Repository navigation
[RFC] feature: Carry sysext and confext images in COSI files - #789
Open
Paco Huelsz (frhuelsz) wants to merge 21 commits into
Open
Paco Huelsz (frhuelsz) wants to merge 21 commits into
Paco Huelsz (frhuelsz) wants to merge 21 commits into
Conversation
Proposes an optional `extensions` section in COSI metadata (revision 1.3) holding `sysexts` and `confexts` arrays. Each entry reuses the existing `ImageFile` object to reference a ZSTD-compressed DDI under `images/extensions/`, plus an optional destination path mirroring the Host Configuration `Extension` object. Covers the metadata schema, tar layout, versioning and forward-compatibility, Trident-side consumption (effective extension set across the extensions, osconfig and selinux subsystems), A/B update and rollback semantics, the Host Configuration interaction, and validation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Azure Pipelines: 1 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
An extension-only change to a COSI changes the metadata hash, which forces an A/B update via ab_update_required() before any subsystem is consulted. Adds an OS content digest recorded in Host Status, and a requested-then-verified Runtime Update path gated on digest equality, with refusal as the only failure mode. Rejects an extension-only COSI variant and records the weaker rollback guarantee of the runtime path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ruction Replaces the OS content digest with a structured summary of the deployed image's metadata, recorded in the Host Status, so Trident can distinguish a partition change from an extension-only change from a no-op, and report which partition differs. Falls back to the current os.image.sha384 comparison where no summary is recorded. Adds the construction requirement: filesystem images are not reproducible, so an extension-only COSI must be built by copying an existing COSI's region images verbatim rather than by rebuilding. An unreproducible build degrades to a redundant A/B update, never a skipped one. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Add a deployed extension inventory in Host Status; the Host Configuration cannot represent bundled extensions, so spec_old does not describe what is deployed. - Give effective entries a source discriminator; update_host_configuration errors when a processed extension has no matching Host Configuration entry, and compressed and raw sha384 values must never be compared against one another. - Record three prerequisite defects: in-place replacement deletes the newly installed image when ID and destination are unchanged; runtime finalize and rollback build their context with image: None so staged payloads must be durable; extension placement is validated against the Host Configuration only and before the COSI is read. - Correct the A/B rollback claim, which held only for Host Configuration entries, and drop the unsupported read-only assertion. - SELinux check must move to a hook running on every servicing type; it sits in configure(), which returns early for runtime updates. - Split metadata-time from payload-time validation; omitted paths cannot be collision-checked statically, and there is no load-time member existence check since tar entries are discovered lazily. - Warn on extension-release ID mismatch only; systemd accepts a VERSION_ID mismatch when SYSEXT_LEVEL matches. - Note that an omission by an older reader does not self-heal, and that a no-op must still persist the accepted image. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Inventory and image summary need current/pending records, mirroring spec/spec_old, or finalize cannot reconstruct the target set and rollback cannot reconstruct the previous one. - Scope the summary comparison to the image's servicing requirement; select_servicing_type still takes the maximum across subsystems, so an extension-only runtime update also requires no other subsystem to need A/B. - Disk streaming places extensions but osconfig returns early on is_stream_image, so the merge units are never enabled. - Replace the blanket verity rejection: the root-verity /etc overlay is backed by var/lib/trident-overlay on an A/B volume, so /etc/extensions is a supported destination on clean install and A/B update. - Stage on the destination filesystem; the fixed /var/lib/extensions/.staging assumes /var is writable and makes cross-filesystem placement non-atomic. - The permitted-directory allow-list is Trident policy, not a format property; keep it out of the schema and cover it in Rust validation tests. - Move the servicing-type request surface out of Open Questions, where it contradicted its listing as a prerequisite. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Include fsType in the deployed image summary; it drives resize decisions, so two images differing only in fsType must not compare equal. - Promotion of pending records follows the servicing type: rebooting servicing reaches *Finalized before reboot and commits only after booting the expected root, so the pending record must survive the reboot and be discarded when the boot check fails. - ManualRollbackChainItem carries only kind, spec, active volume and install index, so it must be extended or manual rollback cannot restore the bundled extension set. - Remove the stale Future Possibility that restated the now-required inventory. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- A manual runtime rollback has neither the target COSI nor the superseded payload, so inventory metadata alone cannot restore a bundled extension. Either retain payloads for the depth of the rollback chain, or refuse the operation; restoring nothing silently is not acceptable. - ManualRollbackRuntime promotes its pending record on completion. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The runtime path was a stated requirement but absent from the exit criteria and marked deferrable in the plan. Add it to the exit criteria and state that step 5 may land separately but is required for the RFC to be complete. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Streaming places extension files but osconfig returns early on is_stream_image, so the merge units are never enabled. Refuse to stream a COSI carrying extensions rather than leaving files that never merge; record enabling the units on a streamed install as follow-up work. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Review findings had been folded in as prose, leaving most points stated once and then re-justified. Cuts about a quarter of the text with no change to any decision, constraint or cited behaviour. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Prose down from 6691 to 3907 words across two passes. Drops the redundant consumer diagram and trims the example to one entry per array. No decision, constraint or cited behaviour changed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep path optional for Trident-managed placement, describe current defaults and the unresolved slotted-policy selection from RFC 0838. Remove repeated rationale while retaining schema, update, rollback and validation rules. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add a required per-entry id matching the DDI's SYSEXT_ID or CONFEXT_ID, with duplicate and mismatch validation. Match extension updates by kind and ID; use the compressed hash to detect replacement. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
List exclusions as bullets and make Image Customizer authoring a separate dependency. Keep the copy-based writer outside this RFC's implementation plan. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep COSI-borne extension changes on the existing A/B path. Remove the image-summary, copy-writer, runtime staging and rollback design from this RFC; record runtime updates as future work. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove the Host Status extension inventory from RFC 789. Make Host Configuration materialization and rollback state a dependency on RFC 838, including a durable source reference and raw DDI hash. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep the archive layout, metadata schema and reader contract. Defer placement, activation, persistence, and other implementation mechanics to downstream work. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Azure Pipelines: 1 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Silent omission by older readers and rollback dependencies on RFC #838 warrant human design review.
No open issues 🎉
What changed in this PR
Proposes COSI 1.3 support for bundled sysext and confext images so extensions can ship with the OS.
Changes:
- Defines extension metadata, tar layout and validation requirements.
- Documents reader compatibility and deployment expectations.
- Delegates placement and persistence to RFC #838.
| File | Description |
|---|---|
| docs/Development/RFCs/0789-cosi-extension-images.md | Adds the bundled-extension RFC and its downstream dependencies. |
Review effort: Balanced
Adapt the COSI anatomy SVG for RFC 0789 with example sysext and confext members, matching ImageFile fields and extension IDs. Embed it alongside the tar layout description. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔍 Description
RFC for COSI 1.3 to carry sysext and confext DDIs as compressed tar members, with
extensions.sysextsandextensions.confextsmetadata. Each entry has a requiredidandImageFile, and an optional destinationpath.🤔 Rationale
OS-coupled extensions can ship and roll out with the OS. The Host Configuration URL route remains available for independent releases.
📝 Checks
git diff --check— passed. No code tests run (RFC only).📌 Follow-ups
🗒️ Notes
Older Trident versions silently omit bundled extensions.