fix(tmachine): restore package-installed Podman qualification

.github/workflows/branch-e2e.yml

@@ -462,8 +462,7 @@ jobs:
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
-  # Run the Podman e2e suite on tmachine. It needs the binary installer's CLI
-  # path and local HTTP gateway.
+  # Run the Podman e2e suite on tmachine against the packaged gateway.
   podman-e2e-integration:
     needs: prepare-integration
     permissions:
@@ -477,7 +476,7 @@ jobs:
       integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }}
       test-matrix: >-
         [
-          {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"e2e-podman"}
+          {"environment":"fedora-podman-rootless","installer":"rpm","testsuite":"e2e-podman"}
         ]
 
   docker-e2e:

.github/workflows/e2e-suites.yml

@@ -91,14 +91,14 @@ jobs:
             {"environment":"ubuntu-k3s","installer":"k3s-ha","family":"features","package":"host-gateway","gateway":"tmachine","runner":"ubuntu-24.04"},
             {"environment":"fedora-podman-rootful-keycloak","installer":"rpm","family":"features","package":"keycloak-provider-refresh","gateway":"openshell","runner":"ubuntu-24.04"},
             {"environment":"fedora-podman-rootless-keycloak","installer":"rpm","family":"features","package":"keycloak-provider-refresh","gateway":"openshell","runner":"ubuntu-24.04"},
-            {"environment":"fedora-podman-rootful-userns-default","installer":"binaries","family":"drivers/podman","gateway":"tmachine","runner":"ubuntu-24.04"},
-            {"environment":"fedora-podman-rootful-userns-auto","installer":"binaries","family":"drivers/podman","gateway":"tmachine","runner":"ubuntu-24.04"},
-            {"environment":"fedora-podman-rootful-userns-keep-id","installer":"binaries","family":"drivers/podman","gateway":"tmachine","runner":"ubuntu-24.04"},
-            {"environment":"fedora-podman-rootful-userns-private","installer":"binaries","family":"drivers/podman","gateway":"tmachine","runner":"ubuntu-24.04"},
-            {"environment":"fedora-podman-rootless-userns-default","installer":"binaries","family":"drivers/podman","gateway":"tmachine","runner":"ubuntu-24.04"},
-            {"environment":"fedora-podman-rootless-userns-auto","installer":"binaries","family":"drivers/podman","gateway":"tmachine","runner":"ubuntu-24.04"},
-            {"environment":"fedora-podman-rootless-userns-keep-id","installer":"binaries","family":"drivers/podman","gateway":"tmachine","runner":"ubuntu-24.04"},
-            {"environment":"fedora-podman-rootless-userns-private","installer":"binaries","family":"drivers/podman","gateway":"tmachine","runner":"ubuntu-24.04"}
+            {"environment":"fedora-podman-rootful-userns-default","installer":"rpm","family":"drivers/podman","gateway":"openshell","runner":"ubuntu-24.04"},
+            {"environment":"fedora-podman-rootful-userns-auto","installer":"rpm","family":"drivers/podman","gateway":"openshell","runner":"ubuntu-24.04"},
+            {"environment":"fedora-podman-rootful-userns-keep-id","installer":"rpm","family":"drivers/podman","gateway":"openshell","runner":"ubuntu-24.04"},
+            {"environment":"fedora-podman-rootful-userns-private","installer":"rpm","family":"drivers/podman","gateway":"openshell","runner":"ubuntu-24.04"},
+            {"environment":"fedora-podman-rootless-userns-default","installer":"rpm","family":"drivers/podman","gateway":"openshell","runner":"ubuntu-24.04"},
+            {"environment":"fedora-podman-rootless-userns-auto","installer":"rpm","family":"drivers/podman","gateway":"openshell","runner":"ubuntu-24.04"},
+            {"environment":"fedora-podman-rootless-userns-keep-id","installer":"rpm","family":"drivers/podman","gateway":"openshell","runner":"ubuntu-24.04"},
+            {"environment":"fedora-podman-rootless-userns-private","installer":"rpm","family":"drivers/podman","gateway":"openshell","runner":"ubuntu-24.04"}
           ]'
           # `suite` names the row's tests in the job and artifact names.
           matrix=$(jq -c --arg family "${FAMILY}" '{include: map(

.github/workflows/integration-runner.yml

@@ -24,7 +24,7 @@ on:
         type: string
         default: >-
           [
-            {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"e2e-podman"}
+            {"environment":"fedora-podman-rootless","installer":"rpm","testsuite":"e2e-podman"}
           ]
 
 permissions:

.github/workflows/integration-test.yml

@@ -27,7 +27,7 @@ on:
         type: string
         default: >-
           [
-            {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"e2e-podman"}
+            {"environment":"fedora-podman-rootless","installer":"rpm","testsuite":"e2e-podman"}
           ]
 
 permissions:

CI.md

@@ -166,10 +166,11 @@ selected. DEB and RPM packages build only when integration qualification is sele
 the DEB on Ubuntu with Docker and installs the CLI and gateway RPMs on Fedora with
 rootful and rootless Podman. These lanes run conformance using the matching runtime
 images. Release Dev, Release, and Pre-release use the same package installers.
-The feature suites (`tests/suites/features`) run the same way, on the
-package installers. The Podman driver suite (`tests/suites/drivers/podman`) and the
-`e2e-podman` lane retain the binary installer because they configure its system
-service, local HTTP gateway, and CLI path. The driver suite and `e2e-podman` run
+The feature suites (`tests/suites/features`) and the Podman driver suite
+(`tests/suites/drivers/podman`) run the same way, on the package installers; the
+driver suite's environments merge their Podman settings into the packaged
+gateway's configuration (see `TESTING.md`). The `e2e-podman` lane runs on the
+RPM installer as well. The driver suite and `e2e-podman` run
 only in `Branch E2E Checks`. The manual Integration Tests workflow runs the
 remaining tmachine testsuites, such as `e2e-podman`, and downloads the packages
 selected by its matrix.

TESTING.md

@@ -541,7 +541,7 @@ Run the portable subset in a disposable rootless Podman guest:
 
 ```shell
 nix run .#build-artifacts
-nix run .#tmachine -- test fedora-podman-rootless binaries e2e-podman
+nix run .#tmachine -- test fedora-podman-rootless rpm e2e-podman
 ```
 
