Installation of Trezor Bridge fails on Fedora Silverblue

[triceo]

[root@degrasse Downloads]# LC_ALL=C rpm-ostree install trezor-bridge-2.0.30-1.x86_64.rpm
---SNIP---
Running pre scripts... done
error: Running %prein for trezor-bridge: bwrap(/bin/sh): Proces potomka byl zabit signálem 1; run `journalctl -t 'rpm-ostree(trezor-bridge.prein)'` for more information

[root@degrasse Downloads]# journalctl -t 'rpm-ostree(trezor-bridge.prein)'
kvě 21 22:43:24 degrasse rpm-ostree(trezor-bridge.prein)[29347]: touch: nelze se dotknout (provést příkaz „touch“) '/var/log/trezord.log': Adresář nebo soubor neexistuje
kvě 21 22:43:24 degrasse rpm-ostree(trezor-bridge.prein)[29348]: chown: nelze přistoupit k '/var/log/trezord.log': Adresář nebo soubor neexistuje
kvě 21 22:43:24 degrasse rpm-ostree(trezor-bridge.prein)[29349]: chmod: nelze přistoupit k '/var/log/trezord.log': Adresář nebo soubor neexistuje

Silverblue is immutable. There can be no write access to /var in the prein scripts. I have not been able to find a workaround.

(My apologies for the Czech in the log. My system locale is cs_CZ.)

[triceo]

Specifically, this and the following lines are the problem:

https://github.com/trezor/trezord-go/blob/master/release/linux/fpm.before-install.sh#L5

[prusnak]

@triceo I am inclined to say that supporting distributions that do not adhere to FHS standard is out of scope of RPM provided by our project. However, can you please ask among the Silverblue folks how they usually solve this? I am sure there are plenty of RPM packages that have the same issue on Silverblue.

[triceo]

@prusnak I have found a similar issue in another package: https://bugzilla.redhat.com/show_bug.cgi?id=1817258

This was the fix: https://src.fedoraproject.org/rpms/dpkg/c/44e117baf58e10d5ef84281259574cf42b607b2d?branch=rawhide

[prusnak]

@triceo That does not really look like a good fix.

The best solution would be to create a Fedora specific package and maintain it there, similarly to https://src.fedoraproject.org/rpms/python-trezor

That would have another advantage allowing people to use the already trusted Fedora repositories and not needing to install 3rd party RPMs.

Are you ready to take the task of maintaining these? Or will you find someone in RH and/or Fedora community to maintain the package. It should be quite trivial and lots of other distributions already do this.

PS: I am closing this as I feel this is really out-of-scope of the upstream project.

[hegjon]

My two cents as the maintainer of python-trezor package for Fedora.

@triceo Could you install the package with something similar to rpm --install --noscripts as a work-around. Then run the scripts manually after?

@prusnak Could it be a better solution to move the file creation to ExecStartPre= in the systemd init script? An example from the arangodb-server:

ExecStartPre=/usr/bin/install -g arangodb -o arangodb -d /var/tmp/arangodb3
ExecStartPre=/usr/bin/install -g arangodb -o arangodb -d /var/run/arangodb3
ExecStartPre=/bin/chown -R arangodb:arangodb /var/log/arangodb3
ExecStartPre=/bin/chmod 700 /var/log/arangodb3
ExecStartPre=/bin/chown -R arangodb:arangodb /var/lib/arangodb3
ExecStartPre=/bin/chmod 700 /var/lib/arangodb3
ExecStartPre=/bin/chown -R arangodb:arangodb /var/lib/arangodb3-apps
ExecStartPre=/bin/chmod 700 /var/lib/arangodb3-apps

Full source: https://github.com/arangodb/arangodb/blob/devel/Installation/systemd/arangodb3.service.in

[prusnak]

@prusnak Could it be a better solution to move the file creation to ExecStartPre= in the systemd init script? An example from the arangodb-server:

That sounds good! Will you please send a pull request?

[triceo]

@prusnak Great to see this fixed! When is the next release coming out?

[prusnak]

No ETA. This small change does not really need a release and there is an easy workaround (--noscripts). If you need the package now, you could start maintaining a package in Fedora. Other distributions do that already and don't need to wait for the release.

OTOH, there is an issue https://github.com/trezor/trezord-go/pull/254 which is worth releasing. So maybe there will be a release coming up later.