https://www.scrivano.org/tags/fs-verity/ Recent content in Fs-Verity on *scratch* Hugo en Fri, 10 Jul 2026 10:41:24 +0200 https://www.scrivano.org/posts/2026-06-05-sealing-with-composefs/ Fri, 05 Jun 2026 08:00:00 +0000 https://www.scrivano.org/posts/2026-06-05-sealing-with-composefs/ <p>Composefs achieves whole-filesystem integrity verification through <em>image sealing</em>: a single cryptographic digest authenticates an entire filesystem, covering both file contents and metadata (directory structure, permissions, ownership, symlinks, and xattrs). This goes further than fs-verity alone, which can only verify individual file contents, and avoids the fixed-partition requirement of dm-verity. The mechanism combines an EROFS image for metadata, a content-addressed object store for file data, and overlayfs with <code>verity=require</code> to enforce integrity checks on every file access at the kernel level.</p>