composefs-oci: add support for splitfdstream

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Author: giuseppe

Cargo.toml

@@ -38,6 +38,8 @@ composefs-ioctls = { version = "0.4.0", path = "crates/composefs-ioctls", defaul
 composefs-oci = { version = "0.4.0", path = "crates/composefs-oci", default-features = false }
 composefs-boot = { version = "0.4.0", path = "crates/composefs-boot", default-features = false }
 composefs-http = { version = "0.4.0", path = "crates/composefs-http", default-features = false }
+composefs-splitfdstream = { version = "0.4.0", path = "crates/composefs-splitfdstream", default-features = false }
+splitfdstream = { package = "composefs-splitfdstream", version = "0.4.0", path = "crates/composefs-splitfdstream", default-features = false }
 cap-std-ext = "5.1.2"
 ocidir = "0.7.2"
 

crates/composefs-oci/Cargo.toml

@@ -26,10 +26,12 @@ bytes = { version = "1", default-features = false }
 composefs = { workspace = true }
 zlink-core = { workspace = true, optional = true }
 composefs-boot = { workspace = true, optional = true }
+splitfdstream = { workspace = true }
 containers-image-proxy = { version = "0.10", default-features = false }
 cstorage = { package = "composefs-storage", path = "../composefs-storage", version = "0.4.0", optional = true }
 hex = { version = "0.4.0", default-features = false }
 indicatif = { version = "0.17.0", default-features = false }
+jsonrpc-fdpass = { workspace = true }
 rustix = { version = "1.0.0", features = ["fs"] }
 serde = { version = "1.0", default-features = false, features = ["derive"] }
 thiserror = { version = "2.0.0", default-features = false }

crates/composefs-oci/src/lib.rs

@@ -26,6 +26,7 @@ pub mod oci_layout;
 /// Re-exported from [`composefs::progress`]; use that path directly in new code.
 pub mod progress;
 pub mod skopeo;
+pub mod splitfdstream;
 pub mod tar;
 
 /// Test utilities for building OCI images from dumpfile strings.
@@ -37,6 +38,10 @@ pub mod test_util;
 // Re-export the composefs crate for consumers who only need composefs-oci
 pub use composefs;
 
+pub use splitfdstream::{
+    CompleteImageImportResult, import_complete_image_from_splitfdstream, import_from_splitfdstream,
+};
+
 use std::io::Read;
 use std::{collections::HashMap, sync::Arc};
 

crates/composefs-oci/src/oci_image.rs

@@ -50,9 +50,9 @@ use serde::Serialize;
 
 use composefs::{fsverity::FsVerityHashValue, repository::Repository};
 
-use crate::ContentAndVerity;
 use crate::layer::is_tar_media_type;
 use crate::skopeo::{OCI_BLOB_CONTENT_TYPE, OCI_CONFIG_CONTENT_TYPE, OCI_MANIFEST_CONTENT_TYPE};
+use crate::{ContentAndVerity, sha256_content_digest};
 
 /// Error marker: an OCI reference (tag) does not exist.
 #[derive(Debug, thiserror::Error)]
@@ -682,6 +682,54 @@ pub(crate) fn rewrite_manifest<ObjectID: FsVerityHashValue, S: AsRef<str>>(
     Ok((manifest_digest.clone(), id))
 }
 
+/// Writes a manifest to the repository from raw JSON bytes.
+///
+/// Unlike [`write_manifest`], this preserves the exact JSON bytes from the
+/// original source, avoiding digest mismatches from re-serialization.
+pub fn write_manifest_raw<ObjectID: FsVerityHashValue>(
+    repo: &Arc<Repository<ObjectID>>,
+    manifest_json: &[u8],
+    manifest_digest: &str,
+    config_verity: &ObjectID,
+    layer_verities: &HashMap<Box<str>, ObjectID>,
+    reference: Option<&str>,
+) -> Result<(String, ObjectID)> {
+    let digest: OciDigest = manifest_digest.parse().context("parsing manifest digest")?;
+    let content_id = manifest_identifier(&digest);
+
+    if let Some(verity) = repo.has_stream(&content_id)? {
+        if let Some(name) = reference {
+            tag_image(repo, &digest, name)?;
+        }
+        return Ok((manifest_digest.to_string(), verity));
+    }
+
+    let computed = sha256_content_digest(manifest_json);
+    ensure!(
+        digest == computed,
+        "Manifest digest mismatch: expected {digest}, got {computed}"
+    );
+
+    let manifest: ImageManifest =
+        serde_json::from_slice(manifest_json).context("parsing manifest JSON")?;
+
+    let mut stream = repo.create_stream(OCI_MANIFEST_CONTENT_TYPE)?;
+
+    let config_key = format!("config:{}", manifest.config().digest());
+    stream.add_named_stream_ref(&config_key, config_verity);
+
+    for (diff_id, verity) in layer_verities {
+        stream.add_named_stream_ref(diff_id, verity);
+    }
+
+    stream.write_external(manifest_json)?;
+
+    let oci_ref = reference.map(oci_ref_path);
+    let id = repo.write_stream(stream, &content_id, oci_ref.as_deref())?;
+
+    Ok((manifest_digest.to_string(), id))
+}
+
 /// Checks if a manifest exists.
 pub fn has_manifest<ObjectID: FsVerityHashValue>(
     repo: &Repository<ObjectID>,