From e633ff2814050007d4645d52ffbcde30de596d2a Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 17 Aug 2020 09:20:29 +0100 Subject: [PATCH 001/118] Setup for F-33 branched Signed-off-by: Peter Robinson --- config.ini | 4 ++-- fedora-32.repo => fedora-33.repo | 0 fedora-iot-base.json | 2 +- fedora-iot-updates-testing.json | 2 +- fedora-iot.json | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) rename fedora-32.repo => fedora-33.repo (100%) diff --git a/config.ini b/config.ini index 3d79dfc..5a27098 100644 --- a/config.ini +++ b/config.ini @@ -11,8 +11,8 @@ tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 release = f33 -ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s -yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux//development/rawhide/%(arch)s/os/ +ref = %(os_name)s/devel/%(arch)s/%(tree_name)s +yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/33/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot docker_os_name = fedora diff --git a/fedora-32.repo b/fedora-33.repo similarity index 100% rename from fedora-32.repo rename to fedora-33.repo diff --git a/fedora-iot-base.json b/fedora-iot-base.json index bd18a09..9ed1431 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -1,5 +1,5 @@ { - "ref": "fedora/rawhide/${basearch}/iot", + "ref": "fedora/devel/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", "repos": [], diff --git a/fedora-iot-updates-testing.json b/fedora-iot-updates-testing.json index 96b50ac..d0b3866 100644 --- a/fedora-iot-updates-testing.json +++ b/fedora-iot-updates-testing.json @@ -1,5 +1,5 @@ { - "ref": "fedora/rawhide/${basearch}/testing/iot", + "ref": "fedora/devel/${basearch}/testing/iot", "ex-jigdo-spec": "fedora-iot.spec", "include": "fedora-iot-base.json" } diff --git a/fedora-iot.json b/fedora-iot.json index 3892dcc..8518094 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,5 +1,5 @@ { - "ref": "fedora/rawhide/${basearch}/iot", + "ref": "fedora/devel/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", "repos": ["fedora-33"], "include": "fedora-iot-base.json" From b8e040235faa05d0e1c6690e3e65aa62763a58c8 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 17 Aug 2020 09:25:46 +0100 Subject: [PATCH 002/118] IoT: Update rawhide for F-34 Signed-off-by: Peter Robinson --- config.ini | 4 ++-- fedora-32.repo => fedora-34.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 10 insertions(+), 10 deletions(-) rename fedora-32.repo => fedora-34.repo (61%) diff --git a/config.ini b/config.ini index 3d79dfc..c437a00 100644 --- a/config.ini +++ b/config.ini @@ -10,9 +10,9 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f33 +release = f34 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s -yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux//development/rawhide/%(arch)s/os/ +yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot docker_os_name = fedora diff --git a/fedora-32.repo b/fedora-34.repo similarity index 61% rename from fedora-32.repo rename to fedora-34.repo index 5d5c0a0..64b8944 100644 --- a/fedora-32.repo +++ b/fedora-34.repo @@ -1,12 +1,12 @@ -[fedora-33] -name=Fedora 33 - $basearch +[fedora-34] +name=Fedora 34 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/33/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-33&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/34/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-34&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=1 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-33-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-34-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index bd18a09..9248564 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -10,8 +10,8 @@ "documentation": false, - "automatic_version_prefix": "33", - "mutate-os-release": "33", + "automatic_version_prefix": "34", + "mutate-os-release": "34", "initramfs-args": ["--no-hostonly", "--add", "ignition"], diff --git a/fedora-iot.json b/fedora-iot.json index 3892dcc..4f3cf35 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-33"], + "repos": ["fedora-34"], "include": "fedora-iot-base.json" } From c8bdd80ca466ea8f01d7fd39c34ac025e943064f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 24 Aug 2020 13:16:12 +0100 Subject: [PATCH 003/118] Add new clevis tpm2 pin Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 9248564..c5ee169 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -107,7 +107,7 @@ "kernel-tools", "libgpiod-utils", "podman", "container-selinux", "skopeo", "criu", "slirp4netns", "fuse-overlayfs", - "clevis", "clevis-dracut", "clevis-luks"], + "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", From 48617f2eaa39bbeb63bb152f042ad99ea60c0dcf Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 24 Aug 2020 13:16:12 +0100 Subject: [PATCH 004/118] Add new clevis tpm2 pin Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 9ed1431..9efc704 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -107,7 +107,7 @@ "kernel-tools", "libgpiod-utils", "podman", "container-selinux", "skopeo", "criu", "slirp4netns", "fuse-overlayfs", - "clevis", "clevis-dracut", "clevis-luks"], + "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", From a933bdf17b8c6bf8bd8ef5ab6a779ed666f58a5c Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 16 Sep 2020 14:13:41 +0100 Subject: [PATCH 005/118] Add and enable parsec/dbus-parsec, minor tweaks Signed-off-by: Peter Robinson --- fedora-iot-base.json | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index c5ee169..d01de44 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -103,11 +103,12 @@ "policycoreutils-python-utils", "setools-console", "audit", "rng-tools", "chrony", - "bluez", "bluez-libs", "bluez-mesh", "wpan-tools", + "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", "podman", "container-selinux", "skopeo", "criu", - "slirp4netns", "fuse-overlayfs", - "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2"], + "slirp4netns", "fuse-overlayfs", + "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", + "parsec", "dbus-parsec"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", @@ -127,5 +128,6 @@ "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", "zezere_ignition.timer", "zezere_ignition_banner.service", "greenboot-grub2-set-counter", "greenboot-grub2-set-success", "greenboot-healthcheck", "greenboot-rpm-ostree-grub2-check-fallback", - "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "edboot-task-runner"] + "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "edboot-task-runner", + "parsec", "dbus-parsec"] } From ae2821f910411db3d7f009ec07fc19649f7def1a Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 16 Sep 2020 14:13:41 +0100 Subject: [PATCH 006/118] Add and enable parsec/dbus-parsec, minor tweaks Signed-off-by: Peter Robinson --- fedora-iot-base.json | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 9efc704..dd96d27 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -103,11 +103,12 @@ "policycoreutils-python-utils", "setools-console", "audit", "rng-tools", "chrony", - "bluez", "bluez-libs", "bluez-mesh", "wpan-tools", + "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", "podman", "container-selinux", "skopeo", "criu", - "slirp4netns", "fuse-overlayfs", - "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2"], + "slirp4netns", "fuse-overlayfs", + "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", + "parsec", "dbus-parsec"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", @@ -127,5 +128,6 @@ "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", "zezere_ignition.timer", "zezere_ignition_banner.service", "greenboot-grub2-set-counter", "greenboot-grub2-set-success", "greenboot-healthcheck", "greenboot-rpm-ostree-grub2-check-fallback", - "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "edboot-task-runner"] + "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "edboot-task-runner", + "parsec", "dbus-parsec"] } From aefa3387f8e30b3498034a9f74adfe2fa904bda0 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 17 Sep 2020 09:04:33 +0100 Subject: [PATCH 007/118] Add tpm2-abrmd Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index d01de44..c51a9f7 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -108,7 +108,7 @@ "podman", "container-selinux", "skopeo", "criu", "slirp4netns", "fuse-overlayfs", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", - "parsec", "dbus-parsec"], + "parsec", "dbus-parsec", "tpm2-abrmd"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", From bcc9459ea2e69c5086c48c637ed3016d870e6fc5 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 17 Sep 2020 09:04:33 +0100 Subject: [PATCH 008/118] Add tpm2-abrmd Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index dd96d27..aac0735 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -108,7 +108,7 @@ "podman", "container-selinux", "skopeo", "criu", "slirp4netns", "fuse-overlayfs", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", - "parsec", "dbus-parsec"], + "parsec", "dbus-parsec", "tpm2-abrmd"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", From 413eb752e3ff3d62ed3e036737fce1609b472c7d Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 17 Sep 2020 14:28:04 +0100 Subject: [PATCH 009/118] Revert "Add tpm2-abrmd" This reverts commit bcc9459ea2e69c5086c48c637ed3016d870e6fc5. Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index aac0735..dd96d27 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -108,7 +108,7 @@ "podman", "container-selinux", "skopeo", "criu", "slirp4netns", "fuse-overlayfs", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", - "parsec", "dbus-parsec", "tpm2-abrmd"], + "parsec", "dbus-parsec"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", From f8b9a68f929f7d2e5c8a549928f251621d9e1c6b Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 17 Sep 2020 14:28:04 +0100 Subject: [PATCH 010/118] Revert "Add tpm2-abrmd" This reverts commit bcc9459ea2e69c5086c48c637ed3016d870e6fc5. Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index c51a9f7..d01de44 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -108,7 +108,7 @@ "podman", "container-selinux", "skopeo", "criu", "slirp4netns", "fuse-overlayfs", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", - "parsec", "dbus-parsec", "tpm2-abrmd"], + "parsec", "dbus-parsec"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", From 0a385eb766e2c524dd7d707aa7746436640b5b5a Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 30 Sep 2020 12:30:43 +0100 Subject: [PATCH 011/118] fix typo in redboot service Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index dd96d27..bc00392 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -128,6 +128,6 @@ "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", "zezere_ignition.timer", "zezere_ignition_banner.service", "greenboot-grub2-set-counter", "greenboot-grub2-set-success", "greenboot-healthcheck", "greenboot-rpm-ostree-grub2-check-fallback", - "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "edboot-task-runner", + "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "redboot-task-runner", "parsec", "dbus-parsec"] } From 16bae90f46c5556f3abe2b1a12994fb4d0a43683 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 30 Sep 2020 12:30:43 +0100 Subject: [PATCH 012/118] fix typo in redboot service Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index d01de44..242670d 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -128,6 +128,6 @@ "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", "zezere_ignition.timer", "zezere_ignition_banner.service", "greenboot-grub2-set-counter", "greenboot-grub2-set-success", "greenboot-healthcheck", "greenboot-rpm-ostree-grub2-check-fallback", - "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "edboot-task-runner", + "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "redboot-task-runner", "parsec", "dbus-parsec"] } From b84ecbd52d22e2d6bfde41adc2b81468f0362850 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 8 Oct 2020 18:33:33 +0100 Subject: [PATCH 013/118] Add podman-plugins as it's not pulled in now Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 242670d..b7a508c 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -105,7 +105,7 @@ "audit", "rng-tools", "chrony", "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", - "podman", "container-selinux", "skopeo", "criu", + "podman", "podman-plugins", "container-selinux", "skopeo", "criu", "slirp4netns", "fuse-overlayfs", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "parsec", "dbus-parsec"], From af704d8e887ffda746cf98c87c10aff59341f6ff Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 8 Oct 2020 18:33:33 +0100 Subject: [PATCH 014/118] Add podman-plugins as it's not pulled in now Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index bc00392..e617284 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -105,7 +105,7 @@ "audit", "rng-tools", "chrony", "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", - "podman", "container-selinux", "skopeo", "criu", + "podman", "podman-plugins", "container-selinux", "skopeo", "criu", "slirp4netns", "fuse-overlayfs", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "parsec", "dbus-parsec"], From cf89d27ad4edc6652fbea5929d87d262424d43f2 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 28 Oct 2020 14:11:08 +0000 Subject: [PATCH 015/118] move F-33 to stable ostree branch Signed-off-by: Peter Robinson --- config.ini | 4 ++-- fedora-iot-base.json | 2 +- fedora-iot-updates-stable.json | 2 +- fedora-iot-updates-testing.json | 2 +- fedora-iot.json | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config.ini b/config.ini index 5a27098..a77cb73 100644 --- a/config.ini +++ b/config.ini @@ -11,8 +11,8 @@ tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 release = f33 -ref = %(os_name)s/devel/%(arch)s/%(tree_name)s -yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/33/Everything/%(arch)s/os/ +ref = %(os_name)s/stable/%(arch)s/%(tree_name)s +yum_baseurl = https://dl.fedoraproject.org/pub/fedora/linux/releases/33/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot docker_os_name = fedora diff --git a/fedora-iot-base.json b/fedora-iot-base.json index e617284..15ef7da 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -1,5 +1,5 @@ { - "ref": "fedora/devel/${basearch}/iot", + "ref": "fedora/stable/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", "repos": [], diff --git a/fedora-iot-updates-stable.json b/fedora-iot-updates-stable.json index 1bacd21..aeb0024 100644 --- a/fedora-iot-updates-stable.json +++ b/fedora-iot-updates-stable.json @@ -1,5 +1,5 @@ - "ref": "fedora/devel/${basearch}/updates/iot", + "ref": "fedora/stable/${basearch}/updates/iot", "ex-jigdo-spec": "fedora-iot.spec", "include": "fedora-iot-base.json" } diff --git a/fedora-iot-updates-testing.json b/fedora-iot-updates-testing.json index d0b3866..5d008fe 100644 --- a/fedora-iot-updates-testing.json +++ b/fedora-iot-updates-testing.json @@ -1,5 +1,5 @@ { - "ref": "fedora/devel/${basearch}/testing/iot", + "ref": "fedora/stable/${basearch}/testing/iot", "ex-jigdo-spec": "fedora-iot.spec", "include": "fedora-iot-base.json" } diff --git a/fedora-iot.json b/fedora-iot.json index 8518094..a21eb9f 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,5 +1,5 @@ { - "ref": "fedora/devel/${basearch}/iot", + "ref": "fedora/stable/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", "repos": ["fedora-33"], "include": "fedora-iot-base.json" From 3bcf4fcde08762a5b9b70813a1f185e34570af06 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 19 Dec 2020 11:35:36 +0000 Subject: [PATCH 016/118] add openssl option explicitly to allow for certificate pieces Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index b7a508c..688f0c3 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -97,7 +97,7 @@ "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "ignition", "zezere-ignition", "rsync", "attr", - "ima-evm-utils", + "ima-evm-utils", "openssl", "bash-completion", "tmux", "screen", "policycoreutils-python-utils", From 6fb322fa3b81cc32407a6b018fbf01ef37e66a74 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 19 Dec 2020 11:35:36 +0000 Subject: [PATCH 017/118] add openssl option explicitly to allow for certificate pieces Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 15ef7da..52d776c 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -97,7 +97,7 @@ "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "ignition", "zezere-ignition", "rsync", "attr", - "ima-evm-utils", + "ima-evm-utils", "openssl", "bash-completion", "tmux", "screen", "policycoreutils-python-utils", From c073a1e95799ac5122ef9b978665d33413243b4a Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 31 Dec 2020 10:57:36 +0000 Subject: [PATCH 018/118] Add wireless-regdb to ensure wireless location can be set Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 688f0c3..a52b3a5 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -85,7 +85,7 @@ "coreutils", "which", "curl", "firewalld", "iptables", "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", - "wpa_supplicant", "iwd", "tpm2-pkcs11", + "wpa_supplicant", "wireless-regdb", "iwd", "tpm2-pkcs11", "dnsmasq", "traceroute", "hostname", "iproute", "iputils", "openssh-clients", "openssh-server", "passwd", From 80e5883a5cff8c02cdf5df4b75b0c96592e3052a Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 31 Dec 2020 10:57:36 +0000 Subject: [PATCH 019/118] Add wireless-regdb to ensure wireless location can be set Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 52d776c..c38143a 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -85,7 +85,7 @@ "coreutils", "which", "curl", "firewalld", "iptables", "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", - "wpa_supplicant", "iwd", "tpm2-pkcs11", + "wpa_supplicant", "wireless-regdb", "iwd", "tpm2-pkcs11", "dnsmasq", "traceroute", "hostname", "iproute", "iputils", "openssh-clients", "openssh-server", "passwd", From 635d2c5f12ba50d8795da3f1f188c3f970f1a31c Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 14 Feb 2021 11:57:05 +0000 Subject: [PATCH 020/118] Add zram-generator, zram-generator-defaults which replace zram Signed-off-by: Peter Robinson --- fedora-iot-base.json | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index a52b3a5..db7f2e8 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -96,6 +96,7 @@ "fwupd", "usbguard", "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "ignition", "zezere-ignition", + "zram-generator", "zram-generator-defaults", "rsync", "attr", "ima-evm-utils", "openssl", "bash-completion", From 2081789dbbbff087b2cebd2a024dd434d4d512f2 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 14 Feb 2021 11:57:05 +0000 Subject: [PATCH 021/118] Add zram-generator, zram-generator-defaults which replace zram Signed-off-by: Peter Robinson --- fedora-iot-base.json | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index c38143a..b07b986 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -96,6 +96,7 @@ "fwupd", "usbguard", "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "ignition", "zezere-ignition", + "zram-generator", "zram-generator-defaults", "rsync", "attr", "ima-evm-utils", "openssl", "bash-completion", From c5e20d4103cbd6ac6eb4c173b1466847180b8e4f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 14 Feb 2021 14:38:01 +0000 Subject: [PATCH 022/118] IoT: Update rawhide for F-35 Signed-off-by: Peter Robinson --- config.ini | 2 +- fedora-34.repo => fedora-35.