Disable read-only FS until we fix issue #1589

[jhrozek]

We track go-tuf writing into /home and not being allowed to in issue
artifact signatures.

[rdimitrov]

We should update this setting on the docker compose file too 👍

[JAORMX]

@rdimitrov so, there is no way to configure where go-tuf downloads these files?

[rdimitrov]

@rdimitrov so, there is no way to configure where go-tuf downloads these files?

@JAORMX - Alright, I'm silly 🤦‍♂️

I went back to the cosign code and found that in sigstore/sigstore there's a SIGSTORE_NO_CACHE env var that apparently should allow for tuf to run in a readonly setup which hopefully allows this for cosign too. Although it's not really documented anywhere so...there's that.

@jhrozek - did you found a way to reproduce this somewhat easily so we can try this?

[jhrozek]

@rdimitrov so, there is no way to configure where go-tuf downloads these files?

@JAORMX - Alright, I'm silly 🤦‍♂️

I went back to the cosign code and found that in sigstore/sigstore there's a SIGSTORE_NO_CACHE env var that apparently should allow for tuf to run in a readonly setup which hopefully allows this for cosign too. Although it's not really documented anywhere so...there's that.

Do we lose the ability to fetch the trust roots?

@jhrozek - did you found a way to reproduce this somewhat easily so we can try this?

Not really, although it was visible several times a day in staging. We can push your patch and observe for 24h if you prefer.

[rdimitrov]

Do we lose the ability to fetch the trust roots?

No, we shouldn't. It's just that if minder restarts cosign will rebuilt/update its metadata state. Otherwise it would've read it from disk.

@jhrozek - did you found a way to reproduce this somewhat easily so we can try this?

Not really, although it was visible several times a day in staging. We can push your patch and observe for 24h if you prefer.

Ah, so we haven't seen that locally, i.e. using run-docker? Alright, I'll open a PR adding this env var 👍

[jhrozek]

Ah, so we haven't seen that locally, i.e. using run-docker? Alright, I'll open a PR adding this env var 👍

I don't use run-docker, but run the server locally on foreground..

[jhrozek]

Closing in favour of #1611