Fixed an RPM issue that also broke OS-tree installs (#29)

.github/workflows/release.yml

@@ -60,6 +60,9 @@ jobs:
       - name: Check git status
         run: git --no-pager diff --exit-code
 
+      - name: Run packaging compatibility tests
+        run: bash scripts/test-immutable-packaging.sh
+
       - name: Run Go tests
         run: go test ./...
 

.goreleaser.yml

@@ -259,11 +259,13 @@ nfpms:
         type: config|noreplace
       - src: packaging/selinux/nm_netbird.pp
         dst: /usr/share/selinux/packages/nm_netbird.pp
+      - src: packaging/scripts/selinux-install-rpm.sh
+        dst: /usr/libexec/nm-netbird-selinux-install
       - src: LICENSE
         dst: /usr/share/doc/network-manager-netbird/LICENSE
     scripts:
-      postinstall: packaging/scripts/postinstall.sh
-      postremove: packaging/scripts/postremove.sh
+      postinstall: packaging/scripts/postinstall-rpm.sh
+      postremove: packaging/scripts/postremove-rpm.sh
     rpm:
       signature:
         key_file: '{{ if index .Env "GPG_RPM_KEY_FILE" }}{{ .Env.GPG_RPM_KEY_FILE }}{{ end }}'

Taskfile.yml

@@ -172,13 +172,18 @@ tasks:
 
   test:
     desc: Run unit tests
-    deps: [test:go, test:properties]
+    deps: [test:go, test:properties, test:packaging]
 
   test:go:
     desc: Run Go unit tests
     cmds:
       - go test ./...
 
+  test:packaging:
+    desc: Run packaging compatibility tests
+    cmds:
+      - bash scripts/test-immutable-packaging.sh
+
   test:properties:
     desc: Run properties editor model tests
     deps: [build:properties]

docs/reference.md

@@ -215,9 +215,10 @@ All targets are run via `task <name>`. See `Taskfile.yml` for full definitions.
 | `selinux:build:fedora` | Build and validate the `nm_netbird` SELinux policy module in a Fedora container for RPM packaging. |
 | `selinux:install` | Install the built SELinux policy module with `semodule`. |
 | `selinux:clean` | Remove generated SELinux policy build artifacts. |
-| `test` | Run Go unit tests + editor model tests. |
+| `test` | Run Go unit tests, editor model tests, and packaging compatibility tests. |
 | `test:go` | Run Go unit tests. |
 | `test:properties` | Run editor settings mapping tests. |
+| `test:packaging` | Run executable RPM/DEB lifecycle and immutable-host packaging tests. |
 | `test:race` | Run Go unit tests with race detector. |
 | `fmt` | Format Go code and tidy modules. |
 | `vet` | Run `go vet`. |

packaging/rpm/network-manager-netbird.spec.tmpl

@@ -75,28 +75,14 @@ install -D -m0644 packaging/selinux/nm_netbird.te \
   %{buildroot}%{_datadir}/%{name}/selinux/nm_netbird.te
 install -D -m0644 packaging/selinux/nm_netbird.fc \
   %{buildroot}%{_datadir}/%{name}/selinux/nm_netbird.fc
+install -D -m0755 packaging/scripts/selinux-install-rpm.sh \
+  %{buildroot}%{_libexecdir}/nm-netbird-selinux-install
 install -D -m0644 LICENSE \
   %{buildroot}%{_datadir}/doc/%{name}/LICENSE
 
 %post
-if [ -f %{_datadir}/selinux/packages/nm_netbird.pp ] && command -v semodule >/dev/null 2>&1; then
-  if semodule -i %{_datadir}/selinux/packages/nm_netbird.pp >/dev/null 2>&1; then
-    mkdir -p %{_sharedstatedir}/%{name}
-    : >%{_sharedstatedir}/%{name}/selinux-policy-installed
-    echo "installed SELinux policy module nm_netbird"
-  else
-    echo "warning: could not install SELinux policy module %{_datadir}/selinux/packages/nm_netbird.pp" >&2
-  fi
-fi
-
-if command -v restorecon >/dev/null 2>&1; then
-  for path in \
-    %{_libexecdir}/nm-netbird-service \
-    %{_libexecdir}/nm-netbird-auth-dialog \
-    /run/netbird.sock \
-    /var/run/netbird.sock; do
-    [ -e "$path" ] && restorecon "$path" >/dev/null 2>&1 || true
-  done
+if ! %{_libexecdir}/nm-netbird-selinux-install; then
+  echo "warning: SELinux installation helper failed; continuing installation" >&2
 fi
 
