New upstream version 2022.4

src/libostree/libostree-devel.sym

@@ -21,7 +21,6 @@
 */
 
 
-
 /* Stub section for the stable release *after* this development one; don't
  * edit this other than to update the year.  This is just a copy/paste
  * source.  Replace $LASTSTABLE with the last stable version, and $NEWVERSION

src/libostree/libostree-released.sym

@@ -677,6 +677,12 @@ global:
   ostree_repo_traverse_commit_with_flags;
 } LIBOSTREE_2021.5;
 
+LIBOSTREE_2022.4 {
+global:
+  ostree_fs_get_all_xattrs;
+  ostree_fs_get_all_xattrs_at;
+} LIBOSTREE_2021.5;
+
 /* NOTE: Only add more content here in release commits!  See the
  * comments at the top of this file.
  */

src/libostree/ostree-bootloader-zipl.c

@@ -21,12 +21,18 @@
 #include "ostree-bootloader-zipl.h"
 #include "ostree-deployment-private.h"
 #include "otutil.h"
+#include <sys/mount.h>
+#include <sys/stat.h>
 #include <string.h>
 
-#define SECURE_EXECUTION_BOOT_IMAGE     "/boot/sd-boot"
+#define SECURE_EXECUTION_SYSFS_FLAG     "/sys/firmware/uv/prot_virt_guest"
+#define SECURE_EXECUTION_PARTITION      "/dev/disk/by-label/se"
+#define SECURE_EXECUTION_MOUNTPOINT     "/sysroot/se"
+#define SECURE_EXECUTION_BOOT_IMAGE     SECURE_EXECUTION_MOUNTPOINT "/sd-boot"
 #define SECURE_EXECUTION_HOSTKEY_PATH   "/etc/se-hostkeys/"
 #define SECURE_EXECUTION_HOSTKEY_PREFIX "ibm-z-hostkey"
 #define SECURE_EXECUTION_LUKS_ROOT_KEY  "/etc/luks/root"
+#define SECURE_EXECUTION_LUKS_BOOT_KEY  "/etc/luks/boot"
 #define SECURE_EXECUTION_LUKS_CONFIG    "/etc/crypttab"
 #define SECURE_EXECUTION_RAMDISK_TOOL   PKGLIBEXECDIR "/s390x-se-luks-gencpio"
 
@@ -67,6 +73,25 @@ _ostree_bootloader_zipl_get_name (OstreeBootloader *bootloader)
   return "zipl";
 }
 
+static gboolean
+_ostree_secure_execution_mount(GError **error)
+{
+  const char *device = realpath (SECURE_EXECUTION_PARTITION, NULL);
+  if (device == NULL)
+    return glnx_throw_errno_prefix(error, "s390x SE: resolving %s", SECURE_EXECUTION_PARTITION);
+  if (mount (device, SECURE_EXECUTION_MOUNTPOINT, "ext4", 0, NULL) < 0)
+    return glnx_throw_errno_prefix (error, "s390x SE: Mounting %s", device);
+  return TRUE;
+}
+
+static gboolean
+_ostree_secure_execution_umount(GError **error)
+{
+  if (umount (SECURE_EXECUTION_MOUNTPOINT) < 0)
+    return glnx_throw_errno_prefix (error, "s390x SE: Unmounting %s", SECURE_EXECUTION_MOUNTPOINT);
+  return TRUE;
+}
+
 static gboolean
 _ostree_bootloader_zipl_write_config (OstreeBootloader  *bootloader,
                                           int                bootversion,
@@ -85,6 +110,23 @@ _ostree_bootloader_zipl_write_config (OstreeBootloader  *bootloader,
   return TRUE;
 }
 