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-34.repo => fedora-35.repo (61%) diff --git a/config.ini b/config.ini index c437a00..c3def07 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f34 +release = f35 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-34.repo b/fedora-35.repo similarity index 61% rename from fedora-34.repo rename to fedora-35.repo index 64b8944..4943b25 100644 --- a/fedora-34.repo +++ b/fedora-35.repo @@ -1,12 +1,12 @@ -[fedora-34] -name=Fedora 34 - $basearch +[fedora-35] +name=Fedora 35 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/34/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-34&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/35/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-35&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=1 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-34-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-35-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index db7f2e8..cd49f99 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -10,8 +10,8 @@ "documentation": false, - "automatic_version_prefix": "34", - "mutate-os-release": "34", + "automatic_version_prefix": "35", + "mutate-os-release": "35", "initramfs-args": ["--no-hostonly", "--add", "ignition"], diff --git a/fedora-iot.json b/fedora-iot.json index 4f3cf35..1b7ca7a 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-34"], + "repos": ["fedora-35"], "include": "fedora-iot-base.json" } From ab7db2e1f08d83f47e081e288f86f244ddb03116 Mon Sep 17 00:00:00 2001 From: Alexander Wellbrock Date: Tue, 30 Mar 2021 12:03:02 +0000 Subject: [PATCH 023/118] treefile: fix unit file names Observed from dmesg since F33 the unit symlinks created with this treefile have invalid names and are ignored by systemd. It seems that it worked nonetheless since the units are started anyway and most have correct symlinks placed alongside the invalid ones. This should get rid of those warnings in dmesg. Apparently rpm-ostree takes the specified strings here and places them as-is in the .wants/ dir. --- fedora-iot-base.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index cd49f99..3fce376 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -128,7 +128,7 @@ "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", "zezere_ignition.timer", "zezere_ignition_banner.service", - "greenboot-grub2-set-counter", "greenboot-grub2-set-success", "greenboot-healthcheck", "greenboot-rpm-ostree-grub2-check-fallback", - "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "redboot-task-runner", - "parsec", "dbus-parsec"] + "greenboot-grub2-set-counter.service", "greenboot-grub2-set-success.service", "greenboot-healthcheck.service", + "greenboot-rpm-ostree-grub2-check-fallback.service", "greenboot-status.service", "greenboot-task-runner.service", + "redboot-auto-reboot.service", "redboot-task-runner.service", "parsec.service", "dbus-parsec.service"] } From fb64a374e895e5b76e2d2337bffc046bb3bd2731 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 21 Apr 2021 12:57:36 +0100 Subject: [PATCH 024/118] initrd: include the watchdog module Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 3fce376..394d611 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -14,7 +14,7 @@ "mutate-os-release": "35", "initramfs-args": ["--no-hostonly", - "--add", "ignition"], + "--add", "ignition watchdog"], "boot_location": "new", "install-langs-comment": "Keep this in sync with treecompose-post.sh", From 0f8a7c76f8a66790c29981a65eb2eba6a355c6b6 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 27 Apr 2021 12:54:29 +0100 Subject: [PATCH 025/118] Fedora repo metadata isn't signed by default Signed-off-by: Peter Robinson --- fedora-35.repo | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-35.repo b/fedora-35.repo index 4943b25..901cd0a 100644 --- a/fedora-35.repo +++ b/fedora-35.repo @@ -5,7 +5,7 @@ failovermethod=priority metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-35&arch=$basearch enabled=1 #metadata_expire=7d -repo_gpgcheck=1 +repo_gpgcheck=0 type=rpm gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-35-$basearch From abc66898e9eeef09f88c4ddcece5d186b1131d72 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 3 May 2021 17:49:40 +0100 Subject: [PATCH 026/118] Add fwupd-plugin-modem-manager Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 394d611..fe0abc1 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -93,7 +93,7 @@ "selinux-policy-targeted", "setup", "shadow-utils", "sudo", "systemd", "util-linux", "vim-minimal", "less", "tar", - "fwupd", "usbguard", + "fwupd", "fwupd-plugin-modem-manager", "usbguard", "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "ignition", "zezere-ignition", "zram-generator", "zram-generator-defaults", From 32111f79bb8d8e422d90d5d778e3f5a1c89631c6 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 8 May 2021 13:05:38 +0100 Subject: [PATCH 027/118] Add fwupd-efi Signed-off-by: Peter Robinson --- fedora-iot-base.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index fe0abc1..8902b27 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -93,7 +93,7 @@ "selinux-policy-targeted", "setup", "shadow-utils", "sudo", "systemd", "util-linux", "vim-minimal", "less", "tar", - "fwupd", "fwupd-plugin-modem-manager", "usbguard", + "fwupd", "fwupd-plugin-modem-manager", "fwupd-efi", "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "ignition", "zezere-ignition", "zram-generator", "zram-generator-defaults", @@ -102,7 +102,7 @@ "bash-completion", "tmux", "screen", "policycoreutils-python-utils", - "setools-console", + "setools-console", "usbguard", "audit", "rng-tools", "chrony", "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", From 6490f41732f91861a2dfd7103508e08fa7f4c2ee Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 25 May 2021 13:09:21 +0100 Subject: [PATCH 028/118] fwupd-efi is only on x86_64/aarch64 Signed-off-by: Peter Robinson --- fedora-iot-base.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 8902b27..f9664aa 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -93,7 +93,7 @@ "selinux-policy-targeted", "setup", "shadow-utils", "sudo", "systemd", "util-linux", "vim-minimal", "less", "tar", - "fwupd", "fwupd-plugin-modem-manager", "fwupd-efi", + "fwupd", "fwupd-plugin-modem-manager", "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "ignition", "zezere-ignition", "zram-generator", "zram-generator-defaults", @@ -111,7 +111,7 @@ "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "parsec", "dbus-parsec"], - "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", + "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "fwupd-efi", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer", "iwl7260-firmware"], @@ -119,7 +119,7 @@ "uboot-tools", "uboot-images-armv7", "bcm283x-firmware", "arm-image-installer"], - "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "microcode_ctl", + "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "fwupd-efi", "microcode_ctl", "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware", "iwl7260-firmware"], From a3112cdac08a84cd65d044750d43d276ecd4f4e0 Mon Sep 17 00:00:00 2001 From: Christian Glombek Date: Thu, 10 Jun 2021 19:46:51 +0200 Subject: [PATCH 029/118] treefile: remove redboot-* service units The redboot services should not be started by the default target. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1959861 --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index f9664aa..24edd7b 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -130,5 +130,5 @@ "zezere_ignition.timer", "zezere_ignition_banner.service", "greenboot-grub2-set-counter.service", "greenboot-grub2-set-success.service", "greenboot-healthcheck.service", "greenboot-rpm-ostree-grub2-check-fallback.service", "greenboot-status.service", "greenboot-task-runner.service", - "redboot-auto-reboot.service", "redboot-task-runner.service", "parsec.service", "dbus-parsec.service"] + "parsec.service", "dbus-parsec.service"] } From df477fc624c02e5b9781178f477e5cf4fe2c33a2 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 29 Jul 2021 20:21:56 +0100 Subject: [PATCH 030/118] add systemd-resolved Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 24edd7b..02d2dae 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -91,7 +91,8 @@ "openssh-clients", "openssh-server", "passwd", "policycoreutils", "procps-ng", "rootfiles", "rpm", "selinux-policy-targeted", "setup", "shadow-utils", - "sudo", "systemd", "util-linux", "vim-minimal", + "sudo", "util-linux", "vim-minimal", + "systemd", "systemd-resolved", "less", "tar", "fwupd", "fwupd-plugin-modem-manager", "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", From c269f11ae9fc8d1eb0ef6c3264b28842e114c0b1 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 20 Aug 2021 08:37:38 +0100 Subject: [PATCH 031/118] Drop fuse-overlayfs It's no longer needed for rootless containers Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 02d2dae..c7675bc 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -107,8 +107,7 @@ "audit", "rng-tools", "chrony", "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", - "podman", "podman-plugins", "container-selinux", "skopeo", "criu", - "slirp4netns", "fuse-overlayfs", + "podman", "podman-plugins", "container-selinux", "skopeo", "criu", "slirp4netns", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "parsec", "dbus-parsec"], From 97aeeeccb1a31a861173098d1df2d30e8cd1da1b Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 20 Aug 2021 08:54:29 +0100 Subject: [PATCH 032/118] IoT: Update rawhide for F-36 Signed-off-by: Peter Robinson --- config.ini | 2 +- fedora-35.repo => fedora-36.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-35.repo => fedora-36.repo (61%) diff --git a/config.ini b/config.ini index c3def07..d16b945 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f35 +release = f36 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-35.repo b/fedora-36.repo similarity index 61% rename from fedora-35.repo rename to fedora-36.repo index 901cd0a..51639ff 100644 --- a/fedora-35.repo +++ b/fedora-36.repo @@ -1,12 +1,12 @@ -[fedora-35] -name=Fedora 35 - $basearch +[fedora-36] +name=Fedora 36 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/35/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-35&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/36/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-36&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-35-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-36-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index c7675bc..52a1fe8 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -10,8 +10,8 @@ "documentation": false, - "automatic_version_prefix": "35", - "mutate-os-release": "35", + "automatic_version_prefix": "36", + "mutate-os-release": "36", "initramfs-args": ["--no-hostonly", "--add", "ignition watchdog"], diff --git a/fedora-iot.json b/fedora-iot.json index 1b7ca7a..df9035d 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-35"], + "repos": ["fedora-36"], "include": "fedora-iot-base.json" } From 0dec23f77f454280d685f5455dfffdae34b37dcb Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 28 Aug 2021 13:29:30 +0100 Subject: [PATCH 033/118] drop audit from package set audit for unknown and unexplained reasons keeps depending on the long legacy Sys-V initscripts/chkconfig and we don't want to pull in the legacy deps so drop audit. Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 52a1fe8..059a48d 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -104,7 +104,7 @@ "tmux", "screen", "policycoreutils-python-utils", "setools-console", "usbguard", - "audit", "rng-tools", "chrony", + "rng-tools", "chrony", "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", "podman", "podman-plugins", "container-selinux", "skopeo", "criu", "slirp4netns", From df56f712a945147d27589d1a6080b49e8d4412e7 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 10 Oct 2021 13:29:48 +0100 Subject: [PATCH 034/118] Add Intel Wireless AX2xx firmware Signed-off-by: Peter Robinson --- fedora-iot-base.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 059a48d..e7b83b4 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -113,7 +113,7 @@ "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "fwupd-efi", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", - "arm-image-installer", "iwl7260-firmware"], + "arm-image-installer", "iwl7260-firmware", "iwlax2xx-firmware"], "packages-armhfp": ["grub2-efi-arm", "efibootmgr", "uboot-tools", "uboot-images-armv7", "bcm283x-firmware", @@ -122,7 +122,8 @@ "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "fwupd-efi", "microcode_ctl", "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", - "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware", "iwl7260-firmware"], + "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware", "iwl7260-firmware", + "iwlax2xx-firmware"], "default_target": "multi-user.target", From d0ac7aebe2505908983de8a2ca3e48cadf8084c5 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 10 Nov 2021 14:35:42 +0000 Subject: [PATCH 035/118] Update greenboot packages for upstream changes Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index e7b83b4..caeac22 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -95,7 +95,7 @@ "systemd", "systemd-resolved", "less", "tar", "fwupd", "fwupd-plugin-modem-manager", - "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", + "greenboot", "greenboot-default-health-checks", "ignition", "zezere-ignition", "zram-generator", "zram-generator-defaults", "rsync", "attr", From bf190f31480d36a4488438c867367b364a4d6291 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 11 Dec 2021 16:55:04 +0000 Subject: [PATCH 036/118] Add fwupd-plugin-uefi-capsule-data Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index caeac22..e692826 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -94,7 +94,7 @@ "sudo", "util-linux", "vim-minimal", "systemd", "systemd-resolved", "less", "tar", - "fwupd", "fwupd-plugin-modem-manager", + "fwupd", "fwupd-plugin-modem-manager", "fwupd-plugin-uefi-capsule-data", "greenboot", "greenboot-default-health-checks", "ignition", "zezere-ignition", "zram-generator", "zram-generator-defaults", From 80e2ffbc85fa8652d2559b783c5f3ba4c2c5eb34 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 11 Dec 2021 17:40:07 +0000 Subject: [PATCH 037/118] Drop uboot-tools, now unnessary Signed-off-by: Peter Robinson --- fedora-iot-base.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index e692826..e01793e 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -112,11 +112,11 @@ "parsec", "dbus-parsec"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "fwupd-efi", - "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", + "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer", "iwl7260-firmware", "iwlax2xx-firmware"], "packages-armhfp": ["grub2-efi-arm", "efibootmgr", - "uboot-tools", "uboot-images-armv7", "bcm283x-firmware", + "uboot-images-armv7", "bcm283x-firmware", "arm-image-installer"], "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "fwupd-efi", "microcode_ctl", From 97fc77899bc92a34f3d001a53f9a0ac2dc7f7f62 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 12 Dec 2021 20:55:06 +0000 Subject: [PATCH 038/118] no fwupd-plugin-uefi-capsule-data on armhfp Signed-off-by: Peter Robinson --- fedora-iot-base.json | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index e01793e..58e25d9 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -94,7 +94,7 @@ "sudo", "util-linux", "vim-minimal", "systemd", "systemd-resolved", "less", "tar", - "fwupd", "fwupd-plugin-modem-manager", "fwupd-plugin-uefi-capsule-data", + "fwupd", "fwupd-plugin-modem-manager", "greenboot", "greenboot-default-health-checks", "ignition", "zezere-ignition", "zram-generator", "zram-generator-defaults", @@ -112,18 +112,17 @@ "parsec", "dbus-parsec"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "fwupd-efi", - "uboot-images-armv8", "bcm283x-firmware", + "uboot-images-armv8", "bcm283x-firmware", "fwupd-plugin-uefi-capsule-data", "arm-image-installer", "iwl7260-firmware", "iwlax2xx-firmware"], - "packages-armhfp": ["grub2-efi-arm", "efibootmgr", - "uboot-images-armv7", "bcm283x-firmware", + "packages-armhfp": ["grub2-efi-arm", "efibootmgr", "uboot-images-armv7", "bcm283x-firmware", "arm-image-installer"], "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "fwupd-efi", "microcode_ctl", "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware", "iwl7260-firmware", - "iwlax2xx-firmware"], + "iwlax2xx-firmware", "fwupd-plugin-uefi-capsule-data"], "default_target": "multi-user.target", From 88df205fd33094553bda26b836462cf62a3bde5b Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 9 Feb 2022 10:18:58 +0000 Subject: [PATCH 039/118] IoT: Update rawhide for F-37 Signed-off-by: Peter Robinson --- config.ini | 2 +- fedora-36.repo => fedora-37.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot-updates-stable.json | 2 +- fedora-iot.json | 2 +- 5 files changed, 10 insertions(+), 10 deletions(-) rename fedora-36.repo => fedora-37.repo (61%) diff --git a/config.ini b/config.ini index d16b945..a2f3084 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f36 +release = f37 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-36.repo b/fedora-37.repo similarity index 61% rename from fedora-36.repo rename to fedora-37.repo index 51639ff..9cbd5a6 100644 --- a/fedora-36.repo +++ b/fedora-37.repo @@ -1,12 +1,12 @@ -[fedora-36] -name=Fedora 36 - $basearch +[fedora-37] +name=Fedora 37 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/36/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-36&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/37/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-37&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-36-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-37-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 58e25d9..d50af30 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -10,8 +10,8 @@ "documentation": false, - "automatic_version_prefix": "36", - "mutate-os-release": "36", + "automatic_version_prefix": "37", + "mutate-os-release": "37", "initramfs-args": ["--no-hostonly", "--add", "ignition watchdog"], diff --git a/fedora-iot-updates-stable.json b/fedora-iot-updates-stable.json index 1bacd21..a3fb5ed 100644 --- a/fedora-iot-updates-stable.json +++ b/fedora-iot-updates-stable.json @@ -1,5 +1,5 @@ - "ref": "fedora/devel/${basearch}/updates/iot", + "ref": "fedora/rawhide/${basearch}/updates/iot", "ex-jigdo-spec": "fedora-iot.spec", "include": "fedora-iot-base.json" } diff --git a/fedora-iot.json b/fedora-iot.json index df9035d..be6b73b 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-36"], + "repos": ["fedora-37"], "include": "fedora-iot-base.json" } From 1c4f3e7dcdb5bf35a6bba761fee63224053ba0c1 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 9 Feb 2022 11:10:13 +0000 Subject: [PATCH 040/118] add authselect for Fedora feature, drop rng-tools Signed-off-by: Peter Robinson --- fedora-iot-base.