Passbolt CE 5.17.0 upgrade blocked by SELinux dependency on openSUSE Leap 15.6

Installation Issues
1

Checklist
I have read intro post: https://community.passbolt.com/t/about-the-installation-issues-category/12
I have read the tutorials, help and searched for similar issues
I provide relevant information about my server (component names and versions, etc.)
I provide a copy of my logs and healthcheck
I describe the steps I have taken to trouble shoot the problem
I describe the steps on how to reproduce the issue

Passbolt CE 5.17.0 upgrade blocked by SELinux dependency on openSUSE Leap 15.6

Hi,

I’m running Passbolt Community Edition 5.15.0 on openSUSE Leap 15.6 and am trying to upgrade to version 5.17.0.

Unfortunately, the upgrade is blocked by a dependency on passbolt-server-selinux, which in turn requires a Fedora-specific SELinux policy package that is not available on openSUSE Leap 15.6.

Since openSUSE Leap uses AppArmor rather than SELinux by default, I suspect this may be an issue with the RPM packaging or dependency definitions for version 5.17.0.

1. System information

Component Version / Configuration
Operating system openSUSE Leap 15.6
Kernel 6.4.0-150600.23.103-default
Passbolt edition Community Edition (CE)
Currently installed version 5.15.0-1
Available version 5.17.0-1
PHP 8.2.30
Web server nginx 1.21.5
PHP-FPM PHP 8.2
Active security module AppArmor
Installation method Official Passbolt CE RPM repository

The official repository is configured as follows:

[passbolt-server]
name=Passbolt Server
baseurl=https://download.passbolt.com/ce/rpm/opensuse/stable
enabled=1
gpgcheck=1
gpgkey=https://download.passbolt.com/pub.key

2. Problem description

When attempting to upgrade Passbolt using:

zypper update --dry-run passbolt-ce-server

Zypper reports the following dependency conflict:

Problem: 1: nothing provides 'selinux-policy-base >= 3.13.1-128.6.fc22' needed by the to be installed passbolt-server-selinux-0.7-1.noarch

Solution 1: do not install passbolt-ce-server-5.17.0-1.noarch
Solution 2: break passbolt-server-selinux-0.7-1.noarch by ignoring some of its dependencies

I cancelled the operation rather than forcing an installation with unresolved dependencies.

Interestingly, zypper list-updates reports no updates, while zypper list-updates --all correctly identifies Passbolt 5.17.0 as available.

3. Dependency comparison

The currently installed Passbolt CE 5.15.0 package does not require passbolt-server-selinux.

However, the available Passbolt CE 5.17.0 package explicitly includes it as a required dependency.

Output from:

zypper info --requires passbolt-ce-server

Relevant section:

Name       : passbolt-ce-server
Version    : 5.17.0-1
Repository : Passbolt Server

Requires:
    /usr/bin/env
    nginx
    /bin/bash
    cronie
    php-gnupg
    php-pecl
    passbolt-server-selinux
    php >= 8.2
    php-cli >= 8.2
    php-curl >= 8.2
    php-fileinfo >= 8.2
    php-fpm >= 8.2
    php-gd >= 8.2
    php-intl >= 8.2
    php-json >= 8.2
    php-mbstring >= 8.2
    php-mysql >= 8.2
    php-openssl >= 8.2
    php-pgsql >= 8.2
    php-posix >= 8.2
    php-xmlreader >= 8.2
    php-xmlwriter >= 8.2
    php-ldap >= 8.2

The SELinux package is available in the official Passbolt repository:

Name       : passbolt-server-selinux
Version    : 0.7-1
Repository : Passbolt Server

However, it cannot be installed because of its dependency on:

selinux-policy-base >= 3.13.1-128.6.fc22

The fc22 version suffix suggests a Fedora-specific dependency.

4. SELinux / AppArmor verification

The active Linux Security Modules were verified using:

cat /sys/kernel/security/lsm

Output:

lockdown,capability,apparmor,bpf

The SELinux policy package is not installed:

rpm -q selinux-policy-base

Output:

package selinux-policy-base is not installed

Likewise, passbolt-server-selinux is not currently installed:

rpm -q passbolt-server-selinux

Output:

package passbolt-server-selinux is not installed

5. Troubleshooting performed

I have completed the following checks:

  1. Verified that the repository URL matches the official Passbolt CE repository for openSUSE.

  2. Refreshed all repositories using zypper refresh.

  3. Confirmed that Passbolt 5.17.0 is available using zypper list-updates --all.

  4. Reproduced the dependency conflict using zypper update --dry-run passbolt-ce-server.

  5. Compared the installed 5.15.0 package dependencies with the available 5.17.0 package.

  6. Confirmed that the new package requires passbolt-server-selinux.

  7. Verified that AppArmor is active and SELinux is not listed among the active Linux Security Modules.

  8. Confirmed that neither selinux-policy-base nor passbolt-server-selinux is installed.

No dependency overrides or forced installations have been attempted.

6. Steps to reproduce

On an openSUSE Leap 15.6 system with Passbolt CE 5.15.0 installed:

  1. Configure the official Passbolt CE openSUSE stable repository.

  2. Execute zypper refresh.

  3. Execute zypper list-updates --all to verify that 5.17.0 is available.

  4. Execute zypper update --dry-run passbolt-ce-server.

  5. Observe the dependency conflict involving passbolt-server-selinux and selinux-policy-base.

7. Current Passbolt healthcheck

The existing Passbolt CE 5.15.0 installation is operational.

The healthcheck confirms:

[PASS] PHP version 8.2.30.
[PASS] The temporary directory and its content are writable and not executable.
[PASS] The logs directory /var/log/passbolt/ and its content are writable.
[PASS] Cache is working.
[PASS] /healthcheck/status is reachable.

[PASS] SSL peer certificate validates.
[PASS] Hostname is matching in SSL certificate.
[PASS] Not using a self-signed certificate.

[PASS] A valid JWT key pair was found.
[PASS] The server OpenPGP key is not the default one.
[PASS] The private key can be used to decrypt a message.

[PASS] The database schema is up to date.
[PASS] The application is able to connect to the database.
[PASS] The database version is supported.
[PASS] The model schema cache shows no discrepancies with the database schema.

[FAIL] This installation is not up to date.
       Currently using 5.15.0 and it should be 5.17.0.

[FAIL] 1 error(s) found.

The only remaining healthcheck failure is the outdated Passbolt version. There are also non-fatal configuration warnings.

8. Questions

Could someone from the Passbolt team please clarify the following?

  1. Is passbolt-server-selinux intentionally a mandatory dependency for the openSUSE Leap RPM package, even on systems using AppArmor?

  2. Could this be an RPM packaging issue introduced between Passbolt CE 5.15.0 and 5.17.0?

  3. Is there an officially supported method to upgrade to 5.17.0 without installing passbolt-server-selinux or bypassing RPM dependency checks?

  4. If this is a packaging issue, is a corrected RPM package planned?

Since this is a production password manager, I would prefer to avoid forcing the installation or leaving unresolved RPM dependencies.

Any guidance would be appreciated.

Thanks in advance!