I had a look at this and while conversion of the users to a 'sysusers' file and it's distribution is trivial, it's incompatible with libvirt distributing the 'spec' file as part of the upstream project and including it in the release tarball.

The problem originates from the need to use the '%sysusers_create_compat' macro which re-expands the sysuser file into commands to actually add the user. The macro takes a path to the sysusers file but that file, when included in the tarball can't be referenced by 'rpmbuild' at that point.

This would fundamendally break the way e.g. CI builds packages.

I see only 3 options for now:
1) we keep the script to create users
2) the macro is reworked somehow to work properly even for packages wanting to use 'rpmbuild -tb' way to extrac the spec from a tarball
3) libvirt's sysusers file will be distributed as part of the dirstribution so we can rely on it being already installed

For reference I'm attaching the sysusers file I've made for libvirt and a comparison of the scripts generated by %sysusers_create_compat and what we have now:

$ cat src/qemu/libvirt-qemu.sysusers
# This file is part of libvirt's qemu VM driver
#
# Libvirt requires soft static allocation of well-known ids, as disk images
# are commonly shared across NFS mounts by id rather than name.
#
# This config:
# - creates a 'kvm' group with gid 36
# - creates a 'qemu' user and group with uid 107 and gid 107
# - adds the 'qemu' user to the 'kvm' group
g kvm  36
u qemu 107 "qemu user"
m qemu kvm
$ /usr/lib/rpm/sysusers.generate-pre.sh src/qemu/libvirt-qemu.sysusers
# generated from libvirt-qemu.sysusers
getent group 'kvm' >/dev/null || groupadd -f -g '36' -r 'kvm' || :
getent group 'qemu' >/dev/null || groupadd -f -g '107' -r 'qemu' || :
if ! getent passwd 'qemu' >/dev/null; then
    if ! getent passwd '107' >/dev/null; then
        useradd -r -u '107' -g 'qemu' -d '/' -s /sbin/nologin -c 'qemu user' 'qemu' || :
    else
        useradd -r -g 'qemu' -d '/' -s /sbin/nologin -c 'qemu user' 'qemu' || :
    fi
fi

getent group 'kvm' >/dev/null || groupadd -r 'kvm' || :
getent passwd 'qemu' >/dev/null || \
    useradd -r -g 'kvm' -d '/' -s '/sbin/nologin' -c '' 'qemu' || :

Now we have:

getent group kvm >/dev/null || groupadd -f -g 36 -r kvm
getent group qemu >/dev/null || groupadd -f -g 107 -r qemu
if ! getent passwd qemu >/dev/null; then
  if ! getent passwd 107 >/dev/null; then
    useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin -c "qemu user" qemu
  else
    useradd -r -g qemu -G kvm -d / -s /sbin/nologin -c "qemu user" qemu
  fi
fi
exit 0

Pat,

are you involved by any means in the effort to use the 'sysuser' files or can point somebody to this bug?

Based on my above comment it currently doesn't seem that libvirt will be able to use what you suggested without breaking builds from tarball which doesn't seem acceptable.

Alas, I'm not really involved in the larger scale effort to move to systemd-sysusers.

Neal might know what the larger plans are for this type of scenario....

Neal, any ideas on building from tarball with systemd-sysusers and RPM, or who we should add to the CC list?

As outlined in Comment #2 it's currently impossible for libvirt to use the new approach requested in this BZ. Please reopen this bug if it will become possible in the future.