New upstream version 2017.4

Makefile-libostree-defines.am

@@ -37,3 +37,7 @@ libostree_public_headers = \
 	src/libostree/ostree-bootconfig-parser.h \
 	src/libostree/ostree-repo-deprecated.h \
 	$(NULL)
+
+# This one is generated via configure.ac, and the gtk-doc
+# code hence needs to look in the builddir.
+libostree_public_built_headers = src/libostree/ostree-version.h

Makefile-libostree.am

@@ -24,9 +24,9 @@ noinst_LTLIBRARIES += libostree-kernel-args.la
 
 if ENABLE_RUST
 bupsplitpath = @abs_top_builddir@/target/@RUST_TARGET_SUBDIR@/libbupsplit_rs.a
-BUPSPLIT_RUST_SOURCES = rust/src/bupsplit.rs
+BUPSPLIT_RUST_SRCS = rust/src/bupsplit.rs
-EXTRA_DIST += $(BUPSPLIT_RUST_SOURCES)
+EXTRA_DIST += $(BUPSPLIT_RUST_SRCS)
-$(bupsplitpath): Makefile $(BUPSPLIT_RUST_SOURCES)
+$(bupsplitpath): Makefile $(BUPSPLIT_RUST_SRCS)
 	cd $(top_srcdir)/rust && CARGO_TARGET_DIR=@abs_top_builddir@/target cargo build --verbose $(CARGO_RELEASE_ARGS)
 else
 bupsplitpath = libbupsplit.la
@@ -44,7 +44,7 @@ libostree_kernel_args_la_LIBADD = $(OT_INTERNAL_GIO_UNIX_LIBS)
 lib_LTLIBRARIES += libostree-1.la
 
 libostreeincludedir = $(includedir)/ostree-1
-libostreeinclude_HEADERS = $(libostree_public_headers)
+libostreeinclude_HEADERS = $(libostree_public_headers) $(libostree_public_built_headers)
 
 ENUM_TYPES = $(NULL)
 ENUM_TYPES += $(srcdir)/src/libostree/ostree-fetcher.h
@@ -107,6 +107,7 @@ libostree_1_la_SOURCES = \
 	src/libostree/ostree-repo-file-enumerator.c \
 	src/libostree/ostree-repo-file-enumerator.h \
 	src/libostree/ostree-sepolicy.c \
+	src/libostree/ostree-sepolicy-private.h \
 	src/libostree/ostree-sysroot-private.h \
 	src/libostree/ostree-sysroot.c \
 	src/libostree/ostree-sysroot-cleanup.c \
@@ -147,10 +148,11 @@ libostree_1_la_SOURCES += \
 endif
 
 libostree_1_la_CFLAGS = $(AM_CFLAGS) -I$(srcdir)/bsdiff -I$(srcdir)/libglnx -I$(srcdir)/src/libotutil -I$(srcdir)/src/libostree -I$(builddir)/src/libostree \
-	$(OT_INTERNAL_GIO_UNIX_CFLAGS) $(OT_INTERNAL_GPGME_CFLAGS) $(OT_DEP_LZMA_CFLAGS) $(OT_DEP_ZLIB_CFLAGS) \
+	$(OT_INTERNAL_GIO_UNIX_CFLAGS) $(OT_INTERNAL_GPGME_CFLAGS) $(OT_DEP_LZMA_CFLAGS) $(OT_DEP_ZLIB_CFLAGS) $(OT_DEP_OPENSSL_CFLAGS) \
 	-fvisibility=hidden '-D_OSTREE_PUBLIC=__attribute__((visibility("default"))) extern'
 libostree_1_la_LDFLAGS = -version-number 1:0:0 -Bsymbolic-functions -Wl,--version-script=$(top_srcdir)/src/libostree/libostree.sym
-libostree_1_la_LIBADD = libotutil.la libglnx.la libbsdiff.la libostree-kernel-args.la $(OT_INTERNAL_GIO_UNIX_LIBS) $(OT_INTERNAL_GPGME_LIBS) $(OT_DEP_LZMA_LIBS) $(OT_DEP_ZLIB_LIBS)
+libostree_1_la_LIBADD = libotutil.la libglnx.la libbsdiff.la libostree-kernel-args.la $(OT_INTERNAL_GIO_UNIX_LIBS) $(OT_INTERNAL_GPGME_LIBS) \
+                        $(OT_DEP_LZMA_LIBS) $(OT_DEP_ZLIB_LIBS) $(OT_DEP_OPENSSL_LIBS)
 libostree_1_la_LIBADD += $(bupsplitpath)
 EXTRA_libostree_1_la_DEPENDENCIES = $(top_srcdir)/src/libostree/libostree.sym
 
@@ -209,7 +211,7 @@ OSTree_1_0_gir_INCLUDES = Gio-2.0
 OSTree_1_0_gir_CFLAGS = $(libostree_1_la_CFLAGS)
 OSTree_1_0_gir_LIBS = libostree-1.la
 OSTree_1_0_gir_SCANNERFLAGS = --warn-all --identifier-prefix=Ostree --symbol-prefix=ostree
-OSTree_1_0_gir_FILES = $(libostreeinclude_HEADERS) $(filter-out %-private.h,$(libostree_1_la_SOURCES))
+OSTree_1_0_gir_FILES = $(libostreeinclude_HEADERS) $(filter-out %-private.h %/ostree-soup-uri.h,$(libostree_1_la_SOURCES))
 INTROSPECTION_GIRS += OSTree-1.0.gir
 gir_DATA += OSTree-1.0.gir
 typelib_DATA += OSTree-1.0.typelib
@@ -225,7 +227,8 @@ EXTRA_DIST += src/libostree/README-gpg src/libostree/bupsplit.h \
 		src/libostree/ostree-enumtypes.h.template \
 		src/libostree/ostree-enumtypes.c.template \
 		src/libostree/ostree-deployment-private.h \
-		src/libostree/ostree-repo-deprecated.h
+		src/libostree/ostree-repo-deprecated.h \
+		src/libostree/ostree-version.h
 
 install-mkdir-remotes-d-hook:
 	mkdir -p $(DESTDIR)$(sysconfdir)/ostree/remotes.d

Makefile-ostree.am

@@ -105,7 +105,7 @@ EXTRA_DIST += src/ostree/parse-datetime.y
 CLEANFILES += src/ostree/parse-datetime.c
 
 ostree_bin_shared_cflags = $(AM_CFLAGS) -I$(srcdir)/src/libotutil -I$(srcdir)/src/libostree \
-	-I$(srcdir)/src/ostree -I$(srcdir)/libglnx $(OT_INTERNAL_GIO_UNIX_CFLAGS) \
+	-I$(builddir)/src/libostree -I$(srcdir)/src/ostree -I$(srcdir)/libglnx $(OT_INTERNAL_GIO_UNIX_CFLAGS) \
 	-DPKGLIBEXECDIR=\"$(pkglibexecdir)\"
 ostree_bin_shared_ldadd = $(AM_LDFLAGS) libglnx.la libotutil.la libostree-1.la \
 	$(OT_INTERNAL_GIO_UNIX_LIBS)

Makefile-otutil.am

@@ -22,6 +22,8 @@ noinst_LTLIBRARIES += libotutil.la
 libotutil_la_SOURCES = \
 	src/libotutil/ot-checksum-utils.c \
 	src/libotutil/ot-checksum-utils.h \
+	src/libotutil/ot-checksum-instream.c \
+	src/libotutil/ot-checksum-instream.h \
 	src/libotutil/ot-fs-utils.c \
 	src/libotutil/ot-fs-utils.h \
 	src/libotutil/ot-keyfile-utils.c \
@@ -30,8 +32,6 @@ libotutil_la_SOURCES = \
 	src/libotutil/ot-opt-utils.h \
 	src/libotutil/ot-unix-utils.c \
 	src/libotutil/ot-unix-utils.h \
-	src/libotutil/ot-spawn-utils.c \
-	src/libotutil/ot-spawn-utils.h \
 	src/libotutil/ot-variant-utils.c \
 	src/libotutil/ot-variant-utils.h \
 	src/libotutil/ot-gio-utils.c \

Makefile-tests.am

@@ -28,6 +28,7 @@ EXTRA_DIST += \
 # include the builddir in $PATH so we find our just-built ostree
 # binary.
 TESTS_ENVIRONMENT += OT_TESTS_DEBUG=1 \
+  OSTREE_UNINSTALLED_SRCDIR=$(abs_top_srcdir) \
 	OSTREE_UNINSTALLED=$(abs_top_builddir) \
 	G_DEBUG=fatal-warnings \
 	GI_TYPELIB_PATH=$$(cd $(top_builddir) && pwd)$${GI_TYPELIB_PATH:+:$$GI_TYPELIB_PATH} \
@@ -46,6 +47,7 @@ dist_uninstalled_test_scripts = tests/test-symbols.sh
 dist_test_scripts = \
 	tests/test-basic.sh \
 	tests/test-basic-user.sh \
+	tests/test-basic-user-only.sh \
 	tests/test-pull-subpath.sh \
 	tests/test-archivez.sh \
 	tests/test-remote-add.sh \
@@ -98,6 +100,7 @@ dist_test_scripts = \
 	tests/test-switchroot.sh \
 	tests/test-pull-contenturl.sh \
 	tests/test-pull-mirrorlist.sh \
+	tests/coccinelle.sh \
 	$(NULL)
 
 if BUILDOPT_FUSE

Makefile.am

@@ -24,7 +24,7 @@ OSTREE_GITREV=$(shell if command -v git >/dev/null 2>&1 && test -d $(srcdir)/.gi
 ACLOCAL_AMFLAGS = -I buildutil -I libglnx ${ACLOCAL_FLAGS}
 AM_CPPFLAGS += -DDATADIR='"$(datadir)"' -DLIBEXECDIR='"$(libexecdir)"' \
 	-DLOCALEDIR=\"$(datadir)/locale\" -DSYSCONFDIR=\"$(sysconfdir)\" \
-	-DSHORTENED_SYSCONFDIR=\"$(shortened_sysconfdir)\" \
+	-DTARGET_PREFIX='"$(prefix)"' -DSHORTENED_SYSCONFDIR=\"$(shortened_sysconfdir)\" \
 	-DOSTREE_FEATURES='"$(OSTREE_FEATURES)"' \
 	-DOSTREE_COMPILATION \
 	-DG_LOG_DOMAIN=\"OSTree\" \

Makefile.in

@@ -340,14 +340,13 @@ host_triplet = @host@
 bin_PROGRAMS = ostree$(EXEEXT) $(am__EXEEXT_1)
 sbin_PROGRAMS =
 libexec_PROGRAMS =
-pkglibexec_PROGRAMS = $(am__EXEEXT_11)
+pkglibexec_PROGRAMS = $(am__EXEEXT_12)
-noinst_PROGRAMS = $(am__EXEEXT_8) tests/test-rollsum-cli$(EXEEXT)
+noinst_PROGRAMS = $(am__EXEEXT_9) tests/test-rollsum-cli$(EXEEXT)
-ostree_boot_PROGRAMS = $(am__EXEEXT_9) $(am__EXEEXT_10)
+ostree_boot_PROGRAMS = $(am__EXEEXT_10) $(am__EXEEXT_11)
-TESTS = $(am__EXEEXT_3) $(am__EXEEXT_13) \
+TESTS = $(am__EXEEXT_3) $(am__EXEEXT_14) \
-	$(dist_uninstalled_test_scripts) test-libglnx-xattrs$(EXEEXT)
+	$(dist_uninstalled_test_scripts) $(am__EXEEXT_6)
-installed_test_PROGRAMS = $(am__EXEEXT_7)
+installed_test_PROGRAMS = $(am__EXEEXT_8)
-check_PROGRAMS = $(am__EXEEXT_5) test-libglnx-xattrs$(EXEEXT) \
+check_PROGRAMS = $(am__EXEEXT_5) $(am__EXEEXT_6) $(am__EXEEXT_7)
-	$(am__EXEEXT_6)
 @ENABLE_ALWAYS_BUILD_TESTS_TRUE@am__append_1 = $(all_test_ltlibs)
 @ENABLE_ALWAYS_BUILD_TESTS_TRUE@am__append_2 = $(all_test_programs)
 @ENABLE_ALWAYS_BUILD_TESTS_TRUE@am__append_3 = $(all_test_scripts)
@@ -375,7 +374,7 @@ check_PROGRAMS = $(am__EXEEXT_5) test-libglnx-xattrs$(EXEEXT) \
 @ENABLE_INSTALLED_TESTS_TRUE@am__append_13 = $(installed_test_meta_DATA)
 @ENABLE_GTK_DOC_TRUE@am__append_14 = apidoc
 @ENABLE_RUST_TRUE@am__append_15 = $(srcdir)/rust/Cargo.toml $(srcdir)/rust/cargo-vendor-config
-@ENABLE_RUST_TRUE@am__append_16 = $(BUPSPLIT_RUST_SOURCES)
+@ENABLE_RUST_TRUE@am__append_16 = $(BUPSPLIT_RUST_SRCS)
 @ENABLE_RUST_FALSE@am__append_17 = libbupsplit.la
 @USE_LIBARCHIVE_TRUE@am__append_18 = src/libostree/ostree-libarchive-input-stream.h \
 @USE_LIBARCHIVE_TRUE@	src/libostree/ostree-libarchive-input-stream.c \
@@ -487,7 +486,8 @@ am__CONFIG_DISTCLEAN_FILES = config.status config.cache config.log \
  configure.lineno config.status.lineno
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = config.h
-CONFIG_CLEAN_FILES = src/libostree/ostree-1.pc
+CONFIG_CLEAN_FILES = src/libostree/ostree-1.pc \
+	src/libostree/ostree-version.h
 CONFIG_CLEAN_VPATH_FILES =
 am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
 am__vpath_adj = case $$p in \
@@ -585,10 +585,10 @@ am__DEPENDENCIES_3 = $(am__DEPENDENCIES_1) $(am__DEPENDENCIES_1)
 libostree_1_la_DEPENDENCIES = libotutil.la libglnx.la libbsdiff.la \
 	libostree-kernel-args.la $(am__DEPENDENCIES_2) \
 	$(am__DEPENDENCIES_3) $(am__DEPENDENCIES_1) \
-	$(am__DEPENDENCIES_1) $(bupsplitpath) $(am__DEPENDENCIES_4) \
+	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_1) $(bupsplitpath) \
-	$(am__DEPENDENCIES_5) $(am__DEPENDENCIES_6) \
+	$(am__DEPENDENCIES_4) $(am__DEPENDENCIES_5) \
-	$(am__DEPENDENCIES_7) $(am__DEPENDENCIES_8) \
+	$(am__DEPENDENCIES_6) $(am__DEPENDENCIES_7) \
-	$(am__DEPENDENCIES_9)
+	$(am__DEPENDENCIES_8) $(am__DEPENDENCIES_9)
 am__libostree_1_la_SOURCES_DIST =  \
 	src/libostree/ostree-async-progress.c \
 	src/libostree/ostree-cmdprivate.h \
@@ -624,6 +624,7 @@ am__libostree_1_la_SOURCES_DIST =  \
 	src/libostree/ostree-repo-file-enumerator.c \
 	src/libostree/ostree-repo-file-enumerator.h \
 	src/libostree/ostree-sepolicy.c \
+	src/libostree/ostree-sepolicy-private.h \
 	src/libostree/ostree-sysroot-private.h \
 	src/libostree/ostree-sysroot.c \
 	src/libostree/ostree-sysroot-cleanup.c \
@@ -755,11 +756,11 @@ libotutil_la_DEPENDENCIES = $(am__DEPENDENCIES_2) \
 	$(am__DEPENDENCIES_3) $(am__DEPENDENCIES_1)
 am_libotutil_la_OBJECTS =  \
 	src/libotutil/libotutil_la-ot-checksum-utils.lo \
+	src/libotutil/libotutil_la-ot-checksum-instream.lo \
 	src/libotutil/libotutil_la-ot-fs-utils.lo \
 	src/libotutil/libotutil_la-ot-keyfile-utils.lo \
 	src/libotutil/libotutil_la-ot-opt-utils.lo \
 	src/libotutil/libotutil_la-ot-unix-utils.lo \
-	src/libotutil/libotutil_la-ot-spawn-utils.lo \
 	src/libotutil/libotutil_la-ot-variant-utils.lo \
 	src/libotutil/libotutil_la-ot-gio-utils.lo \
 	src/libotutil/libotutil_la-ot-log-utils.lo \
@@ -799,12 +800,14 @@ am__EXEEXT_3 = tests/test-varint$(EXEEXT) \
 	$(am__EXEEXT_2)
 am__EXEEXT_4 = $(am__EXEEXT_3)
 @ENABLE_ALWAYS_BUILD_TESTS_FALSE@am__EXEEXT_5 = $(am__EXEEXT_4)
-@BUILDOPT_SYSTEMD_FALSE@am__EXEEXT_6 = ostree-remount$(EXEEXT)
+am__EXEEXT_6 = test-libglnx-xattrs$(EXEEXT) test-libglnx-fdio$(EXEEXT) \
-@ENABLE_INSTALLED_TESTS_TRUE@am__EXEEXT_7 = $(am__EXEEXT_3)
+	test-libglnx-errors$(EXEEXT)
-@ENABLE_ALWAYS_BUILD_TESTS_TRUE@am__EXEEXT_8 = $(am__EXEEXT_4)
+@BUILDOPT_SYSTEMD_FALSE@am__EXEEXT_7 = ostree-remount$(EXEEXT)
-@BUILDOPT_SYSTEMD_TRUE@am__EXEEXT_9 = ostree-remount$(EXEEXT)
+@ENABLE_INSTALLED_TESTS_TRUE@am__EXEEXT_8 = $(am__EXEEXT_3)
-@BUILDOPT_USE_STATIC_COMPILER_FALSE@am__EXEEXT_10 = ostree-prepare-root$(EXEEXT)
+@ENABLE_ALWAYS_BUILD_TESTS_TRUE@am__EXEEXT_9 = $(am__EXEEXT_4)
-@USE_LIBSOUP_TRUE@am__EXEEXT_11 = ostree-trivial-httpd$(EXEEXT)
+@BUILDOPT_SYSTEMD_TRUE@am__EXEEXT_10 = ostree-remount$(EXEEXT)
+@BUILDOPT_USE_STATIC_COMPILER_FALSE@am__EXEEXT_11 = ostree-prepare-root$(EXEEXT)
+@USE_LIBSOUP_TRUE@am__EXEEXT_12 = ostree-trivial-httpd$(EXEEXT)
 PROGRAMS = $(bin_PROGRAMS) $(installed_test_PROGRAMS) \
 	$(libexec_PROGRAMS) $(noinst_PROGRAMS) $(ostree_boot_PROGRAMS) \
 	$(pkglibexec_PROGRAMS) $(sbin_PROGRAMS)
@@ -962,6 +965,21 @@ rofiles_fuse_OBJECTS = $(am_rofiles_fuse_OBJECTS)
 rofiles_fuse_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
 	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(rofiles_fuse_CFLAGS) \
 	$(CFLAGS) $(AM_LDFLAGS) $(LDFLAGS) -o $@
+am_test_libglnx_errors_OBJECTS = libglnx/tests/test_libglnx_errors-test-libglnx-errors.$(OBJEXT)
+test_libglnx_errors_OBJECTS = $(am_test_libglnx_errors_OBJECTS)
+test_libglnx_errors_DEPENDENCIES = $(am__DEPENDENCIES_2) libglnx.la
+test_libglnx_errors_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(test_libglnx_errors_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
+	$(LDFLAGS) -o $@
+am_test_libglnx_fdio_OBJECTS =  \
+	libglnx/tests/test_libglnx_fdio-test-libglnx-fdio.$(OBJEXT)
+test_libglnx_fdio_OBJECTS = $(am_test_libglnx_fdio_OBJECTS)
+test_libglnx_fdio_DEPENDENCIES = $(am__DEPENDENCIES_2) libglnx.la
+test_libglnx_fdio_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(test_libglnx_fdio_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) $(LDFLAGS) \
+	-o $@
 am_test_libglnx_xattrs_OBJECTS = libglnx/tests/test_libglnx_xattrs-test-libglnx-xattrs.$(OBJEXT)
 test_libglnx_xattrs_OBJECTS = $(am_test_libglnx_xattrs_OBJECTS)
 test_libglnx_xattrs_DEPENDENCIES = $(am__DEPENDENCIES_2) libglnx.la
@@ -1155,6 +1173,7 @@ SOURCES = $(libbsdiff_la_SOURCES) $(libbupsplit_la_SOURCES) \
 	$(libreaddir_rand_la_SOURCES) $(ostree_SOURCES) \
 	$(ostree_prepare_root_SOURCES) $(ostree_remount_SOURCES) \
 	$(ostree_trivial_httpd_SOURCES) $(rofiles_fuse_SOURCES) \
+	$(test_libglnx_errors_SOURCES) $(test_libglnx_fdio_SOURCES) \
 	$(test_libglnx_xattrs_SOURCES) tests/test-basic-c.c \
 	tests/test-bsdiff.c $(tests_test_checksum_SOURCES) \
 	$(tests_test_gpg_verify_result_SOURCES) \
@@ -1175,6 +1194,7 @@ DIST_SOURCES = $(libbsdiff_la_SOURCES) \
 	$(ostree_prepare_root_SOURCES) $(ostree_remount_SOURCES) \
 	$(am__ostree_trivial_httpd_SOURCES_DIST) \
 	$(am__rofiles_fuse_SOURCES_DIST) \
+	$(test_libglnx_errors_SOURCES) $(test_libglnx_fdio_SOURCES) \
 	$(test_libglnx_xattrs_SOURCES) tests/test-basic-c.c \
 	tests/test-bsdiff.c $(tests_test_checksum_SOURCES) \
 	$(tests_test_gpg_verify_result_SOURCES) \
@@ -1403,15 +1423,16 @@ am__set_TESTS_bases = \
   bases=`for i in $$bases; do echo $$i; done | sed 's/\.log$$//'`; \
   bases=`echo $$bases`
 RECHECK_LOGS = $(TEST_LOGS)
-am__EXEEXT_12 =
+am__EXEEXT_13 =
-am__EXEEXT_13 = tests/test-basic.sh tests/test-basic-user.sh \
+am__EXEEXT_14 = tests/test-basic.sh tests/test-basic-user.sh \
-	tests/test-pull-subpath.sh tests/test-archivez.sh \
+	tests/test-basic-user-only.sh tests/test-pull-subpath.sh \
-	tests/test-remote-add.sh tests/test-remote-headers.sh \
+	tests/test-archivez.sh tests/test-remote-add.sh \
-	tests/test-remote-gpg-import.sh tests/test-commit-sign.sh \
+	tests/test-remote-headers.sh tests/test-remote-gpg-import.sh \
-	tests/test-export.sh tests/test-help.sh \
+	tests/test-commit-sign.sh tests/test-export.sh \
-	tests/test-libarchive.sh tests/test-parent.sh \
+	tests/test-help.sh tests/test-libarchive.sh \
-	tests/test-pull-archive-z.sh tests/test-pull-commit-only.sh \
+	tests/test-parent.sh tests/test-pull-archive-z.sh \
-	tests/test-pull-depth.sh tests/test-pull-mirror-summary.sh \
+	tests/test-pull-commit-only.sh tests/test-pull-depth.sh \
+	tests/test-pull-mirror-summary.sh \
 	tests/test-pull-large-metadata.sh tests/test-pull-metalink.sh \
 	tests/test-pull-summary-sigs.sh tests/test-pull-resume.sh \
 	tests/test-pull-repeated.sh tests/test-pull-untrusted.sh \
@@ -1437,8 +1458,9 @@ am__EXEEXT_13 = tests/test-basic.sh tests/test-basic-user.sh \
 	tests/test-auto-summary.sh tests/test-prune.sh \
 	tests/test-refs.sh tests/test-demo-buildsystem.sh \
 	tests/test-switchroot.sh tests/test-pull-contenturl.sh \
-	tests/test-pull-mirrorlist.sh $(am__EXEEXT_12) \
+	tests/test-pull-mirrorlist.sh tests/coccinelle.sh \
-	$(am__append_51) $(am__append_53) $(am__append_54)
+	$(am__EXEEXT_13) $(am__append_51) $(am__append_53) \
+	$(am__append_54)
 TEST_SUITE_LOG = test-suite.log
 TEST_EXTENSIONS = @EXEEXT@ .test
 LOG_COMPILE = $(LOG_COMPILER) $(AM_LOG_FLAGS) $(LOG_FLAGS)
@@ -1478,7 +1500,8 @@ am__DIST_COMMON = $(srcdir)/Makefile-boot.am \
 	$(top_srcdir)/build-aux/missing \
 	$(top_srcdir)/build-aux/test-driver \
 	$(top_srcdir)/buildutil/glib-tap.mk \
-	$(top_srcdir)/src/libostree/ostree-1.pc.in COPYING TODO \
+	$(top_srcdir)/src/libostree/ostree-1.pc.in \
+	$(top_srcdir)/src/libostree/ostree-version.h.in COPYING TODO \
 	build-aux/compile build-aux/config.guess build-aux/config.sub \
 	build-aux/depcomp build-aux/install-sh build-aux/ltmain.sh \
 	build-aux/missing
@@ -1619,6 +1642,8 @@ OT_DEP_LIBMOUNT_CFLAGS = @OT_DEP_LIBMOUNT_CFLAGS@
 OT_DEP_LIBMOUNT_LIBS = @OT_DEP_LIBMOUNT_LIBS@
 OT_DEP_LZMA_CFLAGS = @OT_DEP_LZMA_CFLAGS@
 OT_DEP_LZMA_LIBS = @OT_DEP_LZMA_LIBS@
+OT_DEP_OPENSSL_CFLAGS = @OT_DEP_OPENSSL_CFLAGS@
+OT_DEP_OPENSSL_LIBS = @OT_DEP_OPENSSL_LIBS@
 OT_DEP_SELINUX_CFLAGS = @OT_DEP_SELINUX_CFLAGS@
 OT_DEP_SELINUX_LIBS = @OT_DEP_SELINUX_LIBS@
 OT_DEP_SOUP_CFLAGS = @OT_DEP_SOUP_CFLAGS@
@@ -1637,6 +1662,7 @@ PKG_CONFIG = @PKG_CONFIG@
 PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
 PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
 RANLIB = @RANLIB@
+RELEASE_VERSION = @RELEASE_VERSION@
 RUST_TARGET_SUBDIR = @RUST_TARGET_SUBDIR@
 SED = @SED@
 SET_MAKE = @SET_MAKE@
@@ -1647,6 +1673,7 @@ VERSION = @VERSION@
 WARN_CFLAGS = @WARN_CFLAGS@
 XSLTPROC = @XSLTPROC@
 YACC = @YACC@
+YEAR_VERSION = @YEAR_VERSION@
 YFLAGS = @YFLAGS@
 abs_builddir = @abs_builddir@
 abs_srcdir = @abs_srcdir@
@@ -1709,7 +1736,7 @@ top_srcdir = @top_srcdir@
 # Common variables
 AM_CPPFLAGS = -DDATADIR='"$(datadir)"' -DLIBEXECDIR='"$(libexecdir)"' \
 	-DLOCALEDIR=\"$(datadir)/locale\" \
-	-DSYSCONFDIR=\"$(sysconfdir)\" \
+	-DSYSCONFDIR=\"$(sysconfdir)\" -DTARGET_PREFIX='"$(prefix)"' \
 	-DSHORTENED_SYSCONFDIR=\"$(shortened_sysconfdir)\" \
 	-DOSTREE_FEATURES='"$(OSTREE_FEATURES)"' -DOSTREE_COMPILATION \
 	-DG_LOG_DOMAIN=\"OSTree\" -DOSTREE_GITREV='"$(OSTREE_GITREV)"' \
@@ -1743,11 +1770,11 @@ EXTRA_DIST = $(all_dist_test_scripts) $(all_dist_test_data) autogen.sh \
 	src/libostree/ostree-enumtypes.c.template \
 	src/libostree/ostree-deployment-private.h \
 	src/libostree/ostree-repo-deprecated.h \
-	src/ostree/parse-datetime.y buildutil/tap-driver.sh \
+	src/libostree/ostree-version.h src/ostree/parse-datetime.y \
-	buildutil/tap-test tests/glib.supp tests/ostree.supp $(NULL) \
+	buildutil/tap-driver.sh buildutil/tap-test tests/glib.supp \
-	$(am__append_52) $(am__append_55) tests/libtest.sh \
+	tests/ostree.supp $(NULL) $(am__append_52) $(am__append_55) \
-	$(am__append_56) tests/libostreetest.h tests/libtest.sh \
+	tests/libtest.sh $(am__append_56) tests/libostreetest.h \
-	tests/gpg-verify-data/README.md $(NULL) \
+	tests/libtest.sh tests/gpg-verify-data/README.md $(NULL) \
 	src/boot/dracut/module-setup.sh src/boot/dracut/ostree.conf \
 	src/boot/mkinitcpio/ostree \
 	src/boot/ostree-prepare-root.service \
@@ -1778,6 +1805,7 @@ TESTS_ENVIRONMENT = G_TEST_SRCDIR="$(abs_srcdir)" \
 	G_TEST_BUILDDIR="$(abs_builddir)" UNINSTALLEDTESTS=1 \
 	G_DEBUG=gc-friendly MALLOC_CHECK_=2 \
 	MALLOC_PERTURB_=$$(($${RANDOM:-256} % 256)) OT_TESTS_DEBUG=1 \
+	OSTREE_UNINSTALLED_SRCDIR=$(abs_top_srcdir) \
 	OSTREE_UNINSTALLED=$(abs_top_builddir) G_DEBUG=fatal-warnings \
 	GI_TYPELIB_PATH=$$(cd $(top_builddir) && \
 	pwd)$${GI_TYPELIB_PATH:+:$$GI_TYPELIB_PATH} \
@@ -1878,9 +1906,16 @@ libglnx_la_SOURCES = \
 libglnx_la_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
 libglnx_la_LDFLAGS = -avoid-version -Bsymbolic-functions -export-symbols-regex "^glnx_" -no-undefined -export-dynamic 
 libglnx_la_LIBADD = $(libglnx_libs)
+libglnx_tests = test-libglnx-xattrs test-libglnx-fdio test-libglnx-errors
 test_libglnx_xattrs_SOURCES = libglnx/tests/test-libglnx-xattrs.c
 test_libglnx_xattrs_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
 test_libglnx_xattrs_LDADD = $(libglnx_libs) libglnx.la
+test_libglnx_fdio_SOURCES = libglnx/tests/test-libglnx-fdio.c
+test_libglnx_fdio_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
+test_libglnx_fdio_LDADD = $(libglnx_libs) libglnx.la
+test_libglnx_errors_SOURCES = libglnx/tests/test-libglnx-errors.c
+test_libglnx_errors_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
+test_libglnx_errors_LDADD = $(libglnx_libs) libglnx.la
 libbsdiff_srcpath := $(srcdir)/bsdiff
 libbsdiff_cflags := $(OT_DEP_GIO_UNIX_CFLAGS) "-I$(bsdiff_srcpath)"
 libbsdiff_libs := $(OT_DEP_GIO_UNIX_LIBS)
@@ -1893,6 +1928,8 @@ libbsdiff_la_CFLAGS = $(AM_CFLAGS)
 libotutil_la_SOURCES = \
 	src/libotutil/ot-checksum-utils.c \
 	src/libotutil/ot-checksum-utils.h \
+	src/libotutil/ot-checksum-instream.c \
+	src/libotutil/ot-checksum-instream.h \
 	src/libotutil/ot-fs-utils.c \
 	src/libotutil/ot-fs-utils.h \
 	src/libotutil/ot-keyfile-utils.c \
@@ -1901,8 +1938,6 @@ libotutil_la_SOURCES = \
 	src/libotutil/ot-opt-utils.h \
 	src/libotutil/ot-unix-utils.c \
 	src/libotutil/ot-unix-utils.h \
-	src/libotutil/ot-spawn-utils.c \
-	src/libotutil/ot-spawn-utils.h \
 	src/libotutil/ot-variant-utils.c \
 	src/libotutil/ot-variant-utils.h \
 	src/libotutil/ot-gio-utils.c \
@@ -1939,9 +1974,13 @@ libostree_public_headers = \
 	src/libostree/ostree-repo-deprecated.h \
 	$(NULL)
 
