New upstream version 2021.6

src/libostree/ostree-deployment.c

@@ -374,9 +374,9 @@ ostree_deployment_new (int    index,
   OstreeDeployment *self;
 
   /* index may be -1 */
-  g_return_val_if_fail (osname != NULL, NULL);
-  g_return_val_if_fail (csum != NULL, NULL);
-  g_return_val_if_fail (deployserial >= 0, NULL);
+  g_assert (osname != NULL);
+  g_assert (csum != NULL);
+  g_assert (deployserial >= 0);
   /* We can have "disconnected" deployments that don't have a
      bootcsum/serial */
 

src/libostree/ostree-fetcher-soup.c

@@ -35,7 +35,7 @@
 #include "ostree-fetcher.h"
 #include "ostree-fetcher-util.h"
 #ifdef HAVE_LIBSOUP_CLIENT_CERTS
-#include "ostree-tls-cert-interaction.h"
+#include "ostree-tls-cert-interaction-private.h"
 #endif
 #include "ostree-enumtypes.h"
 #include "ostree.h"
@@ -183,7 +183,7 @@ static OstreeFetcherPendingURI *
 pending_uri_ref (OstreeFetcherPendingURI *pending)
 {
   gint refcount;
-  g_return_val_if_fail (pending != NULL, NULL);
+  g_assert (pending);
   refcount = g_atomic_int_add (&pending->ref_count, 1);
   g_assert (refcount > 0);
   return pending;

src/libostree/ostree-remote.c

@@ -65,8 +65,8 @@ ostree_remote_new_dynamic (const gchar *name,
 {
   OstreeRemote *remote;
 
-  g_return_val_if_fail (name != NULL && *name != '\0', NULL);
-  g_return_val_if_fail (refspec_name == NULL || *refspec_name != '\0', NULL);
+  g_assert (name != NULL && *name != '\0');
+  g_assert (refspec_name == NULL || *refspec_name != '\0');
 
   remote = g_slice_new0 (OstreeRemote);
   remote->ref_count = 1;

src/libostree/ostree-repo-checkout.c

@@ -1389,7 +1389,7 @@ ostree_repo_checkout_at (OstreeRepo                        *self,
   g_autoptr(GFile) target_dir = NULL;
 
   if (strcmp (options->subpath, "/") != 0)
-    target_dir = g_file_get_child (commit_root, options->subpath);
+    target_dir = g_file_resolve_relative_path (commit_root, options->subpath);
   else
     target_dir = g_object_ref (commit_root);
   g_autoptr(GFileInfo) target_info =

src/libostree/ostree-repo-private.h

@@ -525,6 +525,7 @@ _ostree_repo_verify_bindings (const char  *collection_id,
  */
 typedef struct
 {
+  gint atomic_refcount;
   OstreeRepo *repo;
 } OstreeRepoAutoTransaction;
 
@@ -544,9 +545,14 @@ _ostree_repo_auto_transaction_commit (OstreeRepoAutoTransaction  *txn,
                                       GCancellable               *cancellable,
                                       GError                    **error);
 
-void
-_ostree_repo_auto_transaction_cleanup (void *p);
+OstreeRepoAutoTransaction *
+_ostree_repo_auto_transaction_ref (OstreeRepoAutoTransaction *txn);
 
-G_DEFINE_AUTOPTR_CLEANUP_FUNC (OstreeRepoAutoTransaction, _ostree_repo_auto_transaction_cleanup);
+void
+_ostree_repo_auto_transaction_unref (OstreeRepoAutoTransaction *txn);
+
+GType _ostree_repo_auto_transaction_get_type (void);
+
+G_DEFINE_AUTOPTR_CLEANUP_FUNC (OstreeRepoAutoTransaction, _ostree_repo_auto_transaction_unref);
 
 G_END_DECLS

src/libostree/ostree-repo-prune.c

@@ -39,17 +39,17 @@ typedef struct {
 } OtPruneData;
 
 static gboolean
-maybe_prune_loose_object (OtPruneData        *data,
-                          OstreeRepoPruneFlags    flags,
-                          const char         *checksum,
-                          OstreeObjectType    objtype,
-                          GCancellable       *cancellable,
-                          GError            **error)
+maybe_prune_loose_object (OtPruneData           *data,
+                          OstreeRepoPruneFlags   flags,
+                          GVariant              *key,
+                          GCancellable          *cancellable,
+                          GError               **error)
 {
   gboolean reachable = FALSE;
-  g_autoptr(GVariant) key = NULL;
+  const char *checksum;
+  OstreeObjectType objtype;
 