+static gboolean _ostree_secure_execution_is_enabled (gboolean *out_enabled,
+                                                     GCancellable *cancellable,
+                                                     GError **error)
+{
+  *out_enabled = FALSE;
+  glnx_autofd int fd = -1;
+  if (!ot_openat_ignore_enoent (AT_FDCWD, SECURE_EXECUTION_SYSFS_FLAG, &fd, error))
+    return FALSE;
+  if (fd == -1)
+    return TRUE; //ENOENT --> SecureExecution is disabled
+  g_autofree char *data = glnx_fd_readall_utf8 (fd, NULL, cancellable, error);
+  if (!data)
+    return FALSE;
+  *out_enabled = strstr (data, "1") != NULL;
+  return TRUE;
+}
+
 static gboolean
 _ostree_secure_execution_get_keys (GPtrArray **keys,
                                    GCancellable *cancellable,
@@ -152,8 +194,8 @@ _ostree_secure_execution_get_bls_config (OstreeBootloaderZipl *self,
 static gboolean
 _ostree_secure_execution_luks_key_exists (void)
 {
-  return (access(SECURE_EXECUTION_LUKS_ROOT_KEY, F_OK) == 0 &&
-          access(SECURE_EXECUTION_LUKS_CONFIG, F_OK) == 0);
+  return (access(SECURE_EXECUTION_LUKS_CONFIG, F_OK) == 0 &&
+    (access(SECURE_EXECUTION_LUKS_ROOT_KEY, F_OK) == 0 || access(SECURE_EXECUTION_LUKS_BOOT_KEY, F_OK) == 0));
 }
 
 static gboolean
@@ -250,7 +292,7 @@ static gboolean
 _ostree_secure_execution_call_zipl (GError **error)
 {
   int status = 0;
-  const char *const zipl_argv[] = {"zipl", "-V", "-t", "/boot", "-i", SECURE_EXECUTION_BOOT_IMAGE, NULL};
+  const char *const zipl_argv[] = {"zipl", "-V", "-t", SECURE_EXECUTION_MOUNTPOINT, "-i", SECURE_EXECUTION_BOOT_IMAGE, NULL};
   if (!g_spawn_sync (NULL, (char**)zipl_argv, NULL, G_SPAWN_SEARCH_PATH,
                        NULL, NULL, NULL, NULL, &status, error))
     return glnx_prefix_error(error, "s390x SE: spawning zipl");
@@ -274,9 +316,11 @@ _ostree_secure_execution_enable (OstreeBootloaderZipl *self,
   g_autofree gchar* options = NULL;
 
   gboolean rc =
+      _ostree_secure_execution_mount (error) &&
       _ostree_secure_execution_get_bls_config (self, bootversion, &vmlinuz, &initramfs, &options, cancellable, error) &&
       _ostree_secure_execution_generate_sdboot (vmlinuz, initramfs, options, keys, error) &&
-      _ostree_secure_execution_call_zipl (error);
+      _ostree_secure_execution_call_zipl (error) &&
+      _ostree_secure_execution_umount (error);
 
   return rc;
 }
@@ -303,12 +347,18 @@ _ostree_bootloader_zipl_post_bls_sync (OstreeBootloader  *bootloader,
     return TRUE;
 
   /* Try with Secure Execution */
-  g_autoptr(GPtrArray) keys = NULL;
-  if (!_ostree_secure_execution_get_keys (&keys, cancellable, error))
+  gboolean se_enabled = FALSE;
+  if ( !_ostree_secure_execution_is_enabled (&se_enabled, cancellable, error))
     return FALSE;
-  if (keys && keys->len)
-    return _ostree_secure_execution_enable (self, bootversion, keys, cancellable, error);
-
+  if (se_enabled)
+    {
+      g_autoptr(GPtrArray) keys = NULL;
+      if (!_ostree_secure_execution_get_keys (&keys, cancellable, error))
+        return FALSE;
+      if (!keys || keys->len == 0)
+        return glnx_throw (error, "s390x SE: no keys");
+      return _ostree_secure_execution_enable (self, bootversion, keys, cancellable, error);
+    }
   /* Fallback to non-SE setup */
   const char *const zipl_argv[] = {"zipl", NULL};
   int estatus;

src/libostree/ostree-cmd-private.c

@@ -19,7 +19,7 @@
 
 #include "config.h"
 
-#include "ostree-cmdprivate.h"
+#include "ostree-cmd-private.h"
 #include "ostree-repo-private.h"
 #include "ostree-core-private.h"
 #include "ostree-repo-static-delta-private.h"

src/libostree/ostree-core.c

@@ -836,6 +836,51 @@ gboolean ostree_break_hardlink (int               dfd,
   return TRUE;
 }
 