+
+# This one is generated via configure.ac, and the gtk-doc
+# code hence needs to look in the builddir.
+libostree_public_built_headers = src/libostree/ostree-version.h
 @ENABLE_RUST_FALSE@bupsplitpath = libbupsplit.la
 @ENABLE_RUST_TRUE@bupsplitpath = @abs_top_builddir@/target/@RUST_TARGET_SUBDIR@/libbupsplit_rs.a
-@ENABLE_RUST_TRUE@BUPSPLIT_RUST_SOURCES = rust/src/bupsplit.rs
+@ENABLE_RUST_TRUE@BUPSPLIT_RUST_SRCS = rust/src/bupsplit.rs
 @ENABLE_RUST_FALSE@libbupsplit_la_SOURCES = src/libostree/bupsplit.h src/libostree/bupsplit.c
 libostree_kernel_args_la_SOURCES = \
 	src/libostree/ostree-kernel-args.h \
@@ -1951,7 +1990,7 @@ libostree_kernel_args_la_SOURCES = \
 libostree_kernel_args_la_CFLAGS = -I$(srcdir)/libglnx $(OT_INTERNAL_GIO_UNIX_CFLAGS)
 libostree_kernel_args_la_LIBADD = $(OT_INTERNAL_GIO_UNIX_LIBS)
 libostreeincludedir = $(includedir)/ostree-1
-libostreeinclude_HEADERS = $(libostree_public_headers)
+libostreeinclude_HEADERS = $(libostree_public_headers) $(libostree_public_built_headers)
 ENUM_TYPES = $(NULL) $(srcdir)/src/libostree/ostree-fetcher.h
 nodist_libostree_1_la_SOURCES = \
 	src/libostree/ostree-enumtypes.h \
@@ -1992,6 +2031,7 @@ libostree_1_la_SOURCES = src/libostree/ostree-async-progress.c \
 	src/libostree/ostree-repo-file-enumerator.c \
 	src/libostree/ostree-repo-file-enumerator.h \
 	src/libostree/ostree-sepolicy.c \
+	src/libostree/ostree-sepolicy-private.h \
 	src/libostree/ostree-sysroot-private.h \
 	src/libostree/ostree-sysroot.c \
 	src/libostree/ostree-sysroot-cleanup.c \
@@ -2024,7 +2064,7 @@ libostree_1_la_CFLAGS = $(AM_CFLAGS) -I$(srcdir)/bsdiff \
 	-I$(srcdir)/src/libostree -I$(builddir)/src/libostree \
 	$(OT_INTERNAL_GIO_UNIX_CFLAGS) $(OT_INTERNAL_GPGME_CFLAGS) \
 	$(OT_DEP_LZMA_CFLAGS) $(OT_DEP_ZLIB_CFLAGS) \
-	-fvisibility=hidden \
+	$(OT_DEP_OPENSSL_CFLAGS) -fvisibility=hidden \
 	'-D_OSTREE_PUBLIC=__attribute__((visibility("default"))) \
 	extern' $(am__append_20) $(am__append_22) $(am__append_26) \
 	$(am__append_29) $(am__append_31) $(am__append_33)
@@ -2032,16 +2072,16 @@ libostree_1_la_LDFLAGS = -version-number 1:0:0 -Bsymbolic-functions -Wl,--versio
 libostree_1_la_LIBADD = libotutil.la libglnx.la libbsdiff.la \
 	libostree-kernel-args.la $(OT_INTERNAL_GIO_UNIX_LIBS) \
 	$(OT_INTERNAL_GPGME_LIBS) $(OT_DEP_LZMA_LIBS) \
-	$(OT_DEP_ZLIB_LIBS) $(bupsplitpath) $(am__append_21) \
+	$(OT_DEP_ZLIB_LIBS) $(OT_DEP_OPENSSL_LIBS) $(bupsplitpath) \
-	$(am__append_23) $(am__append_27) $(am__append_30) \
+	$(am__append_21) $(am__append_23) $(am__append_27) \
-	$(am__append_32) $(am__append_34)
+	$(am__append_30) $(am__append_32) $(am__append_34)
 EXTRA_libostree_1_la_DEPENDENCIES = $(top_srcdir)/src/libostree/libostree.sym
 @BUILDOPT_INTROSPECTION_TRUE@OSTree_1_0_gir_EXPORT_PACKAGES = ostree-1
 @BUILDOPT_INTROSPECTION_TRUE@OSTree_1_0_gir_INCLUDES = Gio-2.0
 @BUILDOPT_INTROSPECTION_TRUE@OSTree_1_0_gir_CFLAGS = $(libostree_1_la_CFLAGS)
 @BUILDOPT_INTROSPECTION_TRUE@OSTree_1_0_gir_LIBS = libostree-1.la
 @BUILDOPT_INTROSPECTION_TRUE@OSTree_1_0_gir_SCANNERFLAGS = --warn-all --identifier-prefix=Ostree --symbol-prefix=ostree
-@BUILDOPT_INTROSPECTION_TRUE@OSTree_1_0_gir_FILES = $(libostreeinclude_HEADERS) $(filter-out %-private.h,$(libostree_1_la_SOURCES))
+@BUILDOPT_INTROSPECTION_TRUE@OSTree_1_0_gir_FILES = $(libostreeinclude_HEADERS) $(filter-out %-private.h %/ostree-soup-uri.h,$(libostree_1_la_SOURCES))
 gpgreadme_DATA = src/libostree/README-gpg
 gpgreadmedir = $(datadir)/ostree/trusted.gpg.d
 
@@ -2095,7 +2135,7 @@ ostree_SOURCES = src/ostree/main.c src/ostree/ot-builtin-admin.c \
 	src/ostree/ot-remote-builtin-summary.c $(NULL) \
 	$(am__append_39) $(am__append_40)
 ostree_bin_shared_cflags = $(AM_CFLAGS) -I$(srcdir)/src/libotutil -I$(srcdir)/src/libostree \
-	-I$(srcdir)/src/ostree -I$(srcdir)/libglnx $(OT_INTERNAL_GIO_UNIX_CFLAGS) \
+	-I$(builddir)/src/libostree -I$(srcdir)/src/ostree -I$(srcdir)/libglnx $(OT_INTERNAL_GIO_UNIX_CFLAGS) \
 	-DPKGLIBEXECDIR=\"$(pkglibexecdir)\"
 
 ostree_bin_shared_ldadd = $(AM_LDFLAGS) libglnx.la libotutil.la libostree-1.la \
@@ -2143,13 +2183,14 @@ uninstalled_test_data = tests/ostree-symlink-stamp tests/ostree-prepare-root-sym
 
 dist_uninstalled_test_scripts = tests/test-symbols.sh
 dist_test_scripts = tests/test-basic.sh tests/test-basic-user.sh \
-	tests/test-pull-subpath.sh tests/test-archivez.sh \
+	tests/test-basic-user-only.sh tests/test-pull-subpath.sh \
-	tests/test-remote-add.sh tests/test-remote-headers.sh \
+	tests/test-archivez.sh tests/test-remote-add.sh \
-	tests/test-remote-gpg-import.sh tests/test-commit-sign.sh \
+	tests/test-remote-headers.sh tests/test-remote-gpg-import.sh \
-	tests/test-export.sh tests/test-help.sh \
+	tests/test-commit-sign.sh tests/test-export.sh \
-	tests/test-libarchive.sh tests/test-parent.sh \
+	tests/test-help.sh tests/test-libarchive.sh \
-	tests/test-pull-archive-z.sh tests/test-pull-commit-only.sh \
+	tests/test-parent.sh tests/test-pull-archive-z.sh \
-	tests/test-pull-depth.sh tests/test-pull-mirror-summary.sh \
+	tests/test-pull-commit-only.sh tests/test-pull-depth.sh \
+	tests/test-pull-mirror-summary.sh \
 	tests/test-pull-large-metadata.sh tests/test-pull-metalink.sh \
 	tests/test-pull-summary-sigs.sh tests/test-pull-resume.sh \
 	tests/test-pull-repeated.sh tests/test-pull-untrusted.sh \
@@ -2175,8 +2216,8 @@ dist_test_scripts = tests/test-basic.sh tests/test-basic-user.sh \
 	tests/test-auto-summary.sh tests/test-prune.sh \
 	tests/test-refs.sh tests/test-demo-buildsystem.sh \
 	tests/test-switchroot.sh tests/test-pull-contenturl.sh \
-	tests/test-pull-mirrorlist.sh $(NULL) $(am__append_51) \
+	tests/test-pull-mirrorlist.sh tests/coccinelle.sh $(NULL) \
-	$(am__append_53) $(am__append_54)
+	$(am__append_51) $(am__append_53) $(am__append_54)
 
 # These call into gjs scripts 
 js_tests = tests/test-corruption.sh tests/test-pull-corruption.sh
@@ -2390,6 +2431,8 @@ distclean-hdr:
 	-rm -f config.h stamp-h1
 src/libostree/ostree-1.pc: $(top_builddir)/config.status $(top_srcdir)/src/libostree/ostree-1.pc.in
 	cd $(top_builddir) && $(SHELL) ./config.status $@
+src/libostree/ostree-version.h: $(top_builddir)/config.status $(top_srcdir)/src/libostree/ostree-version.h.in
+	cd $(top_builddir) && $(SHELL) ./config.status $@
 
 clean-checkLTLIBRARIES:
 	-test -z "$(check_LTLIBRARIES)" || rm -f $(check_LTLIBRARIES)
@@ -2750,6 +2793,9 @@ src/libotutil/$(DEPDIR)/$(am__dirstamp):
 src/libotutil/libotutil_la-ot-checksum-utils.lo:  \
 	src/libotutil/$(am__dirstamp) \
 	src/libotutil/$(DEPDIR)/$(am__dirstamp)
+src/libotutil/libotutil_la-ot-checksum-instream.lo:  \
+	src/libotutil/$(am__dirstamp) \
+	src/libotutil/$(DEPDIR)/$(am__dirstamp)
 src/libotutil/libotutil_la-ot-fs-utils.lo:  \
 	src/libotutil/$(am__dirstamp) \
 	src/libotutil/$(DEPDIR)/$(am__dirstamp)
@@ -2762,9 +2808,6 @@ src/libotutil/libotutil_la-ot-opt-utils.lo:  \
 src/libotutil/libotutil_la-ot-unix-utils.lo:  \
 	src/libotutil/$(am__dirstamp) \
 	src/libotutil/$(DEPDIR)/$(am__dirstamp)
-src/libotutil/libotutil_la-ot-spawn-utils.lo:  \
-	src/libotutil/$(am__dirstamp) \
-	src/libotutil/$(DEPDIR)/$(am__dirstamp)
 src/libotutil/libotutil_la-ot-variant-utils.lo:  \
 	src/libotutil/$(am__dirstamp) \
 	src/libotutil/$(DEPDIR)/$(am__dirstamp)
@@ -3321,6 +3364,20 @@ libglnx/tests/$(am__dirstamp):
 libglnx/tests/$(DEPDIR)/$(am__dirstamp):
 	@$(MKDIR_P) libglnx/tests/$(DEPDIR)
 	@: > libglnx/tests/$(DEPDIR)/$(am__dirstamp)
+libglnx/tests/test_libglnx_errors-test-libglnx-errors.$(OBJEXT):  \
+	libglnx/tests/$(am__dirstamp) \
+	libglnx/tests/$(DEPDIR)/$(am__dirstamp)
+
+test-libglnx-errors$(EXEEXT): $(test_libglnx_errors_OBJECTS) $(test_libglnx_errors_DEPENDENCIES) $(EXTRA_test_libglnx_errors_DEPENDENCIES) 
+	@rm -f test-libglnx-errors$(EXEEXT)
+	$(AM_V_CCLD)$(test_libglnx_errors_LINK) $(test_libglnx_errors_OBJECTS) $(test_libglnx_errors_LDADD) $(LIBS)
+libglnx/tests/test_libglnx_fdio-test-libglnx-fdio.$(OBJEXT):  \
+	libglnx/tests/$(am__dirstamp) \
+	libglnx/tests/$(DEPDIR)/$(am__dirstamp)
+
+test-libglnx-fdio$(EXEEXT): $(test_libglnx_fdio_OBJECTS) $(test_libglnx_fdio_DEPENDENCIES) $(EXTRA_test_libglnx_fdio_DEPENDENCIES) 
+	@rm -f test-libglnx-fdio$(EXEEXT)
+	$(AM_V_CCLD)$(test_libglnx_fdio_LINK) $(test_libglnx_fdio_OBJECTS) $(test_libglnx_fdio_LDADD) $(LIBS)
 libglnx/tests/test_libglnx_xattrs-test-libglnx-xattrs.$(OBJEXT):  \
 	libglnx/tests/$(am__dirstamp) \
 	libglnx/tests/$(DEPDIR)/$(am__dirstamp)
@@ -3687,6 +3744,8 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@libglnx/$(DEPDIR)/libglnx_la-glnx-lockfile.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@libglnx/$(DEPDIR)/libglnx_la-glnx-shutil.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@libglnx/$(DEPDIR)/libglnx_la-glnx-xattrs.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@libglnx/tests/$(DEPDIR)/test_libglnx_errors-test-libglnx-errors.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@libglnx/tests/$(DEPDIR)/test_libglnx_fdio-test-libglnx-fdio.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@libglnx/tests/$(DEPDIR)/test_libglnx_xattrs-test-libglnx-xattrs.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/libostree/$(DEPDIR)/bupsplit.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/libostree/$(DEPDIR)/libostree_1_la-ostree-async-progress.Plo@am__quote@
@@ -3748,6 +3807,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@src/libostree/$(DEPDIR)/tests_test_rollsum-ostree-rollsum.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/libostree/$(DEPDIR)/tests_test_rollsum_cli-ostree-rollsum.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/libostree/$(DEPDIR)/tests_test_varint-ostree-varint.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@src/libotutil/$(DEPDIR)/libotutil_la-ot-checksum-instream.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/libotutil/$(DEPDIR)/libotutil_la-ot-checksum-utils.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/libotutil/$(DEPDIR)/libotutil_la-ot-fs-utils.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/libotutil/$(DEPDIR)/libotutil_la-ot-gio-utils.Plo@am__quote@
@@ -3755,7 +3815,6 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@src/libotutil/$(DEPDIR)/libotutil_la-ot-keyfile-utils.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/libotutil/$(DEPDIR)/libotutil_la-ot-log-utils.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/libotutil/$(DEPDIR)/libotutil_la-ot-opt-utils.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@src/libotutil/$(DEPDIR)/libotutil_la-ot-spawn-utils.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/libotutil/$(DEPDIR)/libotutil_la-ot-tool-util.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/libotutil/$(DEPDIR)/libotutil_la-ot-unix-utils.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/libotutil/$(DEPDIR)/libotutil_la-ot-variant-utils.Plo@am__quote@
@@ -4318,6 +4377,13 @@ src/libotutil/libotutil_la-ot-checksum-utils.lo: src/libotutil/ot-checksum-utils
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libotutil_la_CFLAGS) $(CFLAGS) -c -o src/libotutil/libotutil_la-ot-checksum-utils.lo `test -f 'src/libotutil/ot-checksum-utils.c' || echo '$(srcdir)/'`src/libotutil/ot-checksum-utils.c
 
+src/libotutil/libotutil_la-ot-checksum-instream.lo: src/libotutil/ot-checksum-instream.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libotutil_la_CFLAGS) $(CFLAGS) -MT src/libotutil/libotutil_la-ot-checksum-instream.lo -MD -MP -MF src/libotutil/$(DEPDIR)/libotutil_la-ot-checksum-instream.Tpo -c -o src/libotutil/libotutil_la-ot-checksum-instream.lo `test -f 'src/libotutil/ot-checksum-instream.c' || echo '$(srcdir)/'`src/libotutil/ot-checksum-instream.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) src/libotutil/$(DEPDIR)/libotutil_la-ot-checksum-instream.Tpo src/libotutil/$(DEPDIR)/libotutil_la-ot-checksum-instream.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='src/libotutil/ot-checksum-instream.c' object='src/libotutil/libotutil_la-ot-checksum-instream.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libotutil_la_CFLAGS) $(CFLAGS) -c -o src/libotutil/libotutil_la-ot-checksum-instream.lo `test -f 'src/libotutil/ot-checksum-instream.c' || echo '$(srcdir)/'`src/libotutil/ot-checksum-instream.c
+
 src/libotutil/libotutil_la-ot-fs-utils.lo: src/libotutil/ot-fs-utils.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libotutil_la_CFLAGS) $(CFLAGS) -MT src/libotutil/libotutil_la-ot-fs-utils.lo -MD -MP -MF src/libotutil/$(DEPDIR)/libotutil_la-ot-fs-utils.Tpo -c -o src/libotutil/libotutil_la-ot-fs-utils.lo `test -f 'src/libotutil/ot-fs-utils.c' || echo '$(srcdir)/'`src/libotutil/ot-fs-utils.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) src/libotutil/$(DEPDIR)/libotutil_la-ot-fs-utils.Tpo src/libotutil/$(DEPDIR)/libotutil_la-ot-fs-utils.Plo
@@ -4346,13 +4412,6 @@ src/libotutil/libotutil_la-ot-unix-utils.lo: src/libotutil/ot-unix-utils.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libotutil_la_CFLAGS) $(CFLAGS) -c -o src/libotutil/libotutil_la-ot-unix-utils.lo `test -f 'src/libotutil/ot-unix-utils.c' || echo '$(srcdir)/'`src/libotutil/ot-unix-utils.c
 
-src/libotutil/libotutil_la-ot-spawn-utils.lo: src/libotutil/ot-spawn-utils.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libotutil_la_CFLAGS) $(CFLAGS) -MT src/libotutil/libotutil_la-ot-spawn-utils.lo -MD -MP -MF src/libotutil/$(DEPDIR)/libotutil_la-ot-spawn-utils.Tpo -c -o src/libotutil/libotutil_la-ot-spawn-utils.lo `test -f 'src/libotutil/ot-spawn-utils.c' || echo '$(srcdir)/'`src/libotutil/ot-spawn-utils.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) src/libotutil/$(DEPDIR)/libotutil_la-ot-spawn-utils.Tpo src/libotutil/$(DEPDIR)/libotutil_la-ot-spawn-utils.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='src/libotutil/ot-spawn-utils.c' object='src/libotutil/libotutil_la-ot-spawn-utils.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libotutil_la_CFLAGS) $(CFLAGS) -c -o src/libotutil/libotutil_la-ot-spawn-utils.lo `test -f 'src/libotutil/ot-spawn-utils.c' || echo '$(srcdir)/'`src/libotutil/ot-spawn-utils.c
-
 src/libotutil/libotutil_la-ot-variant-utils.lo: src/libotutil/ot-variant-utils.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libotutil_la_CFLAGS) $(CFLAGS) -MT src/libotutil/libotutil_la-ot-variant-utils.lo -MD -MP -MF src/libotutil/$(DEPDIR)/libotutil_la-ot-variant-utils.Tpo -c -o src/libotutil/libotutil_la-ot-variant-utils.lo `test -f 'src/libotutil/ot-variant-utils.c' || echo '$(srcdir)/'`src/libotutil/ot-variant-utils.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) src/libotutil/$(DEPDIR)/libotutil_la-ot-variant-utils.Tpo src/libotutil/$(DEPDIR)/libotutil_la-ot-variant-utils.Plo
@@ -5242,6 +5301,34 @@ src/rofiles-fuse/rofiles_fuse-main.obj: src/rofiles-fuse/main.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(rofiles_fuse_CFLAGS) $(CFLAGS) -c -o src/rofiles-fuse/rofiles_fuse-main.obj `if test -f 'src/rofiles-fuse/main.c'; then $(CYGPATH_W) 'src/rofiles-fuse/main.c'; else $(CYGPATH_W) '$(srcdir)/src/rofiles-fuse/main.c'; fi`
 
+libglnx/tests/test_libglnx_errors-test-libglnx-errors.o: libglnx/tests/test-libglnx-errors.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_libglnx_errors_CFLAGS) $(CFLAGS) -MT libglnx/tests/test_libglnx_errors-test-libglnx-errors.o -MD -MP -MF libglnx/tests/$(DEPDIR)/test_libglnx_errors-test-libglnx-errors.Tpo -c -o libglnx/tests/test_libglnx_errors-test-libglnx-errors.o `test -f 'libglnx/tests/test-libglnx-errors.c' || echo '$(srcdir)/'`libglnx/tests/test-libglnx-errors.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) libglnx/tests/$(DEPDIR)/test_libglnx_errors-test-libglnx-errors.Tpo libglnx/tests/$(DEPDIR)/test_libglnx_errors-test-libglnx-errors.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='libglnx/tests/test-libglnx-errors.c' object='libglnx/tests/test_libglnx_errors-test-libglnx-errors.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_libglnx_errors_CFLAGS) $(CFLAGS) -c -o libglnx/tests/test_libglnx_errors-test-libglnx-errors.o `test -f 'libglnx/tests/test-libglnx-errors.c' || echo '$(srcdir)/'`libglnx/tests/test-libglnx-errors.c
+
+libglnx/tests/test_libglnx_errors-test-libglnx-errors.obj: libglnx/tests/test-libglnx-errors.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_libglnx_errors_CFLAGS) $(CFLAGS) -MT libglnx/tests/test_libglnx_errors-test-libglnx-errors.obj -MD -MP -MF libglnx/tests/$(DEPDIR)/test_libglnx_errors-test-libglnx-errors.Tpo -c -o libglnx/tests/test_libglnx_errors-test-libglnx-errors.obj `if test -f 'libglnx/tests/test-libglnx-errors.c'; then $(CYGPATH_W) 'libglnx/tests/test-libglnx-errors.c'; else $(CYGPATH_W) '$(srcdir)/libglnx/tests/test-libglnx-errors.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) libglnx/tests/$(DEPDIR)/test_libglnx_errors-test-libglnx-errors.Tpo libglnx/tests/$(DEPDIR)/test_libglnx_errors-test-libglnx-errors.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='libglnx/tests/test-libglnx-errors.c' object='libglnx/tests/test_libglnx_errors-test-libglnx-errors.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_libglnx_errors_CFLAGS) $(CFLAGS) -c -o libglnx/tests/test_libglnx_errors-test-libglnx-errors.obj `if test -f 'libglnx/tests/test-libglnx-errors.c'; then $(CYGPATH_W) 'libglnx/tests/test-libglnx-errors.c'; else $(CYGPATH_W) '$(srcdir)/libglnx/tests/test-libglnx-errors.c'; fi`
+
+libglnx/tests/test_libglnx_fdio-test-libglnx-fdio.o: libglnx/tests/test-libglnx-fdio.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_libglnx_fdio_CFLAGS) $(CFLAGS) -MT libglnx/tests/test_libglnx_fdio-test-libglnx-fdio.o -MD -MP -MF libglnx/tests/$(DEPDIR)/test_libglnx_fdio-test-libglnx-fdio.Tpo -c -o libglnx/tests/test_libglnx_fdio-test-libglnx-fdio.o `test -f 'libglnx/tests/test-libglnx-fdio.c' || echo '$(srcdir)/'`libglnx/tests/test-libglnx-fdio.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) libglnx/tests/$(DEPDIR)/test_libglnx_fdio-test-libglnx-fdio.Tpo libglnx/tests/$(DEPDIR)/test_libglnx_fdio-test-libglnx-fdio.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='libglnx/tests/test-libglnx-fdio.c' object='libglnx/tests/test_libglnx_fdio-test-libglnx-fdio.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_libglnx_fdio_CFLAGS) $(CFLAGS) -c -o libglnx/tests/test_libglnx_fdio-test-libglnx-fdio.o `test -f 'libglnx/tests/test-libglnx-fdio.c' || echo '$(srcdir)/'`libglnx/tests/test-libglnx-fdio.c
+
+libglnx/tests/test_libglnx_fdio-test-libglnx-fdio.obj: libglnx/tests/test-libglnx-fdio.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_libglnx_fdio_CFLAGS) $(CFLAGS) -MT libglnx/tests/test_libglnx_fdio-test-libglnx-fdio.obj -MD -MP -MF libglnx/tests/$(DEPDIR)/test_libglnx_fdio-test-libglnx-fdio.Tpo -c -o libglnx/tests/test_libglnx_fdio-test-libglnx-fdio.obj `if test -f 'libglnx/tests/test-libglnx-fdio.c'; then $(CYGPATH_W) 'libglnx/tests/test-libglnx-fdio.c'; else $(CYGPATH_W) '$(srcdir)/libglnx/tests/test-libglnx-fdio.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) libglnx/tests/$(DEPDIR)/test_libglnx_fdio-test-libglnx-fdio.Tpo libglnx/tests/$(DEPDIR)/test_libglnx_fdio-test-libglnx-fdio.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='libglnx/tests/test-libglnx-fdio.c' object='libglnx/tests/test_libglnx_fdio-test-libglnx-fdio.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_libglnx_fdio_CFLAGS) $(CFLAGS) -c -o libglnx/tests/test_libglnx_fdio-test-libglnx-fdio.obj `if test -f 'libglnx/tests/test-libglnx-fdio.c'; then $(CYGPATH_W) 'libglnx/tests/test-libglnx-fdio.c'; else $(CYGPATH_W) '$(srcdir)/libglnx/tests/test-libglnx-fdio.c'; fi`
+
 libglnx/tests/test_libglnx_xattrs-test-libglnx-xattrs.o: libglnx/tests/test-libglnx-xattrs.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(test_libglnx_xattrs_CFLAGS) $(CFLAGS) -MT libglnx/tests/test_libglnx_xattrs-test-libglnx-xattrs.o -MD -MP -MF libglnx/tests/$(DEPDIR)/test_libglnx_xattrs-test-libglnx-xattrs.Tpo -c -o libglnx/tests/test_libglnx_xattrs-test-libglnx-xattrs.o `test -f 'libglnx/tests/test-libglnx-xattrs.c' || echo '$(srcdir)/'`libglnx/tests/test-libglnx-xattrs.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) libglnx/tests/$(DEPDIR)/test_libglnx_xattrs-test-libglnx-xattrs.Tpo libglnx/tests/$(DEPDIR)/test_libglnx_xattrs-test-libglnx-xattrs.Po
@@ -6337,6 +6424,13 @@ tests/test-basic-user.sh.log: tests/test-basic-user.sh
 	--log-file $$b.log --trs-file $$b.trs \
 	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
 	"$$tst" $(AM_TESTS_FD_REDIRECT)
+tests/test-basic-user-only.sh.log: tests/test-basic-user-only.sh
+	@p='tests/test-basic-user-only.sh'; \
+	b='tests/test-basic-user-only.sh'; \
+	$(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \
+	--log-file $$b.log --trs-file $$b.trs \
+	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
+	"$$tst" $(AM_TESTS_FD_REDIRECT)
 tests/test-pull-subpath.sh.log: tests/test-pull-subpath.sh
 	@p='tests/test-pull-subpath.sh'; \
 	b='tests/test-pull-subpath.sh'; \
@@ -6701,6 +6795,13 @@ tests/test-pull-mirrorlist.sh.log: tests/test-pull-mirrorlist.sh
 	--log-file $$b.log --trs-file $$b.trs \
 	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
 	"$$tst" $(AM_TESTS_FD_REDIRECT)
+tests/coccinelle.sh.log: tests/coccinelle.sh
+	@p='tests/coccinelle.sh'; \
+	b='tests/coccinelle.sh'; \
+	$(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \
+	--log-file $$b.log --trs-file $$b.trs \
+	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
+	"$$tst" $(AM_TESTS_FD_REDIRECT)
 tests/test-rofiles-fuse.sh.log: tests/test-rofiles-fuse.sh
 	@p='tests/test-rofiles-fuse.sh'; \
 	b='tests/test-rofiles-fuse.sh'; \
@@ -6743,6 +6844,20 @@ test-libglnx-xattrs.log: test-libglnx-xattrs$(EXEEXT)
 	--log-file $$b.log --trs-file $$b.trs \
 	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
 	"$$tst" $(AM_TESTS_FD_REDIRECT)
+test-libglnx-fdio.log: test-libglnx-fdio$(EXEEXT)
+	@p='test-libglnx-fdio$(EXEEXT)'; \
+	b='test-libglnx-fdio'; \
+	$(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \
+	--log-file $$b.log --trs-file $$b.trs \
+	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
+	"$$tst" $(AM_TESTS_FD_REDIRECT)
+test-libglnx-errors.log: test-libglnx-errors$(EXEEXT)
+	@p='test-libglnx-errors$(EXEEXT)'; \
+	b='test-libglnx-errors'; \
+	$(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \
+	--log-file $$b.log --trs-file $$b.trs \
+	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
+	"$$tst" $(AM_TESTS_FD_REDIRECT)
 .test.log:
 	@p='$<'; \
 	$(am__set_b); \
@@ -7223,7 +7338,7 @@ all-local: $(ALL_LOCAL_RULES)
 @ENABLE_RUST_TRUE@   cargo vendor -q && \
 @ENABLE_RUST_TRUE@   mkdir .cargo && \
 @ENABLE_RUST_TRUE@	 cp cargo-vendor-config .cargo/config)
-@ENABLE_RUST_TRUE@$(bupsplitpath): Makefile $(BUPSPLIT_RUST_SOURCES)
+@ENABLE_RUST_TRUE@$(bupsplitpath): Makefile $(BUPSPLIT_RUST_SRCS)
 @ENABLE_RUST_TRUE@	cd $(top_srcdir)/rust && CARGO_TARGET_DIR=@abs_top_builddir@/target cargo build --verbose $(CARGO_RELEASE_ARGS)
 
 src/libostree/ostree-enumtypes.h: src/libostree/ostree-enumtypes.h.template $(ENUM_TYPES)

apidoc/Makefile.am

@@ -60,7 +60,7 @@ FIXXREF_OPTIONS=
 # Used for dependencies. The docs will be rebuilt if any of these change.
 # e.g. HFILE_GLOB=$(top_srcdir)/gtk/*.h
 # e.g. CFILE_GLOB=$(top_srcdir)/gtk/*.c
-HFILE_GLOB=$(addprefix $(top_srcdir)/,$(libostree_public_headers))
+HFILE_GLOB=$(addprefix $(top_srcdir)/,$(libostree_public_headers)) $(addprefix $(top_builddir)/,$(libostree_public_built_headers))
 CFILE_GLOB=$(top_srcdir)/src/libostree/*.c
 
 # Header files to ignore when scanning.

apidoc/Makefile.in

@@ -267,6 +267,8 @@ OT_DEP_LIBMOUNT_CFLAGS = @OT_DEP_LIBMOUNT_CFLAGS@
 OT_DEP_LIBMOUNT_LIBS = @OT_DEP_LIBMOUNT_LIBS@
 OT_DEP_LZMA_CFLAGS = @OT_DEP_LZMA_CFLAGS@
 OT_DEP_LZMA_LIBS = @OT_DEP_LZMA_LIBS@
+OT_DEP_OPENSSL_CFLAGS = @OT_DEP_OPENSSL_CFLAGS@
+OT_DEP_OPENSSL_LIBS = @OT_DEP_OPENSSL_LIBS@
 OT_DEP_SELINUX_CFLAGS = @OT_DEP_SELINUX_CFLAGS@
 OT_DEP_SELINUX_LIBS = @OT_DEP_SELINUX_LIBS@
 OT_DEP_SOUP_CFLAGS = @OT_DEP_SOUP_CFLAGS@
@@ -285,6 +287,7 @@ PKG_CONFIG = @PKG_CONFIG@
 PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
 PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
 RANLIB = @RANLIB@
+RELEASE_VERSION = @RELEASE_VERSION@
 RUST_TARGET_SUBDIR = @RUST_TARGET_SUBDIR@
 SED = @SED@
 SET_MAKE = @SET_MAKE@
@@ -295,6 +298,7 @@ VERSION = @VERSION@
 WARN_CFLAGS = @WARN_CFLAGS@
 XSLTPROC = @XSLTPROC@
 YACC = @YACC@
+YEAR_VERSION = @YEAR_VERSION@
 YFLAGS = @YFLAGS@
 abs_builddir = @abs_builddir@
 abs_srcdir = @abs_srcdir@
@@ -373,6 +377,10 @@ libostree_public_headers = \
 	src/libostree/ostree-repo-deprecated.h \
 	$(NULL)
 
+
+# This one is generated via configure.ac, and the gtk-doc
+# code hence needs to look in the builddir.
+libostree_public_built_headers = src/libostree/ostree-version.h
 NULL = 
 
 # We require automake 1.6 at least.
@@ -414,7 +422,7 @@ FIXXREF_OPTIONS =
 # Used for dependencies. The docs will be rebuilt if any of these change.
 # e.g. HFILE_GLOB=$(top_srcdir)/gtk/*.h
 # e.g. CFILE_GLOB=$(top_srcdir)/gtk/*.c
-HFILE_GLOB = $(addprefix $(top_srcdir)/,$(libostree_public_headers))
+HFILE_GLOB = $(addprefix $(top_srcdir)/,$(libostree_public_headers)) $(addprefix $(top_builddir)/,$(libostree_public_built_headers))
 CFILE_GLOB = $(top_srcdir)/src/libostree/*.c
 
