Module repo 

Composefs repository lifecycle and OCI pull paths.

This module owns how OCI images get into the composefs object store. There are two pull paths, selected by the use_unified flag:

Direct pull (use_unified = false)

pull_composefs_direct fetches from the source transport (registry, OCI dir, etc.) straight into the composefs repo via composefs_oci::pull with default options. No containers-storage involvement.

Unified pull (use_unified = true)

pull_composefs_unified is the two-stage path that populates all three stores (see crate::store for the architecture overview):

Stage 1 — Pull into bootc-owned containers-storage via CStorage::pull_with_progress (or pull_from_host_storage if the image already exists in the default podman store, saving a network round-trip).

Stage 2 — composefs_oci::pull with LocalFetchOpt::ZeroCopy and storage_root pointing at the containers-storage directory. composefs-ctl walks the overlay diff/ directories and FICLONEs each file into the composefs object store keyed by its SHA-512 fsverity digest. On a reflink-capable filesystem this is near-instantaneous and consumes no additional disk space.

The caller provides storage_path as an absolute filesystem path string (not a Dir fd) because composefs-ctl passes it to a child skopeo process. It is derived from the physical root fd via /proc/self/fd/{fd} readlink.

Entry points

• pull_composefs_repo — upgrade/switch on a composefs-booted system.
• initialize_composefs_repository — bootc install with the composefs backend.

Structs

BootImage 🔒

The boot-facing artifacts reconstructed from a pulled OCI image.

InitializedComposefs 🔒

PullRepoResult 🔒

Result of pulling a composefs repository, including the OCI manifest digest needed to reconstruct image metadata from the local composefs repo.

Functions

bootc_tag_for_manifest 🔒

Create a composefs OCI tag name for the given manifest digest.

composefs_repository_config 🔒

Build the repository configuration used by every composefs initialization path. Keeping the fs-verity policy and the dual EROFS format policy here prevents preflight initialization from silently creating a different repository than the real pull path will use.

ensure_composefs_repository 🔒

Open an existing repository without changing its metadata, or create a new one with bootc’s current dual-format configuration.

final_repository_policy 🔒

finalize_fresh_repository_policy 🔒

Replace only the metadata of a repository created by this install. The replacement is generated by composefs-rs itself, so format and feature settings cannot drift from the normal initialization path.

initialize_composefs_repository 🔒

inspect_image_fsverity_policy 🔒

Inspect the image’s fs-verity policy without generating or recovering a boot image. Boot image generation is deferred until the durable repository policy has been finalized and the normal boot setup path runs.

open_composefs_repo 🔒

prepare_boot_image 🔒

Generate the boot image, reconstruct the untransformed filesystem for boot entry discovery, and reconcile the generated digest with a UKI, if present.

pull_composefs_direct 🔒

Pull an image directly into the composefs repository via skopeo.

pull_composefs_repo 🔒

Pulls an image into a composefs repository at /sysroot.

pull_composefs_unified 🔒

Pull an image via unified storage: first into bootc-owned containers-storage, then from there into the composefs repository via cstor (zero-copy reflink/hardlink).

pull_install_composefs_repository 🔒

Pull or import an install image into an initialized composefs repository.

tag_pulled_image 🔒

validate_repository_policy 🔒

Enforce the durable repository policy after inspecting the imported image. Existing metadata is never rewritten: an explicit relaxation only applies to the session that will install the boot artifacts.