RPM pre-install scriptlet fails to set up `knot-resolver` user and group correctly

[cyqsimon]

When installing knot-resolver 5.7.6 from EPEL9 on a system for the first time, the scriptlet that is supposed to set up the knot-resolver user and group fails to do so correctly, causing a host of installation problems.

Relevant logs from dnf install -y knot-resolver:

  Running scriptlet: knot-resolver-5.7.6-1.el9.x86_64                                                                            30/31
  Installing       : knot-resolver-5.7.6-1.el9.x86_64                                                                            30/31
warning: user knot-resolver does not exist - using root
warning: group knot-resolver does not exist - using root
warning: user knot-resolver does not exist - using root
warning: group knot-resolver does not exist - using root
warning: user knot-resolver does not exist - using root
warning: group knot-resolver does not exist - using root

  Running scriptlet: knot-resolver-5.7.6-1.el9.x86_64                                                                            30/31
/usr/lib/tmpfiles.d/knot-resolver.conf:4: Failed to resolve user 'knot-resolver': No such process
/usr/lib/tmpfiles.d/knot-resolver.conf:5: Failed to resolve user 'knot-resolver': No such process
/usr/lib/tmpfiles.d/knot-resolver.conf:6: Failed to resolve user 'knot-resolver': No such process

systemctl start kresd@0.service will then fail due to multiple file permission related errors.

To reproduce

The easiest way is to use a container. The same problem exists on full, physical hosts too.

# enter a fresh container
podman run --rm -it rockylinux:9 bash
# install knot-resolver; observe errors during installation
dnf install -y epel-release && dnf install -y kresd@0.service
# observe that the knot-resolver user and group have not been added correctly
grep knot-resolver /etc/{passwd,group}
# start knot-resolver and observe failures
systemctl start kresd@0.service && journalctl -u kresd@0.service

A workaround

Currently it is possible to get a working installation with the following procedure:

1. Install knot-resolver.
2. Start the service with systemctl start kresd@0.service and let it fail. Systemd will create the knot-resolver user and group as declared in the service unit.
3. Uninstall knot-resolver.
4. Install knot-resolver again. This time there won't be file permissions because the the knot-resolver user and group exist.