 # Header files to ignore when scanning.

apidoc/html/index.html

@@ -14,7 +14,7 @@
 <div class="titlepage">
 <div>
 <div><table class="navigation" id="top" width="100%" cellpadding="2" cellspacing="0"><tr><th valign="middle"><p class="title">OSTree API references</p></th></tr></table></div>
-<div><p class="releaseinfo">for OSTree 2017.3</p></div>
+<div><p class="releaseinfo">for OSTree 2017.4</p></div>
 </div>
 <hr>
 </div>

apidoc/html/ostree-Content-addressed-object-store.html

@@ -2686,6 +2686,53 @@ ostree_repo_sign_delta (<em class="parameter"><code><a class="link" href="ostree
                         <em class="parameter"><code><span class="type">GError</span> **error</code></em>);</pre>
 <p>This function is deprecated, sign the summary file instead.
 Add a GPG signature to a static delta.</p>
+<div class="refsect3">
+<a name="ostree-repo-sign-delta.parameters"></a><h4>Parameters</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="150px" class="parameters_name">
+<col class="parameters_description">
+<col width="200px" class="parameters_annotations">
+</colgroup>
+<tbody>
+<tr>
+<td class="parameter_name"><p>self</p></td>
+<td class="parameter_description"><p>Self</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>from_commit</p></td>
+<td class="parameter_description"><p>From commit</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>to_commit</p></td>
+<td class="parameter_description"><p>To commit</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>key_id</p></td>
+<td class="parameter_description"><p>key id</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>homedir</p></td>
+<td class="parameter_description"><p>homedir</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>cancellable</p></td>
+<td class="parameter_description"><p>cancellable</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>error</p></td>
+<td class="parameter_description"><p>error</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+</tbody>
+</table></div>
+</div>
 </div>
 <hr>
 <div class="refsect2">
@@ -6914,6 +6961,13 @@ possible modes.</p>
 </td>
 <td class="enum_member_annotations"> </td>
 </tr>
+<tr>
+<td class="enum_member_name"><p><a name="OSTREE-REPO-MODE-BARE-USER-ONLY:CAPS"></a>OSTREE_REPO_MODE_BARE_USER_ONLY</p></td>
+<td class="enum_member_description">
+<p>Same as BARE_USER, but all metadata is not stored, so it can only be used for user checkouts. Does not need xattrs.</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
 </tbody>
 </table></div>
 </div>
@@ -6932,23 +6986,31 @@ possible modes.</p>
 <tbody>
 <tr>
 <td class="enum_member_name"><p><a name="OSTREE-REPO-REMOTE-CHANGE-ADD:CAPS"></a>OSTREE_REPO_REMOTE_CHANGE_ADD</p></td>
-<td> </td>
+<td class="enum_member_description">
-<td> </td>
+<p>Add a remote</p>
+</td>
+<td class="enum_member_annotations"> </td>
 </tr>
 <tr>
 <td class="enum_member_name"><p><a name="OSTREE-REPO-REMOTE-CHANGE-ADD-IF-NOT-EXISTS:CAPS"></a>OSTREE_REPO_REMOTE_CHANGE_ADD_IF_NOT_EXISTS</p></td>
-<td> </td>
+<td class="enum_member_description">
-<td> </td>
+<p>Like above, but do nothing if the remote exists</p>
+</td>
+<td class="enum_member_annotations"> </td>
 </tr>
 <tr>
 <td class="enum_member_name"><p><a name="OSTREE-REPO-REMOTE-CHANGE-DELETE:CAPS"></a>OSTREE_REPO_REMOTE_CHANGE_DELETE</p></td>
-<td> </td>
+<td class="enum_member_description">
-<td> </td>
+<p>Delete a remote</p>
+</td>
+<td class="enum_member_annotations"> </td>
 </tr>
 <tr>
 <td class="enum_member_name"><p><a name="OSTREE-REPO-REMOTE-CHANGE-DELETE-IF-EXISTS:CAPS"></a>OSTREE_REPO_REMOTE_CHANGE_DELETE_IF_EXISTS</p></td>
-<td> </td>
+<td class="enum_member_description">
-<td> </td>
+<p>Delete a remote, do nothing if the remote does not exist</p>
+</td>
+<td class="enum_member_annotations"> </td>
 </tr>
 </tbody>
 </table></div>
@@ -7105,6 +7167,20 @@ in bytes, counting only content objects.</p></td>
 </td>
 <td class="enum_member_annotations"> </td>
 </tr>
+<tr>
+<td class="enum_member_name"><p><a name="OSTREE-REPO-COMMIT-MODIFIER-FLAGS-CANONICAL-PERMISSIONS:CAPS"></a>OSTREE_REPO_COMMIT_MODIFIER_FLAGS_CANONICAL_PERMISSIONS</p></td>
+<td class="enum_member_description">
+<p>Canonicalize permissions for bare-user-only mode.</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="OSTREE-REPO-COMMIT-MODIFIER-FLAGS-ERROR-ON-UNLABELED:CAPS"></a>OSTREE_REPO_COMMIT_MODIFIER_FLAGS_ERROR_ON_UNLABELED</p></td>
+<td class="enum_member_description">
+<p>Emit an error if configured SELinux policy does not provide a label</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
 </tbody>
 </table></div>
 </div>

apidoc/html/ostree-Core-repository-independent-functions.html

@@ -393,6 +393,14 @@
 <a class="link" href="ostree-Core-repository-independent-functions.html#ostree-commit-get-timestamp" title="ostree_commit_get_timestamp ()">ostree_commit_get_timestamp</a> <span class="c_punctuation">()</span>
 </td>
 </tr>
+<tr>
+<td class="function_type">
+<span class="returnvalue">gboolean</span>
+</td>
+<td class="function_name">
+<a class="link" href="ostree-Core-repository-independent-functions.html#ostree-check-version" title="ostree_check_version ()">ostree_check_version</a> <span class="c_punctuation">()</span>
+</td>
+</tr>
 </tbody>
 </table></div>
 </div>
@@ -2143,6 +2151,39 @@ if none</p>
 <pre class="programlisting"><span class="returnvalue">guint64</span>
 ostree_commit_get_timestamp (<em class="parameter"><code><span class="type">GVariant</span> *commit_variant</code></em>);</pre>
 </div>
+<hr>
+<div class="refsect2">
+<a name="ostree-check-version"></a><h3>ostree_check_version ()</h3>
+<pre class="programlisting"><span class="returnvalue">gboolean</span>
+ostree_check_version (<em class="parameter"><code><span class="type">guint</span> required_year</code></em>,
+                      <em class="parameter"><code><span class="type">guint</span> required_release</code></em>);</pre>
+<div class="refsect3">
+<a name="ostree-check-version.parameters"></a><h4>Parameters</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="150px" class="parameters_name">
+<col class="parameters_description">
+<col width="200px" class="parameters_annotations">
+</colgroup>
+<tbody>
+<tr>
+<td class="parameter_name"><p>required_year</p></td>
+<td class="parameter_description"><p>Major/year required</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>required_release</p></td>
+<td class="parameter_description"><p>Release version required</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+</tbody>
+</table></div>
+</div>
+<div class="refsect3">
+<a name="ostree-check-version.returns"></a><h4>Returns</h4>
+<p> <code class="literal">TRUE</code> if current libostree has at least the requested version, <code class="literal">FALSE</code> otherwise</p>
+</div>
+</div>
 </div>
 <div class="refsect1">
 <a name="ostree-Core-repository-independent-functions.other_details"></a><h2>Types and Values</h2>

apidoc/html/ostree-Root-partition-mount-point.html

@@ -268,6 +268,14 @@
 <span class="returnvalue">gboolean</span>
 </td>
 <td class="function_name">
+<a class="link" href="ostree-Root-partition-mount-point.html#ostree-sysroot-write-deployments-with-options" title="ostree_sysroot_write_deployments_with_options ()">ostree_sysroot_write_deployments_with_options</a> <span class="c_punctuation">()</span>
+</td>
+</tr>
+<tr>
+<td class="function_type">
+<span class="returnvalue">gboolean</span>
+</td>
+<td class="function_name">
 <a class="link" href="ostree-Root-partition-mount-point.html#ostree-sysroot-write-origin-file" title="ostree_sysroot_write_origin_file ()">ostree_sysroot_write_origin_file</a> <span class="c_punctuation">()</span>
 </td>
 </tr>
@@ -1120,6 +1128,11 @@ layering additional non-OSTree content.</p>
 <td class="parameter_annotations"> </td>
 </tr>
 <tr>
+<td class="parameter_name"><p>cancellable</p></td>
+<td class="parameter_description"><p>Cancellable</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
 <td class="parameter_name"><p>error</p></td>
 <td class="parameter_description"><p>Error</p></td>
 <td class="parameter_annotations"> </td>
@@ -1189,9 +1202,8 @@ ostree_sysroot_write_deployments (<em class="parameter"><code><a class="link" hr
                                   <em class="parameter"><code><span class="type">GPtrArray</span> *new_deployments</code></em>,
                                   <em class="parameter"><code><span class="type">GCancellable</span> *cancellable</code></em>,
                                   <em class="parameter"><code><span class="type">GError</span> **error</code></em>);</pre>
-<p>Assuming <em class="parameter"><code>new_deployments</code></em>
+<p>Older version of <a class="link" href="ostree-Root-partition-mount-point.html#ostree-sysroot-write-deployments-with-options" title="ostree_sysroot_write_deployments_with_options ()"><code class="function">ostree_sysroot_write_deployments_with_options()</code></a>. This
- have already been deployed in place on
+version will perform post-deployment cleanup by default.</p>
-disk, atomically update bootloader configuration.</p>
 <div class="refsect3">
 <a name="ostree-sysroot-write-deployments.parameters"></a><h4>Parameters</h4>
 <div class="informaltable"><table class="informaltable" width="100%" border="0">
@@ -1227,6 +1239,62 @@ disk, atomically update bootloader configuration.</p>
 </div>
 <hr>
 <div class="refsect2">
+<a name="ostree-sysroot-write-deployments-with-options"></a><h3>ostree_sysroot_write_deployments_with_options ()</h3>
+<pre class="programlisting"><span class="returnvalue">gboolean</span>
+ostree_sysroot_write_deployments_with_options
+                               (<em class="parameter"><code><a class="link" href="ostree-Root-partition-mount-point.html#OstreeSysroot" title="OstreeSysroot"><span class="type">OstreeSysroot</span></a> *self</code></em>,
+                                <em class="parameter"><code><span class="type">GPtrArray</span> *new_deployments</code></em>,
+                                <em class="parameter"><code><span class="type">OstreeSysrootWriteDeploymentsOpts</span> *opts</code></em>,
+                                <em class="parameter"><code><span class="type">GCancellable</span> *cancellable</code></em>,
+                                <em class="parameter"><code><span class="type">GError</span> **error</code></em>);</pre>
+<p>Assuming <em class="parameter"><code>new_deployments</code></em>
+ have already been deployed in place on disk via
+<a class="link" href="ostree-Root-partition-mount-point.html#ostree-sysroot-deploy-tree" title="ostree_sysroot_deploy_tree ()"><code class="function">ostree_sysroot_deploy_tree()</code></a>, atomically update bootloader configuration. By
+default, no post-transaction cleanup will be performed. You should invoke
+<a class="link" href="ostree-Root-partition-mount-point.html#ostree-sysroot-cleanup" title="ostree_sysroot_cleanup ()"><code class="function">ostree_sysroot_cleanup()</code></a> at some point after the transaction, or specify
+<code class="literal">do_postclean</code> in <em class="parameter"><code>opts</code></em>
+.  Skipping the post-transaction cleanup is useful
+if for example you want to control pruning of the repository.</p>
+<div class="refsect3">
+<a name="ostree-sysroot-write-deployments-with-options.parameters"></a><h4>Parameters</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="150px" class="parameters_name">
+<col class="parameters_description">
+<col width="200px" class="parameters_annotations">
+</colgroup>
+<tbody>
+<tr>
+<td class="parameter_name"><p>self</p></td>
+<td class="parameter_description"><p>Sysroot</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>new_deployments</p></td>
+<td class="parameter_description"><p> List of new deployments. </p></td>
+<td class="parameter_annotations"><span class="annotation">[<a href="http://foldoc.org/element-type"><span class="acronym">element-type</span></a> OstreeDeployment]</span></td>
+</tr>
+<tr>
+<td class="parameter_name"><p>opts</p></td>
+<td class="parameter_description"><p>Options</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>cancellable</p></td>
+<td class="parameter_description"><p>Cancellable</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>error</p></td>
+<td class="parameter_description"><p>Error</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+</tbody>
+</table></div>
+</div>
+</div>
+<hr>
+<div class="refsect2">
 <a name="ostree-sysroot-write-origin-file"></a><h3>ostree_sysroot_write_origin_file ()</h3>
 <pre class="programlisting"><span class="returnvalue">gboolean</span>
 ostree_sysroot_write_origin_file (<em class="parameter"><code><a class="link" href="ostree-Root-partition-mount-point.html#OstreeSysroot" title="OstreeSysroot"><span class="type">OstreeSysroot</span></a> *sysroot</code></em>,
@@ -1405,11 +1473,18 @@ ostree_sysroot_origin_new_from_refspec
 <col class="parameters_description">
 <col width="200px" class="parameters_annotations">
 </colgroup>
-<tbody><tr>
+<tbody>
+<tr>
+<td class="parameter_name"><p>self</p></td>
+<td class="parameter_description"><p>Sysroot</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
 <td class="parameter_name"><p>refspec</p></td>
 <td class="parameter_description"><p>A refspec</p></td>
 <td class="parameter_annotations"> </td>
-</tr></tbody>
+</tr>
+</tbody>
 </table></div>
 </div>
 <div class="refsect3">

apidoc/html/ostree-SELinux-policy-management.html

@@ -49,6 +49,14 @@
 </tr>
 <tr>
 <td class="function_type">
+<a class="link" href="ostree-SELinux-policy-management.html#OstreeSePolicy" title="OstreeSePolicy"><span class="returnvalue">OstreeSePolicy</span></a> *
+</td>
+<td class="function_name">
+<a class="link" href="ostree-SELinux-policy-management.html#ostree-sepolicy-new-at" title="ostree_sepolicy_new_at ()">ostree_sepolicy_new_at</a> <span class="c_punctuation">()</span>
+</td>
+</tr>
+<tr>
+<td class="function_type">
 <span class="returnvalue">GFile</span> *
 </td>
 <td class="function_name">
@@ -144,11 +152,23 @@ ostree_sepolicy_new (<em class="parameter"><code><span class="type">GFile</span>
 <col class="parameters_description">
 <col width="200px" class="parameters_annotations">
 </colgroup>
-<tbody><tr>
+<tbody>
+<tr>
 <td class="parameter_name"><p>path</p></td>
 <td class="parameter_description"><p>Path to a root directory</p></td>
 <td class="parameter_annotations"> </td>
-</tr></tbody>
+</tr>
+<tr>
+<td class="parameter_name"><p>cancellable</p></td>
+<td class="parameter_description"><p>Cancellable</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>error</p></td>
+<td class="parameter_description"><p>Error</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+</tbody>
 </table></div>
 </div>
 <div class="refsect3">
@@ -160,6 +180,47 @@ ostree_sepolicy_new (<em class="parameter"><code><span class="type">GFile</span>
 </div>
 <hr>
 <div class="refsect2">
+<a name="ostree-sepolicy-new-at"></a><h3>ostree_sepolicy_new_at ()</h3>
+<pre class="programlisting"><a class="link" href="ostree-SELinux-policy-management.html#OstreeSePolicy" title="OstreeSePolicy"><span class="returnvalue">OstreeSePolicy</span></a> *
+ostree_sepolicy_new_at (<em class="parameter"><code><span class="type">int</span> rootfs_dfd</code></em>,
+                        <em class="parameter"><code><span class="type">GCancellable</span> *cancellable</code></em>,
+                        <em class="parameter"><code><span class="type">GError</span> **error</code></em>);</pre>
+<div class="refsect3">
+<a name="ostree-sepolicy-new-at.parameters"></a><h4>Parameters</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="150px" class="parameters_name">
+<col class="parameters_description">
+<col width="200px" class="parameters_annotations">
+</colgroup>
+<tbody>
+<tr>
+<td class="parameter_name"><p>rootfs_dfd</p></td>
+<td class="parameter_description"><p>Directory fd for rootfs (will not be cloned)</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>cancellable</p></td>
+<td class="parameter_description"><p>Cancellable</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>error</p></td>
+<td class="parameter_description"><p>Error</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+</tbody>
+</table></div>
+</div>
+<div class="refsect3">
+<a name="ostree-sepolicy-new-at.returns"></a><h4>Returns</h4>
+<p> An accessor object for SELinux policy in root located at <em class="parameter"><code>rootfs_dfd</code></em>
+. </p>
+<p><span class="annotation">[<a href="http://foldoc.org/transfer%20full"><span class="acronym">transfer full</span></a>]</span></p>
+</div>
+</div>
+<hr>
+<div class="refsect2">
 <a name="ostree-sepolicy-get-path"></a><h3>ostree_sepolicy_get_path ()</h3>
 <pre class="programlisting"><span class="returnvalue">GFile</span> *
 ostree_sepolicy_get_path (<em class="parameter"><code><a class="link" href="ostree-SELinux-policy-management.html#OstreeSePolicy" title="OstreeSePolicy"><span class="type">OstreeSePolicy</span></a> *self</code></em>);</pre>
@@ -365,6 +426,21 @@ ostree_sepolicy_setfscreatecon (<em class="parameter"><code><a class="link" href
 <pre class="programlisting"><span class="returnvalue">void</span>
 ostree_sepolicy_fscreatecon_cleanup (<em class="parameter"><code><span class="type">void</span> **unused</code></em>);</pre>
 <p>Cleanup function for <a class="link" href="ostree-SELinux-policy-management.html#ostree-sepolicy-setfscreatecon" title="ostree_sepolicy_setfscreatecon ()"><code class="function">ostree_sepolicy_setfscreatecon()</code></a>.</p>
+<div class="refsect3">
+<a name="ostree-sepolicy-fscreatecon-cleanup.parameters"></a><h4>Parameters</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="150px" class="parameters_name">
+<col class="parameters_description">
+<col width="200px" class="parameters_annotations">
+</colgroup>
+<tbody><tr>
+<td class="parameter_name"><p>unused</p></td>
+<td class="parameter_description"><p>Not used, just in case you didn't infer that from the parameter name</p></td>
+<td class="parameter_annotations"> </td>
+</tr></tbody>
+</table></div>
+</div>
 </div>
 </div>
 <div class="refsect1">

apidoc/html/ostree-Simple-upgrade-class.html

@@ -174,11 +174,23 @@ ostree_sysroot_upgrader_new (<em class="parameter"><code><a class="link" href="o
 <col class="parameters_description">
 <col width="200px" class="parameters_annotations">
 </colgroup>
-<tbody><tr>
+<tbody>
+<tr>
 <td class="parameter_name"><p>sysroot</p></td>
 <td class="parameter_description"><p>An <a class="link" href="ostree-Root-partition-mount-point.html#OstreeSysroot" title="OstreeSysroot"><span class="type">OstreeSysroot</span></a></p></td>
 <td class="parameter_annotations"> </td>
-</tr></tbody>
+</tr>
+<tr>
+<td class="parameter_name"><p>cancellable</p></td>
+<td class="parameter_description"><p>Cancellable</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>error</p></td>
+<td class="parameter_description"><p>Error</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+</tbody>
 </table></div>
 </div>
 <div class="refsect3">
@@ -214,6 +226,16 @@ ostree_sysroot_upgrader_new_for_os (<em class="parameter"><code><a class="link"
 <td class="parameter_description"><p> Operating system name. </p></td>
 <td class="parameter_annotations"><span class="annotation">[<a href="http://foldoc.org/allow-none"><span class="acronym">allow-none</span></a>]</span></td>
 </tr>
+<tr>
+<td class="parameter_name"><p>cancellable</p></td>
+<td class="parameter_description"><p>Cancellable</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>error</p></td>
+<td class="parameter_description"><p>Error</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
 </tbody>
 </table></div>
 </div>
@@ -257,6 +279,16 @@ ostree_sysroot_upgrader_new_for_os_with_flags
 <td class="parameter_description"><p>Flags</p></td>
 <td class="parameter_annotations"> </td>
 </tr>
+<tr>
+<td class="parameter_name"><p>cancellable</p></td>
+<td class="parameter_description"><p>Cancellable</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>error</p></td>
+<td class="parameter_description"><p>Error</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
 </tbody>
 </table></div>
 </div>
@@ -515,6 +547,58 @@ ostree_sysroot_upgrader_pull_one_dir (<em class="parameter"><code><a class="link
 <p>Like <a class="link" href="ostree-Simple-upgrade-class.html#ostree-sysroot-upgrader-pull" title="ostree_sysroot_upgrader_pull ()"><code class="function">ostree_sysroot_upgrader_pull()</code></a>, but allows retrieving just a
 subpath of the tree.  This can be used to download metadata files
 from inside the tree such as package databases.</p>
+<div class="refsect3">
+<a name="ostree-sysroot-upgrader-pull-one-dir.parameters"></a><h4>Parameters</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="150px" class="parameters_name">
+<col class="parameters_description">
+<col width="200px" class="parameters_annotations">
+</colgroup>
+<tbody>
+<tr>
+<td class="parameter_name"><p>self</p></td>
+<td class="parameter_description"><p>Upgrader</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>dir_to_pull</p></td>
+<td class="parameter_description"><p>Subdirectory path (should include a leading /)</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>flags</p></td>
+<td class="parameter_description"><p>Flags controlling pull behavior</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>upgrader_flags</p></td>
+<td class="parameter_description"><p>Flags controlling upgrader behavior</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>progress</p></td>
+<td class="parameter_description"><p> Progress. </p></td>
+<td class="parameter_annotations"><span class="annotation">[<a href="http://foldoc.org/allow-none"><span class="acronym">allow-none</span></a>]</span></td>
+</tr>
+<tr>
+<td class="parameter_name"><p>out_changed</p></td>
+<td class="parameter_description"><p> Whether or not the origin changed. </p></td>
+<td class="parameter_annotations"><span class="annotation">[<a href="http://foldoc.org/out"><span class="acronym">out</span></a>]</span></td>
+</tr>
+<tr>
+<td class="parameter_name"><p>cancellable</p></td>
+<td class="parameter_description"><p>Cancellable</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>error</p></td>
+<td class="parameter_description"><p>Error</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+</tbody>
+</table></div>
+</div>
 </div>
 <hr>
 <div class="refsect2">

apidoc/html/ostree-ostree-diff.html

@@ -65,6 +65,14 @@
 </tr>
 <tr>
 <td class="function_type">
+<span class="returnvalue">gboolean</span>
+</td>
+<td class="function_name">
+<a class="link" href="ostree-ostree-diff.html#ostree-diff-dirs-with-options" title="ostree_diff_dirs_with_options ()">ostree_diff_dirs_with_options</a> <span class="c_punctuation">()</span>
+</td>
+</tr>
+<tr>
+<td class="function_type">
 <span class="returnvalue">void</span>
 </td>
 <td class="function_name">
@@ -183,6 +191,84 @@ sets of <a class="link" href="ostree-ostree-diff.html#OstreeDiffItem" title="str
 </div>
 <hr>
 <div class="refsect2">
+<a name="ostree-diff-dirs-with-options"></a><h3>ostree_diff_dirs_with_options ()</h3>
+<pre class="programlisting"><span class="returnvalue">gboolean</span>
+ostree_diff_dirs_with_options (<em class="parameter"><code><a class="link" href="ostree-ostree-diff.html#OstreeDiffFlags" title="enum OstreeDiffFlags"><span class="type">OstreeDiffFlags</span></a> flags</code></em>,
+                               <em class="parameter"><code><span class="type">GFile</span> *a</code></em>,
+                               <em class="parameter"><code><span class="type">GFile</span> *b</code></em>,
+                               <em class="parameter"><code><span class="type">GPtrArray</span> *modified</code></em>,
+                               <em class="parameter"><code><span class="type">GPtrArray</span> *removed</code></em>,
+                               <em class="parameter"><code><span class="type">GPtrArray</span> *added</code></em>,
+                               <em class="parameter"><code><span class="type">OstreeDiffDirsOptions</span> *options</code></em>,
+                               <em class="parameter"><code><span class="type">GCancellable</span> *cancellable</code></em>,
+                               <em class="parameter"><code><span class="type">GError</span> **error</code></em>);</pre>
+<p>Compute the difference between directory <em class="parameter"><code>a</code></em>
+ and <em class="parameter"><code>b</code></em>
+ as 3 separate
+sets of <a class="link" href="ostree-ostree-diff.html#OstreeDiffItem" title="struct OstreeDiffItem"><span class="type">OstreeDiffItem</span></a> in <em class="parameter"><code>modified</code></em>
+, <em class="parameter"><code>removed</code></em>
+, and <em class="parameter"><code>added</code></em>
+.</p>
+<div class="refsect3">
+<a name="ostree-diff-dirs-with-options.parameters"></a><h4>Parameters</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="150px" class="parameters_name">
+<col class="parameters_description">
+<col width="200px" class="parameters_annotations">
+</colgroup>
+<tbody>
+<tr>
+<td class="parameter_name"><p>flags</p></td>
+<td class="parameter_description"><p>Flags</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>a</p></td>
+<td class="parameter_description"><p>First directory path, or <code class="literal">NULL</code></p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>b</p></td>
+<td class="parameter_description"><p>First directory path</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>modified</p></td>
+<td class="parameter_description"><p> Modified files. </p></td>
+<td class="parameter_annotations"><span class="annotation">[<a href="http://foldoc.org/element-type"><span class="acronym">element-type</span></a> OstreeDiffItem]</span></td>
+</tr>
+<tr>
+<td class="parameter_name"><p>removed</p></td>
+<td class="parameter_description"><p> Removed files. </p></td>
+<td class="parameter_annotations"><span class="annotation">[<a href="http://foldoc.org/element-type"><span class="acronym">element-type</span></a> Gio.File]</span></td>
+</tr>
+<tr>
+<td class="parameter_name"><p>added</p></td>
+<td class="parameter_description"><p> Added files. </p></td>
+<td class="parameter_annotations"><span class="annotation">[<a href="http://foldoc.org/element-type"><span class="acronym">element-type</span></a> Gio.File]</span></td>
+</tr>
+<tr>
+<td class="parameter_name"><p>cancellable</p></td>
+<td class="parameter_description"><p>Cancellable</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>options</p></td>
+<td class="parameter_description"><p> Options. </p></td>
+<td class="parameter_annotations"><span class="annotation">[<a href="http://foldoc.org/allow-none"><span class="acronym">allow-none</span></a>]</span></td>
+</tr>
+<tr>
+<td class="parameter_name"><p>error</p></td>
+<td class="parameter_description"><p>Error</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+</tbody>
+</table></div>
+</div>
+</div>
+<hr>
+<div class="refsect2">
 <a name="ostree-diff-print"></a><h3>ostree_diff_print ()</h3>
 <pre class="programlisting"><span class="returnvalue">void</span>
 ostree_diff_print (<em class="parameter"><code><span class="type">GFile</span> *a</code></em>,

apidoc/html/ostree.devhelp2

@@ -65,6 +65,7 @@
     <keyword type="function" name="ostree_validate_structureof_dirmeta ()" link="ostree-Core-repository-independent-functions.html#ostree-validate-structureof-dirmeta"/>
     <keyword type="function" name="ostree_commit_get_parent ()" link="ostree-Core-repository-independent-functions.html#ostree-commit-get-parent"/>
     <keyword type="function" name="ostree_commit_get_timestamp ()" link="ostree-Core-repository-independent-functions.html#ostree-commit-get-timestamp"/>
+    <keyword type="function" name="ostree_check_version ()" link="ostree-Core-repository-independent-functions.html#ostree-check-version"/>
     <keyword type="macro" name="OSTREE_MAX_METADATA_SIZE" link="ostree-Core-repository-independent-functions.html#OSTREE-MAX-METADATA-SIZE:CAPS"/>
     <keyword type="macro" name="OSTREE_MAX_METADATA_WARN_SIZE" link="ostree-Core-repository-independent-functions.html#OSTREE-MAX-METADATA-WARN-SIZE:CAPS"/>
     <keyword type="macro" name="OSTREE_MAX_RECURSION" link="ostree-Core-repository-independent-functions.html#OSTREE-MAX-RECURSION:CAPS"/>
@@ -257,6 +258,7 @@
     <keyword type="function" name="ostree_sysroot_deployment_set_mutable ()" link="ostree-Root-partition-mount-point.html#ostree-sysroot-deployment-set-mutable"/>
     <keyword type="function" name="ostree_sysroot_deployment_unlock ()" link="ostree-Root-partition-mount-point.html#ostree-sysroot-deployment-unlock"/>
     <keyword type="function" name="ostree_sysroot_write_deployments ()" link="ostree-Root-partition-mount-point.html#ostree-sysroot-write-deployments"/>
+    <keyword type="function" name="ostree_sysroot_write_deployments_with_options ()" link="ostree-Root-partition-mount-point.html#ostree-sysroot-write-deployments-with-options"/>
     <keyword type="function" name="ostree_sysroot_write_origin_file ()" link="ostree-Root-partition-mount-point.html#ostree-sysroot-write-origin-file"/>
     <keyword type="function" name="ostree_sysroot_deploy_tree ()" link="ostree-Root-partition-mount-point.html#ostree-sysroot-deploy-tree"/>
     <keyword type="function" name="ostree_sysroot_get_merge_deployment ()" link="ostree-Root-partition-mount-point.html#ostree-sysroot-get-merge-deployment"/>
@@ -275,6 +277,7 @@
     <keyword type="function" name="ostree_async_progress_finish ()" link="ostree-Progress-notification-system-for-asynchronous-operations.html#ostree-async-progress-finish"/>
     <keyword type="typedef" name="OstreeAsyncProgress" link="ostree-Progress-notification-system-for-asynchronous-operations.html#OstreeAsyncProgress"/>
     <keyword type="function" name="ostree_sepolicy_new ()" link="ostree-SELinux-policy-management.html#ostree-sepolicy-new"/>
+    <keyword type="function" name="ostree_sepolicy_new_at ()" link="ostree-SELinux-policy-management.html#ostree-sepolicy-new-at"/>
     <keyword type="function" name="ostree_sepolicy_get_path ()" link="ostree-SELinux-policy-management.html#ostree-sepolicy-get-path"/>
     <keyword type="function" name="ostree_sepolicy_get_name ()" link="ostree-SELinux-policy-management.html#ostree-sepolicy-get-name"/>
     <keyword type="function" name="ostree_sepolicy_get_label ()" link="ostree-SELinux-policy-management.html#ostree-sepolicy-get-label"/>
@@ -345,6 +348,7 @@
     <keyword type="function" name="ostree_diff_item_ref ()" link="ostree-ostree-diff.html#ostree-diff-item-ref"/>
     <keyword type="function" name="ostree_diff_item_unref ()" link="ostree-ostree-diff.html#ostree-diff-item-unref"/>
     <keyword type="function" name="ostree_diff_dirs ()" link="ostree-ostree-diff.html#ostree-diff-dirs"/>
+    <keyword type="function" name="ostree_diff_dirs_with_options ()" link="ostree-ostree-diff.html#ostree-diff-dirs-with-options"/>
     <keyword type="function" name="ostree_diff_print ()" link="ostree-ostree-diff.html#ostree-diff-print"/>
     <keyword type="enum" name="enum OstreeDiffFlags" link="ostree-ostree-diff.html#OstreeDiffFlags"/>
     <keyword type="struct" name="struct OstreeDiffItem" link="ostree-ostree-diff.html#OstreeDiffItem"/>
@@ -370,6 +374,7 @@
     <keyword type="constant" name="OSTREE_REPO_MODE_BARE" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-MODE-BARE:CAPS"/>
     <keyword type="constant" name="OSTREE_REPO_MODE_ARCHIVE_Z2" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-MODE-ARCHIVE-Z2:CAPS"/>
     <keyword type="constant" name="OSTREE_REPO_MODE_BARE_USER" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-MODE-BARE-USER:CAPS"/>
+    <keyword type="constant" name="OSTREE_REPO_MODE_BARE_USER_ONLY" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-MODE-BARE-USER-ONLY:CAPS"/>
     <keyword type="constant" name="OSTREE_REPO_REMOTE_CHANGE_ADD" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-REMOTE-CHANGE-ADD:CAPS"/>
     <keyword type="constant" name="OSTREE_REPO_REMOTE_CHANGE_ADD_IF_NOT_EXISTS" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-REMOTE-CHANGE-ADD-IF-NOT-EXISTS:CAPS"/>
     <keyword type="constant" name="OSTREE_REPO_REMOTE_CHANGE_DELETE" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-REMOTE-CHANGE-DELETE:CAPS"/>
@@ -379,6 +384,8 @@
     <keyword type="constant" name="OSTREE_REPO_COMMIT_MODIFIER_FLAGS_NONE" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-COMMIT-MODIFIER-FLAGS-NONE:CAPS"/>
     <keyword type="constant" name="OSTREE_REPO_COMMIT_MODIFIER_FLAGS_SKIP_XATTRS" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-COMMIT-MODIFIER-FLAGS-SKIP-XATTRS:CAPS"/>
     <keyword type="constant" name="OSTREE_REPO_COMMIT_MODIFIER_FLAGS_GENERATE_SIZES" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-COMMIT-MODIFIER-FLAGS-GENERATE-SIZES:CAPS"/>
+    <keyword type="constant" name="OSTREE_REPO_COMMIT_MODIFIER_FLAGS_CANONICAL_PERMISSIONS" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-COMMIT-MODIFIER-FLAGS-CANONICAL-PERMISSIONS:CAPS"/>
+    <keyword type="constant" name="OSTREE_REPO_COMMIT_MODIFIER_FLAGS_ERROR_ON_UNLABELED" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-COMMIT-MODIFIER-FLAGS-ERROR-ON-UNLABELED:CAPS"/>
     <keyword type="constant" name="OSTREE_REPO_CHECKOUT_MODE_NONE" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-CHECKOUT-MODE-NONE:CAPS"/>
     <keyword type="constant" name="OSTREE_REPO_CHECKOUT_MODE_USER" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-CHECKOUT-MODE-USER:CAPS"/>
     <keyword type="constant" name="OSTREE_REPO_CHECKOUT_OVERWRITE_NONE" link="ostree-Content-addressed-object-store.html#OSTREE-REPO-CHECKOUT-OVERWRITE-NONE:CAPS"/>

apidoc/html/reference.html

@@ -230,6 +230,14 @@
 </dt>
 <dd></dd>
 <dt>
+OSTREE_CHECK_VERSION, macro in ostree-version
+</dt>
+<dd></dd>
+<dt>
+<a class="link" href="ostree-Core-repository-independent-functions.html#ostree-check-version" title="ostree_check_version ()">ostree_check_version</a>, function in <a class="link" href="ostree-Core-repository-independent-functions.html" title="Core repository-independent functions">Core repository-independent functions</a>
+</dt>
+<dd></dd>
+<dt>
 <a class="link" href="ostree-Core-repository-independent-functions.html#ostree-cmp-checksum-bytes" title="ostree_cmp_checksum_bytes ()">ostree_cmp_checksum_bytes</a>, function in <a class="link" href="ostree-Core-repository-independent-functions.html" title="Core repository-independent functions">Core repository-independent functions</a>
 </dt>
 <dd></dd>
@@ -359,6 +367,10 @@
 </dt>
 <dd></dd>
 <dt>
+<a class="link" href="ostree-ostree-diff.html#ostree-diff-dirs-with-options" title="ostree_diff_dirs_with_options ()">ostree_diff_dirs_with_options</a>, function in <a class="link" href="ostree-ostree-diff.html" title="ostree-diff">ostree-diff</a>
+</dt>
+<dd></dd>
+<dt>
 <a class="link" href="ostree-ostree-diff.html#ostree-diff-item-ref" title="ostree_diff_item_ref ()">ostree_diff_item_ref</a>, function in <a class="link" href="ostree-ostree-diff.html" title="ostree-diff">ostree-diff</a>
 </dt>
 <dd></dd>
@@ -562,6 +574,10 @@
 </dt>
 <dd></dd>
 <dt>
+OSTREE_RELEASE_VERSION, macro in ostree-version
+</dt>
+<dd></dd>
+<dt>
 <a class="link" href="ostree-Content-addressed-object-store.html#OstreeRepo" title="OstreeRepo">OstreeRepo</a>, typedef in <a class="link" href="ostree-Content-addressed-object-store.html" title="Content-addressed object store">Content-addressed object store</a>
 </dt>
 <dd></dd>
@@ -1187,6 +1203,10 @@
 </dt>
 <dd></dd>
 <dt>
+<a class="link" href="ostree-SELinux-policy-management.html#ostree-sepolicy-new-at" title="ostree_sepolicy_new_at ()">ostree_sepolicy_new_at</a>, function in <a class="link" href="ostree-SELinux-policy-management.html" title="SELinux policy management">SELinux policy management</a>
+</dt>
+<dd></dd>
+<dt>
 <a class="link" href="ostree-SELinux-policy-management.html#ostree-sepolicy-restorecon" title="ostree_sepolicy_restorecon ()">ostree_sepolicy_restorecon</a>, function in <a class="link" href="ostree-SELinux-policy-management.html" title="SELinux policy management">SELinux policy management</a>
 </dt>
 <dd></dd>
@@ -1399,6 +1419,10 @@
 </dt>
 <dd></dd>
 <dt>
+<a class="link" href="ostree-Root-partition-mount-point.html#ostree-sysroot-write-deployments-with-options" title="ostree_sysroot_write_deployments_with_options ()">ostree_sysroot_write_deployments_with_options</a>, function in <a class="link" href="ostree-Root-partition-mount-point.html" title="Root partition mount point">Root partition mount point</a>
+</dt>
+<dd></dd>
+<dt>
 <a class="link" href="ostree-Root-partition-mount-point.html#ostree-sysroot-write-origin-file" title="ostree_sysroot_write_origin_file ()">ostree_sysroot_write_origin_file</a>, function in <a class="link" href="ostree-Root-partition-mount-point.html" title="Root partition mount point">Root partition mount point</a>
 </dt>
 <dd></dd>
@@ -1448,6 +1472,23 @@
 <a class="link" href="ostree-Core-repository-independent-functions.html#ostree-validate-structureof-objtype" title="ostree_validate_structureof_objtype ()">ostree_validate_structureof_objtype</a>, function in <a class="link" href="ostree-Core-repository-independent-functions.html" title="Core repository-independent functions">Core repository-independent functions</a>
 </dt>
 <dd></dd>
+<dt>
+OSTREE_VERSION, macro in ostree-version
+</dt>
+<dd></dd>
+<dt>
+OSTREE_VERSION_HEX, macro in ostree-version
+</dt>
+<dd></dd>
+<dt>
+OSTREE_VERSION_S, macro in ostree-version
+</dt>
+<dd></dd>
+<a name="idxY"></a><h3 class="title">Y</h3>
+<dt>
+OSTREE_YEAR_VERSION, macro in ostree-version
+</dt>
+<dd></dd>
 </div>
 </div>
 <div class="footer">

apidoc/ostree-sections.txt

@@ -71,6 +71,16 @@ OstreeChecksumInputStreamPrivate
 ostree_checksum_input_stream_get_type
 </SECTION>
 
+<SECTION>
+<FILE>ostree-version</FILE>
+OSTREE_CHECK_VERSION
+OSTREE_YEAR_VERSION
+OSTREE_RELEASE_VERSION
+OSTREE_VERSION
+OSTREE_VERSION_S
+OSTREE_VERSION_HEX
+</SECTION>
+
 <SECTION>
 <FILE>ostree-core</FILE>
 OSTREE_MAX_METADATA_SIZE
@@ -133,6 +143,7 @@ ostree_validate_structureof_dirtree
 ostree_validate_structureof_dirmeta
 ostree_commit_get_parent
 ostree_commit_get_timestamp
+ostree_check_version
 </SECTION>
 
 <SECTION>
@@ -171,6 +182,7 @@ OstreeDiffItem
 ostree_diff_item_ref
 ostree_diff_item_unref
 ostree_diff_dirs
+ostree_diff_dirs_with_options
 ostree_diff_print
 <SUBSECTION Standard>
 ostree_diff_item_get_type
@@ -424,6 +436,7 @@ ostree_repo_file_get_type
 <FILE>ostree-sepolicy</FILE>
 OstreeSePolicy
 ostree_sepolicy_new
+ostree_sepolicy_new_at
 ostree_sepolicy_get_path
 ostree_sepolicy_get_name
 ostree_sepolicy_get_label
@@ -470,6 +483,7 @@ ostree_sysroot_deployment_set_kargs
 ostree_sysroot_deployment_set_mutable
 ostree_sysroot_deployment_unlock
 ostree_sysroot_write_deployments
+ostree_sysroot_write_deployments_with_options
 ostree_sysroot_write_origin_file
 ostree_sysroot_deploy_tree
 ostree_sysroot_get_merge_deployment

apidoc/version.xml

@@ -1 +1 @@
-2017.3
+2017.4

config.h.in

@@ -1,5 +1,8 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */
 
+/* Define if we are enabling ostree trivial-httpd entrypoint */
+#undef BUILDOPT_ENABLE_TRIVIAL_HTTPD_CMDLINE
+
 /* Define if we should avoid using O_TMPFILE */
 #undef DISABLE_OTMPFILE
 
@@ -52,6 +55,9 @@
 /* Define to 1 if you have the `mnt_unref_cache' function. */
 #undef HAVE_MNT_UNREF_CACHE
 
+/* Define if we have openssl */
+#undef HAVE_OPENSSL
+
 /* Define if we have libselinux.pc */
 #undef HAVE_SELINUX
 

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for libostree 2017.3.
+# Generated by GNU Autoconf 2.69 for libostree 2017.4.
 #
 # Report bugs to <walters@verbum.org>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='libostree'
 PACKAGE_TARNAME='libostree'
-PACKAGE_VERSION='2017.3'
+PACKAGE_VERSION='2017.4'
-PACKAGE_STRING='libostree 2017.3'
+PACKAGE_STRING='libostree 2017.4'
 PACKAGE_BUGREPORT='walters@verbum.org'
 PACKAGE_URL=''
 
@@ -665,6 +665,10 @@ USE_LIBMOUNT_FALSE
 USE_LIBMOUNT_TRUE
 OT_DEP_LIBMOUNT_LIBS
 OT_DEP_LIBMOUNT_CFLAGS
+USE_OPENSSL_FALSE
+USE_OPENSSL_TRUE
+OT_DEP_OPENSSL_LIBS
+OT_DEP_OPENSSL_CFLAGS
 USE_SMACK_FALSE
 USE_SMACK_TRUE
 USE_SELINUX_FALSE
@@ -788,6 +792,8 @@ LIBTOOL
 BUILDOPT_ASAN_FALSE
 BUILDOPT_ASAN_TRUE
 WARN_CFLAGS
+RELEASE_VERSION
+YEAR_VERSION
 YFLAGS
 YACC
 EGREP
@@ -901,6 +907,7 @@ enable_glibtest
 with_curl
 with_soup
 enable_libsoup_client_certs
+enable_trivial_httpd_cmdline
 enable_introspection
 with_gpgme_prefix
 with_html_dir
@@ -913,6 +920,7 @@ enable_rust_debug
 with_libarchive
 with_selinux
 with_smack
+with_openssl
 with_libmount
 enable_rofiles_fuse
 with_dracut
@@ -957,6 +965,8 @@ OT_DEP_LIBARCHIVE_CFLAGS
 OT_DEP_LIBARCHIVE_LIBS
 OT_DEP_SELINUX_CFLAGS
 OT_DEP_SELINUX_LIBS
+OT_DEP_OPENSSL_CFLAGS
+OT_DEP_OPENSSL_LIBS
 OT_DEP_LIBMOUNT_CFLAGS
 OT_DEP_LIBMOUNT_LIBS
 BUILDOPT_FUSE_CFLAGS
@@ -1503,7 +1513,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures libostree 2017.3 to adapt to many kinds of systems.
+\`configure' configures libostree 2017.4 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1573,7 +1583,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of libostree 2017.3:";;
+     short | recursive ) echo "Configuration of libostree 2017.4:";;
    esac
   cat <<\_ACEOF
 
@@ -1608,6 +1618,9 @@ Optional Features:
   --enable-libsoup-client-certs
                           Require availability of new enough libsoup TLS
                           client cert API (default: auto)
+  --enable-trivial-httpd-cmdline
+                          Continue to support "ostree trivial-httpd"
+                          [default=no]
   --enable-introspection=[no/auto/yes]
                           Enable introspection for this build
   --enable-gtk-doc        use gtk-doc to build documentation [[default=no]]
@@ -1637,6 +1650,7 @@ Optional Packages:
   --without-libarchive    Do not use libarchive
   --without-selinux       Do not use SELinux
   --with-smack            Enable smack
+  --with-openssl          Enable use of OpenSSL libcrypto (checksums)
   --without-libmount      Do not use libmount
   --with-dracut           Install dracut module (default: no)
   --with-mkinitcpio       Install mkinitcpio module (default: no)
@@ -1712,6 +1726,10 @@ Some influential environment variables:
               C compiler flags for OT_DEP_SELINUX, overriding pkg-config
   OT_DEP_SELINUX_LIBS
               linker flags for OT_DEP_SELINUX, overriding pkg-config
+  OT_DEP_OPENSSL_CFLAGS
+              C compiler flags for OT_DEP_OPENSSL, overriding pkg-config
+  OT_DEP_OPENSSL_LIBS
+              linker flags for OT_DEP_OPENSSL, overriding pkg-config
   OT_DEP_LIBMOUNT_CFLAGS
               C compiler flags for OT_DEP_LIBMOUNT, overriding pkg-config
   OT_DEP_LIBMOUNT_LIBS
@@ -1791,7 +1809,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-libostree configure 2017.3
+libostree configure 2017.4
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2206,7 +2224,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by libostree $as_me 2017.3, which was
+It was created by libostree $as_me 2017.4, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -3073,7 +3091,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='libostree'
- VERSION='2017.3'
+ VERSION='2017.4'
 
 
 # Some tools Automake needs.
@@ -5805,6 +5823,13 @@ done
 test -n "$YACC" || YACC="yacc"
 
 
+YEAR_VERSION=2017
+
+RELEASE_VERSION=4
+
+PACKAGE_VERSION=2017.4
+
+
 
   for flag in \
         -pipe \
@@ -5823,6 +5848,7 @@ test -n "$YACC" || YACC="yacc"
         -Werror=incompatible-pointer-types \
         -Werror=misleading-indentation \
 	-Werror=missing-include-dirs -Werror=aggregate-return \
+  -Werror=unused-result \
 ; do
 
   { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports flag $flag in envvar CFLAGS" >&5
@@ -14832,6 +14858,20 @@ else
 fi
 
 
+# Check whether --enable-trivial-httpd-cmdline was given.
+if test "${enable_trivial_httpd_cmdline+set}" = set; then :
+  enableval=$enable_trivial_httpd_cmdline;
+else
+  enable_trivial_httpd_cmdline=no
+fi
+
+if test x$enable_trivial_httpd_cmdline = xyes; then :
+
+$as_echo "#define BUILDOPT_ENABLE_TRIVIAL_HTTPD_CMDLINE 1" >>confdefs.h
+
+
+fi
+
 if test x$with_curl = xyes && test x$with_soup = xno; then :
 
   as_fn_error $? "Curl enabled, but libsoup is not; libsoup is needed for tests" "$LINENO" 5
@@ -16231,6 +16271,129 @@ else
 fi
 
 
+OPENSSL_DEPENDENCY="libcrypto >= 1.0.1"
+
+# Check whether --with-openssl was given.
+if test "${with_openssl+set}" = set; then :
+  withval=$with_openssl; :
+else
+  with_openssl=no
+fi
+
+
+if  test x$with_openssl != xno ; then :
+
+
+pkg_failed=no
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for OT_DEP_OPENSSL" >&5
+$as_echo_n "checking for OT_DEP_OPENSSL... " >&6; }
+
+if test -n "$OT_DEP_OPENSSL_CFLAGS"; then
+    pkg_cv_OT_DEP_OPENSSL_CFLAGS="$OT_DEP_OPENSSL_CFLAGS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"\$OPENSSL_DEPENDENCY\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "$OPENSSL_DEPENDENCY") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_OT_DEP_OPENSSL_CFLAGS=`$PKG_CONFIG --cflags "$OPENSSL_DEPENDENCY" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+if test -n "$OT_DEP_OPENSSL_LIBS"; then
+    pkg_cv_OT_DEP_OPENSSL_LIBS="$OT_DEP_OPENSSL_LIBS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"\$OPENSSL_DEPENDENCY\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "$OPENSSL_DEPENDENCY") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_OT_DEP_OPENSSL_LIBS=`$PKG_CONFIG --libs "$OPENSSL_DEPENDENCY" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+
+
+
+if test $pkg_failed = yes; then
+   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
+        _pkg_short_errors_supported=yes
+else
+        _pkg_short_errors_supported=no
+fi
+        if test $_pkg_short_errors_supported = yes; then
+	        OT_DEP_OPENSSL_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$OPENSSL_DEPENDENCY" 2>&1`
+        else
+	        OT_DEP_OPENSSL_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$OPENSSL_DEPENDENCY" 2>&1`
+        fi
+	# Put the nasty error message in config.log where it belongs
+	echo "$OT_DEP_OPENSSL_PKG_ERRORS" >&5
+
+	as_fn_error $? "Package requirements ($OPENSSL_DEPENDENCY) were not met:
+
+$OT_DEP_OPENSSL_PKG_ERRORS
+
+Consider adjusting the PKG_CONFIG_PATH environment variable if you
+installed software in a non-standard prefix.
+
+Alternatively, you may set the environment variables OT_DEP_OPENSSL_CFLAGS
+and OT_DEP_OPENSSL_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details." "$LINENO" 5
+elif test $pkg_failed = untried; then
+     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "The pkg-config script could not be found or is too old.  Make sure it
+is in your PATH or set the PKG_CONFIG environment variable to the full
+path to pkg-config.
+
+Alternatively, you may set the environment variables OT_DEP_OPENSSL_CFLAGS
+and OT_DEP_OPENSSL_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details.
+
+To get pkg-config, see <http://pkg-config.freedesktop.org/>.
+See \`config.log' for more details" "$LINENO" 5; }
+else
+	OT_DEP_OPENSSL_CFLAGS=$pkg_cv_OT_DEP_OPENSSL_CFLAGS
+	OT_DEP_OPENSSL_LIBS=$pkg_cv_OT_DEP_OPENSSL_LIBS
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+fi
+
+$as_echo "#define HAVE_OPENSSL 1" >>confdefs.h
+
+      with_openssl=yes
+
+else
+
+      with_openssl=no
+
+fi
+if test x$with_openssl != xno; then OSTREE_FEATURES="$OSTREE_FEATURES openssl"; fi
+ if test $with_openssl != no; then
+  USE_OPENSSL_TRUE=
+  USE_OPENSSL_FALSE='#'
+else
+  USE_OPENSSL_TRUE='#'
+  USE_OPENSSL_FALSE=
+fi
+
+
 LIBMOUNT_DEPENDENCY="mount >= 2.23.0"
 
 
@@ -16830,7 +16993,7 @@ else
 fi
 
 
-ac_config_files="$ac_config_files Makefile apidoc/Makefile src/libostree/ostree-1.pc"
+ac_config_files="$ac_config_files Makefile apidoc/Makefile src/libostree/ostree-1.pc src/libostree/ostree-version.h"
 
 cat >confcache <<\_ACEOF
 # This file is a shell script that caches the results of configure
@@ -17057,6 +17220,10 @@ if test -z "${USE_SMACK_TRUE}" && test -z "${USE_SMACK_FALSE}"; then
   as_fn_error $? "conditional \"USE_SMACK\" was never defined.
 Usually this means the macro was only invoked conditionally." "$LINENO" 5
 fi
+if test -z "${USE_OPENSSL_TRUE}" && test -z "${USE_OPENSSL_FALSE}"; then
+  as_fn_error $? "conditional \"USE_OPENSSL\" was never defined.
+Usually this means the macro was only invoked conditionally." "$LINENO" 5
+fi
 if test -z "${USE_LIBMOUNT_TRUE}" && test -z "${USE_LIBMOUNT_FALSE}"; then
   as_fn_error $? "conditional \"USE_LIBMOUNT\" was never defined.
 Usually this means the macro was only invoked conditionally." "$LINENO" 5
@@ -17494,7 +17661,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by libostree $as_me 2017.3, which was
+This file was extended by libostree $as_me 2017.4, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -17560,7 +17727,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-libostree config.status 2017.3
+libostree config.status 2017.4
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
@@ -17978,6 +18145,7 @@ do
     "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;;
     "apidoc/Makefile") CONFIG_FILES="$CONFIG_FILES apidoc/Makefile" ;;
     "src/libostree/ostree-1.pc") CONFIG_FILES="$CONFIG_FILES src/libostree/ostree-1.pc" ;;
+    "src/libostree/ostree-version.h") CONFIG_FILES="$CONFIG_FILES src/libostree/ostree-version.h" ;;
 
   *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;;
   esac
@@ -19257,7 +19425,9 @@ echo "
     Rust (internal oxidation):                    $rust_debug_release
     rofiles-fuse:                                 $enable_rofiles_fuse
     HTTP backend:                                 $fetcher_backend
+    \"ostree trivial-httpd\":                       $enable_trivial_httpd_cmdline
     SELinux:                                      $with_selinux
+    OpenSSL libcrypto (checksums):                $with_openssl
     systemd:                                      $have_libsystemd
     libmount:                                     $with_libmount
     libarchive (parse tar files directly):        $with_libarchive

configure.ac

@@ -1,6 +1,10 @@
 AC_PREREQ([2.63])
 dnl If incrementing the version here, remember to update libostree.sym too
-AC_INIT([libostree], [2017.3], [walters@verbum.org])
+m4_define([year_version], [2017])
+m4_define([release_version], [4])
+m4_define([package_version], [year_version.release_version])
+
+AC_INIT([libostree], [package_version], [walters@verbum.org])
 AC_CONFIG_HEADER([config.h])
 AC_CONFIG_MACRO_DIR([buildutil])
 AC_CONFIG_AUX_DIR([build-aux])
@@ -16,6 +20,11 @@ AC_PROG_CC
 AM_PROG_CC_C_O
 AC_PROG_YACC
 
+dnl Versioning information
+AC_SUBST([YEAR_VERSION], [year_version])
+AC_SUBST([RELEASE_VERSION], [release_version])
+AC_SUBST([PACKAGE_VERSION], [package_version])
+
 CC_CHECK_FLAGS_APPEND([WARN_CFLAGS], [CFLAGS], [\
         -pipe \
         -Wall \
@@ -33,6 +42,7 @@ CC_CHECK_FLAGS_APPEND([WARN_CFLAGS], [CFLAGS], [\
         -Werror=incompatible-pointer-types \
         -Werror=misleading-indentation \
 	-Werror=missing-include-dirs -Werror=aggregate-return \
+  -Werror=unused-result \
 ])
 AC_SUBST(WARN_CFLAGS)
 
@@ -134,6 +144,14 @@ if test x$with_soup != xno; then OSTREE_FEATURES="$OSTREE_FEATURES libsoup"; fi
 AM_CONDITIONAL(USE_LIBSOUP, test x$with_soup != xno)
 AM_CONDITIONAL(HAVE_LIBSOUP_CLIENT_CERTS, test x$have_libsoup_client_certs = xyes)
 
+AC_ARG_ENABLE(trivial-httpd-cmdline,
+  [AS_HELP_STRING([--enable-trivial-httpd-cmdline],
+  [Continue to support "ostree trivial-httpd" [default=no]])],,
+  enable_trivial_httpd_cmdline=no)
+AS_IF([test x$enable_trivial_httpd_cmdline = xyes],
+  [AC_DEFINE([BUILDOPT_ENABLE_TRIVIAL_HTTPD_CMDLINE], 1, [Define if we are enabling ostree trivial-httpd entrypoint])]
+)
+
 AS_IF([test x$with_curl = xyes && test x$with_soup = xno], [
   AC_MSG_ERROR([Curl enabled, but libsoup is not; libsoup is needed for tests])
 ])
@@ -281,6 +299,23 @@ AS_IF([ test x$with_smack = xyes], [
 ])
 AM_CONDITIONAL(USE_SMACK, test $with_smack != no)
 
+dnl begin openssl (really just libcrypto right now)
+OPENSSL_DEPENDENCY="libcrypto >= 1.0.1"
+AC_ARG_WITH(openssl,
+AS_HELP_STRING([--with-openssl], [Enable use of OpenSSL libcrypto (checksums)]),
+:, with_openssl=no)
+
+AS_IF([ test x$with_openssl != xno ], [
+      PKG_CHECK_MODULES(OT_DEP_OPENSSL, $OPENSSL_DEPENDENCY)
+      AC_DEFINE([HAVE_OPENSSL], 1, [Define if we have openssl])
+      with_openssl=yes
+], [
+      with_openssl=no
+])
+if test x$with_openssl != xno; then OSTREE_FEATURES="$OSTREE_FEATURES openssl"; fi
+AM_CONDITIONAL(USE_OPENSSL, test $with_openssl != no)
+dnl end openssl
+
 dnl This is what is in RHEL7.2 right now, picking it arbitrarily
 LIBMOUNT_DEPENDENCY="mount >= 2.23.0"
 
@@ -398,6 +433,7 @@ AC_CONFIG_FILES([
 Makefile
 apidoc/Makefile
 src/libostree/ostree-1.pc
+src/libostree/ostree-version.h
 ])
 AC_OUTPUT
 
@@ -410,7 +446,9 @@ echo "
     Rust (internal oxidation):                    $rust_debug_release
     rofiles-fuse:                                 $enable_rofiles_fuse
     HTTP backend:                                 $fetcher_backend
+    \"ostree trivial-httpd\":                       $enable_trivial_httpd_cmdline
     SELinux:                                      $with_selinux
+    OpenSSL libcrypto (checksums):                $with_openssl
     systemd:                                      $have_libsystemd
     libmount:                                     $with_libmount
     libarchive (parse tar files directly):        $with_libarchive

libglnx/Makefile-libglnx.am

@@ -52,9 +52,18 @@ libglnx_la_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
 libglnx_la_LDFLAGS = -avoid-version -Bsymbolic-functions -export-symbols-regex "^glnx_" -no-undefined -export-dynamic 
 libglnx_la_LIBADD = $(libglnx_libs)
 
-TESTS += test-libglnx-xattrs
+libglnx_tests = test-libglnx-xattrs test-libglnx-fdio test-libglnx-errors
+TESTS += $(libglnx_tests)
 
-check_PROGRAMS += test-libglnx-xattrs
+check_PROGRAMS += $(libglnx_tests)
 test_libglnx_xattrs_SOURCES = $(libglnx_srcpath)/tests/test-libglnx-xattrs.c
 test_libglnx_xattrs_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
 test_libglnx_xattrs_LDADD = $(libglnx_libs) libglnx.la
+
+test_libglnx_fdio_SOURCES = $(libglnx_srcpath)/tests/test-libglnx-fdio.c
+test_libglnx_fdio_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
+test_libglnx_fdio_LDADD = $(libglnx_libs) libglnx.la
+
+test_libglnx_errors_SOURCES = $(libglnx_srcpath)/tests/test-libglnx-errors.c
+test_libglnx_errors_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
+test_libglnx_errors_LDADD = $(libglnx_libs) libglnx.la

libglnx/Makefile-libglnx.am.inc

@@ -52,9 +52,18 @@ libglnx_la_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
 libglnx_la_LDFLAGS = -avoid-version -Bsymbolic-functions -export-symbols-regex "^glnx_" -no-undefined -export-dynamic 
 libglnx_la_LIBADD = $(libglnx_libs)
 
-TESTS += test-libglnx-xattrs
+libglnx_tests = test-libglnx-xattrs test-libglnx-fdio test-libglnx-errors
+TESTS += $(libglnx_tests)
 
-check_PROGRAMS += test-libglnx-xattrs
+check_PROGRAMS += $(libglnx_tests)
 test_libglnx_xattrs_SOURCES = libglnx/tests/test-libglnx-xattrs.c
 test_libglnx_xattrs_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
 test_libglnx_xattrs_LDADD = $(libglnx_libs) libglnx.la
+
+test_libglnx_fdio_SOURCES = libglnx/tests/test-libglnx-fdio.c
+test_libglnx_fdio_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
+test_libglnx_fdio_LDADD = $(libglnx_libs) libglnx.la
+
+test_libglnx_errors_SOURCES = libglnx/tests/test-libglnx-errors.c
+test_libglnx_errors_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
+test_libglnx_errors_LDADD = $(libglnx_libs) libglnx.la

libglnx/glnx-dirfd.c

@@ -68,8 +68,7 @@ glnx_opendirat (int             dfd,
   int ret = glnx_opendirat_with_errno (dfd, path, follow);
   if (ret == -1)
     {
-      glnx_set_prefix_error_from_errno (error, "%s", "openat");
+      return glnx_throw_errno_prefix (error, "openat");
-      return FALSE;
     }
   *out_fd = ret;
   return TRUE;
@@ -339,8 +338,7 @@ glnx_mkdtempat (int dfd,
           /* Any other error will apply also to other names we might
            *  try, and there are 2^32 or so of them, so give up now.
            */
-          glnx_set_prefix_error_from_errno (error, "%s", "mkdirat");
+          return glnx_throw_errno_prefix (error, "mkdirat");
-          return FALSE;
         }
 
       return TRUE;

libglnx/glnx-errors.c

@@ -24,30 +24,21 @@
 #include <glnx-errors.h>
 
 void
-glnx_real_set_prefix_error_from_errno (GError     **error,
+glnx_real_set_prefix_error_from_errno_va (GError     **error,
                                           gint         errsv,
                                           const char  *format,
-                                       ...)
+                                          va_list      args)
 {
   if (!error)
     return;
-  else
-    {
-      GString *buf = g_string_new ("");
-      va_list args;
 
-      va_start (args, format);
+  /* TODO - enhance GError to have a "set and take ownership" API */
+  g_autoptr(GString) buf = g_string_new ("");
   g_string_append_vprintf (buf, format, args);
-      va_end (args);
-
   g_string_append (buf, ": ");
   g_string_append (buf, g_strerror (errsv));
-    
   g_set_error_literal (error,
                        G_IO_ERROR,
                        g_io_error_from_errno (errsv),
                        buf->str);
-      g_string_free (buf, TRUE);
-      errno = errsv;
-    }
 }

libglnx/glnx-errors.h

@@ -25,25 +25,101 @@
 
 G_BEGIN_DECLS
 
+/* Set @error with G_IO_ERROR/G_IO_ERROR_FAILED.
+ *
+ * This function returns %FALSE so it can be used conveniently in a single
+ * statement:
+ *
+ * ``
+ *   if (strcmp (foo, "somevalue") != 0)
+ *     return glnx_throw (error, "key must be somevalue, not '%s'", foo);
+ * ```
+ */
+static inline gboolean G_GNUC_PRINTF (2,3)
+glnx_throw (GError **error, const char *fmt, ...)
+{
+  if (error == NULL)
+    return FALSE;
+
+  va_list args;
+  va_start (args, fmt);
+  GError *new = g_error_new_valist (G_IO_ERROR, G_IO_ERROR_FAILED, fmt, args);
+  va_end (args);
+  g_propagate_error (error, g_steal_pointer (&new));
+  return FALSE;
+}
+
+
+/* Set @error using the value of `g_strerror (errno)`.
+ *
+ * This function returns %FALSE so it can be used conveniently in a single
+ * statement:
+ *
+ * ``
+ *   if (unlinkat (fd, somepathname) < 0)
+ *     return glnx_throw_errno (error);
+ * ```
+ */
+static inline gboolean
+glnx_throw_errno (GError **error)
+{
+  /* Save the value of errno, in case one of the
+   * intermediate function calls happens to set it.
+   */
+  int errsv = errno;
+  g_set_error_literal (error, G_IO_ERROR,
+                       g_io_error_from_errno (errsv),
+                       g_strerror (errsv));
+  /* We also restore the value of errno, since that's
+   * what was done in a long-ago libgsystem commit
+   * https://git.gnome.org/browse/libgsystem/commit/?id=ed106741f7a0596dc8b960b31fdae671d31d666d
+   * but I certainly can't remember now why I did that.
+   */
+  errno = errsv;
+  return FALSE;
+}
+
+/* Implementation detail of glnx_throw_errno_prefix() */
+void glnx_real_set_prefix_error_from_errno_va (GError     **error,
+                                               gint         errsv,
+                                               const char  *format,
+                                               va_list      args) G_GNUC_PRINTF (3,0);
+
+/* Set @error using the value of `$prefix: g_strerror (errno)` where `$prefix`
+ * is computed via printf @fmt.
+ *
+ * This function returns %FALSE so it can be used conveniently in a single
+ * statement:
+ *
+ * ```
+ *   return glnx_throw_errno_prefix (error, "unlinking %s", pathname);
+ * ```
+ */
+static inline gboolean G_GNUC_PRINTF (2,3)
+glnx_throw_errno_prefix (GError **error, const char *fmt, ...)
+{
+  int errsv = errno;
+  va_list args;
+  va_start (args, fmt);
+  glnx_real_set_prefix_error_from_errno_va (error, errsv, fmt, args);
+  va_end (args);
+  /* See comment above about preserving errno */
+  errno = errsv;
+  return FALSE;
+}
+
+/* BEGIN LEGACY APIS */
+
 #define glnx_set_error_from_errno(error)                \
   do {                                                  \
-    int errsv = errno;                                  \
+    glnx_throw_errno (error);                           \
-    g_set_error_literal (error, G_IO_ERROR,             \
-                         g_io_error_from_errno (errsv), \
-                         g_strerror (errsv));           \
-    errno = errsv;                                      \
   } while (0);
 
 #define glnx_set_prefix_error_from_errno(error, format, args...)  \
   do {                                                            \
-    int errsv = errno;                                                  \
+    glnx_set_error_from_errno (error);                            \
-    glnx_real_set_prefix_error_from_errno (error, errsv, format, args); \
+    g_prefix_error (error, format, args);                         \
-    errno = errsv;                                                      \
   } while (0);
 
-void glnx_real_set_prefix_error_from_errno (GError     **error,
-                                            gint         errsv,
-                                            const char  *format,
-                                            ...) G_GNUC_PRINTF (3,4);
 
 G_END_DECLS

libglnx/glnx-fdio.c

@@ -54,11 +54,13 @@
             sizeof(type) <= 4 ? 10 :                                    \
             sizeof(type) <= 8 ? 20 : sizeof(int[-2*(sizeof(type) > 8)])))
 
-static gboolean
+
-rename_file_noreplace_at (int olddirfd, const char *oldpath,
+/* An implementation of renameat2(..., RENAME_NOREPLACE)
-                          int newdirfd, const char *newpath,
+ * with fallback to a non-atomic version.
-                          gboolean ignore_eexist,
+ */
-                          GError **error)
+int
+glnx_renameat2_noreplace (int olddirfd, const char *oldpath,
+                          int newdirfd, const char *newpath)
 {
 #ifndef ENABLE_WRPSEUDO_COMPAT
   if (renameat2 (olddirfd, oldpath, newdirfd, newpath, RENAME_NOREPLACE) < 0)
@@ -66,9 +68,35 @@ rename_file_noreplace_at (int olddirfd, const char *oldpath,
       if (errno == EINVAL || errno == ENOSYS)
         {
           /* Fall through */
-          ;
         }
-      else if (errno == EEXIST && ignore_eexist)
+      else
+        {
+          return -1;
+        }
+    }
+  else
+    return TRUE;
+#endif
+
+  if (linkat (olddirfd, oldpath, newdirfd, newpath, 0) < 0)
+    return -1;
+
+  if (unlinkat (olddirfd, oldpath, 0) < 0)
+    return -1;
+
+  return 0;
+}
+
+static gboolean
+rename_file_noreplace_at (int olddirfd, const char *oldpath,
+                          int newdirfd, const char *newpath,
+                          gboolean ignore_eexist,
+                          GError **error)
+{
+  if (glnx_renameat2_noreplace (olddirfd, oldpath,
+                                newdirfd, newpath) < 0)
+    {
+      if (errno == EEXIST && ignore_eexist)
         {
           (void) unlinkat (olddirfd, oldpath, 0);
           return TRUE;
@@ -79,29 +107,46 @@ rename_file_noreplace_at (int olddirfd, const char *oldpath,
           return FALSE;
         }
     }
-  else
   return TRUE;
+}
+
+/* An implementation of renameat2(..., RENAME_EXCHANGE)
+ * with fallback to a non-atomic version.
+ */
+int
+glnx_renameat2_exchange (int olddirfd, const char *oldpath,
+                         int newdirfd, const char *newpath)
+{
+#ifndef ENABLE_WRPSEUDO_COMPAT
+  if (renameat2 (olddirfd, oldpath, newdirfd, newpath, RENAME_EXCHANGE) == 0)
+    return 0;
+  else
+    {
+      if (errno == ENOSYS || errno == EINVAL)
+        {
+          /* Fall through */
+        }
+      else
+        {
+          return -1;
+        }
+    }
 #endif
 
-  if (linkat (olddirfd, oldpath, newdirfd, newpath, 0) < 0)
+  /* Fallback */
-    {
+  { const char *old_tmp_name = glnx_strjoina (oldpath, ".XXXXXX");
-      if (errno == EEXIST && ignore_eexist)
-        /* Fall through */
-        ;
-      else
-        {
-          glnx_set_error_from_errno (error);
-          return FALSE;
-        }
-    }
 
-  if (unlinkat (olddirfd, oldpath, 0) < 0)
+    /* Move old out of the way */
-    {
+    if (renameat (olddirfd, oldpath, olddirfd, old_tmp_name) < 0)
-      glnx_set_error_from_errno (error);
+      return -1;
-      return FALSE;
+    /* Now move new into its place */
+    if (renameat (newdirfd, newpath, olddirfd, oldpath) < 0)
+      return -1;
+    /* And finally old(tmp) into new */
+    if (renameat (olddirfd, old_tmp_name, newdirfd, newpath) < 0)
+      return -1;
   }
-
+  return 0;
-  return TRUE;
 }
 
 gboolean

libglnx/glnx-fdio.h

@@ -150,4 +150,10 @@ glnx_stream_fstat (GFileDescriptorBased *stream,
                    struct stat          *stbuf,
                    GError              **error);
 
+int glnx_renameat2_noreplace (int olddirfd, const char *oldpath,
+                              int newdirfd, const char *newpath);
+int glnx_renameat2_exchange (int olddirfd, const char *oldpath,
+                             int newdirfd, const char *newpath);
+
+
 G_END_DECLS

libglnx/glnx-missing.h

@@ -48,5 +48,8 @@
 #ifndef RENAME_NOREPLACE
 #define RENAME_NOREPLACE (1 << 0)
 #endif
+#ifndef RENAME_EXCHANGE
+#define RENAME_EXCHANGE (1 << 1)
+#endif
 
