F32 (recently branched) toolbox container still uses rawhide repos as default

[garrett]

Note: This is not about toolbox the toolbox command itself, but about the F32 container that toolbox uses.

Apologies in advance if this is not the right place to report the issue. (If not here, where is the correct place? Bugzilla... or here... or somewhere else?)

---

After upgrading to Fedora 32 pre-beta using Silverblue, creating a toolbox container works (thankfully), but a Fedora 32 container still uses rawhide in /etc/yum.repos.d/*. (Rawhide repos are enabled and normal, non-rawhide Fedora repos are not enabled.)

DNF installs and upgrades then fail with a mismatched key.

(Truncated verbose output with ellipses, to show relevant parts.)

 $ toolbox create -r 32 -c test-f32
Created container: test-f32
Enter with: toolbox enter --container test-f32

 $ toolbox enter --container test-f32
⬢[garrett@toolbox garrett]$ sudo dnf upgrade dnf -y
...
Fedora - Modular Rawhide - Developmental packages for the next 744 kB/s | 2.0 MB     00:02    
Fedora - Rawhide - Developmental packages for the next Fedora  2.3 MB/s |  70 MB     00:30    
Dependencies resolved.
...
Upgrading:
 dnf                              noarch         4.2.19-1.fc33           rawhide         405 k
...
Downloading Packages:
...
(6/15): dnf-4.2.19-1.fc33.noarch.rpm                           971 kB/s | 405 kB     00:00    
...
warning: /var/cache/dnf/rawhide-2d95c80a1fa0a67d/packages/deltarpm-3.6.2-5.fc32.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 9570ff31: NOKEY
Fedora - Rawhide - Developmental packages for the next Fedora  1.6 MB/s | 1.6 kB     00:00    
GPG key at file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-32-x86_64 (0x12C944D0) is already installed
The GPG keys listed for the "Fedora - Rawhide - Developmental packages for the next Fedora release" repository are already installed but they are not correct for this package.
Check that the correct key URLs are configured for this repository.. Failing package is: deltarpm-3.6.2-5.fc32.x86_64
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-32-x86_64

[martinpitt]

https://github.com/containers/toolbox/blob/master/images/fedora/f32/Dockerfile actually looks reasonable.

I first checked the fedora:32 container image, and it also seems okay:

$ podman run -it --rm registry.fedoraproject.org/fedora:32 bash
# # dnf repolist
repo id                                                                                                                         repo name
fedora                                                                                                                          Fedora 32 - x86_64
fedora-modular                                                                                                                  Fedora Modular 32 - x86_64
updates                                                                                                                         Fedora 32 - x86_64 - Updates
updates-modular                                                                                                                 Fedora Modular 32 - x86_64 - Updates
updates-testing                                                                                                                 Fedora 32 - x86_64 - Test Updates
updates-testing-modular                                                                                                         Fedora Modular 32 - x86_64 - Test Updates

The container still has /etc/yum.repos.d/fedora-rawhide.repo , but it's disabled by default. dnf upgrade works.

The problem is that the toolbox f32 container is out of date:

$ podman run -it --rm registry.fedoraproject.org/f32/fedora-toolbox:32 bash
# dnf repolist
Fedora - Modular Rawhide - Developmental packages for the next Fedora release
[...]
*rawhide                          Fedora - Rawhide - Developmental packages for the next Fedora release                           59008
*rawhide-modular                  Fedora - Modular Rawhide - Developmental packages for the next Fedora release                       0

That image was created 3 months (!) ago, waay before F32 branched off. So it seems that toolbox F32 image simply needs to be rebuilt, then everything should be fine.

[martinpitt]

BTW, registry.fedoraproject.org/f31/fedora-toolbox was built 5 months ago -- any chance that could get a refresher too, so that after creation one doesn't need to spend so much time installing upgrades?

[HarryMichal]

@juhp, could you, please, rebuild the image?

[juhp]

I was trying to build them last week but they failed - will try again.

[juhp]

I dunno why but dnf is still giving a 143 error:

https://koji.fedoraproject.org/koji/taskinfo?taskID=41976528 (f33)

Same for f32 container (f31 builds okay).

(There is also the Fedora Container Images product in bugzilla with fedora-toolbox component, but to be honest I find it just as easy to track here.)

[juhp]

Even after that (ie skipping missing-docs), I see install errors:

: 
  Installing       : mtr-2:0.92-6.fc32.x86_64                                                                             87/100 
Error unpacking rpm package mtr-2:0.92-6.fc32.x86_64
  Running scriptlet: mlocate-0.26-25.fc32.x86_64                                                                          88/100 
error: unpacking of archive failed on file /usr/sbin/mtr-packet;5e58802a: cpio: cap_set_file
error: mtr-2:0.92-6.fc32.x86_64: install failed
  Installing       : iputils-20190515-5.fc32.x86_64                                                                       93/100 
Error unpacking rpm package iputils-20190515-5.fc32.x86_64
  Installing       : hostname-3.23-2.fc32.x86_64                                                                          94/100 
error: unpacking of archive failed on file /usr/bin/arping;5e58802a: cpio: cap_set_file
error: iputils-20190515-5.fc32.x86_64: install failed

[juhp]

Seems cap_set_file error is caused by containers/buildah#2176 (ie buildah-1.14.0).
At least It builds okay locally for me with buildah-1.12.0.

[HarryMichal]

I just tried the new image by simply deleting the one on my machine and just typing toolbox create on my Silverblue 32 and repositories seem to be alright.

Thank you @juhp! Closing.

PS: @juhp also create an image for Fedora 33 which is current Rawhide and it also works!

[juhp]

Yep, thanks for testing (and spotting the new images - I had meant to report back here:) 👍