[Bug] composefs-native: Weird fs-verity errors

[TheHooly]

Greeter comes up but login fails and loops, because cosmic-session package is missing in the deployment, identified by rpm -qa cosmic-session returning empty, and /usr/share/wayland-sessions/cosmic.desktop missing.
see reply below

Log reveals several, curious fs-verity errors:

Sep 17 09:14:36 fedora-laptop kernel: fs-verity (dm-0, inode 249306): FILE CORRUPTED! pos=1966080, level=-1, want_hash=sha512:407d87dbf5e656c831944d16c426c2f13ba8d8bee4eae484e9b4633c3e3787edc764a8899c5690f14b4e16e20663ff003bf944008a92884a9d8ef8d20a058e2e, real_hash=sha512:2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
Sep 17 09:14:36 fedora-laptop kernel: fs-verity (dm-0, inode 249306): FILE CORRUPTED! pos=2621440, level=-1, want_hash=sha512:319d843febf7a2c4fbd0504c2f87dafea841816172124e1f3f14c1153666d69480e0d75c0e5a50ddf0fa8c393fb459780471e724ffbe6a7772ce387af2114f18, real_hash=sha512:2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
Sep 17 09:14:36 fedora-laptop kernel: fs-verity (dm-0, inode 249306): FILE CORRUPTED! pos=2228224, level=-1, want_hash=sha512:43e3994577ff5f3a125cd4e10c6b1ce21ce17617adef7ee971e3201a6f2d76b0212790470ead010b536d55cc569b048e3146efd9898625870eccc1dde6448cb5, real_hash=sha512:2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
Sep 17 09:14:36 fedora-laptop kernel: fs-verity (dm-0, inode 249598): FILE CORRUPTED! pos=1835008, level=-1, want_hash=sha512:190bfb0666908e4c295e56cb4cbcaba0f7e3f2d802307227a8816fc16ef4ba9dae557fe9cac38c3e57158f07056dac2e3fbef89fce3513ec0392b3e48a3fea45, real_hash=sha512:2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
Sep 17 09:14:36 fedora-laptop kernel: fs-verity (dm-0, inode 249598): FILE CORRUPTED! pos=2228224, level=-1, want_hash=sha512:30d033fd992fc3217b5b4349e42539698438af3ed2b14b7fc5bd10f7706ab06635693f2534a64898523d69539e930da72cd38ae05d4660e0293b3442c9286b0e, real_hash=sha512:2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
Sep 17 09:14:36 fedora-laptop kernel: fs-verity (dm-0, inode 249598): FILE CORRUPTED! pos=3407872, level=-1, want_hash=sha512:c1896860683a55cad0b2cfe8cb2047b0a8efcee09644298828ed6e1d920c44a6ec89ce36988b1f8d5f1a4318baba2f86414eb607cee67ab5ee96f6b1c3a62a75, real_hash=sha512:2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
Sep 17 09:14:36 fedora-laptop kernel: fs-verity (dm-0, inode 249598): FILE CORRUPTED! pos=3145728, level=-1, want_hash=sha512:148f90d6e551e193625967a919308c0c4fa76426b755d6c4b841030b89dadec10b041e7d3b9d7a1cacfb7dc759c0a5f7a93cfcf4aaa4c1346e6ca9e137b3c13a, real_hash=sha512:2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
Sep 17 09:14:37 fedora-laptop kernel: fs-verity (dm-0, inode 249598): FILE CORRUPTED! pos=4063232, level=-1, want_hash=sha512:b7bfbada6e729b0c7e2978391d5468ec52a042a77a2c861fba0d930ee82347f4f41ea934443a4daa50e86d4ffb02bbed0a130f845eb589da0ad245f5ac1e28d5, real_hash=sha512:2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
Sep 17 09:14:37 fedora-laptop kernel: fs-verity (dm-0, inode 249598): FILE CORRUPTED! pos=3801088, level=-1, want_hash=sha512:4a1504dc5e944d2397a074ee3bc2fa85b397e73eb8ec5fff9d4b8c59573a07324a8e6273d5a10b178808ca56ccaf41c817510348ee2a7c6ddafac24ae9edeab5, real_hash=sha512:2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
Sep 17 09:14:53 fedora-laptop kernel: fs-verity (dm-0, inode 1444220): FILE CORRUPTED! pos=23040000, level=-1, want_hash=sha512:774f1b8345ab98cfca85fcb31c83b86433eb0b6191828226fe142856fec26d28371a8640b2ffe7bee4314ed3f3cd71be0e4233e18607a10d0d6d87434e44c3b9, real_hash=sha512:053a879ef60a6f4b0c6daa8428a60e6262ef59f3a2389b830994ff7acd4a2d7aa1bf6dd924bbb2b52f0b19dd35279ca8b545d7b67ad3bdc3d8ce5c76e368a0f2

The curious part is that the wanted and found hashes make no sense, there are:

• Three different want_hash values for 249306,
• Six different want_hash values for 249598,
• 249306 and 249598 have the same found_hash values
• But do not actually point to the same file on disk as seen below

249306: /sysroot/composefs/objects/27/b3751bd5e5ad8d2dff4d98837e574721b5075094dbfdf86417bcbb3ce90482547656eb0958e30fff42c73d0df2652886e5db69c90c3021933550836323caf7

249598:
/sysroot/composefs/objects/1b/362f004ed42defd8e400883f382a500bb421ea186e326c429d1475923662d60277365ad6843d3bb4f554aee7d1b81cf31fb1876064e02ebaadcc3a52f44438

1444220:
/sysroot/composefs/objects/92/4eba01ab7a7c2865874593472d1b77a3e108a919c6680c88c61b09bb6adedcfe217a59e10dd65d33b62a4e87940604a1c1cf9dbb7c9e04d4561534313920f7

The issue persists after deleting and redownloading the deployment:

🦸 [root@fedora-laptop hooly]# bootc status
● Booted image: ghcr.io/secureblue/cosmic-main-hardened:uki
        Digest: sha256:e345f75fca78fac0cab1494944c266546f39e766e0eba7945fbdba14ed302497 (amd64)
        Verity: cba33619b1512ce05e9b4154f15f4b6e1afa9cc26d7cc672530ae6188c07bdd348b30ea6d694311dac8e8b3355cf362224c6ef30c095920648591e716e4f83a5
     Timestamp: 2026-09-12T00:11:12Z

  Rollback image: ghcr.io/secureblue/cosmic-main-hardened:uki
          Digest: sha256:80ebcf6cefc533038d58faa27f16b1deba369dea39e0ff5d4305353b3d1f8321 (amd64)
          Verity: 5b03aa85aa92715cb444cb8cbd722a9d89183ef36454afc1651dfba3d49958005e3316926ab03cee96644130f297f9eecd7c785bd00ee0620db15a03aaaf0ea0
       Timestamp: 2026-09-16T12:37:33Z
🦸 [root@fedora-laptop hooly]# bootc delete-deployment 5b03aa85aa92715cb444cb8cbd722a9d89183ef36454afc1651dfba3d49958005e3316926ab03cee96644130f297f9eecd7c785bd00ee0620db15a03aaaf0ea0
🦸 [root@fedora-laptop hooly]# bootc status
● Booted image: ghcr.io/secureblue/cosmic-main-hardened:uki
        Digest: sha256:e345f75fca78fac0cab1494944c266546f39e766e0eba7945fbdba14ed302497 (amd64)
        Verity: cba33619b1512ce05e9b4154f15f4b6e1afa9cc26d7cc672530ae6188c07bdd348b30ea6d694311dac8e8b3355cf362224c6ef30c095920648591e716e4f83a5
     Timestamp: 2026-09-12T00:11:12Z
🦸 [root@fedora-laptop hooly]# bootc upgrade
Fetching config sha256:80be46064733fc78bd2c4aab0ddf8e6e72cba0623afe8227790028b1d7474999                                                                                          Storing manifest sha256:80ebcf6cefc533038d58faa27f16b1deba369dea39e0ff5d4305353b3d1f8321                                                                                         🦸 [root@fedora-laptop hooly]#

[TheHooly]

We have confirmed that the session file is not missing because of the fs-verity errors, they are probably worth investigating regardless.