 #include "glnx-missing-syscall.h"

libglnx/tests/test-libglnx-errors.c

@@ -0,0 +1,79 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+#include "libglnx.h"
+#include <glib.h>
+#include <stdlib.h>
+#include <gio/gio.h>
+#include <string.h>
+
+static void
+test_error_throw (void)
+{
+  g_autoptr(GError) error = NULL;
+
+  g_assert (!glnx_throw (&error, "foo: %s %d", "hello", 42));
+  g_assert_error (error, G_IO_ERROR, G_IO_ERROR_FAILED);
+  g_assert_cmpstr (error->message, ==, "foo: hello 42");
+}
+
+static void
+test_error_errno (void)
+{
+  g_autoptr(GError) error = NULL;
+  const char noent_path[] = "/enoent-this-should-not-exist";
+  int fd;
+
+  fd = open (noent_path, O_RDONLY);
+  if (fd < 0)
+    {
+      g_assert (!glnx_throw_errno (&error));
+      g_assert_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND);
+      g_clear_error (&error);
+    }
+  else
+    g_assert_cmpint (fd, ==, -1);
+
+  fd = open (noent_path, O_RDONLY);
+  if (fd < 0)
+    {
+      g_assert (!glnx_throw_errno_prefix (&error, "Failed to open %s", noent_path));
+      g_assert_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND);
+      g_assert (g_str_has_prefix (error->message, glnx_strjoina ("Failed to open ", noent_path)));
+      g_clear_error (&error);
+    }
+  else
+    g_assert_cmpint (fd, ==, -1);
+}
+
+int main (int argc, char **argv)
+{
+  int ret;
+
+  g_test_init (&argc, &argv, NULL);
+
+  g_test_add_func ("/error-throw", test_error_throw);
+  g_test_add_func ("/error-errno", test_error_errno);
+
+  ret = g_test_run();
+
+  return ret;
+}

libglnx/tests/test-libglnx-fdio.c

@@ -0,0 +1,155 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+#include "libglnx.h"
+#include <glib.h>
+#include <stdlib.h>
+#include <gio/gio.h>
+#include <err.h>
+#include <string.h>
+
+static gboolean
+renameat_test_setup (int *out_srcfd, int *out_destfd,
+                     GError **error)
+{
+  glnx_fd_close int srcfd = -1;
+  glnx_fd_close int destfd = -1;
+
+  (void) glnx_shutil_rm_rf_at (AT_FDCWD, "srcdir", NULL, NULL);
+  if (mkdir ("srcdir", 0755) < 0)
+    err (1, "mkdir");
+  if (!glnx_opendirat (AT_FDCWD, "srcdir", TRUE, &srcfd, error))
+    return FALSE;
+  (void) glnx_shutil_rm_rf_at (AT_FDCWD, "destdir", NULL, NULL);
+  if (mkdir ("destdir", 0755) < 0)
+    err (1, "mkdir");
+  if (!glnx_opendirat (AT_FDCWD, "destdir", TRUE, &destfd, error))
+    return FALSE;
+
+  if (!glnx_file_replace_contents_at (srcfd, "foo", (guint8*)"foo contents", strlen ("foo contents"),
+                                      GLNX_FILE_REPLACE_NODATASYNC, NULL, error))
+    return FALSE;
+  if (!glnx_file_replace_contents_at (destfd, "bar", (guint8*)"bar contents", strlen ("bar contents"),
+                                      GLNX_FILE_REPLACE_NODATASYNC, NULL, error))
+    return FALSE;
+
+  *out_srcfd = srcfd; srcfd = -1;
+  *out_destfd = destfd; destfd = -1;
+  return TRUE;
+}
+
+static void
+test_renameat2_noreplace (void)
+{
+  g_autoptr(GError) local_error = NULL;
+  GError **error = &local_error;
+  glnx_fd_close int srcfd = -1;
+  glnx_fd_close int destfd = -1;
+  struct stat stbuf;
+
+  if (!renameat_test_setup (&srcfd, &destfd, error))
+    goto out;
+
+  if (glnx_renameat2_noreplace (srcfd, "foo", destfd, "bar") == 0)
+    g_assert_not_reached ();
+  else
+    {
+      g_assert_cmpint (errno, ==, EEXIST);
+    }
+
+  if (glnx_renameat2_noreplace (srcfd, "foo", destfd, "baz") < 0)
+    {
+      glnx_set_error_from_errno (error);
+      goto out;
+    }
+  if (fstatat (destfd, "bar", &stbuf, AT_SYMLINK_NOFOLLOW) < 0)
+    {
+      glnx_set_error_from_errno (error);
+      goto out;
+    }
+
+  if (fstatat (srcfd, "foo", &stbuf, AT_SYMLINK_NOFOLLOW) == 0)
+    g_assert_not_reached ();
+  else
+    g_assert_cmpint (errno, ==, ENOENT);
+
+ out:
+  g_assert_no_error (local_error);
+}
+
+static void
+test_renameat2_exchange (void)
+{
+  g_autoptr(GError) local_error = NULL;
+  GError **error = &local_error;
+  glnx_fd_close int srcfd = -1;
+  glnx_fd_close int destfd = -1;
+  struct stat stbuf;
+
+  if (!renameat_test_setup (&srcfd, &destfd, error))
+    goto out;
+
+  if (glnx_renameat2_exchange (AT_FDCWD, "srcdir", AT_FDCWD, "destdir") < 0)
+    {
+      glnx_set_error_from_errno (error);
+      goto out;
+    }
+
+  /* Ensure the dir fds are the same */
+  if (fstatat (srcfd, "foo", &stbuf, AT_SYMLINK_NOFOLLOW) < 0)
+    {
+      glnx_set_error_from_errno (error);
+      goto out;
+    }
+  if (fstatat (destfd, "bar", &stbuf, AT_SYMLINK_NOFOLLOW) < 0)
+    {
+      glnx_set_error_from_errno (error);
+      goto out;
+    }
+  /* But the dirs should be swapped */
+  if (fstatat (AT_FDCWD, "destdir/foo", &stbuf, AT_SYMLINK_NOFOLLOW) < 0)
+    {
+      glnx_set_error_from_errno (error);
+      goto out;
+    }
+  if (fstatat (AT_FDCWD, "srcdir/bar", &stbuf, AT_SYMLINK_NOFOLLOW) < 0)
+    {
+      glnx_set_error_from_errno (error);
+      goto out;
+    }
+
+ out:
+  g_assert_no_error (local_error);
+}
+
+int main (int argc, char **argv)
+{
+  int ret;
+
+  g_test_init (&argc, &argv, NULL);
+
+  g_test_add_func ("/renameat2-noreplace", test_renameat2_noreplace);
+  g_test_add_func ("/renameat2-exchange", test_renameat2_exchange);
+
+  ret = g_test_run();
+
+  return ret;
+}

man/ostree-admin-cleanup.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree admin cleanup
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree admin cleanup
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-admin-config-diff.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree admin config-diff
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree admin config-diff
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-admin-deploy.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree admin deploy
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree admin deploy
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-admin-init-fs.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree admin init-fs
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree admin init-fs
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-admin-instutil.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree admin instutil
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree admin instutil
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-admin-os-init.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree admin os-init
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree admin os-init
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-admin-set-origin.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree admin set-origin
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree admin set-origin
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-admin-status.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree admin status
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree admin status
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-admin-switch.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree admin switch
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree admin switch
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-admin-undeploy.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree admin undeploy
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree admin undeploy
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-admin-unlock.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree admin unlock
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree admin unlock
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-admin-upgrade.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree admin upgrade
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree admin upgrade
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-admin.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree admin
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree admin
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-cat.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree cat
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree cat
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-checkout.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree checkout
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree checkout
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-checksum.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree checksum
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree checksum
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-commit.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree commit
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree commit
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-config.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree config
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree config
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-diff.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree diff
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/11/2017
 .\"    Manual: ostree diff
 .\"    Source: OSTree
 .\"  Language: English
@@ -46,6 +46,16 @@ Print various statistics\&.
 .RS 4
 Print filesystem diff\&.
 .RE
+.PP
+\fB\-\-owner\-uid\fR
+.RS 4
+Use file ownership user id for local files\&.
+.RE
+.PP
+\fB\-\-owner\-gid\fR
+.RS 4
+Use file ownership group id for local files\&.
+.RE
 .SH "EXAMPLE"
 .PP
 \fB$ ostree diff my\-branch^ my\-branch\fR

man/ostree-diff.xml

@@ -78,6 +78,20 @@ Boston, MA 02111-1307, USA.
                     Print filesystem diff.
                 </para></listitem>
             </varlistentry>
+
+            <varlistentry>
+                <term><option>--owner-uid</option></term>
+                <listitem><para>
+                    Use file ownership user id for local files.
+                </para></listitem>
+            </varlistentry>
+
+            <varlistentry>
+                <term><option>--owner-gid</option></term>
+                <listitem><para>
+                    Use file ownership group id for local files.
+                </para></listitem>
+            </varlistentry>
         </variablelist>
     </refsect1>
 

man/ostree-export.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree export
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree export
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-fsck.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree fsck
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree fsck
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-gpg-sign.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree gpg-sign
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree gpg-sign
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-init.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree init
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree init
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-log.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree log
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree log
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-ls.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree ls
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree ls
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-prune.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree prune
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree prune
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-pull-local.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree pull-local
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree pull-local
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-pull.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree pull
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree pull
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-refs.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree refs
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree refs
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-remote.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree remote
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree remote
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-reset.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree reset
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree reset
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-rev-parse.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree rev-parse
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree rev-parse
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-show.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree show
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree show
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-static-delta.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree static-delta
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree static-delta
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-summary.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree summary
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree summary
 .\"    Source: OSTree
 .\"  Language: English

man/ostree-trivial-httpd.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree trivial-httpd
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree trivial-httpd
 .\"    Source: OSTree
 .\"  Language: English

man/ostree.1

@@ -2,7 +2,7 @@
 .\"     Title: ostree
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree
 .\"    Source: OSTree
 .\"  Language: English

man/ostree.repo-config.5

@@ -2,7 +2,7 @@
 .\"     Title: ostree.repo-config
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree.repo-config
 .\"    Source: OSTree
 .\"  Language: English

man/ostree.repo.5

@@ -2,7 +2,7 @@
 .\"     Title: ostree.repo
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: ostree.repo
 .\"    Source: OSTree
 .\"  Language: English

man/rofiles-fuse.1

@@ -2,7 +2,7 @@
 .\"     Title: rofiles-fuse
 .\"    Author: Colin Walters <walters@verbum.org>
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 03/10/2017
+.\"      Date: 04/05/2017
 .\"    Manual: rofiles-fuse
 .\"    Source: rofiles-fuse
 .\"  Language: English

src/libostree/libostree.sym

@@ -381,16 +381,25 @@ global:
         ostree_raw_file_to_archive_z2_stream_with_options;
 } LIBOSTREE_2017.2;
 
+LIBOSTREE_2017.4 {
+global:
+  ostree_check_version;
+  ostree_diff_dirs_with_options;
+  ostree_sepolicy_new_at;
+  ostree_sysroot_write_deployments_with_options;
+} LIBOSTREE_2017.3;
+
 /*                         NOTE NOTE NOTE
  * Versions above here are released.  Only add symbols below this line.
  *                         NOTE NOTE NOTE
  */
 
-/* Stub section for new version, uncomment when the first symbol is added
+/* Uncomment when adding the first new symbol */
+/*
 LIBOSTREE_2017.$NEWVERSION {
 global:
 	someostree_symbol_deleteme;
-} LIBOSTREE_2017.2;
+} LIBOSTREE_2017.4;
 */
 
 /* Stub section for the stable release *after* this development one; don't

src/libostree/ostree-autocleanups.h

@@ -26,14 +26,10 @@
 
 G_BEGIN_DECLS
 
-#ifndef OSTREE_WITH_AUTOCLEANUPS
-#define OSTREE_WITH_AUTOCLEANUPS 0
-#endif
-
 /* ostree can use g_autoptr backports from libglnx when glib is too
  * old, but still avoid exposing them to users that also have an old
  * glib */
-#if defined(OSTREE_COMPILATION) || (OSTREE_WITH_AUTOCLEANUPS && GLIB_CHECK_VERSION(2, 44, 0))
+#if defined(OSTREE_COMPILATION) || GLIB_CHECK_VERSION(2, 44, 0)
 
 /*
  * The following types have no specific clear/free/unref functions, so

src/libostree/ostree-bootloader-grub2.c

@@ -353,7 +353,7 @@ _ostree_bootloader_grub2_write_config (OstreeBootloader      *bootloader,
         use_system_grub2_mkconfig = FALSE;
     }
   else
-    grub_exec = use_system_grub2_mkconfig ? GRUB2_MKCONFIG_PATH : "/usr/lib/ostree/ostree-grub-generator";
+    grub_exec = use_system_grub2_mkconfig ? GRUB2_MKCONFIG_PATH : TARGET_PREFIX "/lib/ostree/ostree-grub-generator";
 
   if (use_system_grub2_mkconfig && ostree_sysroot_get_booted_deployment (self->sysroot) == NULL
       && g_file_has_parent (self->sysroot->path, NULL))

src/libostree/ostree-core-private.h

@@ -139,6 +139,15 @@ _ostree_loose_path (char              *buf,
 #define _OSTREE_METADATA_GPGSIGS_NAME "ostree.gpgsigs"
 #define _OSTREE_METADATA_GPGSIGS_TYPE G_VARIANT_TYPE ("aay")
 
+static inline gboolean
+_ostree_repo_mode_is_bare (OstreeRepoMode mode)
+{
+  return
+    mode == OSTREE_REPO_MODE_BARE ||
+    mode == OSTREE_REPO_MODE_BARE_USER ||
+    mode == OSTREE_REPO_MODE_BARE_USER_ONLY;
+}
+
 GVariant *
 _ostree_detached_metadata_append_gpg_sig (GVariant   *existing_metadata,
                                           GBytes     *signature_bytes);

src/libostree/ostree-core.c

@@ -121,13 +121,8 @@ ostree_parse_refspec (const char   *refspec,
                       char        **out_ref,
                       GError      **error)
 {
-  gboolean ret = FALSE;
-  GMatchInfo *match = NULL;
-  g_autofree char *remote = NULL;
-
-  static gsize regex_initialized;
   static GRegex *regex;
-
+  static gsize regex_initialized;
   if (g_once_init_enter (&regex_initialized))
     {
       regex = g_regex_new ("^(" OSTREE_REF_FRAGMENT_REGEXP ":)?(" OSTREE_REF_REGEXP ")$", 0, 0, NULL);
@@ -135,14 +130,11 @@ ostree_parse_refspec (const char   *refspec,
       g_once_init_leave (&regex_initialized, 1);
     }
 
+  g_autoptr(GMatchInfo) match = NULL;
   if (!g_regex_match (regex, refspec, 0, &match))
-    {
+    return glnx_throw (error, "Invalid refspec %s", refspec);
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
-                   "Invalid refspec %s", refspec);
-      goto out;
-    }
 
-  remote = g_match_info_fetch (match, 1);
+  g_autofree char *remote = g_match_info_fetch (match, 1);
   if (*remote == '\0')
     {
       g_clear_pointer (&remote, g_free);
@@ -153,16 +145,11 @@ ostree_parse_refspec (const char   *refspec,
       remote[strlen(remote)-1] = '\0';
     }
 
-  ret = TRUE;
-
   if (out_remote)
     *out_remote = g_steal_pointer (&remote);
   if (out_ref != NULL)
     *out_ref = g_match_info_fetch (match, 2);
- out:
+  return TRUE;
-  if (match)
-    g_match_info_unref (match);
-  return ret;
 }
 
 /**
@@ -176,12 +163,10 @@ gboolean
 ostree_validate_rev (const char *rev,
                      GError **error)
 {
-  gboolean ret = FALSE;
+  g_autoptr(GMatchInfo) match = NULL;
-  GMatchInfo *match = NULL;
 
   static gsize regex_initialized;
   static GRegex *regex;
-
   if (g_once_init_enter (&regex_initialized))
     {
       regex = g_regex_new ("^" OSTREE_REF_REGEXP "$", 0, 0, NULL);
@@ -190,17 +175,9 @@ ostree_validate_rev (const char *rev,
     }
 
   if (!g_regex_match (regex, rev, 0, &match))
-    {
+    return glnx_throw (error, "Invalid ref name %s", rev);
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
-                   "Invalid ref name %s", rev);
-      goto out;
-    }
 
-  ret = TRUE;
+  return TRUE;
- out:
-  if (match)
-    g_match_info_unref (match);
-  return ret;
 }
 
 GVariant *
@@ -282,7 +259,6 @@ write_padding (GOutputStream    *output,
                GCancellable     *cancellable,
                GError          **error)
 {
-  gboolean ret = FALSE;
   guint bits;
   guint padding_len;
   guchar padding_nuls[8] = {0, 0, 0, 0, 0, 0, 0, 0};
@@ -298,12 +274,10 @@ write_padding (GOutputStream    *output,
       if (!ot_gio_write_update_checksum (output, (guchar*)padding_nuls, padding_len,
                                          out_bytes_written, checksum,
                                          cancellable, error))
-        goto out;
+        return FALSE;
     }
 
-  ret = TRUE;
+  return TRUE;
- out:
-  return ret;
 }
 
 /*
@@ -330,7 +304,6 @@ _ostree_write_variant_with_size (GOutputStream      *output,
                                  GCancellable       *cancellable,
                                  GError            **error)
 {
-  gboolean ret = FALSE;
   guint64 variant_size;
   guint32 variant_size_u32_be;
   gsize bytes_written;
@@ -345,7 +318,7 @@ _ostree_write_variant_with_size (GOutputStream      *output,
   if (!ot_gio_write_update_checksum (output, &variant_size_u32_be, 4,
                                      &bytes_written, checksum,
                                      cancellable, error))
-    goto out;
+    return FALSE;
   ret_bytes_written += bytes_written;
   alignment_offset += bytes_written;
 
@@ -353,21 +326,19 @@ _ostree_write_variant_with_size (GOutputStream      *output,
   /* Pad to offset of 8, write variant */
   if (!write_padding (output, 8, alignment_offset, &bytes_written, checksum,
                       cancellable, error))
-    goto out;
+    return FALSE;
   ret_bytes_written += bytes_written;
 
   bytes_written = 0;
   if (!ot_gio_write_update_checksum (output, g_variant_get_data (variant),
                                      variant_size, &bytes_written, checksum,
                                      cancellable, error))
-    goto out;
+    return FALSE;
   ret_bytes_written += bytes_written;
 
-  ret = TRUE;
   if (out_bytes_written)
     *out_bytes_written = ret_bytes_written;
- out:
+  return TRUE;
-  return ret;
 }
 
 /*
@@ -388,16 +359,13 @@ write_file_header_update_checksum (GOutputStream         *out,
                                    GCancellable          *cancellable,
                                    GError               **error)
 {
-  gboolean ret = FALSE;
   gsize bytes_written;
 
   if (!_ostree_write_variant_with_size (out, header, 0, &bytes_written, checksum,
                                         cancellable, error))
-    goto out;
+    return FALSE;
 
-  ret = TRUE;
+  return TRUE;
- out:
-  return ret;
 }
 
 /*
@@ -724,32 +692,28 @@ ostree_content_file_parse_at (gboolean                compressed,
                               GCancellable           *cancellable,
                               GError                **error)
 {
-  gboolean ret = FALSE;
-  struct stat stbuf;
   g_autoptr(GInputStream) file_input = NULL;
-  g_autoptr(GInputStream) ret_input = NULL;
-  g_autoptr(GFileInfo) ret_file_info = NULL;
-  g_autoptr(GVariant) ret_xattrs = NULL;
-
   if (!ot_openat_read_stream (parent_dfd, path, TRUE, &file_input,
                               cancellable, error))
-    goto out;
+    return FALSE;
 
+  struct stat stbuf;
   if (!glnx_stream_fstat ((GFileDescriptorBased*)file_input, &stbuf, error))
-    goto out;
+    return FALSE;
 
+  g_autoptr(GFileInfo) ret_file_info = NULL;
+  g_autoptr(GVariant) ret_xattrs = NULL;
+  g_autoptr(GInputStream) ret_input = NULL;
   if (!ostree_content_stream_parse (compressed, file_input, stbuf.st_size, trusted,
                                     out_input ? &ret_input : NULL,
                                     &ret_file_info, &ret_xattrs,
                                     cancellable, error))
-    goto out;
+    return FALSE;
 
-  ret = TRUE;
   ot_transfer_out_value (out_input, &ret_input);
   ot_transfer_out_value (out_file_info, &ret_file_info);
   ot_transfer_out_value (out_xattrs, &ret_xattrs);
- out:
+  return TRUE;
-  return ret;
 }
 
 /**
@@ -804,23 +768,19 @@ ostree_checksum_file_from_input (GFileInfo        *file_info,
                                  GCancellable     *cancellable,
                                  GError          **error)
 {
-  gboolean ret = FALSE;
-  g_autofree guchar *ret_csum = NULL;
-  GChecksum *checksum = NULL;
 
-  checksum = g_checksum_new (G_CHECKSUM_SHA256);
+  g_autoptr(GChecksum) checksum = g_checksum_new (G_CHECKSUM_SHA256);
 
   if (OSTREE_OBJECT_TYPE_IS_META (objtype))
     {
       if (!ot_gio_splice_update_checksum (NULL, in, checksum, cancellable, error))
-        goto out;
+        return FALSE;
     }
   else if (g_file_info_get_file_type (file_info) == G_FILE_TYPE_DIRECTORY)
     {
       g_autoptr(GVariant) dirmeta = ostree_create_directory_metadata (file_info, xattrs);
       g_checksum_update (checksum, g_variant_get_data (dirmeta),
                          g_variant_get_size (dirmeta));
-      
     }
   else
     {
@@ -830,22 +790,17 @@ ostree_checksum_file_from_input (GFileInfo        *file_info,
 
       if (!write_file_header_update_checksum (NULL, file_header, checksum,
                                               cancellable, error))
-        goto out;
+        return FALSE;
 
       if (g_file_info_get_file_type (file_info) == G_FILE_TYPE_REGULAR)
         {
           if (!ot_gio_splice_update_checksum (NULL, in, checksum, cancellable, error))
-            goto out;
+            return FALSE;
         }
     }
 
-  ret_csum = ot_csum_from_gchecksum (checksum);
+  *out_csum = ot_csum_from_gchecksum (checksum);
-
+  return TRUE;
-  ret = TRUE;
-  ot_transfer_out_value (out_csum, &ret_csum);
- out:
-  g_clear_pointer (&checksum, (GDestroyNotify)g_checksum_free);
-  return ret;
 }
 
 /**
@@ -1042,10 +997,9 @@ _ostree_make_temporary_symlink_at (int             tmp_dirfd,
                                    GCancellable   *cancellable,
                                    GError        **error)
 {
-  gboolean ret = FALSE;
+  g_autofree char *tmpname = g_strdup ("tmplink.XXXXXX");
-  char *tmpname = g_strdup ("tmplink.XXXXXX");
-  guint i;
   const int max_attempts = 128;
+  guint i;
 
   for (i = 0; i < max_attempts; i++)
     {
@@ -1055,28 +1009,17 @@ _ostree_make_temporary_symlink_at (int             tmp_dirfd,
           if (errno == EEXIST)
             continue;
           else
-            {
+            return glnx_throw_errno (error);
-              int errsv = errno;
-              g_set_error_literal (error, G_IO_ERROR, g_io_error_from_errno (errsv),
-                                   g_strerror (errsv));
-              goto out;
-            }
         }
       else
         break;
     }
   if (i == max_attempts)
-    {
+    return glnx_throw (error, "Exhausted attempts to open temporary file");
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
-                   "Exhausted attempts to open temporary file");
-      goto out;
-    }
 
-  ret = TRUE;
   if (out_name)
     *out_name = g_steal_pointer (&tmpname);
- out:
+  return TRUE;
-  return ret;
 }
 
 
@@ -1351,16 +1294,7 @@ void
 ostree_checksum_inplace_from_bytes (const guchar *csum,
                                     char         *buf)
 {
-  static const gchar hexchars[] = "0123456789abcdef";
+  ot_bin2hex (buf, csum, OSTREE_SHA256_DIGEST_LEN);
-  guint i, j;
-
-  for (i = 0, j = 0; i < OSTREE_SHA256_DIGEST_LEN; i++, j += 2)
-    {
-      guchar byte = csum[i];
-      buf[j] = hexchars[byte >> 4];
-      buf[j+1] = hexchars[byte & 0xF];
-    }
-  buf[j] = '\0';
 }
 
 /**
@@ -1809,11 +1743,7 @@ ostree_validate_structureof_objtype (guchar    objtype,
   OstreeObjectType objtype_v = (OstreeObjectType) objtype;
   if (objtype_v < OSTREE_OBJECT_TYPE_FILE
       || objtype_v > OSTREE_OBJECT_TYPE_COMMIT)
-    {
+    return glnx_throw (error, "Invalid object type '%u'", objtype);
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
-                   "Invalid object type '%u'", objtype);
-      return FALSE;
-    }
   return TRUE;
 }
 
@@ -1846,11 +1776,7 @@ ostree_validate_structureof_checksum_string (const char *checksum,
   size_t len = strlen (checksum);
 
   if (len != OSTREE_SHA256_STRING_LEN)
-    {
+    return glnx_throw (error, "Invalid rev '%s'", checksum);
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
-                   "Invalid rev '%s'", checksum);
-      return FALSE;
-    }
 
   for (i = 0; i < len; i++)
     {
@@ -2153,3 +2079,16 @@ _ostree_get_default_sysroot_path (void)
 
   return default_sysroot_path;
 }
+
+/**
+ * ostree_check_version:
+ * @required_year: Major/year required
+ * @required_release: Release version required
+ *
+ * Returns: %TRUE if current libostree has at least the requested version, %FALSE otherwise
+ */
+gboolean
+ostree_check_version (guint required_year, guint required_release)
+{
+  return OSTREE_CHECK_VERSION(required_year, required_release);
+}

src/libostree/ostree-core.h

@@ -179,6 +179,7 @@ typedef enum {
  * @OSTREE_REPO_MODE_BARE: Files are stored as themselves; checkouts are hardlinks; can only be written as root
  * @OSTREE_REPO_MODE_ARCHIVE_Z2: Files are compressed, should be owned by non-root.  Can be served via HTTP
  * @OSTREE_REPO_MODE_BARE_USER: Files are stored as themselves, except ownership; can be written by user. Hardlinks work only in user checkouts.
+ * @OSTREE_REPO_MODE_BARE_USER_ONLY: Same as BARE_USER, but all metadata is not stored, so it can only be used for user checkouts. Does not need xattrs.
  *
  * See the documentation of #OstreeRepo for more information about the
  * possible modes.
@@ -186,7 +187,8 @@ typedef enum {
 typedef enum {
   OSTREE_REPO_MODE_BARE,
   OSTREE_REPO_MODE_ARCHIVE_Z2,
-  OSTREE_REPO_MODE_BARE_USER
+  OSTREE_REPO_MODE_BARE_USER,
+  OSTREE_REPO_MODE_BARE_USER_ONLY,
 } OstreeRepoMode;
 
 _OSTREE_PUBLIC
@@ -399,4 +401,7 @@ gchar *  ostree_commit_get_parent            (GVariant  *commit_variant);
 _OSTREE_PUBLIC
 guint64  ostree_commit_get_timestamp         (GVariant  *commit_variant);
 
+_OSTREE_PUBLIC
+gboolean ostree_check_version (guint required_year, guint required_release);
+
 G_END_DECLS

src/libostree/ostree-diff.c

@@ -24,6 +24,7 @@
 
 #include "libglnx.h"
 #include "ostree.h"
+#include "ostree-repo-private.h"
 #include "otutil.h"
 
 static gboolean
@@ -225,6 +226,37 @@ ostree_diff_dirs (OstreeDiffFlags flags,
                   GPtrArray      *added,
                   GCancellable   *cancellable,
                   GError        **error)
+{
+  return ostree_diff_dirs_with_options (flags, a, b, modified,
+                                        removed, added, NULL,
+                                        cancellable, error);
+}
+
+/**
+ * ostree_diff_dirs_with_options:
+ * @flags: Flags
+ * @a: First directory path, or %NULL
+ * @b: First directory path
+ * @modified: (element-type OstreeDiffItem): Modified files
+ * @removed: (element-type Gio.File): Removed files
+ * @added: (element-type Gio.File): Added files
+ * @cancellable: Cancellable
+ * @options: (allow-none): Options
+ * @error: Error
+ *
+ * Compute the difference between directory @a and @b as 3 separate
+ * sets of #OstreeDiffItem in @modified, @removed, and @added.
+ */
+gboolean
+ostree_diff_dirs_with_options (OstreeDiffFlags        flags,
+                               GFile                 *a,
+                               GFile                 *b,
+                               GPtrArray             *modified,
+                               GPtrArray             *removed,
+                               GPtrArray             *added,
+                               OstreeDiffDirsOptions *options,
+                               GCancellable          *cancellable,
+                               GError               **error)
 {
   gboolean ret = FALSE;
   GError *temp_error = NULL;
@@ -233,6 +265,23 @@ ostree_diff_dirs (OstreeDiffFlags flags,
   g_autoptr(GFile) child_b = NULL;
   g_autoptr(GFileInfo) child_a_info = NULL;
   g_autoptr(GFileInfo) child_b_info = NULL;
+  OstreeDiffDirsOptions default_opts = OSTREE_DIFF_DIRS_OPTIONS_INIT;
+
+  if (!options)
+    options = &default_opts;
+
+  /* If we're diffing versus a repo, and either of them have xattrs disabled,
+   * then disable for both.
+   */
+  OstreeRepo *repo;
+  if (OSTREE_IS_REPO_FILE (a))
+    repo = ostree_repo_file_get_repo ((OstreeRepoFile*)a);
+  else if (OSTREE_IS_REPO_FILE (b))
+    repo = ostree_repo_file_get_repo ((OstreeRepoFile*)b);
+  else
+    repo = NULL;
+  if (repo != NULL && repo->disable_xattrs)
+    flags |= OSTREE_DIFF_FLAGS_IGNORE_XATTRS;
 
   if (a == NULL)
     {
@@ -316,6 +365,11 @@ ostree_diff_dirs (OstreeDiffFlags flags,
         }
       else
         {
+          if (options->owner_uid >= 0)
+            g_file_info_set_attribute_uint32 (child_b_info, "unix::uid", options->owner_uid);
+          if (options->owner_gid >= 0)
+            g_file_info_set_attribute_uint32 (child_b_info, "unix::gid", options->owner_gid);
+
           child_b_type = g_file_info_get_file_type (child_b_info);
           if (child_a_type != child_b_type)
             {
@@ -337,8 +391,9 @@ ostree_diff_dirs (OstreeDiffFlags flags,
 
               if (child_a_type == G_FILE_TYPE_DIRECTORY)
                 {
-                  if (!ostree_diff_dirs (flags, child_a, child_b, modified,
+                  if (!ostree_diff_dirs_with_options (flags, child_a, child_b, modified,
-                                         removed, added, cancellable, error))
+                                                      removed, added, options,
+                                                      cancellable, error))
                     goto out;
                 }
             }

src/libostree/ostree-diff.h

@@ -71,6 +71,42 @@ gboolean ostree_diff_dirs (OstreeDiffFlags flags,
                            GCancellable   *cancellable,
                            GError        **error);
 
+/**
+ * OstreeDiffDirsOptions:
+ *
+ * An extensible options structure controlling diff dirs. Make sure
+ * that owner_uid/gid is set to -1 when not used. This is used by
+ * ostree_diff_dirs_with_options().
+ */
+typedef struct {
+  gint owner_uid;
+  gint owner_gid;
+
+  OstreeRepoDevInoCache *devino_to_csum_cache;
+
+  gboolean unused_bools[7];
+  int unused_ints[6];
+  gpointer unused_ptrs[7];
+} OstreeDiffDirsOptions;
+
+/**
+ * OSTREE_DIFF_DIRS_OPTIONS_INIT:
+ *
+ * Use this to initialize an `OstreeDiffDirsOptions` structure.
+ */
+#define OSTREE_DIFF_DIRS_OPTIONS_INIT { .owner_uid = -1, .owner_gid = -1, }
+
+_OSTREE_PUBLIC
+gboolean ostree_diff_dirs_with_options (OstreeDiffFlags       flags,
+                                        GFile                 *a,
+                                        GFile                 *b,
+                                        GPtrArray             *modified,
+                                        GPtrArray             *removed,
+                                        GPtrArray             *added,
+                                        OstreeDiffDirsOptions *options,
+                                        GCancellable          *cancellable,
+                                        GError                **error);
+
 _OSTREE_PUBLIC
 void ostree_diff_print (GFile          *a,
                         GFile          *b,

src/libostree/ostree-fetcher-curl.c

@@ -36,6 +36,14 @@
 #define CURL_AT_LEAST_VERSION(x,y,z) (LIBCURL_VERSION_NUM >= CURL_VERSION_BITS(x, y, z))
 #endif
 
+/* Cargo culted from https://github.com/curl/curl/blob/curl-7_53_0/docs/examples/http2-download.c */
+#ifndef CURLPIPE_MULTIPLEX
+/* This little trick will just make sure that we don't enable pipelining for
+   libcurls old enough to not have this symbol. It is _not_ defined to zero in
+   a recent libcurl header. */
+#define CURLPIPE_MULTIPLEX 0
+#endif
+
 #include "ostree-fetcher.h"
 #include "ostree-fetcher-util.h"
 #include "ostree-enumtypes.h"
@@ -219,6 +227,12 @@ _ostree_fetcher_init (OstreeFetcher *self)
 #if CURL_AT_LEAST_VERSION(7, 30, 0)
   /* Let's do something reasonable here. */
   curl_multi_setopt (self->multi, CURLMOPT_MAX_TOTAL_CONNECTIONS, 8);
+#endif
+  /* This version mirrors the version at which we're enabling HTTP2 support.
+   * See also https://github.com/curl/curl/blob/curl-7_53_0/docs/examples/http2-download.c
+   */
+#if CURL_AT_LEAST_VERSION(7, 51, 0)
+  curl_multi_setopt (self->multi, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
 #endif
 }
 
