virt-install: get passwd/group from $ref to stage2

[yuvalturg]

When using anaconda to install an ostree_ref, rpmostreepayload will fail
on systemd-tmpfiles --create for unknown users/groups. Installing
/usr/lib/{passwd,group} from ostree_ref before ostreesetup (in %pre)
will fix this

Signed-off-by: Yuval Turgeman yturgema@redhat.com

[dustymabe]

Hi @yuvalturg - thanks for the contribution. There are a few things at play here. We are planning to move away from anaconda for our image builds of FCOS so this fix wouldn't be effective for very long. We need to make sure we solve this problem when we make the transition.

Another thing to consider if that Fedora Silverblue and Fedora IoT do still use anaconda for the foreseeable future so maybe we should actually get a real fix into anaconda for this so that SB and IoT can benefit.

cc @cgwalters and @jlebon for input.

[yuvalturg]

This trick can be applied in rpmostreepayload just before executing systemd-tmpfiles, and it should be the right place to do so. I know it's simple but I posted this so it doesn't get lost - without it I can't build my forked coreos image

[jlebon]

Also note we're planning to move to systemd-sysusers soon, which will allow us to drop nss-altfiles completely. At that point, we'd update FCOS to run systemd-sysusers at first boot time and could also update Anaconda to do the same at install time for FSB & IoT. (A related higher-level discussion here is whether those should also switch to cosa, though that impacts many other larger items as well).

I guess we could get this in as a temporary fix until either the sysusers work or the move away from Anaconda is done (since either would "fix" this), though it does add more churn that distracts from those initiatives. So... maybe let's hold it here for the time being? (And thanks for sharing!)

[yuvalturg]

I'm obviously not familiar with all use cases, and I use a local cosa build anyway with this patch applied and some other changes for our experiments with ovirt and coreos, so it's not blocking us. If you do stick with anaconda, moving this to rpmostreepayload and dropping the varsubdir loop (just create everything under /var) would be much nicer

[dustymabe]

If you do stick with anaconda, moving this to rpmostreepayload and dropping the varsubdir loop (just create everything under /var) would be much nicer

would you be willing to send a patch to anaconda for it?

[yuvalturg]

If you do stick with anaconda, moving this to rpmostreepayload and dropping the varsubdir loop (just create everything under /var) would be much nicer

would you be willing to send a patch to anaconda for it?

Sure, pushed it here and checked with silverblue for now to see I didn't break anything, I will test it some more and send the PR

[yuvalturg]

Pushed rhinstaller/anaconda#1976