first commit

apt-ostree-systemd/apt-ostreed.conf

@@ -0,0 +1,9 @@
+# Entries in this file show the compile time defaults.
+# You can change settings by editing this file.
+# For option meanings, see apt-ostreed.conf(5).
+
+[Daemon]
+#AutomaticUpdatePolicy=none
+#IdleExitTimeout=60
+#LockLayering=false
+#Recommends=true

apt-ostree-systemd/kernel/install.conf

@@ -0,0 +1,4 @@
+# kernel-install will not try to run dracut and allow apt-ostree to
+# take over. Apt-ostree will use this to know that it is responsible
+# to run dracut and ensure that there is only one kernel in the image
+layout=ostree

apt-ostree-systemd/kernel/install.d/05-aptostree.install

@@ -0,0 +1,9 @@
+#!/usr/bin/bash
+# Check if install.conf is missing or does not include layout=ostree
+if [ ! -f /usr/lib/kernel/install.conf ] || ! grep -q layout=ostree /usr/lib/kernel/install.conf; then
+    exit 0
+fi
+# This is the hook that has kernel-install call into apt-ostree kernel-install
+if test -x /usr/bin/apt-ostree; then
+    exec /usr/bin/apt-ostree kernel-install "$@"
+fi

apt-ostree-systemd/org.debian.aptostree1.conf

@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?> <!-- -*- XML -*- -->
+
+<!DOCTYPE busconfig PUBLIC
+  "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+  "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+  <!-- Only root can own the service -->
+  <policy user="root">
+    <allow own="org.debian.aptostree1"/>
+    <allow send_destination="org.debian.aptostree1"/>
+  </policy>
+
+  <!-- Allow anyone to call into the service - we'll reject callers using PolicyKit -->
+  <policy context="default">
+    <deny send_destination="org.debian.aptostree1"/>
+
+    <allow send_destination="org.debian.aptostree1"
+           send_interface="org.freedesktop.DBus.Introspectable"/>
+
+    <allow send_destination="org.debian.aptostree1"
+           send_interface="org.freedesktop.DBus.ObjectManager"/>
+
+    <allow send_destination="org.debian.aptostree1"
+           send_interface="org.freedesktop.DBus.Peer"/>
+
+    <allow send_destination="org.debian.aptostree1"
+           send_interface="org.freedesktop.DBus.Properties"
+           send_member="Get"/>
+
+    <allow send_destination="org.debian.aptostree1"
+           send_interface="org.freedesktop.DBus.Properties"
+           send_member="GetAll"/>
+
+    <allow send_destination="org.debian.aptostree1"
+           send_interface="org.debian.aptostree1.OS"/>
+
+    <allow send_destination="org.debian.aptostree1"
+           send_interface="org.debian.aptostree1.Sysroot"/>
+  </policy>
+</busconfig>

apt-ostree-systemd/systemd/system/apt-ostree-bootstatus.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Log apt-ostree Booted Deployment Status To Journal
+Documentation=man:apt-ostree(1)
+ConditionPathExists=/run/ostree-booted
+
+[Service]
+Type=oneshot
+ExecStart=apt-ostree status -b
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

apt-ostree-systemd/systemd/system/apt-ostree-countme.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Weekly apt-ostree Count Me reporting
+Documentation=man:apt-ostree-countme.service(8)
+ConditionPathExists=/run/ostree-booted
+
+[Service]
+Type=oneshot
+User=apt-ostree
+DynamicUser=yes
+StateDirectory=apt-ostree-countme
+StateDirectoryMode=750
+ExecStart=apt-ostree countme

apt-ostree-systemd/systemd/system/apt-ostree-countme.timer

@@ -0,0 +1,12 @@
+[Unit]
+Description=Weekly apt-ostree Count Me reporting
+Documentation=man:apt-ostree-countme.service(8)
+ConditionPathExists=/run/ostree-booted
+
+[Timer]
+OnCalendar=weekly
+RandomizedDelaySec=1d
+Persistent=true
+
+[Install]
+WantedBy=timers.target

apt-ostree-systemd/systemd/system/apt-ostree-fix-shadow-mode.service

@@ -0,0 +1,25 @@
+[Unit]
+# apt-ostree v2023.6 introduced a permission issue on `/etc/[g]shadow[-]`.
+# This makes sure to fix permissions on systems that were deployed with the wrong permissions.
+Description=Update permissions for /etc/shadow
+Documentation=https://github.com/coreos/rpm-ostree-ghsa-2m76-cwhg-7wv6
+# This new stamp file is written by the Rust code, and obsoletes
+# the old /etc/.apt-ostree-shadow-mode-fixed.stamp
+ConditionPathExists=!/etc/.apt-ostree-shadow-mode-fixed2.stamp
+ConditionPathExists=/run/ostree-booted
+# Filter out non-traditional ostree setups (e.g. live boots)
+ConditionKernelCommandLine=ostree
+# Because we read the sysroot
+RequiresMountsFor=/boot
+# Make sure this is started before any unprivileged (interactive) user has access to the system.
+Before=systemd-user-sessions.service
+
+[Service]
+Type=oneshot
+ExecStart=apt-ostree fix-shadow-perms
+RemainAfterExit=yes
+# So we can remount /sysroot writable in our own namespace
+MountFlags=slave
+
+[Install]
+WantedBy=multi-user.target

