examples: Pass --hash sha256 to unified examples

[Johan-Liebert1]

Remove /var/lib/systemd/random-seed to prevent user. xattr diff
between dumpfile created from mounted fs and oci container

Also update to use fedora 43 for tests

[Johan-Liebert1]

Weird, hash computed from

RUN --mount=type=bind,from=base,target=/mnt/base <<EOF
    set -eux
    mkdir -p /tmp/sysroot/composefs
    COMPOSEFS_FSVERITY="$(cfsctl --repo /tmp/sysroot --hash sha256 compute-id --bootable /mnt/base)"
EOF

seems to mismatch hash computed from containers-storage

[Johan-Liebert1]

I thought it was because of #209, but I guess not. Will need to debug it a bit more

[cgwalters]

Since this is a bootable digest we should not have --no-propagate-usr-to-root - why did you add it?

[Johan-Liebert1]

this example was failing without this change as well; I thought maybe this was the issue

[Johan-Liebert1]

Okay the issue seems to be the following xattr diff

30263c30263
< /var/lib/systemd/random-seed 32 100600 1 0 0 0 1769000852.0 - \x10\x93\x81.\xa8\xae\xc7\xcbvxB9h\x86O\xca~m\xaa\xc4\xca\xfb?\xb1\xab\xda^N\xf6\xe3\xd2\xf3 - security.selinux=system_u:object_r:random_seed_t:s0 user.random-seed-creditable=1
---
> /var/lib/systemd/random-seed 32 100600 1 0 0 0 1769000852.0 - \x10\x93\x81.\xa8\xae\xc7\xcbvxB9h\x86O\xca~m\xaa\xc4\xca\xfb?\xb1\xab\xda^N\xf6\xe3\xd2\xf3 - security.selinux=system_u:object_r:random_seed_t:s0

[Johan-Liebert1]

I think the we need the xattr filter on the Oci subcommands as well

[cgwalters]

Ah hah! This is an interesting and relevant use of xattrs. I think in this case though, the correct thing is to delete that file at build time. It doesn't make any sense to include the random seed in images (especially generic base images).

This filtering is part of the bootc-base-imagectl builder for example, and bootc container lint also emits warnings about these things.

Bigger picture I think we will need to carefully balance the "show that composefs-rs (for bootable systems) can in theory be used outside of bootc" with "don't duplicate too much work".

Anyways basically I suggest rm -vf /var/lib/systemd/random-seed

[cgwalters]

I think the we need the xattr filter on the Oci subcommands as well

But yes this too

[Johan-Liebert1]

Anyways basically I suggest rm -vf /var/lib/systemd/random-seed

This sounds good a temp measure, but yeah we'll need the filter on all commands that do anything with filesystem

[cgwalters]

Nice!