From ef96f3648197b85a6bb18dc3c263b8e7d41c43d5 Mon Sep 17 00:00:00 2001 From: Rolv Apneseth Date: Thu, 8 Oct 2026 16:06:40 +0100 Subject: [PATCH 1/2] playbooks/depencies-fedora-coreos: add fallbacks to the updates-testing and fedora repos When trying to replace the existing versions of some base Fedora CoreOS packages, we had repo=updates hard-coded. However, while the `next` stream is pointing at a pre-release version, updates are either in repo=updates-testing or repo=fedora. Let's add some fallback logic to avoid failures when this is the case. Signed-off-by: Rolv Apneseth --- playbooks/dependencies-fedora-coreos.yaml | 48 +++++++++++++++++------ 1 file changed, 37 insertions(+), 11 deletions(-) diff --git a/playbooks/dependencies-fedora-coreos.yaml b/playbooks/dependencies-fedora-coreos.yaml index d676cb9f4..83b38ea29 100644 --- a/playbooks/dependencies-fedora-coreos.yaml +++ b/playbooks/dependencies-fedora-coreos.yaml @@ -14,19 +14,45 @@ # limitations under the License. # -- name: Synchronize glibc to repo version for gcc/glibc-devel compatibility - become: yes - command: >- - rpm-ostree override replace --experimental --from repo=updates - glibc - glibc-common - glibc-minimal-langpack - glibc-gconv-extra - ignore_errors: yes +# These package overrides get a little complicated due to the +# `next` stream pointing at pre-release repos during branching. +# With the below loop, we try and use the default `updates` repo, +# and fallback to `updates-testing` and `fedora` in turn so that we +# can update base packages on the system. -- name: Synchronize shadow-utils to repo version for shadow-utils-subid-devel compatibility +- name: Synchronize base packages to repo versions become: yes - command: rpm-ostree override replace --experimental --from repo=updates shadow-utils + shell: | + for repo in updates updates-testing fedora; do + output=$(rpm-ostree override replace --experimental --from repo="$repo" {{ item.packages }} 2>&1) + rc=$? + + if [ $rc -eq 0 ]; then + echo "$output" + exit 0 + fi + echo "$output" >&2 + + # Already at the latest version, nothing to do. + if echo "$output" | grep -qi 'reinstall exact'; then + exit 0 + fi + + # Package not found in this repo, try the next one. + if echo "$output" | grep -qi 'no matches'; then + continue + fi + + # Other error, bail out. + exit $rc + done + exit $rc + loop: + - { name: glibc, packages: "glibc glibc-common glibc-minimal-langpack glibc-gconv-extra" } + - { name: shadow-utils, packages: "shadow-utils" } + - { name: libgcc, packages: "libgcc" } + loop_control: + label: "{{ item.name }}" ignore_errors: yes - name: Apply base package overrides From f74d1ec45b024278574dbb8f13bb9d8808e24d1a Mon Sep 17 00:00:00 2001 From: Rolv Apneseth Date: Sat, 10 Oct 2026 20:09:54 +0100 Subject: [PATCH 2/2] build: restrict systemd-tmpfiles call to /run As of systemd v261, bare `systemd-tmpfiles --create` calls now attempt to set permissions on / on systems which are not set to 0o555. This currently fails on Fedora CoreOS systems due to them having the incorrect permissions set while also having a read-only root filesystem. This leads to the following error: fchmod() of / failed: Read-only file system Since both entries in data/tmpfiles.d/toolbox.conf are under /run, it's safe for us to restrict these calls to this directory with --prefix=/run in order to avoid that issue on FCOS. See: https://github.com/coreos/fedora-coreos-tracker/issues/2238 Signed-off-by: Rolv Apneseth --- meson_post_install.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meson_post_install.py b/meson_post_install.py index 13c456dfa..a1bea22fc 100644 --- a/meson_post_install.py +++ b/meson_post_install.py @@ -23,6 +23,6 @@ euid = os.geteuid() if not destdir and not os.path.exists('/run/.containerenv') and euid == 0: - subprocess.run(['systemd-tmpfiles', '--create'], check=True) + subprocess.run(['systemd-tmpfiles', '--create', '--prefix=/run'], check=True) sys.exit(0)