diff --git a/ADOPTERS.md b/ADOPTERS.md new file mode 100644 index 0000000..07acb19 --- /dev/null +++ b/ADOPTERS.md @@ -0,0 +1,42 @@ + +> **Note** +> Do you want to add yourself to this list? Simply fork the repository and open a PR with the required change. +> We have a short description of the adopter types at the bottom of this page. Each type is in alphabetical order. + +# bootc Adopters (direct) + +| Type | Name | Since | Website | Use-Case | +|:-|:-|:-|:-|:-| +Vendor | Red Hat | 2024 | https://redhat.com | Image Based Linux +Vendor | HeliumOS | 2024 | https://www.heliumos.org/ | An atomic desktop operating system for your devices +Vendor | AlmaLinux (Atomic SIG) | 2025 | [atomic-desktop](https://github.com/AlmaLinux/atomic-desktop), [atomic-workstation](https://github.com/AlmaLinux/atomic-workstation) | Atomic AlmaLinux desktop respins +Vendor | Caligra | 2025 | [workbench](https://caligra.com/workbench/) | An OS designed to accelerate knowledge work +Vendor | CIQ | 2026 | https://ciq.com | Rocky Linux from CIQ (RLC) - Image Based Linux - Standard and Cloud variants +Vendor | Universal Blue (Aurora/Bazzite/Bluefin) | 2024 | https://universal-blue.org/ | The reliability of a Chromebook, but with the flexibility and power of a traditional Linux desktop + +# bootc Adopters (indirect, via ostree) + +Bootc is a relatively new project, but much of the underlying technology and goals is *not* new. +The underlying ostree project is over 13 years old (as of 2024). This project also relates +to [rpm-ostree](https://github.com/coreos/rpm-ostree/) which has existed a really long time. + +Not every one of these projects uses bootc directly today, but a toplevel goal of bootc +is to be the successor to ostree, and it is our aim to seamlessly carry forward these users. + +| Type | Name | Since | Website | Use-Case | +|:-|:-|:-|:-|:-| +| Vendor | Endless | 2014 | [link](https://www.endlessos.org/os) | A Completely Free, User-Friendly Operating System Packed with Educational Tools, Games, and More +| Vendor | Red Hat | 2015 | [link](https://redhat.com) | Image Based Linux +| Vendor | Apertis | 2020 | [link](https://apertis.org) | Collaborative OS platform for products +| Vendor | Fedora Project | 2021 | [link](https://fedoraproject.org/atomic-desktops/) | An atomic desktop operating system aimed at good support for container-focused workflows +| Vendor | Playtron GameOS | 2022 | [link](https://www.playtron.one/) | A video game console OS that has integration with the top PC game stores | +| Vendor | Fyra Labs | 2024 | [link](https://fyralabs.com) | Bootc powers an experimental variant of Ultramarine Linux + +### Adopter Types + +**End-user**: The organization runs bootc in production in some way. + +**Integration**: The organization has a product that integrates with bootc, but does not contain bootc. + +**Vendor**: The organization packages bootc in their product and sells it as part of their product. + diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..62a5861 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,4 @@ +# Bootc Project Code of Conduct + +The Bootc project has adopted the [CNCF Community Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md). +All community members, contributors, and participants in the Bootc project are expected to abide by this Code of Conduct. This includes respectful treatment of everyone, regardless of their background or identity. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..a189e51 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,338 @@ +# Contributing to bootc + +Thanks for your interest in contributing! At the current time, +bootc is implemented in Rust, and calls out to important components +which are written in Go (e.g. https://github.com/containers/image) +as well as C (e.g. https://github.com/ostreedev/ostree/). Depending +on what area you want to work on, you'll need to be familiar with +the relevant language. + +## Note: Before writing a big patch + +If you plan to contribute a large change, please get in touch *before* +submitting a pull request by e.g. filing an issue describing your proposed +change. This will help ensure alignment. + +## Development environment + +There isn't a single approach to working on bootc; however +the primary developers tend to use Linux host systems, +and test in Linux VMs. One specifically recommended +approach is to use [toolbox](https://github.com/containers/toolbox/) +to