@@ -764,6 +778,11 @@ initiate_next_curl_request (FetcherRequest *req,
    */
 #if CURL_AT_LEAST_VERSION(7, 51, 0)
   curl_easy_setopt (req->easy, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
+#endif
+  /* https://github.com/curl/curl/blob/curl-7_53_0/docs/examples/http2-download.c */
+#if (CURLPIPE_MULTIPLEX > 0)
+  /* wait for pipe connection to confirm */
+  curl_easy_setopt (req->easy, CURLOPT_PIPEWAIT, 1L);
 #endif
   curl_easy_setopt (req->easy, CURLOPT_WRITEFUNCTION, write_cb);
   if (g_getenv ("OSTREE_DEBUG_HTTP"))

src/libostree/ostree-fetcher-soup.c

@@ -1040,20 +1040,20 @@ on_request_sent (GObject        *object,
                  gpointer        user_data) 
 {
   GTask *task = G_TASK (user_data);
-  OstreeFetcherPendingURI *pending;
+  /* Hold a ref to the pending across this function, since we remove
-  GCancellable *cancellable;
+   * it from the hash early in some cases, not in others. */
+  OstreeFetcherPendingURI *pending = pending_uri_ref (g_task_get_task_data (task));
+  GCancellable *cancellable = g_task_get_cancellable (task);
   GError *local_error = NULL;
   glnx_unref_object SoupMessage *msg = NULL;
 
-  pending = g_task_get_task_data (task);
-  cancellable = g_task_get_cancellable (task);
-
   pending->state = OSTREE_FETCHER_STATE_COMPLETE;
   pending->request_body = soup_request_send_finish ((SoupRequest*) object,
                                                    result, &local_error);
 
   if (!pending->request_body)
     goto out;
+  g_assert_no_error (local_error);
 
   if (SOUP_IS_REQUEST_HTTP (object))
     {
@@ -1183,6 +1183,7 @@ on_request_sent (GObject        *object,
       remove_pending (pending);
     }
 
+  pending_uri_unref (pending);
   g_object_unref (task);
 }
 

src/libostree/ostree-repo-checkout.c

@@ -363,7 +363,7 @@ checkout_file_hardlink (OstreeRepo                          *self,
                         GError                             **error)
 {
   HardlinkResult ret_result = HARDLINK_RESULT_NOT_SUPPORTED;
-  int srcfd = (self->mode == OSTREE_REPO_MODE_BARE || self->mode == OSTREE_REPO_MODE_BARE_USER) ?
+  int srcfd = _ostree_repo_mode_is_bare (self->mode) ?
     self->objects_dir_fd : self->uncompressed_objects_dir_fd;
 
  again:
@@ -423,6 +423,7 @@ checkout_one_file_at (OstreeRepo                        *repo,
   gboolean ret = FALSE;
   const char *checksum;
   gboolean is_symlink;
+  gboolean is_bare_user_symlink = FALSE;
   gboolean can_cache;
   gboolean need_copy = TRUE;
   char loose_path_buf[_OSTREE_LOOSE_PATH_MAX];
@@ -431,7 +432,6 @@ checkout_one_file_at (OstreeRepo                        *repo,
   gboolean is_whiteout;
 
   is_symlink = g_file_info_get_file_type (source_info) == G_FILE_TYPE_SYMBOLIC_LINK;
-
   checksum = ostree_repo_file_get_checksum ((OstreeRepoFile*)source);
 
   is_whiteout = !is_symlink && options->process_whiteouts &&
@@ -468,18 +468,42 @@ checkout_one_file_at (OstreeRepo                        *repo,
 
       while (current_repo)
         {
-          gboolean is_bare = ((current_repo->mode == OSTREE_REPO_MODE_BARE
+          /* TODO - Hoist this up to the toplevel at least for checking out from
+           * !parent; don't need to compute it for each file.
+           */
+          gboolean repo_is_usermode =
+            current_repo->mode == OSTREE_REPO_MODE_BARE_USER ||
+            current_repo->mode == OSTREE_REPO_MODE_BARE_USER_ONLY;
+          /* We're hardlinkable if the checkout mode matches the repo mode */
+          gboolean is_hardlinkable =
+            (current_repo->mode == OSTREE_REPO_MODE_BARE
              && options->mode == OSTREE_REPO_CHECKOUT_MODE_NONE) ||
-                              (current_repo->mode == OSTREE_REPO_MODE_BARE_USER
+            (repo_is_usermode && options->mode == OSTREE_REPO_CHECKOUT_MODE_USER);
-                               && options->mode == OSTREE_REPO_CHECKOUT_MODE_USER
+          gboolean is_bare = is_hardlinkable && !is_bare_user_symlink;
-                               /* NOTE: bare-user symlinks are not stored as symlinks */
-                               && !is_symlink));
           gboolean current_can_cache = (options->enable_uncompressed_cache
                                         && current_repo->enable_uncompressed_cache);
           gboolean is_archive_z2_with_cache = (current_repo->mode == OSTREE_REPO_MODE_ARCHIVE_Z2
                                                && options->mode == OSTREE_REPO_CHECKOUT_MODE_USER
                                                && current_can_cache);
 
+          /* NOTE: bare-user symlinks are not stored as symlinks; see
+           * https://github.com/ostreedev/ostree/commit/47c612e5a0688c3452a125655a245e8f4f01b2b0
+           * as well as write_object().
+           */
+          is_bare_user_symlink = (repo_is_usermode && is_symlink);
+
+          /* Verify if no_copy_fallback is set that we can hardlink, with a
+           * special exception for bare-user symlinks.
+           */
+          if (options->no_copy_fallback && !is_hardlinkable && !is_bare_user_symlink)
+            {
+              glnx_throw (error,
+                          repo_is_usermode ?
+                          "User repository mode requires user checkout mode to hardlink" :
+                          "Bare repository mode cannot hardlink in user checkout mode");
+              goto out;
+            }
+
           /* But only under these conditions */
           if (is_bare || is_archive_z2_with_cache)
             {
@@ -594,7 +618,13 @@ checkout_one_file_at (OstreeRepo                        *repo,
   /* Fall back to copy if we couldn't hardlink */
   if (need_copy)
     {
-      g_assert (!options->no_copy_fallback);
+      /* Bare user mode can't hardlink symlinks, so we need to do a copy for
+       * those. (Although in the future we could hardlink inside checkouts) This
+       * assertion is intended to ensure that for regular files at least, we
+       * succeeded at hardlinking above.
+       */
+      if (options->no_copy_fallback)
+        g_assert (is_bare_user_symlink);
       if (!ostree_repo_load_file (repo, checksum, &input, NULL, &xattrs,
                                   cancellable, error))
         goto out;
@@ -862,6 +892,9 @@ ostree_repo_checkout_tree (OstreeRepo               *self,
 {
   OstreeRepoCheckoutAtOptions options = { 0, };
 
+  if (ostree_repo_get_mode (self) == OSTREE_REPO_MODE_BARE_USER_ONLY)
+    mode = OSTREE_REPO_CHECKOUT_MODE_USER;
+
   options.mode = mode;
   options.overwrite_mode = overwrite_mode;
   /* Backwards compatibility */
@@ -948,6 +981,7 @@ ostree_repo_checkout_at (OstreeRepo                        *self,
                          GError                           **error)
 {
   OstreeRepoCheckoutAtOptions default_options = { 0, };
+  OstreeRepoCheckoutAtOptions real_options;
 
   if (!options)
     {
@@ -955,6 +989,13 @@ ostree_repo_checkout_at (OstreeRepo                        *self,
       options = &default_options;
     }
 
+  /* Make a copy so we can modify the options */
+  real_options = *options;
+  options = &real_options;
+
+  if (ostree_repo_get_mode (self) == OSTREE_REPO_MODE_BARE_USER_ONLY)
+    options->mode = OSTREE_REPO_CHECKOUT_MODE_USER;
+
   g_autoptr(GFile) commit_root = (GFile*) _ostree_repo_file_new_for_commit (self, commit, error);
   if (!commit_root)
     return FALSE;

src/libostree/ostree-repo-private.h

@@ -100,6 +100,7 @@ struct OstreeRepo {
   GError *writable_error;
   gboolean in_transaction;
   gboolean disable_fsync;
+  gboolean disable_xattrs;
   guint zlib_compression_level;
   GHashTable *loose_object_devino_hash;
   GHashTable *updated_uncompressed_dirs;

src/libostree/ostree-repo-pull.c

@@ -279,18 +279,21 @@ pull_termination_condition (OtPullData          *pull_data)
 
 static void
 check_outstanding_requests_handle_error (OtPullData          *pull_data,
-                                         GError              *error)
+                                         GError             **errorp)
 {
+  g_assert (errorp);
+
+  GError *error = *errorp;
   if (error)
     {
       if (!pull_data->caught_error)
         {
           pull_data->caught_error = TRUE;
-          g_propagate_error (pull_data->async_error, error);
+          g_propagate_error (pull_data->async_error, g_steal_pointer (errorp));
         }
       else
         {
-          g_error_free (error);
+          g_clear_error (errorp);
         }
     }
   else
@@ -382,7 +385,7 @@ idle_worker (gpointer user_data)
 {
   OtPullData *pull_data = user_data;
   ScanObjectQueueData *scan_data;
-  GError *error = NULL;
+  g_autoptr(GError) error = NULL;
 
   scan_data = g_queue_pop_head (&pull_data->scan_object_queue);
   if (!scan_data)
@@ -398,7 +401,7 @@ idle_worker (gpointer user_data)
                               scan_data->recursion_depth,
                               pull_data->cancellable,
                               &error);
-  check_outstanding_requests_handle_error (pull_data, error);
+  check_outstanding_requests_handle_error (pull_data, &error);
 
   g_free (scan_data->path);
   g_free (scan_data);
@@ -760,7 +763,7 @@ content_fetch_on_write_complete (GObject        *object,
 {
   FetchObjectData *fetch_data = user_data;
   OtPullData *pull_data = fetch_data->pull_data;
-  GError *local_error = NULL;
+  g_autoptr(GError) local_error = NULL;
   GError **error = &local_error;
   OstreeObjectType objtype;
   const char *expected_checksum;
@@ -794,7 +797,7 @@ content_fetch_on_write_complete (GObject        *object,
     pull_data->n_fetched_deltapart_fallbacks++;
  out:
   pull_data->n_outstanding_content_write_requests--;
-  check_outstanding_requests_handle_error (pull_data, local_error);
+  check_outstanding_requests_handle_error (pull_data, &local_error);
   fetch_object_data_free (fetch_data);
 }
 
@@ -806,7 +809,7 @@ content_fetch_on_complete (GObject        *object,
   OstreeFetcher *fetcher = (OstreeFetcher *)object;
   FetchObjectData *fetch_data = user_data;
   OtPullData *pull_data = fetch_data->pull_data;
-  GError *local_error = NULL;
+  g_autoptr(GError) local_error = NULL;
   GError **error = &local_error;
   GCancellable *cancellable = NULL;
   guint64 length;
@@ -881,7 +884,7 @@ content_fetch_on_complete (GObject        *object,
 
  out:
   pull_data->n_outstanding_content_fetches--;
-  check_outstanding_requests_handle_error (pull_data, local_error);
+  check_outstanding_requests_handle_error (pull_data, &local_error);
   if (free_fetch_data)
     fetch_object_data_free (fetch_data);
 }
@@ -893,7 +896,7 @@ on_metadata_written (GObject           *object,
 {
   FetchObjectData *fetch_data = user_data;
   OtPullData *pull_data = fetch_data->pull_data;
-  GError *local_error = NULL;
+  g_autoptr(GError) local_error = NULL;
   GError **error = &local_error;
   const char *expected_checksum;
   OstreeObjectType objtype;
@@ -927,7 +930,7 @@ on_metadata_written (GObject           *object,
   pull_data->n_outstanding_metadata_write_requests--;
   fetch_object_data_free (fetch_data);
 
-  check_outstanding_requests_handle_error (pull_data, local_error);
+  check_outstanding_requests_handle_error (pull_data, &local_error);
 }
 
 static void
@@ -943,7 +946,7 @@ meta_fetch_on_complete (GObject           *object,
   const char *checksum;
   g_autofree char *checksum_obj = NULL;
   OstreeObjectType objtype;
-  GError *local_error = NULL;
+  g_autoptr(GError) local_error = NULL;
   GError **error = &local_error;
   glnx_fd_close int fd = -1;
   gboolean free_fetch_data = TRUE;
@@ -1038,7 +1041,7 @@ meta_fetch_on_complete (GObject           *object,
   g_assert (pull_data->n_outstanding_metadata_fetches > 0);
   pull_data->n_outstanding_metadata_fetches--;
   pull_data->n_fetched_metadata++;
-  check_outstanding_requests_handle_error (pull_data, local_error);
+  check_outstanding_requests_handle_error (pull_data, &local_error);
   if (free_fetch_data)
     fetch_object_data_free (fetch_data);
 }
@@ -1061,7 +1064,7 @@ on_static_delta_written (GObject           *object,
 {
   FetchStaticDeltaData *fetch_data = user_data;
   OtPullData *pull_data = fetch_data->pull_data;
-  GError *local_error = NULL;
+  g_autoptr(GError) local_error = NULL;
   GError **error = &local_error;
 
   g_debug ("execute static delta part %s complete", fetch_data->expected_checksum);
@@ -1072,7 +1075,7 @@ on_static_delta_written (GObject           *object,
  out:
   g_assert (pull_data->n_outstanding_deltapart_write_requests > 0);
   pull_data->n_outstanding_deltapart_write_requests--;
-  check_outstanding_requests_handle_error (pull_data, local_error);
+  check_outstanding_requests_handle_error (pull_data, &local_error);
   /* Always free state */
   fetch_static_delta_data_free (fetch_data);
 }
@@ -1088,7 +1091,7 @@ static_deltapart_fetch_on_complete (GObject           *object,
   g_autofree char *temp_path = NULL;
   g_autoptr(GInputStream) in = NULL;
   g_autoptr(GVariant) part = NULL;
-  GError *local_error = NULL;
+  g_autoptr(GError) local_error = NULL;
   GError **error = &local_error;
   glnx_fd_close int fd = -1;
   gboolean free_fetch_data = TRUE;
@@ -1132,7 +1135,7 @@ static_deltapart_fetch_on_complete (GObject           *object,
   g_assert (pull_data->n_outstanding_deltapart_fetches > 0);
   pull_data->n_outstanding_deltapart_fetches--;
   pull_data->n_fetched_deltaparts++;
-  check_outstanding_requests_handle_error (pull_data, local_error);
+  check_outstanding_requests_handle_error (pull_data, &local_error);
   if (free_fetch_data)
     fetch_static_delta_data_free (fetch_data);
 }
@@ -1197,6 +1200,14 @@ gpg_verify_unwritten_commit (OtPullData         *pull_data,
   return TRUE;
 }
 
+static gboolean
+commitstate_is_partial (OtPullData   *pull_data,
+                        OstreeRepoCommitState commitstate)
+{
+  return pull_data->legacy_transaction_resuming
+    || (commitstate & OSTREE_REPO_COMMIT_STATE_PARTIAL) > 0;
+}
+
 static gboolean
 scan_commit_object (OtPullData         *pull_data,
                     const char         *checksum,
@@ -1253,8 +1264,7 @@ scan_commit_object (OtPullData         *pull_data,
     goto out;
 
   /* If we found a legacy transaction flag, assume all commits are partial */
-  is_partial = pull_data->legacy_transaction_resuming
+  is_partial = commitstate_is_partial (pull_data, commitstate);
-    || (commitstate & OSTREE_REPO_COMMIT_STATE_PARTIAL) > 0;
 
   /* PARSE OSTREE_SERIALIZED_COMMIT_VARIANT */
   g_variant_get_child (commit, 1, "@ay", &parent_csum);
@@ -1882,7 +1892,7 @@ get_best_static_delta_start_for (OtPullData *pull_data,
   /* Array<char*> of possible from checksums */
   g_autoptr(GPtrArray) candidates = g_ptr_array_new_with_free_func (g_free);
   const char *newest_candidate = NULL;
-  guint64 newest_candidate_timestamp;
+  guint64 newest_candidate_timestamp = 0;
 
   g_assert (pull_data->summary_deltas_checksums != NULL);
   g_hash_table_iter_init (&hiter, pull_data->summary_deltas_checksums);
@@ -1911,7 +1921,7 @@ get_best_static_delta_start_for (OtPullData *pull_data,
   for (guint i = 0; i < candidates->len; i++)
     {
       const char *candidate = candidates->pdata[i];
-      guint64 candidate_ts;
+      guint64 candidate_ts = 0;
       g_autoptr(GVariant) commit = NULL;
       OstreeRepoCommitState state;
       gboolean have_candidate;
@@ -1961,7 +1971,7 @@ on_superblock_fetched (GObject   *src,
 {
   FetchDeltaSuperData *fdata = data;
   OtPullData *pull_data = fdata->pull_data;
-  GError *local_error = NULL;
+  g_autoptr(GError) local_error = NULL;
   GError **error = &local_error;
   g_autoptr(GBytes) delta_superblock_data = NULL;
   const char *from_revision = fdata->from_revision;
@@ -2038,7 +2048,7 @@ on_superblock_fetched (GObject   *src,
   g_assert (pull_data->n_outstanding_metadata_fetches > 0);
   pull_data->n_outstanding_metadata_fetches--;
   pull_data->n_fetched_metadata++;
-  check_outstanding_requests_handle_error (pull_data, local_error);
+  check_outstanding_requests_handle_error (pull_data, &local_error);
 }
 
 static gboolean
@@ -3242,6 +3252,7 @@ ostree_repo_pull_with_options (OstreeRepo             *self,
       g_autofree char *from_revision = NULL;
       const char *ref = key;
       const char *to_revision = value;
+      gboolean have_valid_from_commit = TRUE;
 
       /* If we have a summary, find the latest local commit we have
        * to use as a from revision for static deltas.
@@ -3257,9 +3268,27 @@ ostree_repo_pull_with_options (OstreeRepo             *self,
           if (!ostree_repo_resolve_rev (pull_data->repo, ref, TRUE,
                                         &from_revision, error))
             goto out;
+
+          /* Determine whether the from revision we have is partial; this
+           * can happen if e.g. one uses `ostree pull --commit-metadata-only`.
+           * This mirrors the logic in get_best_static_delta_start_for().
+           */
+          if (from_revision)
+            {
+              OstreeRepoCommitState from_commitstate;
+
+              if (!ostree_repo_load_commit (pull_data->repo, from_revision, NULL,
+                                            &from_commitstate, error))
+                goto out;
+
+              /* Was it partial?  OK, we can't use it. */
+              if (commitstate_is_partial (pull_data, from_commitstate))
+                have_valid_from_commit = FALSE;
+            }
         }
 
       if (!disable_static_deltas &&
+          have_valid_from_commit &&
           (from_revision == NULL || g_strcmp0 (from_revision, to_revision) != 0))
         {
           g_autofree char *delta_name =

src/libostree/ostree-repo-refs.c

@@ -32,30 +32,23 @@ add_ref_to_set (const char       *remote,
                 GCancellable     *cancellable,
                 GError          **error)
 {
-  gboolean ret = FALSE;
-  char *contents;
   gsize len;
-  GString *refname;
+  char *contents = glnx_file_get_contents_utf8_at (base_fd, path, &len, cancellable, error);
-
-  contents = glnx_file_get_contents_utf8_at (base_fd, path, &len, cancellable, error);
   if (!contents)
-    goto out;
+    return FALSE;
 
   g_strchomp (contents);
 
-  refname = g_string_new ("");
+  g_autoptr(GString) refname = g_string_new ("");
   if (remote)
     {
       g_string_append (refname, remote);
       g_string_append_c (refname, ':');
     }
   g_string_append (refname, path);
+  g_hash_table_insert (refs, g_string_free (g_steal_pointer (&refname), FALSE), contents);
 
-  g_hash_table_insert (refs, g_string_free (refname, FALSE), contents);
+  return TRUE;
-
-  ret = TRUE;
- out:
-  return ret;
 }
 
 static gboolean
@@ -66,27 +59,16 @@ write_checksum_file_at (OstreeRepo   *self,
                         GCancellable *cancellable,
                         GError **error)
 {
-  gboolean ret = FALSE;
-  const char *lastslash;
-
   if (!ostree_validate_checksum_string (sha256, error))
-    goto out;
+    return FALSE;
 
   if (ostree_validate_checksum_string (name, NULL))
-    {
+    return glnx_throw (error, "Rev name '%s' looks like a checksum", name);
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
-                   "Rev name '%s' looks like a checksum", name);
-      goto out;
-    }
 
   if (!*name)
-    {
+    return glnx_throw (error, "Invalid empty ref name");
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
-                   "Invalid empty ref name");
-      goto out;
-    }
 
-  lastslash = strrchr (name, '/');
+  const char *lastslash = strrchr (name, '/');
 
   if (lastslash)
     {
@@ -94,7 +76,7 @@ write_checksum_file_at (OstreeRepo   *self,
       parent[lastslash - name] = '\0';
 
       if (!glnx_shutil_mkdir_p_at (dfd, parent, 0777, cancellable, error))
-        goto out;
+        return FALSE;
     }
 
   {
@@ -118,38 +100,32 @@ write_checksum_file_at (OstreeRepo   *self,
             g_clear_error (&temp_error);
 
             if (!ostree_repo_list_refs (self, name, &refs, cancellable, error))
-              goto out;
+              return FALSE;
 
             g_hash_table_iter_init (&hashiter, refs);
 
             while ((g_hash_table_iter_next (&hashiter, &hashkey, &hashvalue)))
               {
                 if (strcmp (name, (char *)hashkey) != 0)
-                  {
+                  return glnx_throw (error, "Conflict: %s exists under %s when attempting write", (char*)hashkey, name);
-                    g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
-                                 "Conflict: %s exists under %s when attempting write", (char*)hashkey, name);
-                    goto out;
-                  }
               }
 
             if (!glnx_shutil_rm_rf_at (dfd, name, cancellable, error))
-              goto out;
+              return FALSE;
 
             if (!_ostree_repo_file_replace_contents (self, dfd, name, (guint8*)bufnl, l + 1,
                                                      cancellable, error))
-              goto out;
+              return FALSE;
           }
         else
           {
             g_propagate_error (error, g_steal_pointer (&temp_error));
-            goto out;
+            return FALSE;
           }
       }
   }
 
-  ret = TRUE;
+  return TRUE;
- out:
-  return ret;
 }
 
 static gboolean
@@ -158,12 +134,11 @@ find_ref_in_remotes (OstreeRepo         *self,
                      int                *out_fd,
                      GError            **error)
 {
-  gboolean ret = FALSE;
   g_auto(GLnxDirFdIterator) dfd_iter = { 0, };
   glnx_fd_close int ret_fd = -1;
 
   if (!glnx_dirfd_iterator_init_at (self->repo_dir_fd, "refs/remotes", TRUE, &dfd_iter, error))
-    goto out;
+    return FALSE;
 
   while (TRUE)
     {
@@ -171,7 +146,7 @@ find_ref_in_remotes (OstreeRepo         *self,
       glnx_fd_close int remote_dfd = -1;
 
       if (!glnx_dirfd_iterator_next_dent_ensure_dtype (&dfd_iter, &dent, NULL, error))
-        goto out;
+        return FALSE;
       if (dent == NULL)
         break;
 
@@ -179,19 +154,17 @@ find_ref_in_remotes (OstreeRepo         *self,
         continue;
 
       if (!glnx_opendirat (dfd_iter.fd, dent->d_name, TRUE, &remote_dfd, error))
-        goto out;
+        return FALSE;
 
       if (!ot_openat_ignore_enoent (remote_dfd, rev, &ret_fd, error))
-        goto out;
+        return FALSE;
 
       if (ret_fd != -1)
         break;
     }
 
-  ret = TRUE;
   *out_fd = ret_fd; ret_fd = -1;
- out:
+  return TRUE;
-  return ret;
 }
 
 static gboolean
@@ -213,14 +186,13 @@ resolve_refspec_fallback (OstreeRepo     *self,
                           GCancellable   *cancellable,
                           GError        **error)
 {
-  gboolean ret = FALSE;
   g_autofree char *ret_rev = NULL;
 
   if (self->parent_repo)
     {
       if (!resolve_refspec (self->parent_repo, remote, ref, allow_noent,
                             fallback_remote, &ret_rev, error))
-        goto out;
+        return FALSE;
     }
   else if (!allow_noent)
     {
@@ -229,13 +201,11 @@ resolve_refspec_fallback (OstreeRepo     *self,
                    remote ? remote : "",
                    remote ? ":" : "",
                    ref);
-      goto out;
+      return FALSE;
     }
 
-  ret = TRUE;
   ot_transfer_out_value (out_rev, &ret_rev);
- out:
+  return TRUE;
-  return ret;
 }
 
 static gboolean
@@ -247,7 +217,6 @@ resolve_refspec (OstreeRepo     *self,
                  char          **out_rev,
                  GError        **error)
 {
-  gboolean ret = FALSE;
   __attribute__((unused)) GCancellable *cancellable = NULL;
   g_autofree char *ret_rev = NULL;
   glnx_fd_close int target_fd = -1;
@@ -264,26 +233,26 @@ resolve_refspec (OstreeRepo     *self,
       const char *remote_ref = glnx_strjoina ("refs/remotes/", remote, "/", ref);
 
       if (!ot_openat_ignore_enoent (self->repo_dir_fd, remote_ref, &target_fd, error))
-        goto out;
+        return FALSE;
     }
   else
     {
       const char *local_ref = glnx_strjoina ("refs/heads/", ref);
 
       if (!ot_openat_ignore_enoent (self->repo_dir_fd, local_ref, &target_fd, error))
-        goto out;
+        return FALSE;
 
       if (target_fd == -1 && fallback_remote)
         {
           local_ref = glnx_strjoina ("refs/remotes/", ref);
 
           if (!ot_openat_ignore_enoent (self->repo_dir_fd, local_ref, &target_fd, error))
-            goto out;
+            return FALSE;
 
           if (target_fd == -1)
             {
               if (!find_ref_in_remotes (self, ref, &target_fd, error))
-                goto out;
+                return FALSE;
             }
         }
     }
@@ -294,24 +263,22 @@ resolve_refspec (OstreeRepo     *self,
       if (!ret_rev)
         {
           g_prefix_error (error, "Couldn't open ref '%s': ", ref);
-          goto out;
+          return FALSE;
         }
 
       g_strchomp (ret_rev);
       if (!ostree_validate_checksum_string (ret_rev, error))
-        goto out;
+        return FALSE;
     }
   else
     {
       if (!resolve_refspec_fallback (self, remote, ref, allow_noent, fallback_remote,
                                      &ret_rev, cancellable, error))
-        goto out;
+        return FALSE;
     }
 
   ot_transfer_out_value (out_rev, &ret_rev);
-  ret = TRUE;
+  return TRUE;
- out:
-  return ret;
 }
 
 /**
@@ -330,65 +297,51 @@ ostree_repo_resolve_partial_checksum (OstreeRepo   *self,
                                       char        **full_checksum,
                                       GError      **error)
 {
-  gboolean ret = FALSE;
   static const char hexchars[] = "0123456789abcdef";
-  gsize off;
-  g_autoptr(GHashTable) ref_list = NULL;
   g_autofree char *ret_rev = NULL;
-  guint length;
-  const char *checksum = NULL;
-  OstreeObjectType objtype;
-  GHashTableIter hashiter;
-  gpointer key, value;
-  GVariant *first_commit;
 
   g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
 
   /* If the input is longer than OSTREE_SHA256_STRING_LEN chars or contains non-hex chars,
      don't bother looking for it as an object */
-  off = strspn (refspec, hexchars);
+  const gsize off = strspn (refspec, hexchars);
   if (off > OSTREE_SHA256_STRING_LEN || refspec[off] != '\0')
     return TRUE;
 
   /* this looks through all objects and adds them to the ref_list if:
      a) they are a commit object AND
      b) the obj checksum starts with the partual checksum defined by "refspec" */
+  g_autoptr(GHashTable) ref_list = NULL;
   if (!ostree_repo_list_commit_objects_starting_with (self, refspec, &ref_list, NULL, error))
-    goto out;
+    return FALSE;
 
-  length = g_hash_table_size (ref_list);
+  guint length = g_hash_table_size (ref_list);
 
+  GHashTableIter hashiter;
+  gpointer key, value;
+  GVariant *first_commit = NULL;
   g_hash_table_iter_init (&hashiter, ref_list);
   if (g_hash_table_iter_next (&hashiter, &key, &value))
     first_commit = (GVariant*) key;
-  else
-    first_commit = NULL;
 
+  OstreeObjectType objtype;
+  const char *checksum = NULL;
   if (first_commit)
     ostree_object_name_deserialize (first_commit, &checksum, &objtype);
 
   /* length more than one - multiple commits match partial refspec: is not unique */
   if (length > 1)
-    {
+    return glnx_throw (error, "Refspec %s not unique", refspec);
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
-                   "Refspec %s not unique", refspec);
-      goto out;
-    }
-    
   /* length is 1 - a single matching commit gives us our revision */
   else if (length == 1)
-    {
     ret_rev = g_strdup (checksum);
-    }
 
   /* Note: if length is 0, then code will return TRUE
      because there is no error, but it will return full_checksum = NULL
      to signal to continue parsing */
 
-  ret = TRUE;
   ot_transfer_out_value (full_checksum, &ret_rev);
- out:
+  return TRUE;
-  return ret;
 }
 
 static gboolean
@@ -399,7 +352,6 @@ _ostree_repo_resolve_rev_internal (OstreeRepo     *self,
                                    char          **out_rev,
                                    GError        **error)
 {
-  gboolean ret = FALSE;
   g_autofree char *ret_rev = NULL;
 
   g_return_val_if_fail (refspec != NULL, FALSE);
@@ -410,12 +362,12 @@ _ostree_repo_resolve_rev_internal (OstreeRepo     *self,
     }
 
   else if (!ostree_repo_resolve_partial_checksum (self, refspec, &ret_rev, error))
-    goto out;
+    return FALSE;
 
   if (!ret_rev)
     {
       if (error != NULL && *error != NULL)
-        goto out;
+        return FALSE;
 
       if (g_str_has_suffix (refspec, "^"))
         {
@@ -427,18 +379,14 @@ _ostree_repo_resolve_rev_internal (OstreeRepo     *self,
           parent_refspec[strlen(parent_refspec) - 1] = '\0';
 
           if (!ostree_repo_resolve_rev (self, parent_refspec, allow_noent, &parent_rev, error))
-            goto out;
+            return FALSE;
 
           if (!ostree_repo_load_variant (self, OSTREE_OBJECT_TYPE_COMMIT, parent_rev,
                                          &commit, error))
-            goto out;
+            return FALSE;
 
           if (!(ret_rev = ostree_commit_get_parent (commit)))
-            {
+            return glnx_throw (error, "Commit %s has no parent", parent_rev);
-              g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
-                           "Commit %s has no parent", parent_rev);
-              goto out;
-            }
         }
       else
         {
@@ -446,18 +394,16 @@ _ostree_repo_resolve_rev_internal (OstreeRepo     *self,
           g_autofree char *ref = NULL;
 
           if (!ostree_parse_refspec (refspec, &remote, &ref, error))
-            goto out;
+            return FALSE;
 
           if (!resolve_refspec (self, remote, ref, allow_noent,
                                 fallback_remote, &ret_rev, error))
-            goto out;
+            return FALSE;
         }
     }
 
-  ret = TRUE;
   ot_transfer_out_value (out_rev, &ret_rev);
- out:
+  return TRUE;
-  return ret;
 }
 
 /**
@@ -518,11 +464,10 @@ enumerate_refs_recurse (OstreeRepo    *repo,
                         GCancellable  *cancellable,
                         GError       **error)
 {
-  gboolean ret = FALSE;
   g_auto(GLnxDirFdIterator) dfd_iter = { 0, };
 
   if (!glnx_dirfd_iterator_init_at (child_dfd, path, FALSE, &dfd_iter, error))
-    goto out;
+    return FALSE;
 
   while (TRUE)
     {
@@ -530,7 +475,7 @@ enumerate_refs_recurse (OstreeRepo    *repo,
       struct dirent *dent = NULL;
 
       if (!glnx_dirfd_iterator_next_dent_ensure_dtype (&dfd_iter, &dent, cancellable, error))
-        goto out;
+        return FALSE;
       if (dent == NULL)
         break;
 
