Merge branch 'dusty-update-new-fedora-version' into 'main'

docs: update RELEASE.md steps for new Fedora version

See merge request fedora/bootc/base-images!675

.gitlab-ci.yml

@@ -1,15 +1,60 @@
 ---
-include:
-  - remote: https://gitlab.com/platform-engineering-org/gitlab-ci/-/raw/main/templates/build-image.gitlab-ci.yml
+# CI for fedora-bootc base images.
+#
+# All build and test logic lives in the Justfile so that CI flows
+# are easily replicable locally: just install `just` and run the
+# same targets that CI does.
+workflow:
+  rules:
+    # Skip CI if only non-build files changed
+    - changes:
+        - renovate.json
+        - README.md
+        - LICENSE
+        - .tekton/*
+      when: never
+    - when: always
 
-build-image:
+stages:
+  - build
+
+variables:
+  BUILDER: buildah
+  JUST_VERSION: "1.49.0"
+
+.build-image:
+  stage: build
+  image: quay.io/buildah/stable:v1.42.2
+  needs: []
+  before_script:
+    # just is not packaged in the buildah image; grab a pinned static binary
+    - curl -sSfL -o /tmp/just.tar.gz "https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz"
+    - tar -xzf /tmp/just.tar.gz -C /usr/local/bin just
+
+basic-checks:
+  stage: build
+  image: quay.io/fedora/fedora:latest
+  needs: []
+  script: |
+    set -xeuo pipefail
+    dnf install -y file jq python3-yaml ShellCheck just
+    just validate
+
+# Test each tier against rawhide and the latest stable release
+build-and-test:
   extends: .build-image
   parallel:
     matrix:
-      - TIER: [tier-0, tier-1, tier-x]
-  variables:
-    EXTRA_ARGS: "--security-opt=label=disable --cap-add=all --build-arg MANIFEST=fedora-$TIER.yaml"
-  rules:
-    - if: $CI_PROJECT_NAMESPACE != "fedora/bootc"
-      when: never
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      - FEDORA_VERSION: [rawhide, "44"]
+        TIER: [minimal, minimal-plus, standard]
+  script:
+    - just test
+
+# Smoke-test older Fedora versions (standard tier, build only)
+build-fedora-version:
+  extends: .build-image
+  parallel:
+    matrix:
+      - FEDORA_VERSION: ["43"]
+  script:
+    - just build

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 ---
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.6.0
+    rev: v6.0.0
     hooks:
       - id: end-of-file-fixer
       - id: trailing-whitespace
@@ -22,6 +22,6 @@ repos:
       - id: check-json
       - id: check-yaml
   - repo: https://github.com/markdownlint/markdownlint
-    rev: v0.13.0
+    rev: v0.15.0
     hooks:
       - id: markdownlint

.tekton/fedora-bootc-43-iot-pull-request.yaml

@@ -0,0 +1,73 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-43-iot-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "iot.yaml".pathChanged() ||
+        "iot/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-iot
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-43-iot-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-iot
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-iot:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-iot

.tekton/fedora-bootc-43-iot-push.yaml

@@ -0,0 +1,70 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-43-iot-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "iot.yaml".pathChanged() ||
+        "iot/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-iot
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-43-iot-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-iot
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-iot:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-iot

.tekton/fedora-bootc-43-iot-renovate-push.yaml

@@ -0,0 +1,73 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch.startsWith("renovate/"))
+      ) && (
+        ".tekton/fedora-bootc-43-iot-renovate-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "iot.yaml".pathChanged() ||
+        "iot/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-iot
+    pipelines.appstudio.openshift.io/type: build
+    release.appstudio.openshift.io/auto-release: "false"
+  name: fedora-bootc-43-iot-renovate-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-iot
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-iot:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-iot

.tekton/fedora-bootc-43-minimal-plus-pull-request.yaml

@@ -0,0 +1,73 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-43-minimal-plus-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-minimal-plus
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-43-minimal-plus-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-minimal-plus
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-minimal-plus:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-minimal-plus

.tekton/fedora-bootc-43-minimal-plus-push.yaml

@@ -0,0 +1,70 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-43-minimal-plus-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-minimal-plus
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-43-minimal-plus-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-minimal-plus
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-minimal-plus:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-minimal-plus

.tekton/fedora-bootc-43-minimal-pull-request.yaml

@@ -0,0 +1,71 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-43-minimal-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-minimal
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-43-minimal-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-minimal
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-minimal:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-minimal

.tekton/fedora-bootc-43-minimal-push.yaml

@@ -0,0 +1,68 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-43-minimal-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-minimal
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-43-minimal-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-minimal
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-minimal:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-minimal

.tekton/fedora-bootc-43-standard-pull-request.yaml

@@ -0,0 +1,75 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-43-standard-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-standard
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-43-standard-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-standard
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-standard:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-standard

.tekton/fedora-bootc-43-standard-push.yaml

@@ -0,0 +1,72 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-43-standard-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-standard
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-43-standard-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-standard
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-standard:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-standard

.tekton/fedora-bootc-44-iot-pull-request.yaml

@@ -0,0 +1,73 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-44-iot-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "iot.yaml".pathChanged() ||
+        "iot/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-iot
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-44-iot-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-20260209.n.0@sha256:c947e0988e3f00078d3ff59eaff5ee18fe1d6fd39dc1fd15d268de0d074df45f
+    - MANIFEST=fedora-iot
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-iot:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-iot

.tekton/fedora-bootc-44-iot-push.yaml

@@ -0,0 +1,70 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-44-iot-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "iot.yaml".pathChanged() ||
+        "iot/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-iot
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-44-iot-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-20260209.n.0@sha256:c947e0988e3f00078d3ff59eaff5ee18fe1d6fd39dc1fd15d268de0d074df45f
+    - MANIFEST=fedora-iot
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-iot:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-iot

.tekton/fedora-bootc-44-minimal-plus-pull-request.yaml

@@ -0,0 +1,73 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-44-minimal-plus-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-minimal-plus
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-44-minimal-plus-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20260825.0@sha256:a927d08edf12c3d8d8299fa948bd22aefe771b54186bce85c42aa0f8fa1ebacf
+    - MANIFEST=fedora-minimal-plus
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-minimal-plus:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-minimal-plus

.tekton/fedora-bootc-44-minimal-plus-push.yaml

@@ -0,0 +1,70 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-44-minimal-plus-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-minimal-plus
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-44-minimal-plus-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20260825.0@sha256:a927d08edf12c3d8d8299fa948bd22aefe771b54186bce85c42aa0f8fa1ebacf
+    - MANIFEST=fedora-minimal-plus
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-minimal-plus:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-minimal-plus

.tekton/fedora-bootc-44-minimal-pull-request.yaml

@@ -0,0 +1,71 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-44-minimal-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-minimal
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-44-minimal-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20260825.0@sha256:a927d08edf12c3d8d8299fa948bd22aefe771b54186bce85c42aa0f8fa1ebacf
+    - MANIFEST=fedora-minimal
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-minimal:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-minimal

.tekton/fedora-bootc-44-minimal-push.yaml

@@ -0,0 +1,68 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-44-minimal-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-minimal
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-44-minimal-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20260825.0@sha256:a927d08edf12c3d8d8299fa948bd22aefe771b54186bce85c42aa0f8fa1ebacf
+    - MANIFEST=fedora-minimal
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-minimal:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-minimal

.tekton/fedora-bootc-44-standard-pull-request.yaml

@@ -0,0 +1,75 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-44-standard-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-standard
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-44-standard-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20260825.0@sha256:a927d08edf12c3d8d8299fa948bd22aefe771b54186bce85c42aa0f8fa1ebacf
+    - MANIFEST=fedora-standard
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-standard:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-standard

.tekton/fedora-bootc-44-standard-push.yaml

@@ -0,0 +1,72 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-44-standard-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-standard
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-44-standard-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20260825.0@sha256:a927d08edf12c3d8d8299fa948bd22aefe771b54186bce85c42aa0f8fa1ebacf
+    - MANIFEST=fedora-standard
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-standard:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-standard

.tekton/fedora-bootc-45-iot-pull-request.yaml

@@ -0,0 +1,73 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-45-iot-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "iot.yaml".pathChanged() ||
+        "iot/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-iot
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-45-iot-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260821.n.0@sha256:55b3460339b8c7aa0a2511e33c623310e17b16118764011059b2e8f35c5bedaf
+    - MANIFEST=fedora-iot
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-iot:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-iot

.tekton/fedora-bootc-45-iot-push.yaml

@@ -0,0 +1,70 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-45-iot-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "iot.yaml".pathChanged() ||
+        "iot/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-iot
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-45-iot-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260821.n.0@sha256:55b3460339b8c7aa0a2511e33c623310e17b16118764011059b2e8f35c5bedaf
+    - MANIFEST=fedora-iot
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-iot:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-iot

.tekton/fedora-bootc-45-minimal-plus-pull-request.yaml

@@ -0,0 +1,73 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-45-minimal-plus-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-minimal-plus
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-45-minimal-plus-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260821.n.0@sha256:55b3460339b8c7aa0a2511e33c623310e17b16118764011059b2e8f35c5bedaf
+    - MANIFEST=fedora-minimal-plus
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-minimal-plus:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-minimal-plus

.tekton/fedora-bootc-45-minimal-plus-push.yaml

@@ -0,0 +1,70 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-45-minimal-plus-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-minimal-plus
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-45-minimal-plus-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260821.n.0@sha256:55b3460339b8c7aa0a2511e33c623310e17b16118764011059b2e8f35c5bedaf
+    - MANIFEST=fedora-minimal-plus
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-minimal-plus:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-minimal-plus

.tekton/fedora-bootc-45-minimal-pull-request.yaml

@@ -0,0 +1,71 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-45-minimal-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-minimal
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-45-minimal-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260821.n.0@sha256:55b3460339b8c7aa0a2511e33c623310e17b16118764011059b2e8f35c5bedaf
+    - MANIFEST=fedora-minimal
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-minimal:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-minimal

.tekton/fedora-bootc-45-minimal-push.yaml

@@ -0,0 +1,68 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-45-minimal-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-minimal
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-45-minimal-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260821.n.0@sha256:55b3460339b8c7aa0a2511e33c623310e17b16118764011059b2e8f35c5bedaf
+    - MANIFEST=fedora-minimal
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-minimal:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-minimal

.tekton/fedora-bootc-45-standard-pull-request.yaml

@@ -0,0 +1,75 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-45-standard-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-standard
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-45-standard-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260821.n.0@sha256:55b3460339b8c7aa0a2511e33c623310e17b16118764011059b2e8f35c5bedaf
+    - MANIFEST=fedora-standard
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-standard:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-standard

.tekton/fedora-bootc-45-standard-push.yaml

@@ -0,0 +1,72 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-45-standard-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-standard
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-45-standard-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260821.n.0@sha256:55b3460339b8c7aa0a2511e33c623310e17b16118764011059b2e8f35c5bedaf
+    - MANIFEST=fedora-standard
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-standard:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-standard

.tekton/fedora-bootc-eln-standard-pull-request.yaml

@@ -0,0 +1,77 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-eln-standard-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/eln.yaml".pathChanged() ||
+        "fedora-eln.yaml".pathChanged() ||
+        "eln/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-eln
+    appstudio.openshift.io/component: fedora-bootc-eln-standard
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-eln-standard-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-eln-compose:Fedora-eln-20260802.n.0@sha256:12f9b31a07ea270b65d5869a904fd1509c56b470df6c8f2586492fc0f006f213
+    - MANIFEST=fedora-eln
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-eln-standard:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=eln
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:c587d9400c89e21225fee03a080dcb0816919d39770b6af0cd6f990c7f8404b8
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-eln-standard

.tekton/fedora-bootc-eln-standard-push.yaml

@@ -0,0 +1,74 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-eln-standard-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/eln.yaml".pathChanged() ||
+        "fedora-eln.yaml".pathChanged() ||
+        "eln/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-eln
+    appstudio.openshift.io/component: fedora-bootc-eln-standard
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-eln-standard-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-eln-compose:Fedora-eln-20260802.n.0@sha256:12f9b31a07ea270b65d5869a904fd1509c56b470df6c8f2586492fc0f006f213
+    - MANIFEST=fedora-eln
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-eln-standard:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=eln
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:c587d9400c89e21225fee03a080dcb0816919d39770b6af0cd6f990c7f8404b8
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-eln-standard

