Update composefs-rs

Bump our own ocidir and containers-image-proxy pins to match what
composefs-oci now uses, so the dependency graph doesn't end up with
two copies.

Disable composefs-ctl's "ostree" feature for now: it pulls in reqwest
(for remote pulls), which drags in rustls-webpki/untrusted/webpki-root-certs
whose licenses aren't in our cargo-deny allow list. bootc doesn't use
the ostree support in composefs-ctl yet, so just turn it off until the
licensing is sorted out upstream or in our deny.toml.

Signed-off-by: Colin Walters <walters@verbum.org>

Author: cgwalters

Cargo.lock

@@ -44,7 +44,17 @@ clap_mangen = { version = "0.3.0" }
 #   [patch."https://github.com/composefs/composefs-rs"]
 #   composefs-ctl = { path = "/path/to/composefs-rs/crates/composefs-ctl" }
 # The Justfile will auto-detect these and bind-mount them into container builds.
-composefs-ctl = { git = "https://github.com/composefs/composefs-rs", rev = "679a342db28c536d3bfa79a6225a888484a9742e" }
+# The "ostree" feature is disabled for now: it pulls in reqwest (for remote
+# pulls), which drags in rustls-webpki/untrusted/webpki-root-certs whose
+# licenses aren't in our cargo-deny allow list. Re-enable once that's sorted.
+# See: https://github.com/bootc-dev/bootc/pull/2295
+composefs-ctl = { git = "https://github.com/composefs/composefs-rs", rev = "6a34615fcbf9db6845949044be7543ef79a08f0a", default-features = false, features = [
+    "pre-6.15",
+    "pre-6.16",
+    "oci",
+    "containers-storage",
+    "fuse",
+] }
 fn-error-context = "0.2.1"
 futures-util = "0.3"
 hex = "0.4.3"

Cargo.toml

@@ -273,7 +273,7 @@ fn build_overlay_fd(
     fsconfig_set_string(overlayfs.as_fd(), "source", source)?;
     overlayfs_set_fd(overlayfs.as_fd(), "workdir", work.as_fd())?;
     overlayfs_set_fd(overlayfs.as_fd(), "upperdir", upper.as_fd())?;
-    overlayfs_set_lower_and_data_fds(&overlayfs, base.as_fd(), None::<OwnedFd>)?;
+    overlayfs_set_lower_and_data_fds(&overlayfs, base.as_fd(), &[])?;
     fsconfig_create(overlayfs.as_fd())?;
     Ok(fsmount(
         overlayfs.as_fd(),

crates/initramfs/src/lib.rs

@@ -67,7 +67,7 @@ unicode-width = "0.2"
 libsystemd = "0.7"
 linkme = "0.3"
 nom = "8.0.0"
-ocidir = "0.7.0"
+ocidir = "0.8.0"
 schemars = { version = "1.0.4", features = ["chrono04"] }
 serde_ignored = "0.1.10"
 serde_yaml = "0.9.34"

crates/lib/Cargo.toml

@@ -802,7 +802,12 @@ fn write_pe_to_esp(
             // UKI/Addons would always be large enough to be an external object
             anyhow::bail!("File too small to be UKI/Addon")
         }
-        RegularFile::External(id, ..) => std::fs::File::from(repo.open_object(id)?),
+        RegularFile::External(id, ..) | RegularFile::ExternalNoVerity(id, ..) => {
+            std::fs::File::from(repo.open_object(id)?)
+        }
+        RegularFile::Sparse(..) => {
+            anyhow::bail!("Sparse file cannot be a UKI/Addon")
+        }
     };
 
     let mut boot_label: Option<UKIInfo> = None;

crates/lib/src/bootc_composefs/boot.rs

@@ -39,14 +39,14 @@ xshell = { workspace = true, optional = true }
 
 # Crate-specific dependencies
 comfy-table = "7.1.1"
-containers-image-proxy = "0.10.1"
+containers-image-proxy = "0.11.0"
 flate2 = { features = ["zlib"], default-features = false, version = "1.0.20" }
 futures-util = "0.3.13"
 gvariant = "0.5.0"
 indexmap = { version = "2.2.2", features = ["serde"] }
 io-lifetimes = "3"
 libsystemd = "0.7.0"
-ocidir = "0.7.2"
+ocidir = "0.8.0"
 # We re-export this library too.
 ostree = { features = ["v2025_3"], version = "0.20.5" }
 pin-project = "1.0"

crates/ostree-ext/Cargo.toml

@@ -6,6 +6,7 @@ use camino::Utf8Path;
 use cap_std::fs::Dir;
 use cap_std_ext::cap_std;
 use containers_image_proxy::oci_spec::image as oci_image;
+use ocidir::OciRead;
 use std::io::{BufReader, BufWriter};
 
 /// Given an OSTree container image reference, update the detached metadata (e.g. GPG signature)

crates/ostree-ext/src/container/update_detachedmeta.rs

@@ -22,6 +22,7 @@ use fn_error_context::context;
 use gvariant::aligned_bytes::TryAsAligned;
 use gvariant::{Marker, Structure};
 use io_lifetimes::AsFd;
+use ocidir::OciRead;
 use ocidir::cap_std::fs::{DirBuilder, DirBuilderExt as _};
 use ocidir::oci_spec::image::ImageConfigurationBuilder;
 use regex::Regex;

crates/ostree-ext/src/fixture.rs

@@ -13,7 +13,7 @@ use fn_error_context::context;
 use gio::prelude::*;
 use oci_spec::image as oci_image;
 use ocidir::{
-    LayerWriter,
+    LayerWriter, OciRead,
     oci_spec::image::{Arch, Platform},
 };
 use ostree::gio;

crates/ostree-ext/src/integrationtest.rs

@@ -9,6 +9,7 @@ use gvariant::aligned_bytes::TryAsAligned;
 use gvariant::{Marker, Structure};
 use oci_image::ImageManifest;
 use oci_spec::image as oci_image;
+use ocidir::OciRead;
 use ocidir::oci_spec::distribution::Reference;
 use ocidir::oci_spec::image::{Arch, DigestAlgorithm};
 use ostree_ext::chunking::ObjectMetaSized;