create a containerized development environment +(it's possible, though not necessary to create the toolbox + dev environment using a bootc image as well). + +At the current time most upstream developers use a Fedora derivative +as a base, and the [hack/Containerfile](hack/Containerfile) defaults +to Fedora. However, bootc itself is not intended to strongly tie to a particular +OS or distribution, and patches to handle others are gratefully +accepted! + +## Key recommended ingredients: + +- A development environment (toolbox or a host) with a Rust and C compiler, etc. + While this isn't specific to bootc, you will find the experience of working on Rust + is greatly aided with use of e.g. [rust-analyzer](https://github.com/rust-lang/rust-analyzer/). +- Install [bcvk](https://github.com/bootc-dev/bcvk). + +## Ensure you're familiar with a bootc system + +Worth stating: before you start diving into the code you should understand using +the system as a user and how it works. See the user documentation for that. + +## The Justfile + +The [Justfile](Justfile) is the primary interface for building and testing bootc. + +```bash +just --list # Show all targets organized by group +just list-variants # Show available build variants and current config +``` + +### Building from source + +Edit the source code; a simple thing to do is add e.g. +`eprintln!("hello world");` into `run_from_opt` in [crates/lib/src/cli.rs](crates/lib/src/cli.rs). +You can run `make` or `cargo build` to build that locally. However, a key +next step is to get that binary into a bootc container image. + +Running `just` defaults to `just build` which will build a container +from the current source code; the result will be named `localhost/bootc`. + +### Running an interactive shell in an environment from the container + +You can of course `podman run --rm -ti localhost/bootc bash` to get a shell, +and try running `bootc`. + +### Running container-oriented integration tests + +```bash +just test-container +``` + +### Running (TMT) integration tests + +A common cycle here is you'll edit e.g. `deploy.rs` and want to run the +tests that perform an upgrade: + +```bash +just test-tmt local-upgrade-reboot +``` + +To run a specific test: + +```bash +just test-tmt readonly +``` + +### Faster iteration cycles + +The test cycle currently builds a disk image and creates a new ephemeral +VM for each test run. + +You can shortcut some iteration cycles by having a more persistent +environment where you run bootc. + +#### Upgrading from the container image + +One good approach is to create a persistent target virtual machine via e.g. +`bcvk libvirt run` (or a cloud VM), and then after doing a `just build` and getting +a container image, you can directly upgrade to that image. + +For the local case, check out [cstor-dist](https://github.com/cgwalters/cstor-dist). +Another alternative is mounting via virtiofs (see e.g. [this PR to bcvk](https://github.com/bootc-dev/bcvk/pull/16)). +If you're using libvirt, see [this document](https://libvirt.org/kbase/virtiofs.html). + +#### Using sysext for fast iteration + +For the fastest development cycle when working on the bootc client +(e.g. `bootc upgrade`, `bootc switch`), you can use the sysext-based +workflow. This builds the bootc binary via a container, shares it into +a persistent VM via virtiofs, and overlays it onto `/usr` using +systemd-sysext (~30s rebuild cycle): + +```bash +# Build sysext and launch a persistent dev VM +just bcvk up + +# After editing code, rebuild and refresh the overlay (~30s) +just bcvk sync + +# SSH into the VM — bootc is your dev build +just bcvk ssh bootc status + +# When done +just bcvk down +``` + +The sysext overlay means `bootc` on the VM's PATH is your dev build. +Run `just bcvk` to list all available commands. + +#### Running bootc against a live environment + +If your development environment host is also a bootc system (e.g. a +workstation or a virtual server) one way to shortcut some cycles is just +to directly run the output of the built binary against your host. + +Say for example your host is a Fedora 42 workstation (based on bootc), +then you can `cargo b --release` directly in a Fedora 42 container +or even on your host system, and then directly run e.g. `./target/release/bootc upgrade` +etc. + +### Building and testing with the composefs backend + +bootc has two storage backends: `ostree` (default, production) and `composefs` +(experimental). The composefs backend has several axes of configuration: + +| Variable | Values | Notes | +|---|---|---| +| `variant` | `ostree`, `composefs` | Storage backend | +| `bootloader` | `grub`, `systemd` | systemd-boot required for UKI | +| `boot_type` | `bls`, `uki` | UKI embeds the composefs digest | +| `seal_state` | `unsealed`, `sealed` | Sealed signs the UKI for Secure Boot | +| `filesystem` | `ext4`, `btrfs`, `xfs` | xfs lacks fsverity, incompatible with sealed | + +These are controlled via `BOOTC_`-prefixed environment variables. +Using environment variables (rather than `just` command-line overrides) +is recommended because they persist across commands in the same shell +session — so `just build` followed by `just test-tmt` will use the +same configuration: + +```bash +# Set up a composefs development session +export BOOTC_variant=composefs +export BOOTC_bootloader=systemd +# Now all just targets use these settings: +just build +just test-tmt readonly +just test-container +``` + +The constraints are: + +- `sealed` requires `boot_type=uki` (the digest lives in the UKI cmdline) +- `sealed` requires `filesystem` with fsverity support (`ext4` or `btrfs`) +- `uki` requires `bootloader=systemd` + +Common workflows: + +```bash +# Simplest composefs build (unsealed, grub, BLS, ext4) +export BOOTC_variant=composefs +just build + +# Composefs with systemd-boot +export BOOTC_variant=composefs BOOTC_bootloader=systemd +just build + +# Fully sealed image (systemd-boot + signed UKI + Secure Boot) +# This is the most common composefs dev workflow: +just build-sealed + +# Run composefs integration tests (all four params are required) +just test-composefs systemd ext4 bls unsealed + +# Run sealed UKI tests +just test-composefs systemd ext4 uki sealed + +# Validate composefs digests match between build and install views +# (useful for debugging mtime/metadata issues) +just validate-composefs-digest +``` + +The `build-sealed` target generates test Secure Boot keys in +`target/test-secureboot/` and builds a complete sealed image with all +the sealed composefs settings. See +[experimental-composefs.md](docs/src/experimental-composefs.md) for +more information on sealed images. + + +### Debugging via lldb + +The `hack/lldb` directory contains an example of how to use lldb to debug bootc code. +`hack/lldb/deploy.sh` can be used to build and deploy a bootc VM in libvirt with an lldb-server +running as a systemd service. Depending on your editor, you can then connect to the lldb server +to use an interactive debugger, and set up the editor to build and push the new binary to the VM. +`hack/lldb/dap-example-vim.lua` is an example for neovim. + +The VM can be connected to via `ssh test@bootc-lldb` if you have [nss](https://libvirt.org/nss.html) +enabled. + +For some bootc install commands, it's simpler to run the lldb-server in a container, e.g. + +```bash +sudo podman run --pid=host --network=host --privileged --security-opt label=type:unconfined_t -v /var/lib/containers:/var/lib/containers -v /dev:/dev -v .:/output localhost/bootc-lldb lldb-server platform --listen "*:1234" --server +``` + +## Code linting + +The `make validate` target runs checks locally that we gate on +in CI, currently around `cargo fmt` and `cargo clippy`. + +## Running the tests + +First, you can run many unit tests with `cargo test`. + +### container tests + +There's a small set of tests which are designed to run inside a bootc container +and are built into the default container image: + +``` +$ just test-container +``` + +## Submitting a patch + +The podman project has some [generic useful guidance](https://github.com/containers/podman/blob/main/CONTRIBUTING.md#submitting-pull-requests); +like that project, a "Developer Certificate of Origin" is required. + +### Sign your PRs + +The sign-off is a line at the end of the explanation for the patch. Your +signature certifies that you wrote the patch or otherwise have the right to pass +it on as an open-source patch. The rules are simple: if you can certify +the below (from [developercertificate.org](https://developercertificate.org/)): + +``` +Developer Certificate of Origin +Version 1.1 + +Copyright (C) 2004, 2006 The Linux Foundation and its contributors. +660 York Street, Suite 102, +San Francisco, CA 94110 USA + +Everyone is permitted to copy and distribute verbatim copies of this +license