fix(rpm): explicitly Provides user(name) to satisfy systemd unit Requires

Diagnosing the persistent "Nothing to do" on v0.1.10 surfaced that
removing %attr(,,name) from %files wasn't enough. systemd-rpm-macros
ships its own rpm dep generator (/usr/lib/rpm/systemd.req) that parses
User=/Group= directives from every .service file the package ships
and emits Requires: user(NAME)/group(NAME) accordingly.

Rpmbuild log from v0.1.10 shows these Requires are still emitted even
after the %attr removal. Meanwhile the sysusers provides-generator
emits group(NAME) in both unversioned and versioned forms, but only
a versioned user(NAME) = <base64> when the u-line has GECOS/home/shell
fields. The asymmetry leaves Requires: user(NAME) unresolvable.

Add explicit Provides: user(NAME) back to both specs, with a comment
documenting the actual cause (systemd unit parsing, not file attrs)
so the next person touching these specs doesn't repeat the mistake.

Why monsoon didn't hit this: it creates its user in %pre via
groupadd/useradd (not sysusers.d), so no Provides are generated at
all — matching the Requires: user(monsoon) by luck of the rpm solver
treating unknown symbols as soft-fails for that path. Ours went through
the sysusers Provides code path and hit the asymmetry instead.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/scripts/copr-build.sh

@@ -1,61 +0,0 @@
-#!/bin/bash
-# Submit an SRPM to COPR, watch the build, and dump per-chroot build logs
-# to stdout so they are captured in CI output.
-#
-# Usage: copr-build.sh <project> <srpm> [srpm...]
-# Example: copr-build.sh helexa/cortex ./cortex-0.1.2-1.fc43.src.rpm
-
-set -o pipefail
-
-PROJECT="$1"
-shift
-
-if [ -z "$PROJECT" ] || [ "$#" -eq 0 ]; then
-  echo "usage: $0 <project> <srpm> [srpm...]" >&2
-  exit 2
-fi
-
-# Submit without waiting; capture the build ID from stdout.
-SUBMIT_OUT=$(copr-cli build --nowait "$PROJECT" "$@")
-echo "$SUBMIT_OUT"
-BUILD_ID=$(echo "$SUBMIT_OUT" | grep -oP 'Created builds: \K[0-9]+' | head -n1)
-
-if [ -z "$BUILD_ID" ]; then
-  echo "error: could not parse build ID from copr-cli output" >&2
-  exit 1
-fi
-
-echo
-echo "Build $BUILD_ID submitted to $PROJECT"
-echo "Follow live: https://copr.fedorainfracloud.org/coprs/build/$BUILD_ID"
-echo
-
-# Watch the build; captures status transitions to stdout. Exit non-zero
-# on build failure, but defer propagating that until after we've fetched
-# logs so the CI output contains diagnostics either way.
-if copr-cli watch-build "$BUILD_ID"; then
-  STATUS=0
-else
-  STATUS=$?
-fi
-
-# Fetch per-chroot results (logs + rpms). Anonymous download — no auth needed.
-mkdir -p copr-logs
-copr-cli download-build --dest copr-logs "$BUILD_ID" || {
-  echo "warning: failed to download build artifacts" >&2
-}
-
-# Dump each chroot's builder-live.log as a collapsible group.
-for chroot_dir in copr-logs/*/; do
-  [ -d "$chroot_dir" ] || continue
-  chroot=$(basename "$chroot_dir")
-  log="${chroot_dir}builder-live.log"
-  if [ -f "$log" ]; then
-    echo
-    echo "::group::${chroot} builder-live.log"
-    cat "$log"
-    echo "::endgroup::"
-  fi
-done
-
-exit "$STATUS"

.gitea/workflows/ci.yml

@@ -66,6 +66,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Determine version
         id: version
@@ -79,6 +81,12 @@ jobs:
           sed -i '/\[workspace\.package\]/,/\[/{ s/^version = ".*"/version = "'"${VERSION}"'"/ }' Cargo.toml
           sed -i "s/^Version:.*/Version:        ${VERSION}/" cortex.spec
 
+      - name: Generate changelog entry
+        uses: https://git.lair.cafe/actions/rpm-changelog@v1
+        with:
+          spec: cortex.spec
+          version: ${{ steps.version.outputs.VERSION }}
+
       - name: Generate source tarball
         run: |
           set -ex
@@ -118,6 +126,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Determine version
         id: version
@@ -131,6 +141,12 @@ jobs:
           sed -i '/\[workspace\.package\]/,/\[/{ s/^version = ".*"/version = "'"${VERSION}"'"/ }' Cargo.toml
           sed -i "s/^Version:.*/Version:        ${VERSION}/" neuron.spec
 
+      - name: Generate changelog entry
+        uses: https://git.lair.cafe/actions/rpm-changelog@v1
+        with:
+          spec: neuron.spec
+          version: ${{ steps.version.outputs.VERSION }}
+
       - name: Generate source tarball
         run: |
           set -ex
@@ -168,40 +184,34 @@ jobs:
     runs-on: fedora
     needs: srpm-cortex
     steps:
-      - uses: actions/checkout@v4
-
       - name: Download SRPM
         uses: actions/download-artifact@v3
         with:
           name: srpm-cortex
 
