this mostly LGTM.

I do have some concern, though. We obviously manage the treecompose-post.sh file ourselves and we can control what goes into it. What about people who are building/hosting their own ostrees. Are there certain rules they have to follow? i.e. can you elaborate on the problem a little more and explain why it is or is not a problem for others?

There's more information at https://github.com/ostreedev/ostree/blob/master/man/rofiles-fuse.xml
and https://bugzilla.redhat.com/show_bug.cgi?id=1352154

But see also https://github.com/ostreedev/ostree/issues/1377 which would obviate the need for this.

Hmm, that should've been caught by https://github.com/projectatomic/rpm-ostree/pull/1003 though, right?

I have a not-yet-submitted PR for that that follows https://github.com/projectatomic/rpm-ostree/pull/1148