fix(rpm): drop %attr(,,user) on config files to avoid dnf silent filter

Using %attr(,,cortex) / %attr(,,neuron) on config files caused rpm's
auto-dep-generator to emit Requires: user(name) and group(name) on
each package. When those Requires couldn't be resolved — whether due
to sysusers Provides mismatches, missing GPG keys, or dnf5 cache
state — dnf5 silently filtered the package out of the candidate set
and reported "Nothing to do" rather than an unsatisfied-dep error.

Adopt the pattern that already works reliably across our infra
(grenade/monsoon): ship config files as default root:root with 0644
perms, don't declare user/group ownership in the rpm file list.
systemd-sysusers still creates the service user via the shipped
sysusers.d file; the service drops to that user at runtime via the
User= directive in the unit.

This removes the user(cortex)/user(neuron) Requires entirely, which
is the root cause of the dnf5 filtering. File permission tightening
can be reintroduced later — either via a separate secrets file with
different mode bits, or by moving secret material to /var/lib/<svc>/
where the service drop-privileges account already has write access.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -173,13 +173,12 @@ jobs:
         with:
           name: srpm-cortex
 
-      - name: Configure copr-cli
+      - name: Publish to COPR
-        run: |
+        uses: https://git.lair.cafe/actions/copr-publish@v1
-          mkdir -p ~/.config
+        with:
-          echo "${{ secrets.COPR_CONFIG }}" > ~/.config/copr
+          project: helexa/cortex
-
+          srpm: "*.src.rpm"
-      - name: Submit build to COPR
+          copr-config: ${{ secrets.COPR_CONFIG }}
-        run: copr-cli build helexa/cortex *.src.rpm
 
   copr-neuron:
     name: Publish neuron to COPR
@@ -191,13 +190,12 @@ jobs:
         with:
           name: srpm-neuron
 
-      - name: Configure copr-cli
+      - name: Publish to COPR
-        run: |
+        uses: https://git.lair.cafe/actions/copr-publish@v1
-          mkdir -p ~/.config
+        with:
-          echo "${{ secrets.COPR_CONFIG }}" > ~/.config/copr
+          project: helexa/neuron
-
+          srpm: "*.src.rpm"
-      - name: Submit build to COPR
+          copr-config: ${{ secrets.COPR_CONFIG }}
-        run: copr-cli build helexa/neuron *.src.rpm
 
   bump-version:
     name: Bump version in source

Cargo.lock

@@ -351,7 +351,7 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "cortex-cli"
-version = "0.1.2"
+version = "0.1.7"
 dependencies = [
  "anyhow",
  "clap",
@@ -366,7 +366,7 @@ dependencies = [
 
 [[package]]
 name = "cortex-core"
-version = "0.1.2"
+version = "0.1.7"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -381,7 +381,7 @@ dependencies = [
 
 [[package]]
 name = "cortex-gateway"
-version = "0.1.2"
+version = "0.1.7"
 dependencies = [
  "anyhow",
  "axum",
@@ -1184,7 +1184,7 @@ dependencies = [
 
 [[package]]
 name = "neuron"
-version = "0.1.2"
+version = "0.1.7"
 dependencies = [
  "anyhow",
  "async-trait",

Cargo.toml

@@ -8,7 +8,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.1.2"
+version = "0.1.7"
 edition = "2024"
 license = "GPL-3.0-or-later"
 repository = "https://git.lair.cafe/helexa/cortex"

cortex.spec

@@ -1,5 +1,5 @@
 Name:           cortex
-Version:        0.1.2
+Version:        0.1.7
 Release:        1%{?dist}
 Summary:        Inference gateway for multi-node GPU clusters
 
@@ -47,9 +47,9 @@ cargo build --release -p cortex-cli
 install -Dm755 target/release/cortex %{buildroot}%{_bindir}/cortex
 install -Dm644 data/cortex.service %{buildroot}%{_unitdir}/cortex.service
 install -Dm644 data/cortex-sysusers.conf %{buildroot}%{_sysusersdir}/cortex.conf
-install -dm750 %{buildroot}%{_sysconfdir}/cortex
+install -dm755 %{buildroot}%{_sysconfdir}/cortex
-install -Dm640 cortex.example.toml %{buildroot}%{_sysconfdir}/cortex/cortex.toml
+install -Dm644 cortex.example.toml %{buildroot}%{_sysconfdir}/cortex/cortex.toml
-install -Dm640 models.example.toml %{buildroot}%{_sysconfdir}/cortex/models.toml
+install -Dm644 models.example.toml %{buildroot}%{_sysconfdir}/cortex/models.toml
 