@@ -543,22 +488,19 @@ enumerate_refs_recurse (OstreeRepo    *repo,
           if (!enumerate_refs_recurse (repo, remote, base_dfd, base_path,
                                        dfd_iter.fd, dent->d_name,
                                        refs, cancellable, error))
-            goto out;
+            return FALSE;
-          
         }
       else if (dent->d_type == DT_REG)
         {
           if (!add_ref_to_set (remote, base_dfd, base_path->str, refs,
                                cancellable, error))
-            goto out;
+            return FALSE;
         }
 
       g_string_truncate (base_path, len);
     }
 
-  ret = TRUE;
+  return TRUE;
- out:
-  return ret;
 }
 
 static gboolean
@@ -569,7 +511,6 @@ _ostree_repo_list_refs_internal (OstreeRepo       *self,
                                  GCancellable     *cancellable,
                                  GError          **error)
 {
-  gboolean ret = FALSE;
   g_autoptr(GHashTable) ret_all_refs = NULL;
   g_autofree char *remote = NULL;
   g_autofree char *ref_prefix = NULL;
@@ -583,7 +524,7 @@ _ostree_repo_list_refs_internal (OstreeRepo       *self,
       const char *path;
 
       if (!ostree_parse_refspec (refspec_prefix, &remote, &ref_prefix, error))
-        goto out;
+        return FALSE;
 
       if (remote)
         {
@@ -599,10 +540,7 @@ _ostree_repo_list_refs_internal (OstreeRepo       *self,
       if (fstatat (self->repo_dir_fd, path, &stbuf, 0) < 0)
         {
           if (errno != ENOENT)
-            {
+            return glnx_throw_errno (error);
-              glnx_set_error_from_errno (error);
-              goto out;
-            }
         }
       else
         {
@@ -614,23 +552,23 @@ _ostree_repo_list_refs_internal (OstreeRepo       *self,
                 g_string_printf (base_path, "%s/", ref_prefix);
 
               if (!glnx_opendirat (self->repo_dir_fd, cut_prefix ? path : prefix_path, TRUE, &base_fd, error))
-                goto out;
+                return FALSE;
 
               if (!enumerate_refs_recurse (self, remote, base_fd, base_path,
                                            base_fd, cut_prefix ? "." : ref_prefix,
                                            ret_all_refs, cancellable, error))
-                goto out;
+                return FALSE;
             }
           else
             {
               glnx_fd_close int prefix_dfd = -1;
 
               if (!glnx_opendirat (self->repo_dir_fd, prefix_path, TRUE, &prefix_dfd, error))
-                goto out;
+                return FALSE;
 
               if (!add_ref_to_set (remote, prefix_dfd, ref_prefix, ret_all_refs,
                                    cancellable, error))
-                goto out;
+                return FALSE;
             }
         }
     }
@@ -641,17 +579,17 @@ _ostree_repo_list_refs_internal (OstreeRepo       *self,
       glnx_fd_close int refs_heads_dfd = -1;
 
       if (!glnx_opendirat (self->repo_dir_fd, "refs/heads", TRUE, &refs_heads_dfd, error))
-        goto out;
+        return FALSE;
 
       if (!enumerate_refs_recurse (self, NULL, refs_heads_dfd, base_path,
                                    refs_heads_dfd, ".",
                                    ret_all_refs, cancellable, error))
-        goto out;
+        return FALSE;
 
       g_string_truncate (base_path, 0);
 
       if (!glnx_dirfd_iterator_init_at (self->repo_dir_fd, "refs/remotes", TRUE, &dfd_iter, error))
-        goto out;
+        return FALSE;
 
       while (TRUE)
         {
@@ -659,7 +597,7 @@ _ostree_repo_list_refs_internal (OstreeRepo       *self,
           glnx_fd_close int remote_dfd = -1;
 
           if (!glnx_dirfd_iterator_next_dent_ensure_dtype (&dfd_iter, &dent, cancellable, error))
-            goto out;
+            return FALSE;
           if (!dent)
             break;
 
@@ -667,20 +605,18 @@ _ostree_repo_list_refs_internal (OstreeRepo       *self,
             continue;
 
           if (!glnx_opendirat (dfd_iter.fd, dent->d_name, TRUE, &remote_dfd, error))
-            goto out;
+            return FALSE;
 
           if (!enumerate_refs_recurse (self, dent->d_name, remote_dfd, base_path,
                                        remote_dfd, ".",
                                        ret_all_refs,
                                        cancellable, error))
-            goto out;
+            return FALSE;
         }
     }
 
-  ret = TRUE;
   ot_transfer_out_value (out_all_refs, &ret_all_refs);
- out:
+  return TRUE;
-  return ret;
 }
 
 /**
@@ -748,19 +684,16 @@ ostree_repo_remote_list_refs (OstreeRepo       *self,
                               GError          **error)
 {
   g_autoptr(GBytes) summary_bytes = NULL;
-  gboolean ret = FALSE;
   g_autoptr(GHashTable) ret_all_refs = NULL;
 
   if (!ostree_repo_remote_fetch_summary (self, remote_name,
                                          &summary_bytes, NULL,
                                          cancellable, error))
-    goto out;
+    return FALSE;
 
   if (summary_bytes == NULL)
     {
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
+      return glnx_throw (error, "Remote refs not available; server has no summary file");
-                   "Remote refs not available; server has no summary file\n");
-      goto out;
     }
   else
     {
@@ -786,12 +719,11 @@ ostree_repo_remote_list_refs (OstreeRepo       *self,
 
           if (ref_name != NULL)
             {
-              const guchar *csum_bytes;
-
               g_variant_get_child (child, 1, "(t@aya{sv})", NULL, &csum_v, NULL);
-              csum_bytes = ostree_checksum_bytes_peek_validate (csum_v, error);
+
+              const guchar *csum_bytes = ostree_checksum_bytes_peek_validate (csum_v, error);
               if (csum_bytes == NULL)
-                goto out;
+                return FALSE;
 
               ostree_checksum_inplace_from_bytes (csum_bytes, tmp_checksum);
 
@@ -804,11 +736,8 @@ ostree_repo_remote_list_refs (OstreeRepo       *self,
         }
     }
 
-  ret = TRUE;
   ot_transfer_out_value (out_all_refs, &ret_all_refs);
-
+  return TRUE;
- out:
-  return ret;
 }
 
 gboolean
@@ -819,7 +748,6 @@ _ostree_repo_write_ref (OstreeRepo    *self,
                         GCancellable  *cancellable,
                         GError       **error)
 {
-  gboolean ret = FALSE;
   glnx_fd_close int dfd = -1;
 
   if (remote == NULL)
@@ -828,7 +756,7 @@ _ostree_repo_write_ref (OstreeRepo    *self,
                            &dfd, error))
         {
           g_prefix_error (error, "Opening %s: ", "refs/heads");
-          goto out;
+          return FALSE;
         }
     }
   else
@@ -839,23 +767,19 @@ _ostree_repo_write_ref (OstreeRepo    *self,
                            &refs_remotes_dfd, error))
         {
           g_prefix_error (error, "Opening %s: ", "refs/remotes");
-          goto out;
+          return FALSE;
         }
 
       if (rev != NULL)
         {
           /* Ensure we have a dir for the remote */
           if (!glnx_shutil_mkdir_p_at (refs_remotes_dfd, remote, 0777, cancellable, error))
-            goto out;
+            return FALSE;
         }
 
       dfd = glnx_opendirat_with_errno (refs_remotes_dfd, remote, TRUE);
       if (dfd < 0 && (errno != ENOENT || rev != NULL))
-        {
+        return glnx_throw_errno_prefix (error, "Opening remotes/ dir %s", remote);
-          glnx_set_error_from_errno (error);
-          g_prefix_error (error, "Opening remotes/ dir %s: ", remote);
-          goto out;
-        }
     }
 
   if (rev == NULL)
@@ -865,25 +789,20 @@ _ostree_repo_write_ref (OstreeRepo    *self,
           if (unlinkat (dfd, ref, 0) != 0)
             {
               if (errno != ENOENT)
-              {
+                return glnx_throw_errno (error);
-                glnx_set_error_from_errno (error);
-                goto out;
-              }
             }
         }
     }
   else
     {
       if (!write_checksum_file_at (self, dfd, ref, rev, cancellable, error))
-        goto out;
+        return FALSE;
     }
 
   if (!_ostree_repo_update_mtime (self, error))
-    goto out;
+    return FALSE;
 
-  ret = TRUE;
+  return TRUE;
- out:
-  return ret;
 }
 
 gboolean
@@ -892,7 +811,6 @@ _ostree_repo_update_refs (OstreeRepo        *self,
                           GCancellable      *cancellable,
                           GError           **error)
 {
-  gboolean ret = FALSE;
   GHashTableIter hash_iter;
   gpointer key, value;
 
@@ -905,14 +823,12 @@ _ostree_repo_update_refs (OstreeRepo        *self,
       g_autofree char *ref = NULL;
 
       if (!ostree_parse_refspec (refspec, &remote, &ref, error))
-        goto out;
+        return FALSE;
 
       if (!_ostree_repo_write_ref (self, remote, ref, rev,
                                    cancellable, error))
-        goto out;
+        return FALSE;
     }
 
-  ret = TRUE;
+  return TRUE;
- out:
-  return ret;
 }

src/libostree/ostree-repo.c

@@ -42,6 +42,7 @@
 
 #include <locale.h>
 #include <glib/gstdio.h>
+#include <sys/file.h>
 
 /**
  * SECTION:ostree-repo
@@ -891,26 +892,21 @@ ostree_repo_write_config (OstreeRepo *self,
                           GKeyFile   *new_config,
                           GError    **error)
 {
-  gboolean ret = FALSE;
-  g_autofree char *data = NULL;
-  gsize len;
-
   g_return_val_if_fail (self->inited, FALSE);
 
-  data = g_key_file_to_data (new_config, &len, error);
+  gsize len;
+  g_autofree char *data = g_key_file_to_data (new_config, &len, error);
   if (!glnx_file_replace_contents_at (self->repo_dir_fd, "config",
                                       (guint8*)data, len, 0,
                                       NULL, error))
-    goto out;
+    return FALSE;
 
   g_key_file_free (self->config);
   self->config = g_key_file_new ();
   if (!g_key_file_load_from_data (self->config, data, len, 0, error))
-    goto out;
+    return FALSE;
 
-  ret = TRUE;
+  return TRUE;
- out:
-  return ret;
 }
 
 /* Bind a subset of an a{sv} to options in a given GKeyfile section */
@@ -953,34 +949,24 @@ impl_repo_remote_add (OstreeRepo     *self,
                       GCancellable   *cancellable,
                       GError        **error)
 {
-  g_autoptr(OstreeRemote) remote = NULL;
-  gboolean different_sysroot = FALSE;
-  gboolean ret = FALSE;
-
   g_return_val_if_fail (name != NULL, FALSE);
   g_return_val_if_fail (url != NULL, FALSE);
   g_return_val_if_fail (options == NULL || g_variant_is_of_type (options, G_VARIANT_TYPE ("a{sv}")), FALSE);
 
   if (strchr (name, '/') != NULL)
-    {
+    return glnx_throw (error, "Invalid character '/' in remote name: %s", name);
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
-                   "Invalid character '/' in remote name: %s",
-                   name);
-      goto out;
-    }
 
-  remote = ost_repo_get_remote (self, name, NULL);
+  g_autoptr(OstreeRemote) remote = ost_repo_get_remote (self, name, NULL);
   if (remote != NULL && if_not_exists)
     {
-      ret = TRUE;
+      /* Note early return */
-      goto out;
+      return TRUE;
     }
   else if (remote != NULL)
     {
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
+      return glnx_throw (error,
                          "Remote configuration for \"%s\" already exists: %s",
                          name, remote->file ? gs_file_get_path_cached (remote->file) : "(in config)");
-      goto out;
     }
 
   remote = ost_remote_new ();
@@ -994,20 +980,18 @@ impl_repo_remote_add (OstreeRepo     *self,
    *
    * XXX Having API regret about the "sysroot" argument now.
    */
+  gboolean different_sysroot = FALSE;
   if (sysroot != NULL)
     different_sysroot = !g_file_equal (sysroot, self->sysroot_dir);
 
   if (different_sysroot || ostree_repo_is_system (self))
     {
-      g_autofree char *basename = g_strconcat (name, ".conf", NULL);
+      g_autoptr(GError) local_error = NULL;
-      g_autoptr(GFile) etc_ostree_remotes_d = NULL;
-      GError *local_error = NULL;
 
       if (sysroot == NULL)
         sysroot = self->sysroot_dir;
 
-      etc_ostree_remotes_d = g_file_resolve_relative_path (sysroot, SYSCONF_REMOTES);
+      g_autoptr(GFile) etc_ostree_remotes_d = g_file_resolve_relative_path (sysroot, SYSCONF_REMOTES);
-
       if (!g_file_make_directory_with_parents (etc_ostree_remotes_d,
                                                cancellable, &local_error))
         {
@@ -1017,11 +1001,12 @@ impl_repo_remote_add (OstreeRepo     *self,
             }
           else
             {
-              g_propagate_error (error, local_error);
+              g_propagate_error (error, g_steal_pointer (&local_error));
-              goto out;
+              return FALSE;
             }
         }
 
+      g_autofree char *basename = g_strconcat (name, ".conf", NULL);
       remote->file = g_file_get_child (etc_ostree_remotes_d, basename);
     }
 
@@ -1035,16 +1020,14 @@ impl_repo_remote_add (OstreeRepo     *self,
 
   if (remote->file != NULL)
     {
-      g_autofree char *data = NULL;
       gsize length;
-
+      g_autofree char *data = g_key_file_to_data (remote->options, &length, NULL);
-      data = g_key_file_to_data (remote->options, &length, NULL);
 
       if (!g_file_replace_contents (remote->file,
                                     data, length,
                                     NULL, FALSE, 0, NULL,
                                     cancellable, error))
-        goto out;
+        return FALSE;
     }
   else
     {
@@ -1054,15 +1037,12 @@ impl_repo_remote_add (OstreeRepo     *self,
       ot_keyfile_copy_group (remote->options, config, remote->group);
 
       if (!ostree_repo_write_config (self, config, error))
-        goto out;
+        return FALSE;
     }
 
   ost_repo_add_remote (self, remote);
 
-  ret = TRUE;
+  return TRUE;
-
- out:
-  return ret;
 }
 
 /**
@@ -1103,67 +1083,52 @@ impl_repo_remote_delete (OstreeRepo     *self,
                          GCancellable   *cancellable,
                          GError        **error)
 {
-  g_autoptr(OstreeRemote) remote = NULL;
-  gboolean ret = FALSE;
-
   g_return_val_if_fail (name != NULL, FALSE);
 
   if (strchr (name, '/') != NULL)
-    {
+    return glnx_throw (error, "Invalid character '/' in remote name: %s", name);
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
-                   "Invalid character '/' in remote name: %s",
-                   name);
-      goto out;
-    }
 
+  g_autoptr(OstreeRemote) remote = NULL;
   if (if_exists)
     {
       remote = ost_repo_get_remote (self, name, NULL);
       if (!remote)
         {
-          ret = TRUE;
+          /* Note early return */
-          goto out;
+          return TRUE;
         }
     }
   else
     remote = ost_repo_get_remote (self, name, error);
 
   if (remote == NULL)
-    goto out;
+    return FALSE;
 
   if (remote->file != NULL)
     {
       if (unlink (gs_file_get_path_cached (remote->file)) != 0)
-        {
+        return glnx_throw_errno (error);
-          glnx_set_error_from_errno (error);
-          goto out;
-        }
     }
   else
     {
-      g_autoptr(GKeyFile) config = NULL;
+      g_autoptr(GKeyFile) config = ostree_repo_copy_config (self);
-
-      config = ostree_repo_copy_config (self);
 
       /* XXX Not sure it's worth failing if the group to remove
        *     isn't found.  It's the end result we want, after all. */
       if (g_key_file_remove_group (config, remote->group, NULL))
         {
           if (!ostree_repo_write_config (self, config, error))
-            goto out;
+            return FALSE;
         }
     }
 
   /* Delete the remote's keyring file, if it exists. */
   if (!ot_ensure_unlinked_at (self->repo_dir_fd, remote->keyring, error))
-    goto out;
+    return FALSE;
 
   ost_repo_remove_remote (self, remote);
 
-  ret = TRUE;
+  return TRUE;
-
- out:
-  return ret;
 }
 
 /**
@@ -1319,11 +1284,9 @@ ostree_repo_remote_get_url (OstreeRepo  *self,
                             char       **out_url,
                             GError     **error)
 {
-  g_autofree char *url = NULL;
-  gboolean ret = FALSE;
-
   g_return_val_if_fail (name != NULL, FALSE);
 
+  g_autofree char *url = NULL;
   if (_ostree_repo_remote_name_is_file (name))
     {
       url = g_strdup (name);
@@ -1331,23 +1294,19 @@ ostree_repo_remote_get_url (OstreeRepo  *self,
   else
     {
       if (!ostree_repo_get_remote_option (self, name, "url", NULL, &url, error))
-        goto out;
+        return FALSE;
 
       if (url == NULL)
         {
           g_set_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND,
                        "No \"url\" option in remote \"%s\"", name);
-          goto out;
+          return FALSE;
         }
     }
 
   if (out_url != NULL)
     *out_url = g_steal_pointer (&url);
-
+  return TRUE;
-  ret = TRUE;
-
- out:
-  return ret;
 }
 
 /**
@@ -1583,8 +1542,9 @@ ostree_repo_remote_gpg_import (OstreeRepo         *self,
 
   if (fstatat (self->repo_dir_fd, remote->keyring, &stbuf, AT_SYMLINK_NOFOLLOW) == 0)
     {
+      GLnxFileCopyFlags copyflags = self->disable_xattrs ? GLNX_FILE_COPY_NOXATTRS : 0;
       if (!glnx_file_copy_at (self->repo_dir_fd, remote->keyring,
-                              &stbuf, target_temp_fd, "pubring.gpg", 0,
+                              &stbuf, target_temp_fd, "pubring.gpg", copyflags,
                               cancellable, error))
         {
           g_prefix_error (error, "Unable to copy remote's keyring: ");
@@ -1741,7 +1701,6 @@ ostree_repo_mode_to_string (OstreeRepoMode   mode,
                             const char     **out_mode,
                             GError         **error)
 {
-  gboolean ret = FALSE;
   const char *ret_mode;
 
   switch (mode)
@@ -1752,19 +1711,18 @@ ostree_repo_mode_to_string (OstreeRepoMode   mode,
     case OSTREE_REPO_MODE_BARE_USER:
       ret_mode = "bare-user";
       break;
+    case OSTREE_REPO_MODE_BARE_USER_ONLY:
+      ret_mode = "bare-user-only";
+      break;
     case OSTREE_REPO_MODE_ARCHIVE_Z2:
       ret_mode ="archive-z2";
       break;
     default:
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
+      return glnx_throw (error, "Invalid mode '%d'", mode);
-                   "Invalid mode '%d'", mode);
-      goto out;
     }
 
-  ret = TRUE;
   *out_mode = ret_mode;
- out:
+  return TRUE;
-  return ret;
 }
 
 gboolean
@@ -1772,27 +1730,22 @@ ostree_repo_mode_from_string (const char      *mode,
                               OstreeRepoMode  *out_mode,
                               GError         **error)
 {
-  gboolean ret = FALSE;
   OstreeRepoMode ret_mode;
 
   if (strcmp (mode, "bare") == 0)
     ret_mode = OSTREE_REPO_MODE_BARE;
   else if (strcmp (mode, "bare-user") == 0)
     ret_mode = OSTREE_REPO_MODE_BARE_USER;
+  else if (strcmp (mode, "bare-user-only") == 0)
+    ret_mode = OSTREE_REPO_MODE_BARE_USER_ONLY;
   else if (strcmp (mode, "archive-z2") == 0 ||
            strcmp (mode, "archive") == 0)
     ret_mode = OSTREE_REPO_MODE_ARCHIVE_Z2;
   else
-    {
+    return glnx_throw (error, "Invalid mode '%s' in repository configuration", mode);
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
-                   "Invalid mode '%s' in repository configuration", mode);
-      goto out;
-    }
 
-  ret = TRUE;
   *out_mode = ret_mode;
- out:
+  return TRUE;
-  return ret;
 }
 
 #define DEFAULT_CONFIG_CONTENTS ("[core]\n" \
@@ -1830,10 +1783,7 @@ ostree_repo_create (OstreeRepo     *self,
   if (mkdir (repopath, 0755) != 0)
     {
       if (G_UNLIKELY (errno != EEXIST))
-        {
+        return glnx_throw_errno (error);
-          glnx_set_error_from_errno (error);
-          return FALSE;
-        }
     }
 
   if (!glnx_opendirat (AT_FDCWD, repopath, TRUE, &dfd, error))
@@ -1843,11 +1793,12 @@ ostree_repo_create (OstreeRepo     *self,
     {
       if (errno == ENOENT)
         {
-          const char *mode_str;
+          const char *mode_str = NULL;
           g_autoptr(GString) config_data = g_string_new (DEFAULT_CONFIG_CONTENTS);
 
           if (!ostree_repo_mode_to_string (mode, &mode_str, error))
             return FALSE;
+          g_assert (mode_str);
 
           g_string_append_printf (config_data, "mode=%s\n", mode_str);
 
@@ -1857,10 +1808,7 @@ ostree_repo_create (OstreeRepo     *self,
             return FALSE;
         }
       else
-        {
+        return glnx_throw_errno (error);
-          glnx_set_error_from_errno (error);
-          return FALSE;
-        }
     }
 
   for (guint i = 0; i < G_N_ELEMENTS (state_dirs); i++)
@@ -1869,10 +1817,7 @@ ostree_repo_create (OstreeRepo     *self,
       if (mkdirat (dfd, elt, 0755) == -1)
         {
           if (G_UNLIKELY (errno != EEXIST))
-            {
+            return glnx_throw_errno (error);
-              glnx_set_error_from_errno (error);
-              return FALSE;
-            }
         }
     }
 
@@ -1890,8 +1835,7 @@ enumerate_directory_allow_noent (GFile               *dirpath,
                                  GCancellable        *cancellable,
                                  GError             **error)
 {
-  gboolean ret = FALSE;
+  g_autoptr(GError) temp_error = NULL;
-  GError *temp_error = NULL;
   g_autoptr(GFileEnumerator) ret_direnum = NULL;
 
   ret_direnum = g_file_enumerate_children (dirpath, queryargs, queryflags,
@@ -1899,21 +1843,17 @@ enumerate_directory_allow_noent (GFile               *dirpath,
   if (!ret_direnum)
     {
       if (g_error_matches (temp_error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND))
-        {
         g_clear_error (&temp_error);
-          ret = TRUE;
-        }
       else
-        g_propagate_error (error, temp_error);
+        {
-
+          g_propagate_error (error, g_steal_pointer (&temp_error));
-      goto out;
+          return FALSE;
+        }
     }
 
-  ret = TRUE;
   if (out_direnum)
     *out_direnum = g_steal_pointer (&ret_direnum);
- out:
+  return TRUE;
-  return ret;
 }
 
 static gboolean
@@ -1979,17 +1919,12 @@ append_one_remote_config (OstreeRepo      *self,
                           GCancellable    *cancellable,
                           GError         **error)
 {
-  gboolean ret = FALSE;
   g_autoptr(GKeyFile) remotedata = g_key_file_new ();
-
   if (!g_key_file_load_from_file (remotedata, gs_file_get_path_cached (path),
                                   0, error))
-    goto out;
+    return FALSE;
 
-  ret = add_remotes_from_keyfile (self, remotedata, path, error);
+  return add_remotes_from_keyfile (self, remotedata, path, error);
-
- out:
-  return ret;
 }
 
 static GFile *
@@ -2033,11 +1968,7 @@ reload_core_config (OstreeRepo          *self,
     return FALSE;
 
   if (strcmp (version, "1") != 0)
-    {
+    return glnx_throw (error, "Invalid repository version '%s'", version);
-      g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
-                   "Invalid repository version '%s'", version);
-      return FALSE;
-    }
 
   if (!ot_keyfile_get_boolean_with_default (self->config, "core", "archive",
                                             FALSE, &is_archive, error))
@@ -2075,6 +2006,11 @@ reload_core_config (OstreeRepo          *self,
       ostree_repo_set_disable_fsync (self, TRUE);
   }
 
+  /* See https://github.com/ostreedev/ostree/issues/758 */
+  if (!ot_keyfile_get_boolean_with_default (self->config, "core", "disable-xattrs",
+                                            FALSE, &self->disable_xattrs, error))
+    return FALSE;
+
   { g_autofree char *tmp_expiry_seconds = NULL;
 
     /* 86400 secs = one day */
@@ -2125,25 +2061,23 @@ reload_remote_config (OstreeRepo          *self,
                       GCancellable        *cancellable,
                       GError             **error)
 {
-  gboolean ret = FALSE;
-  g_autoptr(GFile) remotes_d = NULL;
-  g_autoptr(GFileEnumerator) direnum = NULL;
 
   g_mutex_lock (&self->remotes_lock);
   g_hash_table_remove_all (self->remotes);
   g_mutex_unlock (&self->remotes_lock);
 
   if (!add_remotes_from_keyfile (self, self->config, NULL, error))
-    goto out;
+    return FALSE;
 
-  remotes_d = get_remotes_d_dir (self);
+  g_autoptr(GFile) remotes_d = get_remotes_d_dir (self);
   if (remotes_d == NULL)
     return TRUE;
 
+  g_autoptr(GFileEnumerator) direnum = NULL;
   if (!enumerate_directory_allow_noent (remotes_d, OSTREE_GIO_FAST_QUERYINFO, 0,
                                         &direnum,
                                         cancellable, error))
-    goto out;
+    return FALSE;
   if (direnum)
     {
       while (TRUE)
@@ -2155,7 +2089,7 @@ reload_remote_config (OstreeRepo          *self,
 
           if (!g_file_enumerator_iterate (direnum, &file_info, &path,
                                           NULL, error))
-            goto out;
+            return FALSE;
           if (file_info == NULL)
             break;
 
@@ -2166,14 +2100,12 @@ reload_remote_config (OstreeRepo          *self,
               g_str_has_suffix (name, ".conf"))
             {
               if (!append_one_remote_config (self, path, cancellable, error))
-                goto out;
+                return FALSE;
             }
         }
     }
 
-  ret = TRUE;
+  return TRUE;
- out:
-  return ret;
 }
 
 /**
@@ -2202,7 +2134,6 @@ ostree_repo_open (OstreeRepo    *self,
                   GCancellable  *cancellable,
                   GError       **error)
 {
-  gboolean ret = FALSE;
   struct stat stbuf;
 
   g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
@@ -2225,7 +2156,7 @@ ostree_repo_open (OstreeRepo    *self,
                                   &boot_id,
                                   NULL,
                                   error))
-          goto out;
+          return FALSE;
         g_strdelimit (boot_id, "\n", '\0');
       }
 
@@ -2236,14 +2167,14 @@ ostree_repo_open (OstreeRepo    *self,
                        &self->repo_dir_fd, error))
     {
       g_prefix_error (error, "%s: ", gs_file_get_path_cached (self->repodir));
-      goto out;
+      return FALSE;
     }
 
   if (!glnx_opendirat (self->repo_dir_fd, "objects", TRUE,
                        &self->objects_dir_fd, error))
     {
       g_prefix_error (error, "Opening objects/ directory: ");
-      goto out;
+      return FALSE;
     }
 
   self->writable = faccessat (self->objects_dir_fd, ".", W_OK, 0) == 0;
@@ -2251,13 +2182,11 @@ ostree_repo_open (OstreeRepo    *self,
     {
       /* This is returned through ostree_repo_is_writable(). */
       glnx_set_error_from_errno (&self->writable_error);
+      /* Note - we don't return this error yet! */
     }
 
   if (fstat (self->objects_dir_fd, &stbuf) != 0)
-    {
+    return glnx_throw_errno (error);
-      glnx_set_error_from_errno (error);
-      goto out;
-    }
 
   if (stbuf.st_uid != getuid () || stbuf.st_gid != getgid ())
     {
@@ -2270,37 +2199,34 @@ ostree_repo_open (OstreeRepo    *self,
     }
 
   if (!glnx_opendirat (self->repo_dir_fd, "tmp", TRUE, &self->tmp_dir_fd, error))
-    goto out;
+    return FALSE;
 
   if (self->writable)
     {
       if (!glnx_shutil_mkdir_p_at (self->tmp_dir_fd, _OSTREE_CACHE_DIR, 0775, cancellable, error))
-        goto out;
+        return FALSE;
 
       if (!glnx_opendirat (self->tmp_dir_fd, _OSTREE_CACHE_DIR, TRUE, &self->cache_dir_fd, error))
-        goto out;
+        return FALSE;
     }
 
   if (!ostree_repo_reload_config (self, cancellable, error))
-    goto out;
+    return FALSE;
 
   /* TODO - delete this */
   if (self->mode == OSTREE_REPO_MODE_ARCHIVE_Z2 && self->enable_uncompressed_cache)
     {
       if (!glnx_shutil_mkdir_p_at (self->repo_dir_fd, "uncompressed-objects-cache", 0755,
                                    cancellable, error))
-        goto out;
+        return FALSE;
       if (!glnx_opendirat (self->repo_dir_fd, "uncompressed-objects-cache", TRUE,
                            &self->uncompressed_objects_dir_fd,
                            error))
-        goto out;
+        return FALSE;
     }
 
   self->inited = TRUE;
-
+  return TRUE;
-  ret = TRUE;
- out:
-  return ret;
 }
 
 /**
@@ -2474,7 +2400,7 @@ list_loose_objects_at (OstreeRepo             *self,
 
       if ((self->mode == OSTREE_REPO_MODE_ARCHIVE_Z2
            && strcmp (dot, ".filez") == 0) ||
-          ((self->mode == OSTREE_REPO_MODE_BARE || self->mode == OSTREE_REPO_MODE_BARE_USER)
+          ((_ostree_repo_mode_is_bare (self->mode))
            && strcmp (dot, ".file") == 0))
         objtype = OSTREE_OBJECT_TYPE_FILE;
       else if (strcmp (dot, ".dirtree") == 0)
@@ -2529,7 +2455,6 @@ list_loose_objects (OstreeRepo                     *self,
                     GCancellable                   *cancellable,
                     GError                        **error)
 {
-  gboolean ret = FALSE;
   guint c;
   int dfd = -1;
   static const gchar hexchars[] = "0123456789abcdef";
@@ -2546,21 +2471,16 @@ list_loose_objects (OstreeRepo                     *self,
           if (errno == ENOENT)
             continue;
           else
-            {
+            return glnx_throw_errno (error);
-              glnx_set_error_from_errno (error);
-              goto out;
-            }
         }
       /* Takes ownership of dfd */
       if (!list_loose_objects_at (self, inout_objects, buf, dfd,
                                        commit_starting_with,
                                        cancellable, error))
-        goto out;
+        return FALSE;
     }
 
-  ret = TRUE;
+  return TRUE;
- out:
-  return ret;
 }
 
 static gboolean
@@ -2574,7 +2494,6 @@ load_metadata_internal (OstreeRepo       *self,
                         GCancellable     *cancellable,
                         GError          **error)
 {
-  gboolean ret = FALSE;
   char loose_path_buf[_OSTREE_LOOSE_PATH_MAX];
   struct stat stbuf;
   glnx_fd_close int fd = -1;
@@ -2587,22 +2506,19 @@ load_metadata_internal (OstreeRepo       *self,
 
  if (!ot_openat_ignore_enoent (self->objects_dir_fd, loose_path_buf, &fd,
                                error))
-    goto out;
+    return FALSE;
 
   if (fd < 0 && self->commit_stagedir_fd != -1)
     {
       if (!ot_openat_ignore_enoent (self->commit_stagedir_fd, loose_path_buf, &fd,
                                     error))
-        goto out;
+        return FALSE;
     }
 
   if (fd != -1)
     {
       if (fstat (fd, &stbuf) < 0)
-        {
+        return glnx_throw_errno (error);
-          glnx_set_error_from_errno (error);
-          goto out;
-        }
 
       if (out_variant)
         {
@@ -2613,7 +2529,7 @@ load_metadata_internal (OstreeRepo       *self,
 
               mfile = g_mapped_file_new_from_fd (fd, FALSE, error);
               if (!mfile)
-                goto out;
+                return FALSE;
               ret_variant = g_variant_new_from_data (ostree_metadata_variant_type (objtype),
                                                      g_mapped_file_get_contents (mfile),
                                                      g_mapped_file_get_length (mfile),
@@ -2626,7 +2542,7 @@ load_metadata_internal (OstreeRepo       *self,
             {
               g_autoptr(GBytes) data = glnx_fd_readall_bytes (fd, cancellable, error);
               if (!data)
-                goto out;
+                return FALSE;
               ret_variant = g_variant_new_from_bytes (ostree_metadata_variant_type (objtype),
                                                       data, TRUE);
               g_variant_ref_sink (ret_variant);
@@ -2636,7 +2552,7 @@ load_metadata_internal (OstreeRepo       *self,
         {
           ret_stream = g_unix_input_stream_new (fd, TRUE);
           if (!ret_stream)
-            goto out;
+            return FALSE;
           fd = -1; /* Transfer ownership */
         }
 
@@ -2646,21 +2562,19 @@ load_metadata_internal (OstreeRepo       *self,
   else if (self->parent_repo)
     {
       if (!ostree_repo_load_variant (self->parent_repo, objtype, sha256, &ret_variant, error))
-        goto out;
+        return FALSE;
     }
   else if (error_if_not_found)
     {
       g_set_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND,
                    "No such metadata object %s.%s",
                    sha256, ostree_object_type_to_string (objtype));
-      goto out;
+      return FALSE;
     }
 
-  ret = TRUE;
   ot_transfer_out_value (out_variant, &ret_variant);
   ot_transfer_out_value (out_stream, &ret_stream);
- out:
+  return TRUE;
-  return ret;
 }
 
 static gboolean
@@ -2745,8 +2659,7 @@ _ostree_repo_read_bare_fd (OstreeRepo           *self,
 {
   char loose_path_buf[_OSTREE_LOOSE_PATH_MAX];
 
-  g_assert (self->mode == OSTREE_REPO_MODE_BARE ||
+  g_assert (_ostree_repo_mode_is_bare (self->mode));
-            self->mode == OSTREE_REPO_MODE_BARE_USER);
 
   _ostree_loose_path (loose_path_buf, checksum, OSTREE_OBJECT_TYPE_FILE, self->mode);
 
