Incorrect capabilities set for some binaries during compose (Rawhide only) about rpm-ostree

[debarshiray]

Thanks for investigating this, @travier @jlebon !

[travier]

All of the compose image composes that I did were in a Fedora 39 buildroot (including the FCOS ones), so this probably why we're not seeing that there yet.

Edit: I did a compose image from a rawhide buildroot and the capabilities are incorrect there as well, so this is definitely a rawhide vs f39 thing.

[jlebon]

Should be fixed by #4769

[swick]

I run either into the same or a similar issue:

$ toolbox create \
                     --image quay.io/fedora-ostree-desktops/silverblue:40 \
                     silverblue-toolbox-40
$ toolbox enter silverblue-toolbox-40
⬢ sudo rpm-ostree install dnf
# probably needs to pull in shadow-utils
⬢ sudo dnf reinstall shadow-utils
⬢ exit
$ podman commit \
                     silverblue-toolbox-40 \
                     localhost/silverblue-toolbox:40
$ rpm-ostree rebase ostree-unverified-image:containers-storage:[$HOME/.local/share/containers/storage]localhost/silverblue-toolbox:40

the caps for newuidmap/newgidmap are missing.

$ rpm-ostree --version 
rpm-ostree:
 Version: '2024.3'
 Git: 1f77b617746da5cc6e6d75d9d29a0e35025081a8
 Features:
  - rust
  - compose
  - container
  - fedora-integration

[travier]

You probably need to run ostree container commit in the container before podman commit