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index d50af30..3598f5f 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -79,7 +79,7 @@ "cryptsetup", "pinentry", "keyutils", "cracklib-dicts", "e2fsprogs", "xfsprogs", "dosfstools", - "gnupg2", + "gnupg2", "authselect", "basesystem", "python3", "bash", "xz", "gzip", "coreutils", "which", "curl", @@ -104,7 +104,7 @@ "tmux", "screen", "policycoreutils-python-utils", "setools-console", "usbguard", - "rng-tools", "chrony", + "chrony", "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", "podman", "podman-plugins", "container-selinux", "skopeo", "criu", "slirp4netns", From 57af56375908dbea96654527693899b366e3fb1f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 9 Feb 2022 13:45:55 +0000 Subject: [PATCH 041/118] Updates for F-36+ Signed-off-by: Peter Robinson --- fedora-iot-base.json | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 3598f5f..dfe548a 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -73,7 +73,7 @@ "packages": ["fedora-release-iot", "glibc", "glibc-minimal-langpack", "nss-altfiles", "sssd-client", "libsss_sudo", "shadow-utils", - "kernel", + "kernel", "linux-firmware", "dracut-config-generic", "dracut-network", "rpm-ostree", "polkit", "lvm2", "cryptsetup", "pinentry", @@ -107,7 +107,8 @@ "chrony", "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", - "podman", "podman-plugins", "container-selinux", "skopeo", "criu", "slirp4netns", + "podman", "podman-plugins", "container-selinux", "skopeo", "criu", + "slirp4netns", " containernetworking-plugins", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "parsec", "dbus-parsec"], @@ -126,7 +127,7 @@ "default_target": "multi-user.target", - "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", + "units": ["NetworkManager.service", "firewalld.service", "sshd.service", "zezere_ignition.timer", "zezere_ignition_banner.service", "greenboot-grub2-set-counter.service", "greenboot-grub2-set-success.service", "greenboot-healthcheck.service", "greenboot-rpm-ostree-grub2-check-fallback.service", "greenboot-status.service", "greenboot-task-runner.service", From 28a6a677762138aabc23dcfb9973e4ec3507e27d Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 9 Feb 2022 13:47:29 +0000 Subject: [PATCH 042/118] Drop ARMv7 specific package set Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 --- 1 file changed, 3 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index dfe548a..2d3230e 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -116,9 +116,6 @@ "uboot-images-armv8", "bcm283x-firmware", "fwupd-plugin-uefi-capsule-data", "arm-image-installer", "iwl7260-firmware", "iwlax2xx-firmware"], - "packages-armhfp": ["grub2-efi-arm", "efibootmgr", "uboot-images-armv7", "bcm283x-firmware", - "arm-image-installer"], - "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "fwupd-efi", "microcode_ctl", "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", From 1c0a8aa02f10e1a9b2a8c9802d8bd7028fca5752 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 9 Feb 2022 17:01:07 +0000 Subject: [PATCH 043/118] De-dupe and cleanup architecture specific packages With ARMv7 we can clean up a few exceptions that are identical across the two aarch64/x86_64 architectures. We also explicitly drop traditional BIOS piecs, we've never officially supported it and including it stops enhancements around security so explicitly definte it. Signed-off-by: Peter Robinson --- fedora-iot-base.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 2d3230e..cf8fc88 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -109,18 +109,18 @@ "kernel-tools", "libgpiod-utils", "podman", "podman-plugins", "container-selinux", "skopeo", "criu", "slirp4netns", " containernetworking-plugins", + "parsec", "dbus-parsec", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", - "parsec", "dbus-parsec"], + "efibootmgr", "fwupd-efi", "fwupd-plugin-uefi-capsule-data", + "iwl7260-firmware", "iwlax2xx-firmware"], - "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "fwupd-efi", - "uboot-images-armv8", "bcm283x-firmware", "fwupd-plugin-uefi-capsule-data", - "arm-image-installer", "iwl7260-firmware", "iwlax2xx-firmware"], + "packages-aarch64": ["grub2-efi-aa64", "shim-aa64", + "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer"], - "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "fwupd-efi", "microcode_ctl", - "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", - "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", - "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware", "iwl7260-firmware", - "iwlax2xx-firmware", "fwupd-plugin-uefi-capsule-data"], + "packages-x86_64": ["grub2-efi-x64", "shim-x64", "microcode_ctl", + "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", + "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", + "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware"], "default_target": "multi-user.target", From 0c7f01f93b3b5afe15b351caa9450200545c058e Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 18 Mar 2022 08:12:18 +0000 Subject: [PATCH 044/118] Add netavark for new podman 4 network Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index cf8fc88..7c4d3e1 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -108,7 +108,7 @@ "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", "podman", "podman-plugins", "container-selinux", "skopeo", "criu", - "slirp4netns", " containernetworking-plugins", + "containernetworking-plugins", "slirp4netns", "netavark", "parsec", "dbus-parsec", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "efibootmgr", "fwupd-efi", "fwupd-plugin-uefi-capsule-data", From bd8545ee95bc5004d8c5d53d9ec1abfe2c92fa86 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 20 Mar 2022 10:40:21 +0000 Subject: [PATCH 045/118] Add aardvark-dns for local container lookups Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 7c4d3e1..0222428 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -108,7 +108,7 @@ "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", "podman", "podman-plugins", "container-selinux", "skopeo", "criu", - "containernetworking-plugins", "slirp4netns", "netavark", + "containernetworking-plugins", "slirp4netns", "netavark", "aardvark-dns", "parsec", "dbus-parsec", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "efibootmgr", "fwupd-efi", "fwupd-plugin-uefi-capsule-data", From f51a1e4263c39a94a2127f761f1114583714d6ee Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 26 Mar 2022 19:47:14 +0000 Subject: [PATCH 046/118] drop rsync Signed-off-by: Peter Robinson --- fedora-iot-base.json | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 0222428..65a33fe 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -75,21 +75,21 @@ "sssd-client", "libsss_sudo", "shadow-utils", "kernel", "linux-firmware", "dracut-config-generic", "dracut-network", - "rpm-ostree", "polkit", "lvm2", + "rpm-ostree", "rpm", "polkit", "lvm2", "cryptsetup", "pinentry", "keyutils", "cracklib-dicts", "e2fsprogs", "xfsprogs", "dosfstools", "gnupg2", "authselect", "basesystem", "python3", "bash", "xz", "gzip", - "coreutils", "which", "curl", + "coreutils", "which", "curl", "attr", "firewalld", "iptables", "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", "wpa_supplicant", "wireless-regdb", "iwd", "tpm2-pkcs11", "dnsmasq", "traceroute", "hostname", "iproute", "iputils", "openssh-clients", "openssh-server", "passwd", - "policycoreutils", "procps-ng", "rootfiles", "rpm", + "policycoreutils", "procps-ng", "rootfiles", "selinux-policy-targeted", "setup", "shadow-utils", "sudo", "util-linux", "vim-minimal", "systemd", "systemd-resolved", @@ -98,7 +98,6 @@ "greenboot", "greenboot-default-health-checks", "ignition", "zezere-ignition", "zram-generator", "zram-generator-defaults", - "rsync", "attr", "ima-evm-utils", "openssl", "bash-completion", "tmux", "screen", From 1811f791326a804d51f104ae6abec9113acd693e Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 26 Mar 2022 19:52:35 +0000 Subject: [PATCH 047/118] Drop xfsprogs, it's not a default IoT filesystem Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 65a33fe..f7ef3b2 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -78,7 +78,7 @@ "rpm-ostree", "rpm", "polkit", "lvm2", "cryptsetup", "pinentry", "keyutils", "cracklib-dicts", - "e2fsprogs", "xfsprogs", "dosfstools", + "e2fsprogs", "dosfstools", "gnupg2", "authselect", "basesystem", "python3", "bash", "xz", "gzip", From 906ef6941640cf67eda447d9bb7da998ae252db8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 20 Oct 2021 20:30:18 +0200 Subject: [PATCH 048/118] README: Minor update --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 25e27d2..2eb5265 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,3 @@ -# ostree +# Fedora IoT ostree/rpm-ostree treefiles This is the repo for the ostree compose configs for Fedora IoT. From 603a779550c50b7d09624132837be5377a87a494 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Mon, 11 Oct 2021 12:50:54 +0200 Subject: [PATCH 049/118] Remove fedora-iot-rawhide.tdl & fedora-iot.spec - fedora-iot-rawhide.tdl has out of date content - fedora-iot.spec: support for jigdo/rojig was dropped from rpm-ostree. See: https://github.com/coreos/rpm-ostree/pull/2841 & https://github.com/coreos/rpm-ostree/pull/2842 --- fedora-iot-rawhide.tdl | 13 ------------- fedora-iot.spec | 22 ---------------------- 2 files changed, 35 deletions(-) delete mode 100644 fedora-iot-rawhide.tdl delete mode 100644 fedora-iot.spec diff --git a/fedora-iot-rawhide.tdl b/fedora-iot-rawhide.tdl deleted file mode 100644 index 8ad38cb..0000000 --- a/fedora-iot-rawhide.tdl +++ /dev/null @@ -1,13 +0,0 @@ - - diff --git a/fedora-iot.spec b/fedora-iot.spec deleted file mode 100644 index f8b12a5..0000000 --- a/fedora-iot.spec +++ /dev/null @@ -1,22 +0,0 @@ -# Suppress most build root processing since we are just carrying binary data -%global __os_install_post /usr/lib/rpm/brp-compress %{nil} -Name: fedora-iot -Version: %{ostree_version} -Release: 1%{?dist} -Summary: Image (rpm-ostree jigdo) for Fedora IoT -License: MIT -#@@@rpmostree_jigdo_meta@@@ - -%description -%{summary} - -%prep - -%build - -%install -mkdir -p %{buildroot}%{_prefix}/lib/ostree-jigdo/%{name} -for x in *; do mv ${x} %{buildroot}%{_prefix}/lib/ostree-jigdo/%{name}; done - -%files -%{_prefix}/lib/ostree-jigdo/%{name} From 179518bbab031d6c523ffaff66bae88a2e11ed0d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 20 Oct 2021 20:30:43 +0200 Subject: [PATCH 050/118] fedora-iot-base: Update persistent journal workaround Add a systemd configuration drop-in instead of modyfing the default configuration file. Imported from: https://github.com/coreos/fedora-coreos-config/blob/testing-devel/overlay.d/05core/usr/lib/systemd/journald.conf.d/10-coreos-persistent.conf --- treecompose-post.sh | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/treecompose-post.sh b/treecompose-post.sh index 81d6c5e..4b86bf3 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -2,12 +2,8 @@ set -xeuo pipefail -# Work around https://bugzilla.redhat.com/show_bug.cgi?id=1265295 -# Also note the create-new-then-rename dance for rofiles-fuse compat -if ! grep -q '^Storage=persistent' /etc/systemd/journald.conf; then - (cat /etc/systemd/journald.conf && echo 'Storage=persistent') > /etc/systemd.journald.conf.new - mv /etc/systemd.journald.conf{.new,} -fi +# From https://github.com/coreos/fedora-coreos-config/blob/testing-devel/overlay.d/05core/usr/lib/systemd/journald.conf.d/10-coreos-persistent.conf +echo -e "[Journal]\nStorage=persistent" > /usr/lib/systemd/journald.conf.d/10-persistent.conf # See: https://src.fedoraproject.org/rpms/glibc/pull-request/4 # Basically that program handles deleting old shared library directories From 8d4aec8722da60a1499aa0e9eb4ff10f2ed6962d Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 30 May 2022 13:22:03 -0400 Subject: [PATCH 051/118] Fix missing directory in treecompose-post.sh Signed-off-by: Paul Whalen --- treecompose-post.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/treecompose-post.sh b/treecompose-post.sh index 4b86bf3..8cf8e61 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -3,6 +3,7 @@ set -xeuo pipefail # From https://github.com/coreos/fedora-coreos-config/blob/testing-devel/overlay.d/05core/usr/lib/systemd/journald.conf.d/10-coreos-persistent.conf +install -dm0755 /usr/lib/systemd/journald.conf.d/ echo -e "[Journal]\nStorage=persistent" > /usr/lib/systemd/journald.conf.d/10-persistent.conf # See: https://src.fedoraproject.org/rpms/glibc/pull-request/4 From f22dd5b0854043e96f21e4d4a145df953bf83076 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 13 Aug 2022 15:02:37 +0100 Subject: [PATCH 052/118] IoT: Update rawhide for F-38 Signed-off-by: Peter Robinson --- config.ini | 2 +- fedora-37.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/config.ini b/config.ini index a2f3084..cc2f879 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f37 +release = f38 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-37.repo b/fedora-37.repo index 9cbd5a6..ae158a8 100644 --- a/fedora-37.repo +++ b/fedora-37.repo @@ -1,12 +1,12 @@ -[fedora-37] -name=Fedora 37 - $basearch +[fedora-38] +name=Fedora 38 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/37/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-37&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/38/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-38&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-37-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-38-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index f7ef3b2..18eec22 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -10,8 +10,8 @@ "documentation": false, - "automatic_version_prefix": "37", - "mutate-os-release": "37", + "automatic_version_prefix": "38", + "mutate-os-release": "38", "initramfs-args": ["--no-hostonly", "--add", "ignition watchdog"], diff --git a/fedora-iot.json b/fedora-iot.json index be6b73b..31c9ec4 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-37"], + "repos": ["fedora-38"], "include": "fedora-iot-base.json" } From 91c9bdb99f5e6fcadaebdf82323d8d98dd02e910 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 27 Aug 2022 09:32:57 +0100 Subject: [PATCH 053/118] Set tmp-is-dir = True Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 18eec22..eaedd75 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -6,6 +6,8 @@ "selinux": true, + "tmp-is-dir": true, + "recommends": false, "documentation": false, From 91e80aecf0971f20b83496e3b77d78543eaf4079 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 10 Feb 2023 10:52:28 -0500 Subject: [PATCH 054/118] IoT: Update rawhide for F-39 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-37.repo => fedora-39.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-37.repo => fedora-39.repo (61%) diff --git a/config.ini b/config.ini index cc2f879..7032043 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f38 +release = f39 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-37.repo b/fedora-39.repo similarity index 61% rename from fedora-37.repo rename to fedora-39.repo index ae158a8..739626d 100644 --- a/fedora-37.repo +++ b/fedora-39.repo @@ -1,12 +1,12 @@ -[fedora-38] -name=Fedora 38 - $basearch +[fedora-39] +name=Fedora 39 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/38/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-38&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/39/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-39&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-38-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-39-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index eaedd75..cbb4c49 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -12,8 +12,8 @@ "documentation": false, - "automatic_version_prefix": "38", - "mutate-os-release": "38", + "automatic_version_prefix": "39", + "mutate-os-release": "39", "initramfs-args": ["--no-hostonly", "--add", "ignition watchdog"], diff --git a/fedora-iot.json b/fedora-iot.json index 31c9ec4..7e8c051 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-38"], + "repos": ["fedora-39"], "include": "fedora-iot-base.json" } From f0727787bc11e267dde0f3f1e59701f78ce54af1 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 24 Mar 2023 13:47:40 -0400 Subject: [PATCH 055/118] Add workaround for anaconda unified-core issue. Signed-off-by: Paul Whalen --- treecompose-post.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/treecompose-post.sh b/treecompose-post.sh index 8cf8e61..08dd6ca 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -15,3 +15,8 @@ for x in /usr/sbin/glibc_post_upgrade.*; do ln -srf /usr/bin/true ${x} fi done + +# Remove loader directory causing issues in Anaconda in unified core mode +# Will be obsolete once we start using bootupd +# See - https://pagure.io/workstation-ostree-config/pull-request/344 +rm -rf /usr/lib/ostree-boot/loader From a3b9689aea3de54de4d1710f8e5ec6e7976c381a Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 20 Apr 2023 14:51:16 +0100 Subject: [PATCH 056/118] Add split out wifi firmwares explicitly Signed-off-by: Peter Robinson --- fedora-iot-base.json | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index cbb4c49..257c049 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -114,6 +114,7 @@ "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "efibootmgr", "fwupd-efi", "fwupd-plugin-uefi-capsule-data", "iwl7260-firmware", "iwlax2xx-firmware"], + "atheros-firmware", "brcmfmac-firmware", "realtek-firmware"], "packages-aarch64": ["grub2-efi-aa64", "shim-aa64", "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer"], From 7fb6ff3c3202d85269271eebdcf1cda67a7b4019 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 21 Apr 2023 14:05:50 -0400 Subject: [PATCH 057/118] Fix json formatting Signed-off-by: Paul Whalen --- fedora-iot-base.