@@ -2910,6 +2823,37 @@ ostree_repo_load_file (OstreeRepo         *self,
                   g_file_info_set_symlink_target (ret_file_info, targetbuf);
                 }
             }
+          else if (repo_mode == OSTREE_REPO_MODE_BARE_USER_ONLY)
+            {
+              glnx_fd_close int fd = -1;
+
+              /* Canonical info is: uid/gid is 0 and no xattrs, which
+                 might be wrong and thus not validate correctly, but
+                 at least we report something consistent. */
+              g_file_info_set_attribute_uint32 (ret_file_info, "unix::uid", 0);
+              g_file_info_set_attribute_uint32 (ret_file_info, "unix::gid", 0);
+
+              if (g_file_info_get_file_type (ret_file_info) == G_FILE_TYPE_REGULAR &&
+                  out_input)
+                {
+                  fd = openat (self->objects_dir_fd, loose_path_buf, O_RDONLY | O_CLOEXEC);
+                  if (fd < 0)
+                    {
+                      glnx_set_error_from_errno (error);
+                      goto out;
+                    }
+
+                  ret_input = g_unix_input_stream_new (fd, TRUE);
+                  fd = -1; /* Transfer ownership */
+                }
+
+              if (out_xattrs)
+                {
+                  GVariantBuilder builder;
+                  g_variant_builder_init (&builder, G_VARIANT_TYPE ("a(ayay)"));
+                  ret_xattrs = g_variant_ref_sink (g_variant_builder_end (&builder));
+                }
+            }
           else
             {
               g_assert (repo_mode == OSTREE_REPO_MODE_BARE);
@@ -2928,7 +2872,9 @@ ostree_repo_load_file (OstreeRepo         *self,
 
                   if (out_xattrs)
                     {
-                      if (!glnx_fd_get_all_xattrs (fd, &ret_xattrs,
+                      if (self->disable_xattrs)
+                        ret_xattrs = g_variant_ref_sink (g_variant_new_array (G_VARIANT_TYPE ("(ayay)"), NULL, 0));
+                      else if (!glnx_fd_get_all_xattrs (fd, &ret_xattrs,
                                                         cancellable, error))
                         goto out;
                     }
@@ -2942,7 +2888,9 @@ ostree_repo_load_file (OstreeRepo         *self,
               else if (g_file_info_get_file_type (ret_file_info) == G_FILE_TYPE_SYMBOLIC_LINK
                        && out_xattrs)
                 {
-                  if (!glnx_dfd_name_get_all_xattrs (self->objects_dir_fd, loose_path_buf,
+                  if (self->disable_xattrs)
+                    ret_xattrs = g_variant_ref_sink (g_variant_new_array (G_VARIANT_TYPE ("(ayay)"), NULL, 0));
+                  else if (!glnx_dfd_name_get_all_xattrs (self->objects_dir_fd, loose_path_buf,
                                                           &ret_xattrs,
                                                           cancellable, error))
                     goto out;
@@ -3476,7 +3424,6 @@ ostree_repo_query_object_storage_size (OstreeRepo           *self,
                                        GCancellable         *cancellable,
                                        GError              **error)
 {
-  gboolean ret = FALSE;
   char loose_path[_OSTREE_LOOSE_PATH_MAX];
   int res;
   struct stat stbuf;
@@ -3487,15 +3434,10 @@ ostree_repo_query_object_storage_size (OstreeRepo           *self,
     res = fstatat (self->objects_dir_fd, loose_path, &stbuf, AT_SYMLINK_NOFOLLOW);
   while (G_UNLIKELY (res == -1 && errno == EINTR));
   if (G_UNLIKELY (res == -1))
-    {
+    return glnx_throw_errno_prefix (error, "Querying object %s.%s", sha256, ostree_object_type_to_string (objtype));
-      glnx_set_prefix_error_from_errno (error, "Querying object %s.%s", sha256, ostree_object_type_to_string (objtype));
-      goto out;
-    }
 
   *out_size = stbuf.st_size;
-  ret = TRUE;
+  return TRUE;
- out:
-  return ret;
 }
 
 /**
@@ -3563,13 +3505,11 @@ ostree_repo_load_commit (OstreeRepo            *self,
                          OstreeRepoCommitState *out_state,
                          GError               **error)
 {
-  gboolean ret = FALSE;
-
   if (out_variant)
     {
       if (!load_metadata_internal (self, OSTREE_OBJECT_TYPE_COMMIT, checksum, TRUE,
                                    out_variant, NULL, NULL, NULL, error))
-        goto out;
+        return FALSE;
     }
 
   if (out_state)
@@ -3585,14 +3525,11 @@ ostree_repo_load_commit (OstreeRepo            *self,
         }
       else if (errno != ENOENT)
         {
-          glnx_set_error_from_errno (error);
+          return glnx_throw_errno (error);
-          goto out;
         }
     }
 
-  ret = TRUE;
+  return TRUE;
- out:
-  return ret;
 }
 
 /**
@@ -3618,13 +3555,11 @@ ostree_repo_list_objects (OstreeRepo                  *self,
                           GCancellable                *cancellable,
                           GError                     **error)
 {
-  gboolean ret = FALSE;
-  g_autoptr(GHashTable) ret_objects = NULL;
-
   g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
   g_return_val_if_fail (self->inited, FALSE);
 
-  ret_objects = g_hash_table_new_full (ostree_hash_object_name, g_variant_equal,
+  g_autoptr(GHashTable) ret_objects =
+    g_hash_table_new_full (ostree_hash_object_name, g_variant_equal,
                            (GDestroyNotify) g_variant_unref,
                            (GDestroyNotify) g_variant_unref);
 
@@ -3634,11 +3569,11 @@ ostree_repo_list_objects (OstreeRepo                  *self,
   if (flags & OSTREE_REPO_LIST_OBJECTS_LOOSE)
     {
       if (!list_loose_objects (self, ret_objects, NULL, cancellable, error))
-        goto out;
+        return FALSE;
       if ((flags & OSTREE_REPO_LIST_OBJECTS_NO_PARENTS) == 0 && self->parent_repo)
         {
           if (!list_loose_objects (self->parent_repo, ret_objects, NULL, cancellable, error))
-            goto out;
+            return FALSE;
         }
     }
 
@@ -3647,10 +3582,8 @@ ostree_repo_list_objects (OstreeRepo                  *self,
       /* Nothing for now... */
     }
 
-  ret = TRUE;
   ot_transfer_out_value (out_objects, &ret_objects);
- out:
+  return TRUE;
-  return ret;
 }
 
 /**
@@ -3720,25 +3653,20 @@ ostree_repo_read_commit (OstreeRepo   *self,
                          GCancellable *cancellable,
                          GError **error)
 {
-  gboolean ret = FALSE;
-  g_autoptr(GFile) ret_root = NULL;
   g_autofree char *resolved_commit = NULL;
-
   if (!ostree_repo_resolve_rev (self, ref, FALSE, &resolved_commit, error))
-    goto out;
+    return FALSE;
 
-  ret_root = (GFile*) _ostree_repo_file_new_for_commit (self, resolved_commit, error);
+  g_autoptr(GFile) ret_root = (GFile*) _ostree_repo_file_new_for_commit (self, resolved_commit, error);
   if (!ret_root)
-    goto out;
+    return FALSE;
 
   if (!ostree_repo_file_ensure_resolved ((OstreeRepoFile*)ret_root, error))
-    goto out;
+    return FALSE;
 
-  ret = TRUE;
   ot_transfer_out_value(out_root, &ret_root);
   ot_transfer_out_value(out_commit, &resolved_commit);
- out:
+  return TRUE;
-  return ret;
 }
 
 /**
@@ -4225,6 +4153,13 @@ out:
 
 /**
  * ostree_repo_sign_delta:
+ * @self: Self
+ * @from_commit: From commit
+ * @to_commit: To commit
+ * @key_id: key id
+ * @homedir: homedir
+ * @cancellable: cancellable
+ * @error: error
  *
  * This function is deprecated, sign the summary file instead.
  * Add a GPG signature to a static delta.
@@ -4859,7 +4794,6 @@ _ostree_repo_try_lock_tmpdir (int            tmpdir_dfd,
                               gboolean      *out_did_lock,
                               GError       **error)
 {
-  gboolean ret = FALSE;
   g_autofree char *lock_name = g_strconcat (tmpdir_name, "-lock", NULL);
   gboolean did_lock = FALSE;
   g_autoptr(GError) local_error = NULL;
@@ -4876,7 +4810,7 @@ _ostree_repo_try_lock_tmpdir (int            tmpdir_dfd,
       else
         {
           g_propagate_error (error, g_steal_pointer (&local_error));
-          goto out;
+          return FALSE;
         }
     }
   else
@@ -4884,10 +4818,8 @@ _ostree_repo_try_lock_tmpdir (int            tmpdir_dfd,
       did_lock = TRUE;
     }
 
-  ret = TRUE;
   *out_did_lock = did_lock;
- out:
+  return TRUE;
-  return ret;
 }
 
 /* This allocates and locks a subdir of the repo tmp dir, using an existing

src/libostree/ostree-repo.h

@@ -123,6 +123,10 @@ gboolean      ostree_repo_remote_delete (OstreeRepo     *self,
 /**
  * OstreeRepoRemoteChange:
  * The remote change operation.
+ * @OSTREE_REPO_REMOTE_CHANGE_ADD: Add a remote
+ * @OSTREE_REPO_REMOTE_CHANGE_ADD_IF_NOT_EXISTS: Like above, but do nothing if the remote exists
+ * @OSTREE_REPO_REMOTE_CHANGE_DELETE: Delete a remote
+ * @OSTREE_REPO_REMOTE_CHANGE_DELETE_IF_EXISTS: Delete a remote, do nothing if the remote does not exist
  */
 typedef enum {
   OSTREE_REPO_REMOTE_CHANGE_ADD,
@@ -536,11 +540,15 @@ typedef OstreeRepoCommitFilterResult (*OstreeRepoCommitFilter) (OstreeRepo    *r
  * @OSTREE_REPO_COMMIT_MODIFIER_FLAGS_NONE: No special flags
  * @OSTREE_REPO_COMMIT_MODIFIER_FLAGS_SKIP_XATTRS: Do not process extended attributes
  * @OSTREE_REPO_COMMIT_MODIFIER_FLAGS_GENERATE_SIZES: Generate size information.
+ * @OSTREE_REPO_COMMIT_MODIFIER_FLAGS_CANONICAL_PERMISSIONS: Canonicalize permissions for bare-user-only mode.
+ * @OSTREE_REPO_COMMIT_MODIFIER_FLAGS_ERROR_ON_UNLABELED: Emit an error if configured SELinux policy does not provide a label
  */
 typedef enum {
   OSTREE_REPO_COMMIT_MODIFIER_FLAGS_NONE = 0,
   OSTREE_REPO_COMMIT_MODIFIER_FLAGS_SKIP_XATTRS = (1 << 0),
-  OSTREE_REPO_COMMIT_MODIFIER_FLAGS_GENERATE_SIZES = (1 << 1)
+  OSTREE_REPO_COMMIT_MODIFIER_FLAGS_GENERATE_SIZES = (1 << 1),
+  OSTREE_REPO_COMMIT_MODIFIER_FLAGS_CANONICAL_PERMISSIONS = (1 << 2),
+  OSTREE_REPO_COMMIT_MODIFIER_FLAGS_ERROR_ON_UNLABELED = (1 << 3),
 } OstreeRepoCommitModifierFlags;
 
 /**

src/libostree/ostree-sepolicy-private.h

@@ -1,6 +1,6 @@
 /* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
  *
- * Copyright (C) 2011 Colin Walters <walters@verbum.org>.
+ * Copyright (C) 2017 Colin Walters <walters@verbum.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -16,18 +16,26 @@
  * License along with this library; if not, write to the
  * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
  * Boston, MA 02111-1307, USA.
- *
- * Author: Colin Walters <walters@verbum.org>
  */
 
 #pragma once
 
-#include <gio/gio.h>
+#include "ostree-types.h"
 
 G_BEGIN_DECLS
 
-GThreadPool * ot_thread_pool_new_nproc (GFunc     func,
+typedef struct {
-                                        gpointer  user_data);
+  gboolean initialized;
+} OstreeSepolicyFsCreatecon;
+
+void _ostree_sepolicy_fscreatecon_clear (OstreeSepolicyFsCreatecon *con);
+G_DEFINE_AUTO_CLEANUP_CLEAR_FUNC(OstreeSepolicyFsCreatecon, _ostree_sepolicy_fscreatecon_clear)
+
+gboolean _ostree_sepolicy_preparefscreatecon (OstreeSepolicyFsCreatecon *con,
+                                              OstreeSePolicy   *self,
+                                              const char       *path,
+                                              guint32           mode,
+                                              GError          **error);
 
 
 G_END_DECLS

src/libostree/ostree-sepolicy.c

@@ -28,6 +28,7 @@
 #include "otutil.h"
 
 #include "ostree-sepolicy.h"
+#include "ostree-sepolicy-private.h"
 #include "ostree-bootloader-uboot.h"
 #include "ostree-bootloader-syslinux.h"
 
@@ -42,6 +43,8 @@
 struct OstreeSePolicy {
   GObject parent;
 
+  int rootfs_dfd;
+  int rootfs_dfd_owned;
   GFile *path;
 
   gboolean runtime_enabled;
@@ -63,7 +66,8 @@ static void initable_iface_init       (GInitableIface      *initable_iface);
 enum {
   PROP_0,
 
-  PROP_PATH
+  PROP_PATH,
+  PROP_ROOTFS_DFD
 };
 
 G_DEFINE_TYPE_WITH_CODE (OstreeSePolicy, ostree_sepolicy, G_TYPE_OBJECT,
@@ -75,6 +79,8 @@ ostree_sepolicy_finalize (GObject *object)
   OstreeSePolicy *self = OSTREE_SEPOLICY (object);
 
   g_clear_object (&self->path);
+  if (self->rootfs_dfd_owned != -1)
+    (void) close (self->rootfs_dfd_owned);
 #ifdef HAVE_SELINUX
   g_clear_object (&self->selinux_policy_root);
   g_clear_pointer (&self->selinux_policy_name, g_free);
@@ -100,8 +106,25 @@ ostree_sepolicy_set_property(GObject         *object,
   switch (prop_id)
     {
     case PROP_PATH:
+      {
+        GFile *path = g_value_get_object (value);
+        if (path)
+          {
             /* Canonicalize */
-      self->path = g_file_new_for_path (gs_file_get_path_cached (g_value_get_object (value)));
+            self->path = g_file_new_for_path (gs_file_get_path_cached (path));
+            g_assert_cmpint (self->rootfs_dfd, ==, -1);
+          }
+      }
+      break;
+    case PROP_ROOTFS_DFD:
+      {
+        int fd = g_value_get_int (value);
+        if (fd != -1)
+          {
+            g_assert (self->path == NULL);
+            self->rootfs_dfd = fd;
+          }
+      }
       break;
     default:
       G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
@@ -122,6 +145,9 @@ ostree_sepolicy_get_property(GObject         *object,
     case PROP_PATH:
       g_value_set_object (value, self->path);
       break;
+    case PROP_ROOTFS_DFD:
+      g_value_set_int (value, self->rootfs_dfd);
+      break;
     default:
       G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
       break;
@@ -133,7 +159,7 @@ ostree_sepolicy_constructed (GObject *object)
 {
   OstreeSePolicy *self = OSTREE_SEPOLICY (object);
 
-  g_assert (self->path != NULL);
+  g_assert (self->path != NULL || self->rootfs_dfd != -1);
 
   G_OBJECT_CLASS (ostree_sepolicy_parent_class)->constructed (object);
 }
@@ -155,6 +181,13 @@ ostree_sepolicy_class_init (OstreeSePolicyClass *klass)
                                                         "",
                                                         G_TYPE_FILE,
                                                         G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));
+  g_object_class_install_property (object_class,
+                                   PROP_ROOTFS_DFD,
+                                   g_param_spec_int ("rootfs-dfd",
+                                                     "", "",
+                                                     -1, G_MAXINT, -1,
+                                                     G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));
+
 }
 
 #ifdef HAVE_SELINUX
@@ -252,6 +285,7 @@ initable_init (GInitable     *initable,
 #ifdef HAVE_SELINUX
   gboolean ret = FALSE;
   OstreeSePolicy *self = OSTREE_SEPOLICY (initable);
+  g_autoptr(GFile) path = NULL;
   g_autoptr(GFile) etc_selinux_dir = NULL;
   g_autoptr(GFile) policy_config_path = NULL;
   g_autoptr(GFile) policy_root = NULL;
@@ -262,11 +296,28 @@ initable_init (GInitable     *initable,
   const char *selinux_prefix = "SELINUX=";
   const char *selinuxtype_prefix = "SELINUXTYPE=";
 
-  etc_selinux_dir = g_file_resolve_relative_path (self->path, "etc/selinux");
+  /* TODO - use this below */
+  if (self->rootfs_dfd != -1)
+    path = ot_fdrel_to_gfile (self->rootfs_dfd, ".");
+  else if (self->path)
+    {
+      path = g_object_ref (self->path);
+#if 0
+      /* TODO - use this below */
+      if (!glnx_opendirat (AT_FDCWD, gs_file_get_path_cached (self->path), TRUE,
+                           &self->rootfs_dfd_owned, error))
+        goto out;
+      self->rootfs_dfd = self->rootfs_dfd_owned;
+#endif
+    }
+  else
+    g_assert_not_reached ();
+
+  etc_selinux_dir = g_file_resolve_relative_path (path, "etc/selinux");
   if (!g_file_query_exists (etc_selinux_dir, NULL))
     {
       g_object_unref (etc_selinux_dir);
-      etc_selinux_dir = g_file_resolve_relative_path (self->path, "usr/etc/selinux");
+      etc_selinux_dir = g_file_resolve_relative_path (path, "usr/etc/selinux");
     }
   policy_config_path = g_file_get_child (etc_selinux_dir, "config");
 
@@ -367,6 +418,8 @@ initable_init (GInitable     *initable,
 static void
 ostree_sepolicy_init (OstreeSePolicy *self)
 {
+  self->rootfs_dfd = -1;
+  self->rootfs_dfd_owned = -1;
 }
 
 static void
@@ -378,6 +431,8 @@ initable_iface_init (GInitableIface *initable_iface)
 /**
  * ostree_sepolicy_new:
  * @path: Path to a root directory
+ * @cancellable: Cancellable
+ * @error: Error
  *
  * Returns: (transfer full): An accessor object for SELinux policy in root located at @path
  */
@@ -389,6 +444,22 @@ ostree_sepolicy_new (GFile         *path,
   return g_initable_new (OSTREE_TYPE_SEPOLICY, cancellable, error, "path", path, NULL);
 }
 
+/**
+ * ostree_sepolicy_new_at:
+ * @rootfs_dfd: Directory fd for rootfs (will not be cloned)
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Returns: (transfer full): An accessor object for SELinux policy in root located at @rootfs_dfd
+ */
+OstreeSePolicy*
+ostree_sepolicy_new_at (int         rootfs_dfd,
+                        GCancellable  *cancellable,
+                        GError       **error)
+{
+  return g_initable_new (OSTREE_TYPE_SEPOLICY, cancellable, error, "rootfs-dfd", rootfs_dfd, NULL);
+}
+
 /**
  * ostree_sepolicy_get_path:
  * @self:
@@ -455,20 +526,24 @@ ostree_sepolicy_get_label (OstreeSePolicy    *self,
                            GError          **error)
 {
 #ifdef HAVE_SELINUX
-  gboolean ret = FALSE;
+  /* Early return if no policy */
-  int res;
+  if (!self->selinux_hnd)
-  char *con = NULL;
+    return TRUE;
 
-  if (self->selinux_hnd)
+  /* http://marc.info/?l=selinux&m=149082134430052&w=2
-    {
+   * https://github.com/ostreedev/ostree/pull/768
-      res = selabel_lookup_raw (self->selinux_hnd, &con, relpath, unix_mode);
+   */
+  if (strcmp (relpath, "/proc") == 0)
+    relpath = "/mnt";
+
+  char *con = NULL;
+  int res = selabel_lookup_raw (self->selinux_hnd, &con, relpath, unix_mode);
   if (res != 0)
     {
-          if (errno != ENOENT)
+      if (errno == ENOENT)
-            {
+        *out_label = NULL;
-              glnx_set_error_from_errno (error);
+      else
-              goto out;
+        return glnx_throw_errno (error);
-            }
     }
   else
     {
@@ -476,14 +551,9 @@ ostree_sepolicy_get_label (OstreeSePolicy    *self,
       *out_label = g_strdup (con);
       freecon (con);
     }
-    }
 
-  ret = TRUE;
- out:
-  return ret;
-#else
-  return TRUE;
 #endif
+  return TRUE;
 }
 
 /**
@@ -621,6 +691,7 @@ ostree_sepolicy_setfscreatecon (OstreeSePolicy   *self,
 
 /**
  * ostree_sepolicy_fscreatecon_cleanup:
+ * @unused: Not used, just in case you didn't infer that from the parameter name
  *
  * Cleanup function for ostree_sepolicy_setfscreatecon().
  */
@@ -631,3 +702,31 @@ ostree_sepolicy_fscreatecon_cleanup (void **unused)
   setfscreatecon (NULL);
 #endif
 }
+
+/* Currently private copy of the older sepolicy/fscreatecon API with a nicer
+ * g_auto() cleanup. May be made public later.
+ */
+gboolean
+_ostree_sepolicy_preparefscreatecon (OstreeSepolicyFsCreatecon *con,
+                                     OstreeSePolicy   *self,
+                                     const char       *path,
+                                     guint32           mode,
+                                     GError          **error)
+{
+  if (!self || ostree_sepolicy_get_name (self) == NULL)
+    return TRUE;
+
+  if (!ostree_sepolicy_setfscreatecon (self, path, mode, error))
+    return FALSE;
+
+  con->initialized = TRUE;
+  return TRUE;
+}
+
+void
+_ostree_sepolicy_fscreatecon_clear (OstreeSepolicyFsCreatecon *con)
+{
+  if (!con->initialized)
+    return;
+  ostree_sepolicy_fscreatecon_cleanup (NULL);
+}

src/libostree/ostree-sepolicy.h

@@ -38,6 +38,12 @@ OstreeSePolicy* ostree_sepolicy_new (GFile         *path,
                                      GCancellable  *cancellable,
                                      GError       **error);
 
+_OSTREE_PUBLIC
+OstreeSePolicy* ostree_sepolicy_new_at (int            rootfs_dfd,
+                                        GCancellable  *cancellable,
+                                        GError       **error);
+
+
 _OSTREE_PUBLIC
 GFile * ostree_sepolicy_get_path (OstreeSePolicy  *self);
 

src/libostree/ostree-sysroot-cleanup.c

@@ -515,12 +515,7 @@ ostree_sysroot_cleanup (OstreeSysroot       *self,
                         GCancellable        *cancellable,
                         GError             **error)
 {
-  OstreeSysrootCleanupFlags flags;
+  return _ostree_sysroot_cleanup_internal (self, TRUE, cancellable, error);
-
-  /* Do everything. */
-  flags = OSTREE_SYSROOT_CLEANUP_ALL;
-
-  return _ostree_sysroot_piecemeal_cleanup (self, flags, cancellable, error);
 }
 
 /**
@@ -537,55 +532,41 @@ ostree_sysroot_prepare_cleanup (OstreeSysroot  *self,
                                 GCancellable   *cancellable,
                                 GError        **error)
 {
-  OstreeSysrootCleanupFlags flags;
+  return _ostree_sysroot_cleanup_internal (self, FALSE, cancellable, error);
-
-  /* Do everything EXCEPT pruning the repository. */
-  flags = OSTREE_SYSROOT_CLEANUP_ALL & ~OSTREE_SYSROOT_CLEANUP_PRUNE_REPO;
-
-  return _ostree_sysroot_piecemeal_cleanup (self, flags, cancellable, error);
 }
 
 gboolean
-_ostree_sysroot_piecemeal_cleanup (OstreeSysroot              *self,
+_ostree_sysroot_cleanup_internal (OstreeSysroot              *self,
-                                   OstreeSysrootCleanupFlags   flags,
+                                  gboolean                    do_prune_repo,
                                   GCancellable               *cancellable,
                                   GError                    **error)
 {
-  gboolean ret = FALSE;
   glnx_unref_object OstreeRepo *repo = NULL;
 
   g_return_val_if_fail (OSTREE_IS_SYSROOT (self), FALSE);
   g_return_val_if_fail (self->loaded, FALSE);
 
-  if (flags & OSTREE_SYSROOT_CLEANUP_BOOTVERSIONS)
-    {
   if (!cleanup_other_bootversions (self, cancellable, error))
-        goto out;
+    return FALSE;
-    }
 
-  if (flags & OSTREE_SYSROOT_CLEANUP_DEPLOYMENTS)
-    {
   if (!cleanup_old_deployments (self, cancellable, error))
-        goto out;
+    return FALSE;
-    }
 
   if (!ostree_sysroot_get_repo (self, &repo, cancellable, error))
-    goto out;
+    return FALSE;
 
   if (!generate_deployment_refs (self, repo,
                                  self->bootversion,
                                  self->subbootversion,
                                  self->deployments,
                                  cancellable, error))
-    goto out;
+    return FALSE;
 
-  if (flags & OSTREE_SYSROOT_CLEANUP_PRUNE_REPO)
+  if (do_prune_repo)
     {
       if (!prune_repo (repo, cancellable, error))
-            goto out;
+        return FALSE;
     }
 
-  ret = TRUE;
+  return TRUE;
- out:
-  return ret;
 }

src/libostree/ostree-sysroot-private.h

@@ -30,7 +30,9 @@ G_BEGIN_DECLS
 typedef enum {
 
   /* Don't flag deployments as immutable. */
-  OSTREE_SYSROOT_DEBUG_MUTABLE_DEPLOYMENTS = 1 << 0
+  OSTREE_SYSROOT_DEBUG_MUTABLE_DEPLOYMENTS = 1 << 0,
+  /* See https://github.com/ostreedev/ostree/pull/759 */
+  OSTREE_SYSROOT_DEBUG_NO_XATTRS = 1 << 1,
 
 } OstreeSysrootDebugFlags;
 
@@ -47,8 +49,6 @@ struct OstreeSysroot {
 
   gboolean loaded;
   
-  OstreeSePolicy *sepolicy;
-  
   GPtrArray *deployments;
   int bootversion;
   int subbootversion;
@@ -109,21 +109,8 @@ gboolean _ostree_sysroot_query_bootloader (OstreeSysroot     *sysroot,
 gboolean _ostree_sysroot_bump_mtime (OstreeSysroot *sysroot,
                                      GError       **error);
 
-typedef enum {
+gboolean _ostree_sysroot_cleanup_internal (OstreeSysroot *sysroot,
-  OSTREE_SYSROOT_CLEANUP_BOOTVERSIONS = 1 << 0,
+                                           gboolean       prune_repo,
-  OSTREE_SYSROOT_CLEANUP_DEPLOYMENTS  = 1 << 1,
-  OSTREE_SYSROOT_CLEANUP_PRUNE_REPO   = 1 << 2,
-  OSTREE_SYSROOT_CLEANUP_ALL          = 0xffff
-} OstreeSysrootCleanupFlags;
-
-gboolean _ostree_sysroot_piecemeal_cleanup (OstreeSysroot *sysroot,
-                                            OstreeSysrootCleanupFlags flags,
-                                            GCancellable *cancellable,
-                                            GError **error);
-
-gboolean _ostree_sysroot_write_deployments_internal (OstreeSysroot     *self,
-                                                     GPtrArray         *new_deployments,
-                                                     OstreeSysrootCleanupFlags cleanup_flags,
                                            GCancellable  *cancellable,
                                            GError       **error);
 

src/libostree/ostree-sysroot-upgrader.c

@@ -293,6 +293,8 @@ ostree_sysroot_upgrader_init (OstreeSysrootUpgrader *self)
 /**
  * ostree_sysroot_upgrader_new:
  * @sysroot: An #OstreeSysroot
+ * @cancellable: Cancellable
+ * @error: Error
  *
  * Returns: (transfer full): An upgrader
  */
@@ -309,6 +311,8 @@ ostree_sysroot_upgrader_new (OstreeSysroot *sysroot,
  * ostree_sysroot_upgrader_new_for_os:
  * @sysroot: An #OstreeSysroot
  * @osname: (allow-none): Operating system name
+ * @cancellable: Cancellable
+ * @error: Error
  *
  * Returns: (transfer full): An upgrader
  */
@@ -327,6 +331,8 @@ ostree_sysroot_upgrader_new_for_os (OstreeSysroot *sysroot,
  * @sysroot: An #OstreeSysroot
  * @osname: (allow-none): Operating system name
  * @flags: Flags
+ * @cancellable: Cancellable
+ * @error: Error
  *
  * Returns: (transfer full): An upgrader
  */
@@ -514,6 +520,14 @@ ostree_sysroot_upgrader_pull (OstreeSysrootUpgrader  *self,
 
 /**
  * ostree_sysroot_upgrader_pull_one_dir:
+ * @self: Upgrader
+ * @dir_to_pull: Subdirectory path (should include a leading /)
+ * @flags: Flags controlling pull behavior
+ * @upgrader_flags: Flags controlling upgrader behavior
+ * @progress: (allow-none): Progress
+ * @out_changed: (out): Whether or not the origin changed
+ * @cancellable: Cancellable
+ * @error: Error
  *
  * Like ostree_sysroot_upgrader_pull(), but allows retrieving just a
  * subpath of the tree.  This can be used to download metadata files

src/libostree/ostree-sysroot.c

@@ -21,10 +21,12 @@
 #include "config.h"
 
 #include "otutil.h"
+#include <sys/file.h>
 #include <sys/mount.h>
 #include <sys/wait.h>
 
 #include "ostree-core-private.h"
+#include "ostree-sepolicy-private.h"
 #include "ostree-sysroot-private.h"
 #include "ostree-deployment-private.h"
 #include "ostree-bootloader-uboot.h"
@@ -70,7 +72,6 @@ ostree_sysroot_finalize (GObject *object)
   OstreeSysroot *self = OSTREE_SYSROOT (object);
 
   g_clear_object (&self->path);
-  g_clear_object (&self->sepolicy);
   g_clear_object (&self->repo);
   g_clear_pointer (&self->deployments, g_ptr_array_unref);
   g_clear_object (&self->booted_deployment);
@@ -160,6 +161,7 @@ ostree_sysroot_init (OstreeSysroot *self)
 {
   const GDebugKey keys[] = {
     { "mutable-deployments", OSTREE_SYSROOT_DEBUG_MUTABLE_DEPLOYMENTS },
+    { "no-xattrs", OSTREE_SYSROOT_DEBUG_NO_XATTRS },
   };
 
   self->debug_flags = g_parse_debug_string (g_getenv ("OSTREE_SYSROOT_DEBUG"),
@@ -1268,12 +1270,13 @@ ostree_sysroot_get_merge_deployment (OstreeSysroot     *self,
 
 /**
  * ostree_sysroot_origin_new_from_refspec:
+ * @self: Sysroot
  * @refspec: A refspec
  *
  * Returns: (transfer full): A new config file which sets @refspec as an origin
  */
 GKeyFile *
-ostree_sysroot_origin_new_from_refspec (OstreeSysroot  *sysroot,
+ostree_sysroot_origin_new_from_refspec (OstreeSysroot  *self,
                                         const char     *refspec)
 {
   GKeyFile *ret = g_key_file_new ();
@@ -1551,6 +1554,7 @@ ostree_sysroot_simple_write_deployment (OstreeSysroot      *sysroot,
   g_autoptr(GPtrArray) deployments = NULL;
   g_autoptr(GPtrArray) new_deployments = g_ptr_array_new_with_free_func (g_object_unref);
   const gboolean postclean = (flags & OSTREE_SYSROOT_SIMPLE_WRITE_DEPLOYMENT_FLAGS_NO_CLEAN) == 0;
+  OstreeSysrootWriteDeploymentsOpts write_opts = { .do_postclean = postclean };
   gboolean retain = (flags & OSTREE_SYSROOT_SIMPLE_WRITE_DEPLOYMENT_FLAGS_RETAIN) > 0;
   const gboolean make_default = !((flags & OSTREE_SYSROOT_SIMPLE_WRITE_DEPLOYMENT_FLAGS_NOT_DEFAULT) > 0);
   gboolean added_new = FALSE;
@@ -1601,8 +1605,7 @@ ostree_sysroot_simple_write_deployment (OstreeSysroot      *sysroot,
       added_new = TRUE;
     }
 
-  if (!_ostree_sysroot_write_deployments_internal (sysroot, new_deployments,
+  if (!ostree_sysroot_write_deployments_with_options (sysroot, new_deployments, &write_opts,
-                                                   postclean ? OSTREE_SYSROOT_CLEANUP_ALL : 0,
                                                       cancellable, error))
     goto out;
 
@@ -1688,6 +1691,7 @@ ostree_sysroot_deployment_unlock (OstreeSysroot     *self,
                                   GError           **error)
 {
   gboolean ret = FALSE;
+  glnx_unref_object OstreeSePolicy *sepolicy = NULL;
   OstreeDeploymentUnlockedState current_unlocked =
     ostree_deployment_get_unlocked (deployment); 
   glnx_unref_object OstreeDeployment *deployment_clone =
@@ -1735,6 +1739,10 @@ ostree_sysroot_deployment_unlock (OstreeSysroot     *self,
   if (!glnx_opendirat (self->sysroot_fd, deployment_path, TRUE, &deployment_dfd, error))
     goto out;
 
+  sepolicy = ostree_sepolicy_new_at (deployment_dfd, cancellable, error);
+  if (!sepolicy)
+    goto out;
+
   switch (unlocked_state)
     {
     case OSTREE_DEPLOYMENT_UNLOCKED_NONE:
@@ -1762,9 +1770,17 @@ ostree_sysroot_deployment_unlock (OstreeSysroot     *self,
         const char *development_ovl_upper;
         const char *development_ovl_work;
 
-        if (!glnx_mkdtempat (AT_FDCWD, development_ovldir, 0700, error))
+        /* Ensure that the directory is created with the same label as `/usr` */
+        { g_auto(OstreeSepolicyFsCreatecon) con = { 0, };
+
+          if (!_ostree_sepolicy_preparefscreatecon (&con, sepolicy,
+                                                    "/usr", 0755, error))
             goto out;
 
+          if (!glnx_mkdtempat (AT_FDCWD, development_ovldir, 0755, error))
+            goto out;
+        }
+
         development_ovl_upper = glnx_strjoina (development_ovldir, "/upper");
         if (!glnx_shutil_mkdir_p_at (AT_FDCWD, development_ovl_upper, 0755, cancellable, error))
           goto out;

src/libostree/ostree-sysroot.h

@@ -145,6 +145,20 @@ gboolean ostree_sysroot_write_deployments (OstreeSysroot     *self,
                                            GCancellable      *cancellable,
                                            GError           **error);
 
+typedef struct {
+  gboolean do_postclean;
+  gboolean unused_bools[7];
+  int unused_ints[7];
+  gpointer unused_ptrs[7];
+} OstreeSysrootWriteDeploymentsOpts;
+
+_OSTREE_PUBLIC
+gboolean ostree_sysroot_write_deployments_with_options (OstreeSysroot     *self,
+                                                        GPtrArray         *new_deployments,
+                                                        OstreeSysrootWriteDeploymentsOpts *opts,
+                                                        GCancellable      *cancellable,
+                                                        GError           **error);
+
 _OSTREE_PUBLIC
 gboolean ostree_sysroot_deploy_tree (OstreeSysroot     *self,
                                      const char        *osname,