Hide Forgot
Description of problem: I'm unable to create an image with package "ipa-client" with image builder. The build process always fails with a missing dependency. The problem is reproducible in on the hosted beta console (https://console.redhat.com/beta/insights/image-builder) as well as a self-hosted Cockpit instance in a RHEL 8.5 VM on my computer. Version-Release number of selected component (if applicable): osbuild-ostree-35-3.el8.noarch osbuild-composer-33.2-1.el8.x86_64 cockpit-composer-31.1-1.el8.noarch ostree-2021.3-2.el8_5.x86_64 ipa-client-4.9.6-6.module+el8.5.0+12661+bab6f12d How reproducible: always Steps to Reproduce: 1. Create a new RHEL 8 image in Console / Cockpit's Image Builder app 2. Add "ipa-client" package Actual results: Build process fails with error message error: Failed dependencies: (ipa-selinux if selinux-policy-targeted) is needed by ipa-common-4.9.6-6.module+el8.5.0+12661+bab6f12d.noarch Expected results: Image builder should succeed Additional info: If I add both "ipa-selinux" and "ipa-client" as packages, then the build process finishes successfully. This leads me to the assumption that osbuild or ostree do not understand the "Requires: (ipa-selinux if selinux-policy-targeted)" syntax correctly. https://gitlab.com/redhat/centos-stream/rpms/ipa/-/blob/c9s/freeipa.spec#L892
This is a known limitation of the way we currently dep-solve packages and, quite ironically, happens also for the "osbuild" package.
*** Bug 2075429 has been marked as a duplicate of this bug. ***
To give a bit more details: The build will fail for packages that contain conditionals like `(ipa-selinux if selinux-policy-targeted)` if the "condition" (`selinux-policy-targeted`) is NOT explicitly mentioned in the blueprint but IS contained in the final image; because in this case the conditional dependency (`ipa-selinux`) will not be in the dep-solved package set since the condition is not met, but later while building the image, the condition is met since the condition is now present but we are missing the conditional dependency. We are actively working on a different way to dep-solve to avoid this scenario.
This issue is already fixed in the latest upstream release of osbuild-composer and should be fixed in the upcoming release of RHEL (8.7 and 9.1). The issue is already resolved in the Image Builder Service.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Low: Image Builder security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:7548