-  key = ostree_object_name_serialize (checksum, objtype);
+  ostree_object_name_deserialize (key, &checksum, &objtype);
 
   if (g_hash_table_lookup_extended (data->reachable, key, NULL, NULL))
     reachable = TRUE;
@@ -276,17 +276,14 @@ repo_prune_internal (OstreeRepo        *self,
 
   GLNX_HASH_TABLE_FOREACH_KV (objects, GVariant*, serialized_key, GVariant*, objdata)
     {
-      const char *checksum;
-      OstreeObjectType objtype;
       gboolean is_loose;
 
-      ostree_object_name_deserialize (serialized_key, &checksum, &objtype);
       g_variant_get_child (objdata, 0, "b", &is_loose);
 
       if (!is_loose)
         continue;
 
-      if (!maybe_prune_loose_object (&data, options->flags, checksum, objtype,
+      if (!maybe_prune_loose_object (&data, options->flags, serialized_key,
                                      cancellable, error))
         return FALSE;
     }

src/libostree/ostree-repo-static-delta-core.c

@@ -457,9 +457,15 @@ ostree_repo_static_delta_execute_offline_with_signature (OstreeRepo   *self,
 
       if (sign)
         {
-          verified = _ostree_repo_static_delta_verify_signature (self, meta_fd, sign, NULL, error);
-          if (*error)
-            return FALSE;
+          g_autoptr(GError) local_error = NULL;
+
+          verified = _ostree_repo_static_delta_verify_signature (self, meta_fd, sign, NULL, &local_error);
+          if (local_error != NULL)
+            {
+              g_propagate_error (error, g_steal_pointer (&local_error));
+              return FALSE;
+            }
+
           if (!verified)
             return glnx_throw (error, "Delta signature verification failed");
         }

src/libostree/ostree-repo.c

@@ -711,10 +711,9 @@ ostree_repo_auto_lock_cleanup (OstreeRepoAutoLock *auto_lock)
     }
 }
 
-
 /**
  * _ostree_repo_auto_transaction_start:
- * @repo: an #OsreeRepo object
+ * @repo: (not nullable): an #OsreeRepo object
  * @cancellable: Cancellable
  * @error: a #GError
  *
@@ -734,6 +733,7 @@ _ostree_repo_auto_transaction_start (OstreeRepo     *repo,
     return NULL;
 
   OstreeRepoAutoTransaction *txn = g_malloc(sizeof(OstreeRepoAutoTransaction));
+  txn->atomic_refcount = 1;
   txn->repo = g_object_ref (repo);
 
   return g_steal_pointer (&txn);
@@ -741,7 +741,7 @@ _ostree_repo_auto_transaction_start (OstreeRepo     *repo,
 
 /**
  * _ostree_repo_auto_transaction_abort:
- * @txn: an #OsreeRepoAutoTransaction guard
+ * @txn: (not nullable): an #OsreeRepoAutoTransaction guard
  * @cancellable: Cancellable
  * @error: a #GError
  *
@@ -770,7 +770,8 @@ _ostree_repo_auto_transaction_abort (OstreeRepoAutoTransaction  *txn,
 
 /**
  * _ostree_repo_auto_transaction_commit:
- * @txn: an #OsreeRepoAutoTransaction guard
+ * @txn: (not nullable): an #OsreeRepoAutoTransaction guard
+ * @out_stats: (out) (allow-none): transaction result statistics
  * @cancellable: Cancellable
  * @error: a #GError
  *
@@ -799,30 +800,58 @@ _ostree_repo_auto_transaction_commit (OstreeRepoAutoTransaction  *txn,
 }
 
 /**
- * _ostree_repo_auto_transaction_cleanup:
- * @p: pointer to an #OsreeRepoAutoTransaction guard
+ * _ostree_repo_auto_transaction_ref:
+ * @txn: (not nullable): an #OsreeRepoAutoTransaction guard
  *
- * Destroy a transaction guard. If the transaction has not yet been completed,
- * it gets aborted.
+ * Return a new reference to the transaction guard.
+ *
+ * Returns: (transfer full) (not nullable): new transaction guard reference.
+ */
+OstreeRepoAutoTransaction *
+_ostree_repo_auto_transaction_ref (OstreeRepoAutoTransaction *txn)
+{
+  g_assert (txn != NULL);
+
+  gint refcount = g_atomic_int_add (&txn->atomic_refcount, 1);
+  g_assert (refcount > 1);
+
+  return txn;
+}
+
+/**
+ * _ostree_repo_auto_transaction_unref:
+ * @txn: (transfer full): an #OsreeRepoAutoTransaction guard
+ *
+ * Unreference a transaction guard. When the last reference is gone,
+ * if the transaction has not yet been completed, it gets aborted.
  */
 void
-_ostree_repo_auto_transaction_cleanup (void *p)
+_ostree_repo_auto_transaction_unref (OstreeRepoAutoTransaction *txn)
 {
-  if (p == NULL)
+  if (txn == NULL)
+    return;
+
+  if (!g_atomic_int_dec_and_test (&txn->atomic_refcount))
     return;
 
