Declare scriptlet-only OS dependencies in salt.spec - #70149
Open
jcp-avgo wants to merge 4 commits into
Open
Conversation
twangboy
requested changes
Aug 26, 2026
The %pre/%post/%preun/%posttrans scriptlets for the salt base package and %pre/%post/%preun/%postun/%posttrans for the minion subpackage invoke coreutils, grep, findutils, glibc (getent), awk, and systemd/sed/openssl tools without declaring them as RPM dependencies. This lets tdnf install salt/salt-minion in an order where those tools aren't yet present, causing scriptlets to silently fail on minimal or air-gapped installs. Add scriptlet-scoped Requires(pre)/Requires(post)/Requires(preun)/ Requires(postun)/Requires(posttrans) so package managers can correctly resolve install ordering.
Asserts the base package's Requires(pre)/Requires(post)/Requires(preun)/ Requires(posttrans) and the minion subpackage's Requires(pre)/Requires(post)/ Requires(preun)/Requires(postun)/Requires(posttrans) lines stay declared, following the existing test_rpm_spec_extras_dir_override_present pattern.
jcp-avgo
force-pushed
the
fix/vcops-106330-scriptlet-requires-3008x
branch
from
August 26, 2026 19:05
4a77c91 to
77ea3e2
Compare
twangboy
requested changes
Aug 26, 2026
getent is split into a separate subpackage (e.g. glibc-common) on some distros/minimal images, so pinning the glibc package name by itself isn't portable across every RPM distro this spec targets. Requiring the file path lets the package manager resolve whichever package actually provides it, matching the file-based Requires already used above for shadow-utils's usermod/groupadd/useradd.
twangboy
approved these changes
Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
%pre/%post/%preun/%posttransscriptlets for thesaltbasepackage, and
%pre/%post/%preun/%postun/%posttransfor theminionsubpackage, invokecoreutils,grep,findutils,glibc(
getent),sed, andsystemdtools without declaring them as RPMdependencies. This was surfaced by an internal packaging dependency
audit that diffed each scriptlet's actual tool usage against the
spec's declared
Requires.Undeclared scriptlet dependencies let a resolver like
tdnfinstallsalt/salt-minionin an order where those tools aren't yet present,so the scriptlet can silently fail on minimal or air-gapped installs
instead of the transaction failing loudly up front.
Requires(pre)/Requires(post)/Requires(preun)/Requires(posttrans)to the base
saltpackage for the tools its scriptlets call.Requires(pre)/Requires(post)/Requires(preun)/Requires(postun)/Requires(posttrans)to theminionsubpackage for the same reason.opensslis declared explicitly onminioneven thoughsalt(whichminionrequires) already declares it unconditionally — per-packagedependency audits inspect each subpackage's own
Requiresheader andwon't follow it transitively through
%{name}.metadata.
Test plan
test_rpm_spec_scriptlet_requires_presenttotests/pytests/unit/test_pkg_scripts.py, following the existingtest_rpm_spec_extras_dir_override_presentpattern, asserting eachRequires(...)line is present in the correct package's preamble.