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 257c049..ead5d2f 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -113,8 +113,8 @@ "parsec", "dbus-parsec", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "efibootmgr", "fwupd-efi", "fwupd-plugin-uefi-capsule-data", - "iwl7260-firmware", "iwlax2xx-firmware"], - "atheros-firmware", "brcmfmac-firmware", "realtek-firmware"], + "iwl7260-firmware", "iwlax2xx-firmware", "atheros-firmware", + "brcmfmac-firmware", "realtek-firmware"], "packages-aarch64": ["grub2-efi-aa64", "shim-aa64", "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer"], From 2c3ce9490458469e60076e0c59ad83044c8d7af4 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 6 Jul 2023 11:11:56 +0100 Subject: [PATCH 058/118] firmware: Updates for changes in iwlwifi packaging The Intel WiFi firmware was consolidated/adjusted to better align with the kernel drivers. Signed-off-by: Peter Robinson --- fedora-iot-base.json | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index ead5d2f..59495b7 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -75,7 +75,6 @@ "packages": ["fedora-release-iot", "glibc", "glibc-minimal-langpack", "nss-altfiles", "sssd-client", "libsss_sudo", "shadow-utils", - "kernel", "linux-firmware", "dracut-config-generic", "dracut-network", "rpm-ostree", "rpm", "polkit", "lvm2", "cryptsetup", "pinentry", @@ -113,16 +112,14 @@ "parsec", "dbus-parsec", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "efibootmgr", "fwupd-efi", "fwupd-plugin-uefi-capsule-data", - "iwl7260-firmware", "iwlax2xx-firmware", "atheros-firmware", - "brcmfmac-firmware", "realtek-firmware"], + "kernel", "linux-firmware", + "iwlwifi-mvm-firmware", "iwlwifi-dvm-firmware", + "atheros-firmware", "brcmfmac-firmware", "realtek-firmware"], "packages-aarch64": ["grub2-efi-aa64", "shim-aa64", "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer"], - "packages-x86_64": ["grub2-efi-x64", "shim-x64", "microcode_ctl", - "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", - "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", - "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware"], + "packages-x86_64": ["grub2-efi-x64", "shim-x64", "microcode_ctl"], "default_target": "multi-user.target", From 2af239a9795f4b5c43005ad93fbe5e2f6b7e4d2f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 8 Jul 2023 13:37:54 +0100 Subject: [PATCH 059/118] aarch64: add optee_client package The optee_client TEE supplicant client and library enable interaction with the OP-TEE trusted execution environment which runs in the Arm TrustZone. The client is useful for certain devices. Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 59495b7..d8d0e8d 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -117,7 +117,8 @@ "atheros-firmware", "brcmfmac-firmware", "realtek-firmware"], "packages-aarch64": ["grub2-efi-aa64", "shim-aa64", - "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer"], + "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer", + "optee_client"], "packages-x86_64": ["grub2-efi-x64", "shim-x64", "microcode_ctl"], From 513aced27d634ecf2fcd7b2e1a3faa0c86577345 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 10 Jul 2023 20:26:26 -0400 Subject: [PATCH 060/118] Move boot-location to modules Signed-off-by: Paul Whalen --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index d8d0e8d..56411d0 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -17,7 +17,7 @@ "initramfs-args": ["--no-hostonly", "--add", "ignition watchdog"], - "boot_location": "new", + "boot_location": "modules", "install-langs-comment": "Keep this in sync with treecompose-post.sh", "install-langs": [ From d9d9360619bc818f776cd4128a2faf64c14e699f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 26 Jul 2023 14:47:56 +0100 Subject: [PATCH 061/118] IoT: Update the package set and sort alphanetically Some minor updates to the package set, we add the FDO client and drop bluez/libgpiod, if they're needed it's easy to layer them, and then we sort it all alphabetically. Signed-off-by: Peter Robinson --- fedora-iot-base.json | 169 ++++++++++++++++++++++++++++++------------- 1 file changed, 118 insertions(+), 51 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 56411d0..35c7bd1 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -73,60 +73,127 @@ "check-groups": { "type": "file", "filename": "group" }, "packages": ["fedora-release-iot", - "glibc", "glibc-minimal-langpack", "nss-altfiles", - "sssd-client", "libsss_sudo", "shadow-utils", - "dracut-config-generic", "dracut-network", - "rpm-ostree", "rpm", "polkit", "lvm2", - "cryptsetup", "pinentry", - "keyutils", "cracklib-dicts", - "e2fsprogs", "dosfstools", - "gnupg2", "authselect", - "basesystem", "python3", "bash", - "xz", "gzip", - "coreutils", "which", "curl", "attr", - "firewalld", "iptables", - "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", - "wpa_supplicant", "wireless-regdb", "iwd", "tpm2-pkcs11", - "dnsmasq", "traceroute", - "hostname", "iproute", "iputils", - "openssh-clients", "openssh-server", "passwd", - "policycoreutils", "procps-ng", "rootfiles", - "selinux-policy-targeted", "setup", "shadow-utils", - "sudo", "util-linux", "vim-minimal", - "systemd", "systemd-resolved", - "less", "tar", - "fwupd", "fwupd-plugin-modem-manager", - "greenboot", "greenboot-default-health-checks", - "ignition", "zezere-ignition", - "zram-generator", "zram-generator-defaults", - "ima-evm-utils", "openssl", - "bash-completion", - "tmux", "screen", - "policycoreutils-python-utils", - "setools-console", "usbguard", - "chrony", - "bluez", "bluez-libs", "bluez-mesh", - "kernel-tools", "libgpiod-utils", - "podman", "podman-plugins", "container-selinux", "skopeo", "criu", - "containernetworking-plugins", "slirp4netns", "netavark", "aardvark-dns", - "parsec", "dbus-parsec", - "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", - "efibootmgr", "fwupd-efi", "fwupd-plugin-uefi-capsule-data", - "kernel", "linux-firmware", - "iwlwifi-mvm-firmware", "iwlwifi-dvm-firmware", - "atheros-firmware", "brcmfmac-firmware", "realtek-firmware"], + "aardvark-dns", + "atheros-firmware", + "attr", + "authselect", + "basesystem", + "bash", + "bash-completion", + "brcmfmac-firmware", + "chrony", + "clevis", + "clevis-dracut", + "clevis-luks", + "clevis-pin-tpm2", + "container-selinux", + "containernetworking-plugins", + "coreutils", + "cracklib-dicts", + "criu", + "cryptsetup", + "curl", + "dbus-parsec", + "dnsmasq", + "dosfstools", + "dracut-config-generic", + "dracut-network", + "e2fsprogs", + "efibootmgr", + "fdo-client", + "firewalld", + "fwupd", + "fwupd-efi", + "fwupd-plugin-modem-manager", + "fwupd-plugin-uefi-capsule-data", + "glibc", + "glibc-minimal-langpack", + "gnupg2", + "greenboot", + "greenboot-default-health-checks", + "gzip", + "hostname", + "ignition", + "ima-evm-utils", + "iproute", + "iputils", + "iwd", + "iwlwifi-mvm-firmware", + "kernel-tools", + "keyutils", + "less", + "libsss_sudo", + "linux-firmware", + "lvm2", + "netavark", + "NetworkManager", + "NetworkManager-wifi", + "NetworkManager-wwan", + "nss-altfiles", + "openssl", + "openssh-clients", + "openssh-server", + "parsec", + "passwd", + "pinentry", + "podman", + "podman-plugins", + "policycoreutils", + "policycoreutils-python-utils", + "polkit", + "procps-ng", + "realtek-firmware", + "rootfiles", + "rpm", + "screen", + "selinux-policy-targeted", + "setools-console", + "setup", + "shadow-utils", + "skopeo", + "slirp4netns", + "sssd-client", + "sudo", + "systemd", + "systemd-resolved", + "tar", + "tmux", + "tpm2-pkcs11", + "traceroute", + "usbguard", + "util-linux", + "vim-minimal", + "wpa_supplicant", + "wireless-regdb", + "xfsprogs", + "xz", + "zezere-ignition", + "zram-generator"], - "packages-aarch64": ["grub2-efi-aa64", "shim-aa64", - "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer", - "optee_client"], + "packages-aarch64": ["arm-image-installer", + "bcm283x-firmware", + "grub2-efi-aa64", + "optee_client", + "shim-aa64", + "uboot-images-armv8"], - "packages-x86_64": ["grub2-efi-x64", "shim-x64", "microcode_ctl"], + "packages-x86_64": ["grub2-efi-x64", + "microcode_ctl", + "shim-x64"], "default_target": "multi-user.target", - "units": ["NetworkManager.service", "firewalld.service", "sshd.service", - "zezere_ignition.timer", "zezere_ignition_banner.service", - "greenboot-grub2-set-counter.service", "greenboot-grub2-set-success.service", "greenboot-healthcheck.service", - "greenboot-rpm-ostree-grub2-check-fallback.service", "greenboot-status.service", "greenboot-task-runner.service", - "parsec.service", "dbus-parsec.service"] + "units": ["NetworkManager.service", + "firewalld.service", + "sshd.service", + "greenboot-grub2-set-counter.service", + "greenboot-grub2-set-success.service", + "greenboot-healthcheck.service", + "greenboot-rpm-ostree-grub2-check-fallback.service", + "greenboot-status.service", + "greenboot-task-runner.service", + "parsec.service", + "dbus-parsec.service", + "zezere_ignition.timer", + "zezere_ignition_banner.service",] } From b994f0b5a4d87dacf4a6a7133d607049e6bea8f4 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 26 Jul 2023 11:29:44 -0400 Subject: [PATCH 062/118] Remove trailing comma in fedora-iot-base.json Signed-off-by: Paul Whalen --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 35c7bd1..9ad4979 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -195,5 +195,5 @@ "parsec.service", "dbus-parsec.service", "zezere_ignition.timer", - "zezere_ignition_banner.service",] + "zezere_ignition_banner.service"] } From 1d9600d8e3c4887fbc6c216c5829c4dcd935a1e6 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 26 Jul 2023 17:28:10 +0100 Subject: [PATCH 063/118] Add kernel back, remove trailing space Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 9ad4979..0e26d24 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -119,6 +119,7 @@ "iputils", "iwd", "iwlwifi-mvm-firmware", + "kernel", "kernel-tools", "keyutils", "less", @@ -188,7 +189,7 @@ "sshd.service", "greenboot-grub2-set-counter.service", "greenboot-grub2-set-success.service", - "greenboot-healthcheck.service", + "greenboot-healthcheck.service", "greenboot-rpm-ostree-grub2-check-fallback.service", "greenboot-status.service", "greenboot-task-runner.service", From 1349eef26a1b67d78e8d204b7b57ee0a42846226 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 26 Jul 2023 20:27:35 +0100 Subject: [PATCH 064/118] Add a missing dep from copy/paste Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 0e26d24..2b670e1 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -169,7 +169,8 @@ "xfsprogs", "xz", "zezere-ignition", - "zram-generator"], + "zram-generator", + "zram-generator-defaults"], "packages-aarch64": ["arm-image-installer", "bcm283x-firmware", From d6a3afca84eb0de56a62f3949aac8e4f283529e3 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 14 Aug 2023 13:50:42 -0400 Subject: [PATCH 065/118] IoT: Update rawhide for F-40 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-39.repo => fedora-40.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-39.repo => fedora-40.repo (61%) diff --git a/config.ini b/config.ini index 7032043..fedaedd 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f39 +release = f40 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-39.repo b/fedora-40.repo similarity index 61% rename from fedora-39.repo rename to fedora-40.repo index 739626d..7a3c762 100644 --- a/fedora-39.repo +++ b/fedora-40.repo @@ -1,12 +1,12 @@ -[fedora-39] -name=Fedora 39 - $basearch +[fedora-40] +name=Fedora 40 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/39/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-39&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/40/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-40&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-39-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-40-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 2b670e1..f6a05cf 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -12,8 +12,8 @@ "documentation": false, - "automatic_version_prefix": "39", - "mutate-os-release": "39", + "automatic_version_prefix": "40", + "mutate-os-release": "40", "initramfs-args": ["--no-hostonly", "--add", "ignition watchdog"], diff --git a/fedora-iot.json b/fedora-iot.json index 7e8c051..19a0373 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-39"], + "repos": ["fedora-40"], "include": "fedora-iot-base.json" } From f1fdb7a4d9a037e1a0a6db59b0fc3116ee227907 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 25 Oct 2023 16:38:48 +0100 Subject: [PATCH 066/118] Add criu-libs as criu doesn't pull it in Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index f6a05cf..432222b 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -90,7 +90,7 @@ "containernetworking-plugins", "coreutils", "cracklib-dicts", - "criu", + "criu", "criu-libs", "cryptsetup", "curl", "dbus-parsec", From efc8d5c336db0573eddc308d7d1dde5bfd18eec8 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 8 Nov 2023 13:13:27 +0000 Subject: [PATCH 067/118] Enable IMA signatures Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 432222b..7140481 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -6,6 +6,8 @@ "selinux": true, + "ima": true, + "tmp-is-dir": true, "recommends": false, From d085d6d8192d65ee7033d31d90405ebc8a31e40a Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 27 Nov 2023 15:30:29 -0500 Subject: [PATCH 068/118] Undo rpm scripts enabling units, use only systemd presets Signed-off-by: Paul Whalen --- treecompose-post.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/treecompose-post.sh b/treecompose-post.sh index 08dd6ca..a47d8cf 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -20,3 +20,10 @@ done # Will be obsolete once we start using bootupd # See - https://pagure.io/workstation-ostree-config/pull-request/344 rm -rf /usr/lib/ostree-boot/loader + +# Undo RPM scripts enabling units; we want the presets to be canonical +# https://github.com/projectatomic/rpm-ostree/issues/1803 +rm -rf /etc/systemd/system/* +systemctl preset-all +rm -rf /etc/systemd/user/* +systemctl --user --global preset-all From 6b0bb8dcf66d064caec7bb0adea0b8bb6deca267 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 5 Dec 2023 16:25:59 -0500 Subject: [PATCH 069/118] Add min-free-space-percent to fix compose failure Signed-off-by: Paul Whalen --- fedora-iot-base.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 7140481..481bb90 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -2,6 +2,8 @@ "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", + "min-free-space-percent": "1", + "repos": [], "selinux": true, From eef364fa517b23af89fcb60c850bdab9f6cd5686 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 26 Jan 2024 20:16:47 -0500 Subject: [PATCH 070/118] Convert json to yaml Signed-off-by: Paul Whalen --- fedora-iot-base.json | 205 -------------------------------- fedora-iot-base.yaml | 202 +++++++++++++++++++++++++++++++ fedora-iot-updates-stable.json | 5 - fedora-iot-updates-stable.yaml | 2 + fedora-iot-updates-testing.json | 5 - fedora-iot-updates-testing.yaml | 2 + fedora-iot.json | 6 - fedora-iot.yaml | 8 ++ 8 files changed, 214 insertions(+), 221 deletions(-) delete mode 100644 fedora-iot-base.json create mode 100644 fedora-iot-base.yaml delete mode 100644 fedora-iot-updates-stable.json create mode 100644 fedora-iot-updates-stable.yaml delete mode 100644 fedora-iot-updates-testing.json create mode 100644 fedora-iot-updates-testing.yaml delete mode 100644 fedora-iot.json create mode 100644 fedora-iot.yaml diff --git a/fedora-iot-base.json b/fedora-iot-base.json deleted file mode 100644 index 481bb90..0000000 --- a/fedora-iot-base.json +++ /dev/null @@ -1,205 +0,0 @@ -{ - "ref": "fedora/rawhide/${basearch}/iot", - "ex-jigdo-spec": "fedora-iot.spec", - - "min-free-space-percent": "1", - - "repos": [], - - "selinux": true, - - "ima": true, - - "tmp-is-dir": true, - - "recommends": false, - - "documentation": false, - - "automatic_version_prefix": "40", - "mutate-os-release": "40", - - "initramfs-args": ["--no-hostonly", - "--add", "ignition watchdog"], - "boot_location": "modules", - - "install-langs-comment": "Keep this in sync with treecompose-post.sh", - "install-langs": [ - "pt_BR", - "fr", - "fr_FR", - "de", - "de_DE", - "it", - "it_IT", - "ru", - "ru_RU", - "es", - "es_ES", - "en_US", - "zh_CN", - "ja", - "ja_JP", - "ko", - "ko_KR", - "zh_TW", - "as", - "as_IN", - "bn", - "bn_IN", - "gu", - "gu_IN", - "hi", - "hi_IN", - "kn", - "kn_IN", - "ml", - "ml_IN", - "mr", - "mr_IN", - "or", - "or_IN", - "pa", - "pa_IN", - "ta", - "ta_IN", - "te", - "te_IN" - ], - - "postprocess-script": "treecompose-post.sh", - - "etc-group-members": ["wheel", "docker"], - - "ignore-removed-users": ["root"], - "ignore-removed-groups": ["root"], - "check-passwd": { "type": "file", "filename": "passwd" }, - "check-groups": { "type": "file", "filename": "group" }, - - "packages": ["fedora-release-iot", - "aardvark-dns", - "atheros-firmware", - "attr", - "authselect", - "basesystem", - "bash", - "bash-completion", - "brcmfmac-firmware", - "chrony", - "clevis", - "clevis-dracut", - "clevis-luks", - "clevis-pin-tpm2", - "container-selinux", - "containernetworking-plugins", - "coreutils", - "cracklib-dicts", - "criu", "criu-libs", - "cryptsetup", - "curl", - "dbus-parsec", - "dnsmasq", - "dosfstools", - "dracut-config-generic", - "dracut-network", - "e2fsprogs", - "efibootmgr", - "fdo-client", - "firewalld", - "fwupd", - "fwupd-efi", - "fwupd-plugin-modem-manager", - "fwupd-plugin-uefi-capsule-data", - "glibc", - "glibc-minimal-langpack", - "gnupg2", - "greenboot", - "greenboot-default-health-checks", - "gzip", - "hostname", - "ignition", - "ima-evm-utils", - "iproute", - "iputils", - "iwd", - "iwlwifi-mvm-firmware", - "kernel", - "kernel-tools", - "keyutils", - "less", - "libsss_sudo", - "linux-firmware", - "lvm2", - "netavark", - "NetworkManager", - "NetworkManager-wifi", - "NetworkManager-wwan", - "nss-altfiles", - "openssl", - "openssh-clients", - "openssh-server", - "parsec", - "passwd", - "pinentry", - "podman", - "podman-plugins", - "policycoreutils", - "policycoreutils-python-utils", - "polkit", - "procps-ng", - "realtek-firmware", - "rootfiles", - "rpm", - "screen", - "selinux-policy-targeted", - "setools-console", - "setup", - "shadow-utils", - "skopeo", - "slirp4netns", - "sssd-client", - "sudo", - "systemd", - "systemd-resolved", - "tar", - "tmux", - "tpm2-pkcs11", - "traceroute", - "usbguard", - "util-linux", - "vim-minimal", - "wpa_supplicant", - "wireless-regdb", - "xfsprogs", - "xz", - "zezere-ignition", - "zram-generator", - "zram-generator-defaults"], - - "packages-aarch64": ["arm-image-installer", - "bcm283x-firmware", - "grub2-efi-aa64", - "optee_client", - "shim-aa64", - "uboot-images-armv8"], - - "packages-x86_64": ["grub2-efi-x64", - "microcode_ctl", - "shim-x64"], - - "default_target": "multi-user.target", - - "units": ["NetworkManager.service", - "firewalld.service", - "sshd.service", - "greenboot-grub2-set-counter.service", - "greenboot-grub2-set-success.service", - "greenboot-healthcheck.service", - "greenboot-rpm-ostree-grub2-check-fallback.service", - "greenboot-status.service", - "greenboot-task-runner.service", - "parsec.service", - "dbus-parsec.service", - "zezere_ignition.timer", - "zezere_ignition_banner.service"] -} diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml new file mode 100644 index 0000000..8e9ab6d --- /dev/null +++ b/fedora-iot-base.yaml @@ -0,0 +1,202 @@ +--- +ref: fedora/rawhide/${basearch}/iot +rojig: + name: fedora-iot + summary: "Fedora IoT image" + license: MIT +repos: [] +selinux: true +ima: true +tmp-is-dir: true +recommends: false +documentation: false +automatic_version_prefix: '40' +mutate-os-release: '40' +initramfs-args: +- "--no-hostonly" +- "--add" +- ignition watchdog +boot_location: modules + # Keep this in sync with treecompose-post.sh +install-langs: +- pt_BR +- fr +- fr_FR +- de +- de_DE +- it +- it_IT +- ru +- ru_RU +- es +- es_ES +- en_US +- zh_CN +- ja +- ja_JP +- ko +- ko_KR +- zh_TW +- as +- as_IN +- bn +- bn_IN +- gu +- gu_IN +- hi +- hi_IN +- kn +- kn_IN +- ml +- ml_IN +- mr +- mr_IN +- or +- or_IN +- pa +- pa_IN +- ta +- ta_IN +- te +- te_IN +postprocess-script: treecompose-post.sh +etc-group-members: +- wheel +- docker +ignore-removed-users: +- root +ignore-removed-groups: +- root +check-passwd: + type: file + filename: passwd +check-groups: + type: file + filename: group +packages: +- fedora-release-iot +- aardvark-dns +- atheros-firmware +- attr +- authselect +- basesystem +- bash +- bash-completion +- brcmfmac-firmware +- chrony +- clevis +- clevis-dracut +- clevis-luks +- clevis-pin-tpm2 +- container-selinux +- containernetworking-plugins +- coreutils +- cracklib-dicts +- criu +- criu-libs +- cryptsetup +- curl +- dbus-parsec +- dnsmasq +- dosfstools +- dracut-config-generic +- dracut-network +- e2fsprogs +- efibootmgr +- fdo-client +- firewalld +- fwupd +- fwupd-efi +- fwupd-plugin-modem-manager +- fwupd-plugin-uefi-capsule-data +- glibc +- glibc-minimal-langpack +- gnupg2 +- greenboot +- greenboot-default-health-checks +- gzip +- hostname +- ignition +- ima-evm-utils +- iproute +- iputils +- iwd +- iwlwifi-mvm-firmware +- kernel +- kernel-tools +- keyutils +- less +- libsss_sudo +- linux-firmware +- lvm2 +- netavark +- NetworkManager +- NetworkManager-wifi +- NetworkManager-wwan +- nss-altfiles +- openssl +- openssh-clients +- openssh-server +- parsec +- passwd +- pinentry +- podman +- podman-plugins +- policycoreutils +- policycoreutils-python-utils +- polkit +- procps-ng +- realtek-firmware +- rootfiles +- rpm +- screen +- selinux-policy-targeted +- setools-console +- setup +- shadow-utils +- skopeo +- slirp4netns +- sssd-client +- sudo +- systemd +- systemd-resolved +- tar +- tmux +- tpm2-pkcs11 +- traceroute +- usbguard +- util-linux +- vim-minimal +- wpa_supplicant +- wireless-regdb +- xfsprogs +- xz +- zezere-ignition +- zram-generator +- zram-generator-defaults +packages-aarch64: +- arm-image-installer +- bcm283x-firmware +- grub2-efi-aa64 +- optee_client +- shim-aa64 +- uboot-images-armv8 +packages-x86_64: +- grub2-efi-x64 +- microcode_ctl +- shim-x64 +default_target: multi-user.target +units: +- NetworkManager.service +- firewalld.service +- sshd.service +- greenboot-grub2-set-counter.service +- greenboot-grub2-set-success.service +- greenboot-healthcheck.service +- greenboot-rpm-ostree-grub2-check-fallback.service +- greenboot-status.service +- greenboot-task-runner.service +- parsec.service +- dbus-parsec.service +- zezere_ignition.timer +- zezere_ignition_banner.service diff --git a/fedora-iot-updates-stable.json b/fedora-iot-updates-stable.json deleted file mode 100644 index a3fb5ed..0000000 --- a/fedora-iot-updates-stable.json +++ /dev/null @@ -1,5 +0,0 @@ - - "ref": "fedora/rawhide/${basearch}/updates/iot", - "ex-jigdo-spec": "fedora-iot.spec", - "include": "fedora-iot-base.json" -} diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml new file mode 100644 index 0000000..263bd4b --- /dev/null +++ b/fedora-iot-updates-stable.yaml @@ -0,0 +1,2 @@ +include: fedora-iot-base.yaml +ref: fedora/rawhide/${basearch}/updates/iot diff --git a/fedora-iot-updates-testing.json b/fedora-iot-updates-testing.json deleted file mode 100644 index 96b50ac..0000000 --- a/fedora-iot-updates-testing.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "ref": "fedora/rawhide/${basearch}/testing/iot", - "ex-jigdo-spec": "fedora-iot.spec", - "include": "fedora-iot-base.json" -} diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml new file mode 100644 index 0000000..c6eb5a5 --- /dev/null +++ b/fedora-iot-updates-testing.yaml @@ -0,0 +1,2 @@ +include: fedora-iot-base.yaml +ref: fedora/rawhide/${basearch}/testing/iot diff --git a/fedora-iot.json b/fedora-iot.json deleted file mode 100644 index 19a0373..0000000 --- a/fedora-iot.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "ref": "fedora/rawhide/${basearch}/iot", - "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-40"], - "include": "fedora-iot-base.json" -} diff --git a/fedora-iot.yaml b/fedora-iot.yaml new file mode 100644 index 0000000..f174396 --- /dev/null +++ b/fedora-iot.yaml @@ -0,0 +1,8 @@ +include: fedora-iot-base.yaml +ref: fedora/rawhide/${basearch}/iot +rojig: + name: fedora-iot-base + summary: "Fedora base image for IoT" + license: MIT +repos: +- fedora-40 From 6cb006c96fa31812bdc25ce36132985578f651c2 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 30 Jan 2024 15:19:39 -0500 Subject: [PATCH 071/118] Add bootupd, minor clean up Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 6 +----- fedora-iot.yaml | 4 ---- 2 files changed, 1 insertion(+), 9 deletions(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 8e9ab6d..3151c9a 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,9 +1,4 @@ ---- ref: fedora/rawhide/${basearch}/iot -rojig: - name: fedora-iot - summary: "Fedora IoT image" - license: MIT repos: [] selinux: true ima: true @@ -82,6 +77,7 @@ packages: - basesystem - bash - bash-completion +- bootupd - brcmfmac-firmware - chrony - clevis diff --git a/fedora-iot.yaml b/fedora-iot.yaml index f174396..b83ea21 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,8 +1,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot -rojig: - name: fedora-iot-base - summary: "Fedora base image for IoT" - license: MIT repos: - fedora-40 From 0fdf7b34245fca5d6db5571e98fca21f241f2590 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 1 Feb 2024 10:06:05 -0500 Subject: [PATCH 072/118] Revert adding bootupd for now. Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 3151c9a..33ddd60 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -77,7 +77,6 @@ packages: - basesystem - bash - bash-completion -- bootupd - brcmfmac-firmware - chrony - clevis From ff8dab07b1c51a6aaf153aaa67e0a069d859ddfc Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 8 Feb 2024 09:56:34 -0500 Subject: [PATCH 073/118] Drop passwd, now provided by shadow-utils Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 33ddd60..1c115ec 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -133,7 +133,6 @@ packages: - openssh-clients - openssh-server - parsec -- passwd - pinentry - podman - podman-plugins From 20661a3bb14e6f5ab7422992853435f72bb694df Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 8 Feb 2024 07:33:03 -0500 Subject: [PATCH 074/118] Add fedora-iot-config service to presets Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 1c115ec..2c98c56 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -182,6 +182,7 @@ packages-x86_64: default_target: multi-user.target units: - NetworkManager.service +- fedora-iot-config-remote-fix.service - firewalld.service - sshd.service - greenboot-grub2-set-counter.service From efa477093872dd33aa4948cf6e212c4595e46fd9 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 13 Feb 2024 13:06:27 -0500 Subject: [PATCH 075/118] IoT: Update rawhide for F-41 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-40.repo => fedora-41.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-40.repo => fedora-41.repo (61%) diff --git a/config.ini b/config.ini index fedaedd..0b65ffb 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f40 +release = f41 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-40.repo b/fedora-41.repo similarity index 61% rename from fedora-40.repo rename to fedora-41.repo index 7a3c762..1412aca 100644 --- a/fedora-40.repo +++ b/fedora-41.repo @@ -1,12 +1,12 @@ -[fedora-40] -name=Fedora 40 - $basearch +[fedora-41] +name=Fedora 41 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/40/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-40&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/41/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-41&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-40-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-41-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 2c98c56..a154890 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -5,8 +5,8 @@ ima: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '40' -mutate-os-release: '40' +automatic_version_prefix: '41' +mutate-os-release: '41' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index b83ea21..51c17ad 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-40 +- fedora-41 From ede36f3a2c68f9d8fe24c768fd5343b57e0697cd Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 14 Feb 2024 16:53:30 -0500 Subject: [PATCH 076/118] Drop podman-plugins package Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index a154890..54ecf6c 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -135,7 +135,6 @@ packages: - parsec - pinentry - podman -- podman-plugins - policycoreutils - policycoreutils-python-utils - polkit From 4ef41ffa05c6973590756ea4307d8899904e46b9 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 21 Feb 2024 15:46:40 -0500 Subject: [PATCH 077/118] f41: enable bootupd Signed-off-by: Paul Whalen --- bootupd.yaml | 9 +++++++++ fedora-iot-base.yaml | 1 + 2 files changed, 10 insertions(+) create mode 100644 bootupd.yaml diff --git a/bootupd.yaml b/bootupd.yaml new file mode 100644 index 0000000..949f504 --- /dev/null +++ b/bootupd.yaml @@ -0,0 +1,9 @@ +packages: + - bootupd + +postprocess: + - | + #!/bin/bash + set -xeuo pipefail + # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload + /usr/bin/bootupctl backend generate-update-metadata diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 54ecf6c..3da21d4 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,3 +1,4 @@ +include: bootupd.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true From b908de5dc79ffa83b0e5f38384d2fa4e6818959e Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 19 Mar 2024 14:13:26 +0000 Subject: [PATCH 078/118] add passt userspace network for podmn5 requirements It seems podman5 has changed the rootless container network stack to passt so add this into our compose alongside the exisitng slirp4netns while we find out how the migration works so we can document it. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 3da21d4..6f429f6 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -133,6 +133,8 @@ packages: - openssl - openssh-clients - openssh-server +- passt +- passt-selinux - parsec - pinentry - podman From 187a596a33f43dce9f259b77a92e82ad77ca5ec3 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 12 Apr 2024 08:48:50 -0400 Subject: [PATCH 079/118] F41: enable fdo-client-linuxapp.service Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 6f429f6..1604965 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -184,6 +184,7 @@ packages-x86_64: default_target: multi-user.target units: - NetworkManager.service +- fdo-client-linuxapp.service - fedora-iot-config-remote-fix.service - firewalld.service - sshd.service From 8329945ded68e83941eb2ade0ca309f2d2965e3a Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 15 Apr 2024 11:47:11 -0400 Subject: [PATCH 080/118] F41: Add base bootc container Signed-off-by: Paul Whalen --- fedora-bootc-base/autoupdates.yaml | 9 ++++ fedora-bootc-base/basic-fixes.yaml | 29 +++++++++++ fedora-bootc-base/bootc-config.yaml | 10 ++++ fedora-bootc-base/bootc.yaml | 12 +++++ fedora-bootc-base/bootupd.yaml | 31 ++++++++++++ fedora-bootc-base/group | 46 +++++++++++++++++ fedora-bootc-base/grub2-removals.yaml | 8 +++ fedora-bootc-base/initramfs.yaml | 18 +++++++ fedora-bootc-base/kernel.yaml | 6 +++ fedora-bootc-base/manifest.yaml | 71 +++++++++++++++++++++++++++ fedora-bootc-base/ostree.yaml | 17 +++++++ fedora-bootc-base/passwd | 32 ++++++++++++ fedora-bootc.yaml | 15 ++++++ fedora.repo | 65 ++++++++++++++++++++++++ 14 files changed, 369 insertions(+) create mode 100644 fedora-bootc-base/autoupdates.yaml create mode 100644 fedora-bootc-base/basic-fixes.yaml create mode 100644 fedora-bootc-base/bootc-config.yaml create mode 100644 fedora-bootc-base/bootc.yaml create mode 100644 fedora-bootc-base/bootupd.yaml create mode 100644 fedora-bootc-base/group create mode 100644 fedora-bootc-base/grub2-removals.yaml create mode 100644 fedora-bootc-base/initramfs.yaml create mode 100644 fedora-bootc-base/kernel.yaml create mode 100644 fedora-bootc-base/manifest.yaml create mode 100644 fedora-bootc-base/ostree.yaml create mode 100644 fedora-bootc-base/passwd create mode 100644 fedora-bootc.yaml create mode 100644 fedora.repo diff --git a/fedora-bootc-base/autoupdates.yaml b/fedora-bootc-base/autoupdates.yaml new file mode 100644 index 0000000..a416699 --- /dev/null +++ b/fedora-bootc-base/autoupdates.yaml @@ -0,0 +1,9 @@ +# Enable automatic updates by default +postprocess: + - | + #!/usr/bin/env bash + set -euo pipefail + target=/usr/lib/systemd/system/default.target.wants + mkdir -p $target + set -x + ln -s ../bootc-fetch-apply-updates.timer $target diff --git a/fedora-bootc-base/basic-fixes.yaml b/fedora-bootc-base/basic-fixes.yaml new file mode 100644 index 0000000..d9fe059 --- /dev/null +++ b/fedora-bootc-base/basic-fixes.yaml @@ -0,0 +1,29 @@ +# Fix general bugs + +postprocess: + # See also https://github.com/openshift/os/blob/f6cde963ee140c02364674db378b2bc4ac42675b/common.yaml#L156 + # This one is undoes the effect of + # # RHEL-only: Disable /tmp on tmpfs. + #Wants=tmp.mount + # in /usr/lib/systemd/system/basic.target + # We absolutely must have tmpfs-on-tmp for multiple reasons, + # but the biggest is that when we have composefs for / it's read-only, + # and for units with ProtectSystem=full systemd clones / but needs + # a writable place. + - | + #!/usr/bin/env bash + set -xeuo pipefail + mkdir -p /usr/lib/systemd/system/local-fs.target.wants + if test '!' -f /usr/lib/systemd/system/local-fs.target.wants/tmp.mount; then + ln -sf ../tmp.mount /usr/lib/systemd/system/local-fs.target.wants + fi + + # See https://github.com/containers/bootc/issues/358 + # basically systemd-tmpfiles doesn't follow symlinks; ordinarily our + # tmpfiles.d unit for `/var/roothome` is fine, but this actually doesn't + # work if we want to use tmpfiles.d to write to `/root/.ssh` because + # tmpfiles gives up on that before getting to `/var/roothome`. + sed -ie 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf + # Because /var/roothome is also defined in rpm-ostree-0-integration.conf + # we need to delete /var/roothome + sed -ie '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml new file mode 100644 index 0000000..4d4b24e --- /dev/null +++ b/fedora-bootc-base/bootc-config.yaml @@ -0,0 +1,10 @@ +# Configuration for bootc +postprocess: + # ext4 is our default filesystem in iot + - | + #!/usr/bin/env bash + mkdir -p /usr/lib/bootc/install/ + cat > /usr/lib/bootc/install/20-default-root.toml << EOF + [install] + root-fs-type = "ext4" + EOF diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml new file mode 100644 index 0000000..a862e6c --- /dev/null +++ b/fedora-bootc-base/bootc.yaml @@ -0,0 +1,12 @@ +# The bootc components. +packages: + - systemd + - bootc + # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk + - gdisk xfsprogs e2fsprogs dosfstools + +exclude-packages: + # Exclude kernel-debug-core to make sure that it doesn't somehow get + # chosen as the package to satisfy the `kernel-core` dependency from + # the kernel package. + - kernel-debug-core diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml new file mode 100644 index 0000000..7d3ebf3 --- /dev/null +++ b/fedora-bootc-base/bootupd.yaml @@ -0,0 +1,31 @@ +# Integration with https://github.com/coreos/bootupd and bootloader logic +# xref https://github.com/coreos/fedora-coreos-tracker/issues/510 +packages: + - bootupd + +# bootloader +packages-aarch64: + - grub2-efi-aa64 efibootmgr shim +packages-ppc64le: + - grub2 ostree-grub2 +packages-s390x: + # On Fedora, this is provided by s390utils-core. on RHEL, this is for now + # provided by s390utils-base, but soon will be -core too. + - /usr/sbin/zipl +packages-x86_64: + - grub2 grub2-efi-x64 efibootmgr shim + - microcode_ctl + +conditional-include: + - if: basearch != "s390x" + # And remove some cruft from grub2 + include: grub2-removals.yaml + +postprocess: + - | + #!/bin/bash + set -xeuo pipefail + # Until we have https://github.com/coreos/rpm-ostree/pull/2275 + mkdir -p /run + # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload + /usr/bin/bootupctl backend generate-update-metadata diff --git a/fedora-bootc-base/group b/fedora-bootc-base/group new file mode 100644 index 0000000..2fd197c --- /dev/null +++ b/fedora-bootc-base/group @@ -0,0 +1,46 @@ +root:x:0: +bin:x:1: +daemon:x:2: +sys:x:3: +adm:x:4: +tty:x:5: +disk:x:6: +lp:x:7: +mem:x:8: +kmem:x:9: +wheel:x:10: +cdrom:x:11: +mail:x:12: +man:x:15: +sudo:x:16: +dialout:x:18: +floppy:x:19: +games:x:20: +tape:x:33: +video:x:39: +ftp:x:50: +lock:x:54: +audio:x:63: +nobody:x:99: +users:x:100: +ssh_keys:x:999: +systemd-journal:x:190: +polkitd:x:998: +etcd:x:997: +dip:x:40: +cgred:x:996: +avahi-autoipd:x:170: +sssd:x:993: +dockerroot:x:986: +rpcuser:x:29: +nfsnobody:x:65534: +kube:x:994: +chrony:x:992: +tcpdump:x:72: +ceph:x:167: +input:x:104: +systemd-timesync:x:991: +systemd-network:x:990: +systemd-resolve:x:989: +systemd-bus-proxy:x:988: +cockpit-ws:x:987: diff --git a/fedora-bootc-base/grub2-removals.yaml b/fedora-bootc-base/grub2-removals.yaml new file mode 100644 index 0000000..f4800dd --- /dev/null +++ b/fedora-bootc-base/grub2-removals.yaml @@ -0,0 +1,8 @@ +remove-from-packages: + # The grub bits are mainly designed for desktops, and IMO haven't seen + # enough testing in concert with ostree. At some point we'll flesh out + # the full plan in https://github.com/coreos/fedora-coreos-tracker/issues/47 + - [grub2-tools, /etc/grub.d/08_fallback_counting, + /etc/grub.d/10_reset_boot_success, + /etc/grub.d/12_menu_auto_hide, + /usr/lib/systemd/.*] diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml new file mode 100644 index 0000000..de65333 --- /dev/null +++ b/fedora-bootc-base/initramfs.yaml @@ -0,0 +1,18 @@ +# Configuration for the initramfs +postprocess: + - | + #!