Re: removable setup rpm?!

[Colin Walters]

On Fri, Aug 18, 2017, at 07:43 AM, Petr Stodulka wrote:
>  Hi folks,
>  
>  I found now that the setup rpm is removable from the system,
>  which leads to unusable system, because of missing important files,
>  like /etc/shadow, .... 
Sounds like you're using dnf for a host system?  The Fedora
editions that use rpm-ostree for the host (Atomic Host, and
https://pagure.io/workstation-ostree-config)
are quite resilient to this; in fact by default package layering is just that - layering,
it doesn't
allow removing from the base.

But while rpm-ostree has somewhat of a (partially deserved) reputation
for "you can't do that", in fact you can:

# rpm-ostree status
State: idle
● fedora-atomic:fedora/26/x86_64/atomic-host
                   Version: 26.101 (2017-08-06 21:27:14)
                    Commit:
f6331bcd14577e0ee43db3ba5a44e0f63f74a86e3955604c20542df0b7ad8ad6
              GPGSignature: Valid signature by E641850B77DF435378D1D7E2812A6B4B64DAB85D
# rpm-ostree ex override remove setup
...
Resolving dependencies... failed
error: The following base packages would be removed: atomic-1.18.1-5.fc26.x86_64,
atomic-devmode-0.3.7-1.fc26.noarch, cloud-init-0.7.9-7.fc26.noarch,
cockpit-docker-147-1.fc26.x86_64, cockpit-networkmanager-147-1.fc26.noarch,
cockpit-ostree-147-1.fc26.x86_64, cockpit-system-147-1.fc26.noarch,
nfs-utils-1:2.1.1-5.rc5.fc26.x86_64, rpcbind-0.2.4-7.rc2.fc26.x86_64,
shadow-utils-2:4.3.1-3.fc26.x86_64

But let's say that's not scary enough and I really, really want to try 😉

# rpm-ostree ex override remove setup atomic atomic-devmode cloud-init
cockpit-{docker,networkmanager,ostree,system} nfs-utils rpcbind shadow-utils
...
Transaction complete; bootconfig swap: yes deployment count change: 1
...
Run "systemctl reboot" to start a reboot
# rpm-ostree status
State: idle
Deployments:
  fedora-atomic:fedora/26/x86_64/atomic-host
                   Version: 26.101 (2017-08-06 21:27:14)
                BaseCommit:
f6331bcd14577e0ee43db3ba5a44e0f63f74a86e3955604c20542df0b7ad8ad6
              GPGSignature: Valid signature by E641850B77DF435378D1D7E2812A6B4B64DAB85D
       RemovedBasePackages: atomic-1.18.1-5.fc26.x86_64, cloud-init-0.7.9-7.fc26.noarch,
shadow-utils-2:4.3.1-3.fc26.x86_64, rpcbind-0.2.4-7.rc2.fc26.x86_64,
cockpit-system-147-1.fc26.noarch, nfs-utils-1:2.1.1-5.rc5.fc26.x86_64,
cockpit-networkmanager-147-1.fc26.noarch, cockpit-docker-147-1.fc26.x86_64,
setup-2.10.5-2.fc26.noarch, atomic-devmode-0.3.7-1.fc26.noarch,
cockpit-ostree-147-1.fc26.x86_64

● fedora-atomic:fedora/26/x86_64/atomic-host
                   Version: 26.101 (2017-08-06 21:27:14)
                    Commit:
f6331bcd14577e0ee43db3ba5a44e0f63f74a86e3955604c20542df0b7ad8ad6
              GPGSignature: Valid signature by E641850B77DF435378D1D7E2812A6B4B64DAB85D
# 

But of course by design, the override remove packages are still
available in the base tree; your current system was untouched, and
if you choose to reboot and something went wrong, you'll have the rollback.
And regardless, undoing the override is always possible, without redownloading
anything (which would obviously not be easily possible here since I removed
NetworkManager):

# rpm-ostree ex override reset setup atomic atomic-devmode cloud-init
cockpit-{docker,networkmanager,ostree,system} nfs-utils rpcbind shadow-utils

Will get back to the base.