Timothée Ravier
e578d5f583
The protocols supported by those plugins are either obsolete or not often used, and thus those plugins may include vulnerabilties. Remove them for now and we can consider adding them back if requested. See: https://blogs.gnome.org/mcatanzaro/2026/09/15/privilege-escalation-vulnerabilities-in-networkmanager-plugins/
239 lines
6.4 KiB
YAML
239 lines
6.4 KiB
YAML
# This file has a list of packages to skip from comps that we don't want
|
|
|
|
# Entirely skip all packages in those groups for the common set of packages
|
|
exclude_list_groups:
|
|
- libreoffice
|
|
- gnome-desktop
|
|
- container-management
|
|
- base-x
|
|
|
|
# Always exclude packages matching those regexp:
|
|
# - PackageKit is spread across various groups
|
|
# - We can not include openh264. See https://fedoraproject.org/wiki/OpenH264
|
|
exclude_list_all_regexp:
|
|
- "PackageKit.*"
|
|
- "gstreamer1-plugin-openh264"
|
|
- "mozilla-openh264"
|
|
- "openh264"
|
|
|
|
# Common exclude list for all ostree desktop versions
|
|
exclude_list:
|
|
core:
|
|
# Make sure we only pull-in dnf5 and not dnf4 or yum
|
|
- dnf
|
|
- dnf-plugins-core
|
|
- yum
|
|
# We include dnf5 in another manifest, only for bootable containers
|
|
- dnf5
|
|
- dnf5-plugins
|
|
# Not sure why this is there at all
|
|
- dracut-config-rescue
|
|
# Eh...you can install this in a priv container
|
|
- parted
|
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1452348
|
|
- grubby
|
|
# Colin says we also don't need grubby-deprecated
|
|
- grubby-deprecated
|
|
# Why?
|
|
- ncurses
|
|
workstation-product:
|
|
# Make sure we only pull-in dnf5 and not dnf4 or yum
|
|
- dnf
|
|
- dnf-plugins-core
|
|
- deltarpm
|
|
- python3-dnf-plugin-system-upgrade
|
|
- python3-dnf-plugins-core
|
|
# We include dnf5 in another manifest, only for bootable containers
|
|
- dnf5
|
|
- dnf5-plugins
|
|
# We use fedora-release-silverblue instead
|
|
- fedora-release-workstation
|
|
# Really not worth listing explicitly
|
|
- filesystem
|
|
- mailcap
|
|
# This seems like some weird legacy thing, it also
|
|
# drags in usermode, which should also be deprecated
|
|
# and blocks a /usr/sbin + /usr/bin unification.
|
|
- setuptool
|
|
# This probably doesn't need to be default
|
|
- ppp
|
|
# We removed cronie a while ago, should nuke these too
|
|
- crontabs
|
|
- at
|
|
# Requires libreoffice
|
|
- unoconv
|
|
# Will change to git-core as git pulls in Perl
|
|
- git
|
|
# Apps
|
|
- evolution
|
|
- evolution-ews
|
|
- evolution-help
|
|
- mediawriter
|
|
- rhythmbox
|
|
# This is ancient now, and IMO has been superceded by cgroups
|
|
# Also it breaks with --unified-core.
|
|
- psacct
|
|
# Random tools: container
|
|
- jwhois
|
|
- net-tools
|
|
- nmap-ncat
|
|
- rdist
|
|
- tcpdump
|
|
- telnet
|
|
- traceroute
|
|
# filesystem tools, again priv container
|
|
- dosfstools
|
|
- symlinks
|
|
# Misc
|
|
- dos2unix
|
|
# Gnome specific
|
|
- desktop-backgrounds-gnome
|
|
- gnome-shell-extension-background-logo
|
|
- pinentry-gnome3
|
|
# Excluded here for all desktops and manually re-added in Silverblue manifest
|
|
- qadwaitadecorations-qt5
|
|
- qt5-qtbase
|
|
- qt5-qtbase-gui
|
|
- qt5-qtdeclarative
|
|
- qt5-qtxmlpatterns
|
|
# X11 specific
|
|
- xorg-x11-drv-libinput
|
|
# Included explicitly in the fedora.yaml manifest
|
|
- fedora-chromium-config
|
|
- fedora-flathub-remote
|
|
- fedora-workstation-backgrounds
|
|
- fedora-workstation-repositories
|
|
# See: https://gitlab.com/fedora/ostree/sig/-/issues/81
|
|
- plocate
|
|
# Included explicitly in the fedora.yaml manifest
|
|
- toolbox
|
|
# Only needed for CSD support with GNOME on Silverblue
|
|
- qt6-qtbase
|
|
- qt6-qtbase-gui
|
|
- qt6-qtdeclarative
|
|
- qt6-qtwayland-adwaita-decoration
|
|
firefox:
|
|
# Included explicitly in the fedora.yaml manifest
|
|
- fedora-bookmarks
|
|
- firefox
|
|
networkmanager-submodules:
|
|
# Let's use the builtin one by default
|
|
- dhcp-client
|
|
printing:
