switch: Add --target-imgref to Support a separate update image reference by HarshwardhanPatil07 · Pull Request #2603 · bootc-dev/bootc

HarshwardhanPatil07 · 2026-10-30T09:36:23Z

Adds --target-imgref to bootc switch for OSTree and composefs, allowing an image to be downloaded from a temporary source while keeping a different registry for future updates.

Manually verified composefs UKI switching, repeated switches, and reboot with the previous deployment available for rollback. Verified OSTree download-only staging and both references in its .origin file.

Fixes #2464

Copilot

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

Copilot

🟡 Changes recommended

Unresolved issues can misidentify image sources, lose or strand pending origin changes, and break addon activation, unified-store updates, or soft-reboot behavior.

9 open issues

_{Review effort: Balanced}

Johan-Liebert1

Not a full review yet

Johan-Liebert1 · 2026-11-02T05:56:39Z

+            .booted
+            .as_ref()
+            .context("No booted deployment")?;
+        if booted.require_composefs()?.verity != self.deployment


when will this not be true? afaics, we're only ever setting OriginChange::deployment to the booted depl verity

it is always true when we create the pending change. The check is for when we read it after a reboot: a download-only origin change can remain on disk for deployment A, while the user boots rollback deployment B. In that case, we should ignore A’s pending change rather than show it as staged for B.

Should i add a comment there to make i more clear?

Johan-Liebert1 · 2026-11-02T06:12:31Z

+        opts,
+        UkiAddonCliOpts::Add { .. } | UkiAddonCliOpts::Remove { .. }
+    ) {
+        anyhow::ensure!(


why not? We allow it when we have a staged deployment

This guard applies only while an origin-only change is pending, addon changes with a real staged deployment still work.

Johan-Liebert1 · 2026-11-02T06:18:56Z

Also the first two commits need proper messages and not just wip

Allow switch to accept an update origin separate from the image fetched now. Pass the target through OSTree staging and composefs switch so later updates can follow the recorded reference. Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com> Co-authored-by: HarshwardhanPatil07 <harshpat@redhat.com>

Keep the pulled image name alongside a staged deployment when switch chooses a different update origin. This prepares the staged state to distinguish the delivery source from the recorded origin. Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com> Co-authored-by: HarshwardhanPatil07 <harshpat@redhat.com>

Offline delivery should accept the same registry names users pass to install. Normalize target references before fetching, reject incompatible options, and avoid advertising enforced verification on an unsupported composefs path. Assisted-by: AI Signed-off-by: HarshwardhanPatil07 <harshpat@redhat.com>

A cached import must retain the reference used by the deployment origin so cleanup does not discard its image metadata. Handle this in the importer, respecting set_no_imgref, so direct and unified pulls share the same behavior. Reuse the existing pull preparation helper. Assisted-by: AI Signed-off-by: HarshwardhanPatil07 <harshpat@redhat.com>

The update origin cannot identify which offline delivery was staged. Record the pull source in each deployment origin and compare both references before fetching, preserving download-only locks on repeats. Route OSTree imports through the source while retaining the target. Cover offline repeats, source replacement, activation, and provenance after reboot on both backends. Assisted-by: AI Signed-off-by: HarshwardhanPatil07 <harshpat@redhat.com>

Recording an origin is only useful if later updates actually use it. Extend the reboot test to check unchanged content and a newer image at the recorded registry after completing an offline delivery. Assisted-by: AI Signed-off-by: HarshwardhanPatil07 <harshpat@redhat.com>

Explain how to obtain an image from a temporary source while retaining the normal update origin. Document repeat behavior, activation, and user-visible restrictions with local-storage and registry examples. Assisted-by: AI Signed-off-by: HarshwardhanPatil07 <harshpat@redhat.com>

A redirected deployment records its update origin while containers-storage keeps the delivery name. Detect the stored host image by its OCI config ID and retain that ID during cleanup, so later updates keep using unified storage without requiring another explicit opt-in. Use the existing deployment metadata for both backends without adding persistent state or changing image aliases. Assisted-by: AI Signed-off-by: HarshwardhanPatil07 <harshpat@redhat.com>

Johan-Liebert1 · 2026-11-06T07:03:16Z

+location = "localhost:5555"
+insecure = true
+' | save /etc/containers/registries.conf.d/target-imgref-test.conf
+    podman run -d --name $registry -p 127.0.0.1:5555:5000 docker.io/library/registry:2


Is this necessary for testing? We'd want to limit internet access in our tests to as little as possible to prevent flakes. We could just have another containers-storage:<image> as the target imgref

Johan-Liebert1 · 2026-11-06T07:06:18Z

 }

+/// Parse a transport-prefixed reference, defaulting bare image names to the registry.
+pub(crate) fn parse_image_reference(value: &str) -> Result<containers_image_proxy::ImageReference> {


Why do we need this function? Is there some case where containers_image_proxy::ImageReference::try_from fails?

Johan-Liebert1 · 2026-11-06T07:13:13Z

            continue;
        }

+        if let Some(id) = deployment.container_image_id(storage)? {


We should do this below where we read the origin. We can just check if the origin contains our new key, if it does use that as the image name else use the default one

Johan-Liebert1 · 2026-11-06T07:14:18Z

-    );
+    let mut config = tini::Ini::new()
+        .section("origin")
+        // The composefs pull path does not yet enforce the spec signature mode.


