diff --git a/README.md b/README.md index 2eb5265..25e27d2 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,3 @@ -# Fedora IoT ostree/rpm-ostree treefiles +# ostree This is the repo for the ostree compose configs for Fedora IoT. diff --git a/bootupd.yaml b/bootupd.yaml deleted file mode 100644 index 62ebb0d..0000000 --- a/bootupd.yaml +++ /dev/null @@ -1,26 +0,0 @@ -# KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml -# See also: https://forge.fedoraproject.org/atomic-desktops/config/src/branch/main/bootupd.yaml -# -# Integration with https://github.com/coreos/bootupd -packages: - - bootupd - -postprocess: - - | - #!/bin/bash - set -xeuo pipefail - - # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload - /usr/bin/bootupctl backend generate-update-metadata - - # Enable migration to a static GRUB config - install -dm0755 /usr/lib/systemd/system/bootloader-update.service.d - cat > /usr/lib/systemd/system/bootloader-update.service.d/migrate-static-grub-config.conf << 'EOF' - [Service] - ExecStart=/usr/bin/bootupctl migrate-static-grub-config - EOF - - echo "enable bootloader-update.service" >> /usr/lib/systemd/system-preset/80-iot.preset - - # Turn permissive mode on for bootupd until all SELinux issues are fixed - semanage permissive --noreload --add bootupd_t diff --git a/ci/validate b/ci/validate deleted file mode 100755 index c9e6a32..0000000 --- a/ci/validate +++ /dev/null @@ -1,57 +0,0 @@ -#!/usr/bin/python3 -# Validate basic syntax of shell script and yaml. - -import os -import stat -import subprocess -import yaml - -validated=0 - -def openat(dirfd, name, mode='r'): - def opener(path, flags): - return os.open(path, flags, dir_fd=dirfd) - return open(name, mode, opener=opener) - - -def validate_shell(rootfd, name): - subprocess.check_call(['bash', '-n', name], preexec_fn=lambda: os.fchdir(rootfd)) - global validated - validated +=1 - - -for root, dirs, files, rootfd in os.fwalk('.'): - # Skip folders that do not include content to validate - for d in ['.git', '.github', 'repo', 'cache', 'tmp', 'logs', 'fedora-comps']: - if d in dirs: - dirs.remove(d) - for f in ['.gitlab-ci.yml']: - if f in files: - files.remove(f) - for name in files: - if name.endswith(('.yaml', '.yml')): - print("Validating:", name) - with open(os.open(name, dir_fd=rootfd, flags=os.O_RDONLY)) as f: - yaml.safe_load(f) - result = subprocess.run(['grep', '-RniEv', '^( )*[a-z#/-]|^( )*\\[|^$|^#', name], encoding='UTF-8', - preexec_fn=lambda: os.fchdir(rootfd)) - if result.returncode == 0: - raise Exception("Found likely invalid indentation in YAML file: {}".format(name)) - validated +=1 - continue - elif name.endswith('.sh'): - print("Validating:", name) - validate_shell(rootfd, name) - continue - stbuf = os.lstat(name, dir_fd=rootfd) - if not stat.S_ISREG(stbuf.st_mode): - continue - if not stbuf.st_mode & stat.S_IXUSR: - continue - mimetype = subprocess.check_output(['file', '-b', '--mime-type', name], encoding='UTF-8', - preexec_fn=lambda: os.fchdir(rootfd)).strip() - if mimetype == 'text/x-shellscript': - print("Validating:", name) - validate_shell(rootfd, name) - -print(f"Validated {validated} files") diff --git a/composefs.yaml b/composefs.yaml deleted file mode 100644 index 8a721f3..0000000 --- a/composefs.yaml +++ /dev/null @@ -1,12 +0,0 @@ -# Enable composefs -# See: https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops -# https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT -postprocess: - - | - #!