 if command -v dbus-send >/dev/null 2>&1; then
@@ -117,13 +103,16 @@ fi
 
 %postun
 if [ "$1" -eq 0 ]; then
-  marker=%{_sharedstatedir}/%{name}/selinux-policy-installed
-  if [ -e "$marker" ] && command -v semodule >/dev/null 2>&1; then
-    if semodule -l 2>/dev/null | awk '{ print $1 }' | grep -qx nm_netbird; then
-      semodule -r nm_netbird >/dev/null 2>&1 || true
+  if command -v semodule >/dev/null 2>&1; then
+    if semodule -n -X 200 -r nm_netbird >/dev/null 2>&1; then
+      echo "removed package-owned priority-200 SELinux policy module nm_netbird"
+      if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled && \
+        command -v load_policy >/dev/null 2>&1; then
+        load_policy >/dev/null 2>&1 || true
+      fi
+    else
+      echo "warning: could not remove package-owned priority-200 SELinux policy module nm_netbird" >&2
     fi
-    rm -f "$marker"
-    rmdir %{_sharedstatedir}/%{name} 2>/dev/null || true
   fi
 fi
 
@@ -147,6 +136,7 @@ fi
 %license %{_datadir}/doc/%{name}/LICENSE
 %{_libexecdir}/nm-netbird-service
 %{_libexecdir}/nm-netbird-auth-dialog
+%{_libexecdir}/nm-netbird-selinux-install
 %{_prefix}/lib/NetworkManager/libnm-vpn-plugin-netbird.so
 %{_prefix}/lib/NetworkManager/libnm-vpn-plugin-netbird-editor.so
 %{_prefix}/lib/NetworkManager/libnm-gtk4-vpn-plugin-netbird-editor.so

packaging/scripts/postinstall-rpm.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env sh
+set -eu
+
+reload_dbus_policy() {
+  if command -v dbus-send >/dev/null 2>&1; then
+    if dbus-send --system --type=method_call --dest=org.freedesktop.DBus \
+      /org/freedesktop/DBus org.freedesktop.DBus.ReloadConfig >/dev/null 2>&1; then
+      echo "reloaded D-Bus system policy"
+      return
+    fi
+  fi
+
+  if command -v busctl >/dev/null 2>&1; then
+    if busctl call org.freedesktop.DBus /org/freedesktop/DBus \
+      org.freedesktop.DBus ReloadConfig >/dev/null 2>&1; then
+      echo "reloaded D-Bus system policy"
+      return
+    fi
+  fi
+
+  if command -v systemctl >/dev/null 2>&1; then
+    if systemctl reload dbus >/dev/null 2>&1; then
+      echo "reloaded D-Bus system policy"
+      return
+    fi
+  fi
+
+  echo "warning: could not reload D-Bus policy automatically" >&2
+}
+
+reload_networkmanager() {
+  if command -v systemctl >/dev/null 2>&1 && systemctl is-active --quiet NetworkManager >/dev/null 2>&1; then
+    if systemctl reload NetworkManager >/dev/null 2>&1; then
+      echo "reloaded NetworkManager"
+      return
+    fi
+  fi
+
+  if command -v nmcli >/dev/null 2>&1; then
+    if nmcli general reload >/dev/null 2>&1; then
+      echo "reloaded NetworkManager"
+      return
+    fi
+  fi
+
+  echo "warning: could not reload NetworkManager automatically; restart NetworkManager if vpn-type netbird is not visible" >&2
+}
+
+install_selinux_policy() {
+  helper=/usr/libexec/nm-netbird-selinux-install
+
+  if [ ! -x "$helper" ]; then
+    echo "warning: SELinux installation helper $helper was not found" >&2
+    return 0
+  fi
+
+  if ! "$helper"; then
+    echo "warning: SELinux installation helper $helper failed; continuing installation" >&2
+  fi
+}
+
+install_selinux_policy
+reload_dbus_policy
+reload_networkmanager
+
+cat <<'EOF'
+NetworkManager NetBird plugin installed.
+Create a profile with:
+  nmcli connection add type vpn con-name NetBird vpn-type netbird ifname --
+EOF

packaging/scripts/postinstall.sh

@@ -46,39 +46,6 @@ reload_networkmanager() {
   echo "warning: could not reload NetworkManager automatically; restart NetworkManager if vpn-type netbird is not visible" >&2
 }
 
