Install Bitwarden polkit action on Fedora Silverblue (ostree)

0-install-bitwarden-polkit-action-on-silverblue.sh

#!/usr/bin/env bash
# Originally published here: https://github.com/JohnStarich/dotfiles/commit/d4b1419664472e82ac518d36d50fa61ff538e026
# See master branch for the latest install script I use.
#
# This script is designed to be idempotent. It should be possible to reinstall repeatedly, if needed.
# It can also run from inside a toolbox.

set -ex -o pipefail

policy_file=./buildroot/usr/share/polkit-1/actions/com.bitwarden.Bitwarden.policy
if [[ ! -f "$policy_file" ]]; then
    mkdir "$(dirname "$policy_file")"
    mv "$(basename "$policy_file")" "$policy_file"
fi
sudo chown root:root "$policy_file"

chcon system_u:object_r:usr_t:s0 ./buildroot/usr/share/polkit-1/actions/com.bitwarden.Bitwarden.policy  # This can't be run inside a (rootless) container build.
image_tag=localhost/bitwarden-ostree-policy-rpm:latest
podman build -t "$image_tag" .

rpm_dir=$PWD/out
rm -rf "$rpm_dir"
mkdir -p "$rpm_dir"
podman run \
    --rm \
    --name "bitwarden-ostree-policy-rpm-$RANDOM" \
    -v "./buildroot:/buildroot:ro" \
    -v "$rpm_dir:/data:Z" \
    "$image_tag"
rpm_file=./out/bitwarden-polkit-policy.noarch.rpm
ls "$rpm_file"

"${command_prefix[@]}" sudo rpm-ostree install \
    --assumeyes \
    --idempotent \
    --apply-live \
    --uninstall bitwarden-polkit-policy \
    "$rpm_file"
"${command_prefix[@]}" sudo systemctl restart polkit

com.bitwarden.Bitwarden.policy

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
 "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">

<policyconfig>
    <action id="com.bitwarden.Bitwarden.unlock">
      <description>Unlock Bitwarden</description>
      <message>Authenticate to unlock Bitwarden</message>
      <defaults>
        <allow_any>no</allow_any>
        <allow_inactive>no</allow_inactive>
        <allow_active>auth_self</allow_active>
      </defaults>
    </action>
</policyconfig>

Containerfile

FROM registry.fedoraproject.org/fedora-toolbox:43

RUN dnf install -y rpm-build
WORKDIR /build
RUN <<EOF
cat >./bitwarden-policy.spec <<EOT
Name: bitwarden-polkit-policy
Version: 1.0
Release:        %autorelease
Summary: bitwarden-polkit-policy

License: MIT

%description
bitwarden-polkit-policy

%files
/usr/share/polkit-1/actions/com.bitwarden.Bitwarden.policy
EOT

cat >/run.sh <<EOT
#!/usr/bin/env bash

set -ex -o pipefail

# Verify SELinux context is correct
ls -Z /buildroot/usr/share/polkit-1/actions/com.bitwarden.Bitwarden.policy | tee /dev/stderr | grep '^system_u:object_r:usr_t:s0 '

rpmbuild \
    --buildroot /buildroot \
    --define "_rpmdir $PWD/out" \
    --target noarch \
    -bb bitwarden-policy.spec

mv ./out/noarch/bitwarden-polkit-policy-*.noarch.rpm /data/bitwarden-polkit-policy.noarch.rpm
EOT
chmod +x /run.sh
EOF

ENTRYPOINT ["/run.sh"]

Install docs issue opened here: bitwarden/clients#19571