+/**
+ * ostree_fs_get_all_xattrs:
+ * @fd: File descriptor
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Retrieve all extended attributes in a canonical (sorted) order from
+ * the given file descriptor.
+ *
+ * Returns: (transfer full): A GVariant of type `a(ayay)`
+ */
+GVariant *
+ostree_fs_get_all_xattrs (int fd, GCancellable *cancellable, GError **error)
+{
+  GVariant *ret = NULL;
+  if (!glnx_fd_get_all_xattrs (fd, &ret, cancellable, error))
+    return NULL;
+  return ret;
+}
+
+/**
+ * ostree_fs_get_all_xattrs_at:
+ * @dfd: Directory file descriptor
+ * @path: Filesystem path
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Retrieve all extended attributes in a canonical (sorted) order from
+ * the given path, relative to the provided directory file descriptor.
+ * The target path will not be dereferenced.  Currently on Linux, this
+ * API must be used currently to retrieve extended attributes
+ * for symbolic links because while `O_PATH` exists, it cannot be used
+ * with `fgetxattr()`.
+ *
+ * Returns: (transfer full): A GVariant of type `a(ayay)`
+ */
+GVariant *
+ostree_fs_get_all_xattrs_at (int dfd, const char *path, GCancellable *cancellable, GError **error)
+{
+  GVariant *ret = NULL;
+  if (!glnx_dfd_name_get_all_xattrs (dfd, path, &ret, cancellable, error))
+    return NULL;
+  return ret;
+}
+
 /**
  * ostree_checksum_file_from_input:
  * @file_info: File information
@@ -928,8 +973,8 @@ ostree_checksum_file (GFile            *f,
   g_autoptr(GVariant) xattrs = NULL;
   if (objtype == OSTREE_OBJECT_TYPE_FILE)
     {
-      if (!glnx_dfd_name_get_all_xattrs (AT_FDCWD, gs_file_get_path_cached (f),
-                                         &xattrs, cancellable, error))
+      xattrs = ostree_fs_get_all_xattrs_at (AT_FDCWD, gs_file_get_path_cached (f), cancellable, error);
+      if (!xattrs)
         return FALSE;
     }
 

src/libostree/ostree-core.h

@@ -464,6 +464,12 @@ gboolean ostree_break_hardlink (int               dfd,
                                 GCancellable     *cancellable,
                                 GError          **error);
 
+_OSTREE_PUBLIC
+GVariant *ostree_fs_get_all_xattrs (int fd, GCancellable *cancellable, GError **error);
+
+_OSTREE_PUBLIC
+GVariant *ostree_fs_get_all_xattrs_at (int dfd, const char *path, GCancellable *cancellable, GError **error);
+
 /**
  * OstreeChecksumFlags:
  * @OSTREE_CHECKSUM_FLAGS_NONE: Default checksumming without tweaks.

src/libostree/ostree-impl-system-generator.c

@@ -32,7 +32,7 @@
 
 #include "ostree.h"
 #include "ostree-core-private.h"
-#include "ostree-cmdprivate.h"
+#include "ostree-cmd-private.h"
 
 #ifdef HAVE_LIBMOUNT
 typedef FILE OtLibMountFile;

src/libostree/ostree-mutable-tree.c

@@ -403,8 +403,8 @@ ostree_mutable_tree_ensure_dir (OstreeMutableTree *self,
  * ostree_mutable_tree_lookup:
  * @self: Tree
  * @name: name
- * @out_file_checksum: (out) (transfer full): checksum
- * @out_subdir: (out) (transfer full): subdirectory
+ * @out_file_checksum: (out) (transfer full) (nullable) (optional): checksum
+ * @out_subdir: (out) (transfer full) (nullable) (optional): subdirectory
  * @error: a #GError
  */
 gboolean

src/libostree/ostree-repo-commit.c

@@ -3436,14 +3436,15 @@ get_final_xattrs (OstreeRepo                       *self,
       else if (dfd_subpath == NULL)
         {
           g_assert (dfd != -1);
-          if (!glnx_fd_get_all_xattrs (dfd, &original_xattrs, cancellable, error))
+          original_xattrs = ostree_fs_get_all_xattrs (dfd, cancellable, error);
+          if (!original_xattrs)
             return FALSE;
         }
       else
         {
           g_assert (dfd != -1);
-          if (!glnx_dfd_name_get_all_xattrs (dfd, dfd_subpath, &original_xattrs,
-                                             cancellable, error))
+          original_xattrs = ostree_fs_get_all_xattrs_at (dfd, dfd_subpath, cancellable, error);
+          if (!original_xattrs)
             return FALSE;
         }
 