-install_selinux_policy() {
-  policy=/usr/share/selinux/packages/nm_netbird.pp
-  marker_dir=/var/lib/network-manager-netbird
-  marker="$marker_dir/selinux-policy-installed"
-
-  [ -f "$policy" ] || return 0
-
-  if ! command -v semodule >/dev/null 2>&1; then
-    echo "warning: SELinux policy module is packaged at $policy but semodule was not found" >&2
-    return 0
-  fi
-
-  if semodule -i "$policy" >/dev/null 2>&1; then
-    mkdir -p "$marker_dir"
-    : >"$marker"
-    echo "installed SELinux policy module nm_netbird"
-  else
-    echo "warning: could not install SELinux policy module $policy" >&2
-    return 0
-  fi
-
-  if command -v restorecon >/dev/null 2>&1; then
-    for path in \
-      /usr/libexec/nm-netbird-service \
-      /usr/libexec/nm-netbird-auth-dialog \
-      /run/netbird.sock \
-      /var/run/netbird.sock; do
-      [ -e "$path" ] && restorecon "$path" >/dev/null 2>&1 || true
-    done
-  fi
-}
-
-install_selinux_policy
 reload_dbus_policy
 reload_networkmanager
 

packaging/scripts/postremove-rpm.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env sh
+set -eu
+
+reload_dbus_policy() {
+  if command -v dbus-send >/dev/null 2>&1; then
+    if dbus-send --system --type=method_call --dest=org.freedesktop.DBus \
+      /org/freedesktop/DBus org.freedesktop.DBus.ReloadConfig >/dev/null 2>&1; then
+      echo "reloaded D-Bus system policy"
+      return
+    fi
+  fi
+
+  if command -v busctl >/dev/null 2>&1; then
+    if busctl call org.freedesktop.DBus /org/freedesktop/DBus \
+      org.freedesktop.DBus ReloadConfig >/dev/null 2>&1; then
+      echo "reloaded D-Bus system policy"
+      return
+    fi
+  fi
+
+  if command -v systemctl >/dev/null 2>&1; then
+    if systemctl reload dbus >/dev/null 2>&1; then
+      echo "reloaded D-Bus system policy"
+      return
+    fi
+  fi
+
+  echo "warning: could not reload D-Bus policy automatically" >&2
+}
+
+reload_networkmanager() {
+  if command -v systemctl >/dev/null 2>&1 && systemctl is-active --quiet NetworkManager >/dev/null 2>&1; then
+    if systemctl reload NetworkManager >/dev/null 2>&1; then
+      echo "reloaded NetworkManager"
+      return
+    fi
+  fi
+
+  if command -v nmcli >/dev/null 2>&1; then
+    if nmcli general reload >/dev/null 2>&1; then
+      echo "reloaded NetworkManager"
+      return
+    fi
+  fi
+
+  echo "warning: could not reload NetworkManager automatically" >&2
+}
+
+remove_selinux_policy() {
+  case "${1:-}" in
+    0|remove|purge) ;;
+    *) return 0 ;;
+  esac
+
+  if ! command -v semodule >/dev/null 2>&1; then
+    echo "warning: could not remove SELinux policy module nm_netbird because semodule was not found" >&2
+    return 0
+  fi
+
+  if semodule -n -X 200 -r nm_netbird >/dev/null 2>&1; then
+    echo "removed package-owned priority-200 SELinux policy module nm_netbird"
+    if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled && \
+      command -v load_policy >/dev/null 2>&1; then
+      load_policy >/dev/null 2>&1 || true
+    fi
+  else
+    echo "warning: could not remove package-owned priority-200 SELinux policy module nm_netbird" >&2
+  fi
+}
+
+remove_selinux_policy "$@"
+reload_dbus_policy
+reload_networkmanager

packaging/scripts/postremove.sh

@@ -46,43 +46,5 @@ reload_networkmanager() {
   echo "warning: could not reload NetworkManager automatically" >&2
 }
 
-remove_selinux_policy() {
-  case "${1:-}" in
-    0|remove|purge) ;;
-    *) return 0 ;;
-  esac
-
-  marker=/var/lib/network-manager-netbird/selinux-policy-installed
-  [ -e "$marker" ] || return 0
-
-  if ! command -v semodule >/dev/null 2>&1; then
-    echo "warning: could not remove SELinux policy module nm_netbird because semodule was not found" >&2
-    return 0
-  fi
-
-  modules=$(semodule -l 2>/dev/null) || {
-    echo "warning: could not query SELinux policy modules; keeping $marker" >&2
-    return 0
-  }
-
-  if ! printf '%s\n' "$modules" | awk '{ print $1 }' | grep -qx nm_netbird; then
-    echo "SELinux policy module nm_netbird is not installed"
-    rm -f "$marker"
-    rmdir /var/lib/network-manager-netbird 2>/dev/null || true
-    return 0
-  fi
-
-  if semodule -r nm_netbird >/dev/null 2>&1; then
-    echo "removed SELinux policy module nm_netbird"
-  else
-    echo "warning: could not remove SELinux policy module nm_netbird; keeping $marker" >&2
-    return 0
-  fi
-
-  rm -f "$marker"
-  rmdir /var/lib/network-manager-netbird 2>/dev/null || true
-}
-
-remove_selinux_policy "$@"
 reload_dbus_policy
 reload_networkmanager