-      - name: Configure copr-cli
+      - name: Publish to COPR
-        run: |
+        uses: https://git.lair.cafe/actions/copr-publish@v1
-          mkdir -p ~/.config
+        with:
-          echo "${{ secrets.COPR_CONFIG }}" > ~/.config/copr
+          project: helexa/cortex
-
+          srpm: "*.src.rpm"
-      - name: Submit build to COPR
+          copr-config: ${{ secrets.COPR_CONFIG }}
-        run: bash .gitea/scripts/copr-build.sh helexa/cortex *.src.rpm
 
   copr-neuron:
     name: Publish neuron to COPR
     runs-on: fedora
     needs: srpm-neuron
     steps:
-      - uses: actions/checkout@v4
-
       - name: Download SRPM
         uses: actions/download-artifact@v3
         with:
           name: srpm-neuron
 
-      - name: Configure copr-cli
+      - name: Publish to COPR
-        run: |
+        uses: https://git.lair.cafe/actions/copr-publish@v1
-          mkdir -p ~/.config
+        with:
-          echo "${{ secrets.COPR_CONFIG }}" > ~/.config/copr
+          project: helexa/neuron
-
+          srpm: "*.src.rpm"
-      - name: Submit build to COPR
+          copr-config: ${{ secrets.COPR_CONFIG }}
-        run: bash .gitea/scripts/copr-build.sh helexa/neuron *.src.rpm
 
   bump-version:
     name: Bump version in source

Cargo.lock

@@ -351,7 +351,7 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "cortex-cli"
-version = "0.1.2"
+version = "0.1.10"
 dependencies = [
  "anyhow",
  "clap",
@@ -366,7 +366,7 @@ dependencies = [
 
 [[package]]
 name = "cortex-core"
-version = "0.1.2"
+version = "0.1.10"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -381,7 +381,7 @@ dependencies = [
 
 [[package]]
 name = "cortex-gateway"
-version = "0.1.2"
+version = "0.1.10"
 dependencies = [
  "anyhow",
  "axum",
@@ -1184,7 +1184,7 @@ dependencies = [
 
 [[package]]
 name = "neuron"
-version = "0.1.2"
+version = "0.1.10"
 dependencies = [
  "anyhow",
  "async-trait",

Cargo.toml

@@ -8,7 +8,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.1.2"
+version = "0.1.10"
 edition = "2024"
 license = "GPL-3.0-or-later"
 repository = "https://git.lair.cafe/helexa/cortex"

cortex.spec

@@ -1,5 +1,5 @@
 Name:           cortex
-Version:        0.1.2
+Version:        0.1.10
 Release:        1%{?dist}
 Summary:        Inference gateway for multi-node GPU clusters
 
@@ -22,11 +22,14 @@ BuildRequires:  systemd-rpm-macros
 Requires(pre):  shadow-utils
 Requires:       systemd
 
-# rpm's sysusers provides-generator only emits versioned user(cortex) when
+# systemd-rpm-macros ships a unit dep generator that parses User=/Group=
-# the u-line has GECOS/home/shell fields. %attr(,,cortex) in %files emits
+# from our .service file and emits Requires: user(cortex)/group(cortex).
-# an unversioned Requires: user(cortex), so we provide it explicitly.
+# rpm's sysusers provides-generator emits the unversioned form for groups
+# but only a versioned user(cortex) = <base64> for users with GECOS/home/
+# shell. Provide the unversioned user(cortex) explicitly so dnf can resolve
+# the auto-generated Requires. Without this, dnf5 silently filters the
+# package and reports "Nothing to do".
 Provides:       user(cortex)
-Provides:       group(cortex)
 
 %description
 Cortex is a Rust reverse-proxy that sits in front of multiple inference
@@ -53,9 +56,9 @@ cargo build --release -p cortex-cli
 install -Dm755 target/release/cortex %{buildroot}%{_bindir}/cortex
 install -Dm644 data/cortex.service %{buildroot}%{_unitdir}/cortex.service
 install -Dm644 data/cortex-sysusers.conf %{buildroot}%{_sysusersdir}/cortex.conf
-install -dm750 %{buildroot}%{_sysconfdir}/cortex
+install -dm755 %{buildroot}%{_sysconfdir}/cortex
-install -Dm640 cortex.example.toml %{buildroot}%{_sysconfdir}/cortex/cortex.toml
+install -Dm644 cortex.example.toml %{buildroot}%{_sysconfdir}/cortex/cortex.toml
-install -Dm640 models.example.toml %{buildroot}%{_sysconfdir}/cortex/models.toml
+install -Dm644 models.example.toml %{buildroot}%{_sysconfdir}/cortex/models.toml
 
