Package: ostree-push
ostree-pushBackgroundostree-pushusessshto push commits from a local OSTree repo to a
remote OSTree repo. This is to fill a gap where currently you can only
pull commits in core ostree. To publish commits to a remote repository,
you either have topullfrom the local repo to the remote repo or use
an out of band mechanism likersync.Both approaches have significant limitations. To pull over the network,
only http is supported. So, in addition to having to login on the remote
machine and runostree pull, the local repository needs to be served
over http. This means your build machine needs to be an http server with
appropriate configuration in addition to simply making commits. This
pushes the builds to be done on the public repository server, which
prevents reasonable separation of duties and makes multiarch
repositories impossible.Usingrsyncfor publishing has some major benefits since only updated
objects are published. However, it has no concept of the OSTree object
store or refs structures. There are a few problems deriving from this
issue. First, objects are published in sort order, but this means that
objects can be published before their children. In the most extreme
case, a commit object could be published before it's complete. The
remote repo would assume this commit object was valid even though some
children might be missing. Second, the refs might get updated before the
commit objects are in place. If a client pulls whilersyncis
publishing, it may attempt to pull an incomplete or entirely missing
commit. Finally,rsyncwill push the objects directly into the store
rather than using a staging directory likepullorcommitdo. Ifrsyncis interrupted, it could leave partial objects in the store.ostree-pushtries to offer functionality likegitwhere commits can
be pushed oversshto avoid these issues.OperationWhenostree-pushis started, it first starts a local HTTP server
providing the contents of the local ostree repo. It then connects to the
remote host withsshand tunnels the HTTP server port through the SSH
connection. Finally, it runsostree-receiveon the remote host with
the URL of the tunneled HTTP server.ostree-receivethen creates a
temporary remote using this URL and pulls the desired refs from it.In essence,ostree-pushandostree-receivecoordinate to pull from
the local repo to a remote repo while avoiding the limitations described
above. Namely, no HTTP server needs to be running and no port needs to
be exposed on the local host. Both resources are created temporarily and
only exposed to the remote host through the secure SSH connection.InstallationUsepipto install theotpushpackage and theostree-pushandostree-receivescripts. From a git checkout, run:pip install .Ifostree-receiveis not in a defaultPATHlocation, it may not be
located when run in the environment spawned by the SSH server. As a
workaround, make a symbolic link in a standard location:sudo ln -s /path/to/ostree-receive /usr/bin/ostree-receiveIn order to restrict SSH usage to only runningostree-receive, theostree-receive-shellscript can be used as a login shell. This way
someone with SSH access to the remote machine cannot run arbitrary
commands as the user owning the repositories. To use it, set the login
shell of the repo owner toostree-receive-shell:sudo chsh -s /path/to/ostree-receive-shell <user>ostree-receive-shellwill also append the directory it's installed in
toPATHto allowostree-receiveto be found in non-standard
locations. In that scenario, the symbolic link toostree-receivedescribed above is not needed.Bothostree-pushandostree-receiverequire the OSTree GObject
Introspection bindings. Typically these would be installed from the host
distro. On Debian systems the package isgir1.2-ostree-1.0while on
RedHat systems they are in theostree-libspackage.ostree-pushrelies on the connection sharing and port forwarding
features of OpenSSH and is unlikely to work with another SSH client.
Similarly,ostree-receivehas only be tested with the OpenSSH server,
but it might work correctly with other SSH servers.Configurationostree-receivecan be configured from YAML formatted files. It will
load~/.config/ostree/ostree-receive.confand/etc/ostree/ostree-receive.confor a file specified in theOSTREE_RECEIVE_CONFenvironment variable. See the exampleostree-receive.conffile for available options.TestingA test suite is provided usingpytest. Most of the time simply
runningpytestfrom a git checkout will run it correctly.toxcan also be used to automate running the test suite in a prepared Python
environment.In addition to theostree-pushdependencies, many of the tests depend
on using OpenSSHsshdlocally. On both Debian and RedHat systems this
is available in theopenssh-serverpackage.