Failed to finalize deployment

[Quantum-Sicarius]

Bug Report

Somewhere along the lifetime of my instance of Fedora Core OS a deployment gets unlocked. Zincati seems to fail then with:

zincati[1629931]: [INFO  zincati::update_agent::actor] staged deployment '39.20240407.3.0' available, proceeding to finalize it
zincati[1629931]: [ERROR zincati::update_agent::actor] failed to finalize deployment: rpm-ostree finalize-deployment failed:
zincati[1629931]:     error: Staged deployment already unlocked

sudo rpm-ostree status
State: idle
AutomaticUpdatesDriver: Zincati
  DriverState: active; update staged: 39.20240407.3.0; reboot delayed due to active user sessions
Deployments:
  fedora:fedora/x86_64/coreos/stable
                  Version: 39.20240407.3.0 (2024-04-19T18:34:05Z)
               BaseCommit: 4f5997a887d92f19f6ce564069511115138916a37d7b30e2bfd027c5e5158e63
             GPGSignature: Valid signature by E8F23996F23218640CB44CBE75CF5AC418B8E74C
                     Diff: 133 upgraded, 2 added
          LayeredPackages: ansible libselinux-python3 open-vm-tools openvpn pip python3

● fedora:fedora/x86_64/coreos/stable
                  Version: 39.20240210.3.0 (2024-02-26T11:14:39Z)
               BaseCommit: 9ee1cb0963e253a2864c69a9450c8e3dd91b50b47f97389be0393c1db567dd5e
             GPGSignature: Valid signature by E8F23996F23218640CB44CBE75CF5AC418B8E74C
          LayeredPackages: ansible libselinux-python3 open-vm-tools openvpn pip python3

  fedora:fedora/x86_64/coreos/stable
                  Version: 39.20231119.3.0 (2023-12-04T16:21:28Z)
               BaseCommit: cd3ab5975ace83aa36f687d2f2d58ea59b4d1cceef6d0cd18a231248ce6ae207
             GPGSignature: Valid signature by E8F23996F23218640CB44CBE75CF5AC418B8E74C
          LayeredPackages: ansible libselinux-python3 open-vm-tools openvpn pip python3

The deployment can continue when I manually lock:

 sudo ostree admin status
  fedora-coreos d2e66a091ca3986906968b8fe1d7222c88b525b98132e0ad704cd36555277141.0 (staged)
    Version: 39.20240407.3.0
    origin: <unknown origin type>
* fedora-coreos 33417115625bc800d15bb3edbc0842de33ad7af8d44380b1e326646570c25e46.0
    Version: 39.20240210.3.0
    origin: <unknown origin type>
  fedora-coreos 84971f73648515760d7422887eaa8329e3019899beee6dbd30f094e618c6536e.0 (rollback)
    Version: 39.20231119.3.0
    origin: <unknown origin type>

sudo ostree admin lock-finalization -v
OT: remounted /sysroot writable
OT: remounted /boot writable
OT: using fuse: 0
OT: Deployment 33417115625bc800d15bb3edbc0842de33ad7af8d44380b1e326646570c25e46.0 unlocked=0
OT: Deployment 84971f73648515760d7422887eaa8329e3019899beee6dbd30f094e618c6536e.0 unlocked=0
Staged deployment is now finalization locked

After this the deployment seems to continue, I expect it can unlock again.

Environment

VMWare

Expected Behavior

If it is already unlocked continue.

Actual Behavior

Zincati fails with:

zincati[1629931]: [INFO  zincati::update_agent::actor] staged deployment '39.20240407.3.0' available, proceeding to finalize it
zincati[1629931]: [ERROR zincati::update_agent::actor] failed to finalize deployment: rpm-ostree finalize-deployment failed:
zincati[1629931]:     error: Staged deployment already unlocked

Reproduction Steps

To be honest I am not sure how to reproduce this other than this seems to occur when I use ansible with rpm-ostree to install a package without rebooting.

 - name: Uninstall old docker-compose
   community.general.rpm_ostree_pkg:
     name: docker-compose
     state: absent

Other Information

I may be using RPM-OSTREE incorrectly if so please do point that out.

[jlebon]

Yes, this is coreos/fedora-coreos-tracker#1691, which should be fixed soon. Some workarounds in coreos/fedora-coreos-tracker#1691 (comment).

[Quantum-Sicarius]

Thanks! I will follow that issue.