|
|
# We don't use PackageKit
|
|
- cups-pk-helper
|
|
# For now...
|
|
- ghostscript
|
|
workstation-ostree-support:
|
|
# Now only included in the legacy ostree variants
|
|
- ostree-grub2
|
|
|
|
# Desktop environment specific exclude lists
|
|
desktop_exclude_list:
|
|
gnome-desktop:
|
|
# Non-critical apps -> Flatpak
|
|
- baobab
|
|
- cheese
|
|
- decibels
|
|
- snapshot
|
|
- gnome-boxes
|
|
- gnome-calculator
|
|
- gnome-calendar
|
|
- gnome-characters
|
|
- gnome-clocks
|
|
- gnome-connections
|
|
- gnome-contacts
|
|
- gnome-documents
|
|
- gnome-font-viewer
|
|
- gnome-logs
|
|
- gnome-maps
|
|
- gnome-photos
|
|
- gnome-screenshot
|
|
- gnome-text-editor
|
|
- gnome-weather
|
|
- jwhois
|
|
- loupe
|
|
- papers
|
|
- papers-nautilus
|
|
- rdist
|
|
- sane-backends-drivers-scanners
|
|
- showtime
|
|
- simple-scan
|
|
- sushi
|
|
- symlinks
|
|
- tcpdump
|
|
- telnet
|
|
- traceroute
|
|
# Remove uncommon NetworkManager plugins
|
|
- NetworkManager-libreswan-gnome
|
|
- NetworkManager-ssh-gnome
|
|
budgie-desktop:
|
|
# Incompatible with ostree for various reasons
|
|
- abrt-desktop
|
|
- cups-pk-helper
|
|
- dnfdragora
|
|
# Remove uncommon NetworkManager plugins
|
|
- NetworkManager-fortisslvpn-gnome
|
|
- NetworkManager-iodine-gnome
|
|
- NetworkManager-l2tp-gnome
|
|
- NetworkManager-libreswan-gnome
|
|
- NetworkManager-ssh-gnome
|
|
- NetworkManager-sstp-gnome
|
|
- NetworkManager-strongswan-gnome
|
|
# Included explicitly in the fedora.yaml manifest
|
|
- fedora-flathub-remote
|
|
- fedora-workstation-repositories
|
|
- firefox
|
|
budgie-desktop-apps:
|
|
# Non-critical apps -> Flatpak
|
|
- kcalc
|
|
- koko
|
|
- okular
|
|
- parole
|
|
- rhythmbox
|
|
# Included explicitly in the fedora.yaml manifest
|
|
- firefox
|
|
kde-desktop:
|
|
# Incompatible with ostree for various reasons
|
|
- abrt-desktop
|
|
- cups-pk-helper
|
|
- dnfdragora
|
|
- plasma-pk-updates
|
|
# Misc
|
|
- kwebkitpart
|
|
# Remove some NetworkManager plugins that pull-in lesser used VPN packages
|
|
- plasma-nm-l2tp
|
|
- plasma-nm-openswan
|
|
- plasma-nm-pptp
|
|
- plasma-nm-vpnc
|
|
# Already included in all Atomic Desktops by default
|
|
- toolbox
|
|
# Already included by default for all variants
|
|
- glibc-all-langpacks
|
|
# Pulled-in via the common set of packages
|
|
- fedora-flathub-remote
|
|
- fedora-workstation-repositories
|
|
kde-mobile:
|
|
# Already included by default for all variants
|
|
- glibc-all-langpacks
|
|
# Included explicitly in the fedora.yaml manifest
|
|
- fedora-flathub-remote
|
|
- fedora-workstation-repositories
|
|
swaywm-extended:
|
|
# Non-critical apps -> Flatpak
|
|
- mpv
|
|
# Explicitly added in common.yaml
|
|
- git-core
|
|
# Remove uncommon NetworkManager plugins
|
|
- NetworkManager-l2tp-gnome
|
|
- NetworkManager-libreswan-gnome
|
|
cosmic-desktop:
|
|
# Included explicitly in the fedora.yaml manifest
|
|
- toolbox
|
|
cosmic-desktop-apps:
|
|
# Non-critical apps -> Flatpak
|
|
- gnome-calculator
|
|
- nheko
|
|
- okular
|
|
- rhythmbox
|
|
- thunderbird
|