-  OstreeRepoAutoTransaction *txn = p;
   // Auto-abort only if transaction has not already been aborted/committed.
   if (txn->repo != NULL)
     {
       g_autoptr(GError) error = NULL;
-      if (!_ostree_repo_auto_transaction_abort (txn, NULL, &error)) {
+      if (!ostree_repo_abort_transaction (txn->repo, NULL, &error))
         g_warning("Failed to auto-cleanup OSTree transaction: %s", error->message);
-        g_clear_object (&txn->repo);
-      }
+
+      g_clear_object (&txn->repo);
     }
+
+  g_free (txn);
+  return;
 }
 
+G_DEFINE_BOXED_TYPE(OstreeRepoAutoTransaction, _ostree_repo_auto_transaction,
+                    _ostree_repo_auto_transaction_ref,
+                    _ostree_repo_auto_transaction_unref);
+
 static GFile *
 get_remotes_d_dir (OstreeRepo          *self,
                    GFile               *sysroot);

src/libostree/ostree-sign-ed25519.c

@@ -487,12 +487,16 @@ _load_pk_from_stream (OstreeSign *self,
   while (TRUE)
     {
       gsize len = 0;
-      g_autofree char *line = g_data_input_stream_read_line (key_data_in, &len, NULL, error);
       g_autoptr (GVariant) pk = NULL;
       gboolean added = FALSE;
+      g_autoptr(GError) local_error = NULL;
+      g_autofree char *line = g_data_input_stream_read_line (key_data_in, &len, NULL, &local_error);
 
-      if (*error != NULL)
-        return FALSE;
+      if (local_error != NULL)
+        {
+          g_propagate_error (error, g_steal_pointer (&local_error));
+          return FALSE;
+        }
 
       if (line == NULL)
         return ret;

src/libostree/ostree-sysroot.c

@@ -1235,12 +1235,15 @@ ostree_sysroot_get_subbootversion (OstreeSysroot   *self)
  * ostree_sysroot_get_booted_deployment:
  * @self: Sysroot
  *
+ * This function may only be called if the sysroot is loaded.
+ *
  * Returns: (transfer none) (nullable): The currently booted deployment, or %NULL if none
  */
 OstreeDeployment *
 ostree_sysroot_get_booted_deployment (OstreeSysroot       *self)
 {
-  g_return_val_if_fail (self->loadstate == OSTREE_SYSROOT_LOAD_STATE_LOADED, NULL);
+  g_assert (self);
+  g_assert (self->loadstate == OSTREE_SYSROOT_LOAD_STATE_LOADED);
 
   return self->booted_deployment;
 }
@@ -1390,7 +1393,8 @@ ostree_sysroot_get_repo (OstreeSysroot         *self,
 OstreeRepo *
 ostree_sysroot_repo (OstreeSysroot *self)
 {
-  g_return_val_if_fail (self->loadstate >= OSTREE_SYSROOT_LOAD_STATE_LOADED, NULL);
+  g_assert (self);
+  g_assert (self->loadstate >= OSTREE_SYSROOT_LOAD_STATE_LOADED);
   g_assert (self->repo);
   return self->repo;
 }

src/libostree/ostree-tls-cert-interaction.c

@@ -19,7 +19,7 @@
 
 #include "config.h"
 
-#include "ostree-tls-cert-interaction.h"
+#include "ostree-tls-cert-interaction-private.h"
 
 struct _OstreeTlsCertInteraction
 {

src/libostree/ostree-version.h

@@ -43,7 +43,7 @@
  *
  * Since: 2017.4
  */
-#define OSTREE_RELEASE_VERSION (5)
+#define OSTREE_RELEASE_VERSION (6)
 
 /**
  * OSTREE_VERSION
@@ -52,7 +52,7 @@
  *
  * Since: 2017.4
  */
-#define OSTREE_VERSION (2021.5)
+#define OSTREE_VERSION (2021.6)
 
 /**
  * OSTREE_VERSION_S:
@@ -62,7 +62,7 @@
  *
  * Since: 2017.4
  */
-#define OSTREE_VERSION_S "2021.5"
+#define OSTREE_VERSION_S "2021.6"
 
