Signed-off-by: Derek McGowan <[email protected]>

Add MediaTypeErofsLayerZstd (application/vnd.erofs.layer.v1+zstd) for
the seekable EROFS blob format.

Signed-off-by: Annie Cherkaev <[email protected]>

Add the internal/erofsutils/seekable package with foundational building
blocks for the seekable EROFS format:

- zstd skippable frame read/write helpers: the seekable format uses zstd
  skippable frames to embed the chunk table and dm-verity data inline in
  a valid zstd stream, so standard zstd decoders can skip over this
  metadata while still processing the data frames.

- writeZstdFrame: compresses data as independent zstd frames and
  computes a SHA-512 checksum of the compressed output in a single pass
  (via MultiWriter). Each chunk must be an independent frame so that a
  future lazy-loading snapshotter can decompress individual chunks
  without needing prior frames as context.

- countingWriter: tracks byte offsets in the output stream because
  containerd's content.Writer does not implement io.Seeker, yet the
  format requires recording absolute offsets for the chunk table entries
  and dm-verity frame location. Without this, we would need to buffer
  the entire blob in memory just to know where each section starts.

Signed-off-by: Annie Cherkaev <[email protected]>

Implement the chunk mapping table, the core data structure that enables
random access to compressed EROFS data without full decompression.

The chunk table maps each fixed-size uncompressed byte range to the
absolute offset of its corresponding independent zstd frame in the
compressed blob, along with an optional SHA-512 checksum. This is what
makes the format "seekable": a future lazy-loading remote snapshotter
can read just the chunk table, then fetch and decompress only the
specific chunks needed for a given file access—avoiding the need to
download and decompress the entire layer.

The table is stored as a zstd skippable frame so the overall blob
remains a valid zstd stream. Since skippable frames lack built-in
checksums, the table's integrity is verified separately via an OCI
digest annotation (sha512:<hex>) on the layer descriptor.

Also defines OCI annotation constants for chunk_table_offset,
chunk_digest, dmverity.offset, and dmverity.root_digest, which carry
the metadata needed to locate and verify these embedded structures
within the blob.

Signed-off-by: Annie Cherkaev <[email protected]>

Add a WriteMetadata function to the internal/dmverity package that
atomically writes dm-verity metadata (root hash and hash offset)
alongside layer blobs using atomicfile. This provides crash-safety
guarantees that the previous inline os.WriteFile approach lacked.

Also adds input validation: WriteMetadata rejects empty root hashes
up front, symmetric with ReadMetadata's existing check.

Convert the EROFS differ's formatDmverityLayer to use the new
function, eliminating the inline json.MarshalIndent + os.WriteFile
block. The seekable EROFS dm-verity code (next commit) will also
use WriteMetadata, avoiding duplicate implementations.

Signed-off-by: Annie Cherkaev <[email protected]>

Add dm-verity encoding (at conversion time) and materialization (at
unpack time) for seekable EROFS blobs.

Embedding dm-verity data enables end-to-end integrity verification: the
Merkle tree is computed over the uncompressed EROFS image at conversion
time and stored as a zstd skippable frame at the end of the blob. At
unpack time, the dm-verity payload is extracted and appended to
layer.erofs in "single device" mode, so the Linux dm-verity subsystem
can verify every block read at mount time without requiring a
separate hash device.

The dm-verity superblock stores all parameters (block sizes, salt,
algorithm) so they don't need to be duplicated in annotations—only the
root digest and frame offset are annotated on the OCI descriptor. A
small JSON sidecar (layer.erofs.dmverity) is written alongside
layer.erofs using dmverity.WriteMetadata, sharing the same type and
atomic-write implementation as the non-seekable EROFS dm-verity path.

The OCI annotation stores the root digest in "algo:hex" format
(e.g. "sha512:abcdef...") for self-documenting metadata, while
MaterializeDMVerity strips the prefix before writing the sidecar,
since the mount handler's ParseRootHash expects plain hex.

Non-Linux platforms get stub implementations that return
ErrNotImplemented, since dm-verity is a Linux kernel feature. The
conversion pipeline itself only runs on Linux.

Signed-off-by: Annie Cherkaev <[email protected]>

Implement the end-to-end encoding and decoding logic that ties together
the zstd primitives, chunk table, and dm-verity components.

EncodeErofsImageTo orchestrates the full conversion from a raw EROFS
image to the seekable blob format: it reads the image in fixed-size
chunks, compresses each as an independent zstd frame, builds the chunk
table with frame offsets and SHA-512 checksums, and optionally appends
dm-verity data. The encoder streams output through a countingWriter
(since containerd's content store is not seekable) and uses a temp file
for dm-verity computation when needed, because the go-dmverity library
operates on files rather than streams.

Two decoders support different access patterns:
- DecodeErofsAll: stream-decodes the entire blob for the eager unpack
  path used by today's EROFS snapshotter, which needs the full raw image.
- DecodeErofsFrame: decodes a single zstd frame by offset for the future
  lazy-loading snapshotter, verifying the frame's SHA-512 checksum in a
  single pass via TeeReader to avoid reading the compressed data twice.

Signed-off-by: Annie Cherkaev <[email protected]>

Add SeekableLayerConvertFunc and `ctr images convert --erofs-seekable`
to make the seekable EROFS format usable from the command line.

SeekableLayerConvertFunc handles the three-stage conversion pipeline:
  1. If the layer is already seekable EROFS (+zstd): no-op
  2. If the layer is raw EROFS: wrap in zstd frames with chunk table
  3. If the layer is tar-based: convert to raw EROFS first, then wrap

This reuses the existing raw EROFS converter (LayerConvertFunc) for
step 3, avoiding duplication of the tar-to-erofs logic. The resulting
OCI descriptor carries annotations for chunk table offset/digest and
dm-verity offset/root-digest, which downstream consumers (the differ,
a future lazy-loading snapshotter) use to locate embedded metadata
within the blob.

New CLI flags:
  --erofs-seekable: opt into the seekable format
  --erofs-chunk-size: set random access granularity (default 4 MiB)
  --erofs-dm-verity: enable integrity verification
  --erofs-dm-verity-block-size: dm-verity block size (default 4 KiB)

Also extracts buildErofsOpts helper to share raw EROFS option parsing
between the --erofs and --erofs-seekable code paths.

Signed-off-by: Annie Cherkaev <[email protected]>

Extend the EROFS differ to recognize and unpack seekable EROFS layers,
completing the "convert -> push -> pull -> unpack -> mount" lifecycle
for the new format.

The differ is the integration point between the content store and
the snapshotter: when a seekable EROFS layer is pulled, the differ
must decode it back into a mountable layer.erofs. This commit adds that
decode path:

  1. Detect +zstd media type and route to the seekable decode path
  2. Stream-decode the entire zstd blob to recover the raw EROFS image
     (using DecodeErofsAll—the eager path ignores the chunk table since
     it needs the full image anyway)
  3. If dm-verity annotations are present, extract the embedded payload
     from the blob and append it to layer.erofs with a JSON sidecar,
     enabling mount-time integrity verification

The eager unpack path is intentionally simple—it doesn't use the chunk
table for random access. That optimization is deferred to a future
lazy-loading remote snapshotter, which will use DecodeErofsFrame and the
chunk table to fetch only the needed chunks on demand.

Also refactors IsErofsMediaType to correctly handle the new +zstd suffix
using strings.Cut, fixing a latent issue where any "+suffix" EROFS media
type would have been incorrectly rejected.

Signed-off-by: Annie Cherkaev <[email protected]>

Signed-off-by: Annie Cherkaev <[email protected]>

Extend `ctr images inspect` to display seekable EROFS layer details:
chunk table metadata (uncompressed size, chunk size, hash algorithm,
entry count with offset/size/checksum), OCI annotations (chunk table
offset/digest, dm-verity offset/root digest), and the EROFS directory
tree (decompressed on the fly, with a 256 MiB safety cap).

Also adds a maxDepth parameter to PrintDirectory to bound recursion
for deeply nested filesystems.

Signed-off-by: Annie Cherkaev <[email protected]>