From ac6debd01207672dee767c050d4c3c028bf5bf38 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 4 Sep 2026 07:47:24 +0200 Subject: [PATCH] sysupdate: accept provider: URLs in transfer sources Since systemd-pull now understands "provider:[/path/to/socket]/name" URLs, allow them in the Path= setting of url-file and url-tar sources, wherever HTTP/HTTPS URLs are accepted. Manifests and payloads are then acquired from the specified io.systemd.ResourceProvider service, with the same verification as for web servers. Document the scheme, and how component providers can use it to serve their own resources. Fixes: #33351 --- man/sysupdate.components.xml | 9 +++++++++ man/sysupdate.d.xml | 26 +++++++++++++++++++++----- src/sysupdate/sysupdate-transfer.c | 4 ++-- 3 files changed, 32 insertions(+), 7 deletions(-) diff --git a/man/sysupdate.components.xml b/man/sysupdate.components.xml index c4897cddeaf..38b68044279 100644 --- a/man/sysupdate.components.xml +++ b/man/sysupdate.components.xml @@ -376,6 +376,15 @@ SuggestOnVirtualization=!vm message is logged. The default component (i.e. sysupdate.d/) is always taken from the file system. + Instead of pointing its transfers to resources on a web server, a provider may also serve these + resources itself. In that case, it must implement the generic + io.systemd.ResourceProvider Varlink interface (typically on the same socket), and + use URLs of the form + provider:[/run/systemd/sysupdate/provider/name]/resource + in the Path= field of the sources of its transfers, see + sysupdate.d5 for + details. + Since the definitions of provider-backed components do not live in the file system, the enable-component, disable-component, enable-feature and disable-feature commands of diff --git a/man/sysupdate.d.xml b/man/sysupdate.d.xml index 4b79e261640..65c9afffbdd 100644 --- a/man/sysupdate.d.xml +++ b/man/sysupdate.d.xml @@ -167,11 +167,12 @@ Resources of type url-file encapsulate a file on a web server, - referenced via a HTTP or HTTPS URL. When an update takes place, the file is downloaded and decompressed - and then written to the target file or partition. This resource type is only available for sources, not - for targets. The list of available versions of resources of this type is encoded in - SHA256SUMS manifest files, accompanied by - SHA256SUMS.gpg detached signatures. + referenced via a HTTP or HTTPS URL, or a resource offered by a local resource provider service, + referenced via a provider: URL (see Path= below). When an update + takes place, the file is downloaded and decompressed and then written to the target file or + partition. This resource type is only available for sources, not for targets. The list of available + versions of resources of this type is encoded in SHA256SUMS manifest files, + accompanied by SHA256SUMS.gpg detached signatures. The url-tar resource type is similar, but the file must be a .tar archive. When an update takes place, the file is decompressed and unpacked @@ -639,6 +640,21 @@ names listed in the manifest file in case an update is executed and a resource shall be downloaded. + Alternatively, for these two source types a URL of the form + provider:[socket]/resource + may be specified, which refers to a resource offered by a local service implementing the + io.systemd.ResourceProvider Varlink interface on the + AF_UNIX socket socket (an absolute path). The + resource part is an opaque name the service understands, which may contain + slashes, but no . or .. components. Such URLs are suffixed and + otherwise treated exactly like HTTP/HTTPS URLs: /SHA256SUMS, + /SHA256SUMS.gpg and the file names from the manifest are appended to the + resource part and requested from the service via that interface. + Verification hence works the same way as for HTTP/HTTPS sources; in particular + Verify=yes requires the service to offer the signature file too. This is + primarily useful in combination with component providers, see + sysupdate.components5. + For all other source resource types this must be a local path in the file system, referring to a local directory to find the versions of this resource in. diff --git a/src/sysupdate/sysupdate-transfer.c b/src/sysupdate/sysupdate-transfer.c index 0550a0b6f63..a998690f0eb 100644 --- a/src/sysupdate/sysupdate-transfer.c +++ b/src/sysupdate/sysupdate-transfer.c @@ -603,9 +603,9 @@ static int transfer_finalize(Transfer *t, const char *origin, unsigned line, Has * sources. That's mostly for testing, since it relieves us from having to set up a HTTP * server, and CURL abstracts this away from us thankfully. */ if (RESOURCE_IS_URL(t->source.type)) - if (!http_url_is_valid(t->source.path) && !file_url_is_valid(t->source.path)) + if (!http_url_is_valid(t->source.path) && !file_url_is_valid(t->source.path) && !provider_url_is_valid(t->source.path)) return log_syntax(NULL, LOG_ERR, origin, line, SYNTHETIC_ERRNO(EINVAL), - "Source path is not a valid HTTP or HTTPS URL: %s", t->source.path); + "Source path is not a valid HTTP, HTTPS, file, or provider URL: %s", t->source.path); } if (strv_isempty(t->source.patterns))