.tekton/fedora-bootc-eln-standard-renovate-push.yaml

@@ -0,0 +1,77 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch.startsWith("renovate/"))
+      ) && (
+        ".tekton/fedora-bootc-eln-standard-renovate-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/eln.yaml".pathChanged() ||
+        "fedora-eln.yaml".pathChanged() ||
+        "eln/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      ) && true == false
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-eln
+    appstudio.openshift.io/component: fedora-bootc-eln-standard
+    pipelines.appstudio.openshift.io/type: build
+    release.appstudio.openshift.io/auto-release: "false"
+  name: fedora-bootc-eln-standard-renovate-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-eln-compose:Fedora-eln-20260802.n.0@sha256:12f9b31a07ea270b65d5869a904fd1509c56b470df6c8f2586492fc0f006f213
+    - MANIFEST=fedora-eln
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-eln-standard:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=eln
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:c587d9400c89e21225fee03a080dcb0816919d39770b6af0cd6f990c7f8404b8
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-eln-standard

.tekton/fedora-bootc-rawhide-iot-pull-request.yaml

@@ -0,0 +1,73 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-rawhide-iot-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "iot.yaml".pathChanged() ||
+        "iot/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-rawhide
+    appstudio.openshift.io/component: fedora-bootc-rawhide-iot
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-rawhide-iot-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260209.n.0@sha256:a46fca7ce98fd36b5edb6ef96867de573479af69c645801cdc8c53ad6708114c
+    - MANIFEST=fedora-iot
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-iot:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-iot

.tekton/fedora-bootc-rawhide-iot-push.yaml

@@ -0,0 +1,70 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-rawhide-iot-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "iot.yaml".pathChanged() ||
+        "iot/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-rawhide
+    appstudio.openshift.io/component: fedora-bootc-rawhide-iot
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-rawhide-iot-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260209.n.0@sha256:a46fca7ce98fd36b5edb6ef96867de573479af69c645801cdc8c53ad6708114c
+    - MANIFEST=fedora-iot
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-iot:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-iot

.tekton/fedora-bootc-rawhide-minimal-plus-pull-request.yaml

@@ -0,0 +1,73 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-rawhide-minimal-plus-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-rawhide
+    appstudio.openshift.io/component: fedora-bootc-rawhide-minimal-plus
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-rawhide-minimal-plus-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260824.n.0@sha256:2bf25f551a2d4ed7291a8c1493d4c64384d060c2f193798b0d105323a37c6ba2
+    - MANIFEST=fedora-minimal-plus
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal-plus:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-minimal-plus

.tekton/fedora-bootc-rawhide-minimal-plus-push.yaml

@@ -0,0 +1,70 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-rawhide-minimal-plus-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-rawhide
+    appstudio.openshift.io/component: fedora-bootc-rawhide-minimal-plus
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-rawhide-minimal-plus-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260824.n.0@sha256:2bf25f551a2d4ed7291a8c1493d4c64384d060c2f193798b0d105323a37c6ba2
+    - MANIFEST=fedora-minimal-plus
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal-plus:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-minimal-plus

.tekton/fedora-bootc-rawhide-minimal-pull-request.yaml

@@ -0,0 +1,71 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-rawhide-minimal-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-rawhide
+    appstudio.openshift.io/component: fedora-bootc-rawhide-minimal
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-rawhide-minimal-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260824.n.0@sha256:2bf25f551a2d4ed7291a8c1493d4c64384d060c2f193798b0d105323a37c6ba2
+    - MANIFEST=fedora-minimal
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-minimal

.tekton/fedora-bootc-rawhide-minimal-push.yaml

@@ -0,0 +1,68 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-rawhide-minimal-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-rawhide
+    appstudio.openshift.io/component: fedora-bootc-rawhide-minimal
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-rawhide-minimal-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260824.n.0@sha256:2bf25f551a2d4ed7291a8c1493d4c64384d060c2f193798b0d105323a37c6ba2
+    - MANIFEST=fedora-minimal
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-minimal

.tekton/fedora-bootc-rawhide-standard-pull-request.yaml

@@ -0,0 +1,75 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-rawhide-standard-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-rawhide
+    appstudio.openshift.io/component: fedora-bootc-rawhide-standard
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-rawhide-standard-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260824.n.0@sha256:2bf25f551a2d4ed7291a8c1493d4c64384d060c2f193798b0d105323a37c6ba2
+    - MANIFEST=fedora-standard
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-standard:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-standard

.tekton/fedora-bootc-rawhide-standard-push.yaml

@@ -0,0 +1,72 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-rawhide-standard-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-rawhide
+    appstudio.openshift.io/component: fedora-bootc-rawhide-standard
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-rawhide-standard-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260824.n.0@sha256:2bf25f551a2d4ed7291a8c1493d4c64384d060c2f193798b0d105323a37c6ba2
+    - MANIFEST=fedora-standard
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-standard:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-standard

CONTRIBUTING.md

@@ -0,0 +1,37 @@
+# Contributing to fedora-bootc base images
+
+## Prerequisites
+
+Everything revolves around our Containerfile, but there's
+a high level wrapper in `Justfile` which you should use.
+So installing `podman` (or `buildah`) and `just` are strongly recommended.
+
+## Building and testing
+
+Run `just --list` to see available targets and `just show-config` to
+see current settings. The Justfile is also what CI invokes, so anything
+you run locally is the same as what runs in the pipeline.
+
+Configuration is via environment variables — see the comments at the
+top of the `Justfile` for the full list. For example:
+
+```bash
+just build                                    # defaults
+TIER=minimal just build                       # different tier
+FEDORA_VERSION=43 just test                   # different Fedora version
+BUILDER=podman just build                     # use podman instead of buildah
+just ci                                       # full CI run (validate + test all tiers)
+```
+
+## Building a split image
+
+The Containerfile supports building a split (content-based layered)
+image using [chunkah](https://github.com/coreos/chunkah) via the
+`chunked` build target:
+
+```bash
+just build --chunkah
+```
+
+Extra arguments can be passed to chunkah via the `CHUNKAH_ARGS` build
+arg (e.g. `BUILDER_EXTRA='--build-arg CHUNKAH_ARGS="--max-layers 128"' just build --chunkah`).

Containerfile

@@ -2,30 +2,75 @@
 # nested containerization, so you must build with e.g.
 # podman build --security-opt=label=disable --cap-add=all --device /dev/fuse <...>
 
-# NOTE: This container build will output a single giant layer. It is strongly recommended
-# to run the "rechunker" on the output of this build, see 
-# https://coreos.github.io/rpm-ostree/experimental-build-chunked-oci/
+# NOTE: This container build will output a single giant layer. You can either
+# run the "rechunker" on the output of this build (see bootc-base-imagectl.md),
+# or build the split version directly with `just build --chunkah`
+# (or if using podman/buildah directly, add `--build-arg FINAL=chunked
+# --skip-unused-stages=false -v $PWD:/run/src`).
 
-FROM quay.io/fedora/fedora:rawhide as repos
+# Override this repos container to control the base image package versions. For
+# example, podman build --from=quay.io/fedora/fedora:41 will get you a system
+# that uses Fedora 41 packages. Or inject arbitrary yum repos (COPR, etc) here.
+#
+# Note we also support --build-arg REPOS_IMAGE=quay.io/fedora/fedora:41 here
+# since konflux doesn't yet support --from.
+ARG REPOS_IMAGE=quay.io/fedora/fedora:rawhide
+ARG BUILDER_IMAGE=quay.io/fedora/fedora:rawhide
+# Either 'unchunked' or 'chunked'. Determines whether we take the chunkah path.
+ARG FINAL=unchunked
 
-# BOOTSTRAPPING: This can be any image that has rpm-ostree and selinux-policy-targeted.
-FROM quay.io/fedora/fedora:rawhide as builder
-RUN dnf -y install rpm-ostree selinux-policy-targeted
-ARG MANIFEST=fedora-bootc.yaml
+FROM $REPOS_IMAGE as repos
+# BOOTSTRAPPING: This can be any image that has rpm-ostree, selinux-policy-targeted
+#                and python3 (for bootc-base-imagectl).
+FROM $BUILDER_IMAGE as builder
+RUN dnf -y install rpm-ostree selinux-policy-targeted python3
+ARG MANIFEST=fedora-standard
 # The input git repository has .repo files committed to git rpm-ostree has historically
 # emphasized that.  But here, we are fetching the repos from the container base image.
 # So copy the source, and delete the hardcoded ones in git, and use the container base
 # image ones.  We can drop the ones commited to git when we hard switch to Containerfile.
 COPY . /src
+# Avoid umask/permission leakage from the outer environment; ref e.g.
+# - https://github.com/coreos/coreos-assembler/pull/4277
+# - https://gitlab.com/fedora/bootc/base-images/-/merge_requests/254
+# This invocation preserves only the executable bit, and specifically we want to remove:
+# - setuid/setgid
+# - world writability
+# NOTE: This adds world-readability, which is what we intend here as all the content
+# is public; there's no secrets in our container build.
+RUN chmod -R a=rX,u+w /src
 WORKDIR /src
 RUN rm -vf /src/*.repo
-RUN --mount=type=cache,target=/workdir \
-    --mount=type=bind,rw,from=repos,src=/,dst=/repos \
-    rpm-ostree experimental compose rootfs --cachedir=/workdir --source-root-rw=/repos ${MANIFEST} /target-rootfs
+RUN --mount=type=cache,rw,id=bootc-base-image-cache,target=/cache \
+    --mount=type=bind,rw,from=repos,src=/,dst=/repos <<EORUN
+set -xeuo pipefail
+# Put our manifests into the builder image in the same location they'll be in the
+# final image.
+./install-manifests
+# And embed the rebuild script
+install -m 0755 -t /usr/libexec ./bootc-base-imagectl
+# Verify that listing works
+/usr/libexec/bootc-base-imagectl list >/dev/null
+# Run the build script in the same way we expect custom images to do, and also
+# "re-inject" the manifests into the target, so secondary container builds can use it.
+/usr/libexec/bootc-base-imagectl build-rootfs \
+    --cachedir=/cache --reinject --manifest=${MANIFEST} /repos /target-rootfs
+EORUN
 
 # This pulls in the rootfs generated in the previous step
-FROM scratch
+FROM scratch AS unchunked
 COPY --from=builder /target-rootfs/ /
+
+FROM builder AS rechunker
+RUN dnf -y install chunkah
+ARG CHUNKAH_ARGS=""
+RUN --mount=from=unchunked,src=/,target=/chunkah,ro \
+    --mount=type=bind,target=/run/src,rw \
+    /usr/libexec/bootc-base-imagectl rechunk --chunkah ${CHUNKAH_ARGS} \
+    > /run/src/out.ociarchive
+FROM oci-archive:out.ociarchive AS chunked
+
+FROM $FINAL
 LABEL containers.bootc 1
 # This is an ad-hoc way for us to reference bootc-image-builder in
 # a way that in theory client tooling can inspect and find. Today

Justfile

@@ -0,0 +1,91 @@
+# Development entry point for fedora-bootc base images.
+# Run `just --list` to see available targets.
+# See CONTRIBUTING.md for more information.
+# --------------------------------------------------------------------
+
+# Content tier: standard (default), minimal, minimal-plus, iot
+tier := env("TIER", "standard")
+# Fedora version: rawhide (default), 43, 44, etc.
+fedora_version := env("FEDORA_VERSION", "rawhide")
+# Container build tool
+builder := env("BUILDER", "buildah")
+# Extra arguments for the builder
+builder_extra := env("BUILDER_EXTRA", "")
+# Output image name
+image := "localhost/fedora-bootc"
+
+# These are required for the nested containerization used by rpm-ostree
+# inside the Containerfile.
+priv_args := "--security-opt=label=disable --cap-add=all --device /dev/fuse"
+
+# Internal
+_build_cmd := builder + " build"
+_tag := image + if tier == "standard" { "" } else { ":" + tier }
+_base_image := "quay.io/fedora/fedora:" + fedora_version
+_version_args := if fedora_version == "rawhide" { "" } else { "--build-arg=REPOS_IMAGE=" + _base_image + " --build-arg=BUILDER_IMAGE=" + _base_image }
+_chunkah_args := "--build-arg FINAL=chunked --skip-unused-stages=false -v " + justfile_directory() + ":/run/src"
+
+# ============================================================================
+# Core targets
+# ============================================================================
+
+# Build the container image
+[group('core')]
+[arg("chunkah", long, value="true")]
+build chunkah="": _check-tier
+    {{_build_cmd}} -f Containerfile --no-cache \
+        -t {{_tag}} {{priv_args}} \
+        {{_version_args}} {{builder_extra}} \
+        {{if chunkah != "" { _chunkah_args } else { "" }}} \
+        --build-arg=MANIFEST=fedora-{{tier}} .
+
+# Build and test
+[group('core')]
+test: build
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    {{_build_cmd}} -f tests/rootfs/Dockerfile -t localhost/test --from {{_tag}} tests/rootfs
+    # The derive and sysusers tests only apply to the standard tier
+    if [ "{{tier}}" = "standard" ]; then
+        {{_build_cmd}} -f tests/Containerfile.test-derive --no-cache \
+            -t localhost/fedora-bootc-derived {{priv_args}} {{builder_extra}} tests
+        {{_build_cmd}} -f tests/Containerfile.test-sysusers --no-cache \
+            -t localhost/fedora-bootc-derived {{priv_args}} {{builder_extra}} tests
+    fi
+
+# Run validation checks (whitespace, shellcheck, YAML)
+[group('core')]
+validate:
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    ./ci/find-whitespace
+    ./ci/shellcheck
+    ./ci/validate
+
+# Show current configuration
+[group('core')]
+show-config:
+    @echo "TIER={{tier}}"
+    @echo "FEDORA_VERSION={{fedora_version}}"
+    @echo "BUILDER={{builder}}"
+    @echo "image tag={{_tag}}"
+    @echo "base image={{_base_image}}"
+
+# ============================================================================
+# CI targets (used by .gitlab-ci.yml)
+# ============================================================================
+
+# Run all CI checks: validate + build and test all tiers
+[group('ci')]
+ci: validate
+    just tier=minimal test
+    just tier=minimal-plus test
+    just tier=standard test
+
+# ============================================================================
+# Internal
+# ============================================================================
+
+[private]
+_check-tier:
+    @test -f fedora-{{tier}}.yaml || { echo "error: unknown tier '{{tier}}' (valid: standard, minimal, minimal-plus, iot)"; exit 1; }

README.md

@@ -14,67 +14,53 @@ delivery format for base operating system updates.
 The current default user experience is to build *layered* images on top of the official
 binary base images produced and tested by this project. See the documentation[5] for more info.
 
