cfsctl: Fix seal to update tag, improve verify and inspect UX

Three fixes based on user walkthrough feedback:

1. oci seal now creates a new manifest referencing the sealed config
   and updates the tag, so oci images correctly shows sealed: yes.
   Previously seal created an orphaned config that nothing referenced.

2. oci verify without --cert now prints a clear warning that only
   digest matching was performed and signatures were not cryptographically
   verified, with guidance to use --cert.

3. oci inspect referrers now include artifactType alongside the digest,
   so users can see what kind of referrer each entry is (e.g.
   application/vnd.composefs.erofs-alongside.v1 for composefs artifacts).

Assisted-by: OpenCode (Claude claude-opus-4-6)

Author: cgwalters

crates/cfsctl/src/lib.rs

@@ -779,11 +779,8 @@ where
             }
             OciCommand::Seal { ref image } => {
                 let repo = Arc::new(repo);
-                let img = composefs_oci::OciImage::open_ref(&repo, image)?;
-                let config_digest = img.config_digest().to_string();
-                let (digest, verity) = composefs_oci::seal(&repo, &config_digest, None)?;
-                println!("config {digest}");
-                println!("verity {}", verity.to_id());
+                let manifest_digest = composefs_oci::seal_image(&repo, image)?;
+                println!("Sealed {image} -> {manifest_digest}");
             }
             OciCommand::Mount {
                 ref name,
@@ -1062,6 +1059,9 @@ where
 
                 if verifier.is_some() {
                     println!("\nVerification passed ({verified_count} signatures verified)");
+                } else {
+                    println!("\nDigest check passed. NOTE: no certificate provided, signatures were NOT cryptographically verified.");
+                    println!("To verify signatures, use: cfsctl oci verify {image} --cert <certificate.pem>");
                 }
             }
             OciCommand::Push {

crates/composefs-oci/src/lib.rs

@@ -43,8 +43,8 @@ pub use image::{
 pub use oci_image::{
     add_referrer, export_image_to_oci_layout, export_referrers_to_oci_layout, layer_dumpfile,
     layer_info, layer_tar, list_images, list_referrers, list_refs, remove_referrer,
-    remove_referrers_for_subject, resolve_ref, tag_image, untag_image, ImageInfo, LayerInfo,
-    OciImage, SplitstreamInfo, OCI_REF_PREFIX,
+    remove_referrers_for_subject, resolve_ref, seal_image, tag_image, untag_image, ImageInfo,
+    LayerInfo, OciImage, SplitstreamInfo, OCI_REF_PREFIX,
 };
 pub use skopeo::pull_image;
 

crates/composefs-oci/src/oci_image.rs

@@ -38,11 +38,13 @@
 //! This module handles both transparently. Use `is_container_image()` to check.
 
 use std::collections::{HashMap, HashSet};
+use std::str::FromStr;
 use std::sync::Arc;
 
 use anyhow::{ensure, Context, Result};
 use containers_image_proxy::oci_spec::image::{
-    Descriptor, ImageConfiguration, ImageManifest, MediaType,
+    Descriptor, DescriptorBuilder, Digest as OciDigest, ImageConfiguration, ImageManifest,
+    ImageManifestBuilder, MediaType,
 };
 use rustix::fs::{openat, readlinkat, unlinkat, AtFlags, Dir, Mode, OFlags};
 use rustix::io::Errno;
@@ -389,7 +391,15 @@ impl<ObjectID: FsVerityHashValue> OciImage<ObjectID> {
 
         let referrers_value: Vec<serde_json::Value> = referrers
             .iter()
-            .map(|(digest, _verity)| serde_json::json!({ "digest": digest }))
+            .map(|(digest, verity)| {
+                let mut entry = serde_json::json!({ "digest": digest });
+                if let Ok(referrer_img) = OciImage::open(repo, digest, Some(verity)) {
+                    if let Some(artifact_type) = referrer_img.manifest().artifact_type() {
+                        entry["artifactType"] = serde_json::json!(artifact_type.to_string());
+                    }
+                }
+                entry
+            })
             .collect();
 
         Ok(serde_json::json!({
@@ -599,6 +609,76 @@ pub fn write_manifest<ObjectID: FsVerityHashValue>(
     Ok((manifest_digest.to_string(), id))
 }
 