 #define OSTREE_ENCODE_VERSION(year,release) \
         ((year) << 16 | (release))
@@ -100,4 +100,4 @@
  *
  * Since: 2019.3
  */
-#define OSTREE_BUILT_FEATURES "libsoup gpgme ex-fsverity libarchive selinux libmount systemd release p2p"
+#define OSTREE_BUILT_FEATURES "libsoup gpgme ex-fsverity libarchive selinux avahi libmount systemd release p2p"

src/libotutil/ot-gio-utils.c

@@ -82,10 +82,13 @@ ot_gfile_ensure_unlinked (GFile         *path,
                           GCancellable  *cancellable,
                           GError       **error)
 {
-  if (unlink (gs_file_get_path_cached (path)) != 0)
+  g_assert (path);
+  const char *pathc = gs_file_get_path_cached (path);
+  g_assert (pathc);
+  if (unlink (pathc) != 0)
     {
       if (errno != ENOENT)
-        return glnx_throw_errno_prefix (error, "unlink(%s)", gs_file_get_path_cached (path));
+        return glnx_throw_errno_prefix (error, "unlink(%s)", pathc);
     }
   return TRUE;
 }

src/libotutil/ot-variant-builder.c

@@ -909,6 +909,7 @@ ot_variant_builder_pre_add (OtVariantBuilderInfo *info,
       const GVariantMemberInfo *member_info;
 
       member_info = g_variant_type_info_member_info (info->type_info, info->n_children);
+      g_assert (member_info);
       alignment = member_info->type_info->alignment;
     }
   else if (g_variant_type_is_array (info->type))
@@ -959,6 +960,7 @@ ot_variant_builder_post_add (OtVariantBuilderInfo *info,
       const GVariantMemberInfo *member_info;
 
       member_info = g_variant_type_info_member_info (info->type_info, info->n_children);
+      g_assert (member_info);
       if (member_info->ending_type == G_VARIANT_MEMBER_ENDING_OFFSET)
         ot_variant_builder_add_child_end (info);
     }
@@ -1085,16 +1087,13 @@ ot_variant_builder_open (OtVariantBuilder *builder,
   OtVariantBuilderInfo *info = builder->head;
   OtVariantBuilderInfo *new_info;
 
-  g_return_val_if_fail (info->n_children < info->max_items,
-                        FALSE);
-  g_return_val_if_fail (!info->expected_type ||
+  g_assert (info->n_children < info->max_items);
+  g_assert (!info->expected_type ||
                         g_variant_type_is_subtype_of (type,
-                                                      info->expected_type),
-                        FALSE);
-  g_return_val_if_fail (!info->prev_item_type ||
+                                                      info->expected_type));
+  g_assert (!info->prev_item_type ||
                         g_variant_type_is_subtype_of (info->prev_item_type,
-                                                      type),
-                        FALSE);
+                                                      type));
 
   if (!ot_variant_builder_pre_add (info, type, error))
     return FALSE;

src/ostree/ot-builtin-static-delta.c

@@ -669,7 +669,7 @@ ostree_builtin_static_delta (int argc, char **argv, OstreeCommandInvocation *inv
       return TRUE; /* Note early return */
     }
 
-  if (!command->fn)
+  if (!command || !command->fn)
     {
       static_delta_usage (argv, TRUE);
       return glnx_throw (error, "Unknown \"static-delta\" subcommand '%s'", cmdname);

src/ostree/ot-main.c

@@ -238,7 +238,7 @@ ostree_run (int    argc,
   return 0;
 }
 
-/* Process a --repo arg; used below, and for the remote builtins */
+/* Process a --repo arg. */
 static OstreeRepo *
 parse_repo_option (GOptionContext *context,
                    const char     *repo_path,
@@ -248,19 +248,6 @@ parse_repo_option (GOptionContext *context,
 {
   g_autoptr(OstreeRepo) repo = NULL;
 
-  /* This is a bit of a brutal hack; we set up a mount
-   * namespace if it appears that we may need it.  It'd
-   * be better to do this more precisely in the future.
-   */
-  gboolean setup_ns = FALSE;
-  if (!maybe_setup_mount_namespace (&setup_ns, error))
-    return FALSE;
-  if (setup_ns)
-    {
-      if (mount ("/sysroot", "/sysroot", NULL, MS_REMOUNT | MS_SILENT, NULL) < 0)
-        return glnx_null_throw_errno_prefix (error, "Remounting /sysroot read-write");
-    }
-
   if (repo_path == NULL)
     {
       g_autoptr(GError) local_error = NULL;
@@ -300,6 +287,43 @@ parse_repo_option (GOptionContext *context,
   return g_steal_pointer (&repo);
 }
 
+/* Process a --repo arg, determining if we should remount /sysroot; used below, and for the remote builtins */
+static OstreeRepo *
+parse_repo_option_and_maybe_remount (GOptionContext *context,
+                                     const char     *repo_path,
+                                     gboolean        skip_repo_open,
+                                     GCancellable   *cancellable,
+                                     GError        **error)
+{
+  g_autoptr(OstreeRepo) repo = parse_repo_option (context, repo_path, skip_repo_open, cancellable, error);
+  if (!repo)
+    return NULL;
+
+  /* This is a bit of a brutal hack; we set up a mount
+   * namespace if it appears that we may need it.  It'd
+   * be better to do this more precisely in the future.
+   */
+  if (ostree_repo_is_system (repo) && !ostree_repo_is_writable (repo, NULL))
+    {
+      gboolean setup_ns = FALSE;
+      if (!maybe_setup_mount_namespace (&setup_ns, error))
+        return FALSE;
+      if (setup_ns)
+        {
+          if (mount ("/sysroot", "/sysroot", NULL, MS_REMOUNT | MS_SILENT, NULL) < 0)
+            return glnx_null_throw_errno_prefix (error, "Remounting /sysroot read-write");
+
+          /* Reload the repo so it's actually writable. */
+          g_clear_pointer (&repo, g_object_unref);
+          repo = parse_repo_option (context, repo_path, skip_repo_open, cancellable, error);
+          if (!repo)
+            return NULL;
+        }
+    }
+
+  return g_steal_pointer (&repo);
+}
+
 /* Used by the remote builtins which are special in taking --sysroot or --repo */
 gboolean
 ostree_parse_sysroot_or_repo_option (GOptionContext *context,
@@ -323,7 +347,7 @@ ostree_parse_sysroot_or_repo_option (GOptionContext *context,
     }
   else
     {
-      repo = parse_repo_option (context, repo_path, FALSE, cancellable, error);
+      repo = parse_repo_option_and_maybe_remount (context, repo_path, FALSE, cancellable, error);
       if (!repo)
         return FALSE;
     }
@@ -424,8 +448,8 @@ ostree_option_context_parse (GOptionContext *context,
 
   if (!(flags & OSTREE_BUILTIN_FLAG_NO_REPO))
     {
-      repo = parse_repo_option (context, opt_repo, (flags & OSTREE_BUILTIN_FLAG_NO_CHECK) > 0,
-                                cancellable, error);
+      repo = parse_repo_option_and_maybe_remount (context, opt_repo, (flags & OSTREE_BUILTIN_FLAG_NO_CHECK) > 0,
+                                                  cancellable, error);
       if (!repo)
         return FALSE;
     }

src/switchroot/ostree-prepare-root.c

@@ -81,9 +81,6 @@
 
 #include "ostree-mount-util.h"
 
-/* Initialized early in main */
-static bool running_as_pid1;
-
 static inline bool
 sysroot_is_configured_ro (const char *sysroot)
 {
@@ -135,7 +132,8 @@ resolve_deploy_path (const char * root_mountpoint)
   if (!ostree_target)
     errx (EXIT_FAILURE, "No OSTree target; expected ostree=/ostree/boot.N/...");
 
-  snprintf (destpath, sizeof(destpath), "%s/%s", root_mountpoint, ostree_target);
+  if (snprintf (destpath, sizeof(destpath), "%s/%s", root_mountpoint, ostree_target) < 0)
+    err (EXIT_FAILURE, "failed to assemble ostree target path");
   if (lstat (destpath, &stbuf) < 0)
     err (EXIT_FAILURE, "Couldn't find specified OSTree root '%s'", destpath);
   if (!S_ISLNK (stbuf.st_mode))
@@ -168,6 +166,8 @@ pivot_root(const char * new_root, const char * put_old)
 int
 main(int argc, char *argv[])
 {
+  char srcpath[PATH_MAX];
+
   /* If we're pid 1, that means there's no initramfs; in this situation
    * various defaults change:
    *
@@ -175,7 +175,7 @@ main(int argc, char *argv[])
    * - Quiet logging as there's no journal
    * etc.
    */
-  running_as_pid1 = (getpid () == 1);
+  bool running_as_pid1 = (getpid () == 1);
 
   const char *root_arg = NULL;
   bool we_mounted_proc = false;
@@ -189,6 +189,10 @@ main(int argc, char *argv[])
         err (EXIT_FAILURE, "usage: ostree-prepare-root SYSROOT");
       root_arg = argv[1];
     }
+#ifdef USE_LIBSYSTEMD
+  sd_journal_send ("MESSAGE=preparing sysroot at %s", root_arg,
+                    NULL);
+#endif
 
