Description

Having a system flatpak installed or a system remote configured in the system causes the service to fail after any flatpak operation has been performed by the user. The error may vary depending on the scenario. For example, when a system remote is configured, the service fails in the /usr/bin/flatpak --system repair step with a permission denied error. When a system flatpak is installed, the service cannot find the flatpak's ref when performing the /usr/bin/flatpak --system update -y --noninteractive step and proceeds to fail as well (see screenshot below.)

Reproduce

Steps to reproduce (after updating the image for the first time):

1. Add a system remote (for example, the flathub system remote).
2. Install any system flatpak, either from the command line or from bazaar, and wait until the installation is fully complete.
3. Run systemctl start flatpak-system-update.service, either in a root shell or by verifying through polkit, to instantly trigger the service (it should fail with the exit code 1).
4. Run systemctl status flatpak-system-update.service, and it should show the step /usr/bin/flatpak --system update -y -noninteractive failing.

Expected

The service shouldn't fail

Actual

The service fails

Image

kinoite-main-hardened

Upstream

This service isn't present in the upstream images.

Declaration

• I agree to follow this project's Code of Conduct.
• I declare that this is not a request for alternate community messaging or social platforms.
• I declare that I have read the secureblue website and my feature request is in-scope.