From 68f0f21c99389f5f24ab52c4312108981eb6c081 Mon Sep 17 00:00:00 2001
From: Colin Walters <walters@verbum.org>
Date: Mon, 1 Jun 2026 16:58:08 -0400
Subject: [PATCH] minimal: Add tmpfiles entries for Konflux injected content

See https://github.com/konflux-ci/build-tasks-dockerfiles/pull/243

Unfortunately...some 3rd party container scanners just hard require these JSON files
to exist at the target path. It's going to be a painful long road to get them fixed
to rely on something else.

Add `tmpfiles.d` entries to silence `bootc container lint` for this. It will have
the effect of course of creating these files if they don't exist on boot, so in
the future we'll probably aim to add an "ignore" entry for this into the bootc container
lint.

Also adds a rootfs test case verifying the tmpfiles config is present in built images.

Assisted-by: OpenCode (Claude Sonnet 4.6)
Signed-off-by: Colin Walters <walters@verbum.org>
---
 minimal/tmpfiles.yaml                         |  8 ++++++++
 tests/rootfs/cases/tmpfiles-konflux-buildinfo | 18 ++++++++++++++++++
 2 files changed, 26 insertions(+)
 create mode 100755 tests/rootfs/cases/tmpfiles-konflux-buildinfo

diff --git a/minimal/tmpfiles.yaml b/minimal/tmpfiles.yaml
index f47d3a4..e9846cb 100644
--- a/minimal/tmpfiles.yaml
+++ b/minimal/tmpfiles.yaml
@@ -6,5 +6,13 @@ postprocess:
     # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=771713
     d /var/lib/rpm-state 0755 - - -
     EOF
+    cat > /usr/lib/tmpfiles.d/konflux-buildinfo-contentsets.conf <<'EOF'
+    # Workaround for https://github.com/konflux-ci/build-tasks-dockerfiles/pull/243
+    d /var/roothome/buildinfo 0755 - - -
+    d /var/roothome/buildinfo/content_manifests 0755 - - -
+    # Note we don't actually try to recreate the content; this just makes the linter ignore it
+    f /var/roothome/buildinfo/content_manifests/content-sets.json 0644 - - -
+    f /var/roothome/buildinfo/labels.json 0644 - - -
+    EOF
     # Workaround for https://issues.redhat.com/browse/RHEL-106203
     rm -f /usr/lib/tmpfiles.d/home.conf
diff --git a/tests/rootfs/cases/tmpfiles-konflux-buildinfo b/tests/rootfs/cases/tmpfiles-konflux-buildinfo
new file mode 100755
index 0000000..e03a3b6
--- /dev/null
+++ b/tests/rootfs/cases/tmpfiles-konflux-buildinfo
@@ -0,0 +1,18 @@
+#!/bin/bash
+set -xeuo pipefail
+# Verify our custom tmpfiles.d configs by actually running systemd-tmpfiles
+# against a temporary root and checking the expected paths are created.
+# Workaround for https://github.com/konflux-ci/build-tasks-dockerfiles/pull/243
+
+tmproot=$(mktemp -d)
+trap 'rm -rf "${tmproot}"' EXIT
+
+systemd-tmpfiles --create --root="${tmproot}" \
+    /usr/lib/tmpfiles.d/bootc-base-rpmstate.conf \
+    /usr/lib/tmpfiles.d/konflux-buildinfo-contentsets.conf
+
+test -d "${tmproot}/var/lib/rpm-state"
+test -d "${tmproot}/var/roothome/buildinfo"
+test -d "${tmproot}/var/roothome/buildinfo/content_manifests"
+test -f "${tmproot}/var/roothome/buildinfo/content_manifests/content-sets.json"
+test -f "${tmproot}/var/roothome/buildinfo/labels.json"