apt-ostree-systemd/systemd/system/apt-ostreed-automatic.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=APT-OSTree Automatic Update
+Documentation=man:apt-ostree(1) man:apt-ostreed.conf(5)
+ConditionPathExists=/run/ostree-booted
+
+[Service]
+Type=simple
+ExecStart=apt-ostree upgrade --quiet --trigger-automatic-update-policy

apt-ostree-systemd/systemd/system/apt-ostreed-automatic.timer

@@ -0,0 +1,14 @@
+[Unit]
+Description=APT-OSTree Automatic Update Trigger
+Documentation=man:apt-ostree(1) man:apt-ostreed.conf(5)
+ConditionPathExists=/run/ostree-booted
+After=network-online.target
+Wants=network-online.target
+
+[Timer]
+OnBootSec=1h
+OnUnitInactiveSec=1d
+Persistent=true
+
+[Install]
+WantedBy=timers.target

apt-ostree-systemd/systemd/system/apt-ostreed.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=APT-OSTree System Management Daemon
+Documentation=man:apt-ostree(1)
+ConditionPathExists=/ostree
+RequiresMountsFor=/boot
+
+[Service]
+# See similar code in apt-ostree-countme.service
+User=apt-ostree
+DynamicUser=yes
+# As of right now, our primary API is DBus.  But see also https://github.com/coreos/rpm-ostree/issues/3850
+Type=dbus
+BusName=org.debian.aptostree1
+# To use the read-only sysroot bits
+MountFlags=slave
+# We have no business accessing /var/roothome or /var/home.  In general
+# the ostree design clearly avoids touching those, but since systemd offers
+# us easy tools to toggle on protection, let's use them.  In the future
+# it'd be nice to do something like using DynamicUser=yes for the main service,
+# and have a system apt-ostreed-transaction.service that runs privileged
+# but as a subprocess.
+ProtectHome=true
+NotifyAccess=main
+# Significantly bump this timeout from the default because
+# we do a lot of stuff on daemon startup.
+TimeoutStartSec=5m
+# We start this main process with full privileges; it may spawn unprivileged processes
+# with the apt-ostree user.
+ExecStart=+apt-ostree start-daemon
+ExecReload=apt-ostree reload
+# disable/enable downloading filelists
+Environment="DOWNLOAD_FILELISTS=false"

apt-ostree-systemd/tmpfiles.d/apt-ostree-0-integration-opt-usrlocal-compat.conf

@@ -0,0 +1,5 @@
+# Traditionally, /usr/local has been a link to /var/usrlocal and /opt to /var/opt.
+# A new model now is to allow OSTree commit content in those directories. For
+# backwards compatibility, we keep the /var paths but flip the symlinks around.
+L /var/usrlocal - - - - ../usr/local
+L /var/opt - - - - ../usr/lib/opt

apt-ostree-systemd/tmpfiles.d/apt-ostree-0-integration-opt-usrlocal.conf

@@ -0,0 +1,5 @@
+# Traditionally, /usr/local has been a link to /var/usrlocal and /opt to /var/opt.
+# A new model now is to allow OSTree commit content in those directories. But
+# this dropin implements the old model.
+d /var/opt 0755 root root -
+d /var/usrlocal 0755 root root -

apt-ostree-systemd/tmpfiles.d/apt-ostree-0-integration.conf

@@ -0,0 +1,18 @@
+d /var/home 0755 root root -
+d /var/srv 0755 root root -
+d /var/roothome 0700 root root -
+d /var/mnt 0755 root root -
+d /run/media 0755 root root -
+L /var/lib/dpkg - - - - ../../usr/share/dpkg
+
+# this is normally owned by `filesystem`, but for multiple reasons, this doesn't
+# work in the apt-ostree flow
+d /usr/local/bin 0755 root root -
+d /usr/local/etc 0755 root root -
+d /usr/local/games 0755 root root -
+d /usr/local/include 0755 root root -
+d /usr/local/lib 0755 root root -
+d /usr/local/man 0755 root root -
+d /usr/local/sbin 0755 root root -
+d /usr/local/share 0755 root root -
+d /usr/local/src 0755 root root -