See https://github.com/konflux-ci/build-tasks-dockerfiles/pull/243
Unfortunately...some 3rd party container scanners just hard require these JSON files
to exist at the target path. It's going to be a painful long road to get them fixed
to rely on something else.
Add `tmpfiles.d` entries to silence `bootc container lint` for this. It will have
the effect of course of creating these files if they don't exist on boot, so in
the future we'll probably aim to add an "ignore" entry for this into the bootc container
lint.
Also adds a rootfs test case verifying the tmpfiles config is present in built images.
Assisted-by: OpenCode (Claude Sonnet 4.6)
Signed-off-by: Colin Walters <walters@verbum.org>
jq is not available in the minimal tier. Use grep instead to verify
that the bootupd EFI has both grub2 and shim components installed.
Assisted-by: OpenCode (Claude Opus 4.6)
Per https://issues.redhat.com/browse/RHEL-115278
Longer term of course we want to hard require systemd-sysusers
for this one instead.
Signed-off-by: Colin Walters <walters@verbum.org>
This works around two issues:
- First, rpm switched to reading users/groups directly for
its implementation of systemd-sysusers, which meant
it no longer reads via nss, which breaks nss-altfiles.
xref: https://github.com/rpm-software-management/rpm/pull/2503#issuecomment-1536435351
and below.
- Second, even if that was fixed, `keylime` wants to add
its user to the group, which can't be done when it's a system
uid.
Since nothing in the OS content is owned by this group, we can
move underneath `/etc` by default.
Signed-off-by: Colin Walters <walters@verbum.org>
I just saw the sqlite-shm corruption in
https://gitlab.com/redhat/centos-stream/containers/bootc/-/merge_requests/437#note_2372766792
so let's just go ahead and turn on rpmdb_normalize which
also aids the reproducibility of the rpmdb.
While we're here let's also add a long overdue "unit test" for
the rootfs. This operates as a container build that mounts
the container-under-test as part of a multi-stage build.
Signed-off-by: Colin Walters <walters@verbum.org>
