Add support for building an overlay RPM

[jlebon]

This patch adds support for an overlay RPM defined by a rootfs in the
source repo at overlay/. Unlike FAH, FCOS is much more opinionated
about various things. And these opinions express themselves through e.g.
config file overlays, systemd units, Ignition base configs, etc... These
files don't clearly belong in any particular "component" package, but
rather provide the glue that makes FCOS feel like FCOS. This is similar
to CL's init package.

Right now, a lot of these files are just written out as part of the
postprocess script in the treefile. Splitting them out has the major
benefit of being able to track them in the rpmdb so one actually knows
where they come from. It'd also mean a cleaner manifest and easier
hacking on those files and tracking in git.

We can probably teach rpm-ostree to do this directly later on and
deprecate/automatically translate add-files along with it.

[jlebon]

Used by: coreos/fedora-coreos-config#66
Related: coreos/rpm-ostree#1788

[cgwalters]

This is OK by me and makes sense to do now, but I also think the (inherent, not your fault!) ugliness of building RPMs is a strong argument for 1788.

[ajeddeloh]

What's the plan for handling setting permissions? It probably makes sense to allow relaxed privilege on the files themselves (so you don't need root to edit) but changing them when building the rpm to what they should be on the system.

[cgwalters]

changing them when building the rpm to what they should be on the system.

rpm defaults to files being owned by root, even when building as a non-root user.

[ajeddeloh]

rpm defaults to files being owned by root, even when building as a non-root user.

What about mode?

[jlebon]

OK, dropped WIP on this!

What about mode?

git records file mode. The only bits that we'd need manual intervention for are non-root file ownership or file caps. I don't think it's likely we'll hit these for the targeted use case, but if we do we can specify them in the %files section.

[jlebon]

See examples in https://github.com/projectatomic/rpm-ostree/blob/31569c55bc1de727ca2c5fb886ac4db44b03a398/tests/vmcheck/test-layering-non-root-caps.sh#L49.

[jlebon]

What about mode?

git records file mode

OK, that's not entirely correct. It looks like it only records the owner executable bit on files:

$ ls -ld CONTRIBUTING.md src/
-rw-rw-r--. 1 jlebon jlebon 3863 Mar  6 09:56 CONTRIBUTING.md
drwxrwxr-x. 3 jlebon jlebon 4096 Mar 19 16:28 src/
$ chmod 777 src CONTRIBUTING.md
$ git diff
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
old mode 100644
new mode 100755

So I guess any other mode bits we'd have to record through %attr as well.

[cgwalters]

One thing this will likely trip is the "all rpms in rpmdb are signed" thing but...eh, we can change that to lie later 😉

LGTM!

[jlebon]

Thanks! Any other comments on this one?

[jlebon]

Follow-up in #555 to switch to use an OSTree layer.