044e8aebdf
Merge branch 'move-kmscon-to-fedora-includes' into 'main'
...
fedora-includes: move kmscon out of the shared minimal manifest
See merge request fedora/bootc/base-images!953
2026-11-02 15:08:50 -05:00
konflux
af81260be1
Merge branch 'konflux/mintmaker/main/fedora-eln-compose-dependencies' into 'main'
...
Update quay.io/bootc-devel/fedora-bootc-eln-compose Docker tag to Fedora-eln-20261102.n.0
See merge request fedora/bootc/base-images!1035
2026-11-02 18:04:34 +00:00
de6ae2d73f
Merge branch 'bootloader-update' into 'main'
...
minimal/systemd-presets: enable bootloader-update.service on AlmaLinux
See merge request fedora/bootc/base-images!954
2026-11-02 11:15:07 -05:00
52efa394cf
Merge branch 'just-renovate' into 'main'
...
Justfile: add renovate target for on-demand Renovate runs
See merge request fedora/bootc/base-images!1012
2026-11-02 11:06:19 -05:00
Platform Engineering Bot
2331bfe2d9
Update quay.io/bootc-devel/fedora-bootc-eln-compose Docker tag to Fedora-eln-20261102.n.0
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-11-02 16:02:27 +00:00
539ab5f664
Merge branch 'bifrost-654' into 'main'
...
Regenerate CA trust on first boot and after updates
See merge request fedora/bootc/base-images!663
2026-11-02 10:57:41 -05:00
konflux
91ba6fcceb
Merge branch 'renovate/fedora-43/fedora-43-repos-image' into 'main'
...
Update Fedora 43 REPOS_IMAGE to Fedora-43-updates-20261102.0
See merge request fedora/bootc/base-images!1033
2026-11-02 14:03:36 +00:00
konflux
04f8e423de
Merge branch 'renovate/fedora-44/fedora-44-repos-image' into 'main'
...
Update Fedora 44 REPOS_IMAGE to Fedora-44-updates-20261102.0
See merge request fedora/bootc/base-images!1034
2026-11-02 14:03:20 +00:00
Platform Engineering Bot
5e3c0fe0e5
Update Fedora 44 REPOS_IMAGE to Fedora-44-updates-20261102.0
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-11-02 12:03:56 +00:00
Platform Engineering Bot
092bcc9958
Update Fedora 43 REPOS_IMAGE to Fedora-43-updates-20261102.0
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-11-02 12:03:08 +00:00
konflux
525aa07d8f
Merge branch 'renovate/fedora-43/fedora-43-repos-image' into 'main'
...
Update Fedora 43 REPOS_IMAGE to Fedora-43-updates-20261101.0
See merge request fedora/bootc/base-images!1029
2026-11-01 21:14:40 +00:00
konflux
e3f9a05a3f
Merge branch 'renovate/fedora-44/fedora-44-repos-image' into 'main'
...
Update Fedora 44 REPOS_IMAGE to Fedora-44-updates-20261101.0
See merge request fedora/bootc/base-images!1030
2026-11-01 21:14:28 +00:00
konflux
18a6a61b9f
Merge branch 'konflux/mintmaker/main/fedora-eln-compose-dependencies' into 'main'
...
Update quay.io/bootc-devel/fedora-bootc-eln-compose Docker tag to Fedora-eln-20261101.n.0
See merge request fedora/bootc/base-images!1031
2026-11-01 21:14:14 +00:00
konflux
926d4f7691
Merge branch 'renovate/fedora-rawhide/fedora-rawhide-repos-image' into 'main'
...
Update Fedora Rawhide REPOS_IMAGE to Fedora-Rawhide-20261101.n.0
See merge request fedora/bootc/base-images!1032
2026-11-01 21:14:02 +00:00
Platform Engineering Bot
3872edf9ec
Update Fedora Rawhide REPOS_IMAGE to Fedora-Rawhide-20261101.n.0
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-11-01 20:01:58 +00:00
Platform Engineering Bot
9642b1d59d
Update quay.io/bootc-devel/fedora-bootc-eln-compose Docker tag to Fedora-eln-20261101.n.0
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-11-01 16:02:00 +00:00
Platform Engineering Bot
e6a47ed1df
Update Fedora 44 REPOS_IMAGE to Fedora-44-updates-20261101.0
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-11-01 12:03:49 +00:00
Platform Engineering Bot
032649a250
Update Fedora 43 REPOS_IMAGE to Fedora-43-updates-20261101.0
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-11-01 12:03:01 +00:00
konflux
4371a011d4
Merge branch 'renovate/fedora-rawhide/fedora-rawhide-repos-image' into 'main'
...
Update Fedora Rawhide REPOS_IMAGE to a52132a
See merge request fedora/bootc/base-images!1028
2026-10-31 21:09:17 +00:00
17e44957df
minimal: Move CA trust regeneration down from standard
...
The stale trust store after an update is a property of the ostree /etc
merge, not of the standard content set. minimal already ships
ca-certificates (a hard dependency of openssl-libs), update-ca-trust and
systemd-update-done.service, so it has the same problem and everything
the unit needs. Moving the unit to minimal makes minimal-plus, standard,
ELN and IoT inherit it, and gives the image-based variants built on
minimal-plus (CoreOS, Atomic Desktops) a path to a shared fix.
The unit is unchanged. Its conditions already skip containers, images
without update-ca-trust, boots where /etc is current, and images that
carry coreos-update-ca-trust.service.
The rootfs check now runs in every tier instead of only in standard.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vcy8XfBfUtxbEWMu62CiF6
2026-10-31 16:44:10 -04:00
1d6d4f1eab
standard: Limit CA trust regeneration to first boot and updates
...
Use ConditionNeedsUpdate=/etc so the service only runs when /etc may be
stale relative to /usr: on first boot and on the first boot after a new
deployment, where ostree removes /etc/.updated. Local edits to the trust
sources still require running update-ca-trust by hand, as on any other
system. Order the unit before systemd-update-done.service, as required
for units using that condition.
Skip the unit when coreos-update-ca-trust.service is present. Fedora
CoreOS ships that unit for first boot, and update-ca-trust does not lock
its output, so both running concurrently is unsafe. The condition can be
dropped once CoreOS rebases on this image.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vcy8XfBfUtxbEWMu62CiF6
2026-10-31 16:44:10 -04:00
f803e4d4c8
standard: Order CA trust regeneration before systemd-resolved
...
systemd-resolved uses DefaultDependencies=no and orders itself before
sysinit.target, so it could start in parallel with the regeneration and
read a stale trust store for DNS-over-TLS. Order the service before it.
The ordering is ignored when systemd-resolved is not installed.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vcy8XfBfUtxbEWMu62CiF6
2026-10-31 16:44:10 -04:00
436ea4309c
standard: Focus boot-time regeneration on CA trust
...
Rename the service to atomic-update-ca-trust, remove the legacy extract argument, and defer crypto-policy regeneration. Document early-boot and initramfs limitations and keep regeneration failures visible without preventing boot.
Add standard-image regression coverage for stale bundles, vendor CA changes, local trust and distrust, repeated refreshes, and service activation.
2026-10-31 16:44:10 -04:00
71af986c08
standard: Add ca-trust and crypto-policies regeneration units
...
On bootc/ostree systems, generated config files in /etc may become
stale after an image upgrade due to the 3-way merge. Add systemd
units that regenerate the CA trust store and crypto-policies backend
files early in boot, adapted from CoreOS's approach.
See: https://redhat.atlassian.net/browse/BIFROST-654
Generated-by: AI
2026-10-31 16:44:10 -04:00
Platform Engineering Bot
a8e1d6d39a
Update Fedora Rawhide REPOS_IMAGE to a52132a
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-10-31 20:01:58 +00:00
konflux
95d73c8c10
Merge branch 'renovate/fedora-rawhide/fedora-rawhide-repos-image' into 'main'
...
Update Fedora Rawhide REPOS_IMAGE to Fedora-Rawhide-20261031.n.0
See merge request fedora/bootc/base-images!1027
2026-10-31 17:15:40 +00:00
John Eckersberg
b436a7a91f
Merge branch 'konflux/mintmaker/auto-merged-updates' into 'main'
...
Update quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta Docker digest to 4d9b0d7
See merge request fedora/bootc/base-images!1023
2026-10-31 12:59:47 -04:00
Platform Engineering Bot
50cbf36098
Update Fedora Rawhide REPOS_IMAGE to Fedora-Rawhide-20261031.n.0
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-10-31 16:02:05 +00:00
Platform Engineering Bot
baef2f71d7
Update quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta Docker digest to 4d9b0d7
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-10-31 16:01:56 +00:00
konflux
14e0bc59e4
Merge branch 'renovate/fedora-45/fedora-45-bootc-pipeline' into 'main'
...
Update Fedora 45 bootc build pipeline to 4d9b0d7
See merge request fedora/bootc/base-images!1021
2026-10-31 13:40:59 +00:00
konflux
f6513cb11c
Merge branch 'renovate/fedora-rawhide/fedora-rawhide-bootc-pipeline' into 'main'
...
Update Fedora Rawhide bootc build pipeline to 4d9b0d7
See merge request fedora/bootc/base-images!1022
2026-10-31 13:40:53 +00:00
John Eckersberg
ea77d9ba67
Merge branch 'konflux/mintmaker/main/fedora-eln-compose-dependencies' into 'main'
...
Update quay.io/bootc-devel/fedora-bootc-eln-compose Docker tag to Fedora-eln-20261031.n.0
See merge request fedora/bootc/base-images!1024
2026-10-31 09:40:40 -04:00
konflux
4341f2f325
Merge branch 'renovate/fedora-43/fedora-43-repos-image' into 'main'
...
Update Fedora 43 REPOS_IMAGE to Fedora-43-updates-20261031.0
See merge request fedora/bootc/base-images!1025
2026-10-31 13:40:25 +00:00
konflux
0feac67282
Merge branch 'renovate/fedora-44/fedora-44-repos-image' into 'main'
...
Update Fedora 44 REPOS_IMAGE to Fedora-44-updates-20261031.0
See merge request fedora/bootc/base-images!1026
2026-10-31 13:40:13 +00:00
Platform Engineering Bot
78428bfafb
Update quay.io/bootc-devel/fedora-bootc-eln-compose Docker tag to Fedora-eln-20261031.n.0
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-10-31 12:04:03 +00:00
Platform Engineering Bot
af414a08c9
Update Fedora 44 REPOS_IMAGE to Fedora-44-updates-20261031.0
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-10-31 12:03:16 +00:00
Platform Engineering Bot
a60a89c6f3
Update Fedora 43 REPOS_IMAGE to Fedora-43-updates-20261031.0
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-10-31 12:02:28 +00:00
konflux
d93fa2aab4
Merge branch 'renovate/fedora-rawhide/fedora-rawhide-repos-image' into 'main'
...
Update Fedora Rawhide REPOS_IMAGE to cfee508
See merge request fedora/bootc/base-images!1020
2026-10-31 01:14:07 +00:00
konflux
1da11a469f
Merge branch 'renovate/fedora-45/fedora-45-repos-image' into 'main'
...
Update Fedora 45 REPOS_IMAGE to 57d3209
See merge request fedora/bootc/base-images!1019
2026-10-31 01:12:04 +00:00
Platform Engineering Bot
7915c4222d
Update Fedora Rawhide REPOS_IMAGE to cfee508
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-10-31 00:03:34 +00:00
Platform Engineering Bot
a830b69fea
Update Fedora 45 REPOS_IMAGE to 57d3209
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-10-31 00:02:44 +00:00
konflux
85e89f8089
Merge branch 'renovate/fedora-rawhide/fedora-rawhide-repos-image' into 'main'
...
Update Fedora Rawhide REPOS_IMAGE to Fedora-Rawhide-20261030.n.0
See merge request fedora/bootc/base-images!1018
2026-10-30 21:24:11 +00:00
konflux
ebfb9edb05
Merge branch 'renovate/fedora-45/fedora-45-repos-image' into 'main'
...
Update Fedora 45 REPOS_IMAGE to Fedora-45-20261030.n.0
See merge request fedora/bootc/base-images!1017
2026-10-30 21:13:13 +00:00
Platform Engineering Bot
1891b04176
Update Fedora Rawhide REPOS_IMAGE to Fedora-Rawhide-20261030.n.0
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-10-30 20:02:54 +00:00
Platform Engineering Bot
55a06eab95
Update Fedora 45 REPOS_IMAGE to Fedora-45-20261030.n.0
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-10-30 20:02:06 +00:00
John Eckersberg
1666da21eb
Justfile: match MintMaker's self-hosted settings in renovate target
...
- Allow the shell executor for post-upgrade commands so
pipeline-migration-tool can expand $RENOVATE_POST_UPGRADE_COMMAND_DATA_FILE,
and match MintMaker's execution timeout.
- Set ignorePrAuthor so on-demand runs see and update the bot's MRs.
- Disable the Dependency Dashboard for on-demand runs, since Renovate
only finds dashboards created by the token's user and would otherwise
create a duplicate.
Document the Commit Status: Create token permission (needed for branch
statuses) and MR ownership caveats in CONTRIBUTING.md.
Signed-off-by: John Eckersberg <dev@eckersberg.com>
2026-10-30 15:38:44 -04:00
John Eckersberg
d18a6b69b0
Merge branch 'konflux/mintmaker/main/fedora-eln-compose-dependencies' into 'main'
...
Update quay.io/bootc-devel/fedora-bootc-eln-compose Docker tag to Fedora-eln-20261030.n.0
See merge request fedora/bootc/base-images!1007
2026-10-30 15:14:18 -04:00
konflux
4149ef6099
Merge branch 'renovate/fedora-43/fedora-43-repos-image' into 'main'
...
Update Fedora 43 REPOS_IMAGE to Fedora-43-updates-20261030.0
See merge request fedora/bootc/base-images!1015
2026-10-30 19:14:04 +00:00
konflux
a3a5157ff4
Merge branch 'renovate/fedora-44/fedora-44-repos-image' into 'main'
...
Update Fedora 44 REPOS_IMAGE to Fedora-44-updates-20261030.0
See merge request fedora/bootc/base-images!1016
2026-10-30 19:13:23 +00:00
Platform Engineering Bot
b09de5abf8
Update Fedora 44 REPOS_IMAGE to Fedora-44-updates-20261030.0
...
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
Signed-off-by: Platform Engineering Bot <platform-engineering@redhat.com>
2026-10-30 16:03:22 +00:00
