[amannocci]

What is the change being made?

The single ignity package is split into two packages, for each format (deb, rpm, apk) and arch:

• ignity-core: everything but fix-perms (boot stages, execline, s6, s6-portable-utils, preboot, gen-accounts, load-envfile, with-env, with-retries). It depends on the virtual ignity-utils-impl, plus passwd/shadow-utils/shadow and grep.
• ignity-utils: the execline /usr/bin/fix-perms. It provides ignity-utils-impl, depends on ignity-core (execlineb shebang) and findutils, and conflicts with ignity-utils-rs.
• Both conflict with and replace the ignity package of 0.1.0.

Packaging:

• nfpm.{amd64,arm64}.yaml are replaced by nfpm.{core,utils}.yaml. poe package:<format> passes them ARCH and VERSION, so the version only lives in pyproject.toml and release.py stops rewriting the nfpm configs.
• Assets are named ignity-{core,utils}-<version>-linux-<arch>.<format>. The CI and release globs already match them.
• rpm: a posttrans reruns postinstall.sh. The %preun of the obsoleted ignity runs after the new %post and would remove /bin/execlineb.
• apk: nfpm drops conflicts, so they are !ignity / !ignity-utils-rs dependencies instead.

Why is the change being made?

ignity-utils-rs is a static Rust drop-in replacement for fix-perms. Its package provides ignity-utils-impl and conflicts with/replaces ignity-utils, expecting ignity-core to depend on that virtual package. With the split, an image can pick either implementation of fix-perms.

ignity-utils holds exactly what ignity-utils-rs replaces (fix-perms only), so swapping them never removes another tool.

How has this been tested?

Locally on arm64 (podman), with the six packages built by nfpm:

• IGNITY_INSTALL=package DOCKER_BASE_IMAGE=<base> uv run poe test on debian:bookworm-slim, fedora:latest and alpine:3: 71 passed each.
• uv run poe test (source install): 71 passed.
• ignity-core alone fails on the missing ignity-utils-impl with apt, dnf and apk.
• Upgrade from the 0.1.0 release packages:
  • deb and rpm: ignity is replaced, /bin/execlineb is still linked, fix-perms is present;
  • apk refuses the upgrade (breaks: ignity-core[!ignity]) until apk del ignity, then works.

Not run yet: amd64 (CI sanitize), and the swap to ignity-utils-rs, which has no release yet. poe package:* is Linux-only: on macOS, podman resolves the relative .:/tmp mount in its VM, so nfpm was run by hand with $PWD.

How has this been documented?

• README: the install snippets add both packages, with notes on ignity-utils-rs and on upgrading from 0.1.0 (apk del ignity first on Alpine).
• .claude/CLAUDE.md updated.

Related Issues

None.