Skip to content

Commit

Permalink
Merge pull request #181 from cgwalters/install-check-sigverify
Browse files Browse the repository at this point in the history
  • Loading branch information
jlebon authored Nov 6, 2023
2 parents 6ebad51 + 95ff32c commit e362eaf
Show file tree
Hide file tree
Showing 3 changed files with 4 additions and 9 deletions.
9 changes: 2 additions & 7 deletions docs/install.md
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ other options.
Here's an example:

```
$ podman run --privileged --pid=host --net=none --security-opt label=type:unconfined_t <image> bootc install --target-no-signature-verification /path/to/disk
$ podman run --privileged --pid=host --security-opt label=type:unconfined_t <image> bootc install --target-no-signature-verification /path/to/disk
```

Note that while `--privileged` is used, this command will not perform any
Expand All @@ -59,11 +59,6 @@ The `--pid=host --security-opt label=type:unconfined_t` today
make it more convenient for bootc to perform some privileged
operations; in the future these requirement may be dropped.

The `--net=none` argument is just to emphasize the fact that
an installation by default is not fetching anything else external
from the network - the content to be installed
*is the running container image content*.

### Operating system install configuration required

The container image must define its default install configuration. For example,
Expand Down Expand Up @@ -195,7 +190,7 @@ support the root storage setup already initialized.
The core command should look like this:

```
$ podman run --privileged -v /:/target --pid=host --net=none --security-opt label=type:install_t \
$ podman run --privileged -v /:/target --pid=host --security-opt label=type:install_t \
<image> \
bootc install-to-filesystem --replace=alongside /target
```
Expand Down
2 changes: 1 addition & 1 deletion lib/src/privtests.rs
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@ fn test_install_filesystem(image: &str, blockdev: &Utf8Path) -> Result<()> {
let mountpoint: &Utf8Path = mountpoint_dir.path().try_into().unwrap();

// And run the install
cmd!(sh, "podman run --rm --privileged --pid=host --net=none --env=RUST_LOG -v /usr/bin/bootc:/usr/bin/bootc -v {mountpoint}:/target-root {image} bootc install-to-filesystem /target-root").run()?;
cmd!(sh, "podman run --rm --privileged --pid=host --env=RUST_LOG -v /usr/bin/bootc:/usr/bin/bootc -v {mountpoint}:/target-root {image} bootc install-to-filesystem /target-root").run()?;

cmd!(sh, "umount -R {mountpoint}").run()?;

Expand Down
2 changes: 1 addition & 1 deletion tests/kolainst/install
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ cd $(mktemp -d)

case "${AUTOPKGTEST_REBOOT_MARK:-}" in
"")
podman run --rm -ti --privileged --pid=host --net=none -v /usr/bin/bootc:/usr/bin/bootc ${IMAGE} bootc install --karg=foo=bar ${DEV}
podman run --rm -ti --privileged --pid=host -v /usr/bin/bootc:/usr/bin/bootc ${IMAGE} bootc install --karg=foo=bar ${DEV}
# In theory we could e.g. wipe the bootloader setup on the primary disk, then reboot;
# but for now let's just sanity test that the install command executes.
lsblk ${DEV}
Expand Down

0 comments on commit e362eaf

Please sign in to comment.