[jeckersb]

Do not merge. This points bootc at an unreleased composefs-rs branch to run it through the full CI integration suite.

• composefs-rs PR: fsverity: Enable verity through an isolated helper, fixing the fork race composefs/composefs-rs#447
• Design issue: Revisit fsverity enablement composefs/composefs-rs#442

What it tests

composefs/composefs-rs#447 makes composefs-rs create objects through an FsVerityHelper, a thread pool with a private file descriptor table. A child forked by another thread can then never hold a writable fd to a new object, which used to make FS_IOC_ENABLE_VERITY fail with ETXTBSY. It also deprecates enable_verity_with_retry and enable_verity_maybe_copy.

Changes here

• Cargo.toml / Cargo.lock: a temporary [patch.crates-io] for all composefs crates, pinned to the PR's head commit on jeckersb/composefs-rs.
• ostree-ext/src/fsverity.rs: enabling fs-verity on existing ostree objects now uses enable_verity_raw instead of the deprecated retry. Verity has to go on the existing inode, and nothing should still have it open for writing. If CI hits FileOpenedForWrite here, we'll revisit.

Nothing else in bootc needed to change: it writes objects through composefs_oci::pull, which picks up the helper automatically.

Local testing

• Passing: cargo fmt --check, cargo test --no-run, the --no-default-features checks and cargo doc -D warnings.
• cargo clippy with the CI config reports one error, in tests-integration/src/container.rs (untouched).
• Unit tests: 380 pass. Three aboot tests fail, and fail the same way on main in my environment (permission denied).

Generated-by: AI
The changes are LLM-generated; I reviewed the diff.

[Copilot]

🟡 Changes recommended

The eight patched crates use a Git fork absent from deny.toml’s allowlist, causing the CI cargo-deny source check to reject them.

1 open issue

• Allow the patched composefs-rs Git source in cargo-deny · New

What changed in this PR

This intentionally non-mergeable PR tests the unreleased composefs-rs fs-verity helper through bootc’s CI integration suite.

Changes:

• Temporarily pin eight composefs crates to the helper implementation’s Git commit.
• Replace deprecated retry-based fs-verity enabling for existing OSTree objects with the raw API, handling already-enabled objects and adding error context.

File	Description
crates/​ostree-ext/​src/​fsverity.rs	Use raw fs-verity enabling on existing object inodes.
Cargo.toml	Add temporary Git patches for eight composefs crates.
Cargo.lock	Lock patched crates to the test commit and record the added libc dependency.

_{Review effort: Balanced}