Ironically, we weren't actually verifying signatures on the rpm-sequoia
rpm we got from the CentOS repo...
Let's make sure to do that.
Assisted-by: Pi (Claude Opus 4.6)
It's silly right now how chunkah tars up an ocidir, but the primary
way this is consumed is by the containers stack, which will immediately
untar it back to consume it.
We can't avoid this in the `podman run | podman load` flow, but we can
in the Containerfile flow by simply leaving the output as an ocidir, and
then using `FROM oci:` instead of `FROM oci-archive:`.
To expose this, add support for transport prefixes on the argument
passed to `--output`; `oci:PATH` writes the OCI directory layout
directly to disk, while `oci-archive:PATH` or `PATH` preserves the
existing behavior.
Update `Containerfile.splitter` and docs to use the new format. And of
course, update the chunkah image build itself to use this!
Anyone using chunkah from a Containerfile is encouraged to switch over
to this. The efficiency gains are non-trivial. E.g. for the fedora-bootc
image, this roughly cuts in half the "handover time" from chunkah to
buildah.
Closes: #103
Assisted-by: Pi (Claude Opus 4.6)
Currently, to split el10 images correctly, one needs to use a chunkah
image built from el10 so that rpm can read PQC signatures in the rpmdb
(because Fedora's rpm-sequoia doesn't support PQC yet).
We could switch the base image to c10s or UBI10 or provide separate
images, but I don't like any of those options. But I do want a good
OOTB experience.
So for now just temporarily hack this up by installing rpm-sequoia
from c10s on top of the Fedora base since it's ABI-compatible. If this
breaks before Fedora gains PQC support, we can re-evaluate the other
options.
Assisted-by: Pi (Claude Opus 4.6)
I hit this weird issue running benchmarks between two different
worktrees to compare their results and the chunkah from one worktree
ended up being reused by the benchmark for another tree.
I think this is basically the consequence of (1) using a shared cache
for the cargo target dir, and (2) cargo using mtime for freshness which
can be wrong (e.g. a worktree with older timestamps than the one that
was last built would not trigger a rebuild).
Fix this by making the cache name unique to the workdir.
I want the chunkah image to have layer annotations both to show it as an
example, but also for a self test I'm writing.
Rework the Containerfile to use `--config-str` instead of adding
directives in the final stage so that we leave it as a plain `FROM
oci-archive:`.
To not break the `--no-chunk` flow, repeat config directly in the rootfs
stage and switch `--no-chunk` to just translate to `--target rootfs`.
I want to add a self-test which inspects the chunkah image itself and
sanity-checks some components but right now the WAL files from those dbs
are making it hackier to special-case bigfiles.
And plus it's just cleaner.
I thought early on we would grow a dep on skopeo, but we've avoided it
so far, so just drop it for now to make our images smaller.
Assisted-by: Claude Opus 4.6
One annoying thing about Rust packaging is that it's very easy to miss
when you're bundling what is normally distributed as a shared library.
We almost always want to avoid that. We avoided it for openssl, but we
need the same treatment for zlib.
