API to GET/POST pipeline/manifest

[champtar]

Hi All,

Blueprints lacks a lot of customisation options.
It would be nice to be able to just dump the pipeline/manifest generated by say composer-cli compose start-ostree --url http://10.1.2.3/repo/ test1 edge-installer (or edge-commit), tune everything we want in it, like:

• remove some default packages / services
• change iso filename
• change product and version (in BuildstampStageOptions)
• change isolabel
• change efi vendor to the distro name
• change the repos
• ...

and submit it back to weldr so it can be built.
Right now I'm building CentOS 8.4 rhel-edge-commit & rhel-edge-installer by patching and rebuilding osbuild-composer, and it would be nice to have 'full access' for use cases not available via blueprints.

[teg]

There are two main reasons we don't support this, and are unlikely to add support for it in the near future:

• We would need a different trust model if we were to allow people to submit "arbitrary manifests" rather than "manifests generated from blueprints". The latter we know are "safe" to build, whereas the former could be fairly easily exploited to do basically anything as root on the host machine.
• Images built from arbitrary manifests are fundamentally not supportable (they could be broken in all kinds of ways we could not control), but images built from blueprints should be supportable and issues with them would be bugs we should fix.

We do want to make it easily to use osbuild directly though, so you can experiment more easily, but we should make it clear what that means in terms of supportability and security, and make a clear distinction between what you can build through the official image builder APIs, and what you do manually using developer tools.

[champtar]

For the supportability having a meta rpm package with all minimum required packages could do the trick, and kickstart install allow you to do anything, why not osbuild-composer installs ;)
For the security it indeed makes things complicated, it could be an option "trust the client".
I've since this post switched to rpm-ostree compose as I really needed the flexibilty.

[ondrejbudai]

osbuild-composer is already able to dump the manifest for an image. When you have the manifest, you can manually tweak it and then build directly using osbuild.

I get the point that osbuild-composer should have more customization options but these take quite a long time to properly implement and test.

[champtar]

Nice, do you have the exact command handy ? (else I'll look for them)

[ondrejbudai]

Try composer-cli compose metadata