-You can build custom base images by forking this repository; however,
-https://gitlab.com/fedora/bootc/tracker/-/issues/32 tracks a more supportable
-mechanism that is not simply forking. For more information see[6].
+If you want total control over the image, you don't need to fork this repository.
+Instead, you can use the existing container as a "builder" to make new images.
+For more information, see the documentation[6].
 
-## Build process
+## Contributing
 
-Building the images in this repo can be done with `podman build`, but
-note the build process uses a special podman-ecosystem specific mechanism
-to create fully custom images while inside a `Containerfile`.
-You need to enable some privileges as nested containerization is required.
-
-```
-podman build --security-opt=label=disable --cap-add=all \
-  --device /dev/fuse -t localhost/fedora-bootc .
-```
-
-See the `Containerfile` for more details. This builds the default `tier-1` image.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the full development workflow.
 
 ## Fedora versions
 
 By default, the base images are built for Fedora rawhide. To build against a
-different Fedora version, you can override the `FROM` image used to obtain the
-Fedora repos and dnf variables. E.g.:
+different Fedora version:
 
-```
-podman build --from quay.io/fedora/fedora:41 ...
+```bash
+FEDORA_VERSION=43 just build
 ```
 
-### Deriving
+## Content sets/tiers
 
-You are of course also free to fork, customize, and build base images yourself.
-See this page[6] of the documentation for more information.
+Documentation above referenced the scratch[6] flow,
+but there is also a `minimal-plus` that is not exposed as a stable
+interface, but may be used by other images in Fedora.
 
-## Tiers
-
-At the current time, there is just one reference base image published
-to the registry. Internally the content set is split up somewhat
-into "tiers", but this is an internal implementation detail and may change
-at any time.
-
-It is planned to rework and improve this in the future, especially
-to support smaller custom images. For more on this, see
-[this tracker issue](https://gitlab.com/fedora/bootc/tracker/-/issues/32).
-
-- **tier-1**: This image is the default, what is published as
-  https://quay.io/repository/fedora/fedora-bootc
-- **tier-0**: This content set is more of a convenient centralization point for CI
-  and curation around a package set that we can all agree is the rough minimum
-  necessary for a usable system. It's not meant to be used as is, but layered
-  upon.
-- **tier-x**: This content set is the shared base used by all image-based
+- **standard**: This image is the default, what is published as
+  <https://quay.io/repository/fedora/fedora-bootc>
+- **minimal**: This content set is more of a convenient centralization point for CI
+  and curation around a package set that is intended as a starting point for
+  a container base image.
+- **minimal-plus**: This content set is intended to be the shared base used by all image-based
   Fedora variants (IoT, Atomic Desktops, and CoreOS).
-  Changes to this tier may be done without accounting for external users.
-  To build this, pass `--build-arg=MANIFEST=fedora-tier-x.yaml` to the build
-  command above.
 
-**tier-1** inherits from **tier-x** and **tier-x** in turn inherit from **tier-0**.
+**standard** inherits from **minimal-plus** and **minimal-plus** in turn inherit from **minimal**.
 
-All non-trivial changes to **tier-0** and **tier-x** should be ACKed by at least
+- **eln** (manifest `fedora-eln`): Standard base image for Enterprise Linux Next (ELN). Uses distro `fedora` and inherits from standard; built with ELN repos. The image produced by this manifest is published as **fedora-eln**.
+
+All non-trivial changes to **minimal** and **minimal-plus** should be ACKed by at least
 one stakeholder of each Fedora variant WGs.
 
+### Available Tiers + Versions
+
+> **NOTE:** The location and naming of these images is subject to change.
+
+| Version | standard | minimal | minimal-plus |
+| ------- | -------- | ------- | ------------ |
+| Rawhide | quay.io/bootc-devel/fedora-bootc-rawhide-standard | quay.io/bootc-devel/fedora-bootc-rawhide-minimal | quay.io/bootc-devel/fedora-bootc-rawhide-minimal-plus |
+| Fedora 43 | quay.io/bootc-devel/fedora-bootc-43-standard | quay.io/bootc-devel/fedora-bootc-43-minimal | quay.io/bootc-devel/fedora-bootc-43-minimal-plus |
+
 ## More information
 
 Documentation: <https://docs.fedoraproject.org/en-US/bootc/>
@@ -91,4 +77,4 @@ Documentation: <https://docs.fedoraproject.org/en-US/bootc/>
 [3]: https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit
 [4]: https://pre-commit.com/
 [5]: https://docs.fedoraproject.org/en-US/bootc/building-containers/
-[6]: https://docs.fedoraproject.org/en-US/bootc/building-custom-base/
+[6]: https://docs.fedoraproject.org/en-US/bootc/building-from-scratch/

RELEASE.md

@@ -0,0 +1,306 @@
+# Fedora Base Bootc Container Publishing
+
+## Overview
+
+The `fedora-base-bootc` image is published via **two parallel mechanisms**:
+
+1. **Pungi-IoT + cloud-image-uploader** → `quay.io/fedora/fedora-bootc` (Production)
+2. **Konflux** → `quay.io/bootc-devel/fedora-bootc-*` (Development)
+
+The goal is to move to Konflux and deprecate the Pungi-IoT mechanism.
+
+---
+
+## Part 1: Production Flow (Pungi-IoT)
+
+### Repositories
+
+| Repository | URL | Purpose |
+|------------|-----|---------|
+| base-images | https://pagure.io/fedora-iot/base-images | Image definition (treefiles, packages) |
+| pungi-iot | https://pagure.io/fedora-iot/pungi-iot | Compose configuration |
+| cloud-image-uploader | https://pagure.io/cloud-image-uploader | Uploads images to registries |
+| ansible | https://pagure.io/fedora-infra/ansible | Infrastructure deployment |
+
+### Compose Cadence
+
+| Compose | Schedule | Host |
+|---------|----------|------|
+| IoT Rawhide | **Nightly** | compose-iot01.rdu3.fedoraproject.org |
+
+### Flow
+
+```
+┌──────────────────────────────────────────────────────────────────┐
+│ 1. IoT COMPOSE (compose-iot01.rdu3.fedoraproject.org)            │
+│    Trigger: Daily cron                                           │
+│    Script: pungi-iot/nightly.sh                                  │
+│    Config: pungi-iot/fedora-iot.conf                             │
+│    Treefile: base-images/fedora-rawhide.yaml                     │
+│                                                                  │
+│    Output: /mnt/koji/compose/iot/<compose-id>/compose/           │
+│            └── <arch>/images/Fedora-base-bootc-<ver>.ociarchive  │
+└──────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼ (fedora-messaging)
+┌──────────────────────────────────────────────────────────────────┐
+│ 2. CLOUD-IMAGE-UPLOADER (OpenShift)                              │
+│                                                                  │
+│    Listens: org.fedoraproject.prod.pungi.compose.status.change   │
+│    Maps: subvariant "base" → repository "fedora-bootc"           │
+│    Pushes via skopeo to configured registries                    │
+└──────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────┐
+│ 3. CONTAINER REGISTRIES                                          │
+│                                                                  │
+│    - quay.io/fedora/fedora-bootc                                 │
+│    - registry.fedoraproject.org/fedora-bootc                     │
+└──────────────────────────────────────────────────────────────────┘
+```
+
+### Key Configuration Files
+
+#### 1. Compose: Image Build Definition
+
+**File:** `pungi-iot/fedora-iot.conf` (lines 276-300)
+
+```python
+ostree_container = {
+    "^IoT$": [
+        {
+            "config_url": "https://pagure.io/fedora-iot/base-images",
+            "config_branch": "main",
+            "treefile": "fedora-rawhide.yaml",
+            "arches": ["x86_64", "aarch64", "ppc64le", "s390x"],
+            "subvariant": "base",           # <-- Used for mapping
+            "name": "Fedora-base-bootc",
+        },
+    ]
+}
+```
+
+#### 2. Uploader: Subvariant to Repository Mapping
+
+**File:** `ansible/roles/openshift-apps/cloud-image-uploader/templates/config.toml`
+
+```toml
+[consumer_config.container.repos]
+base = "fedora-bootc"    # subvariant "base" → repo "fedora-bootc"
+IoT = "fedora-iot"
+```
+
+#### 3. Uploader: Target Registries
+
+**File:** `ansible/roles/openshift-apps/cloud-image-uploader/templates/config.toml`
+
+```toml
+[[consumer_config.container.registries]]
+url = "registry.fedoraproject.org"
+
+[[consumer_config.container.registries]]
+url = "quay.io/fedora"
+```
+
+### Tags Applied
+
+| Compose Type | Tags |
+|--------------|------|
+| Rawhide | `<version>`, `rawhide` |
+| Current Stable | `<version>`, `latest` |
+| Branched | `<version>` |
+
+### Common Changes (Production)
+
+| Task | Where to Change |
+|------|-----------------|
+| Add/remove packages from image | `base-images/` repo (manifest YAML files) |
+| Change architectures | `pungi-iot/fedora-iot.conf` → `ostree_container.arches` |
+| Add new registry | `ansible/.../cloud-image-uploader/templates/config.toml` → `registries` |
+| Change repository name | `ansible/.../cloud-image-uploader/templates/config.toml` → `repos` mapping |
+| Change tagging logic | `cloud-image-uploader/.../handler.py` |
+
+---
+
+## Part 2: Development Flow (Konflux)
+
+### Repositories
+
+| Repository | URL | Purpose |
+|------------|-----|---------|
+| compose-images | https://gitlab.com/fedora/bootc/compose-images | Generates images containing RPMs used by base-images |
+| base-images | https://gitlab.com/fedora/bootc/base-images | Image definitions + Tekton build pipelines |
+| tekton-catalog | https://gitlab.com/fedora/bootc/tekton-catalog | Release pipeline definitions |
+| tenants-config | https://gitlab.com/fedora/infrastructure/konflux/tenants-config | Konflux tenant configuration |
+
+### Flow
+
+```
+┌──────────────────────────────────────────────────────────────────────┐
+│ 0. COMPOSE IMAGES                                                    │
+│                                                                      │
+│    Source: gitlab.com/fedora/bootc/compose-images                    │
+│    Output: quay.io/bootc-devel/fedora-bootc-<version>-compose        │
+│                                                                      │
+│    These images contain the RPM repositories used by base-images.    │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│ 1. BUILD (triggered by git push or Renovate)                         │
+│                                                                      │
+│    Source: gitlab.com/fedora/bootc/base-images                       │
+│    Pipeline: .tekton/fedora-bootc-*-push.yaml                        │
+│    Input: REPOS_IMAGE from compose-images                            │
+│                                                                      │
+│    Output: quay.io/konflux-fedora/bootc-tenant/                      │
+│            fedora-bootc-<version>-<tier>:{{revision}}                │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼ (Konflux creates Snapshot)
+┌──────────────────────────────────────────────────────────────────────┐
+│ 2. RELEASE (auto-triggered by ReleasePlan)                           │
+│                                                                      │
+│    ReleasePlan: release-fedora-bootc-to-quay-io                      │
+│    Pipeline: push-to-external-registry                               │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│ 3. OUTPUT                                                            │
+│                                                                      │
+│    quay.io/bootc-devel/fedora-bootc-<version>-standard               │
