lib/pull: Add support for timestamp-check option, use in upgrader

For both flatpak and ostree-as-host, we really want to verify up front during
pulls that we're not being downgraded. Currently both flatpak and
`OstreeSysrootUpgrader` do this before deployments, but at that point we've
already downloaded all the data, which is annoying.

Closes: https://github.com/ostreedev/ostree/issues/687

Closes: #1055
Approved by: jlebon

tests/libtest.sh

@@ -550,6 +550,14 @@ ostree_file_path_to_checksum() {
     $CMD_PREFIX ostree --repo=$repo ls -C $ref $path | awk '{ print $5 }'
 }
 
+# Given an object checksum, print its relative file path
+ostree_checksum_to_relative_object_path() {
+    repo=$1
+    checksum=$2
+    if grep -Eq -e '^mode=archive' ${repo}/config; then suffix=z; else suffix=''; fi
+    echo objects/${checksum:0:2}/${checksum:2}.file${suffix}
+}
+
 # Given a path to a file in a repo for a ref, print the (relative) path to its
 # object
 ostree_file_path_to_relative_object_path() {
@@ -558,7 +566,7 @@ ostree_file_path_to_relative_object_path() {
     path=$3
     checksum=$(ostree_file_path_to_checksum $repo $ref $path)
     test -n "${checksum}"
-    echo objects/${checksum:0:2}/${checksum:2}.file
+    ostree_checksum_to_relative_object_path ${repo} ${checksum}
 }
 
 # Given a path to a file in a repo for a ref, print the path to its object

tests/pull-test.sh

@@ -35,7 +35,7 @@ function verify_initial_contents() {
     assert_file_has_content baz/cow '^moo$'
 }
 
-echo "1..28"
+echo "1..29"
 
 # Try both syntaxes
 repo_init --no-gpg-verify
@@ -205,6 +205,31 @@ ${CMD_PREFIX} ostree --repo=parentpullrepo rev-parse origin:main > main.txt
 assert_file_has_content main.txt ${rev}
 echo "ok pull specific commit"
 
+# test pull -T
+cd ${test_tmpdir}
+repo_init --no-gpg-verify
+${CMD_PREFIX} ostree --repo=repo pull origin main
+origrev=$(${CMD_PREFIX} ostree --repo=repo rev-parse main)
+# Check we can pull the same commit with timestamp checking enabled
+${CMD_PREFIX} ostree --repo=repo pull -T origin main
+assert_streq ${origrev} "$(${CMD_PREFIX} ostree --repo=repo rev-parse main)"
+newrev=$(${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo commit -b main --tree=ref=main)
+${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo summary -u
+# New commit with timestamp checking
+${CMD_PREFIX} ostree --repo=repo pull -T origin main
+assert_not_streq "${origrev}" "${newrev}"
+assert_streq ${newrev} "$(${CMD_PREFIX} ostree --repo=repo rev-parse main)"
+newrev2=$(${CMD_PREFIX} ostree --timestamp="October 25 1985" --repo=ostree-srv/gnomerepo commit -b main --tree=ref=main)
+${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo summary -u
+if ${CMD_PREFIX} ostree --repo=repo pull -T origin main 2>err.txt; then
+    fatal "pulled older commit with timestamp checking enabled?"
+fi
+assert_file_has_content err.txt "Upgrade.*is chronologically older"
+assert_streq ${newrev} "$(${CMD_PREFIX} ostree --repo=repo rev-parse main)"
+# But we can pull it without timestamp checking
+${CMD_PREFIX} ostree --repo=repo pull origin main
+echo "ok pull timestamp checking"
+
 cd ${test_tmpdir}
 repo_init --no-gpg-verify
 ${CMD_PREFIX} ostree --repo=repo pull origin main

tests/test-admin-upgrade-not-backwards.sh

@@ -26,26 +26,42 @@ setup_os_repository "archive-z2" "syslinux"
 
 echo "1..2"
 
+ref=testos/buildmaster/x86_64-runtime
 cd ${test_tmpdir}
 ${CMD_PREFIX} ostree --repo=sysroot/ostree/repo remote add --set=gpg-verify=false testos $(cat httpd-address)/ostree/testos-repo
-${CMD_PREFIX} ostree --repo=sysroot/ostree/repo pull testos testos/buildmaster/x86_64-runtime
-rev=$(${CMD_PREFIX} ostree --repo=sysroot/ostree/repo rev-parse testos/buildmaster/x86_64-runtime)
+${CMD_PREFIX} ostree --repo=sysroot/ostree/repo pull testos ${ref}
+rev=$(${CMD_PREFIX} ostree --repo=sysroot/ostree/repo rev-parse ${ref})
 export rev
 echo "rev=${rev}"
-# This initial deployment gets kicked off with some kernel arguments 
-${CMD_PREFIX} ostree admin deploy --karg=root=LABEL=MOO --karg=quiet --os=testos testos:testos/buildmaster/x86_64-runtime
+# This initial deployment gets kicked off with some kernel arguments
+${CMD_PREFIX} ostree admin deploy --karg=root=LABEL=MOO --karg=quiet --os=testos testos:${ref}
 assert_has_dir sysroot/boot/ostree/testos-${bootcsum}
 
 # This should be a no-op
 ${CMD_PREFIX} ostree admin upgrade --os=testos
 
-# Now reset to an older revision
-${CMD_PREFIX} ostree --repo=${test_tmpdir}/testos-repo reset testos/buildmaster/x86_64-runtime{,^}
-
+# Generate a new commit with an older timestamp that also has
+# some new content, so we test timestamp checking during pull
+# <https://github.com/ostreedev/ostree/pull/1055>
+origrev=$(ostree --repo=${test_tmpdir}/sysroot/ostree/repo rev-parse testos:${ref})
+cd ${test_tmpdir}/osdata
+echo "new content for pull timestamp checking" > usr/share/test-pull-ts-check.txt
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/testos-repo commit  --add-metadata-string "version=tscheck" \
+              -b ${ref} --timestamp='October 25 1985'
+newrev=$(ostree --repo=${test_tmpdir}/testos-repo rev-parse ${ref})
+assert_not_streq ${origrev} ${newrev}
+cd ${test_tmpdir}
+tscheck_checksum=$(ostree_file_path_to_checksum testos-repo ${ref} /usr/share/test-pull-ts-check.txt)
+tscheck_fileobjpath=$(ostree_checksum_to_relative_object_path testos-repo ${tscheck_checksum})
+assert_has_file testos-repo/${tscheck_fileobjpath}
 if ${CMD_PREFIX} ostree admin upgrade --os=testos 2>upgrade-err.txt; then
     assert_not_reached 'upgrade unexpectedly succeeded'
 fi
 assert_file_has_content upgrade-err.txt 'chronologically older'
+currev=$(ostree --repo=sysroot/ostree/repo rev-parse testos:${ref})
+assert_not_streq ${newrev} ${currev}
+assert_streq ${origrev} ${currev}
+assert_not_has_file sysroot/ostree/repo/$tscheck_fileobjpath
 
 echo 'ok upgrade will not go backwards'