GIDs should be consistent for common groups in OSTree commits

[achilleas-k]

System groups that don't specify their gid will have different IDs under different package/system configurations. This becomes an issue when we generate ostree commits that might be used to upgrade existing systems. gids can change during upgrade, affecting the permissions/ownership of system files.

It's impossible to cover all cases but at least for common cases and base packages, we should have consistent gids to avoid creating commits that will affect existing systems.

We should also document this issue as a warning for users creating commits for use in this way.

If the user provides a parent commit, we should use the passwd and group files from the parent while building the commit to avoid gid conflicts.

Comment from @gicmo on PR where issue came up

I had a quick moment to think about that, and I think the missing piece is that osbuild does not do the equivalent of preserve-passwd and check-passwd from rpm-ostree (see its treefile doc). Need to have a look at the rpm-ostree code to see what needs to be done to replicate the behaviour.

Ok, I think I found the place in rpm-ostree: /src/app/rpmostree-compose-builtin-tree.cxx#L440

Group is created in rt-setup.spec

Polkit and ssh-keys groups are added without specifying any gids.

Originally posted by @gicmo in #1175 (comment)

[teg]

Currently we don't pull in the parent commit, so this is going to be interesting.

[gicmo]

Currently we don't pull in the parent commit, so this is going to be interesting.

We wanted access to the parent commit for the iso installer, no? So that is going in the same direction. The alternative is to provide the actual group, passwd files, like Fedora IoT/Silverblue/FOCS currently do.