+│    quay.io/bootc-devel/fedora-bootc-<version>-minimal                │
+│    quay.io/bootc-devel/fedora-bootc-<version>-minimal-plus           │
+│    quay.io/bootc-devel/fedora-bootc-<version>-iot                    │
+└──────────────────────────────────────────────────────────────────────┘
+```
+
+### Image Tiers
+
+See the [README](README.md) for details on the different image tiers (minimal, minimal-plus, standard, iot).
+
+### Renovate Automation
+
+Renovate automatically updates dependencies. See the description comments in [renovate.json](renovate.json) for scheduling and configuration details.
+
+### Common Changes (Development)
+
+| Task | Where to Change |
+|------|-----------------|
+| Add new component | `tenants-config/.../components/` |
+| Change destination registry | `tenants-config/.../releaseplans/release-to-quay-io/` |
+| Modify release pipeline | `tekton-catalog/pipelines/push-to-external-registry/` |
+| Add new Fedora version | See [Adding a New Fedora Version](#adding-a-new-fedora-version-to-konflux) |
+| Remove EOL Fedora version | See [Removing an EOL Fedora Version](#removing-an-eol-fedora-version-from-konflux) |
+
+---
+
+## Part 3: Managing Fedora Versions in Konflux
+
+This section describes how to add a new Fedora version or remove an EOL version from Konflux.
+
+**Example scenario:** Fedora 42 is going EOL and needs to be removed. Rawhide (F45) is branching, so we need to add Fedora 44 as the new branched release.
+
+### Adding a New Fedora Version to Konflux
+
+#### Step 1: Add Release to compose-images Repo
+
+**Repository:** https://gitlab.com/fedora/bootc/compose-images
+
+Add the new release definition so that compose images are generated for the new version. This must be done first as base-images depends on these compose images.
+
+1. Create new Tekton pipelines in `.tekton/` for the new version (copy from existing version)
+2. Update `RELEASEVER`, `COMPOSE_BRANCHED`, and labels in the new pipelines
+3. Add a package rule for the new version in `renovate.json`
+
+See [MR !187](https://gitlab.com/fedora/bootc/compose-images/-/merge_requests/187) for reference (F44 addition).
+
+#### Step 2: Create Tekton Pipelines (base-images repo)
+
+**Repository:** https://gitlab.com/fedora/bootc/base-images
+
+Copy the current release pipelines to the new version and update rawhide for the next version.
+
+See the code snippets used for F44 in [MR !363 comment](https://gitlab.com/fedora/bootc/base-images/-/merge_requests/363#note_3071603283) for reference.
+
+#### Step 3: Update Renovate Configuration (base-images repo)
+
+Add package rules for the new version in `renovate.json`. See the existing rules for other versions as a template.
+
+#### Step 4: Create Tenant Configuration (tenants-config repo)
+
+**Repository:** https://gitlab.com/fedora/infrastructure/konflux/tenants-config
+
+```bash
+cd clusters/kflux-fedora-01/tenants/bootc-tenant/applications/fedora-bootc/
+NEW_RELEASE=44
+
+# Copy from rawhide
+cp -r rawhide $NEW_RELEASE
+
+# Update version references
+sed -i "s/compose-rawhide-id/compose-branched-id/" $NEW_RELEASE/releaseplans/release-to-quay-io/kustomization.yaml
+find "${NEW_RELEASE}/" -type f | xargs sed -i "s/rawhide/$NEW_RELEASE/g"
+```
+
+
+Add the new version to `fedora-bootc/kustomization.yaml`:
+
+```yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - "rawhide"
+  - "44"      # <-- Add new version
+  - "43"
+  - "42"
+```
+
+See [MR !237](https://gitlab.com/fedora/infrastructure/konflux/tenants-config/-/merge_requests/237) for reference (F45 addition).
+
+### Removing an EOL Fedora Version from Konflux
+
+When a Fedora version reaches EOL (e.g., F42), follow these steps:
+
+#### Step 1: Remove Tekton Pipelines (base-images repo)
+
+**Repository:** https://gitlab.com/fedora/bootc/base-images
+
+```bash
+cd .tekton/
+git rm fedora-bootc-42-*.yaml
+```
+
+#### Step 2: Remove Renovate Rules (base-images repo)
+
+Remove the package rules for F42 from `renovate.json` (the two blocks matching `fedora-bootc-42-*`).
+
+#### Step 3: Remove Tenant Configuration (tenants-config repo)
+
+**Repository:** https://gitlab.com/fedora/infrastructure/konflux/tenants-config
+
+Remove the version from `fedora-bootc/kustomization.yaml` and delete the directory:
+
+```bash
+cd cluster/kfluxfedorap01/bootc-tenant/applications/fedora-bootc/
+
+# Edit kustomization.yaml to remove "42" from resources
+
+# Delete the version directory
+rm -rf 42/
+```
+
+#### Step 4: Remove from compose-images Repo
+
+**Repository:** https://gitlab.com/fedora/bootc/compose-images
+
+Remove the EOL release pipelines and renovate rules:
+
+```bash
+cd .tekton/
+git rm fedora-bootc-42-compose-*.yaml
+```
+
+Also remove the package rule for F42 from `renovate.json` (the block matching `fedora-42-.*-compose`).

bootc-base-imagectl

@@ -0,0 +1,237 @@
+#!/usr/bin/env python3
+
+import argparse
+import json
+import os
+import os.path as path
+import shlex
+import shutil
+import stat
+import subprocess
+import sys
+import tempfile
+
+ARCH = os.uname().machine
+MANIFESTDIR = 'usr/share/doc/bootc-base-imagectl/manifests'
+
+def run_build_rootfs(args):
+    """
+    Regenerates a base image using a build configuration.
+    """
+    target = args.target
+    for fn in [f'{args.manifest}.yaml', f'{args.manifest}.hidden.yaml']:
+        manifest_path = f'/{MANIFESTDIR}/{fn}'
+        if os.path.exists(manifest_path):
+            break
+    else:
+        raise Exception(f"manifest not found: {args.manifest}")
+
+    # A fix for https://issues.redhat.com/browse/RHEL-108989
+    subprocess.check_call(['dnf', 'repolist'], stdout=subprocess.DEVNULL)
+
+    rpmostree_argv = ['rpm-ostree', 'compose', 'rootfs']
+
+    override_manifest = {}
+    tmp_ostree_repo = None
+    if args.install:
+        additional_pkgs = [shlex.quote(p) for p in set(args.install)]
+        if len(additional_pkgs) > 0:
+            override_manifest['packages'] = list(additional_pkgs)
+    if args.exclude:
+        exclude_pkgs = [shlex.quote(p) for p in set(args.exclude)]
+        if len(exclude_pkgs) > 0:
+            override_manifest['exclude-packages'] = list(exclude_pkgs)
+    if args.add_dir:
+        tmp_ostree_repo = tempfile.mkdtemp(dir='/var/tmp')
+        subprocess.check_call(['ostree', 'init', '--repo', tmp_ostree_repo, '--mode=bare'])
+        rpmostree_argv.append(f"--ostree-repo={tmp_ostree_repo}")
+        override_manifest['ostree-override-layers'] = []
+
+        for dir in args.add_dir:
+            print(f"Processing --add-dir for {dir}")
+            base = os.path.basename(dir)
+            abs = os.path.realpath(dir)
+            if not os.path.exists(abs):
+                raise Exception(f"add dir directory not found: {abs}")
+            # capture output to hide commit digest printed
+            subprocess.check_output(['ostree', 'commit', '--repo', tmp_ostree_repo, '-b', f'overlay/{base}', abs,
+                                     '--owner-uid=0', '--owner-gid=0', '--no-xattrs', '--mode-ro-executables'])
+            override_manifest['ostree-override-layers'].append(f'overlay/{base}')
+    if args.no_docs:
+        override_manifest['documentation'] = False
+    if args.recommends:
+        override_manifest['recommends'] = True
+    if args.no_initramfs:
+        override_manifest['no-initramfs'] = True
+    if args.sysusers:
+        override_manifest['sysusers'] = 'compose-forced'
+        passwd_mode = 'nobody' if args.nobody_99 else 'none'
+        override_manifest['variables'] = {'passwd_mode': passwd_mode}
+    if args.repo:
+        override_manifest['repos'] = args.repo
+
+    tmp_manifest = None
+    if override_manifest:
+        override_manifest['include'] = manifest_path
+        tmp_manifest = tempfile.NamedTemporaryFile(mode='w', encoding='utf-8', suffix='.json', delete=False)
+        json.dump(override_manifest, tmp_manifest)
+        tmp_manifest.close()
+        manifest_path = tmp_manifest.name
+
+    tmp_lockfile = None
+    if args.lock:
+        lockfile = {'packages': {}}
+        for nevra in args.lock:
+            # we support passing either a NEVRA or a NEVR
+            name, ev, r_or_ra = nevra.rsplit('-', 2)
+            evr_or_evra = f'{ev}-{r_or_ra}'
+            field = 'evra' if r_or_ra.endswith(('.noarch', f'.{ARCH}')) else 'evr'
+            lockfile['packages'][name] = {field: evr_or_evra}
+
+        tmp_lockfile = tempfile.NamedTemporaryFile(mode='w', encoding='utf-8', suffix='.json', delete=False)
+        json.dump(lockfile, tmp_lockfile)
+        tmp_lockfile.close()
+        rpmostree_argv.append(f"--lockfile={tmp_lockfile.name}")
+
+    try:
+        if args.cachedir != "":
+            rpmostree_argv.append(f"--cachedir={args.cachedir}")
+        # Assume we can mutate alternative roots
+        if args.source_root != '/':
+            rpmostree_argv.append(f'--source-root-rw={args.source_root}')
+        else:
+            # But we shouldn't need to mutate the default root
+            rpmostree_argv.append('--source-root=/')
+        rpmostree_argv.extend([manifest_path, target])
+        # Perform the build
+        subprocess.run(rpmostree_argv, check=True)
+        # Work around https://github.com/coreos/rpm-ostree/pull/5322
+        root_mode = os.lstat(target).st_mode
+        if (root_mode & stat.S_IXOTH) == 0:
+            print("Updating rootfs mode")
+            os.chmod(target, root_mode | (0o555))
+        # And run the bootc linter for good measure
+        subprocess.run([
+            'bootc',
+            'container',
+            'lint',
+            f'--rootfs={target}',
+        ], check=True)
+    except subprocess.CalledProcessError as e:
+        print(f"Error executing command: {e}")
+        sys.exit(1)
+    finally:
+        if tmp_lockfile is not None:
+            os.unlink(tmp_lockfile.name)
+        if tmp_manifest is not None:
+            os.unlink(tmp_manifest.name)
+        if tmp_ostree_repo:
+            shutil.rmtree(tmp_ostree_repo)
+
+    # Copy our own build configuration into the target if configured;
+    # this is used for the first stage build. But by default *secondary*
+    # builds don't get this.
+    if args.reinject:
+        for d in [MANIFESTDIR]:
+            dst = path.join(target, d)
+            print(f"Copying /{d} to {dst}")
+            shutil.copytree('/' + d, dst, symlinks=True)
+        for f in ['usr/libexec/bootc-base-imagectl']:
+            dst = path.join(target, f)
+            print(f"Copying /{f} to {dst}")
+            shutil.copy('/' + f, dst)
+
+def run_rechunk(args):
+    if args.chunkah:
+        argv = ['chunkah', 'build', '--rootfs=/chunkah']
+        if args.max_layers is not None:
+            argv.append(f"--max-layers={args.max_layers}")
+        # Strip OSTree data and labels for bootc compatibility; see
+        # https://github.com/coreos/chunkah#compatibility-with-bootable-bootc-images
+        argv.extend(['--prune', '/sysroot/',
+                '--label', 'ostree.commit-',
+                '--label', 'ostree.final-diffid-'])
+        try:
+            subprocess.run(argv, check=True)
+        except subprocess.CalledProcessError as e:
+            print(f"Error executing command: {e}", file=sys.stderr)
+            sys.exit(1)
+    else:
+        if not args.from_image or not args.to_image:
+            print("Error: from_image and to_image are required when not using --chunkah", file=sys.stderr)
+            sys.exit(1)
+        argv = [
+                'rpm-ostree',
+                'experimental',
+                'compose',
+                'build-chunked-oci']
+        if args.max_layers is not None:
+            argv.append(f"--max-layers={args.max_layers}")
+        argv.extend(['--bootc',
+                '--format-version=1',
+                f'--from={args.from_image}',
+                f'--output=containers-storage:{args.to_image}'])
+        try:
+            subprocess.run(argv, check=True)
+        except subprocess.CalledProcessError as e:
+            print(f"Error executing command: {e}")
+            sys.exit(1)
+
+def run_list(args):
+    d = '/' + MANIFESTDIR
+    for ent in sorted(os.listdir(d)):
+        name, ext = os.path.splitext(ent)
+        if ext != '.yaml' or name.endswith('.hidden'):
+            continue
+        fullpath = os.path.join(d, ent)
+        if os.path.islink(fullpath):
+            continue
+        o = subprocess.check_output(['rpm-ostree', 'compose', 'tree', '--print-only', fullpath])
+        manifest = json.loads(o)
+        description = manifest['metadata']['summary']
+        print(f"{name}: {description}")
+        print("---")
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Operate on the build configuration for this container")
+    parser.add_argument("--args-file", help="File containing arguments to parse (one argument per line)", metavar='FILE')
+    subparsers = parser.add_subparsers(help='Subcommands', required=True)
+
+    build_rootfs = subparsers.add_parser('build-rootfs', help='Generate a container root filesystem')
+    build_rootfs.add_argument("--reinject", help="Also reinject the build configurations into the target", action='store_true')
+    build_rootfs.add_argument("--manifest", help="Use the specified manifest", action='store', default='default')
+    build_rootfs.add_argument("--install", help="Add a package", action='append', default=[], metavar='PACKAGE')
+    build_rootfs.add_argument("--exclude", help="Exclude a package", action='append', default=[], metavar='PACKAGE')
+    build_rootfs.add_argument("--cachedir", help="Cache repo metadata and RPMs in specified directory", action='store', default='')
+    build_rootfs.add_argument("--add-dir", help='Copy dir contents into the target', action='append', default=[], metavar='DIR')
+    build_rootfs.add_argument("--no-docs", help="Don't install documentation", action='store_true')
+    build_rootfs.add_argument("--recommends", help="Whether to install recommended packages", action='store_true')
+    build_rootfs.add_argument("--no-initramfs", help="Whether to generate an initramfs for the roots", action='store_true')
+    build_rootfs.add_argument("--sysusers", help="Run systemd-sysusers instead of injecting hardcoded passwd/group entries", action='store_true')
+    build_rootfs.add_argument("--nobody-99", help=argparse.SUPPRESS, action='store_true')
+    build_rootfs.add_argument("--repo", help="Enable specific repositories only", action='append', default=[], metavar='REPO')
+    build_rootfs.add_argument("--lock", help="Lock package to specific version; can be NEVRA or NEVR", action='append', default=[], metavar='NEVRA')
+    build_rootfs.add_argument("source_root", help="Path to the source root directory used for dnf configuration (default=/)", nargs='?', default='/')
+    build_rootfs.add_argument("target", help="Path to the target root directory that will be generated.")
+    build_rootfs.set_defaults(func=run_build_rootfs)
+
+    cmd_rechunk = subparsers.add_parser('rechunk', help="Generate a new container image with split, reproducible, chunked layers")
+    cmd_rechunk.add_argument("--chunkah", help="Use chunkah instead of rpm-ostree (reads rootfs from /chunkah, writes OCI archive to stdout)", action='store_true')
+    cmd_rechunk.add_argument("--max-layers", help="Configure the number of output layers")
+    cmd_rechunk.add_argument("from_image", help="Operate on this image in the container storage", nargs='?')
+    cmd_rechunk.add_argument("to_image", help="Output a new image to the container storage", nargs='?')
+    cmd_rechunk.set_defaults(func=run_rechunk)
+
+    cmd_list = subparsers.add_parser('list', help='List available manifests')
+    cmd_list.set_defaults(func=run_list)
+
+    args = parser.parse_args()
+    if args.args_file:
+        add_args = []
+        with open(args.args_file) as f:
+            for line in f:
+                add_args += [line.strip()]
+        args = parser.parse_args(sys.argv[1:] + add_args)
+
+    args.func(args)
+

bootc-base-imagectl.md

@@ -0,0 +1,182 @@
+# bootc-base-imagectl
+
+A core premise of the bootc model is that rich
+control over Linux system customization can be accomplished
+with a "default" container build:
+
+```
+FROM <base image>
+RUN ...
+```
+
+As of recently, it is possible to e.g. swap the kernel
+and other fundamental components as part of default derivation.
+
+However, some use cases want even more control - for example,
+as an organization deploying a bootc system, I may want to ensure
+the base image version carries a set of packages at
+exactly specific versions (perhaps defined by a lockfile,
+or an rpm-md repository). There are many tools which
+manage snapshots of yum (rpm-md) repositories.
+
+There are currently issues where it won't quite work to e.g.
+`dnf -y upgrade selinux-policy-targeted`.
+
+The `/usr/libexec/bootc-base-imagectl` tool which is
+included in the base image is designed to enable building
+a root filesystem in ostree-container format from a set
+of RPMs controlled by the user.
+
+## Understanding the base image content
+
+Most, but not all content from the base image comes from RPMs.
+There is some additional non-RPM content, as well as postprocessing
+that operates on the filesystem root. At the current time the
+implementation of the base image build uses `rpm-ostree`,
+but this is considered an implementation detail subject to change.
+
+## Using bootc-base-imagectl build-rootfs
+
+The core operation is `bootc-base-imagectl build-rootfs`.
+
+This command takes just two arguments:
+
+- A "source root" which should have an `/etc/yum.repos.d`
+  that defines the input RPM content. This source root is also used
+  to control things like the `$releasever`.
+- A path to the target root filesystem which will be generated as
+  a directory. The target should not already exist (but its parent must exist).
+
+### Implementation
+
+The current implementation uses `rpm-ostree` on a manifest (treefile)
+embedded in the container image itself. These manifests are not intended
+to be editable directly.
+
+To emphasize: the implementation of this command (especially the configuration
+files that it reads) are subject to change.
+
+## Using bootc-base-imagectl rechunk
+
+This operation is strongly related to `build-rootfs` but is also orthogonal;
+it can be used on a "regular" container build as well.
+
+This command assumes it will be run as a container image, and defaults
+to wanting write access to the container storage.
+
+```
+podman run --rm --privileged -v /var/lib/containers:/var/lib/containers quay.io/fedora/fedora-bootc:rawhide \
+  bootc-base-imagectl rechunk quay.io/exampleos/exampleos:build quay.io/exampleos/exampleos:latest
+```
+
+### Rationale
+
+When performing a complex container derivation, there are several issues:
+
+#### Replaced duplicate content
+
+When e.g. upgrading or replacing the kernel or other large packages
+as part of a container build (without squashing all layers) then
+the old replaced content will still be present.
+
+#### Removed content still present
+
+Similarly, `RUN dnf -y remove` etc. will still retain that removed
+content in prior layers.
+
+#### Timestamp drift
+
+By default, many tools will use the current timestamp when writing
+files. `rpm` will do this (unless `SOURCE_DATE_EPOCH` is set), and
+other tools like `cp` and `curl` will as well.
+
+This means that every build of the image will produce a new
+tar stream (with new timestamps) - that will get pushed to a registry
+and downloaded by clients, even if the content didn't actually change.
+
+### What rechunk does: split reproducible chunked images
+
+The `bootc-base-imagectl rechunk` command fixes all of these issues
+by taking an input container, operates on its final merged filesystem
+tree (hence removed/overridden files are handled), and then splits it up
+(currently based on the RPM database) into separate layers (tarballs).
+
+Further, because bootc uses OSTree today, and OSTree canonializes all timestamps
+to zero on the client side, this tool does that at build time.
+
+### Using chunkah instead of rpm-ostree
+
+The `--chunkah` flag switches rechunk to use [chunkah] instead of
+rpm-ostree for layer splitting. In this mode, chunkah reads the rootfs
+from `/chunkah` (its default) and writes an OCI archive to stdout.
+The `from_image` and `to_image` positional arguments are not used.
+The `--max-layers` option is respected and passed through to chunkah.
+
+This mode automatically passes `--prune /sysroot/` to strip OSTree data
+and `--label ostree.commit-` / `--label ostree.final-diffid-` to remove
+OSTree-specific labels. In other words, this produces plain OCI bootc images
+without any OSTree content.
+
+To rechunk an existing image using chunkah:
+
+```
+IMG=quay.io/exampleos/exampleos:latest
+podman run --rm --mount=type=image,src=$IMG,dest=/chunkah \
+  -e CHUNKAH_CONFIG_STR="$(podman inspect $IMG)" \
+  quay.io/fedora/fedora-bootc:rawhide \
+  /usr/libexec/bootc-base-imagectl rechunk --chunkah | podman load
+```
+
+The `CHUNKAH_CONFIG_STR` environment variable passes the original
+image's metadata (labels, environment, command, etc.) to chunkah so
+that it is retained in the rechunked output.
+
+[chunkah]: https://github.com/coreos/chunkah
+
+### Other options
+
+`bootc-base-imagectl list` will enumerate available configurations that
+can be selected by passing `--manifest` to `build-rootfs`.
+
+### Implementation
+
+The default rechunking implementation also uses `rpm-ostree`. The `--chunkah`
+mode uses [chunkah] instead, which is content-agnostic and not tied to
+rpm-ostree.
+
+### Cross builds and the builder image
+
+The build tooling is designed to support "cross builds"; the
+repository root could e.g. be CentOS Stream 10, while the
+builder root is Fedora or RHEL, etc.
+
+In other words, one given base image can be used as a "builder" to produce another
+using different RPMs.
+
+### Example: Generate a new image using CentOS Stream 10 content from RHEL
+
+FROM quay.io/centos/centos:stream10 as repos
+
+FROM registry.redhat.io/rhel10/rhel-bootc:10 as builder
+RUN --mount=type=bind,from=repos,src=/,dst=/repos,rw /usr/libexec/bootc-base-imagectl build-rootfs --manifest=minimal /repos /target-rootfs
+
+# This container image uses the "artifact pattern"; it has some
+# basic configuration we expect to apply to multiple container images.
+FROM quay.io/exampleos/baseconfig@sha256:.... as baseconfig
+
+FROM scratch
+COPY --from=builder /target-rootfs/ /
+# Now we make other arbitrary changes. Copy our systemd units and
+# other tweaks from the baseconfig container image.
+COPY --from=baseconfig /usr/ /usr/
+RUN <<EORUN
+set -xeuo pipefail
+# Install critical components
+dnf -y install linux-firmware NetworkManager cloud-init cowsay
+dnf clean all
+bootc container lint
+EORUN
+LABEL containers.bootc 1
+ENV container=oci
+STOPSIGNAL SIGRTMIN+3
+CMD ["/sbin/init"]

ci/find-whitespace

@@ -0,0 +1,65 @@
+#!/bin/bash
+
+set -euo pipefail
+
+main() {
+
+    local files_with_whitespace=""
+    local files_with_missing_empty_line_at_eof=""
+
+    while IFS= read -r -d '' f; do
+        echo "[+] Checking ${f}"
+
+        # Looking for whitespace at end of line
+        if grep -Eq " +$" "${f}"; then
+            # List of files to ignore
+            if \
+                [[ "${f}" == "./live/isolinux/boot.msg" ]] \
+                ; then
+                echo "[+] Checking ${f}: Ignoring whitespace at end of line"
+            else
+                echo "[+] Checking ${f}: Found whitespace at end of line"
+                files_with_whitespace+=" ${f}"
+            fi
+        fi
+
+        # Looking for missing empty line at end of file
+        if [[ -n $(tail -c 1 "${f}") ]]; then
+            # List of files to ignore
+            if \
+                [[ "${f}" == "./tests/kola/ignition/resource/authenticated-gs/data/expected/"* ]] ||\
+                [[ "${f}" == "./tests/kola/ignition/resource/authenticated-s3/data/expected/"* ]] ||\
+                [[ "${f}" == "./tests/kola/ignition/resource/remote/data/expected/"* ]] \
+                ; then
+                echo "[+] Checking ${f}: Ignoring missing empty line at end of file"
+            else
+                echo "[+] Checking ${f}: Missing empty line at end of file"
+                files_with_missing_empty_line_at_eof+=" ${f}"
+            fi
+        fi
+    done< <(find . -path "./.git" -prune -o -type f -print0)
+
+    echo ""
+    if [[ -n "${files_with_whitespace}" ]]; then
+        echo "[+] Found files with whitespace at the end of line"
+        echo "${files_with_whitespace}" | tr ' ' '\n'
+    else
+        echo "[+] No files with whitespace at the end of line"
+    fi
+
+    echo ""
+    if [[ -n "${files_with_missing_empty_line_at_eof}" ]]; then
+        echo "[+] Found files with missing empty line at end of file"
+        echo "${files_with_missing_empty_line_at_eof}" | tr ' ' '\n'
+    else
+        echo "[+] No files with missing empty line at end of file"
+    fi
+
+    if [[ -n "${files_with_whitespace}" ]] || [[ -n "${files_with_missing_empty_line_at_eof}" ]]; then
+        exit 1
+    fi
+
+    exit 0
+}
+
+main "${@}"

ci/shellcheck

@@ -0,0 +1,35 @@
+#!/bin/bash
+# Template generated by https://github.com/coreos/repo-templates; do not edit downstream
+
+set -euo pipefail
+
+main() {
+    local found_errors="false"
+    # Let's start with error, then we can do warning, info, style
+    local -r severity="error"
+
+    while IFS= read -r -d '' f; do
+        # Skip non-text files that are very unlikely to be shell scripts
+        if [[ "$(file -b --mime-type "${f}" | sed 's|/.*||')" != "text" ]]; then
+            continue
+        fi
+        shebang="$(head -1 "${f}")"
+        if [[ "${f}" == *.sh ]] || \
+            [[ ${shebang} =~ ^#!/.*/bash.* ]] || \
+            [[ ${shebang} =~ ^#!/.*/env\ bash ]]; then
+            echo "[+] Checking ${f}"
+            shellcheck --external-sources --shell bash --severity="${severity}" "${f}" || found_errors="true"
+            bash -n "${f}" || found_errors="true"
+        fi
+    done< <(find . -path "./.git" -prune -o -path "./vendor" -prune -o -type f -print0)
+
+    if [[ "${found_errors}" != "false" ]]; then
+        echo "[+] Found errors with ShellCheck"
+        exit 1
+    fi
+
+    echo "[+] No error found with ShellCheck"
+    exit 0
+}
+
+main "${@}"

ci/validate

@@ -0,0 +1,71 @@
+#!/usr/bin/python3
+# Validate basic syntax of shell script and yaml.
+
+import os
+import re
+import stat
+import subprocess
+import yaml
+
+INITRD_SERVICES_WITHOUT_BEFORE = {
+    # Depended on by other services
+    'coreos-livepxe-rootfs.service',
+}
+
+validated=0
+
+def openat(dirfd, name, mode='r'):
+    def opener(path, flags):
+        return os.open(path, flags, dir_fd=dirfd)
+    return open(name, mode, opener=opener)
+
+
+def validate_initrd_service(rootfd, name):
+    with openat(rootfd, name) as fh:
+        if ([l for l in fh.readlines() if l.startswith('Before=')] or
+                name in INITRD_SERVICES_WITHOUT_BEFORE):
+            global validated
+            validated += 1
+        else:
+            raise Exception(
+                f'{name} has no Before= and may race with switch-root'
+            )
+
+
+BASH_UNBRACKETED_IF = re.compile(r'\sif\s+"?\$')
+def validate_shell(rootfd, name):
+    subprocess.check_call(['bash', '-n', name], preexec_fn=lambda: os.fchdir(rootfd))
+    with openat(rootfd, name) as fh:
+        if BASH_UNBRACKETED_IF.search(fh.read()):
+            raise Exception(f'Possible unbracketed conditional in {name}')
+    global validated
+    validated +=1
+
+
+for root, dirs, files, rootfd in os.fwalk('.'):
+    # Skip .git
+    if '.git' in dirs:
+        dirs.remove('.git')
+    for name in files:
+        print(f"[+] Looking at {name}")
+        if name.endswith(('.yaml', '.yml')):
+            with open(os.open(name, dir_fd=rootfd, flags=os.O_RDONLY)) as f:
+                yaml.safe_load(f)
+                validated +=1
+            continue
+        elif name.endswith('.sh'):
+            validate_shell(rootfd, name)
+            continue
+        elif 'dracut/modules.d' in root and name.endswith('.service'):
+            validate_initrd_service(rootfd, name)
+        stbuf = os.lstat(name, dir_fd=rootfd)
+        if not stat.S_ISREG(stbuf.st_mode):
+            continue
+        if not stbuf.st_mode & stat.S_IXUSR:
+            continue
+        mimetype = subprocess.check_output(['file', '-b', '--mime-type', name], encoding='UTF-8',
+                                        preexec_fn=lambda: os.fchdir(rootfd)).strip()
+        if mimetype == 'text/x-shellscript':
+            validate_shell(rootfd, name)
+
+print(f"Validated {validated} files")

eln.yaml

@@ -0,0 +1 @@
+fedora-eln.yaml

eln/20-rhel.toml

@@ -0,0 +1,2 @@
+[install]
+root-fs-type = "xfs"

eln/bootc-install.yaml

@@ -0,0 +1,3 @@
+add-files:
+  - - 20-rhel.toml
+    - /usr/lib/bootc/install/20-rhel.toml

eln/manifest.yaml

@@ -0,0 +1,9 @@
+metadata:
+  summary: |
+    Standard bootc base image for Enterprise Linux Next (ELN).
+    This manifest is the source for the image published as fedora-eln.
+    ELN is the Fedora package set (rawhide sources, ELN buildroot/compose).
+
+include:
+  - ../standard/manifest.yaml
+  - bootc-install.yaml

fedora-43.yaml

@@ -1,6 +1,6 @@
 # NB: This treefile is used by the legacy pungi path only to build tier-1. It
 # will be removed in the future.
-releasever: 40
+releasever: 43
 repos:
   - fedora
   - fedora-updates

fedora-44.yaml

@@ -0,0 +1,7 @@
+# NB: This treefile is used by the legacy pungi path only to build tier-1. It
+# will be removed in the future.
+releasever: 44
+repos:
+  - fedora
+  - fedora-updates
+include: fedora-bootc.yaml

fedora-45.yaml

@@ -1,6 +1,6 @@
 # NB: This treefile is used by the legacy pungi path only to build tier-1. It
 # will be removed in the future.
-releasever: 42
+releasever: 45
 repos:
   - fedora-devel
 include: fedora-bootc.yaml

fedora-bootc.yaml

@@ -1,8 +0,0 @@
-metadata:
-  name: fedora-boot-tier1
-  summary: Fedora Bootable Tier 1
-
-include:
-  - fedora-generic.yaml
-  - tier-1/manifest.yaml
-  - tier-1/kernel.yaml

fedora-bootc.yaml

@@ -0,0 +1 @@
+fedora-standard.yaml

fedora-eln.yaml

@@ -0,0 +1,6 @@
+repos:
+  - eln-baseos
+  - eln-appstream
+include:
+  - fedora-includes/eln.yaml
+  - eln/manifest.yaml

fedora-includes/eln.yaml

@@ -0,0 +1,7 @@
+# ELN uses the same distro variable as Fedora: ELN is a compose of Fedora
+# Rawhide sources (see docs.fedoraproject.org/en-US/eln/). Repos come from
+# REPOS_IMAGE at build time; we do not add fedora-repos-archive here.
+variables:
+  distro: "fedora"
+
+packages: []

fedora-iot.yaml

@@ -0,0 +1 @@
+iot.yaml

fedora-minimal-plus.yaml

@@ -0,0 +1 @@
+minimal-plus.hidden.yaml

fedora-minimal.yaml

@@ -0,0 +1 @@
+minimal.yaml

fedora-standard.yaml

@@ -0,0 +1 @@
+standard.yaml

fedora-tier-0.yaml

@@ -1,8 +0,0 @@
-metadata:
-  name: fedora-boot-tier0
-  summary: Fedora Bootable Tier 0
-
-include:
-  - fedora-generic.yaml
-  - tier-0/manifest.yaml
-  - tier-0/kernel.yaml

fedora-tier-1.yaml

@@ -1 +0,0 @@
-fedora-bootc.yaml

fedora-tier-x.yaml

@@ -1,8 +0,0 @@
-metadata:
-  name: fedora-boot-tier-x
-  summary: Fedora Bootable Tier X
-
-include:
-  - fedora-generic.yaml
-  - tier-x/manifest.yaml
-  - tier-x/kernel.yaml

finalize.d/01-pungi-install-manifests.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+set -xeuo pipefail
+
+# This is used in the legacy Pungi path. It won't get run in the
+# container-native path since install-manifests doesn't copy this script itself
+# into usr/share/doc.
+target_rootfs=$(pwd)
+cd "$RPMOSTREE_WORKDIR"
+./install-manifests "$target_rootfs"/usr/share/doc/bootc-base-imagectl/manifests
+install -m 0755 -t "$target_rootfs"/usr/libexec bootc-base-imagectl

install-manifests

@@ -0,0 +1,28 @@
+#!/bin/bash
+set -xeuo pipefail
+# This script copies the manifests from the current directory
+# into their installed location.
+manifestdir=${1:-/usr/share/doc/bootc-base-imagectl/manifests}
+mkdir -p "$manifestdir/"
+for image in minimal standard minimal-plus iot; do
+    # Embed the generic defaults
+    cp -a $image $manifestdir/
+    # And the top-level Fedora-specific manifests
+    if [ -f $image.hidden.yaml ]; then
+        cp -a $image.hidden.yaml $manifestdir/
+    else
+        cp -a $image.yaml $manifestdir/
+    fi
+    # And the legacy `fedora-` prefixed names
+    cp -a fedora-$image.yaml $manifestdir/
+done
+# ELN is rawhide-only and should be removed when stable branches are created
+# (manually remove eln/ directory and fedora-eln.yaml when branching for new releases)
+if [ -d eln ]; then
+    cp -a eln $manifestdir/
+    cp -a fedora-eln.yaml $manifestdir/
+fi
+# Set the default
+ln -s fedora-standard.yaml $manifestdir/default.yaml
+# And install dependency manifests
+cp -a fedora-includes $manifestdir

iot.yaml

@@ -0,0 +1,4 @@
+include:
+  - iot/manifest.yaml
+  - fedora-minimal-plus.yaml
+

iot/manifest.yaml

@@ -0,0 +1,59 @@
+metadata:
+  summary: Fedora IoT bootc image
+
+variables:
+  distro: "fedora-iot"
+
+packages:
+  - fedora-release-iot
+  - fedora-iot-config
+  - atheros-firmware
+  - brcmfmac-firmware
+  - chrony
+  - clevis
+  - clevis-dracut
+  - clevis-luks
+  - clevis-pin-tpm2
+  - containernetworking-plugins
+  - dnf5-plugins
+  - dracut-config-generic
+  - dracut-network
+  - fdo-client
+  - fdo-owner-cli
+  - firewalld
+  - fwupd-efi
+  - fwupd-plugin-modem-manager
+  - fwupd-plugin-uefi-capsule-data
+  - greenboot
+  - greenboot-default-health-checks
+  - ignition
+  - ignition-edge
+  - ima-evm-utils
+  - iputils
+  - iwd
+  - iwlwifi-mvm-firmware
+  - libsss_sudo
+  - NetworkManager-wifi
+  - NetworkManager-wwan
+  - openssl
+  - pinentry
+  - procps-ng
+  - realtek-firmware
+  - rootfiles
+  - screen
+  - setools-console
+  - slirp4netns
+  - ssh-key-dir
+  - sssd-client
+  - tmux
+  - tpm2-pkcs11
+  - traceroute
+  - usbguard
+  - wpa_supplicant
+  - wireless-regdb
+packages-aarch64:
+  - arm-image-installer
+  - bcm283x-firmware
+  - optee_client
+  - uboot-images-armv8
+

minimal-plus.hidden.yaml

@@ -0,0 +1,3 @@
+include:
+  - fedora-includes/generic.yaml
+  - minimal-plus/manifest.yaml

minimal-plus/manifest.yaml

@@ -1,5 +1,10 @@
+metadata:
+  summary: |
+    This content set is intended to be the shared base used by all image-based
+    Fedora variants (IoT, Atomic Desktops, and CoreOS).
+
 include:
-  - ../tier-0/manifest.yaml
+  - ../minimal/manifest.yaml
 
 packages:
   # Used by admins interactively

minimal.yaml

@@ -0,0 +1,3 @@
+include:
+  - fedora-includes/generic.yaml
+  - minimal/manifest.yaml

minimal/basic-fixes.yaml

@@ -23,7 +23,13 @@ postprocess:
     # tmpfiles.d unit for `/var/roothome` is fine, but this actually doesn't
     # work if we want to use tmpfiles.d to write to `/root/.ssh` because
     # tmpfiles gives up on that before getting to `/var/roothome`.
-    sed -i -e 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf
+    #
+    # Redirect stdout to /dev/null because of some weird stdout issue
+    # with newer rpm-ostree: https://github.com/coreos/rpm-ostree/pull/5388#issuecomment-2971623787
+    sed -i -e 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf > /dev/null
     # Because /var/roothome is also defined in rpm-ostree-0-integration.conf
     # we need to delete /var/roothome
-    sed -i -e '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf
+    #
+    # Redirect stdout to /dev/null because of some weird stdout issue
+    # with newer rpm-ostree: https://github.com/coreos/rpm-ostree/pull/5388#issuecomment-2971623787
+    sed -i -e '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf > /dev/null

minimal/bootc.yaml

@@ -0,0 +1,11 @@
+# The bootc components.
+packages:
+ # systemd. Also name systemd-pam because it was dropped to a recommends
+ # but we still want it for handling user logins/sessions.
+ # dbus is required per https://bugzilla.redhat.com/show_bug.cgi?id=2507313
+ - systemd systemd-pam dbus
+ # bootc itself.
+ - bootc
+ # Required by bootc install, sgdisk has been replaced by Rust crate
+ # in bootc https://github.com/containers/bootc/pull/775
+ - xfsprogs e2fsprogs dosfstools

minimal/bootupd.yaml

@@ -8,6 +8,14 @@ packages-aarch64:
   - grub2-efi-aa64 efibootmgr shim
 packages-ppc64le:
   - grub2 ostree-grub2
+packages-riscv64:
+  - grub2-efi-riscv64 efibootmgr
+  # Don't specify just `shim` for now because riscv isn't built in
+  # main koji instance yet and thus isn't signed. Here we specify
+  # the path to the provided file so when we do switch to the signed
+  # `shim` package it will transparently happen and we can clean up
+  # this packagelist entry later.
+  - /boot/efi/EFI/fedora/shimriscv64.efi
 packages-s390x:
   # For zipl
   - s390utils-core

minimal/check-passwd-nobody.yaml

@@ -0,0 +1,6 @@
+check-passwd:
+  type: "file"
+  filename: "passwd-nobody"
+check-groups:
+  type: "file"
+  filename: "group-nobody"

minimal/check-passwd.yaml

@@ -0,0 +1,6 @@
+check-passwd:
+  type: "file"
+  filename: "passwd"
+check-groups:
+  type: "file"
+  filename: "group"

minimal/finalize.d/01-var.sh

@@ -4,3 +4,4 @@ set -xeuo pipefail
 ln -s ../run var/run
 # https://gitlab.com/fedora/bootc/tracker/-/issues/58
 mkdir -p var/lib/rpm-state
+test -d var/tmp || mkdir -m 1777 var/tmp

minimal/group

@@ -1,3 +1,5 @@
+# keep sorted by GID (e.g. pass through `sort -t: --key 3 -g`)
+
 root:x:0:
 bin:x:1:
 daemon:x:2:
@@ -15,31 +17,31 @@ man:x:15:
 dialout:x:18:
 floppy:x:19:
 games:x:20:
+rpcuser:x:29:
 tape:x:33:
 video:x:39:
+dip:x:40:
 ftp:x:50:
 lock:x:54:
 audio:x:63:
+tcpdump:x:72:
 nobody:x:99:
 users:x:100:
-ssh_keys:x:999:
-systemd-journal:x:190:
-polkitd:x:998:
-etcd:x:997:
-dip:x:40:
-cgred:x:996:
-avahi-autoipd:x:170:
-sssd:x:993:
-dockerroot:x:986:
-rpcuser:x:29:
-nfsnobody:x:65534:
-kube:x:994:
-chrony:x:992:
-tcpdump:x:72:
-ceph:x:167:
 input:x:104:
-systemd-timesync:x:991:
-systemd-network:x:990:
-systemd-resolve:x:989:
-systemd-bus-proxy:x:988:
+ceph:x:167:
+avahi-autoipd:x:170:
+systemd-journal:x:190:
+dockerroot:x:986:
 cockpit-ws:x:987:
+systemd-bus-proxy:x:988:
+systemd-resolve:x:989:
+systemd-network:x:990:
+systemd-timesync:x:991:
+chrony:x:992:
+sssd:x:993:
+kube:x:994:
+cgred:x:996:
+etcd:x:997:
+polkitd:x:998:
+ssh_keys:x:999:
+nfsnobody:x:65534:

minimal/group-nobody

@@ -0,0 +1,4 @@
+# this is used with the --nobody-99 option for backwards compatibility with
+# systems that had nobody set to 99
+nobody:x:99:
+nfsnobody:x:65534:

minimal/initramfs.yaml

@@ -2,11 +2,15 @@
 postprocess:
   - |
     #!/usr/bin/env bash
+    set -xeuo pipefail
     mkdir -p /usr/lib/dracut/dracut.conf.d
     cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF'
     # We want a generic image; hostonly makes no sense as part of a server side build
     hostonly=no
-    add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree "
+    # Dracut will always fail to set security.selinux xattrs at build time
+    # https://github.com/dracut-ng/dracut-ng/issues/1561
+    export DRACUT_NO_XATTR=1
+    add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree bootc "
     EOF
     cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF'
     # Extra modules that we want by default that are known to exist in the kernel

minimal/kernel-install.yaml

@@ -4,18 +4,23 @@ postprocess:
     #!/usr/bin/env bash
     set -xeuo pipefail
     source /usr/lib/os-release
+    mkdir -p /usr/lib/kernel/install.conf.d
     echo -e "# kernel-install will not try to run dracut and allow rpm-ostree to\n\
     # take over. Rpm-ostree will use this to know that it is responsible\n\
     # to run dracut and ensure that there is only one kernel in the image\n\
-    layout=ostree" | tee /usr/lib/kernel/install.conf > /dev/null
+    layout=ostree" | tee /usr/lib/kernel/install.conf /usr/lib/kernel/install.conf.d/00-bootc-kernel-layout.conf > /dev/null
     # By default dnf keeps multiple versions of the kernel, with this
     # configuration we tell dnf to treat the kernel as everything else.
     # https://dnf.readthedocs.io/en/latest/conf_ref.html#main-options
     # Let's add the config to a distribution configuration file if dnf5
     # is used, we append to /etc/dnf/dnf.conf if not.
+    # Also set protect_running_kernel=False, dnf/yum pre-dates Containers and
+    # uses uname to protect the running kernel even on Container builds.
     if [ -d "/usr/share/dnf5/libdnf.conf.d/" ]; then
       echo -e "[main]\ninstallonlypkgs=''" >> /usr/share/dnf5/libdnf.conf.d/20-ostree-installonlypkgs.conf
+      echo -e "[main]\nprotect_running_kernel=False" >> /usr/share/dnf5/libdnf.conf.d/20-ostree-protect_running_kernel.conf
     else
       echo "installonlypkgs=''" >> /etc/dnf/dnf.conf
+      echo "protect_running_kernel=False" >> /etc/dnf/dnf.conf
     fi
 

minimal/kernel.yaml

@@ -0,0 +1,12 @@
+# Enable the Linux kernel; see also kernel-rt.
+packages:
+ - kernel
+
+exclude-packages:
+  - kernel-debug
+  - kernel-debug-core
+  - kernel-debug-modules
+  - kernel-debug-modules-core
+  - kernel-debug-modules-extra
+  - kernel-debug-uki-virt
+  - kernel-debug-uki-virt-addons

minimal/manifest.yaml

@@ -1,5 +1,11 @@
+metadata:
+  summary: Effectively just bootc, systemd, kernel, and dnf as a starting point.
+
 edition: "2024"
 
+variables:
+  passwd_mode: full
+
 # Be minimal
 recommends: false
 
@@ -10,11 +16,9 @@ container-cmd:
 remove-from-packages:
   # Generally we expect other tools to do this (e.g. Ignition or cloud-init)
   - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service]
-  # We don't want auto-generated mount units. See also
-  # https://github.com/systemd/systemd/issues/13099
-  - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator]
 
 include:
+  - kernel.yaml
   - postprocess-conf.yaml
   - tmpfiles.yaml
   - bootc.yaml
@@ -23,6 +27,7 @@ include:
   - initramfs.yaml
   - basic-fixes.yaml
   - kernel-install.yaml
+  - systemd-presets.yaml
 
 packages:
   # this is implied by dependencies but let's make it explicit
@@ -31,7 +36,7 @@ packages:
   # in dnf5. In CentOS/RHEL, this pulls in dnf(4). We can simplify this back to
   # just `dnf` once the `dnf` package is retired from Fedora.
   - /usr/bin/dnf
-  # Even in tier-0, we have this.  If you don't want SELinux today, you'll need
+  # Even in minimal, we have this.  If you don't want SELinux today, you'll need
   # to build a custom image.
   - selinux-policy-targeted
   # And we want container-selinux because trying to layer it on later currently causes issues.

minimal/ostree.yaml

@@ -5,6 +5,7 @@ postprocess:
   # Set up default root config
   - |
     #!/usr/bin/env bash
+    set -xeuo pipefail
     mkdir -p /usr/lib/ostree
     cat > /usr/lib/ostree/prepare-root.conf << EOF
     [composefs]

minimal/passwd

@@ -1,32 +1,34 @@
-adm:x:3:4:adm:/var/adm:/usr/sbin/nologin
-avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin
+# keep sorted by UID (e.g. pass through `sort -t: --key 3 -g`)
+
+root:x:0:0:Super User:/root:/bin/bash
 bin:x:1:1:bin:/bin:/usr/sbin/nologin
-ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin
-chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin
-cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin
 daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin
+adm:x:3:4:adm:/var/adm:/usr/sbin/nologin
+lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin
+sync:x:5:0:sync:/sbin:/bin/sync
+shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
+halt:x:7:0:halt:/sbin:/sbin/halt
+mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin
+operator:x:11:0:operator:/root:/usr/sbin/nologin
+games:x:12:100:games:/usr/games:/usr/sbin/nologin
+ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin
+rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin
+rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin
+tcpdump:x:72:72::/:/usr/sbin/nologin
+sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin
 dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin
+nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin
+ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin
+avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin
+cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin
+systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin
+systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin
+systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin
+systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin
+chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin
+sssd:x:995:993:User for sssd:/run/sssd:/usr/sbin/nologin
+kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin
 dockerroot:x:997:986:Docker User:/var/lib/docker:/usr/sbin/nologin
 etcd:x:998:997:etcd user:/var/lib/etcd:/usr/sbin/nologin
-ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin
-games:x:12:100:games:/usr/games:/usr/sbin/nologin
-halt:x:7:0:halt:/sbin:/sbin/halt
-kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin
-lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin
-mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin
-nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin
-nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin
-operator:x:11:0:operator:/root:/usr/sbin/nologin
 polkitd:x:999:998:User for polkitd:/:/usr/sbin/nologin
-root:x:0:0:Super User:/root:/bin/bash
-rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin
-rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin
-shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
-sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin
-sssd:x:995:993:User for sssd:/run/sssd:/usr/sbin/nologin
-sync:x:5:0:sync:/sbin:/bin/sync
-systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin
-systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin
-systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin
-systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin
-tcpdump:x:72:72::/:/usr/sbin/nologin
+nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin

minimal/passwd-nobody

@@ -0,0 +1,4 @@
+# this is used with the --nobody-99 option for backwards compatibility with
+# systems that had nobody set to 99
+nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin
+nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin

minimal/postprocess-conf.yaml

@@ -0,0 +1,38 @@
+# This file configures things relevant to `rpm-ostree compose postprocess`.
+
+# We want content lifecycled with the image
+opt-usrlocal: "root"
+
+# https://github.com/CentOS/centos-bootc/issues/167
+machineid-compat: true
+
+rpmdb: target
+# We never want rpmdb.sqlite-shm as it's unreproducible
+rpmdb-normalize: true
+
+ignore-removed-users:
+  - root
+ignore-removed-groups:
+  - root
+# By default users and groups are injected to nss-altfiles
+# which is immutable. This list moves a selected set
+# to /etc/group instead, which is mutable per system
+# and allows local users to become part of these groups.
+etc-group-members:
+  - wheel
+  - systemd-journal
+  - tss # https://issues.redhat.com/browse/BIFROST-618
+  - kvm # https://issues.redhat.com/browse/RHEL-115278
+  - adm
+
+conditional-include:
+  - if: passwd_mode == "full"
+    include: check-passwd.yaml
+  - if: passwd_mode == "nobody"
+    include: check-passwd-nobody.yaml
+  - if: passwd_mode == "none"
+    include:
+      check-passwd:
+        type: "none"
+      check-groups:
+        type: "none"

minimal/systemd-presets.yaml

@@ -0,0 +1,43 @@
+# Postprocessing relating to systemd presets on the system.
+postprocess:
+  - |
+    #!/bin/bash
+    set -xeuo pipefail
+    # Override some of the default presets.
+    cat <<EOF > usr/lib/systemd/system-preset/85-bootc.preset
+    # Disable dnf-makecache.timer on bootc/image mode systems
+    # https://github.com/coreos/fedora-coreos-tracker/issues/1896#issuecomment-2848251507
+    disable dnf-makecache.timer
+    EOF
+  # Enable bootloader-update.service on F43+ and CentOS9+
+  # https://github.com/coreos/fedora-coreos-tracker/issues/1468#issuecomment-2996654547
+  # https://fedoraproject.org/wiki/Changes/AutomaticBootloaderUpdatesBootc
+  - |
+    #!/bin/bash
+    set -xeuo pipefail
+    source /usr/lib/os-release
+
+    preset_file_name=/usr/lib/systemd/system-preset/85-bootc-bootloader-update.preset
+
+    case "$ID" in
+        fedora)
+            if [ "$VERSION_ID" -ge 43 ]; then
+                echo "enable bootloader-update.service" >> "$preset_file_name"
+            fi
+            ;;
+        centos)
+            if [ "$VERSION_ID" -ge 9 ]; then
+                echo "enable bootloader-update.service" >> "$preset_file_name"
+            fi
+            ;;
+        *) ;;
+    esac
+  # Undo RPM scripts enabling units; we want the presets to be canonical
+  # https://github.com/projectatomic/rpm-ostree/issues/1803
+  - |
+    #!/bin/bash
+    set -xeuo pipefail
+    rm -rf /etc/systemd/system/*
+    systemctl preset-all
+    rm -rf /etc/systemd/user/*
+    systemctl --user --global preset-all

minimal/tmpfiles.yaml

@@ -0,0 +1,18 @@
+postprocess:
+  - |
+    #!/bin/bash
+    set -xeuo pipefail
+    cat >/usr/lib/tmpfiles.d/bootc-base-rpmstate.conf <<'EOF'
+    # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=771713
+    d /var/lib/rpm-state 0755 - - -
+    EOF
+    cat > /usr/lib/tmpfiles.d/konflux-buildinfo-contentsets.conf <<'EOF'
+    # Workaround for https://github.com/konflux-ci/build-tasks-dockerfiles/pull/243
+    d /var/roothome/buildinfo 0755 - - -
+    d /var/roothome/buildinfo/content_manifests 0755 - - -
+    # Note we don't actually try to recreate the content; this just makes the linter ignore it
+    f /var/roothome/buildinfo/content_manifests/content-sets.json 0644 - - -
+    f /var/roothome/buildinfo/labels.json 0644 - - -
+    EOF
+    # Workaround for https://issues.redhat.com/browse/RHEL-106203
+    rm -f /usr/lib/tmpfiles.d/home.conf

renovate.json

@@ -1,19 +1,203 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "description": [
+    "Renovate configuration for bootc-base-image repository.",
+    "",
+    "This configuration separates updates into different PRs per release (e.g., Fedora 44, Rawhide)",
+    "to prevent blocking all releases if tests fail on one.",
+    "",
+    "Update schedules:",
+    "- Fedora 43 bootc-pipeline: 2-5 AM UTC daily",
+    "- Fedora 43 REPOS_IMAGE: at any time",
+    "- Fedora 44 bootc-pipeline: 2-5 AM UTC daily",
+    "- Fedora 44 REPOS_IMAGE: at any time",
+    "- Fedora 45 bootc-pipeline: 2-5 AM UTC daily",
+    "- Fedora 45 REPOS_IMAGE: at any time",
+    "- Rawhide bootc-pipeline: 2-5 AM UTC daily",
+    "- Rawhide REPOS_IMAGE: at any time",
+    "",
+    "Each update type (bootc-pipeline, REPOS_IMAGE) also has its own PR",
+    "for independent review and merge.",
+    "",
+    "rebaseWhen is set to 'never' for REPOS_IMAGE PRs because as different PRs",
+    "for each release are merged to main, automatic rebasing would reset pipelines",
+    "and cause tests to rerun multiple times. The operator can manually rebase if needed.",
+    "",
+    "Automerge is enabled for all PRs - they will be merged automatically when all checks pass."
+  ],
   "extends": [
     "github>platform-engineering-org/.github"
   ],
-  "baseBranches": ["main", "f40", "f41"],
+  "dependencyDashboard": true,
+  "automergeType": "pr",
+  "enabledManagers": [
+    "custom.regex",
+    "tekton"
+  ],
+  "tekton": {
+    "additionalBranchPrefix": "",
+    "includePaths": [
+      ".tekton/**"
+    ],
+    "managerFilePatterns": [
+      "/\\.ya?ml$/"
+    ]
+  },
+  "baseBranchPatterns": [
+    "main"
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": [
+        "Update 'REPOS_IMAGE' in tekton files"
+      ],
+      "managerFilePatterns": [
+        "/.tekton/.*\\.ya?ml$/"
+      ],
+      "matchStrings": [
+        "REPOS_IMAGE=(?<depName>.*):(?<currentValue>.*)@(?<currentDigest>.*)\\n"
+      ],
+      "versioningTemplate": "regex:(?<compatibility>.*)-(?<patch>\\d{8})(\\.n)?\\.(?<build>\\d)",
+      "datasourceTemplate": "docker"
+    }
+  ],
   "packageRules": [
     {
-      "matchPackageNames": ["quay.io/fedora/fedora"],
-      "allowedVersions": "=40",
-      "matchBaseBranches": ["f40"]
+      "description": [
+        "Disable REPOS_IMAGE updates for 44-iot, 45-iot and rawhide-iot tekton files",
+        "until we fix https://gitlab.com/fedora/bootc/base-images/-/issues/74"
+      ],
+      "matchManagers": ["custom.regex", "tekton"],
+      "matchFileNames": [".tekton/*-44-iot-*", ".tekton/*-45-iot-*", ".tekton/*-rawhide-iot-*"],
+      "enabled": false
     },
     {
-      "matchPackageNames": ["quay.io/fedora/fedora"],
-      "allowedVersions": "=41",
-      "matchBaseBranches": ["f41"]
+      "matchManagers": ["tekton"],
+      "matchPackageNames": ["/quay.io/bootc-devel/tekton-catalog/"],
+      "matchFileNames": [".tekton/fedora-bootc-43-*"],
+      "groupName": "Fedora 43 bootc-pipeline",
+      "groupSlug": "fedora-43-bootc-pipeline",
+      "branchPrefix": "renovate/fedora-43/",
+      "commitMessageTopic": "Fedora 43 bootc build pipeline",
+      "schedule": ["after 2am and before 5am"],
+      "timezone": "UTC",
+      "recreateWhen": "always",
+      "rebaseWhen": "always",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["custom.regex"],
+      "matchPackageNames": ["/quay.io/bootc-devel/fedora-bootc-43-compose/"],
+      "matchFileNames": [".tekton/fedora-bootc-43-*"],
+      "groupName": "Fedora 43 REPOS_IMAGE",
+      "groupSlug": "fedora-43-repos-image",
+      "branchPrefix": "renovate/fedora-43/",
+      "commitMessageTopic": "Fedora 43 REPOS_IMAGE",
+      "schedule": ["at any time"],
+      "recreateWhen": "always",
+      "rebaseWhen": "never",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["tekton"],
+      "matchPackageNames": ["/quay.io/bootc-devel/tekton-catalog/"],
+      "matchFileNames": [".tekton/fedora-bootc-44-*"],
+      "groupName": "Fedora 44 bootc-pipeline",
+      "groupSlug": "fedora-44-bootc-pipeline",
+      "branchPrefix": "renovate/fedora-44/",
+      "commitMessageTopic": "Fedora 44 bootc build pipeline",
+      "schedule": ["after 2am and before 5am"],
+      "timezone": "UTC",
+      "recreateWhen": "always",
+      "rebaseWhen": "always",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["custom.regex"],
+      "matchPackageNames": ["/quay.io/bootc-devel/fedora-bootc-44-compose/"],
+      "matchFileNames": [".tekton/fedora-bootc-44-*"],
+      "groupName": "Fedora 44 REPOS_IMAGE",
+      "groupSlug": "fedora-44-repos-image",
+      "branchPrefix": "renovate/fedora-44/",
+      "commitMessageTopic": "Fedora 44 REPOS_IMAGE",
+      "schedule": ["at any time"],
+      "recreateWhen": "always",
+      "rebaseWhen": "never",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["tekton"],
+      "matchPackageNames": ["/quay.io/bootc-devel/tekton-catalog/"],
+      "matchFileNames": [".tekton/fedora-bootc-45-*"],
+      "groupName": "Fedora 45 bootc-pipeline",
+      "groupSlug": "fedora-45-bootc-pipeline",
+      "branchPrefix": "renovate/fedora-45/",
+      "commitMessageTopic": "Fedora 45 bootc build pipeline",
+      "schedule": ["after 2am and before 5am"],
+      "timezone": "UTC",
+      "recreateWhen": "always",
+      "rebaseWhen": "always",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["custom.regex"],
+      "matchPackageNames": ["/quay.io/bootc-devel/fedora-bootc-45-compose/"],
+      "matchFileNames": [".tekton/fedora-bootc-45-*"],
+      "groupName": "Fedora 45 REPOS_IMAGE",
+      "groupSlug": "fedora-45-repos-image",
+      "branchPrefix": "renovate/fedora-45/",
+      "commitMessageTopic": "Fedora 45 REPOS_IMAGE",
+      "schedule": ["at any time"],
+      "recreateWhen": "always",
+      "rebaseWhen": "never",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["tekton"],
+      "matchPackageNames": ["/quay.io/bootc-devel/tekton-catalog/"],
+      "matchFileNames": [".tekton/fedora-bootc-rawhide-*"],
+      "groupName": "Fedora Rawhide bootc-pipeline",
+      "groupSlug": "fedora-rawhide-bootc-pipeline",
+      "branchPrefix": "renovate/fedora-rawhide/",
+      "commitMessageTopic": "Fedora Rawhide bootc build pipeline",
+      "schedule": ["after 2am and before 5am"],
+      "timezone": "UTC",
+      "recreateWhen": "always",
+      "rebaseWhen": "always",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["custom.regex"],
+      "matchPackageNames": ["/quay.io/bootc-devel/fedora-bootc-rawhide-compose/"],
+      "matchFileNames": [".tekton/fedora-bootc-rawhide-*"],
+      "groupName": "Fedora Rawhide REPOS_IMAGE",
+      "groupSlug": "fedora-rawhide-repos-image",
+      "branchPrefix": "renovate/fedora-rawhide/",
+      "commitMessageTopic": "Fedora Rawhide REPOS_IMAGE",
+      "schedule": ["at any time"],
+      "recreateWhen": "always",
+      "rebaseWhen": "never",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchPackageNames": [
+        "/quay.io/bootc-devel/fedora-bootc-eln-compose/"
+      ],
+      "groupName": "Fedora ELN compose dependencies",
+      "groupSlug": "fedora-eln-compose-dependencies",
+      "schedule": [
+        "at any time"
+      ],
+      "automerge": true
     }
   ]
 }

standard.yaml

@@ -0,0 +1,11 @@
+include:
+  - fedora-includes/generic.yaml
+  - standard/manifest.yaml
+
+packages:
+  # Make Ansible "package" builtin work by default
+  - python3-libdnf5
+  # Content-based container layer splitting for rechunking
+  # Note we should be able to move this back to the base standard/manifest.yaml
+  # once chunkah is in CentOS Stream and RHEL.
+  - chunkah

standard/autoupdates.yaml

@@ -2,8 +2,7 @@
 postprocess:
   - |
     #!/usr/bin/env bash
-    set -euo pipefail
+    set -xeuo pipefail
     target=/usr/lib/systemd/system/default.target.wants
     mkdir -p $target
-    set -x
     ln -s ../bootc-fetch-apply-updates.timer $target

standard/coreos-user-experience.yaml

@@ -8,7 +8,14 @@ packages:
   - console-login-helper-messages-profile
   # kdump support
   # https://github.com/coreos/fedora-coreos-tracker/issues/622
+  # The makedumpfile and kdump-utils RPMs were broken out in
+  # Fedora and EL10+. To be able to use the same package list
+  # Across EL9 + Fedora + EL10 let's just name paths for now.
+  # We can go back to just specifying the RPM names when we
+  # no longer support EL9.
   - kexec-tools
+  - /usr/share/makedumpfile # makedumpfile RPM
+  - /usr/bin/kdumpctl       # kdump-utils RPM
   # Container tooling
   - toolbox
   # nvme-cli for managing nvme disks

standard/generic-growfs.yaml

@@ -7,6 +7,7 @@ add-files:
 postprocess:
   - |
     #!/bin/bash
-    set -euo pipefail
+    set -xeuo pipefail
+    chmod 0644 /usr/lib/systemd/system/bootc-generic-growpart.service
     mkdir -p /usr/lib/systemd/system/local-fs.target.wants
     ln -s ../bootc-generic-growpart.service /usr/lib/systemd/system/local-fs.target.wants/bootc-generic-growpart.service