document, but changing it is not allowed. + +Developer's Certificate of Origin 1.1 + +By making a contribution to this project, I certify that: + +(a) The contribution was created in whole or in part by me and I + have the right to submit it under the open source license + indicated in the file; or + +(b) The contribution is based upon previous work that, to the best + of my knowledge, is covered under an appropriate open source + license and I have the right under that license to submit that + work with modifications, whether created in whole or in part + by me, under the same open source license (unless I am + permitted to submit under a different license), as indicated + in the file; or + +(c) The contribution was provided directly to me by some other + person who certified (a), (b) or (c) and I have not modified + it. + +(d) I understand and agree that this project and the contribution + are public and that a record of the contribution (including all + personal information I submit with it, including my sign-off) is + maintained indefinitely and may be redistributed consistent with + this project or the open source license(s) involved. +``` + +Then you just add a line to every git commit message: + + Signed-off-by: Joe Smith + +Use your real name (sorry, no pseudonyms or anonymous contributions.) + +If you set your `user.name` and `user.email` git configs, you can sign your +commit automatically with `git commit -s`. + +### Git commit style + +Please look at `git log` and match the commit log style, which is very +similar to the +[Linux kernel](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git). + +You may use `Signed-off-by`, but we're not requiring it. + +**General Commit Message Guidelines**: + +1. Title + - Specify the context or category of the changes e.g. `lib` for library changes, `docs` for document changes, `bin/` for command changes, etc. + - Begin the title with the first letter of the first word capitalized. + - Aim for less than 50 characters, otherwise 72 characters max. + - Do not end the title with a period. + - Use an [imperative tone](https://en.wikipedia.org/wiki/Imperative_mood). +2. Body + - Separate the body with a blank line after the title. + - Begin a paragraph with the first letter of the first word capitalized. + - Each paragraph should be formatted within 72 characters. + - Content should be about what was changed and why this change was made. + - If your commit fixes an issue, the commit message should end with `Closes: #`. + +Commit Message example: + +```bash +: Less than 50 characters for subject title + +A paragraph of the body should be within 72 characters. + +This paragraph is also less than 72 characters. +``` + +For more information see [How to Write a Git Commit Message](https://chris.beams.io/posts/git-commit/) diff --git a/GOVERNANCE.md b/GOVERNANCE.md new file mode 100644 index 0000000..13e8ab0 --- /dev/null +++ b/GOVERNANCE.md @@ -0,0 +1,152 @@ +# Bootc Project Governance + +The Bootc project is dedicated to providing transactional, in-place operating system updates using OCI/Docker container images. +This governance explains how the project is run. + +- [Values](#values) +- [Maintainers](#maintainers) +- [Becoming a Maintainer](#becoming-a-maintainer) +- [Meetings](#meetings) +- [CNCF Resources](#cncf-resources) +- [Code of Conduct Enforcement](#code-of-conduct) +- [Security Response Team](#security-response-team) +- [Voting](#voting) +- [Modifications](#modifying-this-charter) + +## Values + +The Bootc and its leadership embrace the following values: + +* Openness: Communication and decision-making happens in the open and is discoverable for future + reference. As much as possible, all discussions and work take place in public + forums and open repositories. + +* Fairness: All stakeholders have the opportunity to provide feedback and submit + contributions, which will be considered on their merits. + +* Community over Product or Company: Sustaining and growing our community takes + priority over shipping code or sponsors' organizational goals. Each + contributor participates in the project as an individual. + +* Inclusivity: We innovate through different perspectives and skill sets, which + can only be accomplished in a welcoming and respectful environment. + +* Participation: Responsibilities within the project are earned through + participation, and there is a clear path up the