Make verification pass if commit hashes match

rpm-ostree deploy-from-self does get us to the right image, but the MCO
doesn't know that because the OSImageURL/Container Name/Custom
Deployment name doesn't get set when it rebases, it just uses the
commit hash.

This tells the MCO to:
- inspect the current image specified by OSImageURL,
- grab its commit hash from the labels
- compare it to the base commit of what we have on-disk.
If they match, we know we are on the correct image, even if we
did not get there the usual way.

pkg/daemon/daemon.go

@@ -64,6 +64,9 @@ type Daemon struct {
 	// bootedOSImageURL is the currently booted URL of the operating system
 	bootedOSImageURL string
 
+	// bootedOScommit is the commit hash of the currently booted operating system
+	bootedOSCommit string
+
 	// kubeClient allows interaction with Kubernetes, including the node we are running on.
 	kubeClient kubernetes.Interface
 
@@ -213,6 +216,7 @@ func New(
 	var (
 		osImageURL string
 		osVersion  string
+		osCommit   string
 		err        error
 	)
 
@@ -231,11 +235,11 @@ func New(
 		if err != nil {
 			return nil, fmt.Errorf("error initializing rpm-ostree: %w", err)
 		}
-		osImageURL, osVersion, err = nodeUpdaterClient.GetBootedOSImageURL()
+		osImageURL, osVersion, osCommit, err = nodeUpdaterClient.GetBootedOSImageURL()
 		if err != nil {
 			return nil, fmt.Errorf("error reading osImageURL from rpm-ostree: %w", err)
 		}
-		glog.Infof("Booted osImageURL: %s (%s)", osImageURL, osVersion)
+		glog.Infof("Booted osImageURL: %s (%s) %s", osImageURL, osVersion, osCommit)
 	}
 
 	bootID := ""
@@ -267,6 +271,7 @@ func New(
 		os:                    hostos,
 		NodeUpdaterClient:     nodeUpdaterClient,
 		bootedOSImageURL:      osImageURL,
+		bootedOSCommit:        osCommit,
 		bootID:                bootID,
 		exitCh:                exitCh,
 		currentConfigPath:     currentConfigPath,
@@ -1872,7 +1877,7 @@ func (dn *Daemon) validateOnDiskState(currentConfig *mcfgv1.MachineConfig) error
 	// Be sure we're booted into the OS we expect
 	osMatch := dn.checkOS(currentConfig.Spec.OSImageURL)
 	if !osMatch {
-		return fmt.Errorf("expected target osImageURL %q, have %q", currentConfig.Spec.OSImageURL, dn.bootedOSImageURL)
+		return fmt.Errorf("expected target osImageURL %q, have %q (%q)", currentConfig.Spec.OSImageURL, dn.bootedOSImageURL, dn.bootedOSCommit)
 	}
 
 	if dn.os.IsCoreOSVariant() {
@@ -1898,6 +1903,20 @@ func (dn *Daemon) checkOS(osImageURL string) bool {
 		return true
 	}
 
+	// TODO(jkyros): the header for this functions says "if the digests match"
+	// so I'm wondering if at one point this used to work this way....
+	// TODO(jkyros): and pulling it just to check is so expensive, skopeo works now
+	// if you use the --no-tags argument (doesn't pull tags) so we should probably just do that
+	inspection, err := imageInspect(osImageURL)
+	if err != nil {
+		glog.Warningf("Unable to check manifest for matching hash: %s", err)
+	} else if ostreeCommit, ok := inspection.Labels["ostree.commit"]; ok {
+		if ostreeCommit == dn.bootedOSCommit {
+			glog.Infof("We are technically in the right image even if the URL doesn't match (%s == %s)", ostreeCommit, osImageURL)
+			return true
+		}
+	}
+
 	return dn.bootedOSImageURL == osImageURL
 }
 

