cfs/test: Fix ro /sysroot problem

The `bootc internals cfs` test was running into an issue where pulling
an image into a composefs repository at `/sysroot/composefs` was failing
due to /sysroot being mounted ro. We did remount it rw in an earlier
cmd, but that was in a separate mount ns which did not carry over to the
next commands

Instead of globally remounting /sysroot as rw, we now pass a path to the
`test-composefs` command which initializes a composefs repository at
said path. Also, pass in `--insecure` to `bootc internals cfs ...` as in
the ostree case we're testing in xfs which does not support fs-verity

Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Author: Johan-Liebert1

crates/lib/src/cli.rs

@@ -602,7 +602,12 @@ pub(crate) enum InternalsOpts {
         args: Vec<OsString>,
     },
     /// Ensure that a composefs repository is initialized
-    TestComposefs,
+    TestComposefs {
+        /// The path where to initialize composefs repository
+        /// Will use `/sysroot` if not provided
+        #[clap(long)]
+        path: Option<Utf8PathBuf>,
+    },
     /// Loopback device cleanup helper (internal use only)
     LoopbackCleanupHelper {
         /// Device path to clean up
@@ -1745,10 +1750,10 @@ async fn run_from_opt(opt: Opt) -> Result<()> {
                 )
                 .await
             }
-            InternalsOpts::TestComposefs => {
+            InternalsOpts::TestComposefs { path } => {
                 // This is a stub to be replaced
                 let storage = get_storage().await?;
-                let cfs = storage.get_ensure_composefs()?;
+                let cfs = storage.get_ensure_composefs(path)?;
                 let testdata = b"some test data";
                 let testdata_digest = hex::encode(openssl::sha::sha256(testdata));
                 let mut w = SplitStreamWriter::new(&cfs, 0);

crates/lib/src/store/mod.rs

@@ -30,6 +30,7 @@ use cap_std_ext::cap_std::fs::{
 use cap_std_ext::dirext::CapStdExtDirExt;
 use fn_error_context::context;
 
+use ocidir::cap_std::ambient_authority;
 use ostree_ext::container_utils::ostree_booted;
 use ostree_ext::prelude::FileExt;
 use ostree_ext::sysroot::SysrootLock;
@@ -426,20 +427,35 @@ impl Storage {
     ///
     /// This lazily opens the composefs repository, creating the directory if needed
     /// and bootstrapping verity settings from the ostree configuration.
-    pub(crate) fn get_ensure_composefs(&self) -> Result<Arc<ComposefsRepository>> {
+    pub(crate) fn get_ensure_composefs(
+        &self,
+        opt_path: Option<Utf8PathBuf>,
+    ) -> Result<Arc<ComposefsRepository>> {
         if let Some(composefs) = self.composefs.get() {
             return Ok(Arc::clone(composefs));
         }
 
-        ensure_composefs_dir(&self.physical_root)?;
+        let cfs_root = match opt_path {
+            Some(path) => {
+                let dir = Dir::open_ambient_dir(&path, ambient_authority())
+                    .with_context(|| format!("Opening {path:?}"))?;
+
+                ensure_composefs_dir(&dir)?;
+
+                dir
+            }
+            None => {
+                ensure_composefs_dir(&self.physical_root)?;
+                self.physical_root.try_clone()?
+            }
+        };
 
         // Bootstrap verity off of the ostree state. In practice this means disabled by
         // default right now.
         let ostree = self.get_ostree()?;
         let ostree_repo = &ostree.repo();
         let ostree_verity = ostree_ext::fsverity::is_verity_enabled(ostree_repo)?;
-        let mut composefs =
-            ComposefsRepository::open_path(self.physical_root.open_dir(COMPOSEFS)?, ".")?;
+        let mut composefs = ComposefsRepository::open_path(cfs_root.open_dir(COMPOSEFS)?, ".")?;
         if !ostree_verity.enabled {
             tracing::debug!("Setting insecure mode for composefs repo");
             composefs.set_insecure(true);

tmt/tests/booted/readonly/030-test-composefs.nu

@@ -37,10 +37,13 @@ if $is_composefs {
     bootc internals cfs --help
 } else {
     # When not on composefs, run the full test including initialization
-    bootc internals test-composefs
+    # We use a separate `/sysroot` as we need rw access to the repo which
+    # we can't get from `bootc internals cfs ...`
+    mkdir /var/tmp/sysroot
+    bootc internals test-composefs --path /var/tmp/sysroot
     bootc internals cfs --help
-    bootc internals cfs oci pull docker://busybox busybox
-    test -L /sysroot/composefs/streams/refs/busybox
+    bootc internals cfs --insecure --repo /var/tmp/sysroot/composefs oci pull docker://busybox busybox
+    test -L /var/tmp/sysroot/composefs/streams/refs/oci/busybox
 }
 
 tap ok