/usr/bin/env bash + mkdir -p /usr/lib/dracut/dracut.conf.d + cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' + # We want a generic image; hostonly makes no sense as part of a server side build + hostonly=no + dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " + EOF + cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' + # Extra modules that we want by default that are known to exist in the kernel + dracutmodules+=" virtiofs " + EOF + cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' + # We want this for systemd-cryptsetup tpm2 locking + dracutmodules+=" tpm2-tss " + EOF diff --git a/fedora-bootc-base/kernel.yaml b/fedora-bootc-base/kernel.yaml new file mode 100644 index 0000000..0dd777d --- /dev/null +++ b/fedora-bootc-base/kernel.yaml @@ -0,0 +1,6 @@ +# Enable the Linux kernel; see also kernel-rt. +packages: + - kernel + +exclude-packages: + - kernel-debug diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml new file mode 100644 index 0000000..007f6d7 --- /dev/null +++ b/fedora-bootc-base/manifest.yaml @@ -0,0 +1,71 @@ + +# Modern defaults we want +boot-location: modules +tmp-is-dir: true +# https://github.com/CentOS/centos-bootc/issues/167 +machineid-compat: true +# Be minimal +recommends: false + +ignore-removed-users: + - root +ignore-removed-groups: + - root +etc-group-members: + - wheel + - sudo + - systemd-journal + - adm + +# Default to `bash` in our container, the same as other containers we ship. +container-cmd: + - /sbin/init + +# Note that the default for c9s+ is sqlite; we can't rely on rpm being +# in the target (it isn't in tier-0!) so turn this to host here. This +# does break the "hermetic build" aspect a bit. Maybe eventually +# what we should do is special case this and actually install RPM temporarily +# and then remove it... +rpmdb: host + +check-passwd: + type: "file" + filename: "passwd" +check-groups: + type: "file" + filename: "group" + +automatic-version-prefix: "${releasever}." +mutate-os-release: "${releasever}" + +remove-from-packages: + # Generally we expect other tools to do this (e.g. Ignition or cloud-init) + - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service] + # We don't want auto-generated mount units. See also + # https://github.com/systemd/systemd/issues/13099 + - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator] + # Drop some buggy sysusers fragments which do not match static IDs allocation: + # https://bugzilla.redhat.com/show_bug.cgi?id=2105177 + - [dbus-common, /usr/lib/sysusers.d/dbus.conf] + +include: + - bootc.yaml + - ostree.yaml + - bootc-config.yaml + - initramfs.yaml + - autoupdates.yaml + - basic-fixes.yaml + +packages: + # Even in tier-0, we have this. If you don't want SELinux today, you'll need + # to build a custom image. + - selinux-policy-targeted + # And we want container-selinux because trying to layer it on later currently causes issues. + - container-selinux + # Needed for tpm2 bound luks + - tpm2-tools + +# See https://github.com/coreos/bootupd +arch-include: + x86_64: bootupd.yaml + aarch64: bootupd.yaml diff --git a/fedora-bootc-base/ostree.yaml b/fedora-bootc-base/ostree.yaml new file mode 100644 index 0000000..6f30861 --- /dev/null +++ b/fedora-bootc-base/ostree.yaml @@ -0,0 +1,17 @@ +packages: + - ostree nss-altfiles + +# We want content lifecycled with the image +opt-usrlocal: "root" + +postprocess: + # Set up default root config + - | + #!/usr/bin/env bash + mkdir -p /usr/lib/ostree + cat > /usr/lib/ostree/prepare-root.conf << EOF + [composefs] + enabled = yes + [sysroot] + readonly = true + EOF diff --git a/fedora-bootc-base/passwd b/fedora-bootc-base/passwd new file mode 100644 index 0000000..ea84802 --- /dev/null +++ b/fedora-bootc-base/passwd @@ -0,0 +1,32 @@ +adm:x:3:4:adm:/var/adm:/usr/sbin/nologin +avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin +bin:x:1:1:bin:/bin:/usr/sbin/nologin +ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin +chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin +cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin +daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin +dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin +dockerroot:x:997:986:Docker User:/var/lib/docker:/usr/sbin/nologin +etcd:x:998:997:etcd user:/var/lib/etcd:/usr/sbin/nologin +ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin +games:x:12:100:games:/usr/games:/usr/sbin/nologin +halt:x:7:0:halt:/sbin:/sbin/halt +kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin +lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin +mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin +nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin +nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin +operator:x:11:0:operator:/root:/usr/sbin/nologin +polkitd:x:999:998:User for polkitd:/:/usr/sbin/nologin +root:x:0:0:Super User:/root:/bin/bash +rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin +rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin +shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown +sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin +sssd:x:995:993:User for sssd:/:/usr/sbin/nologin +sync:x:5:0:sync:/sbin:/bin/sync +systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin +systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin +systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin +systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin +tcpdump:x:72:72::/:/usr/sbin/nologin diff --git a/fedora-bootc.yaml b/fedora-bootc.yaml new file mode 100644 index 0000000..9bb1cf7 --- /dev/null +++ b/fedora-bootc.yaml @@ -0,0 +1,15 @@ +releasever: rawhide +variables: + distro: "fedora" + +repos: + - rawhide + +metadata: + name: fedora-bootc + summary: Fedora base bootc image + +include: + - fedora-bootc-base/manifest.yaml + - fedora-bootc-base/kernel.yaml + diff --git a/fedora.repo b/fedora.repo new file mode 100644 index 0000000..7101cb9 --- /dev/null +++ b/fedora.repo @@ -0,0 +1,65 @@ +# Note we use baseurl= here because using auto-selected mirrors conflicts with +# change detection: https://github.com/coreos/fedora-coreos-pipeline/issues/85. + +[fedora] +name=Fedora $releasever - $basearch +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ + https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch +enabled=1 +#metadata_expire=7d +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False + +[fedora-updates] +name=Fedora $releasever - $basearch - Updates +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Everything/$basearch/ + https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Everything/$basearch/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch +enabled=1 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +metadata_expire=6h +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False + +[fedora-updates-testing] +name=Fedora $releasever - $basearch - Test Updates +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Everything/$basearch/ + https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Everything/$basearch/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch +enabled=1 +gpgcheck=1 +metadata_expire=6h +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False + +[rawhide] +name=Fedora - Rawhide - Developmental packages for the next Fedora release +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ + https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch +enabled=1 +#metadata_expire=7d +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False + +[fedora-devel] +name=Fedora $releasever - $basearch +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ + https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch +enabled=1 +#metadata_expire=7d +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False From 1314f2a3f25aa6b9932b9a1a7195de9381929842 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 16 Apr 2024 13:43:24 -0400 Subject: [PATCH 081/118] F41: Adjust repo to use mirrors Signed-off-by: Paul Whalen --- fedora-bootc.yaml | 2 +- fedora-rawhide.repo | 6 +++++ fedora.repo | 65 --------------------------------------------- 3 files changed, 7 insertions(+), 66 deletions(-) create mode 100644 fedora-rawhide.repo delete mode 100644 fedora.repo diff --git a/fedora-bootc.yaml b/fedora-bootc.yaml index 9bb1cf7..7067275 100644 --- a/fedora-bootc.yaml +++ b/fedora-bootc.yaml @@ -3,7 +3,7 @@ variables: distro: "fedora" repos: - - rawhide + - fedora-rawhide metadata: name: fedora-bootc diff --git a/fedora-rawhide.repo b/fedora-rawhide.repo new file mode 100644 index 0000000..30b51c9 --- /dev/null +++ b/fedora-rawhide.repo @@ -0,0 +1,6 @@ +[fedora-rawhide] +name=Fedora rawhide $basearch +mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=rawhide&arch=$basearch +enabled=1 +gpgcheck=1 +metadata_expire=1d diff --git a/fedora.repo b/fedora.repo deleted file mode 100644 index 7101cb9..0000000 --- a/fedora.repo +++ /dev/null @@ -1,65 +0,0 @@ -# Note we use baseurl= here because using auto-selected mirrors conflicts with -# change detection: https://github.com/coreos/fedora-coreos-pipeline/issues/85. - -[fedora] -name=Fedora $releasever - $basearch -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ - https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch -enabled=1 -#metadata_expire=7d -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False - -[fedora-updates] -name=Fedora $releasever - $basearch - Updates -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Everything/$basearch/ - https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Everything/$basearch/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch -enabled=1 -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -metadata_expire=6h -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False - -[fedora-updates-testing] -name=Fedora $releasever - $basearch - Test Updates -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Everything/$basearch/ - https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Everything/$basearch/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch -enabled=1 -gpgcheck=1 -metadata_expire=6h -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False - -[rawhide] -name=Fedora - Rawhide - Developmental packages for the next Fedora release -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ - https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch -enabled=1 -#metadata_expire=7d -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False - -[fedora-devel] -name=Fedora $releasever - $basearch -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ - https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch -enabled=1 -#metadata_expire=7d -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False From c1ecf382b89fcdcc85ddbca1fd2dfc1b3123c762 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 3 May 2024 10:49:13 -0400 Subject: [PATCH 082/118] F41: add bootc to packages Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 1604965..8c21026 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -78,6 +78,7 @@ packages: - basesystem - bash - bash-completion +- bootc - brcmfmac-firmware - chrony - clevis From 985a450f7c3dfbc07b29e148e60c9ae0290b533c Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 15 Jul 2024 13:39:36 -0400 Subject: [PATCH 083/118] F41: Add dnf5 to packages Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 8c21026..25d3bdd 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -94,6 +94,8 @@ packages: - cryptsetup - curl - dbus-parsec +- dnf5 +- dnf5-plugins - dnsmasq - dosfstools - dracut-config-generic From 023d15b50fc0f862bd1b1b9fee9011ea03c27780 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 12 Aug 2024 15:26:49 -0400 Subject: [PATCH 084/118] IoT: Update rawhide for F-42 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-41.repo => fedora-42.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-41.repo => fedora-42.repo (61%) diff --git a/config.ini b/config.ini index 0b65ffb..f7e27f5 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f41 +release = f42 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-41.repo b/fedora-42.repo similarity index 61% rename from fedora-41.repo rename to fedora-42.repo index 1412aca..f9343b8 100644 --- a/fedora-41.repo +++ b/fedora-42.repo @@ -1,12 +1,12 @@ -[fedora-41] -name=Fedora 41 - $basearch +[fedora-42] +name=Fedora 42 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/41/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-41&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/42/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-42&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-41-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 25d3bdd..b665f4b 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -6,8 +6,8 @@ ima: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '41' -mutate-os-release: '41' +automatic_version_prefix: '42' +mutate-os-release: '42' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 51c17ad..f765bfe 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-41 +- fedora-42 From 1a898a733753e9700e305e41ea218456780efe13 Mon Sep 17 00:00:00 2001 From: Micah Abbott Date: Wed, 28 Aug 2024 13:54:39 -0400 Subject: [PATCH 085/118] bootupd: add some contextual comments Signed-off-by: Micah Abbott --- bootupd.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/bootupd.yaml b/bootupd.yaml index 949f504..3328d41 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,3 +1,7 @@ +# KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml +# See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml +# +#Integration with https://github.com/coreos/bootupd packages: - bootupd From 36ab3daaf041fe8f822fd639a3d31a093939cc93 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 3 Sep 2024 09:38:53 -0400 Subject: [PATCH 086/118] fedora-iot-base: Add workaround for issue with newer GRUB2 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 5 ++++- grub2-workaround.yaml | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) create mode 100644 grub2-workaround.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index b665f4b..a7afbd1 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,4 +1,7 @@ -include: bootupd.yaml +include: + - bootupd.yaml + # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 + - grub2-workaround.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/grub2-workaround.yaml b/grub2-workaround.yaml new file mode 100644 index 0000000..3b58a9e --- /dev/null +++ b/grub2-workaround.yaml @@ -0,0 +1,22 @@ +# Temporarily disable new GRUB2 config options until we can ensure that we +# have an updated bootloader via bootupd. +# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 +# See: https://github.com/fedora-silverblue/issue-tracker/issues/587 +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + # Completely disable this module + sed -i '2i exit 0' /etc/grub.d/25_bli + + # Skip check that was not performed in previous Fedora versions + sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware + sed -i '/\tif/d' /etc/grub.d/30_uefi-firmware + sed -i '/\tfi/d' /etc/grub.d/30_uefi-firmware + sed -i 's/\t\t/\t/' /etc/grub.d/30_uefi-firmware + + # Verify that the content matches what we expect the file to look like. + # This will fail the build here instead of breaking users' systems. + hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b" + echo "$hash /etc/grub.d/30_uefi-firmware" | sha256sum -c From 176b0add790ece0b16b41337569b9170b0514117 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 20 Sep 2024 15:28:56 +0100 Subject: [PATCH 087/118] drop dnsmasq Not sure why it was included, I suspect it was once used for container networking. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index a7afbd1..4c64cd1 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -99,7 +99,6 @@ packages: - dbus-parsec - dnf5 - dnf5-plugins -- dnsmasq - dosfstools - dracut-config-generic - dracut-network From 597796c53f30950d9edaa85b6d6a07ee1a829d5c Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 25 Sep 2024 08:57:05 -0400 Subject: [PATCH 088/118] Add iot base bootc image Signed-off-by: Paul Whalen --- fedora-bootc-base/autoupdates.yaml | 9 -- fedora-bootc-base/bootc-config.yaml | 10 --- fedora-bootc-base/bootc.yaml | 4 + fedora-bootc-base/bootupd.yaml | 2 +- fedora-bootc-base/initramfs.yaml | 12 ++- fedora-bootc-base/iot.yaml | 100 +++++++++++++++++++++ fedora-bootc-base/manifest.yaml | 14 +-- fedora-bootc.yaml => fedora-iot-bootc.yaml | 6 +- 8 files changed, 121 insertions(+), 36 deletions(-) delete mode 100644 fedora-bootc-base/autoupdates.yaml create mode 100644 fedora-bootc-base/iot.yaml rename fedora-bootc.yaml => fedora-iot-bootc.yaml (61%) diff --git a/fedora-bootc-base/autoupdates.yaml b/fedora-bootc-base/autoupdates.yaml deleted file mode 100644 index a416699..0000000 --- a/fedora-bootc-base/autoupdates.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# Enable automatic updates by default -postprocess: - - | - #!