Skip to content

Image refresh for centos-9-stream #8975

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cockpituous wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Image refresh for centos-9-stream #8975

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c732e5b
images: Update centos-9-stream image
Apr 29, 2026
cc3ea2d
rhel.setup: workaround selinux-policy version mismatch
allisonkarlitskaya May 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion images/centos-9-stream
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
centos-9-stream-845aef8d8eaa333e58da7d080e21d63a1c013618426c928d10ede5098389fa38.qcow2
centos-9-stream-5916936800cbda02a0efd9dad439e4d4485cd19b2d69ef0c945645c6fc652ad0.qcow2
17 changes: 15 additions & 2 deletions images/scripts/rhel.setup
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -421,9 +421,22 @@ EOF
version=$(cut -d '-' -f 2 <<< "$IMAGE")
su builder -c "/usr/bin/mock --verbose --no-bootstrap-image -i $(/var/lib/testvm/build-deps.sh "$opsys $version")"

# We need to make sure mock has the same selinux-policy as we do
# cockpit-ws-selinux has Requires: selinux-policy >= {build version}, so we need to
# ensure that mock's selinux-policy is old enough for any target image.
# For centos-9-stream: use an older version from koji so that packages built here
# can install on centos-9-bootc, which may lag behind centos-9-stream.
# https://github.com/cockpit-project/bots/pull/8975
mkdir /tmp/selinux-policy-rpms
dnf download --downloaddir /tmp/selinux-policy-rpms selinux-policy{,-devel,-targeted}
if [ "$IMAGE" = "centos-9-stream" ]; then
selinux_vr="38.1.76-1.el9"
Copy link
Copy Markdown
Member

@martinpitt martinpitt May 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Meh -- this will get increasingly out of date. At some point the compiled policy during rpm build might not even work any more at runtime, or silently pass while it would fail with the official builds?

This is a structural problem in C9S which is terribly hard to work around. Doesn't this break packit COPR builds and tests in the very same way while that happens? If yes, this just reflects reality, and we'll have to block the image refresh for some time and keep filing tickets. If not, then what does copr/TF do different to avoid this?

Copy link
Copy Markdown
Member

@allisonkarlitskaya allisonkarlitskaya May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I mean, we're basically doing exactly the same for Fedora, right? and it's getting increasingly out of date as well...

Copy link
Copy Markdown
Member

@allisonkarlitskaya allisonkarlitskaya May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also: I don't really consider this to be a downstream issue: it's due to the fact that we build our centos-9-bootc packages on centos-9-stream and when stream gets updated it might end up with a later version of the policy package. There's really nothing that could be done at the distro level to help this...

Copy link
Copy Markdown
Member

@martinpitt martinpitt May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is absolutely a downstream issue. New selinux packages are often already "visible" in the buildroot repo days or even weeks before they become visible in BaseOS. If the publishing was synchronous between the two (i.e. gating holds back buildroot as well), we would only run into this problem if we updated centos-9-bootc image after centos-9-stream.

But ok, one thing at a time..

Copy link
Copy Markdown
Member

@martinpitt martinpitt May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No wait, this is still wrong. We explicitly download the selinux package from BaseOS for that very reason. So how about refreshing centos-9-bootc first or in the same PR?

koji_url="https://kojihub.stream.centos.org/kojifiles/packages/selinux-policy"
for p in selinux-policy selinux-policy-devel selinux-policy-targeted; do
curl -fsS -L -o "/tmp/selinux-policy-rpms/${p}-${selinux_vr}.noarch.rpm" \
"${koji_url}/${selinux_vr%-*}/${selinux_vr##*-}/noarch/${p}-${selinux_vr}.noarch.rpm"
done
else
dnf download --downloaddir /tmp/selinux-policy-rpms selinux-policy{,-devel,-targeted}
fi
su builder -c "/usr/bin/mock --install /tmp/selinux-policy-rpms/*.rpm"
fi

Expand Down
Loading