max / alloy

Declare geoclue's /var wherever geoclue is, not wherever the client is bootc's var-tmpfiles lint failed the first astra mint at step 103 of 103 on one path: /var/lib/geoclue, present and undeclared. Same class as the libX11 cache an hour earlier, and the second time in one afternoon that a declaration living in the client file went missing on a server that installs the package anyway. geoclue rides in under GTK and WebKit, so GUI=tauri brings it to a headless machine. It cannot move to 50-alloy-var.conf beside libX11, and the difference is the user. libX11's cache is root-owned, so declaring it where the package is absent costs an empty directory. `d /var/lib/geoclue 0755 geoclue geoclue` names an account that arrives with the package, and systemd-tmpfiles fails at boot on a line whose user does not resolve, which is why the client file is a separate file at all. So it gets its own file, keyed on the image rather than on a dial: it ships where `getent passwd geoclue` answers and is deleted where it does not. Two dials have now dragged this package in for two different reasons and a condition naming them would be wrong about the third. Both directions are asserted, since a declaration for an absent user fails at boot and a missing one for a present user fails the lint. Two comments that had gone false are corrected rather than left: the client file's header no longer cites geoclue as a user a server lacks, and the avahi note no longer claims geoclue2 is gone on every server.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013wvegQEzB5piwPowYQ3ZbV

Author: Max Johnson <me@maxj.phd> · 2026-09-04 21:15 UTC

Signed with PGP, not checked

Commit: 218321a27cb449381dc2416dbc7db71f8163d76b

Parent: d67e72f

3 files changed, +62 insertions, -8 deletions

M Containerfile +32 -6

			@@ -1481,8 +1481,12 @@
1481	1481		# `<name>.local`, so publishing is load-bearing.
1482	1482		#
1483	1483		# Note this is the group whose weak-dependency carriers are mostly
1484		-	# client-side (cups-libs, pipewire, geoclue2). On `server` those are
1485		-	# gone, so avahi arrives only because this line names it — which is
	1484	+	# client-side (cups-libs, pipewire, geoclue2). On a headless `server`
	1485	+	# those are gone, so avahi arrives only because this line names it.
	1486	+	# geoclue2 is back on a `server` that sets GUI=tauri, since it rides in
	1487	+	# under GTK and WebKit, measured 2026-09-04 on astra; that changes which
	1488	+	# carriers exist and not the conclusion, which is that naming avahi is
	1489	+	# what makes it a decision — which is
1486	1490		# exactly the profile where the install flow depends on it most.
1487	1491		#
1488	1492		# nss-mdns is the half that was missing. It needs no nsswitch edit from
			@@ -2633,14 +2637,24 @@
2633	2637		# is now the single definition, and this runs it.
2634	2638		#
2635	2639		# The client half is a separate file because it cannot merely be inert on
2636		-	# `server`: `d /var/lib/geoclue 0755 geoclue geoclue` and the three greetd
2637		-	# lines name users that arrive with packages this profile does not install, and
2638		-	# systemd-tmpfiles fails a line whose user does not resolve. So it is deleted
2639		-	# rather than shipped and ignored, and the `else` proves the deletion happened.
	2640	+	# `server`: the three greetd lines name a user that arrives with a package this
	2641	+	# profile does not install, and systemd-tmpfiles fails a line whose user does not
	2642	+	# resolve. So it is deleted rather than shipped and ignored, and the `else`
	2643	+	# proves the deletion happened.
2640	2644		#
2641	2645		# --dry-run --create on each file is the check that matters, and it is the same
2642	2646		# one the flatpak rule gets further down: a tmpfiles line with a typo in it is
2643	2647		# accepted by every build step except the boot it silently does nothing on.
	2648	+	#
	2649	+	# THE GEOCLUE HALF KEYS ON THE IMAGE, not on a dial, and that is the whole point
	2650	+	# of it being separate. geoclue arrives with the GTK and WebKit stack, so it is
	2651	+	# on every client and also on a server that sets GUI=tauri; its line was in the
	2652	+	# client file, which a server deletes whole, and the first astra mint failed
	2653	+	# bootc's var-tmpfiles lint on exactly that path. Keying the fix on `$PROFILE`
	2654	+	# and `$GUI` would answer today's two reasons and be wrong about the third, so
	2655	+	# the condition asks the image whether the account exists. A declaration naming a
	2656	+	# user that is not there fails at boot, and one missing for a user that is there
	2657	+	# fails the lint, so both directions are asserted rather than one.
2644	2658		RUN set -eux; \
2645	2659		greeter=/usr/lib/sysusers.d/50-alloy-greeter.conf; \
2646	2660		common=/usr/lib/tmpfiles.d/50-alloy-var.conf; \
			@@ -2666,6 +2680,18 @@
2666	2680		&& { echo "profile=server has a greeter account but no greeter" >&2; exit 1; }; \
2667	2681		echo "greeter: no account on this profile"; \
2668	2682		fi; \
	2683	+	geoclue=/usr/lib/tmpfiles.d/50-alloy-var-geoclue.conf; \
	2684	+	if getent passwd geoclue >/dev/null; then \
	2685	+	[ -f "$geoclue" ] \|\| { echo "$geoclue did not land and this image has geoclue; /var/lib/geoclue would be undeclared and bootc lint refuses that" >&2; exit 1; }; \
	2686	+	systemd-tmpfiles --dry-run --create "$geoclue" >/dev/null \
	2687	+	\|\| { echo "systemd-tmpfiles rejects $geoclue" >&2; exit 1; }; \
	2688	+	echo "var: geoclue is installed, so its declaration ships"; \
	2689	+	else \
	2690	+	rm -f "$geoclue"; \
	2691	+	[ ! -e "$geoclue" ] \
	2692	+	\|\| { echo "this image has no geoclue account and still carries its /var declaration, whose user systemd-tmpfiles cannot resolve at boot" >&2; exit 1; }; \
	2693	+	echo "var: no geoclue on this image, so no declaration for it"; \
	2694	+	fi; \
2669	2695		echo "var: tmpfiles declarations present and accepted for profile=$PROFILE"
2670	2696
2671	2697		# The database's /var, on the same rule as the client half above.