 %pre
 %sysusers_create_compat %{_builddir}/%{name}-%{version}/data/cortex-sysusers.conf
@@ -75,10 +78,10 @@ install -Dm640 models.example.toml %{buildroot}%{_sysconfdir}/cortex/models.toml
 %{_bindir}/cortex
 %{_unitdir}/cortex.service
 %{_sysusersdir}/cortex.conf
-%dir %attr(750,root,cortex) %{_sysconfdir}/cortex
+%dir %{_sysconfdir}/cortex
-%config(noreplace) %attr(640,root,cortex) %{_sysconfdir}/cortex/cortex.toml
+%config(noreplace) %{_sysconfdir}/cortex/cortex.toml
-%config(noreplace) %attr(640,root,cortex) %{_sysconfdir}/cortex/models.toml
+%config(noreplace) %{_sysconfdir}/cortex/models.toml
 
 %changelog
-* Tue Apr 15 2026 Rob Thijssen <grenade@rob.tn> - 0.1.0-1
+* Wed Apr 15 2026 Rob Thijssen <grenade@rob.tn> - 0.1.0-1
 - Initial package

data/neuron-sysusers.conf

@@ -0,0 +1,3 @@
+g neuron - -
+u neuron - "Neuron GPU node daemon" /var/lib/neuron /sbin/nologin
+m neuron neuron

data/neuron.service

@@ -5,11 +5,11 @@ Wants=network-online.target
 
 [Service]
 Type=simple
-ExecStart=/usr/bin/neuron --config /etc/cortex/neuron.toml
+ExecStart=/usr/bin/neuron --config /etc/neuron/neuron.toml
 Restart=on-failure
 RestartSec=5
-User=cortex
+User=neuron
-Group=cortex
+Group=neuron
 
 [Install]
 WantedBy=multi-user.target

neuron.example.toml

@@ -1,6 +1,6 @@
 # neuron.example.toml — example configuration
 #
-# Copy to /etc/cortex/neuron.toml and adjust for your environment.
+# Copy to /etc/neuron/neuron.toml and adjust for your environment.
 #
 # Environment variable overrides use NEURON_ prefix with __ separators:
 #   NEURON_PORT=9090

neuron.spec

@@ -1,5 +1,5 @@
 Name:           neuron
-Version:        0.1.2
+Version:        0.1.10
 Release:        1%{?dist}
 Summary:        Per-node GPU discovery and harness management daemon for cortex
 
@@ -22,11 +22,14 @@ BuildRequires:  systemd-rpm-macros
 Requires(pre):  shadow-utils
 Requires:       systemd
 
-# rpm's sysusers provides-generator only emits versioned user(cortex) when
+# systemd-rpm-macros ships a unit dep generator that parses User=/Group=
-# the u-line has GECOS/home/shell fields. %attr(,,cortex) in %files emits
+# from our .service file and emits Requires: user(neuron)/group(neuron).
-# an unversioned Requires: user(cortex), so we provide it explicitly.
+# rpm's sysusers provides-generator emits the unversioned form for groups
-Provides:       user(cortex)
+# but only a versioned user(neuron) = <base64> for users with GECOS/home/
-Provides:       group(cortex)
+# shell. Provide the unversioned user(neuron) explicitly so dnf can resolve
+# the auto-generated Requires. Without this, dnf5 silently filters the
+# package and reports "Nothing to do".
+Provides:       user(neuron)
 
 %description
 Neuron is a per-node daemon for cortex inference clusters. It discovers
@@ -51,12 +54,12 @@ cargo build --release -p neuron
 %install
 install -Dm755 target/release/neuron %{buildroot}%{_bindir}/neuron
 install -Dm644 data/neuron.service %{buildroot}%{_unitdir}/neuron.service
-install -Dm644 data/cortex-sysusers.conf %{buildroot}%{_sysusersdir}/neuron.conf
+install -Dm644 data/neuron-sysusers.conf %{buildroot}%{_sysusersdir}/neuron.conf
-install -dm750 %{buildroot}%{_sysconfdir}/cortex
+install -dm755 %{buildroot}%{_sysconfdir}/neuron
-install -Dm640 neuron.example.toml %{buildroot}%{_sysconfdir}/cortex/neuron.toml
+install -Dm644 neuron.example.toml %{buildroot}%{_sysconfdir}/neuron/neuron.toml
 
 %pre
-%sysusers_create_compat %{_builddir}/%{name}-%{version}/data/cortex-sysusers.conf
+%sysusers_create_compat %{_builddir}/%{name}-%{version}/data/neuron-sysusers.conf
 
 %post
 %systemd_post neuron.service
@@ -73,9 +76,9 @@ install -Dm640 neuron.example.toml %{buildroot}%{_sysconfdir}/cortex/neuron.toml
 %{_bindir}/neuron
 %{_unitdir}/neuron.service
 %{_sysusersdir}/neuron.conf
-%dir %attr(750,root,cortex) %{_sysconfdir}/cortex
+%dir %{_sysconfdir}/neuron
-%config(noreplace) %attr(640,root,cortex) %{_sysconfdir}/cortex/neuron.toml
+%config(noreplace) %{_sysconfdir}/neuron/neuron.toml
 
 %changelog
-* Tue Apr 15 2026 Rob Thijssen <grenade@rob.tn> - 0.1.0-1
+* Wed Apr 15 2026 Rob Thijssen <grenade@rob.tn> - 0.1.0-1
 - Initial package