   struct stat stbuf;
   if (stat ("/proc/cmdline", &stbuf) < 0)
@@ -197,7 +201,7 @@ main(int argc, char *argv[])
         err (EXIT_FAILURE, "stat(\"/proc/cmdline\") failed");
       /* We need /proc mounted for /proc/cmdline and realpath (on musl) to
        * work: */
-      if (mount ("proc", "/proc", "proc", 0, NULL) < 0)
+      if (mount ("proc", "/proc", "proc", MS_SILENT, NULL) < 0)
         err (EXIT_FAILURE, "failed to mount proc on /proc");
       we_mounted_proc = 1;
     }
@@ -214,17 +218,31 @@ main(int argc, char *argv[])
         err (EXIT_FAILURE, "failed to umount proc from /proc");
     }
 
+  /* Query the repository configuration - this is an operating system builder
+   * choice.  More info: https://github.com/ostreedev/ostree/pull/1767
+   */
+  const bool sysroot_readonly = sysroot_is_configured_ro (root_arg);
+  const bool sysroot_currently_writable = !path_is_on_readonly_fs (root_arg);
+#ifdef USE_LIBSYSTEMD
+  sd_journal_send ("MESSAGE=filesystem at %s currently writable: %d", root_arg,
+                   (int)sysroot_currently_writable,
+                   NULL);
+  sd_journal_send ("MESSAGE=sysroot.readonly configuration value: %d",
+                   (int)sysroot_readonly,
+                   NULL);
+#endif
+
   /* Work-around for a kernel bug: for some reason the kernel
    * refuses switching root if any file systems are mounted
    * MS_SHARED. Hence remount them MS_PRIVATE here as a
    * work-around.
    *
    * https://bugzilla.redhat.com/show_bug.cgi?id=847418 */
-  if (mount (NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) < 0)
+  if (mount (NULL, "/", NULL, MS_REC | MS_PRIVATE | MS_SILENT, NULL) < 0)
     err (EXIT_FAILURE, "failed to make \"/\" private mount");
 
   /* Make deploy_path a bind mount, so we can move it later */
-  if (mount (deploy_path, deploy_path, NULL, MS_BIND, NULL) < 0)
+  if (mount (deploy_path, deploy_path, NULL, MS_BIND | MS_SILENT, NULL) < 0)
     err (EXIT_FAILURE, "failed to make initial bind mount %s", deploy_path);
 
   /* chdir to our new root.  We need to do this after bind-mounting it over
@@ -233,26 +251,13 @@ main(int argc, char *argv[])
   if (chdir (deploy_path) < 0)
     err (EXIT_FAILURE, "failed to chdir to deploy_path");
 
-  /* Query the repository configuration - this is an operating system builder
-   * choice.  More info: https://github.com/ostreedev/ostree/pull/1767
-   */
-  const bool sysroot_readonly = sysroot_is_configured_ro (root_arg);
-  const bool sysroot_currently_writable = !path_is_on_readonly_fs (root_arg);
-
-#ifdef USE_LIBSYSTEMD
-      sd_journal_send ("MESSAGE=sysroot configured read-only: %d, currently writable: %d", 
-                      (int)sysroot_readonly, (int)sysroot_currently_writable, NULL);
-#endif
+  /* This will result in a system with /sysroot read-only. Thus, two additional
+   * writable bind-mounts (for /etc and /var) are required later on. */
   if (sysroot_readonly)
     {
       if (!sysroot_currently_writable)
-        errx (EXIT_FAILURE, "sysroot=readonly currently requires writable / in initramfs");
-      /* Now, /etc is not normally a bind mount, but if we have a readonly
-       * sysroot, we still need a writable /etc.  And to avoid race conditions
-       * we ensure it's writable in the initramfs, before we switchroot at all.
-       */
-      if (mount ("etc", "etc", NULL, MS_BIND, NULL) < 0)
-        err (EXIT_FAILURE, "failed to make /etc a bind mount");
+        errx (EXIT_FAILURE, "sysroot.readonly=true requires %s to be writable at this point",
+              root_arg);
       /* Pass on the fact that we discovered a readonly sysroot to ostree-remount.service */
       int fd = open (_OSTREE_SYSROOT_READONLY_STAMP, O_WRONLY | O_CREAT | O_CLOEXEC, 0644);
       if (fd < 0)
@@ -260,38 +265,39 @@ main(int argc, char *argv[])
       (void) close (fd);
     }
 
