Pass sysroot through updates

src/backend/statefile.rs

@@ -87,7 +87,7 @@ impl SavedState {
 /// Write-lock guard for statefile, protecting against concurrent state updates.
 #[derive(Debug)]
 pub(crate) struct StateLockGuard {
-    sysroot: openat::Dir,
+    pub(crate) sysroot: openat::Dir,
     lockfile: Option<File>,
 }
 

src/bootupd.rs

@@ -110,15 +110,14 @@ pub(crate) fn update(name: &str) -> Result<ComponentUpdateResult> {
     let mut pending_container = state.pending.take().unwrap_or_default();
     let interrupted = pending_container.get(component.name()).cloned();
     pending_container.insert(component.name().into(), update.clone());
-    let sysroot = openat::Dir::open("/")?;
-    let mut state_guard =
-        SavedState::acquire_write_lock(sysroot).context("Failed to acquire write lock")?;
+    let mut state_guard = SavedState::acquire_write_lock(openat::Dir::open("/")?)
+        .context("Failed to acquire write lock")?;
     state_guard
         .update_state(&state)
         .context("Failed to update state")?;
 
     let newinst = component
-        .run_update(&inst)
+        .run_update(&state_guard.sysroot, &inst)
         .with_context(|| format!("Failed to update {}", component.name()))?;
     state.installed.insert(component.name().into(), newinst);
     pending_container.remove(component.name());

src/component.rs

@@ -52,7 +52,11 @@ pub(crate) trait Component {
     fn query_update(&self) -> Result<Option<ContentMetadata>>;
 
     /// Used on the client to run an update.
-    fn run_update(&self, current: &InstalledContent) -> Result<InstalledContent>;
+    fn run_update(
+        &self,
+        sysroot: &openat::Dir,
+        current: &InstalledContent,
+    ) -> Result<InstalledContent>;
 
     /// Used on the client to validate an installed version.
     fn validate(&self, current: &InstalledContent) -> Result<ValidationResult>;
@@ -67,12 +71,16 @@ pub(crate) fn new_from_name(name: &str) -> Result<Box<dyn Component>> {
     Ok(r)
 }
 
+/// Returns the path to the payload directory for an available update for
+/// a component.
+pub(crate) fn component_updatedirname(component: &dyn Component) -> PathBuf {
+    Path::new(BOOTUPD_UPDATES_DIR).join(component.name())
+}
+
 /// Returns the path to the payload directory for an available update for
 /// a component.
 pub(crate) fn component_updatedir(sysroot: &str, component: &dyn Component) -> PathBuf {
-    Path::new(sysroot)
-        .join(BOOTUPD_UPDATES_DIR)
-        .join(component.name())
+    Path::new(sysroot).join(component_updatedirname(component))
 }
 
 /// Returns the name of the JSON file containing a component's available update metadata installed

src/efi.rs

@@ -128,14 +128,19 @@ impl Component for EFI {
         })
     }
 
-    fn run_update(&self, current: &InstalledContent) -> Result<InstalledContent> {
+    fn run_update(
+        &self,
+        sysroot: &openat::Dir,
+        current: &InstalledContent,
+    ) -> Result<InstalledContent> {
         let currentf = current
             .filetree
             .as_ref()
             .ok_or_else(|| anyhow::anyhow!("No filetree for installed EFI found!"))?;
         let updatemeta = self.query_update()?.expect("update available");
-        let updated =
-            openat::Dir::open(&component_updatedir("/", self)).context("opening update dir")?;
+        let updated = sysroot
+            .sub_dir(&component_updatedirname(self))
+            .context("opening update dir")?;
         let updatef = filetree::FileTree::new_from_dir(&updated).context("reading update dir")?;
         let diff = currentf.diff(&updatef)?;
         let destdir = openat::Dir::open(&Path::new("/").join(MOUNT_PATH).join("EFI"))