core: Always sort incoming xattrs

[cgwalters]

When recomputing selinux attrs during commit, we weren't sorting, which could cause various issues like fsck failures.

This is a big hammer; change things so we always canonicalize (i.e. sort) the incoming xattrs when creating a file header.

I think almost all places in the code were already keeping things sorted, but it's better to ensure correctness first. If we ever have some performance issue (I'm doubtful) we could add something like _ostree_file_header_known_canonicalized or so.

Closes: #3343

[cgwalters]

And I also verified that this test successfully fails if we drop the xattr canonicalization.

[prydom]

I get the following error when pulling an image into ostree layered on top of quay.io/fedora/fedora-kinoite. It has user.* xattrs in the container tar stream.

2024-11-27T18:39:25.0514353Z layers already present: 0; layers needed: 89 (4.5 GB)
2024-11-27T18:40:54.5755174Z error: Importing: Parsing layer blob sha256:4c7aee33c4535de34dfdde394e64174d0177144339e7d35846be7ce1663722f4: error: ostree-tar: Failed to handle directory: Incorrectly sorted xattr name, index=2: Processing tar: Failed to commit tar: ExitStatus(unix_wait_status(256))

EDIT: If you want to see the CI job, it is here: https://github.com/prydom/my-ostree-build/actions/runs/12056266866/job/33618838686. The build container has ostree and ostree-libs build from commit 2be4c52.

[cgwalters]

Thanks for testing this out! I pushed an update that also covers directory metadata - only unit tested here so far.

[prydom]

I've done another round of end-to-end testing and the changes work well for me.

On github actions:

• Updated ostree-libs to c863558 on CI build container.
• Built multiple layers upon upstream bootable container image which introduced the librepo extended attributes in tar stream.
• Pulled container image into empty bare ostree repository (this step is what failed earlier)
• Checked out image with ostree, made some further changes that are not appropriate to do with image layering
• Checked image back into new ostree ref and used --selinux-policy= to relabel based on policy in image
• Ran rpm-ostree compose container-encapsulate to re-encapsulate commit as image and upload to registry

In podman on dev machine:

• Added an additional container image layer with even more extended attributes. Signed & uploaded to registry.
• In build container (same as CI) with updated ostree, created empty bare-user repo. Pulled image into repo. ostree fsck passes.
• Run ostree fsck on the sysroot in the container created from new image (bare-split-xattrs). Passes.

On target machine:

• Used bootc to switch/rebase to new image. Existing host with bootc and the new image does not have updated ostree library. Image pulls successfully.
• Booted into staged image successfully.
• Confirmed that introduced user xattrs are preserved.
• ostree fsck run from the booted image on sysroot fails on files that have user xattrs. This is because the ostree library hasn't been updated in the image.
• Activate usr-overlay, install rpms with ostree and ostree-libs from this PR, create new bare repo, pull container into fresh repo and ostree fsck passes.

[cgwalters]

OK, updated this one, should be good to go!