Let's not remove the TODO from here

Johan-Liebert1 · 2026-11-06T07:16:10Z

    target_imgref: &ImageReference,
+    source_imgref: Option<&ImageReference>,


probably worth switching the variable names here

Johan-Liebert1 · 2026-11-06T08:19:34Z

+    current_origin: Option<&ImageReference>,
+    previous_source: Option<&str>,
+) -> Result<bool> {
+    let Some(current_origin) = current_origin else {


Shouldn't the current_origin always exist?

Johan-Liebert1 · 2026-11-06T08:22:00Z

+    source: &ImageReference,
+    target: Option<&ImageReference>,
+    current_origin: Option<&ImageReference>,
+    previous_source: Option<&str>,


These variables are poorly named, not entirely obvious what previous_source is. Renaming or at least a doc comment on the function would help. Also, why we can accept ImageReference for previous_source right to keep it all consistent?

Johan-Liebert1 · 2026-11-06T08:26:46Z

 mod tests {
    use super::*;

+    #[test]


These should all be tmt integration tests imo

Johan-Liebert1 · 2026-11-06T08:33:42Z

+/// Detect a deployment's stored image even when its pull source and origin differ.
+pub(crate) async fn deployment_uses_unified_storage(
+    store: &Storage,
+    deployment: Option<&crate::spec::BootEntry>,


Having an Option here doesn't make sense

Johan-Liebert1 · 2026-11-06T08:34:55Z

+        return Ok(false);
+    };
+    let Some(id) = deployment.container_image_id(store)? else {
+        return Ok(false);


Shouldn't this be an error if we fail to find an image associated with a deployment or am I missing something?

Copilot

🟡 Changes recommended

Active issues misparse valid transport-prefixed targets and cause offline switches from host-only containers-storage sources to fail on OSTree hosts using unified storage.

2 open issues

9 resolved since last review

_{Review effort: Balanced}

+            || crate::deploy::deployment_uses_unified_storage(
+                storage,
+                host.status.staged.as_ref().or(host.status.booted.as_ref()),
+            )
+            .await?


+    // is named after a transport. Use oci:./5000/os for an OCI relative path.
+    let registry_port = value.split_once('/').is_some_and(|(authority, _)| {
+        authority
+            .rsplit_once(':')


Copilot AI balanced review requested due to automatic review settings October 30, 2026 09:36

Copilot AI reviewed Oct 30, 2026

github-actions Bot added area/install Issues related to `bootc install` area/ostree Issues related to ostree area/documentation Updates to the documentation labels Oct 30, 2026

bootc-bot Bot requested a review from henrywang October 30, 2026 09:36

HarshwardhanPatil07 force-pushed the fix/switch-target-imgref branch 2 times, most recently from 75ea0d9 to 8055a2f Compare October 30, 2026 09:41

HarshwardhanPatil07 requested review from Johan-Liebert1, cgwalters and jmarrero October 30, 2026 09:41

HarshwardhanPatil07 changed the title ~~switch: Add --target-imgref for offline image delivery~~ switch: Add --target-imgref to Support a separate update image reference Oct 30, 2026

cgwalters requested a balanced review from Copilot October 30, 2026 18:41

Copilot started reviewing on behalf of cgwalters October 30, 2026 18:42

View session

cgwalters reviewed Oct 30, 2026

View reviewed changes

Comment thread crates/lib/src/cli.rs Resolved

Comment thread crates/lib/src/cli.rs Resolved

Copilot AI reviewed Oct 30, 2026

View reviewed changes

cgwalters reviewed Oct 30, 2026

View reviewed changes

Comment thread crates/lib/src/deploy.rs Resolved

Comment thread crates/lib/src/bootc_composefs/switch.rs Resolved

HarshwardhanPatil07 force-pushed the fix/switch-target-imgref branch 2 times, most recently from a63c7f4 to b00d6b9 Compare October 31, 2026 13:42

Johan-Liebert1 requested changes Nov 2, 2026

View reviewed changes

HarshwardhanPatil07 force-pushed the fix/switch-target-imgref branch from b00d6b9 to 2c72014 Compare November 3, 2026 09:14

Johan-Liebert1 and others added 2 commits November 3, 2026 14:45

HarshwardhanPatil07 force-pushed the fix/switch-target-imgref branch from 2c72014 to 462a54b Compare November 3, 2026 09:15

HarshwardhanPatil07 added 2 commits November 3, 2026 14:49

HarshwardhanPatil07 force-pushed the fix/switch-target-imgref branch from 462a54b to 7818ea5 Compare November 3, 2026 09:22

cgwalters-bot mentioned this pull request Nov 4, 2026

tests: test-64 target-imgref registry refuses connections on [::1]:5555 cgwalters-forge/bootc#90

Open

Johan-Liebert1 reviewed Nov 4, 2026

View reviewed changes

Comment thread crates/lib/src/bootc_composefs/origin.rs Resolved

HarshwardhanPatil07 added 4 commits November 6, 2026 10:56

HarshwardhanPatil07 force-pushed the fix/switch-target-imgref branch from 7818ea5 to f511178 Compare November 6, 2026 05:33

Johan-Liebert1 requested changes Nov 6, 2026

View reviewed changes

Johan-Liebert1 requested a balanced review from Copilot November 6, 2026 08:40

Copilot started reviewing on behalf of Johan-Liebert1 November 6, 2026 08:40

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

cgwalters-bot mentioned this pull request Nov 6, 2026

Maintainer digest cgwalters-forge/tracker#965

Open

		target_imgref: &ImageReference,
		source_imgref: Option<&ImageReference>,

Conversation

HarshwardhanPatil07 commented Oct 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Johan-Liebert1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Johan-Liebert1 commented Nov 2, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants