nspawn/dissect: automatically discover dm-verity verity partitions

This adds support for discovering and making use of properly tagged dm-verity
data integrity partitions. This extends both systemd-nspawn and systemd-dissect
with a new --root-hash= switch that takes the root hash to use for the root
partition, and is otherwise fully automatic.

Verity partitions are discovered automatically by GPT table type UUIDs, as
listed in
https://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/
(which I updated prior to this change, to include new UUIDs for this purpose.

mkosi with https://github.com/systemd/mkosi/pull/39 applied may generate images
that carry the necessary integrity data. With that PR and this commit, the
following simply lines suffice to boot up an integrity-protected container image:

```
 # mkdir test
 # cd test
 # mkosi --verity
 # systemd-nspawn -i ./image.raw -bn
```

Note that mkosi writes the image file to "image.raw" next to a a file
"image.roothash" that contains the root hash. systemd-nspawn will look for that
file and use it if it exists, in case --root-hash= is not specified explicitly.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/machine/image-dbus.c b/src/machine/image-dbus.c
index 65953b368f..e2fb882393 100644
--- a/src/machine/image-dbus.c
+++ b/src/machine/image-dbus.c
@@ -336,7 +336,7 @@ static int raw_image_get_os_release(Image *image, char ***ret, sd_bus_error *err
         if (r < 0)
                 return sd_bus_error_set_errnof(error, r, "Failed to set up loop block device for %s: %m", image->path);
 
-        r = dissect_image(d->fd, &m);
+        r = dissect_image(d->fd, NULL, 0, &m);
         if (r == -ENOPKG)
                 return sd_bus_error_set_errnof(error, r, "Disk image %s not understood: %m", image->path);
         if (r < 0)