 Print the exact tmachine archive selection as a shell `PODMAN_CI_TESTS` array:
@@ -566,14 +566,40 @@ matching lines in `branch-checks.yml`, and `ALIGNED_WORKSPACES`. The Podman
 driver suite (`tests/suites/drivers/podman`) compares OpenShell and direct
 Podman user-namespace mappings.
 Each `fedora-podman-{rootful,rootless}-userns-<mode>` environment configures
-the gateway with one mode (`default`, `auto`, `keep-id` or `private`); only the
-`binaries` installer applies it:
+the gateway with one mode (`default`, `auto`, `keep-id` or `private`) and works
+with every installer; CI runs it with `rpm`:
 
 ```shell
 nix run .#openshell-test-runner -- run \
-  --environment fedora-podman-rootless-userns-keep-id --installer binaries \
-  --gateway tmachine --family drivers/podman
-```
+  --environment fedora-podman-rootless-userns-keep-id --installer rpm \
+  --family drivers/podman
+```
+
+#### Gateway overrides in an environment
+
+An environment overrides gateway settings by writing the tables to change to
+`/etc/openshell-test/gateway-overrides.toml` in a playbook that runs before the
+installer. The file holds whole tables, such as `[openshell.gateway]` or
+`[openshell.drivers.podman]`, and is not a complete configuration. Each
+installer applies it to the gateway's own file:
+
+- `binaries` applies it to the `/etc/openshell/gateway.toml` it generates.
+- `deb` and `rpm` apply it to the service user's
+  `~/.config/openshell/gateway.toml`, the file the packaged service reads. The
+  file starts as a copy of the rpm's
+  `/usr/share/openshell-gateway/gateway.toml.default`, where the service would
+  seed it on first start, or as a minimal `version = 2` file when the package
+  has no default. No environment replaces the packaged file, and an environment
+  with no overrides leaves it untouched.
+- `k3s` installers ignore the file.
+
+`tests/tmachine/ansible/roles/openshell_gateway/files/merge-gateway-toml.py`
+does the work. Each key in the overrides replaces the same key in the table, or
+is added to it, and a table the file lacks is appended. The rest of the file,
+comments included, stays. The script parses the result and fails the setup,
+leaving the file unchanged, when it isn't valid TOML. It can't remove a key.
+Settings that the packaged service reads from `gateway.env` instead of the
+TOML are not covered.
 
 The `oci-image` feature suite (`tests/suites/features/oci-image`) checks OCI
 image identity and working-directory behavior shared by the Docker and Podman

tasks/test.toml

@@ -26,8 +26,13 @@ depends = [
   "test:maintainer-approval",
   "test:cargo-lockfile-alignment",
   "test:review-readiness",
+  "test:merge-gateway-toml",
 ]
 
+["test:merge-gateway-toml"]
+description = "Test the tmachine gateway TOML merge script"
+run = "uv run --no-project --with pytest pytest tests/tmachine/ansible/roles/openshell_gateway/files/merge_gateway_toml_test.py"
+
 ["test:cargo-lockfile-alignment"]
 description = "Test the Cargo lockfile alignment check"
 run = "uv run --no-project --with pytest pytest tasks/scripts/check_cargo_lockfile_alignment_test.py"

tests/tmachine/ansible/playbooks/drivers/podman/e2e.yaml

@@ -48,13 +48,30 @@
         HOME: /home/tmachine
         XDG_RUNTIME_DIR: /run/user/1000
 
+    # The binaries installer runs a plain-HTTP gateway named tmachine from a
+    # system service and puts the CLI in /usr/local/bin. The package installers
+    # run the packaged user service, install the CLI in /usr/bin and register
+    # the gateway as openshell, using the package default network and namespace.
+    - name: Detect the installer
+      ansible.builtin.stat:
+        path: /usr/local/bin/openshell
+      register: podman_e2e_binaries_cli
+
+    - name: Select the gateway under test
+      ansible.builtin.set_fact:
+        podman_e2e_binaries: "{{ podman_e2e_binaries_cli.stat.exists }}"
+        podman_e2e_cli: "{{ '/usr/local/bin/openshell' if podman_e2e_binaries_cli.stat.exists else '/usr/bin/openshell' }}"
+        podman_e2e_gateway: "{{ 'tmachine' if podman_e2e_binaries_cli.stat.exists else 'openshell' }}"
+
     - name: Remove any previous OpenShell gateway registration
+      when: podman_e2e_binaries
       ansible.builtin.command:
         argv: [/usr/local/bin/openshell, gateway, remove, tmachine]
       changed_when: false
       failed_when: false
 
     - name: Register the configured OpenShell gateway
+      when: podman_e2e_binaries
       ansible.builtin.command:
         argv: [/usr/local/bin/openshell, gateway, add, http://127.0.0.1:17670, --local, --name, tmachine]
 
@@ -75,12 +92,12 @@
         CONTAINER_ENGINE: podman
         CONTAINER_HOST: unix:///run/user/1000/podman/podman.sock
         HOME: /home/tmachine
-        OPENSHELL_BIN: /usr/local/bin/openshell
+        OPENSHELL_BIN: "{{ podman_e2e_cli }}"
         OPENSHELL_E2E_CONTAINER_ENGINE_UNSET_XDG_CONFIG_HOME: "1"
         OPENSHELL_E2E_DRIVER: podman
-        OPENSHELL_E2E_NETWORK_NAME: tmachine
-        OPENSHELL_E2E_SANDBOX_NAMESPACE: tmachine
-        OPENSHELL_GATEWAY: tmachine
+        OPENSHELL_E2E_NETWORK_NAME: "{{ podman_e2e_gateway }}"
+        OPENSHELL_E2E_SANDBOX_NAMESPACE: "{{ podman_e2e_gateway }}"
+        OPENSHELL_GATEWAY: "{{ podman_e2e_gateway }}"
         OPENSHELL_PODMAN_SOCKET: /run/user/1000/podman/podman.sock
         XDG_RUNTIME_DIR: /run/user/1000
       register: podman_e2e_test_result
@@ -96,9 +113,12 @@
         var: podman_e2e_test_result.stdout_lines
 
     - name: Capture OpenShell gateway journal after Podman E2E test failure
-      become: true
+      become: "{{ podman_e2e_binaries }}"
       ansible.builtin.command:
-        argv: [journalctl, --unit, openshell-gateway.service, --no-pager, --lines, "200"]
+        argv: >-
+          {{ ['journalctl', '--unit', 'openshell-gateway.service', '--no-pager', '--lines', '200']
+             if podman_e2e_binaries else
+             ['journalctl', '--user-unit', 'openshell-gateway.service', '--no-pager', '--lines', '200'] }}
       changed_when: false
       failed_when: false
       when: podman_e2e_test_result.rc != 0

tests/tmachine/ansible/playbooks/drivers/podman/userns.yaml

@@ -5,23 +5,27 @@
 #
 # `podman_userns_mode` is default, auto, keep-id or private. Every mode except
 # default writes its `[openshell.drivers.podman]` settings to
-# `podman_userns_driver_config`, which the openshell_gateway role (the
-# `binaries` installer) appends to gateway.toml; default removes the file. The
+# `/etc/openshell-test/gateway-overrides.toml`, which every installer applies to the active
+# gateway-overrides.toml (the openshell_gateway role for `binaries`, the
+# openshell_packaged_gateway role for the packages); default removes the file. The
 # Podman support crate (tests/support/podman) reads the published mode and
 # runs Podman's own reference container in it.
 ---
 - name: Podman user namespaces for tests
   hosts: all
   gather_facts: false
   vars:
-    podman_userns_driver_config: /etc/openshell-test/podman-driver.toml
+    podman_userns_driver_config: /etc/openshell-test/gateway-overrides.toml
     podman_userns_settings:
       default: ""
       auto: |
+        [openshell.drivers.podman]
         userns = "auto"
       keep-id: |
+        [openshell.drivers.podman]
         userns = "keep-id"
       private: |
+        [openshell.drivers.podman]
         userns = "private"
         uidmap = ["0:0:1", "1:1:65535"]
         gidmap = ["0:0:1", "1:1:65535"]
@@ -59,7 +63,7 @@
       when: podman_userns_mode != "default"
 
     # The fragment is the only source of userns, uidmap and gidmap settings in
-    # the rendered gateway.toml, so default mode leaves them unset.
+    # the gateway's configuration, so default mode leaves them unset.
     - name: Remove Podman driver user-namespace settings for default mode
       become: true
       ansible.builtin.file: