From efa477093872dd33aa4948cf6e212c4595e46fd9 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 13 Feb 2024 13:06:27 -0500 Subject: [PATCH 01/44] IoT: Update rawhide for F-41 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-40.repo => fedora-41.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-40.repo => fedora-41.repo (61%) diff --git a/config.ini b/config.ini index fedaedd..0b65ffb 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f40 +release = f41 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-40.repo b/fedora-41.repo similarity index 61% rename from fedora-40.repo rename to fedora-41.repo index 7a3c762..1412aca 100644 --- a/fedora-40.repo +++ b/fedora-41.repo @@ -1,12 +1,12 @@ -[fedora-40] -name=Fedora 40 - $basearch +[fedora-41] +name=Fedora 41 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/40/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-40&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/41/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-41&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-40-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-41-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 2c98c56..a154890 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -5,8 +5,8 @@ ima: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '40' -mutate-os-release: '40' +automatic_version_prefix: '41' +mutate-os-release: '41' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index b83ea21..51c17ad 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-40 +- fedora-41 From ede36f3a2c68f9d8fe24c768fd5343b57e0697cd Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 14 Feb 2024 16:53:30 -0500 Subject: [PATCH 02/44] Drop podman-plugins package Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index a154890..54ecf6c 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -135,7 +135,6 @@ packages: - parsec - pinentry - podman -- podman-plugins - policycoreutils - policycoreutils-python-utils - polkit From 4ef41ffa05c6973590756ea4307d8899904e46b9 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 21 Feb 2024 15:46:40 -0500 Subject: [PATCH 03/44] f41: enable bootupd Signed-off-by: Paul Whalen --- bootupd.yaml | 9 +++++++++ fedora-iot-base.yaml | 1 + 2 files changed, 10 insertions(+) create mode 100644 bootupd.yaml diff --git a/bootupd.yaml b/bootupd.yaml new file mode 100644 index 0000000..949f504 --- /dev/null +++ b/bootupd.yaml @@ -0,0 +1,9 @@ +packages: + - bootupd + +postprocess: + - | + #!/bin/bash + set -xeuo pipefail + # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload + /usr/bin/bootupctl backend generate-update-metadata diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 54ecf6c..3da21d4 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,3 +1,4 @@ +include: bootupd.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true From b908de5dc79ffa83b0e5f38384d2fa4e6818959e Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 19 Mar 2024 14:13:26 +0000 Subject: [PATCH 04/44] add passt userspace network for podmn5 requirements It seems podman5 has changed the rootless container network stack to passt so add this into our compose alongside the exisitng slirp4netns while we find out how the migration works so we can document it. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 3da21d4..6f429f6 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -133,6 +133,8 @@ packages: - openssl - openssh-clients - openssh-server +- passt +- passt-selinux - parsec - pinentry - podman From 187a596a33f43dce9f259b77a92e82ad77ca5ec3 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 12 Apr 2024 08:48:50 -0400 Subject: [PATCH 05/44] F41: enable fdo-client-linuxapp.service Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 6f429f6..1604965 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -184,6 +184,7 @@ packages-x86_64: default_target: multi-user.target units: - NetworkManager.service +- fdo-client-linuxapp.service - fedora-iot-config-remote-fix.service - firewalld.service - sshd.service From 8329945ded68e83941eb2ade0ca309f2d2965e3a Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 15 Apr 2024 11:47:11 -0400 Subject: [PATCH 06/44] F41: Add base bootc container Signed-off-by: Paul Whalen --- fedora-bootc-base/autoupdates.yaml | 9 ++++ fedora-bootc-base/basic-fixes.yaml | 29 +++++++++++ fedora-bootc-base/bootc-config.yaml | 10 ++++ fedora-bootc-base/bootc.yaml | 12 +++++ fedora-bootc-base/bootupd.yaml | 31 ++++++++++++ fedora-bootc-base/group | 46 +++++++++++++++++ fedora-bootc-base/grub2-removals.yaml | 8 +++ fedora-bootc-base/initramfs.yaml | 18 +++++++ fedora-bootc-base/kernel.yaml | 6 +++ fedora-bootc-base/manifest.yaml | 71 +++++++++++++++++++++++++++ fedora-bootc-base/ostree.yaml | 17 +++++++ fedora-bootc-base/passwd | 32 ++++++++++++ fedora-bootc.yaml | 15 ++++++ fedora.repo | 65 ++++++++++++++++++++++++ 14 files changed, 369 insertions(+) create mode 100644 fedora-bootc-base/autoupdates.yaml create mode 100644 fedora-bootc-base/basic-fixes.yaml create mode 100644 fedora-bootc-base/bootc-config.yaml create mode 100644 fedora-bootc-base/bootc.yaml create mode 100644 fedora-bootc-base/bootupd.yaml create mode 100644 fedora-bootc-base/group create mode 100644 fedora-bootc-base/grub2-removals.yaml create mode 100644 fedora-bootc-base/initramfs.yaml create mode 100644 fedora-bootc-base/kernel.yaml create mode 100644 fedora-bootc-base/manifest.yaml create mode 100644 fedora-bootc-base/ostree.yaml create mode 100644 fedora-bootc-base/passwd create mode 100644 fedora-bootc.yaml create mode 100644 fedora.repo diff --git a/fedora-bootc-base/autoupdates.yaml b/fedora-bootc-base/autoupdates.yaml new file mode 100644 index 0000000..a416699 --- /dev/null +++ b/fedora-bootc-base/autoupdates.yaml @@ -0,0 +1,9 @@ +# Enable automatic updates by default +postprocess: + - | + #!/usr/bin/env bash + set -euo pipefail + target=/usr/lib/systemd/system/default.target.wants + mkdir -p $target + set -x + ln -s ../bootc-fetch-apply-updates.timer $target diff --git a/fedora-bootc-base/basic-fixes.yaml b/fedora-bootc-base/basic-fixes.yaml new file mode 100644 index 0000000..d9fe059 --- /dev/null +++ b/fedora-bootc-base/basic-fixes.yaml @@ -0,0 +1,29 @@ +# Fix general bugs + +postprocess: + # See also https://github.com/openshift/os/blob/f6cde963ee140c02364674db378b2bc4ac42675b/common.yaml#L156 + # This one is undoes the effect of + # # RHEL-only: Disable /tmp on tmpfs. + #Wants=tmp.mount + # in /usr/lib/systemd/system/basic.target + # We absolutely must have tmpfs-on-tmp for multiple reasons, + # but the biggest is that when we have composefs for / it's read-only, + # and for units with ProtectSystem=full systemd clones / but needs + # a writable place. + - | + #!/usr/bin/env bash + set -xeuo pipefail + mkdir -p /usr/lib/systemd/system/local-fs.target.wants + if test '!' -f /usr/lib/systemd/system/local-fs.target.wants/tmp.mount; then + ln -sf ../tmp.mount /usr/lib/systemd/system/local-fs.target.wants + fi + + # See https://github.com/containers/bootc/issues/358 + # basically systemd-tmpfiles doesn't follow symlinks; ordinarily our + # tmpfiles.d unit for `/var/roothome` is fine, but this actually doesn't + # work if we want to use tmpfiles.d to write to `/root/.ssh` because + # tmpfiles gives up on that before getting to `/var/roothome`. + sed -ie 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf + # Because /var/roothome is also defined in rpm-ostree-0-integration.conf + # we need to delete /var/roothome + sed -ie '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml new file mode 100644 index 0000000..4d4b24e --- /dev/null +++ b/fedora-bootc-base/bootc-config.yaml @@ -0,0 +1,10 @@ +# Configuration for bootc +postprocess: + # ext4 is our default filesystem in iot + - | + #!/usr/bin/env bash + mkdir -p /usr/lib/bootc/install/ + cat > /usr/lib/bootc/install/20-default-root.toml << EOF + [install] + root-fs-type = "ext4" + EOF diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml new file mode 100644 index 0000000..a862e6c --- /dev/null +++ b/fedora-bootc-base/bootc.yaml @@ -0,0 +1,12 @@ +# The bootc components. +packages: + - systemd + - bootc + # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk + - gdisk xfsprogs e2fsprogs dosfstools + +exclude-packages: + # Exclude kernel-debug-core to make sure that it doesn't somehow get + # chosen as the package to satisfy the `kernel-core` dependency from + # the kernel package. + - kernel-debug-core diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml new file mode 100644 index 0000000..7d3ebf3 --- /dev/null +++ b/fedora-bootc-base/bootupd.yaml @@ -0,0 +1,31 @@ +# Integration with https://github.com/coreos/bootupd and bootloader logic +# xref https://github.com/coreos/fedora-coreos-tracker/issues/510 +packages: + - bootupd + +# bootloader +packages-aarch64: + - grub2-efi-aa64 efibootmgr shim +packages-ppc64le: + - grub2 ostree-grub2 +packages-s390x: + # On Fedora, this is provided by s390utils-core. on RHEL, this is for now + # provided by s390utils-base, but soon will be -core too. + - /usr/sbin/zipl +packages-x86_64: + - grub2 grub2-efi-x64 efibootmgr shim + - microcode_ctl + +conditional-include: + - if: basearch != "s390x" + # And remove some cruft from grub2 + include: grub2-removals.yaml + +postprocess: + - | + #!/bin/bash + set -xeuo pipefail + # Until we have https://github.com/coreos/rpm-ostree/pull/2275 + mkdir -p /run + # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload + /usr/bin/bootupctl backend generate-update-metadata diff --git a/fedora-bootc-base/group b/fedora-bootc-base/group new file mode 100644 index 0000000..2fd197c --- /dev/null +++ b/fedora-bootc-base/group @@ -0,0 +1,46 @@ +root:x:0: +bin:x:1: +daemon:x:2: +sys:x:3: +adm:x:4: +tty:x:5: +disk:x:6: +lp:x:7: +mem:x:8: +kmem:x:9: +wheel:x:10: +cdrom:x:11: +mail:x:12: +man:x:15: +sudo:x:16: +dialout:x:18: +floppy:x:19: +games:x:20: +tape:x:33: +video:x:39: +ftp:x:50: +lock:x:54: +audio:x:63: +nobody:x:99: +users:x:100: +ssh_keys:x:999: +systemd-journal:x:190: +polkitd:x:998: +etcd:x:997: +dip:x:40: +cgred:x:996: +avahi-autoipd:x:170: +sssd:x:993: +dockerroot:x:986: +rpcuser:x:29: +nfsnobody:x:65534: +kube:x:994: +chrony:x:992: +tcpdump:x:72: +ceph:x:167: +input:x:104: +systemd-timesync:x:991: +systemd-network:x:990: +systemd-resolve:x:989: +systemd-bus-proxy:x:988: +cockpit-ws:x:987: diff --git a/fedora-bootc-base/grub2-removals.yaml b/fedora-bootc-base/grub2-removals.yaml new file mode 100644 index 0000000..f4800dd --- /dev/null +++ b/fedora-bootc-base/grub2-removals.yaml @@ -0,0 +1,8 @@ +remove-from-packages: + # The grub bits are mainly designed for desktops, and IMO haven't seen + # enough testing in concert with ostree. At some point we'll flesh out + # the full plan in https://github.com/coreos/fedora-coreos-tracker/issues/47 + - [grub2-tools, /etc/grub.d/08_fallback_counting, + /etc/grub.d/10_reset_boot_success, + /etc/grub.d/12_menu_auto_hide, + /usr/lib/systemd/.*] diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml new file mode 100644 index 0000000..de65333 --- /dev/null +++ b/fedora-bootc-base/initramfs.yaml @@ -0,0 +1,18 @@ +# Configuration for the initramfs +postprocess: + - | + #!/usr/bin/env bash + mkdir -p /usr/lib/dracut/dracut.conf.d + cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' + # We want a generic image; hostonly makes no sense as part of a server side build + hostonly=no + dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " + EOF + cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' + # Extra modules that we want by default that are known to exist in the kernel + dracutmodules+=" virtiofs " + EOF + cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' + # We want this for systemd-cryptsetup tpm2 locking + dracutmodules+=" tpm2-tss " + EOF diff --git a/fedora-bootc-base/kernel.yaml b/fedora-bootc-base/kernel.yaml new file mode 100644 index 0000000..0dd777d --- /dev/null +++ b/fedora-bootc-base/kernel.yaml @@ -0,0 +1,6 @@ +# Enable the Linux kernel; see also kernel-rt. +packages: + - kernel + +exclude-packages: + - kernel-debug diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml new file mode 100644 index 0000000..007f6d7 --- /dev/null +++ b/fedora-bootc-base/manifest.yaml @@ -0,0 +1,71 @@ + +# Modern defaults we want +boot-location: modules +tmp-is-dir: true +# https://github.com/CentOS/centos-bootc/issues/167 +machineid-compat: true +# Be minimal +recommends: false + +ignore-removed-users: + - root +ignore-removed-groups: + - root +etc-group-members: + - wheel + - sudo + - systemd-journal + - adm + +# Default to `bash` in our container, the same as other containers we ship. +container-cmd: + - /sbin/init + +# Note that the default for c9s+ is sqlite; we can't rely on rpm being +# in the target (it isn't in tier-0!) so turn this to host here. This +# does break the "hermetic build" aspect a bit. Maybe eventually +# what we should do is special case this and actually install RPM temporarily +# and then remove it... +rpmdb: host + +check-passwd: + type: "file" + filename: "passwd" +check-groups: + type: "file" + filename: "group" + +automatic-version-prefix: "${releasever}." +mutate-os-release: "${releasever}" + +remove-from-packages: + # Generally we expect other tools to do this (e.g. Ignition or cloud-init) + - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service] + # We don't want auto-generated mount units. See also + # https://github.com/systemd/systemd/issues/13099 + - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator] + # Drop some buggy sysusers fragments which do not match static IDs allocation: + # https://bugzilla.redhat.com/show_bug.cgi?id=2105177 + - [dbus-common, /usr/lib/sysusers.d/dbus.conf] + +include: + - bootc.yaml + - ostree.yaml + - bootc-config.yaml + - initramfs.yaml + - autoupdates.yaml + - basic-fixes.yaml + +packages: + # Even in tier-0, we have this. If you don't want SELinux today, you'll need + # to build a custom image. + - selinux-policy-targeted + # And we want container-selinux because trying to layer it on later currently causes issues. + - container-selinux + # Needed for tpm2 bound luks + - tpm2-tools + +# See https://github.com/coreos/bootupd +arch-include: + x86_64: bootupd.yaml + aarch64: bootupd.yaml diff --git a/fedora-bootc-base/ostree.yaml b/fedora-bootc-base/ostree.yaml new file mode 100644 index 0000000..6f30861 --- /dev/null +++ b/fedora-bootc-base/ostree.yaml @@ -0,0 +1,17 @@ +packages: + - ostree nss-altfiles + +# We want content lifecycled with the image +opt-usrlocal: "root" + +postprocess: + # Set up default root config + - | + #!/usr/bin/env bash + mkdir -p /usr/lib/ostree + cat > /usr/lib/ostree/prepare-root.conf << EOF + [composefs] + enabled = yes + [sysroot] + readonly = true + EOF diff --git a/fedora-bootc-base/passwd b/fedora-bootc-base/passwd new file mode 100644 index 0000000..ea84802 --- /dev/null +++ b/fedora-bootc-base/passwd @@ -0,0 +1,32 @@ +adm:x:3:4:adm:/var/adm:/usr/sbin/nologin +avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin +bin:x:1:1:bin:/bin:/usr/sbin/nologin +ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin +chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin +cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin +daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin +dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin +dockerroot:x:997:986:Docker User:/var/lib/docker:/usr/sbin/nologin +etcd:x:998:997:etcd user:/var/lib/etcd:/usr/sbin/nologin +ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin +games:x:12:100:games:/usr/games:/usr/sbin/nologin +halt:x:7:0:halt:/sbin:/sbin/halt +kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin +lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin +mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin +nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin +nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin +operator:x:11:0:operator:/root:/usr/sbin/nologin +polkitd:x:999:998:User for polkitd:/:/usr/sbin/nologin +root:x:0:0:Super User:/root:/bin/bash +rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin +rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin +shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown +sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin +sssd:x:995:993:User for sssd:/:/usr/sbin/nologin +sync:x:5:0:sync:/sbin:/bin/sync +systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin +systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin +systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin +systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin +tcpdump:x:72:72::/:/usr/sbin/nologin diff --git a/fedora-bootc.yaml b/fedora-bootc.yaml new file mode 100644 index 0000000..9bb1cf7 --- /dev/null +++ b/fedora-bootc.yaml @@ -0,0 +1,15 @@ +releasever: rawhide +variables: + distro: "fedora" + +repos: + - rawhide + +metadata: + name: fedora-bootc + summary: Fedora base bootc image + +include: + - fedora-bootc-base/manifest.yaml + - fedora-bootc-base/kernel.yaml + diff --git a/fedora.repo b/fedora.repo new file mode 100644 index 0000000..7101cb9 --- /dev/null +++ b/fedora.repo @@ -0,0 +1,65 @@ +# Note we use baseurl= here because using auto-selected mirrors conflicts with +# change detection: https://github.com/coreos/fedora-coreos-pipeline/issues/85. + +[fedora] +name=Fedora $releasever - $basearch +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ + https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch +enabled=1 +#metadata_expire=7d +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False + +[fedora-updates] +name=Fedora $releasever - $basearch - Updates +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Everything/$basearch/ + https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Everything/$basearch/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch +enabled=1 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +metadata_expire=6h +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False + +[fedora-updates-testing] +name=Fedora $releasever - $basearch - Test Updates +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Everything/$basearch/ + https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Everything/$basearch/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch +enabled=1 +gpgcheck=1 +metadata_expire=6h +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False + +[rawhide] +name=Fedora - Rawhide - Developmental packages for the next Fedora release +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ + https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch +enabled=1 +#metadata_expire=7d +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False + +[fedora-devel] +name=Fedora $releasever - $basearch +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ + https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch +enabled=1 +#metadata_expire=7d +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False From 1314f2a3f25aa6b9932b9a1a7195de9381929842 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 16 Apr 2024 13:43:24 -0400 Subject: [PATCH 07/44] F41: Adjust repo to use mirrors Signed-off-by: Paul Whalen --- fedora-bootc.yaml | 2 +- fedora-rawhide.repo | 6 +++++ fedora.repo | 65 --------------------------------------------- 3 files changed, 7 insertions(+), 66 deletions(-) create mode 100644 fedora-rawhide.repo delete mode 100644 fedora.repo diff --git a/fedora-bootc.yaml b/fedora-bootc.yaml index 9bb1cf7..7067275 100644 --- a/fedora-bootc.yaml +++ b/fedora-bootc.yaml @@ -3,7 +3,7 @@ variables: distro: "fedora" repos: - - rawhide + - fedora-rawhide metadata: name: fedora-bootc diff --git a/fedora-rawhide.repo b/fedora-rawhide.repo new file mode 100644 index 0000000..30b51c9 --- /dev/null +++ b/fedora-rawhide.repo @@ -0,0 +1,6 @@ +[fedora-rawhide] +name=Fedora rawhide $basearch +mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=rawhide&arch=$basearch +enabled=1 +gpgcheck=1 +metadata_expire=1d diff --git a/fedora.repo b/fedora.repo deleted file mode 100644 index 7101cb9..0000000 --- a/fedora.repo +++ /dev/null @@ -1,65 +0,0 @@ -# Note we use baseurl= here because using auto-selected mirrors conflicts with -# change detection: https://github.com/coreos/fedora-coreos-pipeline/issues/85. - -[fedora] -name=Fedora $releasever - $basearch -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ - https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch -enabled=1 -#metadata_expire=7d -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False - -[fedora-updates] -name=Fedora $releasever - $basearch - Updates -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Everything/$basearch/ - https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Everything/$basearch/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch -enabled=1 -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -metadata_expire=6h -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False - -[fedora-updates-testing] -name=Fedora $releasever - $basearch - Test Updates -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Everything/$basearch/ - https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Everything/$basearch/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch -enabled=1 -gpgcheck=1 -metadata_expire=6h -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False - -[rawhide] -name=Fedora - Rawhide - Developmental packages for the next Fedora release -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ - https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch -enabled=1 -#metadata_expire=7d -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False - -[fedora-devel] -name=Fedora $releasever - $basearch -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ - https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch -enabled=1 -#metadata_expire=7d -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False From c1ecf382b89fcdcc85ddbca1fd2dfc1b3123c762 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 3 May 2024 10:49:13 -0400 Subject: [PATCH 08/44] F41: add bootc to packages Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 1604965..8c21026 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -78,6 +78,7 @@ packages: - basesystem - bash - bash-completion +- bootc - brcmfmac-firmware - chrony - clevis From 985a450f7c3dfbc07b29e148e60c9ae0290b533c Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 15 Jul 2024 13:39:36 -0400 Subject: [PATCH 09/44] F41: Add dnf5 to packages Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 8c21026..25d3bdd 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -94,6 +94,8 @@ packages: - cryptsetup - curl - dbus-parsec +- dnf5 +- dnf5-plugins - dnsmasq - dosfstools - dracut-config-generic From 023d15b50fc0f862bd1b1b9fee9011ea03c27780 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 12 Aug 2024 15:26:49 -0400 Subject: [PATCH 10/44] IoT: Update rawhide for F-42 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-41.repo => fedora-42.