contributor ladder into leadership + positions. + +## Maintainers + +Bootc Maintainers have "gated" write access to the [project GitHub repository](https://github.com/bootc-dev/bootc). +The current maintainers can be found in [MAINTAINERS.md](./MAINTAINERS.md). + +Direct pushes to the code is never allowed. All pull requests require review by a maintainer +*other* than the one submitting it. "Large" changes are encouraged to have a tracking +issue filed beforehand and gather consensus from multiple maintainers and interested community. + +Maintainers collectively manage the project's resources and contributors. + +This privilege is granted with some expectation of responsibility: maintainers +are people who care about the Bootc project and want to help it grow and +improve. A maintainer is not just someone who can make changes, but someone who +has demonstrated their ability to collaborate with the team, get the most +knowledgeable people to review code and docs, contribute high-quality code, and +follow through to fix issues (in code or tests). + +A maintainer is a contributor to the project's success and a citizen helping +the project succeed. + +The collective team of all Maintainers is known as the Maintainer Council, which +is the governing body for the project. + +### Becoming a Maintainer + +To become a Maintainer you need to demonstrate the following: + + * commitment to the project: + * participate in discussions, contributions, code and documentation reviews for 6 months or more, + * perform reviews for 20 non-trivial pull requests, + * contribute 10 non-trivial pull requests and have them merged, + * ability to write quality code and/or documentation, + * ability to collaborate with the team, + * understanding of how the team works (policies, processes for testing and code review, etc), + * understanding of the project's code base and coding and documentation style. + +A new Maintainer must be proposed by an existing maintainer by opening a PR against the [MAINTAINERS.md](./MAINTAINERS.md), which will prompt a [gitvote](https://github.com/cncf/gitvote). A simple majority vote of existing Maintainers +approves the application. Maintainers nominations will be evaluated without prejudice +to employer or demographics. + +Maintainers who are selected will be granted the necessary GitHub rights. + +### Removing a Maintainer + +Maintainers may resign at any time if they feel that they will not be able to +continue fulfilling their project duties. + +Maintainers may also be removed after being inactive, failure to fulfill their +Maintainer responsibilities, violating the Code of Conduct, or other reasons. +Inactivity is defined as a period of very low or no activity in the project +for a year or more, with no definite schedule to return to full Maintainer +activity. + +A Maintainer may be removed at any time by a 2/3 vote of the remaining maintainers. + +Depending on the reason for removal, a Maintainer may be converted to Emeritus +status. Emeritus Maintainers will still be consulted on some project matters, +and can be rapidly returned to Maintainer status if their availability changes. +This requires two votes from active maintainers. + +## Meetings + +Time zones permitting, Maintainers are expected to participate in the public +developer meeting, which occurs at 15:30 UTC on Fridays via [Zoom](https://zoom-lfx.platform.linuxfoundation.org/meeting/96540875093?password=7889708d-c520-4565-90d3-ce9e253a1f65). + +Maintainers will also have closed meetings in order to discuss security reports +or Code of Conduct violations. Such meetings should be scheduled by any +Maintainer on receipt of a security issue or CoC report. All current Maintainers +must be invited to such closed meetings, except for any Maintainer who is +accused of a CoC violation. + +## CNCF Resources + +Any Maintainer may suggest a request for CNCF resources, either in the +[bootc discussions](https://github.com/bootc-dev/bootc/discussions), or during a +meeting. A simple majority of Maintainers approves the request. The Maintainers +may also choose to delegate working with the CNCF to non-Maintainer community +members, who will then be added to the [CNCF's Maintainer List](https://github.com/cncf/foundation/blob/main/project-maintainers.csv) +for that purpose. + +## Code of Conduct + +[Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md) +violations by community members will