Make ostree container image pull merge commit reproducible#1421
Merged
cgwalters merged 3 commits intobootc-dev:mainfrom Jul 17, 2025
Merged
Make ostree container image pull merge commit reproducible#1421cgwalters merged 3 commits intobootc-dev:mainfrom
ostree container image pull merge commit reproducible#1421cgwalters merged 3 commits intobootc-dev:mainfrom
Conversation
`HashMap` is unordered which means that the conversion to GVariant (and thus its serialization) is not reproducible since the conversion basically just maps to an GVariant array. That in turns means the commit hash itself is not reproducible. All we really need to do is just swap it for a `BTreeMap` since all the types involved here implement ordering.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Filtered files are only determined at the time we import a layer. So if that layer is already imported, we won't have that information available. That in turn means that the metadata is state-dependent, which in turn means that the commit digest is not reproducible. We still want to provide the filtered files warning though. Just make this information part of the LayeredImageState object instead. The obvious downside of that is that now we only get that warning the first time the layer is imported and it's no longer part of the commit object itself. One way to make this more sticky is to attach it to the individual layers' commits instead, and then the merge commit can coalesce them. Related: bootc-dev#1346
jlebon
force-pushed
the
pr/reproducible-pull
branch
from
fc87107 to
073d23a
Compare
cgwalters
reviewed
Jul 17, 2025
This is something that I've wanted many times. There's no easy way from e.g. bash to convert an image ref into the escaped OSTree ref and so it's always awkward to be able to tell what ref/commit was pulled down. Let's just match podman here and add a `--digestfile` switch for this.
jlebon
force-pushed
the
pr/reproducible-pull
branch
from
073d23a to
d47956a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ostree-ext/store: use BTreeMap for merge commit metadata
HashMapis unordered which means that the conversion to GVariant (and thus its serialization) is not reproducible since the conversion basically just maps to an GVariant array. That in turns means the commit hash itself is not reproducible.All we really need to do is just swap it for a
BTreeMapsince all the types involved here implement ordering.ostree-ext/store: don't include filtered files in metadata
Filtered files are only determined at the time we import a layer. So if that layer is already imported, we won't have that information available. That in turn means that the metadata is state-dependent, which in turn means that the commit digest is not reproducible.
We still want to provide the filtered files warning though. Just make this information part of the LayeredImageState object instead. The obvious downside of that is that now we only get that warning the first time the layer is imported and it's no longer part of the commit object itself.
One way to make this more sticky is to attach it to the individual layers' commits instead, and then the merge commit can coalesce them.
Related: #1346