install: Reject a config stateroot on composefs-only images

The composefs backend only uses the `default` stateroot. #2544 made
`--stateroot` fail with it and left a stateroot from the install
configuration unchecked, since an image may set one for its ostree
installs. An image that ships a UKI, or selects composefs itself with
no ostree prepare-root.conf, can't be installed with ostree, so its
configured stateroot was always ignored and the install still landed
in `default`.

Check the configured stateroot for those images too, unless
`--stateroot` is passed. With `--composefs-backend` on an image that
can also be installed with ostree, it's still ignored.

Assisted-by: AI
Signed-off-by: Andrew Dunn <andrew@dunn.dev>

Author: andrewdunndev

crates/lib/src/install.rs

@@ -438,10 +438,13 @@ pub(crate) struct InstallComposefsOpts {
 impl InstallComposefsOpts {
     /// Check that the options fit together, once `composefs_backend` says
     /// whether the composefs backend is used (passed, or selected by the image).
+    /// `config_stateroot` comes from the install configuration; the caller
+    /// passes `None` when `--stateroot` overrides it.
     pub(crate) fn validate(
         &self,
         bootloader: Option<&Bootloader>,
         stateroot: Option<&str>,
+        config_stateroot: Option<&str>,
     ) -> Result<()> {
         if self.composefs_backend {
             let default = ostree_container::deploy::STATEROOT_DEFAULT;
@@ -450,6 +453,11 @@ impl InstallComposefsOpts {
                     "--stateroot {stateroot} is not supported with the composefs backend, which only uses {default}"
                 );
             }
+            if let Some(stateroot) = config_stateroot.filter(|&s| s != default) {
+                anyhow::bail!(
+                    "stateroot {stateroot} in the install configuration is not supported with the composefs backend, which only uses {default}"
+                );
+            }
         } else {
             anyhow::ensure!(
                 !matches!(bootloader, Some(Bootloader::Ukiboot)),
@@ -1869,9 +1877,17 @@ async fn prepare_install(
     )?;
     tracing::debug!("Composefs default: {composefs_default}");
     composefs_options.composefs_backend |= composefs_required || composefs_default;
+    // An image may set a stateroot in its install configuration for its ostree
+    // installs, so only check it when the image can't be installed with ostree.
+    let config_stateroot = install_config
+        .as_ref()
+        .and_then(|c| c.stateroot.as_deref())
+        .filter(|_| config_opts.stateroot.is_none())
+        .filter(|_| composefs_required || composefs_default);
     composefs_options.validate(
         config_opts.bootloader.as_ref(),
         config_opts.stateroot.as_deref(),
+        config_stateroot,
     )?;
 
     composefs_options.validate_bound_images(config_opts.bound_images, &rootfs)?;
@@ -3284,7 +3300,7 @@ mod tests {
                 },
             };
             assert_eq!(
-                opts.validate(bootloader.as_ref(), stateroot).is_ok(),
+                opts.validate(bootloader.as_ref(), stateroot, None).is_ok(),
                 valid,
                 "{opts:?} {bootloader:?} {stateroot:?}"
             );
@@ -3295,9 +3311,24 @@ mod tests {
             ..Default::default()
         };
         assert_eq!(
-            opts.validate(None, Some("myroot")).unwrap_err().to_string(),
+            opts.validate(None, Some("myroot"), None)
+                .unwrap_err()
+                .to_string(),
             "--stateroot myroot is not supported with the composefs backend, which only uses default"
         );
+
+        assert!(opts.validate(None, None, Some("default")).is_ok());
+        assert!(
+            InstallComposefsOpts::default()
+                .validate(None, None, Some("myroot"))
+                .is_ok()
+        );
+        assert_eq!(
+            opts.validate(None, None, Some("myroot"))
+                .unwrap_err()
+                .to_string(),
+            "stateroot myroot in the install configuration is not supported with the composefs backend, which only uses default"
+        );
     }
 
     #[test]