-  /* Default to true, but in the systemd case, default to false because it's handled by
-   * ostree-system-generator. */
-  bool mount_var = true;
-#ifdef HAVE_SYSTEMD_AND_LIBMOUNT
-  mount_var = false;
-#endif
-
-  /* file in /run can override the default behaviour so that we definitely mount /var */
-  if (lstat (INITRAMFS_MOUNT_VAR, &stbuf) == 0)
-    mount_var = true;
-
-  /* Link to the deployment's /var */
-  if (mount_var && mount ("../../var", "var", NULL, MS_BIND, NULL) < 0)
-    err (EXIT_FAILURE, "failed to bind mount ../../var to var");
-
-  char srcpath[PATH_MAX];
-  /* If /boot is on the same partition, use a bind mount to make it visible
+  /* Prepare /boot.
+   * If /boot is on the same partition, use a bind mount to make it visible
    * at /boot inside the deployment. */
-  snprintf (srcpath, sizeof(srcpath), "%s/boot/loader", root_mountpoint);
+  if (snprintf (srcpath, sizeof(srcpath), "%s/boot/loader", root_mountpoint) < 0)
+    err (EXIT_FAILURE, "failed to assemble /boot/loader path");
   if (lstat (srcpath, &stbuf) == 0 && S_ISLNK (stbuf.st_mode))
     {
       if (lstat ("boot", &stbuf) == 0 && S_ISDIR (stbuf.st_mode))
         {
-          snprintf (srcpath, sizeof(srcpath), "%s/boot", root_mountpoint);
-          if (mount (srcpath, "boot", NULL, MS_BIND, NULL) < 0)
+          if (snprintf (srcpath, sizeof(srcpath), "%s/boot", root_mountpoint) < 0)
+            err (EXIT_FAILURE, "failed to assemble /boot path");
+          if (mount (srcpath, "boot", NULL, MS_BIND | MS_SILENT, NULL) < 0)
             err (EXIT_FAILURE, "failed to bind mount %s to boot", srcpath);
         }
     }
 
-  /* Do we have a persistent overlayfs for /usr?  If so, mount it now. */
+  /* Prepare /etc.
+   * No action required if sysroot is writable. Otherwise, a bind-mount for
+   * the deployment needs to be created and remounted as read/write. */
+  if (sysroot_readonly)
+  {
+    /* Bind-mount /etc (at deploy path), and remount as writable. */
+    if (mount ("etc", "etc", NULL, MS_BIND | MS_SILENT, NULL) < 0)
+      err (EXIT_FAILURE, "failed to prepare /etc bind-mount at %s", srcpath);
+    if (mount ("etc", "etc", NULL, MS_BIND | MS_REMOUNT | MS_SILENT, NULL) < 0)
+      err (EXIT_FAILURE, "failed to make writable /etc bind-mount at %s", srcpath);
+  }
+
+  /* Prepare /usr.
+   * It may be either just a read-only bind-mount, or a persistent overlayfs. */
   if (lstat (".usr-ovl-work", &stbuf) == 0)
     {
+      /* Do we have a persistent overlayfs for /usr?  If so, mount it now. */
       const char usr_ovl_options[] = "lowerdir=usr,upperdir=.usr-ovl-upper,workdir=.usr-ovl-work";
 
       /* Except overlayfs barfs if we try to mount it on a read-only
@@ -305,18 +311,50 @@ main(int argc, char *argv[])
             err (EXIT_FAILURE, "failed to remount rootfs writable (for overlayfs)");
         }
 
-      if (mount ("overlay", "usr", "overlay", 0, usr_ovl_options) < 0)
+      if (mount ("overlay", "usr", "overlay", MS_SILENT, usr_ovl_options) < 0)
         err (EXIT_FAILURE, "failed to mount /usr overlayfs");
     }
   else
     {
       /* Otherwise, a read-only bind mount for /usr */
-      if (mount ("usr", "usr", NULL, MS_BIND, NULL) < 0)
+      if (mount ("usr", "usr", NULL, MS_BIND | MS_SILENT, NULL) < 0)
         err (EXIT_FAILURE, "failed to bind mount (class:readonly) /usr");
-      if (mount ("usr", "usr", NULL, MS_BIND | MS_REMOUNT | MS_RDONLY, NULL) < 0)
+      if (mount ("usr", "usr", NULL, MS_BIND | MS_REMOUNT | MS_RDONLY | MS_SILENT, NULL) < 0)
         err (EXIT_FAILURE, "failed to bind mount (class:readonly) /usr");
     }
 