pkg/daemon/rpm-ostree.go

@@ -38,6 +38,7 @@ type RpmOstreeDeployment struct {
 	OSName                  string   `json:"osname"`
 	Serial                  int32    `json:"serial"`
 	Checksum                string   `json:"checksum"`
+	BaseChecksum            string   `json:"base-checksum,omitempty"`
 	Version                 string   `json:"version"`
 	Timestamp               uint64   `json:"timestamp"`
 	Booted                  bool     `json:"booted"`
@@ -68,7 +69,7 @@ type imageInspection struct {
 type NodeUpdaterClient interface {
 	Initialize() error
 	GetStatus() (string, error)
-	GetBootedOSImageURL() (string, string, error)
+	GetBootedOSImageURL() (string, string, string, error)
 	Rebase(string, string) (bool, error)
 	RebaseLayered(string) error
 	IsBootableImage(string) (bool, error)
@@ -169,16 +170,21 @@ func (r *RpmOstreeClient) GetStatus() (string, error) {
 	return string(output), nil
 }
 
-// GetBootedOSImageURL returns the image URL as well as the OSTree version (for logging)
+// GetBootedOSImageURL returns the image URL as well as the OSTree version(for logging) and the ostree commit (for comparisons)
 // Returns the empty string if the host doesn't have a custom origin that matches pivot://
 // (This could be the case for e.g. FCOS, or a future RHCOS which comes not-pivoted by default)
-func (r *RpmOstreeClient) GetBootedOSImageURL() (string, string, error) {
+func (r *RpmOstreeClient) GetBootedOSImageURL() (string, string, string, error) {
 	bootedDeployment, _, err := r.GetBootedAndStagedDeployment()
 	if err != nil {
-		return "", "", err
+		return "", "", "", err
 	}
 
+	// TODO(jkyros): take this out, I just want to see when/why it's empty?
+	j, _ := json.MarshalIndent(bootedDeployment, "", "    ")
+	glog.Infof("%s", j)
+
 	// the canonical image URL is stored in the custom origin field.
+
 	osImageURL := ""
 	if len(bootedDeployment.CustomOrigin) > 0 {
 		if strings.HasPrefix(bootedDeployment.CustomOrigin[0], "pivot://") {
@@ -194,7 +200,15 @@ func (r *RpmOstreeClient) GetBootedOSImageURL() (string, string, error) {
 			osImageURL = tokens[1]
 		}
 	}
-	return osImageURL, bootedDeployment.Version, nil
+
+	// BaseChecksum is populated if the system has been modified in a way that changes the base checksum
+	// (like via an RPM install) so prefer BaseCheksum that if it's present, otherwise just use Checksum.
+	baseChecksum := bootedDeployment.Checksum
+	if bootedDeployment.BaseChecksum != "" {
+		baseChecksum = bootedDeployment.BaseChecksum
+	}
+
+	return osImageURL, bootedDeployment.Version, baseChecksum, nil
 }
 
 func podmanInspect(imgURL string) (imgdata *imageInspection, err error) {

pkg/daemon/update.go

@@ -1922,17 +1922,11 @@ func (dn *Daemon) updateLayeredOS(config *mcfgv1.MachineConfig) error {
 		if err != nil {
 			return err
 		}
-		dn.needSecondaryReboot = true
-		// We'll need to do a second reconciliation pass i.e. an extra reboot today, but that won't
-		// be necessary after we ship the newer rpm-ostree into older releases.
-		// See also https://github.com/coreos/rpm-ostree/issues/4018
-		if err := os.WriteFile(constants.MachineConfigDaemonPersistentForceOnceFile, []byte(""), 0o644); err != nil {
-			return err
-		}
-	} else {
-		if err := dn.NodeUpdaterClient.RebaseLayered(newURL); err != nil {
-			return fmt.Errorf("failed to update OS to %s : %w", newURL, err)
-		}
+
+		// TODO(jkyros): we don't need to do anything special here if I teach rpm-ostree this is the same container
+
+	} else if err := dn.NodeUpdaterClient.RebaseLayered(newURL); err != nil {
+		return fmt.Errorf("failed to update OS to %s : %w", newURL, err)
 	}
 
 	return nil