From 0962f90d19d647f92d64571c62b173d4e2d9a17c Mon Sep 17 00:00:00 2001 From: "Jorge O. Castro" Date: Sat, 30 May 2026 17:28:42 -0400 Subject: [PATCH] =?UTF-8?q?fix:=20ship=20rechunker-group-fix=20service=20f?= =?UTF-8?q?or=20legacy-rechunk=E2=86=92chunkah=20migration?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk) to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci), the first boot fails with a black screen. Root cause: legacy-rechunk's 1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles, but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow from /etc/group, causing systemd-sysusers to fail on first boot: systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists. The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that rebuilds /etc/gshadow from /etc/group on every boot. The service is idempotent and harmless once gshadow is clean. Files added (verbatim from Aurora): - system_files/shared/usr/bin/rechunker-group-fix - system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service Service enabled in build_files/base/17-cleanup.sh. Without this fix, the first boot into projectbluefin/bluefin after switching from ublue-os/bluefin WILL produce a black screen. Second boot of the same image succeeds, but users will think the image is broken. Fixes: https://github.com/ublue-os/bluefin/issues/3852 See also: - https://github.com/ublue-os/bluefin-lts/issues/918 (renner0e test report) - https://github.com/bootc-dev/bootc/issues/1179 - https://github.com/ublue-os/aurora/issues/1468 - https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Assisted-by: Claude Sonnet 4.6 via GitHub Copilot --- build_files/base/17-cleanup.sh | 4 +++ .../shared/usr/bin/rechunker-group-fix | 17 ++++++++++ .../system/rechunker-group-fix.service | 32 +++++++++++++++++++ 3 files changed, 53 insertions(+) create mode 100755 system_files/shared/usr/bin/rechunker-group-fix create mode 100644 system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service diff --git a/build_files/base/17-cleanup.sh b/build_files/base/17-cleanup.sh index b35a026d..dade60b7 100755 --- a/build_files/base/17-cleanup.sh +++ b/build_files/base/17-cleanup.sh @@ -16,6 +16,10 @@ systemctl enable rpm-ostree-countme.service systemctl enable tailscaled.service systemctl enable ublue-system-setup.service +# see /usr/bin/rechunker-group-fix +# DO NOT REMOVE THIS +systemctl enable rechunker-group-fix.service + systemctl enable flatpak-preinstall.service # Updater diff --git a/system_files/shared/usr/bin/rechunker-group-fix b/system_files/shared/usr/bin/rechunker-group-fix new file mode 100755 index 00000000..78877acb --- /dev/null +++ b/system_files/shared/usr/bin/rechunker-group-fix @@ -0,0 +1,17 @@ +#!/usr/bin/env bash + +# To use this script, you'll want to put this in your systemd service: +# rm /etc/gshadow +# systemd-sysusers +# (run this script) +# systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev +# This will populate /etc/group successfully, and then populate /etc/gshadow +# with any missing groups that we nuked when we removed /etc/gshadow + +GSHADOW_FILE="/etc/gshadow" +GROUP_FILE="/etc/group" + +for f in $(cat $GROUP_FILE); do + cut -f1 -d':' <(echo $f) | xargs -I{} grep ^"{}" $GSHADOW_FILE &>/dev/null || \ + echo $(cut -f1 -d':' <(echo $f)):'!*::' >> $GSHADOW_FILE +done diff --git a/system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service b/system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service new file mode 100644 index 00000000..e05f2450 --- /dev/null +++ b/system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service @@ -0,0 +1,32 @@ +# We have this script so that people using images with `nss-altfiles` (`/usr/lib/g{roup,shadow}`) +# do not break their systems when rebasing to an image without that +# This usually happens when using https://github.com/hhd-dev/rechunk then rebasing to an image without it. +# Please DO NOT remove this unless this is fully, completely obsolete. +# This is exactly what is making it break: https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e99afbdc2eb06788ae28e157a88b03d70/1_prune.sh#L41-L47 +# Users WILL experience black screens and systems will NOT boot if this script malfunctions. Please test this properly and always make sure this works +# Relevant issues: +# - https://github.com/bootc-dev/bootc/issues/1179#issuecomment-2708305926 +# - https://github.com/ublue-os/main/issues/759 +# - https://github.com/ublue-os/bluefin-lts/issues/918 +# - https://github.com/ublue-os/image-template/issues/177 +# - https://github.com/ublue-os/aurora/issues/1468 +# - https://github.com/ublue-os/bluefin/issues/3852 +# This got created on Tue, 16 Dec 2025 00:44:58 -0300 +[Unit] +Description=Fix groups for Legacy rechunker +ConditionPathExists=/run/ostree-booted +Wants=local-fs.target +After=local-fs.target +Before=systemd-user-sessions.service +# Before=systemd-sysusers.service + +[Service] +Type=oneshot +ExecStart=bash -c 'touch /etc/gshadow && chmod 600 /etc/gshadow' +ExecStart=bash -c 'rm /etc/gshadow' +ExecStart=systemd-sysusers +ExecStart=rechunker-group-fix +ExecStart=systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev + +[Install] +WantedBy=default.target multi-user.target