+  /* Prepare /var.
+   * When a read-only sysroot is configured, this adds a dedicated bind-mount (to itself)
+   * so that the stateroot location stays writable. */
+  if (sysroot_readonly)
+    {
+      /* Bind-mount /var (at stateroot path), and remount as writable. */
+      if (mount ("../../var", "../../var", NULL, MS_BIND | MS_SILENT, NULL) < 0)
+        err (EXIT_FAILURE, "failed to prepare /var bind-mount at %s", srcpath);
+      if (mount ("../../var", "../../var", NULL, MS_BIND | MS_REMOUNT | MS_SILENT, NULL) < 0)
+        err (EXIT_FAILURE, "failed to make writable /var bind-mount at %s", srcpath);
+    }
+
+  /* When running under systemd, /var will be handled by a 'var.mount' unit outside
+   * of initramfs.
+   * Systemd auto-detection can be overridden by a marker file under /run. */
+#ifdef HAVE_SYSTEMD_AND_LIBMOUNT
+  bool mount_var = false;
+#else
+  bool mount_var = true;
+#endif
+  if (lstat (INITRAMFS_MOUNT_VAR, &stbuf) == 0)
+    mount_var = true;
+
+  /* If required, bind-mount `/var` in the deployment to the "stateroot", which is
+  *  the shared persistent directory for a set of deployments.  More info:
+  *  https://ostreedev.github.io/ostree/deployment/#stateroot-aka-osname-group-of-deployments-that-share-var
+  */
+  if (mount_var)
+    {
+      if (mount ("../../var", "var", NULL, MS_BIND | MS_SILENT, NULL) < 0)
+        err (EXIT_FAILURE, "failed to bind mount ../../var to var");
+    }
 
   /* We only stamp /run now if we're running in an initramfs, i.e. we're
    * not pid 1.  Otherwise it's handled later via ostree-system-generator.
@@ -355,17 +393,30 @@ main(int argc, char *argv[])
       if (mkdir ("/sysroot.tmp", 0755) < 0)
         err (EXIT_FAILURE, "couldn't create temporary sysroot /sysroot.tmp");
 
-      if (mount (deploy_path, "/sysroot.tmp", NULL, MS_MOVE, NULL) < 0)
+      if (mount (deploy_path, "/sysroot.tmp", NULL, MS_MOVE | MS_SILENT, NULL) < 0)
         err (EXIT_FAILURE, "failed to MS_MOVE '%s' to '/sysroot.tmp'", deploy_path);
 
-      if (mount (root_mountpoint, "sysroot", NULL, MS_MOVE, NULL) < 0)
+      if (mount (root_mountpoint, "sysroot", NULL, MS_MOVE | MS_SILENT, NULL) < 0)
         err (EXIT_FAILURE, "failed to MS_MOVE '%s' to 'sysroot'", root_mountpoint);
 
-      if (mount (".", root_mountpoint, NULL, MS_MOVE, NULL) < 0)
+      if (mount (".", root_mountpoint, NULL, MS_MOVE | MS_SILENT, NULL) < 0)
         err (EXIT_FAILURE, "failed to MS_MOVE %s to %s", deploy_path, root_mountpoint);
 
       if (rmdir ("/sysroot.tmp") < 0)
         err (EXIT_FAILURE, "couldn't remove temporary sysroot /sysroot.tmp");
+
+      if (sysroot_readonly)
+        {
+          if (mount ("sysroot", "sysroot", NULL, MS_BIND | MS_REMOUNT | MS_RDONLY | MS_SILENT, NULL) < 0)
+            err (EXIT_FAILURE, "failed to make /sysroot read-only");
+
+          /* TODO(lucab): This will make the final '/' read-only.
+           * Stabilize read-only '/sysroot' first, then enable this additional hardening too.
+           *
+           * if (mount (".", ".", NULL, MS_BIND | MS_REMOUNT | MS_RDONLY | MS_SILENT, NULL) < 0)
+           *   err (EXIT_FAILURE, "failed to make / read-only");
+           */
+        }
     }
 
   /* The /sysroot mount needs to be private to avoid having a mount for e.g. /var/cache
@@ -376,7 +427,7 @@ main(int argc, char *argv[])
    * at the very start (perhaps down the line systemd will have compile/runtime option
    * to say that the initramfs environment did everything right from the start).
    */
-  if (mount ("none", "sysroot", NULL, MS_PRIVATE, NULL) < 0)
+  if (mount ("none", "sysroot", NULL, MS_PRIVATE | MS_SILENT, NULL) < 0)
     err (EXIT_FAILURE, "remounting 'sysroot' private");
 
   if (running_as_pid1)