bin/compose: Do passwd checking in commit, not install

We won't have done the postprocessing, so `/usr/lib/passwd` won't exist. Trying
to use `compose install` with current fedora-atomic failed (I *really* should
have tested that at least manually with the final patchset). Add `check-passwd`
to the test suite so this gets coverage too.

Closes: #1076
Approved by: jlebon

src/app/rpmostree-compose-builtin-tree.c

@@ -979,17 +979,6 @@ impl_install_tree (RpmOstreeTreeComposeContext *self,
     self->rootfs_dfd = glnx_steal_fd (&target_rootfs_dfd);
   }
 
-  g_autoptr(GFile) treefile_dirpath = g_file_get_parent (self->treefile_path);
-  if (!rpmostree_check_passwd (self->repo, self->rootfs_dfd, treefile_dirpath, self->treefile,
-                               self->previous_checksum,
-                               cancellable, error))
-    return glnx_prefix_error (error, "Handling passwd db");
-
-  if (!rpmostree_check_groups (self->repo, self->rootfs_dfd, treefile_dirpath, self->treefile,
-                               self->previous_checksum,
-                               cancellable, error))
-    glnx_prefix_error (error, "Handling group db");
-
   /* Insert our input hash */
   g_hash_table_replace (self->metadata, g_strdup ("rpmostree.inputhash"),
                         g_variant_ref_sink (g_variant_new_string (new_inputhash)));
@@ -1037,6 +1026,20 @@ impl_commit_tree (RpmOstreeTreeComposeContext *self,
                                     cancellable, error))
     return EXIT_FAILURE;
 
+  if (self->treefile)
+    {
+      g_autoptr(GFile) treefile_dirpath = g_file_get_parent (self->treefile_path);
+      if (!rpmostree_check_passwd (self->repo, self->rootfs_dfd, treefile_dirpath, self->treefile,
+                                   self->previous_checksum,
+                                   cancellable, error))
+        return glnx_prefix_error (error, "Handling passwd db");
+
+      if (!rpmostree_check_groups (self->repo, self->rootfs_dfd, treefile_dirpath, self->treefile,
+                                   self->previous_checksum,
+                                   cancellable, error))
+        glnx_prefix_error (error, "Handling group db");
+    }
+
   /* The penultimate step, just basically `ostree commit` */
   g_autofree char *new_revision = NULL;
   if (!rpmostree_commit (self->rootfs_dfd, self->repo, self->ref, opt_write_commitid_to,

tests/composedata/fedora-base.json

@@ -15,5 +15,10 @@
     "packages-ppc64le": ["grub2", "ostree-grub2"],
 
     "packages-x86_64": ["grub2", "grub2-efi", "ostree-grub2",
-                         "efibootmgr", "shim"]
+                        "efibootmgr", "shim"],
+
+    "ignore-removed-users": ["root"],
+    "ignore-removed-groups": ["root"],
+    "check-passwd": { "type": "file", "filename": "passwd" },
+    "check-groups": { "type": "file", "filename": "group" }
 }

tests/composedata/group

@@ -0,0 +1,51 @@
+root:x:0:
+bin:x:1:
+daemon:x:2:
+sys:x:3:
+adm:x:4:
+tty:x:5:
+disk:x:6:
+lp:x:7:
+mem:x:8:
+kmem:x:9:
+wheel:x:10:
+cdrom:x:11:
+mail:x:12:
+man:x:15:
+dialout:x:18:
+floppy:x:19:
+games:x:20:
+tape:x:30:
+video:x:39:
+ftp:x:50:
+lock:x:54:
+audio:x:63:
+nobody:x:99:
+users:x:100:
+utmp:x:22:
+utempter:x:35:
+ssh_keys:x:999:
+systemd-journal:x:190:
+dbus:x:81:
+polkitd:x:998:
+etcd:x:997:
+dip:x:40:
+cgred:x:996:
+tss:x:59:
+avahi-autoipd:x:170:
+rpc:x:32:
+sssd:x:993:
+dockerroot:x:986:
+rpcuser:x:29:
+nfsnobody:x:65534:
+kube:x:994:
+sshd:x:74:
+chrony:x:992:
+tcpdump:x:72:
+ceph:x:167:
+input:x:995:
+systemd-timesync:x:991:
+systemd-network:x:990:
+systemd-resolve:x:989:
+systemd-bus-proxy:x:988:
+cockpit-ws:x:987:

tests/composedata/passwd

@@ -0,0 +1,33 @@
+root:x:0:0:root:/root:/bin/bash
+bin:x:1:1:bin:/bin:/sbin/nologin
+daemon:x:2:2:daemon:/sbin:/sbin/nologin
+adm:x:3:4:adm:/var/adm:/sbin/nologin
+lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
+sync:x:5:0:sync:/sbin:/bin/sync
+shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
+halt:x:7:0:halt:/sbin:/sbin/halt
+mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
+operator:x:11:0:operator:/root:/sbin/nologin
+games:x:12:100:games:/usr/games:/sbin/nologin
+ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
+nobody:x:99:99:Nobody:/:/sbin/nologin
+dbus:x:81:81:System message bus:/:/sbin/nologin
+polkitd:x:999:998:User for polkitd:/:/sbin/nologin
+etcd:x:998:997:etcd user:/var/lib/etcd:/sbin/nologin
+tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
+avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
+rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
+sssd:x:995:993:User for sssd:/:/sbin/nologin
+dockerroot:x:997:986:Docker User:/var/lib/docker:/sbin/nologin
+rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
+nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
+kube:x:996:994:Kubernetes user:/:/sbin/nologin
+sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
+chrony:x:994:992::/var/lib/chrony:/sbin/nologin
+tcpdump:x:72:72::/:/sbin/nologin
+ceph:x:167:167:Ceph daemons:/var/lib/ceph:/sbin/nologin
+systemd-timesync:x:993:991:systemd Time Synchronization:/:/sbin/nologin
+systemd-network:x:991:990:systemd Network Management:/:/sbin/nologin
+systemd-resolve:x:990:989:systemd Resolver:/:/sbin/nologin
+systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/sbin/nologin
+cockpit-ws:x:988:987:User for cockpit-ws:/:/sbin/nologin