+/// Seals an image by tag: creates a sealed config, a new manifest referencing it,
+/// and updates the tag to point to the new manifest.
+///
+/// This is the complete seal workflow. It:
+/// 1. Opens the image by tag to get the original manifest and layer refs
+/// 2. Calls `seal()` to create a config with the fsverity label
+/// 3. Builds a new manifest referencing the sealed config (same layers)
+/// 4. Stores the new manifest and updates the tag
+///
+/// Returns the new manifest digest.
+pub fn seal_image<ObjectID: FsVerityHashValue>(
+    repo: &Arc<Repository<ObjectID>>,
+    name: &str,
+) -> Result<String> {
+    let img = OciImage::open_ref(repo, name)?;
+    ensure!(
+        img.is_container_image(),
+        "Can only seal container images, not artifacts"
+    );
+
+    let config_digest = img.config_digest().to_string();
+    let (sealed_config_digest, sealed_config_verity) =
+        crate::seal(repo, &config_digest, None)?;
+
+    // Build a new config descriptor for the sealed config
+    let sealed_config_json = {
+        let config_id = crate::config_identifier(&sealed_config_digest);
+        let (data, _) = read_external_splitstream(
+            repo,
+            &config_id,
+            Some(&sealed_config_verity),
+            Some(OCI_CONFIG_CONTENT_TYPE),
+        )?;
+        data
+    };
+
+    let new_config_descriptor = DescriptorBuilder::default()
+        .media_type(MediaType::ImageConfig)
+        .digest(
+            OciDigest::from_str(&sealed_config_digest)
+                .context("parsing sealed config digest")?,
+        )
+        .size(sealed_config_json.len() as u64)
+        .build()
+        .context("building config descriptor")?;
+
+    // Build new manifest with same layers but sealed config
+    let new_manifest = ImageManifestBuilder::default()
+        .schema_version(2u32)
+        .media_type(MediaType::ImageManifest)
+        .config(new_config_descriptor)
+        .layers(img.manifest().layers().to_vec())
+        .build()
+        .context("building sealed manifest")?;
+
+    let new_manifest_json = new_manifest.to_string()?;
+    let new_manifest_digest = hash(new_manifest_json.as_bytes());
+
+    write_manifest(
+        repo,
+        &new_manifest,
+        &new_manifest_digest,
+        &sealed_config_verity,
+        img.layer_refs(),
+        Some(name),
+    )?;
+
+    Ok(new_manifest_digest)
+}
+
 /// Checks if a manifest exists.
 pub fn has_manifest<ObjectID: FsVerityHashValue>(
     repo: &Repository<ObjectID>,

crates/integration-tests/src/tests/podman.rs

@@ -136,11 +136,11 @@ fn test_podman_build_seal_sign_verify() -> Result<()> {
     )
     .read()?;
 
-    // 3. Seal — produces a new config with fsverity digest baked in
+    // 3. Seal — creates sealed config + new manifest, updates the tag
     let seal_output = cmd!(sh, "{cfsctl} --insecure --repo {repo} oci seal test-podman").read()?;
     assert!(
-        seal_output.contains("config") && seal_output.contains("verity"),
-        "expected config/verity in seal output, got: {seal_output}"
+        seal_output.contains("Sealed") && seal_output.contains("sha256:"),
+        "expected sealed manifest digest in seal output, got: {seal_output}"
     );
 
     // 4. Sign

crates/integration-tests/src/tests/signing.rs

@@ -195,6 +195,10 @@ fn test_verify_without_cert() -> Result<()> {
         verify_output.contains("digest matches"),
         "expected digest-only verification, got: {verify_output}"
     );
+    assert!(
+        verify_output.contains("no certificate provided"),
+        "expected warning about missing certificate, got: {verify_output}"
+    );
     Ok(())
 }
 integration_test!(test_verify_without_cert);
@@ -710,7 +714,7 @@ fn test_inspect_shows_referrer_info() -> Result<()> {
         "expected at least one referrer after signing"
     );
 
-    // Each referrer should have a digest field
+    // Each referrer should have a digest field and artifactType
     for referrer in referrers {
         let digest = referrer["digest"]
             .as_str()
@@ -719,6 +723,13 @@ fn test_inspect_shows_referrer_info() -> Result<()> {
             digest.starts_with("sha256:"),
             "referrer digest should start with sha256:, got: {digest}"
         );
+        let artifact_type = referrer["artifactType"]
+            .as_str()
+            .expect("expected artifactType field in referrer");
+        assert!(
+            !artifact_type.is_empty(),
+            "artifactType should not be empty"
+        );
     }
 
     Ok(())