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-41.repo => fedora-42.repo (61%) diff --git a/config.ini b/config.ini index 0b65ffb..f7e27f5 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f41 +release = f42 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-41.repo b/fedora-42.repo similarity index 61% rename from fedora-41.repo rename to fedora-42.repo index 1412aca..f9343b8 100644 --- a/fedora-41.repo +++ b/fedora-42.repo @@ -1,12 +1,12 @@ -[fedora-41] -name=Fedora 41 - $basearch +[fedora-42] +name=Fedora 42 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/41/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-41&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/42/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-42&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-41-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 25d3bdd..b665f4b 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -6,8 +6,8 @@ ima: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '41' -mutate-os-release: '41' +automatic_version_prefix: '42' +mutate-os-release: '42' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 51c17ad..f765bfe 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-41 +- fedora-42 From 1a898a733753e9700e305e41ea218456780efe13 Mon Sep 17 00:00:00 2001 From: Micah Abbott Date: Wed, 28 Aug 2024 13:54:39 -0400 Subject: [PATCH 11/44] bootupd: add some contextual comments Signed-off-by: Micah Abbott --- bootupd.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/bootupd.yaml b/bootupd.yaml index 949f504..3328d41 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,3 +1,7 @@ +# KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml +# See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml +# +#Integration with https://github.com/coreos/bootupd packages: - bootupd From 36ab3daaf041fe8f822fd639a3d31a093939cc93 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 3 Sep 2024 09:38:53 -0400 Subject: [PATCH 12/44] fedora-iot-base: Add workaround for issue with newer GRUB2 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 5 ++++- grub2-workaround.yaml | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) create mode 100644 grub2-workaround.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index b665f4b..a7afbd1 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,4 +1,7 @@ -include: bootupd.yaml +include: + - bootupd.yaml + # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 + - grub2-workaround.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/grub2-workaround.yaml b/grub2-workaround.yaml new file mode 100644 index 0000000..3b58a9e --- /dev/null +++ b/grub2-workaround.yaml @@ -0,0 +1,22 @@ +# Temporarily disable new GRUB2 config options until we can ensure that we +# have an updated bootloader via bootupd. +# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 +# See: https://github.com/fedora-silverblue/issue-tracker/issues/587 +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + # Completely disable this module + sed -i '2i exit 0' /etc/grub.d/25_bli + + # Skip check that was not performed in previous Fedora versions + sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware + sed -i '/\tif/d' /etc/grub.d/30_uefi-firmware + sed -i '/\tfi/d' /etc/grub.d/30_uefi-firmware + sed -i 's/\t\t/\t/' /etc/grub.d/30_uefi-firmware + + # Verify that the content matches what we expect the file to look like. + # This will fail the build here instead of breaking users' systems. + hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b" + echo "$hash /etc/grub.d/30_uefi-firmware" | sha256sum -c From 176b0add790ece0b16b41337569b9170b0514117 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 20 Sep 2024 15:28:56 +0100 Subject: [PATCH 13/44] drop dnsmasq Not sure why it was included, I suspect it was once used for container networking. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index a7afbd1..4c64cd1 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -99,7 +99,6 @@ packages: - dbus-parsec - dnf5 - dnf5-plugins -- dnsmasq - dosfstools - dracut-config-generic - dracut-network From 597796c53f30950d9edaa85b6d6a07ee1a829d5c Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 25 Sep 2024 08:57:05 -0400 Subject: [PATCH 14/44] Add iot base bootc image Signed-off-by: Paul Whalen --- fedora-bootc-base/autoupdates.yaml | 9 -- fedora-bootc-base/bootc-config.yaml | 10 --- fedora-bootc-base/bootc.yaml | 4 + fedora-bootc-base/bootupd.yaml | 2 +- fedora-bootc-base/initramfs.yaml | 12 ++- fedora-bootc-base/iot.yaml | 100 +++++++++++++++++++++ fedora-bootc-base/manifest.yaml | 14 +-- fedora-bootc.yaml => fedora-iot-bootc.yaml | 6 +- 8 files changed, 121 insertions(+), 36 deletions(-) delete mode 100644 fedora-bootc-base/autoupdates.yaml create mode 100644 fedora-bootc-base/iot.yaml rename fedora-bootc.yaml => fedora-iot-bootc.yaml (61%) diff --git a/fedora-bootc-base/autoupdates.yaml b/fedora-bootc-base/autoupdates.yaml deleted file mode 100644 index a416699..0000000 --- a/fedora-bootc-base/autoupdates.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# Enable automatic updates by default -postprocess: - - | - #!/usr/bin/env bash - set -euo pipefail - target=/usr/lib/systemd/system/default.target.wants - mkdir -p $target - set -x - ln -s ../bootc-fetch-apply-updates.timer $target diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml index 4d4b24e..e69de29 100644 --- a/fedora-bootc-base/bootc-config.yaml +++ b/fedora-bootc-base/bootc-config.yaml @@ -1,10 +0,0 @@ -# Configuration for bootc -postprocess: - # ext4 is our default filesystem in iot - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/bootc/install/ - cat > /usr/lib/bootc/install/20-default-root.toml << EOF - [install] - root-fs-type = "ext4" - EOF diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml index a862e6c..d44ee08 100644 --- a/fedora-bootc-base/bootc.yaml +++ b/fedora-bootc-base/bootc.yaml @@ -2,6 +2,10 @@ packages: - systemd - bootc + # bootc pulls in podman, which pulls in containers-common, which wants + # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name + # iptables-nft instead to satisfy it. + - iptables-nft # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk - gdisk xfsprogs e2fsprogs dosfstools diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml index 7d3ebf3..cc83d20 100644 --- a/fedora-bootc-base/bootupd.yaml +++ b/fedora-bootc-base/bootupd.yaml @@ -13,7 +13,7 @@ packages-s390x: # provided by s390utils-base, but soon will be -core too. - /usr/sbin/zipl packages-x86_64: - - grub2 grub2-efi-x64 efibootmgr shim + - grub2-efi-x64 efibootmgr shim - microcode_ctl conditional-include: diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml index de65333..fe4bbeb 100644 --- a/fedora-bootc-base/initramfs.yaml +++ b/fedora-bootc-base/initramfs.yaml @@ -6,13 +6,19 @@ postprocess: cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' # We want a generic image; hostonly makes no sense as part of a server side build hostonly=no - dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " + add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " EOF cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' # Extra modules that we want by default that are known to exist in the kernel - dracutmodules+=" virtiofs " + add_dracutmodules+=" virtiofs " EOF cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' # We want this for systemd-cryptsetup tpm2 locking - dracutmodules+=" tpm2-tss " + add_dracutmodules+=" tpm2-tss " + EOF + cat > /usr/lib/dracut/dracut.conf.d/59-altfiles.conf << 'EOF' + # https://issues.redhat.com/browse/RHEL-49590 + # On image mode systems we use nss-altfiles for passwd and group, + # this makes sure dracut uses them which also fixes kdump writing to NFS. + install_items+=" /usr/lib/passwd /usr/lib/group " EOF diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml new file mode 100644 index 0000000..611ff9a --- /dev/null +++ b/fedora-bootc-base/iot.yaml @@ -0,0 +1,100 @@ +# Fedora IoT specific packages +packages: + - fedora-release-iot + - aardvark-dns + - atheros-firmware + - attr + - authselect + - basesystem + - bash + - bash-completion + - brcmfmac-firmware + - chrony + - clevis + - clevis-dracut + - clevis-luks + - clevis-pin-tpm2 + - containernetworking-plugins + - coreutils + - cracklib-dicts + - criu + - criu-libs + - cryptsetup + - curl + - dbus-parsec + - dnf5-plugins + - dracut-config-generic + - dracut-network + - efibootmgr + - fdo-client + - firewalld + - fwupd + - fwupd-efi + - fwupd-plugin-modem-manager + - fwupd-plugin-uefi-capsule-data + - glibc + - glibc-minimal-langpack + - gnupg2 + - greenboot + - greenboot-default-health-checks + - gzip + - hostname + - ignition + - ima-evm-utils + - iproute + - iputils + - iwd + - iwlwifi-mvm-firmware + - kernel-tools + - keyutils + - less + - libsss_sudo + - linux-firmware + - lvm2 + - netavark + - NetworkManager + - NetworkManager-wifi + - NetworkManager-wwan + - nss-altfiles + - openssl + - openssh-clients + - openssh-server + - passt + - passt-selinux + - parsec + - pinentry + - podman + - policycoreutils + - policycoreutils-python-utils + - polkit + - procps-ng + - realtek-firmware + - rootfiles + - rpm + - screen + - setools-console + - setup + - shadow-utils + - skopeo + - slirp4netns + - sssd-client + - sudo + - systemd-resolved + - tar + - tmux + - tpm2-pkcs11 + - traceroute + - usbguard + - util-linux + - vim-minimal + - wpa_supplicant + - wireless-regdb + - xz + - zezere-ignition + - zram-generator + - zram-generator-defaults +packages-aarch64: + - arm-image-installer + - bcm283x-firmware + - optee_client + - uboot-images-armv8 diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml index 007f6d7..9a21ff3 100644 --- a/fedora-bootc-base/manifest.yaml +++ b/fedora-bootc-base/manifest.yaml @@ -44,19 +44,18 @@ remove-from-packages: # We don't want auto-generated mount units. See also # https://github.com/systemd/systemd/issues/13099 - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator] - # Drop some buggy sysusers fragments which do not match static IDs allocation: - # https://bugzilla.redhat.com/show_bug.cgi?id=2105177 - - [dbus-common, /usr/lib/sysusers.d/dbus.conf] include: - bootc.yaml + - bootupd.yaml - ostree.yaml - - bootc-config.yaml - initramfs.yaml - - autoupdates.yaml - basic-fixes.yaml + - iot.yaml packages: + # needed for building derived container images + - dnf5 # Even in tier-0, we have this. If you don't want SELinux today, you'll need # to build a custom image. - selinux-policy-targeted @@ -64,8 +63,3 @@ packages: - container-selinux # Needed for tpm2 bound luks - tpm2-tools - -# See https://github.com/coreos/bootupd -arch-include: - x86_64: bootupd.yaml - aarch64: bootupd.yaml diff --git a/fedora-bootc.yaml b/fedora-iot-bootc.yaml similarity index 61% rename from fedora-bootc.yaml rename to fedora-iot-bootc.yaml index 7067275..6ae5882 100644 --- a/fedora-bootc.yaml +++ b/fedora-iot-bootc.yaml @@ -1,13 +1,13 @@ releasever: rawhide variables: - distro: "fedora" + distro: "fedora-iot" repos: - fedora-rawhide metadata: - name: fedora-bootc - summary: Fedora base bootc image + name: fedora-iot-bootc-base + summary: Fedora IoT bootc base image include: - fedora-bootc-base/manifest.yaml From 91539fbf82555ede87f931277a090612a23c5680 Mon Sep 17 00:00:00 2001 From: David Jachimowicz Date: Fri, 15 Nov 2024 16:15:33 +0000 Subject: [PATCH 15/44] Update fedora-iot-base.yaml to sync with osbuild iot-commit Adds ssh-key-dir and ignition-edge packages to base yaml. ssh-key-dir is needed to transfer ssh keys to the iot system during boot and ignition-edge is needed to allow ssh-key-dir to work properly. Explicitly adds fedora-iot-config package. Was previously pulled in as a requirement, added for clarity. Adds fdo-owner-cli package to increase FDO functionality. These changes should help bring the package list more in line with the osbuild iot-commit, as well as rectifying issue 70 and issue 49 (relating to ssh key login and home directory creation on iot systems). Issue 70: https://github.com/fedora-iot/iot-distro/issues/70 Issue 49: https://github.com/fedora-iot/iot-distro/issues/49 Signed-off-by: djach7 --- fedora-iot-base.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 4c64cd1..e6358e3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -73,7 +73,11 @@ check-groups: type: file filename: group packages: +# This list of packages should be kept in sync with +# the iot-commit definition is osbuild, as found here: +# https://github.com/osbuild/images/blob/0584c20b0c14a89e833b875252114ceff61805e8/pkg/distro/fedora/package_sets.go#L123 - fedora-release-iot +- fedora-iot-config - aardvark-dns - atheros-firmware - attr @@ -105,6 +109,7 @@ packages: - e2fsprogs - efibootmgr - fdo-client +- fdo-owner-cli - firewalld - fwupd - fwupd-efi @@ -118,6 +123,7 @@ packages: - gzip - hostname - ignition +- ignition-edge - ima-evm-utils - iproute - iputils @@ -157,6 +163,7 @@ packages: - shadow-utils - skopeo - slirp4netns +- ssh-key-dir - sssd-client - sudo - systemd From c611d4da9615ec908287774382e88fcfaf9ff240 Mon Sep 17 00:00:00 2001 From: djach7 Date: Mon, 16 Dec 2024 14:58:43 -0500 Subject: [PATCH 16/44] Adds bootupd update to boot process Updates bootupd.yaml to enable bootupctl-update upon system boot. This allows bootupd to work as expected on Fedora IoT raw image systems, with all expected components installed. Signed-off-by: djach7 --- bootupd.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/bootupd.yaml b/bootupd.yaml index 3328d41..61a6a9a 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -11,3 +11,22 @@ postprocess: set -xeuo pipefail # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload /usr/bin/bootupctl backend generate-update-metadata + + # Trigger a bootloader update on boot + cat > /usr/lib/systemd/system/bootloader-update.service << 'EOF' + [Unit] + Description=Update bootloader on boot + Documentation=https://github.com/coreos/bootupd + ConditionFirmware=uefi + + [Service] + Type=oneshot + ExecStart=/usr/bin/bootupctl update + RemainAfterExit=yes + MountFlags=slave + + [Install] + WantedBy=multi-user.target + EOF + chmod 644 /usr/lib/systemd/system/bootloader-update.service + echo "enable bootloader-update.service" > /usr/lib/systemd/system-preset/81-iot.preset \ No newline at end of file From d6ec8e0b0e553a2ce129c21115f89d679b214641 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 4 Feb 2025 15:29:24 -0500 Subject: [PATCH 17/44] IoT: Update rawhide for F-43 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-42.repo => fedora-43.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-42.repo => fedora-43.repo (61%) diff --git a/config.ini b/config.ini index f7e27f5..f09325d 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f42 +release = f43 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-42.repo b/fedora-43.repo similarity index 61% rename from fedora-42.repo rename to fedora-43.repo index f9343b8..c510019 100644 --- a/fedora-42.repo +++ b/fedora-43.repo @@ -1,12 +1,12 @@ -[fedora-42] -name=Fedora 42 - $basearch +[fedora-43] +name=Fedora 43 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/42/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-42&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/43/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-43&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index e6358e3..11b35f3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -9,8 +9,8 @@ ima: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '42' -mutate-os-release: '42' +automatic_version_prefix: '43' +mutate-os-release: '43' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index f765bfe..2f1ddd3 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-42 +- fedora-43 From 625d7631959acac84ca8d6e9a9955c4cb3969a6e Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Fri, 7 Feb 2025 09:34:26 -0800 Subject: [PATCH 18/44] Replace basesystem with filesystem See https://src.fedoraproject.org/rpms/filesystem/c/3f741bf2a89c9e1bb685943c41fd298e6683dd50?branch=rawhide Signed-off-by: Adam Williamson --- fedora-iot-base.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 11b35f3..fc21de0 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -82,7 +82,6 @@ packages: - atheros-firmware - attr - authselect -- basesystem - bash - bash-completion - bootc @@ -110,6 +109,7 @@ packages: - efibootmgr - fdo-client - fdo-owner-cli +- filesystem - firewalld - fwupd - fwupd-efi From b799fe0c9d8bf09bcfa855b46599f60ecd190f17 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 18 Feb 2025 16:36:16 -0500 Subject: [PATCH 19/44] Remove Zezere and enable systemd-firstboot Remove Zezere and enable systemd-firstboot for local configuration. See: https://fedoraproject.org/wiki/Changes/Retire_Zezere Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index fc21de0..c61164b 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -179,7 +179,6 @@ packages: - wireless-regdb - xfsprogs - xz -- zezere-ignition - zram-generator - zram-generator-defaults packages-aarch64: @@ -200,6 +199,7 @@ units: - fedora-iot-config-remote-fix.service - firewalld.service - sshd.service +- systemd-firstboot.service - greenboot-grub2-set-counter.service - greenboot-grub2-set-success.service - greenboot-healthcheck.service @@ -208,5 +208,3 @@ units: - greenboot-task-runner.service - parsec.service - dbus-parsec.service -- zezere_ignition.timer -- zezere_ignition_banner.service From 17d9d31eb8216fc0ac4d1def372acae86bd4802d Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 18 Feb 2025 16:38:44 -0500 Subject: [PATCH 20/44] Drop parsec no longer supported upstream Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index c61164b..58d3480 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -99,7 +99,6 @@ packages: - criu-libs - cryptsetup - curl -- dbus-parsec - dnf5 - dnf5-plugins - dosfstools @@ -146,7 +145,6 @@ packages: - openssh-server - passt - passt-selinux -- parsec - pinentry - podman - policycoreutils @@ -206,5 +204,3 @@ units: - greenboot-rpm-ostree-grub2-check-fallback.service - greenboot-status.service - greenboot-task-runner.service -- parsec.service -- dbus-parsec.service From ce25ead8e58f35271963d19c792827de443ae869 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 19 Feb 2025 15:34:27 +0000 Subject: [PATCH 21/44] drop policycoreutils-python-utils in base The policycoreutils-python-utils pulls in a bunch of extra SELinux utils which aren't used in day to day, it pulls in a bunch of python packages, it can easily be layered and isn't generally needed. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 58d3480..c5071fa 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -148,7 +148,6 @@ packages: - pinentry - podman - policycoreutils -- policycoreutils-python-utils - polkit - procps-ng - realtek-firmware From b3fd2930a9249c25e94eb32bbe9dbdfc8843e254 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 24 Feb 2025 10:43:18 -0500 Subject: [PATCH 22/44] Disable ima in ostree due to ongoing compose issues See: https://bugzilla.redhat.com/show_bug.cgi?id=2346265 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index c5071fa..62a22bc 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -5,7 +5,6 @@ include: ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true -ima: true tmp-is-dir: true recommends: false documentation: false From a6e7212b561662f8ce507e51dd95ddc354785b45 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 27 Feb 2025 10:58:35 -0500 Subject: [PATCH 23/44] Migrate systems to a static GRUB config See: https://pagure.io/workstation-ostree-config/pull-request/591 https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops Signed-off-by: Paul Whalen --- bootupd.yaml | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-) diff --git a/bootupd.yaml b/bootupd.yaml index 61a6a9a..857de65 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -9,24 +9,18 @@ postprocess: - | #!