sysext: add verity boilerplate

diff --git a/src/sysext/sysext.c b/src/sysext/sysext.c
index ea307dc1d69305b251c7a5bc84579e480b8e76e8..c12f40c160da507d5e529110e9f49ce681f40a9b 100644 (file)
--- a/src/sysext/sysext.c
+++ b/src/sysext/sysext.c
@@ -470,8 +470,16 @@ static int merge_subprocess(Hashmap *images, const char *workspace) {
                         _cleanup_(dissected_image_unrefp) DissectedImage *m = NULL;
                         _cleanup_(loop_device_unrefp) LoopDevice *d = NULL;
                         _cleanup_(decrypted_image_unrefp) DecryptedImage *di = NULL;
+                        _cleanup_(verity_settings_done) VeritySettings verity_settings = VERITY_SETTINGS_DEFAULT;
                         DissectImageFlags flags = DISSECT_IMAGE_READ_ONLY|DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_MOUNT_ROOT_ONLY;
 
+                        r = verity_settings_load(&verity_settings, img->path, NULL, NULL);
+                        if (r < 0)
+                                return log_error_errno(r, "Failed to read verity artifacts for %s: %m", img->path);
+
+                        if (verity_settings.data_path)
+                                flags |= DISSECT_IMAGE_NO_PARTITION_TABLE;
+
                         r = loop_device_make_by_path(img->path, O_RDONLY, 0, &d);
                         if (r < 0)
                                 return log_error_errno(r, "Failed to set up loopback device: %m");
@@ -479,7 +487,7 @@ static int merge_subprocess(Hashmap *images, const char *workspace) {
                         r = dissect_image_and_warn(
                                         d->fd,
                                         img->path,
-                                        NULL,
+                                        &verity_settings,
                                         NULL,
                                         flags,
                                         &m);
@@ -488,7 +496,7 @@ static int merge_subprocess(Hashmap *images, const char *workspace) {
 
                         r = dissected_image_decrypt_interactively(
                                         m, NULL,
-                                        NULL,
+                                        &verity_settings,
                                         flags,
                                         &di);
                         if (r < 0)