--install with extra-data does not work

[TingPing]

error: While trying to apply extra data: Failed to execute child process “/app/libexec/flatpak-bwrap” (No such file or directory)

[nanonyme]

I guess this is also a question of incorrect path being used?

[nanonyme]

(also probably shouldn't happen inside sandbox to begin with...)

[TingPing]

Yeah bwrap will always fail anyway.

[nanonyme]

I wonder if it would be best call to stage a wrapper into “/app/libexec/flatpak-bwrap” that would call flatpak-spawn.

[prodrigestivill]

Still failing with a different error.

Example on how to reproduce, run this:

flatpak install --user org.flatpak.Builder
git clone --recurse-submodules https://github.com/flathub/com.nordpass.NordPass.git
cd com.nordpass.NordPass
flatpak run org.flatpak.Builder --verbose --force-clean --user --install build com.nordpass.NordPass.yaml

Error shown:

FB: Using Flatpak version 1.14.1
FB: Running: flatpak install --user -y --noninteractive --reinstall /home/user/com.nordpass.NordPass/.flatpak-builder/cache com.nordpass.NordPass/x86_64/master
Updating runtime/com.nordpass.NordPass.Locale/x86_64/master
Installing app/com.nordpass.NordPass/x86_64/master
bwrap: No permissions to creating new namespace, likely because the kernel does not allow non-privileged user namespaces. On e.g. debian this can be enabled with 'sysctl kernel.unprivileged_userns_clone=1'.
Error: Failed to install com.nordpass.NordPass: While trying to apply extra data: apply_extra script failed, exit status 256
Install failed: Child process exited with code 1

Notes:

• sysctl kernel.unprivileged_userns_clone is correctly set to 1.
• Running flatpak install afterwards and outside the flatpak builder container does work.
  • Example: flatpak install --user -y --noninteractive --reinstall /home/user/com.nordpass.NordPass/.flatpak-builder/cache com.nordpass.NordPass/x86_64/master

[o-kotb]

Not sure if this is related, but when running org.flatpak.Builder with --build-shell=some_module I get the same bwrap error as prodrigestivill about it not having permissions to create new namespaces.