fix: make RPM runtime portable on Tumbleweed

packaging/fenris.conf

@@ -6,6 +6,6 @@
 # The device selector specifies which NVMe drive to monitor.
 # Uncomment and set exactly one device path:
 #
-#   devices = /dev/disk/by-id/nvme-Samsung_SSD_980_PRO_500GB_S5PANS0T123456
+#   device = /dev/disk/by-id/nvme-Samsung_SSD_980_PRO_500GB_S5PANS0T123456
 #
 # See https://git.bongbetic.com/xavierk/Fenris for documentation.

packaging/nfpm.yaml

@@ -15,7 +15,7 @@ depends:
   - systemd
 
 contents:
-  # Staged tree: venv, wrapper, helpers, units, polkit, sysusers, tmpfiles
+  # Staged tree: runtime packages, wrapper, helpers, units, polkit, sysusers, tmpfiles
   - src: build/stage/
     dst: /
     type: tree

packaging/postinst.sh

@@ -9,7 +9,8 @@ set -eu
 STORE_DIR="/var/lib/fenris"
 STORE_DB="${STORE_DIR}/observations.db"
 STORE_BAK="${STORE_DIR}/observations.db.bak"
-VENV_PYTHON="/opt/fenris/bin/python3"
+RUNTIME_PYTHON="/usr/bin/python3"
+VENDOR_DIR="/opt/fenris/vendor"
 
 case "${1:-}" in
     configure)
@@ -18,8 +19,8 @@ case "${1:-}" in
             if [ -f "${STORE_DB}" ]; then
                 cp "${STORE_DB}" "${STORE_BAK}" 2>/dev/null || true
             fi
-            if [ -x "${VENV_PYTHON}" ] && [ -f "${STORE_DB}" ]; then
-                "${VENV_PYTHON}" -c "
+            if [ -d "${VENDOR_DIR}" ] && [ -f "${STORE_DB}" ]; then
+                PYTHONPATH="${VENDOR_DIR}" "${RUNTIME_PYTHON}" -c "
 from fenris.store import migrate_to_latest
 from pathlib import Path
 n = migrate_to_latest(Path('${STORE_DB}'))

packaging/rpm/post.sh

@@ -5,7 +5,8 @@ set -eu
 STORE_DIR="/var/lib/fenris"
 STORE_DB="${STORE_DIR}/observations.db"
 STORE_BAK="${STORE_DIR}/observations.db.bak"
-VENV_PYTHON="/opt/fenris/bin/python3"
+RUNTIME_PYTHON="/usr/bin/python3"
+VENDOR_DIR="/opt/fenris/vendor"
 
 if [ "$1" -eq 1 ]; then
     # Fresh install
@@ -17,8 +18,8 @@ elif [ "$1" -ge 2 ]; then
     if [ -f "${STORE_DB}" ]; then
         cp "${STORE_DB}" "${STORE_BAK}" 2>/dev/null || true
     fi
-    if [ -x "${VENV_PYTHON}" ] && [ -f "${STORE_DB}" ]; then
-        "${VENV_PYTHON}" -c "
+    if [ -d "${VENDOR_DIR}" ] && [ -f "${STORE_DB}" ]; then
+        PYTHONPATH="${VENDOR_DIR}" "${RUNTIME_PYTHON}" -c "
 from fenris.store import migrate_to_latest
 from pathlib import Path
 n = migrate_to_latest(Path('${STORE_DB}'))

packaging/stage.sh

@@ -5,7 +5,7 @@
 #
 # VERSION defaults to the version in pyproject.toml.
 # The staged tree contains:
-#   /opt/fenris/          — bundled venv with the built wheel
+#   /opt/fenris/vendor/   — bundled pure-Python application dependencies
 #   /usr/bin/fenris       — unprivileged wrapper
 #   /usr/libexec/fenris/  — fenris-monitor, fenris-collect
 #   /usr/lib/systemd/system/ — fenris-collect.{timer,service}
@@ -35,18 +35,23 @@ rm -rf "${STAGE_DIR}"
 mkdir -p "${STAGE_DIR}"
 
 # --- Use pre-built wheel from dist/ ---
-WHEEL=$(ls "${REPO_ROOT}"/dist/fenris-*.whl 2>/dev/null | head -1)
+WHEEL=$(ls "${REPO_ROOT}"/dist/fenris-"${VERSION}"-*.whl 2>/dev/null | head -1)
 if [ -z "${WHEEL}" ]; then
     echo "Error: no wheel found in dist/ — run 'make dist/fenris-*.whl' first" >&2
     exit 1
 fi
 echo "  Using wheel: $(basename "${WHEEL}")"
 
-# --- Create venv with --copies and install wheel ---
-echo "  Creating bundled venv ..."
-python3 -m venv --copies "${STAGE_DIR}/opt/fenris"
-"${STAGE_DIR}/opt/fenris/bin/pip" install --upgrade pip --quiet 2>&1 | tail -1
-"${STAGE_DIR}/opt/fenris/bin/pip" install "${WHEEL}" --quiet 2>&1 | tail -1
+# --- Vendor runtime packages without an interpreter ---
+# A copied Python binary contains an ABI and build-host dynamic-library path.
+# It fails after rolling-distribution Python upgrades (for example Tumbleweed
+# 3.12 -> 3.13).  Fenris and its locked dependencies are pure Python, so place
+# them in a version-neutral directory and execute with the target's python3.
+echo "  Installing version-neutral runtime packages ..."
+VENDOR_DIR="${STAGE_DIR}/opt/fenris/vendor"
+mkdir -p "${VENDOR_DIR}"
+python3 -m pip install --disable-pip-version-check --no-compile \
+    --target "${VENDOR_DIR}" -r "${REPO_ROOT}/requirements.txt" "${WHEEL}"
 
 # --- Inject version into wrapper from pyproject.toml ---
 # The wrapper has a hardcoded version string; patch it for packaging.