Tests for unsealed composefs UKI

[Johan-Liebert1]

No description provided.

[gemini-code-assist]

Code Review

This pull request introduces support for Unified Kernel Images (UKIs) within the composefs framework, including tools for sealing and finalizing UKIs and a new dumpfile_path option for the ukify command. It also adds a missing_verity_allowed flag to track and display fs-verity enforcement status in bootc status. The integration test suite is significantly updated with a new composefs garbage collection test for UKIs and a helper function to wrap container builds for UKI environments. Feedback focuses on improving maintainability by combining conditional package installations in the Dockerfile and refactoring repetitive logic in the new UKI test scripts into helper functions.

[gemini-code-assist]

This test file has some repeated logic that could be refactored into helper functions to improve maintainability and readability.

1. EFI Mount Setup: The commands to create and mount the EFI directory are repeated in second_boot, third_boot, fourth_boot, and fifth_boot.

   def setup_efi_mount [] {
       mkdir /var/tmp/efi
       mount /dev/disk/by-partlabel/EFI-SYSTEM /var/tmp/efi
   }

2. Image Build and Switch: The logic for building a new container image and switching to it is also duplicated.

   def build_and_switch [name: string, content: string] {
       mut containerfile = $"
           FROM localhost/bootc as base
           ($content)
       "
       $containerfile = (tap build_uki_img $containerfile)
       echo $containerfile | podman build -t $"localhost/bootc-($name)" . -f -
       bootc switch --transport containers-storage $"localhost/bootc-($name)"
   }

By using these helpers, the boot stage functions would become much cleaner and more focused on their specific assertions.

[Johan-Liebert1]

Centos10 seems to be failing with

Copr repo for continuous owned by @CoreOS        61 kB/s |  24 kB     00:00    
No match for argument: bootupd-0.2.32.43.g38208d3
Error: Unable to find a match: bootupd-0.2.32.43.g38208d3
Error: building at STEP "RUN --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp --mount=type=bind,from=src,src=/src/hack,target=/run/hack <<-EOF": while running runtime: exit status 1

Edit: #2145 fixes this

[Johan-Liebert1]

Okay, since this modifies /etc and /var, it updates mtimes for both and there is a digest mismatch in the UKI vs when we pull the image in the composefs repo. The following is a reproducible example

FROM alpine AS rootfs
RUN touch /etc/new-file

FROM rootfs AS layer1
RUN stat /etc > /var/etc-stat

FROM rootfs AS layer2
COPY --from=layer1 /var/etc-stat /var/etc-stat
RUN stat /etc > /var/etc-stat-final-layer

This is probably an overlayfs thing and not something to do with builders and both docker and podman run into this

[Johan-Liebert1]

This might not be correct, but the mtime might be different due to the time diff in creating these layers? The time diff here is in millis so that's my guess

/var # cat etc-stat
  File: /etc
  Size: 22              Blocks: 8          IO Block: 4096   directory
Device: 58h/88d Inode: 10047352    Links: 1
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2026-04-17 11:12:32.773615603 +0000
Modify: 2026-04-17 11:12:33.259270681 +0000
Change: 2026-04-17 11:12:33.259270681 +0000

/var # cat etc-stat-final-layer 
  File: /etc
  Size: 22              Blocks: 8          IO Block: 4096   directory
Device: 58h/88d Inode: 10047352    Links: 1
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2026-04-17 11:12:32.773615603 +0000
Modify: 2026-04-17 11:12:33.486824455 +0000
Change: 2026-04-17 11:12:33.486824455 +0000

In my actual testing with a UKI image, the diff was this

5c5
< /etc 0 40755 94 0 0 0 1776409773.0 - - - security.selinux=system_u:object_r:etc_t:s0
---
> /etc 0 40755 94 0 0 0 1776409786.0 - - - security.selinux=system_u:object_r:etc_t:s0
55015c55015
< /var 0 40755 7 0 0 0 1776409756.0 - - - security.selinux=system_u:object_r:var_t:s0
---
> /var 0 40755 7 0 0 0 1776409786.0 - - - security.selinux=system_u:object_r:var_t:s0