cmd-build: Enable composeFS signing

[jbtrystram]

This is a first draft trying to implement a signed composeFS build following the steps in https://ostreedev.github.io/ostree/composefs/#signatures

Right now the ostree container image deploy step fails with :
error: Reading composefs config: Loading composefs config: Invalid tri-state value: signed

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[jbtrystram]

This should probably be

Suggested change

	echo $PUBKEY > ${workdir}/overrides/rootfs/etc/ostree/initramfs-root-binding.key
	mkdir -p ${workdir}/overrides/initramfs/etc/ostree
	echo $PUBKEY > ${workdir}/overrides/initramfs/etc/ostree/initramfs-root-binding.key

[cgwalters]

I think this would make sense to do after rebasing FCOS on bootc i.e. after coreos/fedora-coreos-tracker#1726 as that would help drive code and build system sharing more. I filed https://gitlab.com/fedora/bootc/tracker/-/issues/14 specifically related to this.

[jlebon]

See also discussions in https://gitlab.com/fedora/bootc/tracker/-/issues/2.

[jbtrystram]

edit : mistake on my side: I forgot to pop a git stash entry and was building with composeFS enabled on but not signed. I am unable to get the needed rpm-ostree change in a cosa container to make the build complete

After building rpm-ostree manually with a an ostree-rs-ext fix i was able to build and boot fedora coreOS rawhide with the composeFS signed.

I also set composefs: true in cosa's src/image-defaults for good measure, but I am not sure it's needed, as my previous experiments worked without.

Some further notes :
the resulted deployed system don't use the signature still :

• I can mount /dev/vda4 /sysroot --options remount,rw and change files just fine.
• Running ostree config set ex-integrity.composefs signed results in error: opening repo: Invalid tri-state value: signed