Add containerd patch to handle dmverity referrers

[Dallas Delaney (dallasd1)]

Summary

Patch containerd to be able to discover dmverity OCI referrers if new config option enable_dmverity_referrers is present. This patch represents changes to support this in the CRI, transfer service, unpacker, differ, snapshotter, and mount paths.

Tests have intentionally been stripped from this patch to reduce its size.

Additions

• Discover and fetch signed dm-verity referrers if they are present. The transfer service discovers referrers with artifactType application/vnd.containerd.erofs.dmverity.v1 for an image manifest and stores its per-layer EROFS metadata, Merkle tree, and detached PKCS#7 root-hash signature in the content store.
• Update the container resolver to identify parent snapshots that have a signed ChainID key
• Keep signed and unsigned snapshots independent of each other. Unsigned snapshots are unchanged. They retain pre-existing OCI ChainID keys. Signed snapshots use a separate key appended with "-dmverity". Images sharing layers can therefore use either key without replacing snapshots underneath existing containers.
• Reuse cached signed snapshots. Signed cache hits from snapshot key IDs and concurrent snapshot commits are checked against the root-hash label identity before reuse.
• Fetch without unpacking to allow AgentBaker to precache images without going through the transfer service. When the snapshotter advertises dm-verity-referrer support, transfer fetch-only requests retain the dmverity bundle and its payloads without creating snapshots.
• Create containers offline from a complete cache. If referrer data was fetched without unpacking, CRI can reconstruct signed materializations from retained image content and referrer artifacts without contacting the registry.
• Preserve ordinary paths. OverlayFS unpack remains unchanged.
• With EROFS in auto mode, images without a dmverity referrer continue through ordinary unsigned materialization.
• During FS mount, the kernel verifies the root-hash signature against its trusted keyrings. During container runtime, dm-verity checks reads against the Merkle tree.
• Setting config option enable_dmverity_referrers indicates the snapshotter is capable of referrer fetching. The snapshotter will materialize the published artifacts alongside the original layer tar data.

Limitations and Prerequisites

• This is an opt-in feature. Signed referrer execution requires enable_dmverity_referrers  enabled in the config, a compatible dm-verity mode, and the required kernel support.
• There must only be one dmverity referrer per image manifest. Multiple distinct referrers are rejected. There is no newest-referrer selection. This would require replacing ignoring cached snapshotter metadata and always replacing signatures, even for layers that haven't changed.
• Signed Kubernetes image volumes are unsupported. CRI rejects them on dm-verity-capable snapshotters instead of silently unpacking them unsigned. This restriction does not apply to ordinary OverlayFS volumes.
• Legacy client paths are not automatically integrated. The supported integration is in the transfer service plus CRI. Direct client Fetch() and ordinary client unpack/snapshot calls do not automatically exercise behavior.

PR that will invoke this behavior when IPE is enabled: #98

Change Log

• Add containerd patch based on three containerd functionality PRs

Type of Change

• Image build change (base image, sysexts, OEM images)
• Package/SPEC update
• CI/automation change
• SDK/toolchain update
• Configuration change
• Documentation update
• Bug fix

Does this affect the image build?

• Yes
• No

Associated Issues

Test Methodology

• Test details: The tests in acl-pipelines pass, the AKS e2e tests all pass, local validation of non-IPE OverlayFS and IPE EROFS behavior was tested and with containerd configurations examined for expected values.

Merge Checklist

All applicable boxes should be checked before merging

• Image builds successfully with this change (or image build is not affected)
• Any updated packages/SPECs build successfully
• Relevant kola tests pass
• All package sources are available
• Source files have up-to-date hashes/manifests
• Documentation has been updated to match any changes
• Ready to merge

[Copilot]

🟡 Changes recommended

The security-critical referrer discovery and validation pipeline lacks focused automated tests.

1 open finding

• Add unit tests for referrer discovery and validation paths · New

What changed in this PR

Adds opt-in signed dm-verity referrer support to containerd’s EROFS snapshotter and CRI integration.

Changes:

• Discovers, caches, validates, and materializes signed dm-verity artifacts.
• Separates signed and unsigned snapshot identities and supports offline reuse.
• Enables the patch in the containerd2 RPM.

File	Description
acl/​SPECS/​containerd2/​erofs-signed-dmverity.patch	Implements signed referrer handling across transfer, CRI, unpack, EROFS, and dm-verity paths.
acl/​SPECS/​containerd2/​containerd2.spec	Applies the patch and increments the package release.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.