@@ -4641,8 +4642,8 @@ import_one_object_direct (OstreeRepo    *dest_repo,
           if (src_repo->mode == OSTREE_REPO_MODE_BARE)
             {
               g_autoptr(GVariant) xattrs = NULL;
-              if (!glnx_fd_get_all_xattrs (src_fd, &xattrs,
-                                           cancellable, error))
+              xattrs = ostree_fs_get_all_xattrs (src_fd, cancellable, error);
+              if (!xattrs)
                 return FALSE;
               if (!glnx_fd_set_all_xattrs (tmp_dest.fd, xattrs,
                                            cancellable, error))

src/libostree/ostree-repo-static-delta-core.c

@@ -25,7 +25,7 @@
 #include "ostree-core-private.h"
 #include "ostree-repo-private.h"
 #include "ostree-lzma-decompressor.h"
-#include "ostree-cmdprivate.h"
+#include "ostree-cmd-private.h"
 #include "ostree-checksum-input-stream.h"
 #include "ostree-repo-static-delta-private.h"
 #include "otutil.h"

src/libostree/ostree-repo.c

@@ -28,6 +28,7 @@
 #include <gio/gunixoutputstream.h>
 #include <gio/gfiledescriptorbased.h>
 #include "libglnx.h"
+#include "ostree-core.h"
 #include "otutil.h"
 #include <glnx-console.h>
 #include <linux/magic.h>
@@ -4345,9 +4346,12 @@ _ostree_repo_load_file_bare (OstreeRepo         *self,
         {
           if (self->disable_xattrs)
             ret_xattrs = g_variant_ref_sink (g_variant_new_array (G_VARIANT_TYPE ("(ayay)"), NULL, 0));
-          else if (!glnx_fd_get_all_xattrs (fd, &ret_xattrs,
-                                            cancellable, error))
-            return FALSE;
+          else 
+            {
+              ret_xattrs = ostree_fs_get_all_xattrs (fd, cancellable, error);
+              if (!ret_xattrs)
+                return FALSE;
+            }
         }
       else if (S_ISLNK (stbuf.st_mode) && out_xattrs)
         {

src/libostree/ostree-sysroot-deploy.c

@@ -22,6 +22,7 @@
 #include <gio/gunixinputstream.h>
 #include <gio/gunixoutputstream.h>
 #include <glib-unix.h>
+#include <stdint.h>
 #include <sys/mount.h>
 #include <sys/statvfs.h>
 #include <sys/socket.h>
@@ -2081,6 +2082,50 @@ install_deployment_kernel (OstreeSysroot   *sysroot,
   g_autofree char *options_key = ostree_kernel_args_to_string (kargs);
   ostree_bootconfig_parser_set (bootconfig, "options", options_key);
 
+  g_autoptr(GError) local_error = NULL;
+  GKeyFile *config = ostree_repo_get_config (repo);
+  gchar **read_values = g_key_file_get_string_list (config, "sysroot", "bls-append-except-default", NULL, &local_error);
+  /* We can ignore not found errors */
+  if (!read_values)
+    {
+      gboolean not_found = g_error_matches (local_error, G_KEY_FILE_ERROR, G_KEY_FILE_ERROR_KEY_NOT_FOUND) || \
+                           g_error_matches (local_error, G_KEY_FILE_ERROR, G_KEY_FILE_ERROR_GROUP_NOT_FOUND);
+      if (not_found)
+        {
+          g_clear_error (&local_error);
+        }
+      else
+        {
+          g_propagate_error (error, g_steal_pointer (&local_error));
+          return FALSE;
+        }
+    }
+
+  /* Only append to this BLS config if:
+   * - this is not the default deployment
+   */
+   /* If deployment was prepended, it is the new default */
+  gboolean is_new_default = (ostree_deployment_get_index (deployment) == 0);
+  gboolean allow_append = !is_new_default;
+  if (allow_append)
+    {
+      /* get all key value pairs in bls-append */
+      for (char **iter = read_values; iter && *iter; iter++)
+        {
+          const char *key_value = *iter;
+          const char *sep = strchr (key_value, '=');
+          if (sep == NULL)
+            {
+              glnx_throw (error, "bls-append-except-default key must be of the form \"key1=value1;key2=value2...\"");
+              return FALSE;
+            }
+          g_autofree char *key = g_strndup (key_value, sep - key_value);
+          g_autofree char *value = g_strdup (sep + 1);
+          ostree_bootconfig_parser_set (bootconfig, key, value);
+        }
+
+    }
+
   glnx_autofd int bootconf_dfd = -1;
   if (!glnx_opendirat (sysroot->boot_fd, bootconfdir, TRUE, &bootconf_dfd, error))
     return FALSE;

src/libostree/ostree-sysroot.c

@@ -1267,7 +1267,7 @@ ostree_sysroot_get_booted_deployment (OstreeSysroot       *self)
 OstreeDeployment *
 ostree_sysroot_require_booted_deployment (OstreeSysroot *self, GError **error)
 {
-  g_return_val_if_fail (self->loadstate == OSTREE_SYSROOT_LOAD_STATE_LOADED, NULL);
+  g_assert (self->loadstate == OSTREE_SYSROOT_LOAD_STATE_LOADED);
 
   if (!self->booted_deployment)
     return glnx_null_throw (error, "Not currently booted into an OSTree system");
@@ -1286,7 +1286,7 @@ ostree_sysroot_require_booted_deployment (OstreeSysroot *self, GError **error)
 OstreeDeployment *
 ostree_sysroot_get_staged_deployment (OstreeSysroot       *self)
 {
-  g_return_val_if_fail (self->loadstate == OSTREE_SYSROOT_LOAD_STATE_LOADED, NULL);
+  g_assert (self->loadstate == OSTREE_SYSROOT_LOAD_STATE_LOADED);
 
   return self->staged_deployment;
 }
@@ -1300,7 +1300,7 @@ ostree_sysroot_get_staged_deployment (OstreeSysroot       *self)
 GPtrArray *
 ostree_sysroot_get_deployments (OstreeSysroot  *self)
 {
-  g_return_val_if_fail (self->loadstate == OSTREE_SYSROOT_LOAD_STATE_LOADED, NULL);
+  g_assert (self->loadstate == OSTREE_SYSROOT_LOAD_STATE_LOADED);
 
   GPtrArray *copy = g_ptr_array_new_with_free_func ((GDestroyNotify)g_object_unref);
   for (guint i = 0; i < self->deployments->len; i++)
@@ -1525,7 +1525,7 @@ ostree_sysroot_query_deployments_for (OstreeSysroot     *self,
                                       OstreeDeployment  **out_pending,
                                       OstreeDeployment  **out_rollback)
 {
-  g_return_if_fail (osname != NULL || self->booted_deployment != NULL);
+  g_assert (osname != NULL || self->booted_deployment != NULL);
   g_autoptr(OstreeDeployment) ret_pending = NULL;
   g_autoptr(OstreeDeployment) ret_rollback = NULL;
 
@@ -1896,6 +1896,7 @@ ostree_sysroot_simple_write_deployment (OstreeSysroot      *sysroot,
   /* tracks when we come across the booted deployment */
   gboolean before_booted = TRUE;
   gboolean before_merge = TRUE;
+  g_assert (deployments);
   for (guint i = 0; i < deployments->len; i++)
     {
       OstreeDeployment *deployment = deployments->pdata[i];

src/libostree/ostree-version.h

@@ -41,7 +41,7 @@
  *
  * Since: 2017.4
  */
-#define OSTREE_RELEASE_VERSION (3)
+#define OSTREE_RELEASE_VERSION (4)
 
 /**
  * OSTREE_VERSION
@@ -50,7 +50,7 @@
  *
  * Since: 2017.4
  */
-#define OSTREE_VERSION (2022.3)
+#define OSTREE_VERSION (2022.4)
 