/usr/bin/env bash - set -xeuo pipefail - - cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' - [composefs] - enabled = yes - EOF diff --git a/config.ini b/config.ini index a91c1c6..a77cb73 100644 --- a/config.ini +++ b/config.ini @@ -10,9 +10,9 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f46 -ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s -yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ +release = f33 +ref = %(os_name)s/stable/%(arch)s/%(tree_name)s +yum_baseurl = https://dl.fedoraproject.org/pub/fedora/linux/releases/33/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot docker_os_name = fedora diff --git a/fedora-46.repo b/fedora-33.repo similarity index 56% rename from fedora-46.repo rename to fedora-33.repo index 03af70c..5d5c0a0 100644 --- a/fedora-46.repo +++ b/fedora-33.repo @@ -1,12 +1,12 @@ -[fedora-46] -name=Fedora 46 - $basearch +[fedora-33] +name=Fedora 33 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/46/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-46&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/33/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-33&arch=$basearch enabled=1 #metadata_expire=7d -repo_gpgcheck=0 +repo_gpgcheck=1 type=rpm gpgcheck=1 -gpgkey=file:///usr/share/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-33-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json new file mode 100644 index 0000000..b07b986 --- /dev/null +++ b/fedora-iot-base.json @@ -0,0 +1,134 @@ +{ + "ref": "fedora/stable/${basearch}/iot", + "ex-jigdo-spec": "fedora-iot.spec", + + "repos": [], + + "selinux": true, + + "recommends": false, + + "documentation": false, + + "automatic_version_prefix": "33", + "mutate-os-release": "33", + + "initramfs-args": ["--no-hostonly", + "--add", "ignition"], + "boot_location": "new", + + "install-langs-comment": "Keep this in sync with treecompose-post.sh", + "install-langs": [ + "pt_BR", + "fr", + "fr_FR", + "de", + "de_DE", + "it", + "it_IT", + "ru", + "ru_RU", + "es", + "es_ES", + "en_US", + "zh_CN", + "ja", + "ja_JP", + "ko", + "ko_KR", + "zh_TW", + "as", + "as_IN", + "bn", + "bn_IN", + "gu", + "gu_IN", + "hi", + "hi_IN", + "kn", + "kn_IN", + "ml", + "ml_IN", + "mr", + "mr_IN", + "or", + "or_IN", + "pa", + "pa_IN", + "ta", + "ta_IN", + "te", + "te_IN" + ], + + "postprocess-script": "treecompose-post.sh", + + "etc-group-members": ["wheel", "docker"], + + "ignore-removed-users": ["root"], + "ignore-removed-groups": ["root"], + "check-passwd": { "type": "file", "filename": "passwd" }, + "check-groups": { "type": "file", "filename": "group" }, + + "packages": ["fedora-release-iot", + "glibc", "glibc-minimal-langpack", "nss-altfiles", + "sssd-client", "libsss_sudo", "shadow-utils", + "kernel", + "dracut-config-generic", "dracut-network", + "rpm-ostree", "polkit", "lvm2", + "cryptsetup", "pinentry", + "keyutils", "cracklib-dicts", + "e2fsprogs", "xfsprogs", "dosfstools", + "gnupg2", + "basesystem", "python3", "bash", + "xz", "gzip", + "coreutils", "which", "curl", + "firewalld", "iptables", + "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", + "wpa_supplicant", "wireless-regdb", "iwd", "tpm2-pkcs11", + "dnsmasq", "traceroute", + "hostname", "iproute", "iputils", + "openssh-clients", "openssh-server", "passwd", + "policycoreutils", "procps-ng", "rootfiles", "rpm", + "selinux-policy-targeted", "setup", "shadow-utils", + "sudo", "systemd", "util-linux", "vim-minimal", + "less", "tar", + "fwupd", "usbguard", + "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", + "ignition", "zezere-ignition", + "zram-generator", "zram-generator-defaults", + "rsync", "attr", + "ima-evm-utils", "openssl", + "bash-completion", + "tmux", "screen", + "policycoreutils-python-utils", + "setools-console", + "audit", "rng-tools", "chrony", + "bluez", "bluez-libs", "bluez-mesh", + "kernel-tools", "libgpiod-utils", + "podman", "podman-plugins", "container-selinux", "skopeo", "criu", + "slirp4netns", "fuse-overlayfs", + "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", + "parsec", "dbus-parsec"], + + "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", + "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", + "arm-image-installer", "iwl7260-firmware"], + + "packages-armhfp": ["grub2-efi-arm", "efibootmgr", + "uboot-tools", "uboot-images-armv7", "bcm283x-firmware", + "arm-image-installer"], + + "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "microcode_ctl", + "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", + "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", + "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware", "iwl7260-firmware"], + + "default_target": "multi-user.target", + + "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", + "zezere_ignition.timer", "zezere_ignition_banner.service", + "greenboot-grub2-set-counter", "greenboot-grub2-set-success", "greenboot-healthcheck", "greenboot-rpm-ostree-grub2-check-fallback", + "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "redboot-task-runner", + "parsec", "dbus-parsec"] +} diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml deleted file mode 100644 index 79160b5..0000000 --- a/fedora-iot-base.yaml +++ /dev/null @@ -1,205 +0,0 @@ -include: - - bootupd.yaml - # Enable composefs - - composefs.yaml - # Read only sysroot - - sysroot-ro.yaml -ref: fedora/rawhide/${basearch}/iot -repos: [] -selinux: true -tmp-is-dir: true -recommends: false -documentation: false -automatic_version_prefix: '46' -mutate-os-release: '46' -initramfs-args: -- "--no-hostonly" -- "--add" -- ignition watchdog -boot_location: modules - # Keep this in sync with treecompose-post.sh -install-langs: -- pt_BR -- fr -- fr_FR -- de -- de_DE -- it -- it_IT -- ru -- ru_RU -- es -- es_ES -- en_US -- zh_CN -- ja -- ja_JP -- ko -- ko_KR -- zh_TW -- as -- as_IN -- bn -- bn_IN -- gu -- gu_IN -- hi -- hi_IN -- kn -- kn_IN -- ml -- ml_IN -- mr -- mr_IN -- or -- or_IN -- pa -- pa_IN -- ta -- ta_IN -- te -- te_IN -postprocess-script: treecompose-post.sh -etc-group-members: -- wheel -- docker -ignore-removed-users: -- root -ignore-removed-groups: -- root -check-passwd: - type: file - filename: passwd -check-groups: - type: file - filename: group -packages: -# This list of packages should be kept in sync with -# the iot-commit definition is osbuild, as found here: -# https://github.com/osbuild/images/blob/0584c20b0c14a89e833b875252114ceff61805e8/pkg/distro/fedora/package_sets.go#L123 -- fedora-release-iot -- fedora-iot-config -- aardvark-dns -- atheros-firmware -- attr -- authselect -- bash -- bash-completion -- bootc -- brcmfmac-firmware -- chrony -- clevis -- clevis-dracut -- clevis-luks -- clevis-pin-tpm2 -- container-selinux -- containernetworking-plugins -- coreutils -- cracklib-dicts -- criu -- criu-libs -- cryptsetup -- curl -- dnf5 -- dnf5-plugins -- dosfstools -- dracut-config-generic -- dracut-network -- e2fsprogs -- efibootmgr -- fdo-client -- fdo-owner-cli -- filesystem -- firewalld -- fwupd -- fwupd-efi -- fwupd-plugin-modem-manager -- fwupd-plugin-uefi-capsule-data -- glibc -- glibc-minimal-langpack -- gnupg2 -- greenboot -- greenboot-default-health-checks -- gzip -- hostname -- ignition-edge -- ima-evm-utils -- iproute -- iputils -- iwd -- iwlwifi-mvm-firmware -- kernel -- keyutils -- kmscon -- less -- libsss_sudo -- linux-firmware -- lvm2 -- netavark -- NetworkManager -- NetworkManager-wifi -- NetworkManager-wwan -- nss-altfiles -- openssl -- openssh-clients -- openssh-server -- passt -- passt-selinux -- pinentry -- podman -- policycoreutils -- polkit -- procps-ng -- realtek-firmware -- rootfiles -- rpm -- screen -- selinux-policy-targeted -- setools-console -- setup -- shadow-utils -- skopeo -- slirp4netns -- sssd-client -- sudo -- systemd -- systemd-pam -- systemd-resolved -- tar -- tmux -- tpm2-pkcs11 -- traceroute -- usbguard -- util-linux -- vim-minimal -- wpa_supplicant -- wireless-regdb -- xfsprogs -- xz -- zram-generator -- zram-generator-defaults -packages-aarch64: -- arm-image-installer -- bcm283x-firmware -- grub2-efi-aa64 -- optee_client -- shim-aa64 -- uboot-images-armv8 -packages-x86_64: -- grub2-efi-x64 -- microcode_ctl -- shim-x64 -default_target: multi-user.target -units: -- NetworkManager.service -- fdo-client-linuxapp.service -- fedora-iot-config-remote-fix.service -- firewalld.service -- sshd.service -- systemd-firstboot.service -- greenboot-grub2-set-counter.service -- greenboot-grub2-set-success.service -- greenboot-healthcheck.service -- greenboot-rpm-ostree-grub2-check-fallback.service -- greenboot-status.service -- greenboot-task-runner.service diff --git a/fedora-iot-bootc.yaml b/fedora-iot-bootc.yaml deleted file mode 100644 index 6ae5882..0000000 --- a/fedora-iot-bootc.yaml +++ /dev/null @@ -1,15 +0,0 @@ -releasever: rawhide -variables: - distro: "fedora-iot" - -repos: - - fedora-rawhide - -metadata: - name: fedora-iot-bootc-base - summary: Fedora IoT bootc base image - -include: - - fedora-bootc-base/manifest.yaml - - fedora-bootc-base/kernel.yaml - diff --git a/fedora-iot-rawhide.tdl b/fedora-iot-rawhide.tdl new file mode 100644 index 0000000..8ad38cb --- /dev/null +++ b/fedora-iot-rawhide.tdl @@ -0,0 +1,13 @@ + + diff --git a/fedora-iot-updates-stable.json b/fedora-iot-updates-stable.json new file mode 100644 index 0000000..aeb0024 --- /dev/null +++ b/fedora-iot-updates-stable.json @@ -0,0 +1,5 @@ + + "ref": "fedora/stable/${basearch}/updates/iot", + "ex-jigdo-spec": "fedora-iot.spec", + "include": "fedora-iot-base.json" +} diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml deleted file mode 100644 index 263bd4b..0000000 --- a/fedora-iot-updates-stable.yaml +++ /dev/null @@ -1,2 +0,0 @@ -include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/updates/iot diff --git a/fedora-iot-updates-testing.json b/fedora-iot-updates-testing.json new file mode 100644 index 0000000..5d008fe --- /dev/null +++ b/fedora-iot-updates-testing.json @@ -0,0 +1,5 @@ +{ + "ref": "fedora/stable/${basearch}/testing/iot", + "ex-jigdo-spec": "fedora-iot.spec", + "include": "fedora-iot-base.json" +} diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml deleted file mode 100644 index c6eb5a5..0000000 --- a/fedora-iot-updates-testing.yaml +++ /dev/null @@ -1,2 +0,0 @@ -include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/testing/iot diff --git a/fedora-iot.json b/fedora-iot.json new file mode 100644 index 0000000..a21eb9f --- /dev/null +++ b/fedora-iot.json @@ -0,0 +1,6 @@ +{ + "ref": "fedora/stable/${basearch}/iot", + "ex-jigdo-spec": "fedora-iot.spec", + "repos": ["fedora-33"], + "include": "fedora-iot-base.json" +} diff --git a/fedora-iot.spec b/fedora-iot.spec new file mode 100644 index 0000000..f8b12a5 --- /dev/null +++ b/fedora-iot.spec @@ -0,0 +1,22 @@ +# Suppress most build root processing since we are just carrying binary data +%global __os_install_post /usr/lib/rpm/brp-compress %{nil} +Name: fedora-iot +Version: %{ostree_version} +Release: 1%{?dist} +Summary: Image (rpm-ostree jigdo) for Fedora IoT +License: MIT +#@@@rpmostree_jigdo_meta@@@ + +%description +%{summary} + +%prep + +%build + +%install +mkdir -p %{buildroot}%{_prefix}/lib/ostree-jigdo/%{name} +for x in *; do mv ${x} %{buildroot}%{_prefix}/lib/ostree-jigdo/%{name}; done + +%files +%{_prefix}/lib/ostree-jigdo/%{name} diff --git a/fedora-iot.yaml b/fedora-iot.yaml deleted file mode 100644 index b770dff..0000000 --- a/fedora-iot.yaml +++ /dev/null @@ -1,5 +0,0 @@ -include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/iot - -repos: -- fedora-46 diff --git a/fedora-rawhide.repo b/fedora-rawhide.repo deleted file mode 100644 index 30b51c9..0000000 --- a/fedora-rawhide.repo +++ /dev/null @@ -1,6 +0,0 @@ -[fedora-rawhide] -name=Fedora rawhide $basearch -mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=rawhide&arch=$basearch -enabled=1 -gpgcheck=1 -metadata_expire=1d diff --git a/justfile b/justfile deleted file mode 100644 index 3eaf256..0000000 --- a/justfile +++ /dev/null @@ -1,156 +0,0 @@ -# This is a justfile. See https://github.com/casey/just -# This is only used for local development. The builds made on the Fedora -# infrastructure are run via Pungi in a Koji runroot. - -# Set a default for some recipes -default_variant := "fedora-iot" -default_arch := "default" -# Current default in Pungi -force_nocache := "true" - -# Just doesn't have a native dict type, but quoted bash dictionary works fine -pretty_names := '( - [fedora-iot]="IoT" -)' - -# Default is to only validate the manifests -all: validate - -# Basic validation to make sure the manifests are not completely broken -validate: - ./ci/validate - -# Output the processed manifest for a given variant (defaults to Silverblue) -manifest variant=default_variant: - #!/bin/bash - set -euo pipefail - - rpm-ostree compose tree --print-only --repo=repo {{variant}}.yaml - -# Perform dependency resolution for a given variant (defaults to Silverblue) -compose-dry-run variant=default_variant: - #!/bin/bash - set -euxo pipefail - - mkdir -p repo cache logs - if [[ ! -f "repo/config" ]]; then - pushd repo > /dev/null || exit 1 - ostree init --repo . --mode=bare-user - popd > /dev/null || exit 1 - fi - - rpm-ostree compose tree --unified-core --repo=repo --dry-run {{variant}}.yaml - -# Alias/shortcut for compose-image command -compose variant=default_variant: (compose-image variant) - -# Compose a variant using the legacy non container path (defaults to Silverblue) -compose-legacy variant=default_variant: - #!/bin/bash - set -euxo pipefail - - declare -A pretty_names={{pretty_names}} - variant={{variant}} - variant_pretty=${pretty_names[$variant]-} - if [[ -z $variant_pretty ]]; then - echo "Unknown variant" - exit 1 - fi - - ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1) - - mkdir -p repo cache logs - if [[ ! -f "repo/config" ]]; then - pushd repo > /dev/null || exit 1 - ostree init --repo . --mode=bare-user - popd > /dev/null || exit 1 - fi - # Set option to reduce fsync for transient builds - ostree --repo=repo config set 'core.fsync' 'false' - - buildid="$(date '+%Y%m%d.0')" - timestamp="$(date --iso-8601=sec)" - echo "${buildid}" > .buildid - - version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')" - echo "Composing ${variant_pretty} ${version}.${buildid} ..." - - ARGS="--repo=repo --cachedir=cache" - ARGS+=" --unified-core" - if [[ {{force_nocache}} == "true" ]]; then - ARGS+=" --force-nocache" - fi - CMD="rpm-ostree" - if [[ ${EUID} -ne 0 ]]; then - CMD="sudo rpm-ostree" - fi - - ${CMD} compose tree ${ARGS} \ - --add-metadata-string="version=${variant_pretty} ${version}.${buildid}" \ - "${variant}.yaml" \ - |& tee "logs/${variant}_${version}_${buildid}.