/usr/bin/env bash - set -euo pipefail - target=/usr/lib/systemd/system/default.target.wants - mkdir -p $target - set -x - ln -s ../bootc-fetch-apply-updates.timer $target diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml index 4d4b24e..e69de29 100644 --- a/fedora-bootc-base/bootc-config.yaml +++ b/fedora-bootc-base/bootc-config.yaml @@ -1,10 +0,0 @@ -# Configuration for bootc -postprocess: - # ext4 is our default filesystem in iot - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/bootc/install/ - cat > /usr/lib/bootc/install/20-default-root.toml << EOF - [install] - root-fs-type = "ext4" - EOF diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml index a862e6c..d44ee08 100644 --- a/fedora-bootc-base/bootc.yaml +++ b/fedora-bootc-base/bootc.yaml @@ -2,6 +2,10 @@ packages: - systemd - bootc + # bootc pulls in podman, which pulls in containers-common, which wants + # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name + # iptables-nft instead to satisfy it. + - iptables-nft # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk - gdisk xfsprogs e2fsprogs dosfstools diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml index 7d3ebf3..cc83d20 100644 --- a/fedora-bootc-base/bootupd.yaml +++ b/fedora-bootc-base/bootupd.yaml @@ -13,7 +13,7 @@ packages-s390x: # provided by s390utils-base, but soon will be -core too. - /usr/sbin/zipl packages-x86_64: - - grub2 grub2-efi-x64 efibootmgr shim + - grub2-efi-x64 efibootmgr shim - microcode_ctl conditional-include: diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml index de65333..fe4bbeb 100644 --- a/fedora-bootc-base/initramfs.yaml +++ b/fedora-bootc-base/initramfs.yaml @@ -6,13 +6,19 @@ postprocess: cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' # We want a generic image; hostonly makes no sense as part of a server side build hostonly=no - dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " + add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " EOF cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' # Extra modules that we want by default that are known to exist in the kernel - dracutmodules+=" virtiofs " + add_dracutmodules+=" virtiofs " EOF cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' # We want this for systemd-cryptsetup tpm2 locking - dracutmodules+=" tpm2-tss " + add_dracutmodules+=" tpm2-tss " + EOF + cat > /usr/lib/dracut/dracut.conf.d/59-altfiles.conf << 'EOF' + # https://issues.redhat.com/browse/RHEL-49590 + # On image mode systems we use nss-altfiles for passwd and group, + # this makes sure dracut uses them which also fixes kdump writing to NFS. + install_items+=" /usr/lib/passwd /usr/lib/group " EOF diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml new file mode 100644 index 0000000..611ff9a --- /dev/null +++ b/fedora-bootc-base/iot.yaml @@ -0,0 +1,100 @@ +# Fedora IoT specific packages +packages: + - fedora-release-iot + - aardvark-dns + - atheros-firmware + - attr + - authselect + - basesystem + - bash + - bash-completion + - brcmfmac-firmware + - chrony + - clevis + - clevis-dracut + - clevis-luks + - clevis-pin-tpm2 + - containernetworking-plugins + - coreutils + - cracklib-dicts + - criu + - criu-libs + - cryptsetup + - curl + - dbus-parsec + - dnf5-plugins + - dracut-config-generic + - dracut-network + - efibootmgr + - fdo-client + - firewalld + - fwupd + - fwupd-efi + - fwupd-plugin-modem-manager + - fwupd-plugin-uefi-capsule-data + - glibc + - glibc-minimal-langpack + - gnupg2 + - greenboot + - greenboot-default-health-checks + - gzip + - hostname + - ignition + - ima-evm-utils + - iproute + - iputils + - iwd + - iwlwifi-mvm-firmware + - kernel-tools + - keyutils + - less + - libsss_sudo + - linux-firmware + - lvm2 + - netavark + - NetworkManager + - NetworkManager-wifi + - NetworkManager-wwan + - nss-altfiles + - openssl + - openssh-clients + - openssh-server + - passt + - passt-selinux + - parsec + - pinentry + - podman + - policycoreutils + - policycoreutils-python-utils + - polkit + - procps-ng + - realtek-firmware + - rootfiles + - rpm + - screen + - setools-console + - setup + - shadow-utils + - skopeo + - slirp4netns + - sssd-client + - sudo + - systemd-resolved + - tar + - tmux + - tpm2-pkcs11 + - traceroute + - usbguard + - util-linux + - vim-minimal + - wpa_supplicant + - wireless-regdb + - xz + - zezere-ignition + - zram-generator + - zram-generator-defaults +packages-aarch64: + - arm-image-installer + - bcm283x-firmware + - optee_client + - uboot-images-armv8 diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml index 007f6d7..9a21ff3 100644 --- a/fedora-bootc-base/manifest.yaml +++ b/fedora-bootc-base/manifest.yaml @@ -44,19 +44,18 @@ remove-from-packages: # We don't want auto-generated mount units. See also # https://github.com/systemd/systemd/issues/13099 - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator] - # Drop some buggy sysusers fragments which do not match static IDs allocation: - # https://bugzilla.redhat.com/show_bug.cgi?id=2105177 - - [dbus-common, /usr/lib/sysusers.d/dbus.conf] include: - bootc.yaml + - bootupd.yaml - ostree.yaml - - bootc-config.yaml - initramfs.yaml - - autoupdates.yaml - basic-fixes.yaml + - iot.yaml packages: + # needed for building derived container images + - dnf5 # Even in tier-0, we have this. If you don't want SELinux today, you'll need # to build a custom image. - selinux-policy-targeted @@ -64,8 +63,3 @@ packages: - container-selinux # Needed for tpm2 bound luks - tpm2-tools - -# See https://github.com/coreos/bootupd -arch-include: - x86_64: bootupd.yaml - aarch64: bootupd.yaml diff --git a/fedora-bootc.yaml b/fedora-iot-bootc.yaml similarity index 61% rename from fedora-bootc.yaml rename to fedora-iot-bootc.yaml index 7067275..6ae5882 100644 --- a/fedora-bootc.yaml +++ b/fedora-iot-bootc.yaml @@ -1,13 +1,13 @@ releasever: rawhide variables: - distro: "fedora" + distro: "fedora-iot" repos: - fedora-rawhide metadata: - name: fedora-bootc - summary: Fedora base bootc image + name: fedora-iot-bootc-base + summary: Fedora IoT bootc base image include: - fedora-bootc-base/manifest.yaml From 91539fbf82555ede87f931277a090612a23c5680 Mon Sep 17 00:00:00 2001 From: David Jachimowicz Date: Fri, 15 Nov 2024 16:15:33 +0000 Subject: [PATCH 089/118] Update fedora-iot-base.yaml to sync with osbuild iot-commit Adds ssh-key-dir and ignition-edge packages to base yaml. ssh-key-dir is needed to transfer ssh keys to the iot system during boot and ignition-edge is needed to allow ssh-key-dir to work properly. Explicitly adds fedora-iot-config package. Was previously pulled in as a requirement, added for clarity. Adds fdo-owner-cli package to increase FDO functionality. These changes should help bring the package list more in line with the osbuild iot-commit, as well as rectifying issue 70 and issue 49 (relating to ssh key login and home directory creation on iot systems). Issue 70: https://github.com/fedora-iot/iot-distro/issues/70 Issue 49: https://github.com/fedora-iot/iot-distro/issues/49 Signed-off-by: djach7 --- fedora-iot-base.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 4c64cd1..e6358e3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -73,7 +73,11 @@ check-groups: type: file filename: group packages: +# This list of packages should be kept in sync with +# the iot-commit definition is osbuild, as found here: +# https://github.com/osbuild/images/blob/0584c20b0c14a89e833b875252114ceff61805e8/pkg/distro/fedora/package_sets.go#L123 - fedora-release-iot +- fedora-iot-config - aardvark-dns - atheros-firmware - attr @@ -105,6 +109,7 @@ packages: - e2fsprogs - efibootmgr - fdo-client +- fdo-owner-cli - firewalld - fwupd - fwupd-efi @@ -118,6 +123,7 @@ packages: - gzip - hostname - ignition +- ignition-edge - ima-evm-utils - iproute - iputils @@ -157,6 +163,7 @@ packages: - shadow-utils - skopeo - slirp4netns +- ssh-key-dir - sssd-client - sudo - systemd From c611d4da9615ec908287774382e88fcfaf9ff240 Mon Sep 17 00:00:00 2001 From: djach7 Date: Mon, 16 Dec 2024 14:58:43 -0500 Subject: [PATCH 090/118] Adds bootupd update to boot process Updates bootupd.yaml to enable bootupctl-update upon system boot. This allows bootupd to work as expected on Fedora IoT raw image systems, with all expected components installed. Signed-off-by: djach7 --- bootupd.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/bootupd.yaml b/bootupd.yaml index 3328d41..61a6a9a 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -11,3 +11,22 @@ postprocess: set -xeuo pipefail # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload /usr/bin/bootupctl backend generate-update-metadata + + # Trigger a bootloader update on boot + cat > /usr/lib/systemd/system/bootloader-update.service << 'EOF' + [Unit] + Description=Update bootloader on boot + Documentation=https://github.com/coreos/bootupd + ConditionFirmware=uefi + + [Service] + Type=oneshot + ExecStart=/usr/bin/bootupctl update + RemainAfterExit=yes + MountFlags=slave + + [Install] + WantedBy=multi-user.target + EOF + chmod 644 /usr/lib/systemd/system/bootloader-update.service + echo "enable bootloader-update.service" > /usr/lib/systemd/system-preset/81-iot.preset \ No newline at end of file From d6ec8e0b0e553a2ce129c21115f89d679b214641 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 4 Feb 2025 15:29:24 -0500 Subject: [PATCH 091/118] IoT: Update rawhide for F-43 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-42.repo => fedora-43.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-42.repo => fedora-43.repo (61%) diff --git a/config.ini b/config.ini index f7e27f5..f09325d 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f42 +release = f43 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-42.repo b/fedora-43.repo similarity index 61% rename from fedora-42.repo rename to fedora-43.repo index f9343b8..c510019 100644 --- a/fedora-42.repo +++ b/fedora-43.repo @@ -1,12 +1,12 @@ -[fedora-42] -name=Fedora 42 - $basearch +[fedora-43] +name=Fedora 43 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/42/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-42&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/43/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-43&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index e6358e3..11b35f3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -9,8 +9,8 @@ ima: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '42' -mutate-os-release: '42' +automatic_version_prefix: '43' +mutate-os-release: '43' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index f765bfe..2f1ddd3 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-42 +- fedora-43 From 625d7631959acac84ca8d6e9a9955c4cb3969a6e Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Fri, 7 Feb 2025 09:34:26 -0800 Subject: [PATCH 092/118] Replace basesystem with filesystem See https://src.fedoraproject.org/rpms/filesystem/c/3f741bf2a89c9e1bb685943c41fd298e6683dd50?branch=rawhide Signed-off-by: Adam Williamson --- fedora-iot-base.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 11b35f3..fc21de0 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -82,7 +82,6 @@ packages: - atheros-firmware - attr - authselect -- basesystem - bash - bash-completion - bootc @@ -110,6 +109,7 @@ packages: - efibootmgr - fdo-client - fdo-owner-cli +- filesystem - firewalld - fwupd - fwupd-efi From b799fe0c9d8bf09bcfa855b46599f60ecd190f17 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 18 Feb 2025 16:36:16 -0500 Subject: [PATCH 093/118] Remove Zezere and enable systemd-firstboot Remove Zezere and enable systemd-firstboot for local configuration. See: https://fedoraproject.org/wiki/Changes/Retire_Zezere Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index fc21de0..c61164b 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -179,7 +179,6 @@ packages: - wireless-regdb - xfsprogs - xz -- zezere-ignition - zram-generator - zram-generator-defaults packages-aarch64: @@ -200,6 +199,7 @@ units: - fedora-iot-config-remote-fix.service - firewalld.service - sshd.service +- systemd-firstboot.service - greenboot-grub2-set-counter.service - greenboot-grub2-set-success.service - greenboot-healthcheck.service @@ -208,5 +208,3 @@ units: - greenboot-task-runner.service - parsec.service - dbus-parsec.service -- zezere_ignition.timer -- zezere_ignition_banner.service From 17d9d31eb8216fc0ac4d1def372acae86bd4802d Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 18 Feb 2025 16:38:44 -0500 Subject: [PATCH 094/118] Drop parsec no longer supported upstream Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index c61164b..58d3480 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -99,7 +99,6 @@ packages: - criu-libs - cryptsetup - curl -- dbus-parsec - dnf5 - dnf5-plugins - dosfstools @@ -146,7 +145,6 @@ packages: - openssh-server - passt - passt-selinux -- parsec - pinentry - podman - policycoreutils @@ -206,5 +204,3 @@ units: - greenboot-rpm-ostree-grub2-check-fallback.service - greenboot-status.service - greenboot-task-runner.service -- parsec.service -- dbus-parsec.service From ce25ead8e58f35271963d19c792827de443ae869 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 19 Feb 2025 15:34:27 +0000 Subject: [PATCH 095/118] drop policycoreutils-python-utils in base The policycoreutils-python-utils pulls in a bunch of extra SELinux utils which aren't used in day to day, it pulls in a bunch of python packages, it can easily be layered and isn't generally needed. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 58d3480..c5071fa 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -148,7 +148,6 @@ packages: - pinentry - podman - policycoreutils -- policycoreutils-python-utils - polkit - procps-ng - realtek-firmware From b3fd2930a9249c25e94eb32bbe9dbdfc8843e254 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 24 Feb 2025 10:43:18 -0500 Subject: [PATCH 096/118] Disable ima in ostree due to ongoing compose issues See: https://bugzilla.redhat.com/show_bug.cgi?id=2346265 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index c5071fa..62a22bc 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -5,7 +5,6 @@ include: ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true -ima: true tmp-is-dir: true recommends: false documentation: false From a6e7212b561662f8ce507e51dd95ddc354785b45 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 27 Feb 2025 10:58:35 -0500 Subject: [PATCH 097/118] Migrate systems to a static GRUB config See: https://pagure.io/workstation-ostree-config/pull-request/591 https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops Signed-off-by: Paul Whalen --- bootupd.yaml | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-) diff --git a/bootupd.yaml b/bootupd.yaml index 61a6a9a..857de65 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -9,24 +9,18 @@ postprocess: - | #!/bin/bash set -xeuo pipefail + # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload /usr/bin/bootupctl backend generate-update-metadata - - # Trigger a bootloader update on boot - cat > /usr/lib/systemd/system/bootloader-update.service << 'EOF' - [Unit] - Description=Update bootloader on boot - Documentation=https://github.com/coreos/bootupd - ConditionFirmware=uefi - + + # Enable migration to a static GRUB config + install -dm0755 /usr/lib/systemd/system/bootloader-update.service.d + cat > /usr/lib/systemd/system/bootloader-update.service.d/migrate-static-grub-config.conf << 'EOF' [Service] - Type=oneshot - ExecStart=/usr/bin/bootupctl update - RemainAfterExit=yes - MountFlags=slave - - [Install] - WantedBy=multi-user.target + ExecStart=/usr/bin/bootupctl migrate-static-grub-config EOF - chmod 644 /usr/lib/systemd/system/bootloader-update.service - echo "enable bootloader-update.service" > /usr/lib/systemd/system-preset/81-iot.preset \ No newline at end of file + + echo "enable bootloader-update.service" >> /usr/lib/systemd/system-preset/80-iot.preset + + # Turn permissive mode on for bootupd until all SELinux issues are fixed + semanage permissive --noreload --add bootupd_t From c739a8c05ac86fd6f8b8091e9268e22561eb6a2d Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 27 Feb 2025 11:02:20 -0500 Subject: [PATCH 098/118] Enable composefs by default See: https://pagure.io/workstation-ostree-config/pull-request/591 https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops Signed-off-by: Paul Whalen --- composefs.yaml | 12 ++++++++++++ fedora-iot-base.yaml | 2 ++ 2 files changed, 14 insertions(+) create mode 100644 composefs.yaml diff --git a/composefs.yaml b/composefs.yaml new file mode 100644 index 0000000..8a721f3 --- /dev/null +++ b/composefs.yaml @@ -0,0 +1,12 @@ +# Enable composefs +# See: https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops +# https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' + [composefs] + enabled = yes + EOF diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 62a22bc..03e21c3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,6 +2,8 @@ include: - bootupd.yaml # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - grub2-workaround.yaml + # Enable composefs + - composefs.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true From 6529ca201d34fc21b338722c97fcccddb5e4ea42 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 27 Feb 2025 14:40:52 +0000 Subject: [PATCH 099/118] iot: drop kernel-tools It too should be layered, not included in the base image. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 03e21c3..11e982f 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -130,7 +130,6 @@ packages: - iwd - iwlwifi-mvm-firmware - kernel -- kernel-tools - keyutils - less - libsss_sudo From 2fda060e855080cb329c5d637a7dfca68e8e8999 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 6 Mar 2025 14:02:39 -0500 Subject: [PATCH 100/118] Remove grub2-workaround Remove grub2-workaround, bug has been fixed. See: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 -- grub2-workaround.yaml | 22 ---------------------- 2 files changed, 24 deletions(-) delete mode 100644 grub2-workaround.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 11e982f..1c13f3f 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,7 +1,5 @@ include: - bootupd.yaml - # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - - grub2-workaround.yaml # Enable composefs - composefs.yaml ref: fedora/rawhide/${basearch}/iot diff --git a/grub2-workaround.yaml b/grub2-workaround.yaml deleted file mode 100644 index 3b58a9e..0000000 --- a/grub2-workaround.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# Temporarily disable new GRUB2 config options until we can ensure that we -# have an updated bootloader via bootupd. -# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 -# See: https://github.com/fedora-silverblue/issue-tracker/issues/587 -postprocess: - - | - #!/usr/bin/env bash - set -xeuo pipefail - - # Completely disable this module - sed -i '2i exit 0' /etc/grub.d/25_bli - - # Skip check that was not performed in previous Fedora versions - sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware - sed -i '/\tif/d' /etc/grub.d/30_uefi-firmware - sed -i '/\tfi/d' /etc/grub.d/30_uefi-firmware - sed -i 's/\t\t/\t/' /etc/grub.d/30_uefi-firmware - - # Verify that the content matches what we expect the file to look like. - # This will fail the build here instead of breaking users' systems. - hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b" - echo "$hash /etc/grub.d/30_uefi-firmware" | sha256sum -c From 6b92bbcbbc38b5c50cebf01c1f78115376949789 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Fri, 7 Mar 2025 13:49:18 +0100 Subject: [PATCH 101/118] Remove fedora-bootc-base Now moved to https://github.com/fedora-iot/fedora-iot-bootc --- fedora-bootc-base/basic-fixes.yaml | 29 -------- fedora-bootc-base/bootc-config.yaml | 0 fedora-bootc-base/bootc.yaml | 16 ----- fedora-bootc-base/bootupd.yaml | 31 -------- fedora-bootc-base/group | 46 ------------ fedora-bootc-base/grub2-removals.yaml | 8 --- fedora-bootc-base/initramfs.yaml | 24 ------- fedora-bootc-base/iot.yaml | 100 -------------------------- fedora-bootc-base/kernel.yaml | 6 -- fedora-bootc-base/manifest.yaml | 65 ----------------- fedora-bootc-base/ostree.yaml | 17 ----- fedora-bootc-base/passwd | 32 --------- 12 files changed, 374 deletions(-) delete mode 100644 fedora-bootc-base/basic-fixes.yaml delete mode 100644 fedora-bootc-base/bootc-config.yaml delete mode 100644 fedora-bootc-base/bootc.yaml delete mode 100644 fedora-bootc-base/bootupd.yaml delete mode 100644 fedora-bootc-base/group delete mode 100644 fedora-bootc-base/grub2-removals.yaml delete mode 100644 fedora-bootc-base/initramfs.yaml delete mode 100644 fedora-bootc-base/iot.yaml delete mode 100644 fedora-bootc-base/kernel.yaml delete mode 100644 fedora-bootc-base/manifest.yaml delete mode 100644 fedora-bootc-base/ostree.yaml delete mode 100644 fedora-bootc-base/passwd diff --git a/fedora-bootc-base/basic-fixes.yaml b/fedora-bootc-base/basic-fixes.yaml deleted file mode 100644 index d9fe059..0000000 --- a/fedora-bootc-base/basic-fixes.