Custom image ipa-client-install fail

[graybush]

Describe the bug I made a custom image and with fedora 37 silverblue as the base and layered the freeipa-client package. The final image is made from two container files that can be found here: https://github.com/graybush/ublue-base/blob/main/Containerfile https://github.com/graybush/ublue-zotac/blob/main/Containerfile The image base is quay.io/fedora-ostree-desktops/silverblue:37.

The image builds fine and I am able successfully rebase to my custom image. When attempting to setup the IPA client it fails with:

[root@fedora ~]# ipa-client-install --mkhomedir
This program will set up IPA client.
Version 4.10.1

DNS discovery failed to determine your DNS domain
Provide the domain name of your IPA server (ex: example.com): example.xxx
Discovery was successful!
Do you want to configure chrony with NTP server or pool address? [no]: 
Client hostname: fedora.xxx
Realm: EXAMPLE.XXX
DNS Domain: example.xxx
IPA Server: main.example.xxx
BaseDN: dc=example,dc=xxx

Continue to configure the system with these values? [no]: yes
[Errno 2] No such file or directory: '/var/lib/ipa-client/sysrestore/sysrestore.state'
The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

To Reproduce Please describe the steps needed to reproduce the bug:

1. Build a custom image and rpm-ostree install freeipa-client during image creation
2. Rebase to custom image
3. Setup IPA client

Expected behavior I would expect to be able to successfully setup the IPA client.

OS version:

[root@fedora ~]# rpm-ostree status -b
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
BootedDeployment:
● ostree-unverified-registry:ghcr.io/graybush/ublue-zotac:pr-7
                   Digest: sha256:de3b34633cb7e0e3174bf038aa127ff92671173375eeb866a005c432aa1dd82d
                  Version: 37.20230304.0 (2023-03-05T04:39:36Z)

Additional context When I attempt to rpm-ostree install freeipa-client on a running system e.g. stock fedora silverblue or a custom image without freeipa-client already installed, the software installs and I am able to setup the IPA client software as expected.

[travier]

So what's in:

[Errno 2] No such file or directory: '/var/lib/ipa-client/sysrestore/sysrestore.state'
The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

?

Is it installed by the RPM or setup somewhere else?

[travier]

If you're using a custom image, you must provide a link to the Containerfile you used to build it otherwise we can't know what you're doing:

ostree-unverified-registry:ghcr.io/graybush/ublue-zotac:pr-7

[graybush]

So what's in:

[Errno 2] No such file or directory: '/var/lib/ipa-client/sysrestore/sysrestore.state'
The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

?

Is it installed by the RPM or setup somewhere else?

On a stock silverblue 37 system after layering in the freeipa-client package and rebooting, but before setting up the IPA client, the /var/lib/ipa-client/sysrestore/ exists but there is no sysrestore.state file.

[root@fedora ~]# ls -la /var/lib/ipa-client/sysrestore/
total 0
drwxr-xr-x. 1 root root  0 Mar  6 07:38 .
drwxr-xr-x. 1 root root 26 Mar  6 07:38 ..

I am not sure if this path is setup by the RPM or somewhere else.

[graybush]

If you're using a custom image, you must provide a link to the Containerfile you used to build it otherwise we can't know what you're doing:

ostree-unverified-registry:ghcr.io/graybush/ublue-zotac:pr-7

I added the Containerfiles to the description and here is a link to the built container. https://github.com/graybush/ublue-zotac/pkgs/container/ublue-zotac/74955122?tag=pr-7

[travier]

Does it work if you create this directory before calling ipa-client-install --mkhomedir?

This is likely a missing tpmfiles.d config file missing in the freeipa package to create it on boot if it does not exists.

[graybush]

Yes, if I manually create /var/lib/ipa-client/sysrestore/ before calling ipa-client-install --mkhomedir it works as expected.

[travier]

Then it's a bug in the freeipa package in Fedora. it should likely ship a tpmfiles.d config creating all the required folders in /var on boot as applications/daemons should not expect /var to be populated.

[travier]

• Upstream RPM sources: https://src.fedoraproject.org/rpms/freeipa
• Upstream sources: https://pagure.io/freeipa/issues
• Reporting a bug to the FreeIPA Fedora package: https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=freeipa

Closing as this is an upstream bug.

[travier]

Please report the bug there.