WIP: Fallback to running system's auth.json by ckyrouac · Pull Request #1934 · bootc-dev/bootc

ckyrouac · 2026-01-19T17:19:34Z

This fixes a bug where running bootc upgrade/switch to an image that does not have an auth.json results in failing to pull new LBIs that are stored in an authenticated registry.

This also adds a test for this to the existing LBI switch TMT test. It does this by using cstor-dist as an authenticated registry, running on the TMT test VM. Marking as a WIP for now until I push the cstor-dist image somewhere permanent.

gemini-code-assist

Code Review

This pull request introduces a fallback mechanism to use the host's auth.json when pulling images if the target image for an upgrade or switch doesn't contain one. This is a valuable fix for scenarios involving authenticated registries. The core logic change in Rust is sound, and I've offered a minor suggestion to improve its conciseness. The accompanying tests are thorough, effectively validating the new fallback behavior using a local authenticated registry. I've provided a couple of suggestions for the test scripts to enhance maintainability by reducing code duplication.

gemini-code-assist · 2026-01-19T17:23:01Z

crates/lib/src/podstorage.rs

+    let authfile = if let Some((path, file)) = ostree_ext::globals::get_global_authfile(sysroot)? {
+        tracing::debug!("Using authfile from sysroot: {path}");
+        Some(file)
+    } else if let Some((path, file)) = get_host_authfile()? {
+        tracing::debug!("Using authfile from host root: {path}");
+        Some(file)
+    } else {
+        None
+    };


This if let ... else if let ... chain can be simplified by combining the fallback logic into a single else block, which makes the code slightly more concise.

Suggested change

let authfile = if let Some((path, file)) = ostree_ext::globals::get_global_authfile(sysroot)? {

tracing::debug!("Using authfile from sysroot: {path}");

Some(file)

} else if let Some((path, file)) = get_host_authfile()? {

tracing::debug!("Using authfile from host root: {path}");

Some(file)

} else {

None

};

let authfile = if let Some((path, file)) = ostree_ext::globals::get_global_authfile(sysroot)? {

tracing::debug!("Using authfile from sysroot: {path}");

Some(file)

} else {

get_host_authfile()?.map(|(path, file)| {

tracing::debug!("Using authfile from host root: {path}");

file

})

};

gemini-code-assist · 2026-01-19T17:23:01Z

tmt/tests/booted/test-logically-bound-switch.nu

+    let more_images = [
+        { "bound": true, "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.4", "name": "ubi-minimal" },
+        { "bound": true, "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.3", "name": "ubi-minimal-9-3" },
+        { "bound": false, "image": "quay.io/centos-bootc/centos-bootc:stream9", "name": "centos-bootc" },
+        { "bound": true, "image": $"($CSTOR_DIST_REGISTRY)/docker.io/library/alpine:latest", "name": "cstor-alpine" },
+        { "bound": true, "image": $"($CSTOR_DIST_REGISTRY)/docker.io/library/busybox:latest", "name": "cstor-busybox" }
+    ]


To improve readability and reduce repetition, you can define more_images by appending to the existing $images list, which is defined just a few lines above. This approach is more concise and consistent with how this variable was constructed before this change.

let more_images = $images | append [ { "bound": true, "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.3", "name": "ubi-minimal-9-3" }, { "bound": true, "image": $"($CSTOR_DIST_REGISTRY)/docker.io/library/busybox:latest", "name": "cstor-busybox" } ]

gemini-code-assist · 2026-01-19T17:23:01Z

tmt/tests/booted/test-logically-bound-switch.nu

    let images = [
        { "bound": true, "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.4", "name": "ubi-minimal" },
        { "bound": true, "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.3", "name": "ubi-minimal-9-3" },
-        { "bound": false, "image": "quay.io/centos-bootc/centos-bootc:stream9", "name": "centos-bootc" }
+        { "bound": false, "image": "quay.io/centos-bootc/centos-bootc:stream9", "name": "centos-bootc" },
+        { "bound": true, "image": $"($CSTOR_DIST_REGISTRY)/docker.io/library/alpine:latest", "name": "cstor-alpine" },
+        { "bound": true, "image": $"($CSTOR_DIST_REGISTRY)/docker.io/library/busybox:latest", "name": "cstor-busybox" }
    ]


This list of images is identical to the more_images list defined in second_boot. To avoid this duplication and improve maintainability, consider extracting this list into a shared helper function or constant that can be used in both places.

For example, you could add a helper function:

def get_final_images [] { [ { "bound": true, "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.4", "name": "ubi-minimal" }, { "bound": true, "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.3", "name": "ubi-minimal-9-3" }, { "bound": false, "image": "quay.io/centos-bootc/centos-bootc:stream9", "name": "centos-bootc" }, { "bound": true, "image": $"($CSTOR_DIST_REGISTRY)/docker.io/library/alpine:latest", "name": "cstor-alpine" }, { "bound": true, "image": $"($CSTOR_DIST_REGISTRY)/docker.io/library/busybox:latest", "name": "cstor-busybox" } ] }

Then you could use let more_images = get_final_images in second_boot and let images = get_final_images here.

cgwalters · 2026-01-20T18:58:19Z

crates/lib/src/podstorage.rs

    // We always override the auth to match the bootc setup.
-    let authfile_fd = ostree_ext::globals::get_global_authfile(sysroot)?.map(|v| v.1);
-    if let Some(mut fd) = authfile_fd {
+    // First try to get the authfile from the sysroot (e.g., upgrade image), and if not found,


I had a long thing where I wanted to use the term "sysroot" for "physical root" but we're not doing that consistently.

