Where are the container policies being added to the images? I know they are defined in ublue-os/con

Where are the container policies being added to the images? I know they are defined in ublue-os/config, but wondering how we should get them over to Cosmic.
I kinda expected them to be added in ublue-os/main, which cosmic inherits

Dylan•8/8/24, 3:58 PM

I'm seeing

Dual MIT/GPL
Dual MIT/GPL
Dual MIT/GPL
Dual BSD/GPL
Dual MIT/GPL

on both now. Which is better than it failing but something is off.

RRobert Where are the container policies being added to the images? I know they are def...

M2•8/8/24, 3:59 PM

they should be in ublue-os/main

Dylan•8/8/24, 4:00 PM

I think this is really close. Need to figure out why it's building the wrong one on legacy then fix that

MM2 they should be in ublue-os/main

RobertOP•8/8/24, 4:01 PM

Ah, so I can see the public key in the image (maybe from the ISO?) but there's strangely just the default InsecureAcceptAnything container policy.

M2•8/8/24, 4:01 PM

in cosmic or main?

RobertOP•8/8/24, 4:02 PM

In cosmic

RobertOP•8/8/24, 4:02 PM

But I guess since it's the default policy in cosmic, it's also in main-base?

M2•8/8/24, 4:03 PM

cosmic-base should be base-main + copr repos

M2•8/8/24, 4:05 PM

main-base has our policy in /usr/etc/containers/policy.json. It has the default in /etc/containers/policy.json

RobertOP•8/8/24, 4:05 PM

In cosmic

RRobert In cosmic

antheas•8/8/24, 4:05 PM

do you use rechunk 0.8.1 or 0.8.0

antheas•8/8/24, 4:06 PM

rechunk 0.8.1 will use /usr/etc and 0.8.0 will use /etc

antheas•8/8/24, 4:06 PM

we verified 0.8.1 will use the correct policy on bazzite and i prd it yesterday

antheas•8/8/24, 4:06 PM

for cosmic

RobertOP•8/8/24, 4:06 PM

It was whatever the ISOs were built with.
Will spin some new ISOs

antheas•8/8/24, 4:06 PM

check the container image by booting with bash

antheas•8/8/24, 4:07 PM

the correct oen should be in /etc

antheas•8/8/24, 4:07 PM

not booting by running bash on it

antheas•8/8/24, 4:07 PM

there should not be a /usr/etc dir

Kyle Gospo•8/8/24, 4:10 PM

@M2 @Robert (p5) got an interesting issue we need to fix

Kyle Gospo•8/8/24, 4:10 PM

as part of moving /usr/etc to /etc, it turns out we were replacing a file in /etc/ provided by a core package by putting the replacement in /usr/etc

Kyle Gospo•8/8/24, 4:10 PM

that's the container update policy

Kyle Gospo•8/8/24, 4:11 PM

we need to either
1: Remove it from the signing RPM and replace in the main/ucore image
2: Make our signing rpm provide container-common (Will require us to keep it up to date, not a great concept)
3: Install with --force-allowreplace separately from our other rpms

RobertOP•8/8/24, 4:12 PM

If I understand correctly:
Fedora provides /etc/containers/policy.json in their image
We now try to add our own /etc/containers/policy.json
Adding our policy fails
?

Kyle Gospo•8/8/24, 4:13 PM

yes and yes

Kyle Gospo•8/8/24, 4:13 PM

previously we added it to /usr/etc/containers/policy.json

Kyle Gospo•8/8/24, 4:13 PM

which did not conflict, but adding to /usr/etc is undefined behavior according to Colins

Kyle Gospo•8/8/24, 4:13 PM

so now our signing rpm fails to install w/ that error

RobertOP•8/8/24, 4:14 PM

And (knowing nothing about RPMs) we can't add a PREINSTALL step to the signing RPM which deletes the original file if present?

Kyle Gospo•8/8/24, 4:14 PM

yes that would work

Kyle Gospo•8/8/24, 4:14 PM

as would the force replace param

KKyle Gospo which did not conflict, but adding to /usr/etc is undefined behavior according t...

antheas•8/8/24, 4:16 PM

according to me, i dont think colin ever considered it

antheas•8/8/24, 4:16 PM

tbh

antheas•8/8/24, 4:16 PM

rpm-ostree just mashes the directories together

Aantheas according to me, i dont think colin ever considered it

Kyle Gospo•8/8/24, 4:16 PM

whar that's not what you said, well regardless we are here

RobertOP•8/8/24, 4:16 PM

I think 1 and 2 aren't a great option. 1 due to the unnecessary duplication and 2 due to needing to keep a core dependency up-to-date
As for the force replace param, that's a parameter needing to be defined at RPM install time?

antheas•8/8/24, 4:16 PM

the code path mashes the directories together

RRobert I think 1 and 2 aren't a great option. 1 due to the unnecessary duplication and...

Kyle Gospo•8/8/24, 4:16 PM

you got it

RobertOP•8/8/24, 4:16 PM

I hate to say it... But I like my idea