snapd package from EPEL cannot be installed on Amazon Linux 2

[Maciej Borzecki]

Once EPEL7 is enabled, snapd package cannot be installed due to outdated selinux-policy in AMZN2.

See the log:

google:amazon-linux-2-64 .../mini/hello# sudo yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
Loaded plugins: langpacks, priorities, update-motd
epel-release-latest-7.noarch.rpm | 15 kB 00:00:00
Examining /var/tmp/yum-root-gGbDzE/epel-release-latest-7.noarch.rpm: epel-release-7-11.noarch
Marking /var/tmp/yum-root-gGbDzE/epel-release-latest-7.noarch.rpm to be installed
Resolving Dependencies
--> Running transaction check
---> Package epel-release.noarch 0:7-11 will be installed
--> Finished Dependency Resolution
amzn2-core/2/x86_64 | 2.4 kB 00:00:00

Dependencies Resolved

==============================================================================================================================================================================
 Package Arch Version Repository Size
==============================================================================================================================================================================
Installing:
 epel-release noarch 7-11 /epel-release-latest-7.noarch 24 k

Transaction Summary
==============================================================================================================================================================================
Install 1 Package

Total size: 24 k
Installed size: 24 k
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : epel-release-7-11.noarch 1/1
  Verifying : epel-release-7-11.noarch 1/1

Installed:
  epel-release.noarch 0:7-11

Complete!

google:amazon-linux-2-64 .../mini/hello# sudo yum install -y snapd
Loaded plugins: langpacks, priorities, update-motd
190 packages excluded due to repository priority protections
Resolving Dependencies
--> Running transaction check
---> Package snapd.x86_64 0:2.39.2-1.el7 will be installed
--> Processing Dependency: snap-confine(x86-64) = 2.39.2-1.el7 for package: snapd-2.39.2-1.el7.x86_64
--> Processing Dependency: snapd-selinux = 2.39.2-1.el7 for package: snapd-2.39.2-1.el7.x86_64
--> Processing Dependency: fuse for package: snapd-2.39.2-1.el7.x86_64
--> Processing Dependency: squashfs-tools for package: snapd-2.39.2-1.el7.x86_64
--> Processing Dependency: squashfuse for package: snapd-2.39.2-1.el7.x86_64
--> Running transaction check
---> Package fuse.x86_64 0:2.9.2-11.amzn2 will be installed
---> Package snap-confine.x86_64 0:2.39.2-1.el7 will be installed
---> Package snapd-selinux.noarch 0:2.39.2-1.el7 will be installed
--> Processing Dependency: selinux-policy-base >= 3.13.1-229.el7_6.12 for package: snapd-selinux-2.39.2-1.el7.noarch
---> Package squashfs-tools.x86_64 0:4.3-0.21.gitaae0aff4.amzn2.0.1 will be installed
--> Processing Dependency: liblzo2.so.2()(64bit) for package: squashfs-tools-4.3-0.21.gitaae0aff4.amzn2.0.1.x86_64
---> Package squashfuse.x86_64 0:0.1.102-1.el7 will be installed
--> Processing Dependency: squashfuse-libs(x86-64) = 0.1.102-1.el7 for package: squashfuse-0.1.102-1.el7.x86_64
--> Processing Dependency: libfuse.so.2(FUSE_2.4)(64bit) for package: squashfuse-0.1.102-1.el7.x86_64
--> Processing Dependency: libfuse.so.2(FUSE_2.5)(64bit) for package: squashfuse-0.1.102-1.el7.x86_64
--> Processing Dependency: libfuse.so.2(FUSE_2.6)(64bit) for package: squashfuse-0.1.102-1.el7.x86_64
--> Processing Dependency: libfuse.so.2(FUSE_2.8)(64bit) for package: squashfuse-0.1.102-1.el7.x86_64
--> Processing Dependency: libfuse.so.2()(64bit) for package: squashfuse-0.1.102-1.el7.x86_64
--> Processing Dependency: libfuseprivate.so.0()(64bit) for package: squashfuse-0.1.102-1.el7.x86_64
--> Processing Dependency: libsquashfuse.so.0()(64bit) for package: squashfuse-0.1.102-1.el7.x86_64
--> Processing Dependency: libzstd.so.1()(64bit) for package: squashfuse-0.1.102-1.el7.x86_64
--> Running transaction check
---> Package fuse-libs.x86_64 0:2.9.2-11.amzn2 will be installed
---> Package libzstd.x86_64 0:1.3.3-1.amzn2.0.1 will be installed
---> Package lzo.x86_64 0:2.06-8.amzn2.0.3 will be installed
---> Package snapd-selinux.noarch 0:2.39.2-1.el7 will be installed
--> Processing Dependency: selinux-policy-base >= 3.13.1-229.el7_6.12 for package: snapd-selinux-2.39.2-1.el7.noarch
---> Package squashfuse-libs.x86_64 0:0.1.102-1.el7 will be installed
--> Finished Dependency Resolution
Error: Package: snapd-selinux-2.39.2-1.el7.noarch (epel)
           Requires: selinux-policy-base >= 3.13.1-229.el7_6.12
           Installed: selinux-policy-targeted-3.13.1-192.amzn2.6.noarch (@amzn2-core/2017.12)
               selinux-policy-base = 3.13.1-192.amzn2.6
           Available: selinux-policy-minimum-3.13.1-166.amzn2.5.noarch (amzn2-core)
               selinux-policy-base = 3.13.1-166.amzn2.5
           Available: selinux-policy-minimum-3.13.1-166.amzn2.9.noarch (amzn2-core)
               selinux-policy-base = 3.13.1-166.amzn2.9
           Available: selinux-policy-minimum-3.13.1-192.amzn2.6.noarch (amzn2-core)
               selinux-policy-base = 3.13.1-192.amzn2.6
           Available: selinux-policy-mls-3.13.1-166.amzn2.5.noarch (amzn2-core)
               selinux-policy-base = 3.13.1-166.amzn2.5
           Available: selinux-policy-mls-3.13.1-166.amzn2.9.noarch (amzn2-core)
               selinux-policy-base = 3.13.1-166.amzn2.9
           Available: selinux-policy-mls-3.13.1-192.amzn2.6.noarch (amzn2-core)
               selinux-policy-base = 3.13.1-192.amzn2.6
           Available: selinux-policy-targeted-3.13.1-166.amzn2.5.noarch (amzn2-core)
               selinux-policy-base = 3.13.1-166.amzn2.5
           Available: selinux-policy-targeted-3.13.1-166.amzn2.9.noarch (amzn2-core)
               selinux-policy-base = 3.13.1-166.amzn2.9
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest

[Zygmunt Krynicki (zyga)]

I understand this this is a tracking bug. How can we ensure that we know when the situation changes?

[Brad Warren (bradmwarren)]

Does anyone know if there is any progress being made on getting this resolved?

[Maciej Borzecki (maciek-borzecki)]

Last time I checked, this looked unlikely. The problem is that EPEL7 packages are built agains RHEL7. While it is possible to install some packages from EPEL, ones that end up depending on the packages that were not imported or not updated in AMZN2 will have unmet dependencies.

Snapd can be built without SELinux (builds like this on Amazon Linux 2 by default), however we cannot upload non-SELinux package to EPEL7, as this repository is also consumed by CentOS users.

I think that the most reasonable solution is to have snapd in Amazon Linux 2 repositories.