Sealing installed software is now your choice

Until now quantra-ramfs sealed every file with fs-verity at boot: the base, the boot files and the software you install. A sealed file can be replaced, but never written to. That is what we want for the base. For installed software it got in the way: a program that updates its own files in place cannot, and zex uland --u failed on a sealed file (an upgrade of Flatpak stayed at the old version until it was reinstalled).

What changes

• The base (/overlayer/syshub) and the boot files (/overlayer/zaisys) are sealed at every boot, as before. Root cannot change them.
• Installed software (/overlayer/zexlib/union) is not sealed unless you turn it on.
• zex uland --u and zex update now replace a sealed file instead of writing into it, the same way a reinstall does, so upgrades work whether your software is sealed or not.

Turning it on or off

elevate zex verity --union on    # seal installed software now and at every boot
elevate zex verity --union off   # stop sealing new files at boot
elevate zex verity               # show the setting

etc and var are never sealed: they hold configuration and data that change. Turning it off does not unseal files that are already sealed; they stay sealed until an upgrade or reinstall replaces them. Adding zainium.verity=union to the kernel command line also turns it on.

Update with:

elevate zex syshub --u