 /**
  * OSTREE_VERSION_S:
@@ -60,7 +60,7 @@
  *
  * Since: 2017.4
  */
-#define OSTREE_VERSION_S "2022.3"
+#define OSTREE_VERSION_S "2022.4"
 
 #define OSTREE_ENCODE_VERSION(year,release) \
         ((year) << 16 | (release))
@@ -98,4 +98,6 @@
  *
  * Since: 2019.3
  */
+#ifndef __GI_SCANNER__
 #define OSTREE_BUILT_FEATURES "libsoup gpgme ex-fsverity libarchive selinux libmount systemd release p2p"
+#endif

src/libostree/ostree-version.h.in

@@ -98,4 +98,6 @@
  *
  * Since: 2019.3
  */
+#ifndef __GI_SCANNER__
 #define OSTREE_BUILT_FEATURES "@OSTREE_FEATURES@"
+#endif

src/libostree/s390x-se-luks-gencpio

@@ -4,19 +4,19 @@ set -euo pipefail
 
 old_initrd=$1
 new_initrd=$2
+currdir=$PWD
 
-# Unpacking existing initramdisk
+# Copying existing initramdisk
+cp ${old_initrd} ${new_initrd}
+
+# Appending LUKS root keys and crypttab config to the end of initrd
 workdir=$(mktemp -d -p /tmp se-initramfs-XXXXXX)
 cd ${workdir}
-gzip -cd ${old_initrd} | cpio -imd --quiet
-
-# Adding LUKS root key and crypttab config
 mkdir -p etc/luks
-cp -f /etc/luks/root etc/luks/
+cp -f /etc/luks/* etc/luks/
 cp -f /etc/crypttab etc/
-
-# Creating new initramdisk image
-find . | cpio --quiet -H newc -o | gzip -9 -n >> ${new_initrd}
+find . -mindepth 1 | cpio --quiet -H newc -o | gzip -9 -n >> ${new_initrd}
 
 # Cleanup
+cd ${currdir}
 rm -rf ${workdir}

src/ostree/ot-admin-builtin-boot-complete.c

@@ -27,7 +27,7 @@
 #include "ostree.h"
 #include "otutil.h"
 
-#include "ostree-cmdprivate.h"
+#include "ostree-cmd-private.h"
 
 static GOptionEntry options[] = {
   { NULL }

src/ostree/ot-admin-builtin-deploy.c

@@ -41,6 +41,7 @@ static gboolean opt_no_prune;
 static gboolean opt_no_merge;
 static char **opt_kernel_argv;
 static char **opt_kernel_argv_append;
+static char *opt_kernel_argv_delete;
 static gboolean opt_kernel_proc_cmdline;
 static char *opt_osname;
 static char *opt_origin_path;
@@ -62,6 +63,7 @@ static GOptionEntry options[] = {
   { "karg", 0, 0, G_OPTION_ARG_STRING_ARRAY, &opt_kernel_argv, "Set kernel argument, like root=/dev/sda1; this overrides any earlier argument with the same name", "NAME=VALUE" },
   { "karg-append", 0, 0, G_OPTION_ARG_STRING_ARRAY, &opt_kernel_argv_append, "Append kernel argument; useful with e.g. console= that can be used multiple times", "NAME=VALUE" },
   { "karg-none", 0, 0, G_OPTION_ARG_NONE, &opt_kernel_arg_none, "Do not import kernel arguments", NULL },
+  { "karg-delete", 0, 0, G_OPTION_ARG_STRING, &opt_kernel_argv_delete, "Delete kernel argument if exists", "NAME=VALUE" },
   { "overlay-initrd", 0, 0, G_OPTION_ARG_STRING_ARRAY, &opt_overlay_initrds, "Overlay iniramfs file", "FILE" },
   { NULL }
 };
@@ -85,10 +87,22 @@ ot_admin_builtin_deploy (int argc, char **argv, OstreeCommandInvocation *invocat
     }
 
   if (opt_kernel_proc_cmdline && opt_kernel_arg_none)
-  {
-    ot_util_usage_error (context, "Can't specify both --karg-proc-cmdline and --karg-none", error);
-    return FALSE;
-  }
+    {
+      ot_util_usage_error (context, "Can't specify both --karg-proc-cmdline and --karg-none", error);
+      return FALSE;
+    }
+
+  if (opt_kernel_arg_none && opt_kernel_argv_delete)
+    {
+      ot_util_usage_error (context, "Can't specify both --karg-none and --karg-delete", error);
+      return FALSE;
+    }
+
+  if (opt_no_merge && opt_kernel_argv_delete)
+    {
+      ot_util_usage_error (context, "Can't specify both --no-merge and --karg-delete", error);
+      return FALSE;
+    }
 
   const char *refspec = argv[1];
 
@@ -145,7 +159,7 @@ ot_admin_builtin_deploy (int argc, char **argv, OstreeCommandInvocation *invocat
       if (!ostree_kernel_args_append_proc_cmdline (kargs, cancellable, error))
         return FALSE;
     }
-  else if (merge_deployment && (opt_kernel_argv || opt_kernel_argv_append))
+  else if (merge_deployment && (opt_kernel_argv || opt_kernel_argv_append || opt_kernel_argv_delete))
     {
       OstreeBootconfigParser *bootconfig = ostree_deployment_get_bootconfig (merge_deployment);
       g_auto(GStrv) previous_args = g_strsplit (ostree_bootconfig_parser_get (bootconfig, "options"), " ", -1);
@@ -171,6 +185,12 @@ ot_admin_builtin_deploy (int argc, char **argv, OstreeCommandInvocation *invocat
       ostree_kernel_args_append_argv (kargs, opt_kernel_argv_append);
     }
 
+  if (opt_kernel_argv_delete)
+    {
+      if (!ostree_kernel_args_delete (kargs, opt_kernel_argv_delete, error))
+        return FALSE;
+    }
+
   g_autoptr(GPtrArray) overlay_initrd_chksums = NULL;
   for (char **it = opt_overlay_initrds; it && *it; it++)
     {

src/ostree/ot-admin-builtin-diff.c

@@ -39,7 +39,6 @@ gboolean
 ot_admin_builtin_diff (int argc, char **argv, OstreeCommandInvocation *invocation, GCancellable *cancellable, GError **error)
 {
   g_autoptr(GOptionContext) context = g_option_context_new ("");
-  g_option_context_add_main_entries (context, options, NULL);
 
   g_autoptr(OstreeSysroot) sysroot = NULL;
   if (!ostree_admin_option_context_parse (context, options, &argc, &argv,

src/ostree/ot-admin-builtin-finalize-staged.c

@@ -29,7 +29,7 @@
 #include "ostree.h"
 #include "otutil.h"
 
-#include "ostree-cmdprivate.h"
+#include "ostree-cmd-private.h"
 #include "ostree.h"
 
 static GOptionEntry options[] = {

src/ostree/ot-admin-instutil-builtin-grub2-generate.c

@@ -22,7 +22,7 @@
 
 #include "ot-main.h"
 #include "ot-admin-instutil-builtins.h"
-#include "ostree-cmdprivate.h"
+#include "ostree-cmd-private.h"
 
 #include "otutil.h"
 

src/ostree/ot-builtin-fsck.c

@@ -25,7 +25,7 @@
 #include "ot-main.h"
 #include "ot-builtins.h"
 #include "ostree.h"
-#include "ostree-cmdprivate.h"
+#include "ostree-cmd-private.h"
 #include "otutil.h"
 
 static gboolean opt_quiet;

src/ostree/ot-builtin-static-delta.c

@@ -22,7 +22,7 @@
 #include "ot-main.h"
 #include "ot-builtins.h"
 #include "ostree.h"
-#include "ostree-cmdprivate.h"
+#include "ostree-cmd-private.h"
 #include "ot-main.h"
 #include "otutil.h"
 

src/switchroot/ostree-system-generator.c

@@ -27,7 +27,7 @@
 
 #include <libglnx.h>
 
-#include "ostree-cmdprivate.h"
+#include "ostree-cmd-private.h"
 #include "ostree-mount-util.h"
 
 static const char *arg_dest = "/tmp";