be discussed and resolved +by the maintainers privately. If a Maintainer is directly involved +in the report, the Maintainers will instead designate two Maintainers to work +with the CNCF Code of Conduct Committee in resolving it. + +## Security Response Team + +The Maintainers will appoint a Security Response Team to handle security reports. +This committee may simply consist of the Maintainer Council themselves. If this +responsibility is delegated, the Maintainers will appoint a team of at least two +contributors to handle it. The Maintainers will review who is assigned to this +at least once a year. + +The Security Response Team is responsible for handling all reports of security +holes and breaches according to the [security policy](./SECURITY.md). + +## Voting + +While most business in Bootc is conducted by "[lazy consensus](https://community.apache.org/committers/lazyConsensus.html)", +periodically the Maintainers may need to vote on specific actions or changes. +A vote can be taken using [gitvote](https://github.com/cncf/gitvote) or +privately for security or conduct matters. Any Maintainer may demand a vote be taken. + +Most votes require a simple majority of all Maintainers to succeed, except where +otherwise noted. Two-thirds majority votes mean at least two-thirds of all +existing maintainers. + +## Modifying this Charter + +Changes to this Governance and its supporting documents may be approved by +a 2/3 vote of the Maintainers. diff --git a/MAINTAINERS.md b/MAINTAINERS.md new file mode 100644 index 0000000..f0b9f94 --- /dev/null +++ b/MAINTAINERS.md @@ -0,0 +1,23 @@ +# Maintainers + +The current Maintainers Group for the bootc Project consists of: + +| Name | GitHub ID | Employer | Responsibilities | +| ---- | ---- | ---- | ---- | +| Chris Kyrouac | [ckyrouac](https://github.com/orgs/bootc-dev/people/ckyrouac) | Red Hat | Approver | +| Colin Walters | [cgwalters](https://github.com/orgs/bootc-dev/people/cgwalters) | Red Hat | Approver | +| John Eckersberg | [jeckersb](https://github.com/orgs/bootc-dev/people/jeckersb) | Red Hat | Approver | +| Xiaofeng Wang | [henrywang](https://github.com/orgs/bootc-dev/people/henrywang) | Red Hat | Approver | +| Gursewak Mangat | [gursewak1997](https://github.com/orgs/bootc-dev/people/gursewak1997)| Red Hat | Approver | +| Joseph Marrero | [jmarrero](https://github.com/orgs/bootc-dev/people/jmarrero) | Red Hat | Approver | + +# Community Managers + +This group can represent the project for administrative and program manager duties. Examples: CNCF Service Desk tickets, coordinating with CNCF Project and Events teams, and LFX Administration. No code or code review rights. + +| Name | GitHub ID | Employer | Responsibilities | +| ---- | ---- | ---- | ---- | +| Laura Santamaria | [nimbinatus](https://github.com/nimbinatus) | Red Hat | Representative | +| Mohan Shash | [mohan-shash](https://github.com/mohan-shash) | Red Hat | Representative | +| Preethi Thomas | [preethit](https://github.com/preethit) | Red Hat | Representative | +| Mark Russell | [marrusl](https://github.com/marrusl) | Red Hat | Representative | diff --git a/REVIEW.md b/REVIEW.md new file mode 100644 index 0000000..3c1d690 --- /dev/null +++ b/REVIEW.md @@ -0,0 +1,216 @@ +# Code Review Guidelines + +These guidelines are derived from analysis of code reviews across the bootc-dev +organization (October–December 2024). They represent the collective expectations +and standards that have emerged from real review feedback. + +## Testing + +Tests are expected for all non-trivial changes - unit and integration by default. + +If there's something that's difficult to write a test for at the current time, +please do at least state if it was tested manually. + +### Choosing the Right Test Type + +Unit tests are appropriate for parsing logic, data transformations, and +self-contained functions. Use integration tests for anything that involves +running containers or VMs. + +Default to table-driven tests instead of having a separate unit test per +case. Especially LLMs like to generate the latter, but it can become +too verbose. Context windows matter to both humans and LLMs reading the +code later (this applies outside of unit tests too of course, but it's +easy to generate a *lot* of code for unit tests unnecessarily). + +### Separating Parsing from I/O + +A recurring theme is structuring code for testability. Split parsers from data +reading: have the parser accept a `&str`, then have a separate function that +reads from disk and calls the parser. This makes unit testing straightforward +without filesystem dependencies. + +### Test Assertions + +Make assertions strict and specific. Don't just verify that code "didn't crash"— +check that outputs match expected values. When adding new commands or output +formats, tests should verify the actual content, not just that something was +produced. + +## Code Quality + +### Parsing Structured Data + +Never parse structured data formats (JSON, YAML, XML) with text tools like `grep` +or `sed`. + +### Shell Scripts + +Try to avoid having shell script longer than 50 lines. This commonly occurs +in build system and tests. For the build system, usually there's higher +level ways to structure things (Justfile e.g.) and several of our projects +use the `cargo xtask` pattern to put arbitrary "glue" code in Rust using +the `xshell` crate to keep it easy to run external commands. + +### Constants and Magic Values + +Extract magic numbers into named constants. Any literal number that isn't +immediately obvious—buffer sizes, queue lengths, retry counts, timeouts—should +be a constant with a descriptive name. The same applies to magic strings: +deduplicate repeated paths, configuration keys, and other string literals. + +When values aren't self-explanatory, add a comment explaining why that specific +value was chosen. + +### Don't ignore (swallow) errors + +Avoid the `if let Ok(v) = ... { }` in Rust, or `foo 2>/dev/null || true` +pattern in shell script by default. Most errors should be propagated by +default. If not, it's usually appropriate to at least log error messages +at a `tracing::debug!` or equivalent level. + +Handle edge cases explicitly: missing data, malformed input, offline systems. +Error messages should provide clear context for diagnosis. + +### Code Organization + +Separate concerns: I/O operations, parsing logic, and business logic belong in +different functions. Structure code so core logic can be unit tested without +external dependencies. + +It can be OK to duplicate a bit of code in a slightly different form twice, +but having it happen in 3 places asks for deduplication. + +## Commits and Pull Requests + +### Commit Organization + +Break changes into logical, atomic commits. Reviewers appreciate being able to +follow your reasoning: "Especially grateful for breaking it up into individual +commits so I can more easily follow your train of thought." + +Preparatory refactoring should be separate from behavioral changes. Each commit +should tell a clear story and be reviewable independently. Where applicable, +create "prep" commits that could be merged separately from the behavioral change. + +### Commit Messages + +Write clear and descriptive commit messages using a `component: Summary` +subject, such as `kernel: Add find API w/correct hyphen-dash equality, add docs`. +Use imperative mood: "Add integration with..." not "Adds integration with...". + +The body of the commit should start with at least one sentence (or paragraph) +describing **why** the change is being made, even for something apparently +trivial. For example a "refactor" commit might have a "why" rationale of just +"Prep for handling X later." A big commit introducing a feature may seem +self-explanatory, but there is often ambient context like "A large-scale Debian +user wanted this" that provides helpful grounding in the motivation. + +If there's a linked tracking issue, often that will contain a more extensive +rationale that doesn't need to be duplicated entirely in the commit message, +but do ensure the commit message has something useful on its own for a rationale. + +Keep it natural and concise. A few sentences of prose explaining the design +intent or the high-level data flow is often good enough. If there's a +non-obvious consequence of the change, call it out briefly (e.g. "Note the +manifest becomes part of the GC root") rather than explaining the full +mechanism. Think about what a reviewer needs to know that may not be obvious +from a skim of the code. + +Do not restate obvious parts of what is already visible in the commit diff: + +- "Changed function X to call Y" +- Generic `Changes:` sections with bulleted lists of implementation details +- "Files changed" sections — completely redundant with git + +Implementation details belong in the code documentation. The