Bug 2546181

Summary:	image-builder writes pxeboot initrd.img with 0600 permissions so it cannot be downloaded
Product:	[Fedora] Fedora	Reporter:	Adam Williamson (Fedora) <rhbz>
Component:	image-builder	Assignee:	Simon de Vlieger <cmdr>
Status:	CLOSED RAWHIDE	QA Contact:
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	cmdr, go-sig, osbuilders
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	openqa
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-15 20:32:17 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Adam Williamson (Fedora) 2026-10-05 22:55:54 UTC

Since Fedora Rawhide installer images were switched to building with image-builder, the openQA pxeboot install test is failing.

I *think* this is because image-builder writes pxeboot/initrd.img with 0600 permissions, so it cannot be downloaded. Here's the file from the last lorax compose, on the compose host:

-rw-r--r--. 1 root root 286324656 Sep 29 05:42 /mnt/fedora_koji/koji/compose/rawhide/Fedora-Rawhide-20260929.n.0/compose/Everything/x86_64/os/images/pxeboot/initrd.img

and from the latest image-builder compose:

-rw-------. 1 root root 286536964 Oct  5 05:32 /mnt/fedora_koji/koji/compose/rawhide/Fedora-Rawhide-20261005.n.0/compose/Everything/x86_64/os/images/pxeboot/initrd.img

...and indeed, if you try to download https://kojipkgs.fedoraproject.org/compose/rawhide/Fedora-Rawhide-20261005.n.0/compose/Everything/x86_64/os/images/pxeboot/initrd.img , you'll find it's 403.

The pxeboot test downloads this file as initrd.img in the pxeboot tree. It uses curl and doesn't use -f , so it was 'succeeding', but the initramfs was just a text file with an HTTP 403 error in it. (I've changed the test to use -f now). That's likely the cause of this failure.

The file should have 0644 permissions, like it did with lorax.

Comment 1 Adam Williamson (Fedora) 2026-10-06 23:56:36 UTC

To join a few dots here: the way these files actually wind up in that location in the compose tree is that the boot ISO builder (formerly lorax, now image-builder) puts them in the ISO, then pungi copies the contents of the ISO out to that location in the compose tree. Seems a slightly baroque approach but hey. For the new boot_iso phase, this is done in `pungi/phases/boot_iso.py` method `RunBootIsoThread._extract_boot_infra`.

So I checked an image-builder-created ISO, and sure enough, the file permissions are wrong there:

[root@omnibook unixODBC (rawhide)]# mount /var/home/adamw/Downloads/iso/46/Fedora-Everything-netinst-x86_64-Rawhide-20261005.n.0.iso /mnt/temp1
[root@omnibook unixODBC (rawhide)]# ls /mnt/temp1/images/pxeboot/ -l
total 298580
-rw-------. 1 root root 286536964 Oct  4 22:32 initrd.img

so if we fix the permissions there, it should fix this problem.

Comment 2 Simon de Vlieger 2026-10-07 05:09:14 UTC

Thanks Adam, I kept the `buildinstall` approach to creating the PXE tree (by exploding the ISO) so while I do feel it's probably better to fix this up in `pungi` in the interest of backwards compatibility for other users who also manually explode the ISO I'll document (and fix up in `image-builder`) that the `/images/pxeboot` files need 644 permissions.

Comment 3 Simon de Vlieger 2026-10-07 05:17:18 UTC

Upstream PR: https://github.com/osbuild/image-builder/pull/2747

Comment 4 Simon de Vlieger 2026-10-08 06:24:51 UTC

Should be in rawhide now via: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3595d7b688

Comment 5 Simon de Vlieger 2026-10-15 20:32:17 UTC

This has been resolved.