/bin/bash set -xeuo pipefail + # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload /usr/bin/bootupctl backend generate-update-metadata - - # Trigger a bootloader update on boot - cat > /usr/lib/systemd/system/bootloader-update.service << 'EOF' - [Unit] - Description=Update bootloader on boot - Documentation=https://github.com/coreos/bootupd - ConditionFirmware=uefi - + + # Enable migration to a static GRUB config + install -dm0755 /usr/lib/systemd/system/bootloader-update.service.d + cat > /usr/lib/systemd/system/bootloader-update.service.d/migrate-static-grub-config.conf << 'EOF' [Service] - Type=oneshot - ExecStart=/usr/bin/bootupctl update - RemainAfterExit=yes - MountFlags=slave - - [Install] - WantedBy=multi-user.target + ExecStart=/usr/bin/bootupctl migrate-static-grub-config EOF - chmod 644 /usr/lib/systemd/system/bootloader-update.service - echo "enable bootloader-update.service" > /usr/lib/systemd/system-preset/81-iot.preset \ No newline at end of file + + echo "enable bootloader-update.service" >> /usr/lib/systemd/system-preset/80-iot.preset + + # Turn permissive mode on for bootupd until all SELinux issues are fixed + semanage permissive --noreload --add bootupd_t From c739a8c05ac86fd6f8b8091e9268e22561eb6a2d Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 27 Feb 2025 11:02:20 -0500 Subject: [PATCH 24/44] Enable composefs by default See: https://pagure.io/workstation-ostree-config/pull-request/591 https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops Signed-off-by: Paul Whalen --- composefs.yaml | 12 ++++++++++++ fedora-iot-base.yaml | 2 ++ 2 files changed, 14 insertions(+) create mode 100644 composefs.yaml diff --git a/composefs.yaml b/composefs.yaml new file mode 100644 index 0000000..8a721f3 --- /dev/null +++ b/composefs.yaml @@ -0,0 +1,12 @@ +# Enable composefs +# See: https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops +# https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' + [composefs] + enabled = yes + EOF diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 62a22bc..03e21c3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,6 +2,8 @@ include: - bootupd.yaml # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - grub2-workaround.yaml + # Enable composefs + - composefs.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true From 6529ca201d34fc21b338722c97fcccddb5e4ea42 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 27 Feb 2025 14:40:52 +0000 Subject: [PATCH 25/44] iot: drop kernel-tools It too should be layered, not included in the base image. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 03e21c3..11e982f 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -130,7 +130,6 @@ packages: - iwd - iwlwifi-mvm-firmware - kernel -- kernel-tools - keyutils - less - libsss_sudo From 2fda060e855080cb329c5d637a7dfca68e8e8999 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 6 Mar 2025 14:02:39 -0500 Subject: [PATCH 26/44] Remove grub2-workaround Remove grub2-workaround, bug has been fixed. See: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 -- grub2-workaround.yaml | 22 ---------------------- 2 files changed, 24 deletions(-) delete mode 100644 grub2-workaround.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 11e982f..1c13f3f 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,7 +1,5 @@ include: - bootupd.yaml - # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - - grub2-workaround.yaml # Enable composefs - composefs.yaml ref: fedora/rawhide/${basearch}/iot diff --git a/grub2-workaround.yaml b/grub2-workaround.yaml deleted file mode 100644 index 3b58a9e..0000000 --- a/grub2-workaround.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# Temporarily disable new GRUB2 config options until we can ensure that we -# have an updated bootloader via bootupd. -# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 -# See: https://github.com/fedora-silverblue/issue-tracker/issues/587 -postprocess: - - | - #!/usr/bin/env bash - set -xeuo pipefail - - # Completely disable this module - sed -i '2i exit 0' /etc/grub.d/25_bli - - # Skip check that was not performed in previous Fedora versions - sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware - sed -i '/\tif/d' /etc/grub.d/30_uefi-firmware - sed -i '/\tfi/d' /etc/grub.d/30_uefi-firmware - sed -i 's/\t\t/\t/' /etc/grub.d/30_uefi-firmware - - # Verify that the content matches what we expect the file to look like. - # This will fail the build here instead of breaking users' systems. - hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b" - echo "$hash /etc/grub.d/30_uefi-firmware" | sha256sum -c From 6b92bbcbbc38b5c50cebf01c1f78115376949789 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Fri, 7 Mar 2025 13:49:18 +0100 Subject: [PATCH 27/44] Remove fedora-bootc-base Now moved to https://github.com/fedora-iot/fedora-iot-bootc --- fedora-bootc-base/basic-fixes.yaml | 29 -------- fedora-bootc-base/bootc-config.yaml | 0 fedora-bootc-base/bootc.yaml | 16 ----- fedora-bootc-base/bootupd.yaml | 31 -------- fedora-bootc-base/group | 46 ------------ fedora-bootc-base/grub2-removals.yaml | 8 --- fedora-bootc-base/initramfs.yaml | 24 ------- fedora-bootc-base/iot.yaml | 100 -------------------------- fedora-bootc-base/kernel.yaml | 6 -- fedora-bootc-base/manifest.yaml | 65 ----------------- fedora-bootc-base/ostree.yaml | 17 ----- fedora-bootc-base/passwd | 32 --------- 12 files changed, 374 deletions(-) delete mode 100644 fedora-bootc-base/basic-fixes.yaml delete mode 100644 fedora-bootc-base/bootc-config.yaml delete mode 100644 fedora-bootc-base/bootc.yaml delete mode 100644 fedora-bootc-base/bootupd.yaml delete mode 100644 fedora-bootc-base/group delete mode 100644 fedora-bootc-base/grub2-removals.yaml delete mode 100644 fedora-bootc-base/initramfs.yaml delete mode 100644 fedora-bootc-base/iot.yaml delete mode 100644 fedora-bootc-base/kernel.yaml delete mode 100644 fedora-bootc-base/manifest.yaml delete mode 100644 fedora-bootc-base/ostree.yaml delete mode 100644 fedora-bootc-base/passwd diff --git a/fedora-bootc-base/basic-fixes.yaml b/fedora-bootc-base/basic-fixes.yaml deleted file mode 100644 index d9fe059..0000000 --- a/fedora-bootc-base/basic-fixes.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# Fix general bugs - -postprocess: - # See also https://github.com/openshift/os/blob/f6cde963ee140c02364674db378b2bc4ac42675b/common.yaml#L156 - # This one is undoes the effect of - # # RHEL-only: Disable /tmp on tmpfs. - #Wants=tmp.mount - # in /usr/lib/systemd/system/basic.target - # We absolutely must have tmpfs-on-tmp for multiple reasons, - # but the biggest is that when we have composefs for / it's read-only, - # and for units with ProtectSystem=full systemd clones / but needs - # a writable place. - - | - #!/usr/bin/env bash - set -xeuo pipefail - mkdir -p /usr/lib/systemd/system/local-fs.target.wants - if test '!' -f /usr/lib/systemd/system/local-fs.target.wants/tmp.mount; then - ln -sf ../tmp.mount /usr/lib/systemd/system/local-fs.target.wants - fi - - # See https://github.com/containers/bootc/issues/358 - # basically systemd-tmpfiles doesn't follow symlinks; ordinarily our - # tmpfiles.d unit for `/var/roothome` is fine, but this actually doesn't - # work if we want to use tmpfiles.d to write to `/root/.ssh` because - # tmpfiles gives up on that before getting to `/var/roothome`. - sed -ie 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf - # Because /var/roothome is also defined in rpm-ostree-0-integration.conf - # we need to delete /var/roothome - sed -ie '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml deleted file mode 100644 index d44ee08..0000000 --- a/fedora-bootc-base/bootc.yaml +++ /dev/null @@ -1,16 +0,0 @@ -# The bootc components. -packages: - - systemd - - bootc - # bootc pulls in podman, which pulls in containers-common, which wants - # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name - # iptables-nft instead to satisfy it. - - iptables-nft - # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk - - gdisk xfsprogs e2fsprogs dosfstools - -exclude-packages: - # Exclude kernel-debug-core to make sure that it doesn't somehow get - # chosen as the package to satisfy the `kernel-core` dependency from - # the kernel package. - - kernel-debug-core diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml deleted file mode 100644 index cc83d20..0000000 --- a/fedora-bootc-base/bootupd.yaml +++ /dev/null @@ -1,31 +0,0 @@ -# Integration with https://github.com/coreos/bootupd and bootloader logic -# xref https://github.com/coreos/fedora-coreos-tracker/issues/510 -packages: - - bootupd - -# bootloader -packages-aarch64: - - grub2-efi-aa64 efibootmgr shim -packages-ppc64le: - - grub2 ostree-grub2 -packages-s390x: - # On Fedora, this is provided by s390utils-core. on RHEL, this is for now - # provided by s390utils-base, but soon will be -core too. - - /usr/sbin/zipl -packages-x86_64: - - grub2-efi-x64 efibootmgr shim - - microcode_ctl - -conditional-include: - - if: basearch != "s390x" - # And remove some cruft from grub2 - include: grub2-removals.yaml - -postprocess: - - | - #!/bin/bash - set -xeuo pipefail - # Until we have https://github.com/coreos/rpm-ostree/pull/2275 - mkdir -p /run - # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload - /usr/bin/bootupctl backend generate-update-metadata diff --git a/fedora-bootc-base/group b/fedora-bootc-base/group deleted file mode 100644 index 2fd197c..0000000 --- a/fedora-bootc-base/group +++ /dev/null @@ -1,46 +0,0 @@ -root:x:0: -bin:x:1: -daemon:x:2: -sys:x:3: -adm:x:4: -tty:x:5: -disk:x:6: -lp:x:7: -mem:x:8: -kmem:x:9: -wheel:x:10: -cdrom:x:11: -mail:x:12: -man:x:15: -sudo:x:16: -dialout:x:18: -floppy:x:19: -games:x:20: -tape:x:33: -video:x:39: -ftp:x:50: -lock:x:54: -audio:x:63: -nobody:x:99: -users:x:100: -ssh_keys:x:999: -systemd-journal:x:190: -polkitd:x:998: -etcd:x:997: -dip:x:40: -cgred:x:996: -avahi-autoipd:x:170: -sssd:x:993: -dockerroot:x:986: -rpcuser:x:29: -nfsnobody:x:65534: -kube:x:994: -chrony:x:992: -tcpdump:x:72: -ceph:x:167: -input:x:104: -systemd-timesync:x:991: -systemd-network:x:990: -systemd-resolve:x:989: -systemd-bus-proxy:x:988: -cockpit-ws:x:987: diff --git a/fedora-bootc-base/grub2-removals.yaml b/fedora-bootc-base/grub2-removals.yaml deleted file mode 100644 index f4800dd..0000000 --- a/fedora-bootc-base/grub2-removals.yaml +++ /dev/null @@ -1,8 +0,0 @@ -remove-from-packages: - # The grub bits are mainly designed for desktops, and IMO haven't seen - # enough testing in concert with ostree. At some point we'll flesh out - # the full plan in https://github.com/coreos/fedora-coreos-tracker/issues/47 - - [grub2-tools, /etc/grub.d/08_fallback_counting, - /etc/grub.d/10_reset_boot_success, - /etc/grub.d/12_menu_auto_hide, - /usr/lib/systemd/.*] diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml deleted file mode 100644 index fe4bbeb..0000000 --- a/fedora-bootc-base/initramfs.yaml +++ /dev/null @@ -1,24 +0,0 @@ -# Configuration for the initramfs -postprocess: - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/dracut/dracut.conf.d - cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' - # We want a generic image; hostonly makes no sense as part of a server side build - hostonly=no - add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " - EOF - cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' - # Extra modules that we want by default that are known to exist in the kernel - add_dracutmodules+=" virtiofs " - EOF - cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' - # We want this for systemd-cryptsetup tpm2 locking - add_dracutmodules+=" tpm2-tss " - EOF - cat > /usr/lib/dracut/dracut.conf.d/59-altfiles.conf << 'EOF' - # https://issues.redhat.com/browse/RHEL-49590 - # On image mode systems we use nss-altfiles for passwd and group, - # this makes sure dracut uses them which also fixes kdump writing to NFS. - install_items+=" /usr/lib/passwd /usr/lib/group " - EOF diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml deleted file mode 100644 index 611ff9a..0000000 --- a/fedora-bootc-base/iot.yaml +++ /dev/null @@ -1,100 +0,0 @@ -# Fedora IoT specific packages -packages: - - fedora-release-iot - - aardvark-dns - - atheros-firmware - - attr - - authselect - - basesystem - - bash - - bash-completion - - brcmfmac-firmware - - chrony - - clevis - - clevis-dracut - - clevis-luks - - clevis-pin-tpm2 - - containernetworking-plugins - - coreutils - - cracklib-dicts - - criu - - criu-libs - - cryptsetup - - curl - - dbus-parsec - - dnf5-plugins - - dracut-config-generic - - dracut-network - - efibootmgr - - fdo-client - - firewalld - - fwupd - - fwupd-efi - - fwupd-plugin-modem-manager - - fwupd-plugin-uefi-capsule-data - - glibc - - glibc-minimal-langpack - - gnupg2 - - greenboot - - greenboot-default-health-checks - - gzip - - hostname - - ignition - - ima-evm-utils - - iproute - - iputils - - iwd - - iwlwifi-mvm-firmware - - kernel-tools - - keyutils - - less - - libsss_sudo - - linux-firmware - - lvm2 - - netavark - - NetworkManager - - NetworkManager-wifi - - NetworkManager-wwan - - nss-altfiles - - openssl - - openssh-clients - - openssh-server - - passt - - passt-selinux - - parsec - - pinentry - - podman - - policycoreutils - - policycoreutils-python-utils - - polkit - - procps-ng - - realtek-firmware - - rootfiles - - rpm - - screen - - setools-console - - setup - - shadow-utils - - skopeo - - slirp4netns - - sssd-client - - sudo - - systemd-resolved - - tar - - tmux - - tpm2-pkcs11 - - traceroute - - usbguard - - util-linux - - vim-minimal - - wpa_supplicant - - wireless-regdb - - xz - - zezere-ignition - - zram-generator - - zram-generator-defaults -packages-aarch64: - - arm-image-installer - - bcm283x-firmware - - optee_client - - uboot-images-armv8 diff --git a/fedora-bootc-base/kernel.yaml b/fedora-bootc-base/kernel.yaml deleted file mode 100644 index 0dd777d..0000000 --- a/fedora-bootc-base/kernel.yaml +++ /dev/null @@ -1,6 +0,0 @@ -# Enable the Linux kernel; see also kernel-rt. -packages: - - kernel - -exclude-packages: - - kernel-debug diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml deleted file mode 100644 index 9a21ff3..0000000 --- a/fedora-bootc-base/manifest.yaml +++ /dev/null @@ -1,65 +0,0 @@ - -# Modern defaults we want -boot-location: modules -tmp-is-dir: true -# https://github.com/CentOS/centos-bootc/issues/167 -machineid-compat: true -# Be minimal -recommends: false - -ignore-removed-users: - - root -ignore-removed-groups: - - root -etc-group-members: - - wheel - - sudo - - systemd-journal - - adm - -# Default to `bash` in our container, the same as other containers we ship. -container-cmd: - - /sbin/init - -# Note that the default for c9s+ is sqlite; we can't rely on rpm being -# in the target (it isn't in tier-0!) so turn this to host here. This -# does break the "hermetic build" aspect a bit. Maybe eventually -# what we should do is special case this and actually install RPM temporarily -# and then remove it... -rpmdb: host - -check-passwd: - type: "file" - filename: "passwd" -check-groups: - type: "file" - filename: "group" - -automatic-version-prefix: "${releasever}." -mutate-os-release: "${releasever}" - -remove-from-packages: - # Generally we expect other tools to do this (e.g. Ignition or cloud-init) - - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service] - # We don't want auto-generated mount units. See also - # https://github.com/systemd/systemd/issues/13099 - - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator] - -include: - - bootc.yaml - - bootupd.yaml - - ostree.yaml - - initramfs.yaml - - basic-fixes.yaml - - iot.yaml - -packages: - # needed for building derived container images - - dnf5 - # Even in tier-0, we have this. If you don't want SELinux today, you'll need - # to build a custom image. - - selinux-policy-targeted - # And we want container-selinux because trying to layer it on later currently causes issues. - - container-selinux - # Needed for tpm2 bound luks - - tpm2-tools diff --git a/fedora-bootc-base/ostree.yaml b/fedora-bootc-base/ostree.yaml deleted file mode 100644 index 6f30861..0000000 --- a/fedora-bootc-base/ostree.yaml +++ /dev/null @@ -1,17 +0,0 @@ -packages: - - ostree nss-altfiles - -# We want content lifecycled with the image -opt-usrlocal: "root" - -postprocess: - # Set up default root config - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/ostree - cat > /usr/lib/ostree/prepare-root.conf << EOF - [composefs] - enabled = yes - [sysroot] - readonly = true - EOF diff --git a/fedora-bootc-base/passwd b/fedora-bootc-base/passwd deleted file mode 100644 index ea84802..0000000 --- a/fedora-bootc-base/passwd +++ /dev/null @@ -1,32 +0,0 @@ -adm:x:3:4:adm:/var/adm:/usr/sbin/nologin -avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin -bin:x:1:1:bin:/bin:/usr/sbin/nologin -ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin -chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin -cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin -daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin -dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin -dockerroot:x:997:986:Docker User:/var/lib/docker:/usr/sbin/nologin -etcd:x:998:997:etcd user:/var/lib/etcd:/usr/sbin/nologin -ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin -games:x:12:100:games:/usr/games:/usr/sbin/nologin -halt:x:7:0:halt:/sbin:/sbin/halt -kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin -lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin -mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin -nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin -nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin -operator:x:11:0:operator:/root:/usr/sbin/nologin -polkitd:x:999:998:User for polkitd:/:/usr/sbin/nologin -root:x:0:0:Super User:/root:/bin/bash -rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin -rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin -shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown -sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin -sssd:x:995:993:User for sssd:/:/usr/sbin/nologin -sync:x:5:0:sync:/sbin:/bin/sync -systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin -systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin -systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin -systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin -tcpdump:x:72:72::/:/usr/sbin/nologin From e4bd292f1ab6ea63403b99efbe82e9c7fb47b602 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 19 Feb 2025 19:07:22 +0100 Subject: [PATCH 28/44] Whitespace & indentation cleanup --- bootupd.yaml | 4 ++-- fedora-iot.yaml | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/bootupd.yaml b/bootupd.yaml index 857de65..e15c48a 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,7 +1,7 @@ # KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml # See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml # -#Integration with https://github.com/coreos/bootupd +# Integration with https://github.com/coreos/bootupd packages: - bootupd @@ -12,7 +12,7 @@ postprocess: # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload /usr/bin/bootupctl backend generate-update-metadata - + # Enable migration to a static GRUB config install -dm0755 /usr/lib/systemd/system/bootloader-update.service.d cat > /usr/lib/systemd/system/bootloader-update.service.d/migrate-static-grub-config.conf << 'EOF' diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 2f1ddd3..7f39e3e 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,5 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot + repos: - fedora-43 From ce81f37ea5a7419a16eb03343c553129a96964c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 19 Feb 2025 19:07:37 +0100 Subject: [PATCH 29/44] ci: Add a script to help validate manifest syntax --- ci/validate | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100755 ci/validate diff --git a/ci/validate b/ci/validate new file mode 100755 index 0000000..c9e6a32 --- /dev/null +++ b/ci/validate @@ -0,0 +1,57 @@ +#!/usr/bin/python3 +# Validate basic syntax of shell script and yaml. + +import os +import stat +import subprocess +import yaml + +validated=0 + +def openat(dirfd, name, mode='r'): + def opener(path, flags): + return os.open(path, flags, dir_fd=dirfd) + return open(name, mode, opener=opener) + + +def validate_shell(rootfd, name): + subprocess.check_call(['bash', '-n', name], preexec_fn=lambda: os.fchdir(rootfd)) + global validated + validated +=1 + + +for root, dirs, files, rootfd in os.fwalk('.'): + # Skip folders that do not include content to validate + for d in ['.git', '.github', 'repo', 'cache', 'tmp', 'logs', 'fedora-comps']: + if d in dirs: + dirs.remove(d) + for f in ['.gitlab-ci.yml']: + if f in files: + files.remove(f) + for name in files: + if name.endswith(('.yaml', '.yml')): + print("Validating:", name) + with open(os.open(name, dir_fd=rootfd, flags=os.O_RDONLY)) as f: + yaml.safe_load(f) + result = subprocess.run(['grep', '-RniEv', '^( )*[a-z#/-]|^( )*\\[|^$|^#', name], encoding='UTF-8', + preexec_fn=lambda: os.fchdir(rootfd)) + if result.returncode == 0: + raise Exception("Found likely invalid indentation in YAML file: {}".format(name)) + validated +=1 + continue + elif name.endswith('.sh'): + print("Validating:", name) + validate_shell(rootfd, name) + continue + stbuf = os.lstat(name, dir_fd=rootfd) + if not stat.S_ISREG(stbuf.st_mode): + continue + if not stbuf.st_mode & stat.S_IXUSR: + continue + mimetype = subprocess.check_output(['file', '-b', '--mime-type', name], encoding='UTF-8', + preexec_fn=lambda: os.fchdir(rootfd)).strip() + if mimetype == 'text/x-shellscript': + print("Validating:", name) + validate_shell(rootfd, name) + +print(f"Validated {validated} files") From 465d88c040cc3f40e1967479f23aee90d84c0dde Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 19 Feb 2025 19:07:56 +0100 Subject: [PATCH 30/44] Add a justfile with common commands --- justfile | 156 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 156 insertions(+) create mode 100644 justfile diff --git a/justfile b/justfile new file mode 100644 index 0000000..313ea6c --- /dev/null +++ b/justfile @@ -0,0 +1,156 @@ +# This is a justfile. See https://github.com/casey/just +# This is only used for local development. The builds made on the Fedora +# infrastructure are run via Pungi in a Koji runroot. + +# Set a default for some recipes +default_variant := "fedora-iot" +default_arch := "default" +# Current default in Pungi +force_nocache := "true" + +# Just doesn't have a native dict type, but quoted bash dictionary works fine +pretty_names := '( + [fedora-iot]="IoT" +)' + +# Default is to only validate the manifests +all: validate + +# Basic validation to make sure the manifests are not completely broken +validate: + ./ci/validate + +# Output the processed manifest for a given variant (defaults to Silverblue) +manifest variant=default_variant: + #!