 %pre
 %sysusers_create_compat %{_builddir}/%{name}-%{version}/data/cortex-sysusers.conf
@@ -69,9 +69,9 @@ install -Dm640 models.example.toml %{buildroot}%{_sysconfdir}/cortex/models.toml
 %{_bindir}/cortex
 %{_unitdir}/cortex.service
 %{_sysusersdir}/cortex.conf
-%dir %attr(750,root,cortex) %{_sysconfdir}/cortex
+%dir %{_sysconfdir}/cortex
-%config(noreplace) %attr(640,root,cortex) %{_sysconfdir}/cortex/cortex.toml
+%config(noreplace) %{_sysconfdir}/cortex/cortex.toml
-%config(noreplace) %attr(640,root,cortex) %{_sysconfdir}/cortex/models.toml
+%config(noreplace) %{_sysconfdir}/cortex/models.toml
 
 %changelog
 * Tue Apr 15 2026 Rob Thijssen <grenade@rob.tn> - 0.1.0-1

data/neuron-sysusers.conf

@@ -0,0 +1,3 @@
+g neuron - -
+u neuron - "Neuron GPU node daemon" /var/lib/neuron /sbin/nologin
+m neuron neuron

data/neuron.service

@@ -5,11 +5,11 @@ Wants=network-online.target
 
 [Service]
 Type=simple
-ExecStart=/usr/bin/neuron --config /etc/cortex/neuron.toml
+ExecStart=/usr/bin/neuron --config /etc/neuron/neuron.toml
 Restart=on-failure
 RestartSec=5
-User=cortex
+User=neuron
-Group=cortex
+Group=neuron
 
 [Install]
 WantedBy=multi-user.target

neuron.example.toml

@@ -1,6 +1,6 @@
 # neuron.example.toml — example configuration
 #
-# Copy to /etc/cortex/neuron.toml and adjust for your environment.
+# Copy to /etc/neuron/neuron.toml and adjust for your environment.
 #
 # Environment variable overrides use NEURON_ prefix with __ separators:
 #   NEURON_PORT=9090

neuron.spec

@@ -1,5 +1,5 @@
 Name:           neuron
-Version:        0.1.2
+Version:        0.1.7
 Release:        1%{?dist}
 Summary:        Per-node GPU discovery and harness management daemon for cortex
 
@@ -45,12 +45,12 @@ cargo build --release -p neuron
 %install
 install -Dm755 target/release/neuron %{buildroot}%{_bindir}/neuron
 install -Dm644 data/neuron.service %{buildroot}%{_unitdir}/neuron.service
-install -Dm644 data/cortex-sysusers.conf %{buildroot}%{_sysusersdir}/neuron.conf
+install -Dm644 data/neuron-sysusers.conf %{buildroot}%{_sysusersdir}/neuron.conf
-install -dm750 %{buildroot}%{_sysconfdir}/cortex
+install -dm755 %{buildroot}%{_sysconfdir}/neuron
-install -Dm640 neuron.example.toml %{buildroot}%{_sysconfdir}/cortex/neuron.toml
+install -Dm644 neuron.example.toml %{buildroot}%{_sysconfdir}/neuron/neuron.toml
 
 %pre
-%sysusers_create_compat %{_builddir}/%{name}-%{version}/data/cortex-sysusers.conf
+%sysusers_create_compat %{_builddir}/%{name}-%{version}/data/neuron-sysusers.conf
 
 %post
 %systemd_post neuron.service
@@ -67,8 +67,8 @@ install -Dm640 neuron.example.toml %{buildroot}%{_sysconfdir}/cortex/neuron.toml
 %{_bindir}/neuron
 %{_unitdir}/neuron.service
 %{_sysusersdir}/neuron.conf
-%dir %attr(750,root,cortex) %{_sysconfdir}/cortex
+%dir %{_sysconfdir}/neuron
-%config(noreplace) %attr(640,root,cortex) %{_sysconfdir}/cortex/neuron.toml
+%config(noreplace) %{_sysconfdir}/neuron/neuron.toml
 
 %changelog
 * Tue Apr 15 2026 Rob Thijssen <grenade@rob.tn> - 0.1.0-1