feat: add rechunker-group-fix safety net for legacy rechunk migration - #4633
Closed
dylanmtaylor wants to merge 1 commit into
Closed
feat: add rechunker-group-fix safety net for legacy rechunk migration#4633dylanmtaylor wants to merge 1 commit into
dylanmtaylor wants to merge 1 commit into
Conversation
dylanmtaylor
requested review from
castrojo,
m2Giles,
p5 and
tulilirockz
as code owners
May 16, 2026 01:17
dosubot
Bot
added
size:M
dylanmtaylor
force-pushed
the
rechunker-group-fix
branch
from
May 16, 2026 01:18
a4ce989 to
32fd679
Compare
Up to standards ✅🟢 Issues
|
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a one-shot systemd migration safety net intended to regenerate /etc/gshadow for systems moving away from legacy rechunker/nss-altfiles handling.
Changes:
- Adds
rechunker-group-fix.serviceto run the migration once on ostree-booted systems. - Adds
/usr/bin/rechunker-group-fixhelper to add missing/etc/gshadowentries. - Enables the new service during image cleanup.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service |
Defines the one-shot boot-time migration unit. |
system_files/shared/usr/bin/rechunker-group-fix |
Adds helper logic to populate missing gshadow groups. |
build_files/base/17-cleanup.sh |
Enables the migration unit in built images. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+25
to
+27
| ExecStart=/usr/bin/bash -c 'rm -f /etc/gshadow' | ||
| ExecStart=/usr/bin/systemd-sysusers | ||
| ExecStart=/usr/bin/rechunker-group-fix |
Contributor
Author
There was a problem hiding this comment.
I don't want to deviate rechunker-group-fix from Aurora. The script is intentionally aligned with Aurora to keep cross-distro behavior consistent and reduce risk by shipping something that is known to work.
|
|
||
| # see /usr/bin/rechunker-group-fix | ||
| # DO NOT REMOVE THIS | ||
| systemctl enable rechunker-group-fix.service |
Contributor
Author
|
I am going to test/validate this on my own machine and report back with results. |
dylanmtaylor
force-pushed
the
rechunker-group-fix
branch
from
May 16, 2026 01:31
32fd679 to
7252595
Compare
Member
|
I would put this change in the PR where you remove the hdd rechunker (and move to another one for damage control on the update sizes) |
Adds a one-shot systemd unit that regenerates /etc/gshadow on first boot when migrating from images built with hhd-dev/legacy-rechunk's nss-altfiles handling. Without this, users rebasing to images that no longer use the legacy rechunker hit black screens or fail to boot. The unit is gated by ConditionPathExists=!/var/lib/.rechunker-group-fix-done so it runs once and never again. Lands ahead of the rechunker swap so the fix is baked into running systems before they encounter post-swap images. Split out of ublue-os#4564 to derisk the change based on feedback by @bsherman. Refs ublue-os#4510, ublue-os#3917
dylanmtaylor
force-pushed
the
rechunker-group-fix
branch
from
May 22, 2026 15:52
7252595 to
4d735d7
Compare
dylanmtaylor
added a commit
to dylanmtaylor/bluefin
that referenced
this pull request
May 22, 2026
Switches the rechunk pipeline from hhd-dev/legacy-rechunk to rpm-ostree's built-in compose build-chunked-oci. Adds incremental rebuild support via --previous-build when a prior image is available. Adds load-rootful and export-oci helpers; export-oci is wired into the CI workflow to upload an OCI archive artifact for PR testing. Workflow changes: switches to a BTRFS-mounted podman storage, installs a newer podman from brew to work around a missing layer annotation push (podman-container-tools/podman#27796), and pushes images twice to ensure annotations are sent. Depends on: - ublue-os#4633 rechunker-group-fix safety net - the SBOM/changelogs split-out PR (provides the gen-sbom Just recipe this workflow calls) Closes ublue-os#4510, ublue-os#3917 Split out of ublue-os#4564 to derisk the change based on feedback by @bsherman and @renner0e.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a one-shot systemd unit that regenerates
/etc/gshadowon first boot when migrating from images built withhhd-dev/legacy-rechunk'snss-altfileshandling. Without this, users rebasing to images that no longer use the legacy rechunker hit black screens or fail to boot.The unit is gated by
ConditionPathExists=!/var/lib/.rechunker-group-fix-doneso it runs once per system and never again.Lands ahead of the rechunker swap so the fix is baked into running systems before they encounter post-swap images.
Split out of #4564 to derisk the change based on feedback by @bsherman.
Refs #4510, #3917