Anyways I think this comment is wrong because it shouldn't be the new image - we basically (AFAIK) never look at the new container's root during an upgrade or other operation.

IOW I think this is probably a bug in get_global_authfile

cgwalters · 2026-01-20T18:58:55Z

tmt/tests/booted/bootc_testlib.nu

+# cstor-dist configuration for authenticated registry testing
+# cstor-dist serves images from containers-storage via an authenticated OCI registry endpoint
+# https://github.com/ckyrouac/cstor-dist
+const CSTOR_DIST_IMAGE = "ghcr.io/ckyrouac/cstor-dist:latest"


I'd probably be good moving cstor-dist into the bootc-dev org

cgwalters · 2026-01-20T19:00:18Z

tmt/tests/booted/bootc_testlib.nu

+
+    # Run cstor-dist container with auth enabled
+    # Mount the local containers storage so cstor-dist can serve images from it
+    let storage_path = if ("/var/lib/containers/storage" | path exists) {


This can be done by querying the .graphRoot parameter from podman system info we have some code for this

This fixes a bug where running bootc upgrade/switch to an image that does not have an auth.json results in failing to pull new LBIs that are stored in an authenticated registry. Signed-off-by: ckyrouac <ckyrouac@redhat.com>

Add reusable functions for running cstor-dist, a tool that serves images from containers-storage via an authenticated OCI registry endpoint. This enables testing authenticated logically bound images. The following functions are exported: - start_cstor_dist: Starts cstor-dist container with basic auth - get_cstor_auth: Returns registry address and base64-encoded credentials - setup_insecure_registry: Configures registries.conf.d for non-TLS access - setup_system_auth: Sets up /run/ostree/auth.json with credentials Also update test-logically-bound-switch.nu to: - Import get_cstor_auth from bootc_testlib.nu - Add --with-auth flag to build_image for baking auth.json into images - Fix verify_images to check if image name is IN the Names array (not exact match) to support images with multiple tags Assisted-by: Claude Code (claude-opus-4-5@20251101) Signed-off-by: ckyrouac <ckyrouac@redhat.com>

Extend the logically bound images switch test to verify that authenticated bound images work correctly in two scenarios: 1. Auth credentials baked into the image itself (/etc/ostree/auth.json) 2. Auth credentials on the running system (/run/ostree/auth.json) The test uses cstor-dist to serve images from containers-storage via an authenticated OCI registry endpoint. On first boot, an image with auth baked in is switched to. On second boot, the test upgrades to a new image WITHOUT baked-in auth, forcing the use of the fallback system auth file. This validates the auth fallback fix. Test images: - cstor-alpine: authenticated LBI pulled on first switch - cstor-busybox: authenticated LBI added on upgrade (tests fallback) Assisted-by: Claude Code (claude-opus-4-5@20251101) Signed-off-by: ckyrouac <ckyrouac@redhat.com>

bootc-bot bot requested a review from jeckersb January 19, 2026 17:20

gemini-code-assist bot reviewed Jan 19, 2026

View reviewed changes

cgwalters requested changes Jan 20, 2026

View reviewed changes

ckyrouac force-pushed the lbi-upgrade branch from 66fa1c2 to 47ead61 Compare January 22, 2026 19:23

github-actions bot added the area/install Issues related to `bootc install` label Jan 22, 2026

ckyrouac added 3 commits January 23, 2026 09:53

podstorage: Fallback to running system's auth.json

03ab934

This fixes a bug where running bootc upgrade/switch to an image that does not have an auth.json results in failing to pull new LBIs that are stored in an authenticated registry. Signed-off-by: ckyrouac <ckyrouac@redhat.com>

ckyrouac force-pushed the lbi-upgrade branch from 47ead61 to 89fcf4c Compare January 23, 2026 14:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WIP: Fallback to running system's auth.json#1934

WIP: Fallback to running system's auth.json#1934
ckyrouac wants to merge 3 commits intobootc-dev:mainfrom
ckyrouac:lbi-upgrade

ckyrouac commented Jan 19, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Jan 19, 2026

Uh oh!

gemini-code-assist bot Jan 19, 2026

Uh oh!

gemini-code-assist bot Jan 19, 2026

Uh oh!

cgwalters Jan 20, 2026

Uh oh!

cgwalters Jan 20, 2026

Uh oh!

cgwalters Jan 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ckyrouac commented Jan 19, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

cgwalters Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

cgwalters Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

cgwalters Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants