Runtime org.fedoraproject.Platform pinned during installation of Fedora Silverblue

[tqcharm]

Note:

The original issue was discussed with the Fedora Atomic Desktops SIG in detail here.

Description:

When installing Fedora Silverblue (and possibly other atomic desktops), GUI packages are installed as Flatpaks, along with their corresponding runtime org.fedoraproject.Platform. The issue is that this runtime is pinned (as Flatpak), which causes it to be soon (during the lifecycle of the initially installed OS version) considered end-of-life.

Presumably, this happens because "runtimes that are explicitly installed, rather than installed as a dependency of something else, are automatically pinned" (from flatpak pin's man page). This causes at least two issues:

• Warning message that the runtime is end-of-life when updating Flatpaks. Average users don't know what to do with this information.
• Runtime is kept on an older version/branch during the lifecycle of a Fedora OS version, as well as after system upgrades.

Expected result:

Runtime org.fedoraproject.Platform is not pinned during installation. If it gets pinned as a result of Anaconda installing the runtime, then it should be unpinned afterwards.

Other details:

Silverblue 41 seems to be shipped with runtime/org.fedoraproject.Platform/<arch>/f40. This is probably because branch f41 wasn't available when the installation media for F41 was built. Without the pin, the runtime would be upgraded with a flatpak update as soon as version/branch f41 hits the fedora remote.

This is the end-of-life message output of a flatpak update command:

Info: (pinned) runtime org.fedoraproject.Platform branch f40 is end-of-life, with reason:
   Fedora 40 runtime is no longer supported.
Info: applications using this runtime:
# <list of packages>

[travier]

Note that even if the runtime is pinned, it should still not block the update of the applications and the installation of the next one. If it really does then this is really unexpected and a bug.

[travier]

Maybe

anaconda/pyanaconda/modules/payloads/payload/rpm_ostree/flatpak_installation.py

Line 29 in fd3c742

"""Task to install flatpaks from the local source on Silverblue."""

should explicitly unpin all installed runtimes after installing the Flatpaks.

[tqcharm]

Note that even if the runtime is pinned, it should still not block the update of the applications and the installation of the next one.

No, the pinned runtime doesn't block the update of applications and the installation of new ones. However, it prevents the runtime to be updated to the newer version.

[link to code] should explicitly unpin all installed runtimes after installing the Flatpaks.

100%.

[travier]

However, it prevents the runtime to be updated to the newer version.

That's the thing: there are no new versions. Once Fedora Flatpaks move to a new Fedora N+1 release, the Platform for Fedora N is no longer updated.

[travier]

cc @yselkowitz (to check my understanding of Fedora Flatpaks)

[yselkowitz]

Our usual procedure is once all Fedora flatpak applications are migrated to the new N runtime, then the previous N-1 runtime is EOL'd w/o rebase and does not receive any further updates. While I try to do so as soon as possible after GA, unfortunately for F41 this was somewhat delayed due to a particular non-runtime dependency package being unbuildable for a few months. So, by the time you see an EOL notice on a runtime, there should no longer be any Fedora-shipped dependencies thereon.

[yselkowitz]

I'm a bit concerned about the report that the F40 runtime was included in the F41 installation image. Generally, slightly before final freeze, I ship the new runtimes and the preinstalled apps for both Silverblue and Kinoite rebuilt/updated thereon to stable so that they are available for creating the GA images with the upcoming version. Did that not happen in time for F41, or was this based on a pre-release installation?

[travier]

Hum indeed, looks like the final F41 images did include the F41 Runtime: https://pagure.io/pungi-fedora/blob/f41/f/fedora-final.conf#_906

[tqcharm]

I'm a bit concerned about the report that the F40 runtime was included in the F41 installation image. [...] Did that not happen in time for F41, or was this based on a pre-release installation?

I am almost sure it wasn't a pre-release install image, but I will double-check tomorrow when I get to the machine in question.

Our usual procedure is once all Fedora flatpak applications are migrated to the new N runtime, then the previous N-1 runtime is EOL'd w/o rebase and does not receive any further updates.

OK, so generally (except this special F41 delay situation), by the time a Fedora runtime is EOL, there will be no Flatpak apps depending on it (assuming the user runs flatpak update regularly). Users will get the notification regarding runtime being end-of-life, but will have to know how to unpin it if they want a cleanup, or otherwise the message will pop up with every flatpak update.

So I guess the question that remains is: does the runtime org.fedoraproject.Platform need to be shipped pinned with new installations from ISO images?

[yselkowitz]

I am almost sure it wasn't a pre-release install image

That would make sense.

OK, so generally (except this special F41 delay situation), by the time a Fedora runtime is EOL, there will be no Flatpak apps depending on it (assuming the user runs flatpak update regularly).

No, even with the F41 delays, the F40 runtimes were not EOL'd until every app was finished migrating (or themselves EOL'd, for those few that were retired in F41). It just took a lot longer to reach that point than I had wanted.

Users will get the notification regarding runtime being end-of-life, but will have to know how to unpin it if they want a cleanup, or otherwise the message will pop up with every flatpak update.

Apparently, but only when starting from a prerelease image.

So I guess the question that remains is: does the runtime org.fedoraproject.Platform need to be shipped pinned with new installations from ISO images?

Unpinning the installed runtime would be prudent, but I'll have to leave the mechanics to @travier.

[tqcharm]

Well, based on the history it seems it was a pre-release image indeed (Beta-1.2 I assume). Sorry for the missing information. My report should have been more detailed.

$ flatpak history | grep 'org.fedoraproject.Platform'
Oct 20 09:49:10	deploy update	org.fedoraproject.Platform	f40	system	fedora
Oct 20 09:50:14	deploy install	org.fedoraproject.Platform	f41	system	fedora
Oct 31 12:56:19	deploy update	org.fedoraproject.Platform	f41	system	fedora
Nov  7 09:28:19	deploy update	org.fedoraproject.Platform	f41	system	fedora
Nov 22 17:29:32	deploy update	org.fedoraproject.Platform	f41	system	fedora
Dec  8 22:21:00	deploy update	org.fedoraproject.Platform	f41	system	fedora
Dec 14 22:31:38	deploy update	org.fedoraproject.Platform	f41	system	fedora
Jan  7 12:28:01	deploy update	org.fedoraproject.Platform	f41	system	fedora
Jan 23 09:22:28	deploy update	org.fedoraproject.Platform	f40	system	fedora
Jan 23 09:24:12	deploy update	org.fedoraproject.Platform	f41	system	fedora
Feb  2 13:50:30	deploy update	org.fedoraproject.Platform	f40	system	fedora
Feb  2 14:17:13	uninstall       org.fedoraproject.Platform	f40	system

Users will get the notification regarding runtime being end-of-life, but will have to know how to unpin it if they want a cleanup, or otherwise the message will pop up with every flatpak update.

Apparently, but only when starting from a prerelease image.

Also after a new release comes out (whether the user rebases to the new major version or not), if I'm not mistaken.

[travier]

I would say that the step forward here is to open a bug for Anaconda in Bugzilla to not pin / unpin the Runtime / all applications / refs after the installation. I could not figure out how to do that in the code.

[tqcharm]

Reported in Bugzilla, here.