/bin/bash + set -euo pipefail + + rpm-ostree compose tree --print-only --repo=repo {{variant}}.yaml + +# Perform dependency resolution for a given variant (defaults to Silverblue) +compose-dry-run variant=default_variant: + #!/bin/bash + set -euxo pipefail + + mkdir -p repo cache logs + if [[ ! -f "repo/config" ]]; then + pushd repo > /dev/null || exit 1 + ostree init --repo . --mode=bare-user + popd > /dev/null || exit 1 + fi + + rpm-ostree compose tree --unified-core --repo=repo --dry-run {{variant}}.yaml + +# Alias/shortcut for compose-image command +compose variant=default_variant: (compose-image variant) + +# Compose a variant using the legacy non container path (defaults to Silverblue) +compose-legacy variant=default_variant: + #!/bin/bash + set -euxo pipefail + + declare -A pretty_names={{pretty_names}} + variant={{variant}} + variant_pretty=${pretty_names[$variant]-} + if [[ -z $variant_pretty ]]; then + echo "Unknown variant" + exit 1 + fi + + ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1) + + mkdir -p repo cache logs + if [[ ! -f "repo/config" ]]; then + pushd repo > /dev/null || exit 1 + ostree init --repo . --mode=bare-user + popd > /dev/null || exit 1 + fi + # Set option to reduce fsync for transient builds + ostree --repo=repo config set 'core.fsync' 'false' + + buildid="$(date '+%Y%m%d.0')" + timestamp="$(date --iso-8601=sec)" + echo "${buildid}" > .buildid + + version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')" + echo "Composing ${variant_pretty} ${version}.${buildid} ..." + + ARGS="--repo=repo --cachedir=cache" + ARGS+=" --unified-core" + if [[ {{force_nocache}} == "true" ]]; then + ARGS+=" --force-nocache" + fi + CMD="rpm-ostree" + if [[ ${EUID} -ne 0 ]]; then + CMD="sudo rpm-ostree" + fi + + ${CMD} compose tree ${ARGS} \ + --add-metadata-string="version=${variant_pretty} ${version}.${buildid}" \ + "${variant}-ostree.yaml" \ + |& tee "logs/${variant}_${version}_${buildid}.${timestamp}.log" + + if [[ ${EUID} -ne 0 ]]; then + sudo chown --recursive "$(id --user --name):$(id --group --name)" repo cache + fi + + ostree summary --repo=repo --update + +# Compose an Ostree Native Container OCI image +compose-image variant=default_variant: + #!/bin/bash + set -euxo pipefail + + declare -A pretty_names={{pretty_names}} + variant={{variant}} + variant_pretty=${pretty_names[$variant]-} + if [[ -z $variant_pretty ]]; then + echo "Unknown variant" + exit 1 + fi + + ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1) + + mkdir -p repo cache + if [[ ! -f "repo/config" ]]; then + pushd repo > /dev/null || exit 1 + ostree init --repo . --mode=bare-user + popd > /dev/null || exit 1 + fi + # Set option to reduce fsync for transient builds + ostree --repo=repo config set 'core.fsync' 'false' + + buildid="$(date '+%Y%m%d.0')" + timestamp="$(date --iso-8601=sec)" + echo "${buildid}" > .buildid + + version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')" + echo "Composing ${variant_pretty} ${version}.${buildid} ..." + + ARGS="--cachedir=cache --initialize" + if [[ {{force_nocache}} == "true" ]]; then + ARGS+=" --force-nocache" + fi + # To debug with gdb, use: gdb --args ... + CMD="rpm-ostree" + if [[ ${EUID} -ne 0 ]]; then + CMD="sudo rpm-ostree" + fi + + ${CMD} compose image ${ARGS} \ + --label="quay.expires-after=4w" \ + "${variant}.yaml" \ + "${variant}.ociarchive" + +# Clean up everything +clean-all: + just clean-repo + just clean-cache + +# Only clean the ostree repo +clean-repo: + rm -rf ./repo + +# Only clean the package and repo caches +clean-cache: + rm -rf ./cache From c7f2ffe7cb170e0ae1180f2a10442b0718d622a2 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 17 Mar 2025 13:19:32 -0400 Subject: [PATCH 31/44] Default root config to mount sysroot as read only See: https://github.com/fedora-iot/iot-distro/issues/81 https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 ++ sysroot-ro.yaml | 15 +++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 sysroot-ro.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 1c13f3f..08e92cf 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,6 +2,8 @@ include: - bootupd.yaml # Enable composefs - composefs.yaml + # Read only sysroot + - sysroot-ro.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/sysroot-ro.yaml b/sysroot-ro.yaml new file mode 100644 index 0000000..8214f05 --- /dev/null +++ b/sysroot-ro.yaml @@ -0,0 +1,15 @@ +# Set up default root config to mount sysroot as read only +# https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot +# See: https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml +# See: https://github.com/fedora-iot/iot-distro/issues/81 + +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + install -dm 0755 -o 0 -g 0 /usr/lib/ostree + cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' + [sysroot] + readonly = true + EOF From cc96761b139c82ffa91d8271e223e2318aa78361 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 11 Aug 2025 14:25:38 -0400 Subject: [PATCH 32/44] IoT: Update rawhide for F-44 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-43.repo => fedora-44.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-43.repo => fedora-44.repo (61%) diff --git a/config.ini b/config.ini index f09325d..4dbcdf5 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f43 +release = f44 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-43.repo b/fedora-44.repo similarity index 61% rename from fedora-43.repo rename to fedora-44.repo index c510019..99cde87 100644 --- a/fedora-43.repo +++ b/fedora-44.repo @@ -1,12 +1,12 @@ -[fedora-43] -name=Fedora 43 - $basearch +[fedora-44] +name=Fedora 44 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/43/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-43&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/44/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-44&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 08e92cf..2172526 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -10,8 +10,8 @@ selinux: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '43' -mutate-os-release: '43' +automatic_version_prefix: '44' +mutate-os-release: '44' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 7f39e3e..8da9960 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -2,4 +2,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-43 +- fedora-44 From fc7be035129cd2246053197056b0dedd3de25551 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 4 Feb 2026 11:07:52 -0500 Subject: [PATCH 33/44] fix: drop ssh-key-dir Package has been deprecated in F44. See: https://github.com/coreos/ssh-key-dir/issues/188 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 2172526..116e78f 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -160,7 +160,6 @@ packages: - shadow-utils - skopeo - slirp4netns -- ssh-key-dir - sssd-client - sudo - systemd From dccd3a2e18cbe1c3e7ae121cdd738e61693043f4 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 6 Feb 2026 11:22:08 -0500 Subject: [PATCH 34/44] IoT: Update rawhide for F-45 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-44.repo => fedora-45.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-44.repo => fedora-45.repo (61%) diff --git a/config.ini b/config.ini index 4dbcdf5..2e7f7da 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f44 +release = f45 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-44.repo b/fedora-45.repo similarity index 61% rename from fedora-44.repo rename to fedora-45.repo index 99cde87..85e6dd9 100644 --- a/fedora-44.repo +++ b/fedora-45.repo @@ -1,12 +1,12 @@ -[fedora-44] -name=Fedora 44 - $basearch +[fedora-45] +name=Fedora 45 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/44/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-44&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/45/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-45&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-45-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 116e78f..6178ec3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -10,8 +10,8 @@ selinux: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '44' -mutate-os-release: '44' +automatic_version_prefix: '45' +mutate-os-release: '45' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 8da9960..4e3caeb 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -2,4 +2,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-44 +- fedora-45 From 240bff70e742b6916271144f9d61ca79bc98f24b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 10 Feb 2026 15:44:02 -0500 Subject: [PATCH 35/44] fix: add systemd-pam to fix rootless podman In Fedora 44 systemd changed systemd-pam to recommends and it was dropped from the compose. See: https://github.com/fedora-iot/iot-distro/issues/127 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 6178ec3..d159307 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -163,6 +163,7 @@ packages: - sssd-client - sudo - systemd +- systemd-pam - systemd-resolved - tar - tmux From e0898e8a38c5b9a5a9bc848bdd5cb1d6e51b600b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 15:36:39 -0500 Subject: [PATCH 36/44] fix: restore SSH key management for Ignition Configures OpenSSH to read keys from ~/.ssh/authorized_keys.d/* in addition to authorized_keys, restoring functionality lost when ssh-key-dir was removed. Follows the same approach as CoreOS: https://github.com/coreos/fedora-coreos-config/pull/3885 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 +++- sshd-authorized-keys.yaml | 21 +++++++++++++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 sshd-authorized-keys.