M usr/lib/tmpfiles.d/50-alloy-var-client.conf +6 -2

			@@ -2,10 +2,15 @@
2	2		# content needs declaring at all.
3	3		#
4	4		# Deleted on `server`, and it has to be rather than merely being harmless there:
5		-	# the geoclue and greetd lines name users that arrive with their packages, and
	5	+	# the greetd lines name a user that arrives with its package, and
6	6		# systemd-tmpfiles fails a line whose user does not resolve. The Containerfile
7	7		# removes it in the profile block and asserts it is gone.
8	8		#
	9	+	# geoclue used to be here and is now in 50-alloy-var-geoclue.conf. It was the one
	10	+	# entry that was never really client-side: it arrives with the GTK and WebKit
	11	+	# stack, so a server that sets GUI=tauri carries it too, and deleting this file
	12	+	# took its declaration away. See that file.
	13	+	#
9	14		# Modes and owners are the ones the packages themselves created, read back off a
10	15		# built image rather than chosen here. A line that widens one of them would be a
11	16		# permissions change nobody asked for, wearing a lint fix as a disguise.
			@@ -26,7 +31,6 @@
26	31		d /var/lib/color/icc 0755 root root - -
27	32		d /var/lib/flatpak 0755 root root - -
28	33		d /var/lib/fprint 0700 root root - -
29		-	d /var/lib/geoclue 0755 geoclue geoclue - -
30	34		d /var/lib/greetd/.config 0755 greetd greetd - -
31	35		d /var/lib/greetd/.config/systemd 0755 greetd greetd - -
32	36		d /var/lib/greetd/.config/systemd/user 0755 greetd greetd - -

A usr/lib/tmpfiles.d/50-alloy-var-geoclue.conf +24

		@@ -1,0 +1,24 @@
1	+	# geoclue's /var, declared wherever geoclue is installed and nowhere else.
2	+	#
3	+	# Its own file because it is the one client-side declaration that is not
4	+	# client-side. geoclue arrives with the GTK and WebKit stack, so it lands on
5	+	# every client and also on a server that sets GUI=tauri -- astra, which builds
6	+	# the arm64 Tauri releases natively. It sat in 50-alloy-var-client.conf, which a
7	+	# server deletes whole, and the first astra mint failed bootc's var-tmpfiles
8	+	# lint on this one path (2026-09-04, step 103 of 103).
9	+	#
10	+	# It cannot move to 50-alloy-var.conf beside the libX11 cache, and the
11	+	# difference is the user. `d /var/lib/geoclue 0755 geoclue geoclue` names an
12	+	# account that arrives with the package, and systemd-tmpfiles fails at boot on a
13	+	# line whose user does not resolve -- which is the whole reason the client file
14	+	# exists as a separate file in the first place.
15	+	#
16	+	# So the Containerfile keys this one on the fact rather than on a dial: it ships
17	+	# where `getent passwd geoclue` answers and is deleted where it does not. Two
18	+	# dials have now dragged this package in for two different reasons, and a
19	+	# condition that reads the image cannot be wrong about the third.
20	+	#
21	+	# Mode and owner are the ones the package created, read back off a built image.
22	+	#
23	+	#Type Path Mode User Group Age Argument
24	+	d /var/lib/geoclue 0755 geoclue geoclue - -