${timestamp}.log" - - if [[ ${EUID} -ne 0 ]]; then - sudo chown --recursive "$(id --user --name):$(id --group --name)" repo cache - fi - - ostree summary --repo=repo --update - -# Compose an Ostree Native Container OCI image -compose-image variant=default_variant: - #!/bin/bash - set -euxo pipefail - - declare -A pretty_names={{pretty_names}} - variant={{variant}} - variant_pretty=${pretty_names[$variant]-} - if [[ -z $variant_pretty ]]; then - echo "Unknown variant" - exit 1 - fi - - ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1) - - mkdir -p repo cache - if [[ ! -f "repo/config" ]]; then - pushd repo > /dev/null || exit 1 - ostree init --repo . --mode=bare-user - popd > /dev/null || exit 1 - fi - # Set option to reduce fsync for transient builds - ostree --repo=repo config set 'core.fsync' 'false' - - buildid="$(date '+%Y%m%d.0')" - timestamp="$(date --iso-8601=sec)" - echo "${buildid}" > .buildid - - version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')" - echo "Composing ${variant_pretty} ${version}.${buildid} ..." - - ARGS="--cachedir=cache --initialize" - if [[ {{force_nocache}} == "true" ]]; then - ARGS+=" --force-nocache" - fi - # To debug with gdb, use: gdb --args ... - CMD="rpm-ostree" - if [[ ${EUID} -ne 0 ]]; then - CMD="sudo rpm-ostree" - fi - - ${CMD} compose image ${ARGS} \ - --label="quay.expires-after=4w" \ - "${variant}.yaml" \ - "${variant}.ociarchive" - -# Clean up everything -clean-all: - just clean-repo - just clean-cache - -# Only clean the ostree repo -clean-repo: - rm -rf ./repo - -# Only clean the package and repo caches -clean-cache: - rm -rf ./cache diff --git a/sysroot-ro.yaml b/sysroot-ro.yaml deleted file mode 100644 index 8214f05..0000000 --- a/sysroot-ro.yaml +++ /dev/null @@ -1,15 +0,0 @@ -# Set up default root config to mount sysroot as read only -# https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot -# See: https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml -# See: https://github.com/fedora-iot/iot-distro/issues/81 - -postprocess: - - | - #!/usr/bin/env bash - set -xeuo pipefail - - install -dm 0755 -o 0 -g 0 /usr/lib/ostree - cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' - [sysroot] - readonly = true - EOF diff --git a/treecompose-post.sh b/treecompose-post.sh index e62b942..81d6c5e 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -2,9 +2,12 @@ set -xeuo pipefail -# From https://github.com/coreos/fedora-coreos-config/blob/testing-devel/overlay.d/05core/usr/lib/systemd/journald.conf.d/10-coreos-persistent.conf -install -dm0755 /usr/lib/systemd/journald.conf.d/ -echo -e "[Journal]\nStorage=persistent" > /usr/lib/systemd/journald.conf.d/10-persistent.conf +# Work around https://bugzilla.redhat.com/show_bug.cgi?id=1265295 +# Also note the create-new-then-rename dance for rofiles-fuse compat +if ! grep -q '^Storage=persistent' /etc/systemd/journald.conf; then + (cat /etc/systemd/journald.conf && echo 'Storage=persistent') > /etc/systemd.journald.conf.new + mv /etc/systemd.journald.conf{.new,} +fi # See: https://src.fedoraproject.org/rpms/glibc/pull-request/4 # Basically that program handles deleting old shared library directories @@ -15,15 +18,3 @@ for x in /usr/sbin/glibc_post_upgrade.*; do ln -srf /usr/bin/true ${x} fi done - -# Remove loader directory causing issues in Anaconda in unified core mode -# Will be obsolete once we start using bootupd -# See - https://forge.fedoraproject.org/atomic-desktops/config/pulls/344 -rm -rf /usr/lib/ostree-boot/loader - -# Undo RPM scripts enabling units; we want the presets to be canonical -# https://github.com/projectatomic/rpm-ostree/issues/1803 -rm -rf /etc/systemd/system/* -systemctl preset-all -rm -rf /etc/systemd/user/* -systemctl --user --global preset-all