Skip to content

fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
castrojo merged 1 commit into from
May 30, 2026
Merged

fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions build_files/base/17-cleanup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,10 @@ systemctl enable rpm-ostree-countme.service
systemctl enable tailscaled.service
systemctl enable ublue-system-setup.service

# see /usr/bin/rechunker-group-fix
# DO NOT REMOVE THIS
systemctl enable rechunker-group-fix.service

systemctl enable flatpak-preinstall.service

# Updater
Expand Down
17 changes: 17 additions & 0 deletions system_files/shared/usr/bin/rechunker-group-fix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
#!/usr/bin/env bash

# To use this script, you'll want to put this in your systemd service:
# rm /etc/gshadow
# systemd-sysusers
# (run this script)
# systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev
# This will populate /etc/group successfully, and then populate /etc/gshadow
# with any missing groups that we nuked when we removed /etc/gshadow

GSHADOW_FILE="/etc/gshadow"
GROUP_FILE="/etc/group"

for f in $(cat $GROUP_FILE); do
cut -f1 -d':' <(echo $f) | xargs -I{} grep ^"{}" $GSHADOW_FILE &>/dev/null || \
echo $(cut -f1 -d':' <(echo $f)):'!*::' >> $GSHADOW_FILE
done
32 changes: 32 additions & 0 deletions system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
# We have this script so that people using images with `nss-altfiles` (`/usr/lib/g{roup,shadow}`)
# do not break their systems when rebasing to an image without that
# This usually happens when using https://github.com/hhd-dev/rechunk then rebasing to an image without it.
# Please DO NOT remove this unless this is fully, completely obsolete.
# This is exactly what is making it break: https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e99afbdc2eb06788ae28e157a88b03d70/1_prune.sh#L41-L47
# Users WILL experience black screens and systems will NOT boot if this script malfunctions. Please test this properly and always make sure this works
# Relevant issues:
# - https://github.com/bootc-dev/bootc/issues/1179#issuecomment-2708305926
# - https://github.com/ublue-os/main/issues/759
# - https://github.com/ublue-os/bluefin-lts/issues/918
# - https://github.com/ublue-os/image-template/issues/177
# - https://github.com/ublue-os/aurora/issues/1468
# - https://github.com/ublue-os/bluefin/issues/3852
# This got created on Tue, 16 Dec 2025 00:44:58 -0300
[Unit]
Description=Fix groups for Legacy rechunker
ConditionPathExists=/run/ostree-booted

@cgwalters cgwalters Jun 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it'd be cleaner to do ConditionPathExists=/usr/lib/passwd

Wants=local-fs.target
After=local-fs.target
Before=systemd-user-sessions.service
# Before=systemd-sysusers.service

@cgwalters cgwalters Jun 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See below


[Service]
Type=oneshot
ExecStart=bash -c 'touch /etc/gshadow && chmod 600 /etc/gshadow'
ExecStart=bash -c 'rm /etc/gshadow'

@cgwalters cgwalters Jun 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well...that's a heavy hammer. In the version added to bootc we're careful to only remove shadow entries for users/groups that are orphaned.

(I think users are relevant in this problem domain too, not just groups right?)

Now in practice...it is probably exceedingly unlikely that anyone has a group with a password locally - it's really legacy cruft, the use cases for it are better handled via e.g. ACLs or other tools.

ExecStart=systemd-sysusers

@cgwalters cgwalters Jun 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, running sysusers twice seems suboptimal

ExecStart=rechunker-group-fix
ExecStart=systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev

[Install]
WantedBy=default.target multi-user.target
Loading