It's honestly harder to explain the actual behaviour and not worth going into details most of the ti

It's honestly harder to explain the actual behaviour and not worth going into details most of the time imo but here it is https://blog.verbum.org/2014/01/24/why-ostree-requires-usretc/

Colin WaltersColin Walters

Why OSTree requires “/usr/etc”

While I often lump “dpkg/rpm” together since they’re very similar architecturally, their implementation of configuration file management is a small but nontrivial difference. This…

Arcitec•5/14/23, 2:33 AM

One cool thing is that since

/usr/etc/

/usr/etc/

are the "ground truth templates", you can always run an ostree config diff to see what files you have changes in or files that you;'ve kept that don't exist upstream.

akdevOP•5/14/23, 2:33 AM

I think of it mostly as you explained because I don't count on that three way merge to work reliably

Aakdev It's honestly harder to explain the actual behaviour and not worth going into de...

pythoner6•5/14/23, 2:33 AM

Yes that's what I was saying

It doesn’t attempt to understand the contents of files – if you have modified a config file in any way, that wins

akdevOP•5/14/23, 2:34 AM

Mm you're right

Ppythoner6 Yes that's what I was saying > It doesn’t attempt to understand the contents of ...

Arcitec•5/14/23, 2:34 AM

I read elsewhere that it's running a patch/diff, similar to this: Generate a patch between your

/usr/etc/

/usr/etc/

and the new deployment's

/usr/etc/

/usr/etc/

and then apply those patches to your

/etc/

/etc/

and just ignore the ones that failed to apply.

akdevOP•5/14/23, 2:35 AM

Not sure why he calls it a 3-way merge though if it is not merging anything

Arcitec•5/14/23, 2:35 AM

Yeah that blog is a mess of mixed up terms.

Arcitec•5/14/23, 2:36 AM

Official docs are here and they mention the thing I just said: https://ostreedev.github.io/ostree/deployment/

pythoner6•5/14/23, 2:37 AM

https://github.com/ostreedev/ostree/blob/16cb47489e582da9c139fee20acdac7079867843/docs/atomic-upgrades.md?plain=1#L76

GitHub

ostree/atomic-upgrades.md at 16cb47489e582da9c139fee20acdac70798678...

Operating system and container binary deployment and upgrades - ostree/atomic-upgrades.md at 16cb47489e582da9c139fee20acdac7079867843 · ostreedev/ostree

Ppythoner6 https://github.com/ostreedev/ostree/blob/16cb47489e582da9c139fee20acdac707986784...

Arcitec•5/14/23, 2:37 AM

But read this from the OSTree website:

When OSTree creates a deployment, it performs a 3-way merge using the old default configuration, the active system’s /etc, and the new default configuration. In the final filesystem tree for a deployment then, /etc is a regular writable directory.

pythoner6•5/14/23, 2:37 AM

How it works is:
Files in the currently booted deployment's
/etc
/etc
which were modified from the default
/usr/etc
/usr/etc
(of the same deployment) are retained.
Files in the currently booted deployment's
/etc
/etc
which were not modified from the default
/usr/etc
/usr/etc
(of the same deployment) are upgraded to the new defaults from the new deployment's
/usr/etc
/usr/etc
.

Arcitec•5/14/23, 2:38 AM

Why does their own website contradict the part you just quoted?

pythoner6•5/14/23, 2:39 AM

I don't think it's a contradiction do much as ambiguous use of the term "merge"

Arcitec•5/14/23, 2:39 AM

Yeah it could just be poorly explained. Grr.

pythoner6•5/14/23, 2:39 AM

Individual files aren't being merged, but the entire /etc tree is being merged in a very coarse grained way

Arcitec•5/14/23, 2:40 AM

Oh yeah that makes sense. What a poor way to phrase that on their site. I've always thought it did a 3-way merge per-file, not directory-wise.

Arcitec•5/14/23, 2:40 AM

I've never even thought of directory comparisons as "3-way merging".

pythoner6•5/14/23, 2:41 AM

Yeah it's definitely not the best way to explain it without a bit more detail

Arcitec•5/14/23, 2:41 AM

Yeah, thanks for finding that, it's very useful to know. That changes how I'll maintain my system. I will run the "config diff" more often to resolve actual changes.

pythoner6•5/14/23, 2:42 AM

It's probably just a case of the people writing the docs being familiar enough with how it works that the explanation seems obvious enough - even though it's a bit unclear without the extra detail to someone not as familiar.

Arcitec•5/14/23, 2:43 AM

Yeah it's a common curse when trying to document a complex system that you're very familiar with.

pythoner6•5/14/23, 2:43 AM

Yeah my plan is to try to avoid touching things in /etc at all where possible

AArcitec Yeah, thanks for finding that, it's very useful to know. That changes how I'll m...

akdevOP•5/14/23, 2:43 AM

it'd be cool to have a script that does this and notifies

Arcitec•5/14/23, 2:43 AM

Yep, one thing I always do is edit the wireplumber config to add a script that disables audio device sleeping, to avoid that silent "popping" whenever audio begins playing again. I am doing it via some big edits.

I've been meaning to look for a way to install that in a more granular way that doesn't need maintenance constantly whenever wireplumber changes config.

Aakdev it'd be cool to have a script that does this and notifies

Arcitec•5/14/23, 2:44 AM

Yeah good idea, some kinda GUI that runs as autostart on login and pops up if there's changes.

dreams

pythoner6•5/14/23, 2:44 AM

Yeah I think having some kind of automated check that can keep tabs on the diff to prevent drift would be interesting

akdevOP•5/14/23, 2:44 AM

you don't really need a gui, just run the command if there are changes send a dbus notification

pythoner6•5/14/23, 2:44 AM

A bit complicated because there's a bunch of things that are probably going to be changed just by installing though, like /etc/passwd

Aakdev you don't really need a gui, just run the command if there are changes send a db...

Arcitec•5/14/23, 2:44 AM

Great idea

Ppythoner6 A bit complicated because there's a bunch of things that are probably going to b...

akdevOP•5/14/23, 2:45 AM

I wish anaconda put this stuff in /usr/etc before commiting the deployment to disk...

pythoner6•5/14/23, 2:46 AM

Eh but then should you be ending up with a new ostree deployment every time you change your password?

Arcitec•5/14/23, 2:47 AM

I don't think it compares those files, like

shadow

shadow

and

passwd

passwd

. That would be bad.

pythoner6•5/14/23, 2:48 AM

$ sudo ostree admin config-diff
M    adjtime
M    group
M    passwd
M    gshadow
M    shadow
M    machine-id
M    subgid
M    subuid
...

$ sudo ostree admin config-diff
M    adjtime
M    group
M    passwd
M    gshadow
M    shadow
M    machine-id
M    subgid
M    subuid
...

Arcitec•5/14/23, 2:48 AM

W!!@ADD

Arcitec•5/14/23, 2:48 AM

That's dumb.

akdevOP•5/14/23, 2:48 AM

yeah they do appear as they are not in /usr/etc

Ppythoner6 Eh but then should you be ending up with a new ostree deployment every time you ...

akdevOP•5/14/23, 2:48 AM

I'd be okay with that but there are some implications ...

akdevOP•5/14/23, 2:49 AM

but I would like it if

rm -rf /etc/*

rm -rf /etc/*

does not destroy the system

akdevOP•5/14/23, 2:49 AM

conceptually that should reset the system to default state

Aakdev I'd be okay with that but there are some implications ...

pythoner6•5/14/23, 2:50 AM

Yeah, in a future where things are more image based "native" I could see something along those lines being the case

Aakdev yeah they do appear as they are not in /usr/etc

pythoner6•5/14/23, 2:53 AM

I do see a /usr/etc/passwd and /usr/etc/shadow etc, but there's no passwords for any accounts, so a little hard to log in if things got reset to that

(unless there's something that goes through the first boot setup again or something?)

akdevOP•5/14/23, 2:54 AM

pretty sure your system is bricked

akdevOP•5/14/23, 2:54 AM

if you remove them

ragectl•5/14/23, 2:54 AM

yeah those files under /usr are probably only there to fix file not found errors

akdevOP•5/14/23, 2:55 AM

there are actual defaults for these files, wonder why those aren't used

akdevOP•5/14/23, 2:56 AM

$ podman run --rm -it fedora-minimal:38                                                
bash-5.2# cat /etc/passwd
root❌0:0:Super User:/root:/bin/bash
bin❌1:1:bin:/bin:/usr/sbin/nologin
daemon❌2:2:daemon:/sbin:/usr/sbin/nologin
adm❌3:4:adm:/var/adm:/usr/sbin/nologin
lp❌4:7:lp:/var/spool/lpd:/usr/sbin/nologin
sync❌5:0:sync:/sbin:/bin/sync
shutdown❌6:0:shutdown:/sbin:/sbin/shutdown
halt❌7:0:halt:/sbin:/sbin/halt
mail❌8:12:mail:/var/spool/mail:/usr/sbin/nologin
operator❌11:0:operator:/root:/usr/sbin/nologin
games❌12💯games:/usr/games:/usr/sbin/nologin
ftp❌14:50:FTP User:/var/ftp:/usr/sbin/nologin
nobody❌65534:65534:Kernel Overflow User:/:/usr/sbin/nologin

$ podman run --rm -it fedora-minimal:38                                                
bash-5.2# cat /etc/passwd
root❌0:0:Super User:/root:/bin/bash
bin❌1:1:bin:/bin:/usr/sbin/nologin
daemon❌2:2:daemon:/sbin:/usr/sbin/nologin
adm❌3:4:adm:/var/adm:/usr/sbin/nologin
lp❌4:7:lp:/var/spool/lpd:/usr/sbin/nologin
sync❌5:0:sync:/sbin:/bin/sync
shutdown❌6:0:shutdown:/sbin:/sbin/shutdown
halt❌7:0:halt:/sbin:/sbin/halt
mail❌8:12:mail:/var/spool/mail:/usr/sbin/nologin
operator❌11:0:operator:/root:/usr/sbin/nologin
games❌12💯games:/usr/games:/usr/sbin/nologin
ftp❌14:50:FTP User:/var/ftp:/usr/sbin/nologin
nobody❌65534:65534:Kernel Overflow User:/:/usr/sbin/nologin

ragectl•5/14/23, 2:56 AM

I could see a future state where /etc/shadow /etc/group /etc/passwd actually become

.d

.d

directories which get

include

include

-d

akdevOP•5/14/23, 2:56 AM

that cannot happen, it breaks POSIX

akdevOP•5/14/23, 2:56 AM

systemd has some sysusers thing tho

ragectl•5/14/23, 2:57 AM

not everything sticks to POSIX