goal of the +commit message is like a "cover letter" for the change, with a primary +rationale of why the change is being made, alongside a concise summary of +its implementation. + +Another thing that can go in the commit message is brief descriptions +of alternative approaches that were considered and discarded. + +Closes: tags should generally come at the end of the commit message. + +### PR Descriptions + +Generally, just restate the commit message. + +Where it makes sense, it is OK to include additional details though. + +### Further changes on top of existing commits + +If you have followup fixes (whether that's part of a local loop or +as part of addressing PR review), it is generally encouraged to *squash* +the fixes into the prior commit. Do not create generically-named "Update " commits +or "Address review feedback" or "Fix cargo fmt" commits. + +This applies equally when an AI tool (e.g. Gemini, Copilot) suggests a +change via a review comment — applying the suggestion creates a new commit +with an auto-generated subject. That commit should be squashed before the +PR is merged. + +In other words either a commit "stands alone" with its own rationale or it doesn't. + +### Keeping PRs Current + +Keep PRs rebased on main. When CI failures are fixed in other PRs, rebase to +pick up the fixes. Reference the fixing PR when noting that a rebase is needed. + +### Before Merge + +Self-review your diff before requesting review. Catch obvious issues yourself +rather than burning reviewer cycles. + +Do not add `Signed-off-by` lines automatically—these require explicit human +action after review. If code was AI-assisted, include an `Assisted-by:` trailer +indicating the tool and model used. + +## Architecture and Design + +### Workarounds vs Proper Fixes + +When implementing a workaround, document where the proper fix belongs and link +to relevant upstream issues. Invest time investigating proper fixes before +settling on workarounds. + +### Cross-Project Considerations + +Prefer pushing fixes upstream when the root cause is in a dependency. Reduce +scope where possible; don't reimplement functionality that belongs elsewhere. + +When multiple systems interact (like Renovate and custom sync tooling), be +explicit about which system owns what and how they coordinate. + +### Avoiding Regressions + +Verify that new code paths handle all cases the old code handled. When rewriting +functionality, ensure equivalent coverage exists. + +### Review Requirements + +When multiple contributors co-author a PR, bring in an independent reviewer. + +## Rust-Specific Guidance + +Prefer rustix over `libc`. All `unsafe` code must be very carefully +justified. + +### Dependencies + +New dependencies should be justified. Glance at existing reverse dependencies +on crates.io to see if a crate is widely used. Consider alternatives: "I'm +curious if you did any comparative analysis at all with alternatives?" + +Prefer well-maintained crates with active communities. Consider `cargo deny` +policies when adding dependencies. + +### API Design + +When adding new commands or options, think about machine-readable output early. +JSON is generally preferred for that. + +Keep helper functions in appropriate modules. Move command output formatting +close to the CLI layer, keeping core logic functions focused on their primary +purpose. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..63d3e04 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,19 @@ +# Security Policy + +## Reporting a Vulnerability + +If you find a potential security vulnerability in bootc, please report it by following these steps: + +### 1. **Use the GitHub Security Tab** +This repository is set up to allow vulnerability reports through GitHub's Security Advisories feature. To report a vulnerability: + +1. Navigate to the repository's main page. +2. Select the [**Security**](https://github.com/bootc-dev/bootc/security) tab. +3. Select **Advisories** from the left-hand sidebar. +4. Click on **Report a vulnerability**. +5. Fill in the required details and submit the report. + +Following this process will create a private advisory for our maintainers to review. + +### 2. **Do Not Open Public Pull Requests, Issues, or Discussions** +Please **do not** discuss the issue, create PRs, or start discussions about the vulnerability. This ensures the vulnerability is not widely exploited before a fix is provided.