https://bugzilla.redhat.com/show_bug.cgi?id=2291235
--- Comment #49 from Panu Matilainen pmatilai@redhat.com ---
One way might be using `%pretrans` another to add the `%sysusers_create_compat %{SOURCE1}` %pre macro or similar to all packages which need the SSSD user for installation.
It's not possible to create users (or much anything else for that matter) from %pretrans because it runs in a complete void during initial install. You can't win this with dirty tricks, so please don't try. The best thing you can do is reduce ordering constraints in your package set: have a hard look at all your Requires and any that are there only to ensure version lock to subcomponents, turn to Requires(meta). If none are, then none are. But it's worth a look.
pam dep on authselect: added in https://src.fedoraproject.org/rpms/pam/c/ff21ecd1
Thanks Adam for digging that up. That does look like a potential meta dependency to me: install scriptlets do not need pam services, only the running system does. So the order does not matter at all. AFAICS.
authselect dep on sssd (suggests): added in https://src.fedoraproject.org/rpms/authselect/c/4c5cb1a9aef1bb71c390f2f26a8f... , without explanation. That was quite early in the package's history.
Yup, it has the air of "having this around seems like useful" dependency, never intended to affect ordering or anything like that. Although, by 2018 it would have already done so.