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index d159307..329fac2 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,9 +1,11 @@ -include: +include: - bootupd.yaml # Enable composefs - composefs.yaml # Read only sysroot - sysroot-ro.yaml + # SSH authorized keys configuration for Ignition + - sshd-authorized-keys.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml new file mode 100644 index 0000000..07657bc --- /dev/null +++ b/sshd-authorized-keys.yaml @@ -0,0 +1,21 @@ +# Configuration to have OpenSSH read authorized keys from files in +# ~/.ssh/authorized_keys.d/* in addition to ~/.ssh/authorized_keys +# This enables Ignition to write keys to authorized_keys.d/ignition +# +# Replaces the deprecated ssh-key-dir package +# See: https://github.com/coreos/ssh-key-dir/issues/188 +# See: https://github.com/coreos/fedora-coreos-config/pull/3885 + +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + # Create sshd config directory if it doesn't exist + install -dm 0755 -o 0 -g 0 /etc/ssh/sshd_config.d + + # Configure sshd to read keys from authorized_keys.d directory + cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' + # Also accept keys configured by Ignition and Afterburn + AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* + EOF From 7a121ed5e79b27529a6adaa3467b3c7f97e2d1ce Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 15:52:24 -0500 Subject: [PATCH 37/44] fix: do not create etc/ssh/sshd_config.d Do not create etc/ssh/sshd_config.d, it should already exist and is owned by openssh-clients and systemd. Signed-off-by: Paul Whalen --- sshd-authorized-keys.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml index 07657bc..600321f 100644 --- a/sshd-authorized-keys.yaml +++ b/sshd-authorized-keys.yaml @@ -11,9 +11,6 @@ postprocess: #!/usr/bin/env bash set -xeuo pipefail - # Create sshd config directory if it doesn't exist - install -dm 0755 -o 0 -g 0 /etc/ssh/sshd_config.d - # Configure sshd to read keys from authorized_keys.d directory cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' # Also accept keys configured by Ignition and Afterburn From 1b3ede31d963d32f8789f6e7393d4cd19bfe60a0 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 17:04:31 -0500 Subject: [PATCH 38/44] fix: use 90- prefix for authorized-keys-file.conf Updates the config file numbering to ensure crypto policies(40) and security configs(50) are applied before user keys are sourced. Signed-off-by: Paul Whalen --- sshd-authorized-keys.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml index 600321f..4080a64 100644 --- a/sshd-authorized-keys.yaml +++ b/sshd-authorized-keys.yaml @@ -12,7 +12,7 @@ postprocess: set -xeuo pipefail # Configure sshd to read keys from authorized_keys.d directory - cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' + cat > /etc/ssh/sshd_config.d/90-authorized-keys-file.conf << 'EOF' # Also accept keys configured by Ignition and Afterburn AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* EOF From e49d841a842753be9b7d3ff0fd5dabdf38cda6f6 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 26 Feb 2026 15:07:19 -0500 Subject: [PATCH 39/44] fix: drop sshd-authorized-keys workaround Openssh config snippet now shipped with ignition. See: https://src.fedoraproject.org/rpms/ignition/pull-request/143 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 -- sshd-authorized-keys.yaml | 18 ------------------ 2 files changed, 20 deletions(-) delete mode 100644 sshd-authorized-keys.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 329fac2..ed81137 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -4,8 +4,6 @@ include: - composefs.yaml # Read only sysroot - sysroot-ro.yaml - # SSH authorized keys configuration for Ignition - - sshd-authorized-keys.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml deleted file mode 100644 index 4080a64..0000000 --- a/sshd-authorized-keys.yaml +++ /dev/null @@ -1,18 +0,0 @@ -# Configuration to have OpenSSH read authorized keys from files in -# ~/.ssh/authorized_keys.d/* in addition to ~/.ssh/authorized_keys -# This enables Ignition to write keys to authorized_keys.d/ignition -# -# Replaces the deprecated ssh-key-dir package -# See: https://github.com/coreos/ssh-key-dir/issues/188 -# See: https://github.com/coreos/fedora-coreos-config/pull/3885 - -postprocess: - - | - #!/usr/bin/env bash - set -xeuo pipefail - - # Configure sshd to read keys from authorized_keys.d directory - cat > /etc/ssh/sshd_config.d/90-authorized-keys-file.conf << 'EOF' - # Also accept keys configured by Ignition and Afterburn - AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* - EOF From ce421037460b975d95281855fb2ae9f027eba285 Mon Sep 17 00:00:00 2001 From: Joel Capitao Date: Thu, 12 Mar 2026 09:44:22 +0100 Subject: [PATCH 40/44] Remove ignition package Since [1], the ignition-edge subpackage requires ignition, so it's no longer needed to require ignition explicitly here. [1] https://src.fedoraproject.org/rpms/ignition/c/3ccce9fe2c0462f4a17923937933ab9c26db0aa5?branch=rawhide --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index ed81137..fc454fd 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -122,7 +122,6 @@ packages: - greenboot-default-health-checks - gzip - hostname -- ignition - ignition-edge - ima-evm-utils - iproute From 3738d4889fe646799213cd552c01421b5611a84f Mon Sep 17 00:00:00 2001 From: Kenneth Giusti Date: Mon, 15 Jun 2026 12:56:47 -0400 Subject: [PATCH 41/44] fix: use kmscon as default VT console The kernel console fbcon has been replaced with the userspace console kmscon in Fedora 45. See: https://github.com/fedora-iot/iot-distro/issues/137 Signed-off-by: Kenneth Giusti --- fedora-iot-base.yaml | 1 + justfile | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index fc454fd..f15f5e3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -130,6 +130,7 @@ packages: - iwlwifi-mvm-firmware - kernel - keyutils +- kmscon - less - libsss_sudo - linux-firmware diff --git a/justfile b/justfile index 313ea6c..3eaf256 100644 --- a/justfile +++ b/justfile @@ -87,7 +87,7 @@ compose-legacy variant=default_variant: ${CMD} compose tree ${ARGS} \ --add-metadata-string="version=${variant_pretty} ${version}.${buildid}" \ - "${variant}-ostree.yaml" \ + "${variant}.yaml" \ |& tee "logs/${variant}_${version}_${buildid}.${timestamp}.log" if [[ ${EUID} -ne 0 ]]; then From 63d2e9c3f52e65f502cefafb39725f4b13e8843f Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 28 Jul 2026 16:15:56 -0400 Subject: [PATCH 42/44] Update workstation-ostree-config references to Forge - bootupd.yaml: Update comment URL to atomic-desktops/config on Forge - treecompose-post.sh: Update comment URL to atomic-desktops/config on Forge Assisted-by: Claude Opus 4.6 Signed-off-by: Paul Whalen --- bootupd.yaml | 2 +- treecompose-post.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/bootupd.yaml b/bootupd.yaml index e15c48a..62ebb0d 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,5 +1,5 @@ # KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml -# See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml +# See also: https://forge.fedoraproject.org/atomic-desktops/config/src/branch/main/bootupd.yaml # # Integration with https://github.com/coreos/bootupd packages: diff --git a/treecompose-post.sh b/treecompose-post.sh index a47d8cf..e62b942 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -18,7 +18,7 @@ done # Remove loader directory causing issues in Anaconda in unified core mode # Will be obsolete once we start using bootupd -# See - https://pagure.io/workstation-ostree-config/pull-request/344 +# See - https://forge.fedoraproject.org/atomic-desktops/config/pulls/344 rm -rf /usr/lib/ostree-boot/loader # Undo RPM scripts enabling units; we want the presets to be canonical From f570c87de928f01e14722144ff3d227c151201d0 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 12 Aug 2026 10:17:54 -0400 Subject: [PATCH 43/44] Bump rawhide to Fedora 46 --- config.ini | 2 +- fedora-46.repo | 12 ++++++++++++ fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 16 insertions(+), 4 deletions(-) create mode 100644 fedora-46.repo diff --git a/config.ini b/config.ini index 2e7f7da..a91c1c6 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f45 +release = f46 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-46.repo b/fedora-46.repo new file mode 100644 index 0000000..3af8c93 --- /dev/null +++ b/fedora-46.repo @@ -0,0 +1,12 @@ +[fedora-46] +name=Fedora 46 - $basearch +failovermethod=priority +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/46/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-46&arch=$basearch +enabled=1 +#metadata_expire=7d +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch +skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index f15f5e3..79160b5 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -10,8 +10,8 @@ selinux: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '45' -mutate-os-release: '45' +automatic_version_prefix: '46' +mutate-os-release: '46' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 4e3caeb..b770dff 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -2,4 +2,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-45 +- fedora-46 From 87eaa6a42bd33968869d8f4a1cf9ef596e3ce74b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 17 Aug 2026 14:41:53 -0400 Subject: [PATCH 44/44] Update gpgkey path in fedora-46.repo, drop unused fedora-45.repo Update gpgkey path in fedora-46.repo from /etc/pki/rpm-gpg/ to /usr/share/pki/rpm-gpg/ for the F45 GPG key relocation. See: https://discussion.fedoraproject.org/t/f45-change-proposal-relocate-rpm-repo-configs-to-usr-selfcontained/188916 Remove fedora-45.repo from main (rawhide) - it belongs on f45-branch. Assisted-by: Claude Opus 4.6 Signed-off-by: Paul Whalen --- fedora-45.repo | 12 ------------ fedora-46.repo | 2 +- 2 files changed, 1 insertion(+), 13 deletions(-) delete mode 100644 fedora-45.repo diff --git a/fedora-45.repo b/fedora-45.repo deleted file mode 100644 index 85e6dd9..0000000 --- a/fedora-45.repo +++ /dev/null @@ -1,12 +0,0 @@ -[fedora-45] -name=Fedora 45 - $basearch -failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/45/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-45&arch=$basearch -enabled=1 -#metadata_expire=7d -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-45-$basearch -skip_if_unavailable=False diff --git a/fedora-46.repo b/fedora-46.repo index 3af8c93..03af70c 100644 --- a/fedora-46.repo +++ b/fedora-46.repo @@ -8,5 +8,5 @@ enabled=1 repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch +gpgkey=file:///usr/share/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch skip_if_unavailable=False