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# Fix general bugs - -postprocess: - # See also https://github.com/openshift/os/blob/f6cde963ee140c02364674db378b2bc4ac42675b/common.yaml#L156 - # This one is undoes the effect of - # # RHEL-only: Disable /tmp on tmpfs. - #Wants=tmp.mount - # in /usr/lib/systemd/system/basic.target - # We absolutely must have tmpfs-on-tmp for multiple reasons, - # but the biggest is that when we have composefs for / it's read-only, - # and for units with ProtectSystem=full systemd clones / but needs - # a writable place. - - | - #!/usr/bin/env bash - set -xeuo pipefail - mkdir -p /usr/lib/systemd/system/local-fs.target.wants - if test '!' -f /usr/lib/systemd/system/local-fs.target.wants/tmp.mount; then - ln -sf ../tmp.mount /usr/lib/systemd/system/local-fs.target.wants - fi - - # See https://github.com/containers/bootc/issues/358 - # basically systemd-tmpfiles doesn't follow symlinks; ordinarily our - # tmpfiles.d unit for `/var/roothome` is fine, but this actually doesn't - # work if we want to use tmpfiles.d to write to `/root/.ssh` because - # tmpfiles gives up on that before getting to `/var/roothome`. - sed -ie 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf - # Because /var/roothome is also defined in rpm-ostree-0-integration.conf - # we need to delete /var/roothome - sed -ie '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml deleted file mode 100644 index d44ee08..0000000 --- a/fedora-bootc-base/bootc.yaml +++ /dev/null @@ -1,16 +0,0 @@ -# The bootc components. -packages: - - systemd - - bootc - # bootc pulls in podman, which pulls in containers-common, which wants - # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name - # iptables-nft instead to satisfy it. - - iptables-nft - # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk - - gdisk xfsprogs e2fsprogs dosfstools - -exclude-packages: - # Exclude kernel-debug-core to make sure that it doesn't somehow get - # chosen as the package to satisfy the `kernel-core` dependency from - # the kernel package. - - kernel-debug-core diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml deleted file mode 100644 index cc83d20..0000000 --- a/fedora-bootc-base/bootupd.yaml +++ /dev/null @@ -1,31 +0,0 @@ -# Integration with https://github.com/coreos/bootupd and bootloader logic -# xref https://github.com/coreos/fedora-coreos-tracker/issues/510 -packages: - - bootupd - -# bootloader -packages-aarch64: - - grub2-efi-aa64 efibootmgr shim -packages-ppc64le: - - grub2 ostree-grub2 -packages-s390x: - # On Fedora, this is provided by s390utils-core. on RHEL, this is for now - # provided by s390utils-base, but soon will be -core too. - - /usr/sbin/zipl -packages-x86_64: - - grub2-efi-x64 efibootmgr shim - - microcode_ctl - -conditional-include: - - if: basearch != "s390x" - # And remove some cruft from grub2 - include: grub2-removals.yaml - -postprocess: - - | - #!/bin/bash - set -xeuo pipefail - # Until we have https://github.com/coreos/rpm-ostree/pull/2275 - mkdir -p /run - # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload - /usr/bin/bootupctl backend generate-update-metadata diff --git a/fedora-bootc-base/group b/fedora-bootc-base/group deleted file mode 100644 index 2fd197c..0000000 --- a/fedora-bootc-base/group +++ /dev/null @@ -1,46 +0,0 @@ -root:x:0: -bin:x:1: -daemon:x:2: -sys:x:3: -adm:x:4: -tty:x:5: -disk:x:6: -lp:x:7: -mem:x:8: -kmem:x:9: -wheel:x:10: -cdrom:x:11: -mail:x:12: -man:x:15: -sudo:x:16: -dialout:x:18: -floppy:x:19: -games:x:20: -tape:x:33: -video:x:39: -ftp:x:50: -lock:x:54: -audio:x:63: -nobody:x:99: -users:x:100: -ssh_keys:x:999: -systemd-journal:x:190: -polkitd:x:998: -etcd:x:997: -dip:x:40: -cgred:x:996: -avahi-autoipd:x:170: -sssd:x:993: -dockerroot:x:986: -rpcuser:x:29: -nfsnobody:x:65534: -kube:x:994: -chrony:x:992: -tcpdump:x:72: -ceph:x:167: -input:x:104: -systemd-timesync:x:991: -systemd-network:x:990: -systemd-resolve:x:989: -systemd-bus-proxy:x:988: -cockpit-ws:x:987: diff --git a/fedora-bootc-base/grub2-removals.yaml b/fedora-bootc-base/grub2-removals.yaml deleted file mode 100644 index f4800dd..0000000 --- a/fedora-bootc-base/grub2-removals.yaml +++ /dev/null @@ -1,8 +0,0 @@ -remove-from-packages: - # The grub bits are mainly designed for desktops, and IMO haven't seen - # enough testing in concert with ostree. At some point we'll flesh out - # the full plan in https://github.com/coreos/fedora-coreos-tracker/issues/47 - - [grub2-tools, /etc/grub.d/08_fallback_counting, - /etc/grub.d/10_reset_boot_success, - /etc/grub.d/12_menu_auto_hide, - /usr/lib/systemd/.*] diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml deleted file mode 100644 index fe4bbeb..0000000 --- a/fedora-bootc-base/initramfs.yaml +++ /dev/null @@ -1,24 +0,0 @@ -# Configuration for the initramfs -postprocess: - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/dracut/dracut.conf.d - cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' - # We want a generic image; hostonly makes no sense as part of a server side build - hostonly=no - add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " - EOF - cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' - # Extra modules that we want by default that are known to exist in the kernel - add_dracutmodules+=" virtiofs " - EOF - cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' - # We want this for systemd-cryptsetup tpm2 locking - add_dracutmodules+=" tpm2-tss " - EOF - cat > /usr/lib/dracut/dracut.conf.d/59-altfiles.conf << 'EOF' - # https://issues.redhat.com/browse/RHEL-49590 - # On image mode systems we use nss-altfiles for passwd and group, - # this makes sure dracut uses them which also fixes kdump writing to NFS. - install_items+=" /usr/lib/passwd /usr/lib/group " - EOF diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml deleted file mode 100644 index 611ff9a..0000000 --- a/fedora-bootc-base/iot.yaml +++ /dev/null @@ -1,100 +0,0 @@ -# Fedora IoT specific packages -packages: - - fedora-release-iot - - aardvark-dns - - atheros-firmware - - attr - - authselect - - basesystem - - bash - - bash-completion - - brcmfmac-firmware - - chrony - - clevis - - clevis-dracut - - clevis-luks - - clevis-pin-tpm2 - - containernetworking-plugins - - coreutils - - cracklib-dicts - - criu - - criu-libs - - cryptsetup - - curl - - dbus-parsec - - dnf5-plugins - - dracut-config-generic - - dracut-network - - efibootmgr - - fdo-client - - firewalld - - fwupd - - fwupd-efi - - fwupd-plugin-modem-manager - - fwupd-plugin-uefi-capsule-data - - glibc - - glibc-minimal-langpack - - gnupg2 - - greenboot - - greenboot-default-health-checks - - gzip - - hostname - - ignition - - ima-evm-utils - - iproute - - iputils - - iwd - - iwlwifi-mvm-firmware - - kernel-tools - - keyutils - - less - - libsss_sudo - - linux-firmware - - lvm2 - - netavark - - NetworkManager - - NetworkManager-wifi - - NetworkManager-wwan - - nss-altfiles - - openssl - - openssh-clients - - openssh-server - - passt - - passt-selinux - - parsec - - pinentry - - podman - - policycoreutils - - policycoreutils-python-utils - - polkit - - procps-ng - - realtek-firmware - - rootfiles - - rpm - - screen - - setools-console - - setup - - shadow-utils - - skopeo - - slirp4netns - - sssd-client - - sudo - - systemd-resolved - - tar - - tmux - - tpm2-pkcs11 - - traceroute - - usbguard - - util-linux - - vim-minimal - - wpa_supplicant - - wireless-regdb - - xz - - zezere-ignition - - zram-generator - - zram-generator-defaults -packages-aarch64: - - arm-image-installer - - bcm283x-firmware - - optee_client - - uboot-images-armv8 diff --git a/fedora-bootc-base/kernel.yaml b/fedora-bootc-base/kernel.yaml deleted file mode 100644 index 0dd777d..0000000 --- a/fedora-bootc-base/kernel.yaml +++ /dev/null @@ -1,6 +0,0 @@ -# Enable the Linux kernel; see also kernel-rt. -packages: - - kernel - -exclude-packages: - - kernel-debug diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml deleted file mode 100644 index 9a21ff3..0000000 --- a/fedora-bootc-base/manifest.yaml +++ /dev/null @@ -1,65 +0,0 @@ - -# Modern defaults we want -boot-location: modules -tmp-is-dir: true -# https://github.com/CentOS/centos-bootc/issues/167 -machineid-compat: true -# Be minimal -recommends: false - -ignore-removed-users: - - root -ignore-removed-groups: - - root -etc-group-members: - - wheel - - sudo - - systemd-journal - - adm - -# Default to `bash` in our container, the same as other containers we ship. -container-cmd: - - /sbin/init - -# Note that the default for c9s+ is sqlite; we can't rely on rpm being -# in the target (it isn't in tier-0!) so turn this to host here. This -# does break the "hermetic build" aspect a bit. Maybe eventually -# what we should do is special case this and actually install RPM temporarily -# and then remove it... -rpmdb: host - -check-passwd: - type: "file" - filename: "passwd" -check-groups: - type: "file" - filename: "group" - -automatic-version-prefix: "${releasever}." -mutate-os-release: "${releasever}" - -remove-from-packages: - # Generally we expect other tools to do this (e.g. Ignition or cloud-init) - - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service] - # We don't want auto-generated mount units. See also - # https://github.com/systemd/systemd/issues/13099 - - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator] - -include: - - bootc.yaml - - bootupd.yaml - - ostree.yaml - - initramfs.yaml - - basic-fixes.yaml - - iot.yaml - -packages: - # needed for building derived container images - - dnf5 - # Even in tier-0, we have this. If you don't want SELinux today, you'll need - # to build a custom image. - - selinux-policy-targeted - # And we want container-selinux because trying to layer it on later currently causes issues. - - container-selinux - # Needed for tpm2 bound luks - - tpm2-tools diff --git a/fedora-bootc-base/ostree.yaml b/fedora-bootc-base/ostree.yaml deleted file mode 100644 index 6f30861..0000000 --- a/fedora-bootc-base/ostree.yaml +++ /dev/null @@ -1,17 +0,0 @@ -packages: - - ostree nss-altfiles - -# We want content lifecycled with the image -opt-usrlocal: "root" - -postprocess: - # Set up default root config - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/ostree - cat > /usr/lib/ostree/prepare-root.conf << EOF - [composefs] - enabled = yes - [sysroot] - readonly = true - EOF diff --git a/fedora-bootc-base/passwd b/fedora-bootc-base/passwd deleted file mode 100644 index ea84802..0000000 --- a/fedora-bootc-base/passwd +++ /dev/null @@ -1,32 +0,0 @@ -adm:x:3:4:adm:/var/adm:/usr/sbin/nologin -avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin -bin:x:1:1:bin:/bin:/usr/sbin/nologin -ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin -chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin -cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin -daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin -dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin -dockerroot:x:997:986:Docker User:/var/lib/docker:/usr/sbin/nologin -etcd:x:998:997:etcd user:/var/lib/etcd:/usr/sbin/nologin -ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin -games:x:12:100:games:/usr/games:/usr/sbin/nologin -halt:x:7:0:halt:/sbin:/sbin/halt -kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin -lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin -mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin -nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin -nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin -operator:x:11:0:operator:/root:/usr/sbin/nologin -polkitd:x:999:998:User for polkitd:/:/usr/sbin/nologin -root:x:0:0:Super User:/root:/bin/bash -rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin -rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin -shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown -sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin -sssd:x:995:993:User for sssd:/:/usr/sbin/nologin -sync:x:5:0:sync:/sbin:/bin/sync -systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin -systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin -systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin -systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin -tcpdump:x:72:72::/:/usr/sbin/nologin From e4bd292f1ab6ea63403b99efbe82e9c7fb47b602 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 19 Feb 2025 19:07:22 +0100 Subject: [PATCH 102/118] Whitespace & indentation cleanup --- bootupd.yaml | 4 ++-- fedora-iot.yaml | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/bootupd.yaml b/bootupd.yaml index 857de65..e15c48a 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,7 +1,7 @@ # KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml # See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml # -#Integration with https://github.com/coreos/bootupd +# Integration with https://github.com/coreos/bootupd packages: - bootupd @@ -12,7 +12,7 @@ postprocess: # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload /usr/bin/bootupctl backend generate-update-metadata - + # Enable migration to a static GRUB config install -dm0755 /usr/lib/systemd/system/bootloader-update.service.d cat > /usr/lib/systemd/system/bootloader-update.service.d/migrate-static-grub-config.conf << 'EOF' diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 2f1ddd3..7f39e3e 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,5 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot + repos: - fedora-43 From ce81f37ea5a7419a16eb03343c553129a96964c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 19 Feb 2025 19:07:37 +0100 Subject: [PATCH 103/118] ci: Add a script to help validate manifest syntax --- ci/validate | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100755 ci/validate diff --git a/ci/validate b/ci/validate new file mode 100755 index 0000000..c9e6a32 --- /dev/null +++ b/ci/validate @@ -0,0 +1,57 @@ +#!/usr/bin/python3 +# Validate basic syntax of shell script and yaml. + +import os +import stat +import subprocess +import yaml + +validated=0 + +def openat(dirfd, name, mode='r'): + def opener(path, flags): + return os.open(path, flags, dir_fd=dirfd) + return open(name, mode, opener=opener) + + +def validate_shell(rootfd, name): + subprocess.check_call(['bash', '-n', name], preexec_fn=lambda: os.fchdir(rootfd)) + global validated + validated +=1 + + +for root, dirs, files, rootfd in os.fwalk('.'): + # Skip folders that do not include content to validate + for d in ['.git', '.github', 'repo', 'cache', 'tmp', 'logs', 'fedora-comps']: + if d in dirs: + dirs.remove(d) + for f in ['.gitlab-ci.yml']: + if f in files: + files.remove(f) + for name in files: + if name.endswith(('.yaml', '.yml')): + print("Validating:", name) + with open(os.open(name, dir_fd=rootfd, flags=os.O_RDONLY)) as f: + yaml.safe_load(f) + result = subprocess.run(['grep', '-RniEv', '^( )*[a-z#/-]|^( )*\\[|^$|^#', name], encoding='UTF-8', + preexec_fn=lambda: os.fchdir(rootfd)) + if result.returncode == 0: + raise Exception("Found likely invalid indentation in YAML file: {}".format(name)) + validated +=1 + continue + elif name.endswith('.sh'): + print("Validating:", name) + validate_shell(rootfd, name) + continue + stbuf = os.lstat(name, dir_fd=rootfd) + if not stat.S_ISREG(stbuf.st_mode): + continue + if not stbuf.st_mode & stat.S_IXUSR: + continue + mimetype = subprocess.check_output(['file', '-b', '--mime-type', name], encoding='UTF-8', + preexec_fn=lambda: os.fchdir(rootfd)).strip() + if mimetype == 'text/x-shellscript': + print("Validating:", name) + validate_shell(rootfd, name) + +print(f"Validated {validated} files") From 465d88c040cc3f40e1967479f23aee90d84c0dde Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 19 Feb 2025 19:07:56 +0100 Subject: [PATCH 104/118] Add a justfile with common commands --- justfile | 156 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 156 insertions(+) create mode 100644 justfile diff --git a/justfile b/justfile new file mode 100644 index 0000000..313ea6c --- /dev/null +++ b/justfile @@ -0,0 +1,156 @@ +# This is a justfile. See https://github.com/casey/just +# This is only used for local development. The builds made on the Fedora +# infrastructure are run via Pungi in a Koji runroot. + +# Set a default for some recipes +default_variant := "fedora-iot" +default_arch := "default" +# Current default in Pungi +force_nocache := "true" + +# Just doesn't have a native dict type, but quoted bash dictionary works fine +pretty_names := '( + [fedora-iot]="IoT" +)' + +# Default is to only validate the manifests +all: validate + +# Basic validation to make sure the manifests are not completely broken +validate: + ./ci/validate + +# Output the processed manifest for a given variant (defaults to Silverblue) +manifest variant=default_variant: + #!/bin/bash + set -euo pipefail + + rpm-ostree compose tree --print-only --repo=repo {{variant}}.yaml + +# Perform dependency resolution for a given variant (defaults to Silverblue) +compose-dry-run variant=default_variant: + #!/bin/bash + set -euxo pipefail + + mkdir -p repo cache logs + if [[ ! -f "repo/config" ]]; then + pushd repo > /dev/null || exit 1 + ostree init --repo . --mode=bare-user + popd > /dev/null || exit 1 + fi + + rpm-ostree compose tree --unified-core --repo=repo --dry-run {{variant}}.yaml + +# Alias/shortcut for compose-image command +compose variant=default_variant: (compose-image variant) + +# Compose a variant using the legacy non container path (defaults to Silverblue) +compose-legacy variant=default_variant: + #!/bin/bash + set -euxo pipefail + + declare -A pretty_names={{pretty_names}} + variant={{variant}} + variant_pretty=${pretty_names[$variant]-} + if [[ -z $variant_pretty ]]; then + echo "Unknown variant" + exit 1 + fi + + ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1) + + mkdir -p repo cache logs + if [[ ! -f "repo/config" ]]; then + pushd repo > /dev/null || exit 1 + ostree init --repo . --mode=bare-user + popd > /dev/null || exit 1 + fi + # Set option to reduce fsync for transient builds + ostree --repo=repo config set 'core.fsync' 'false' + + buildid="$(date '+%Y%m%d.0')" + timestamp="$(date --iso-8601=sec)" + echo "${buildid}" > .buildid + + version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')" + echo "Composing ${variant_pretty} ${version}.${buildid} ..." + + ARGS="--repo=repo --cachedir=cache" + ARGS+=" --unified-core" + if [[ {{force_nocache}} == "true" ]]; then + ARGS+=" --force-nocache" + fi + CMD="rpm-ostree" + if [[ ${EUID} -ne 0 ]]; then + CMD="sudo rpm-ostree" + fi + + ${CMD} compose tree ${ARGS} \ + --add-metadata-string="version=${variant_pretty} ${version}.${buildid}" \ + "${variant}-ostree.yaml" \ + |& tee "logs/${variant}_${version}_${buildid}.${timestamp}.log" + + if [[ ${EUID} -ne 0 ]]; then + sudo chown --recursive "$(id --user --name):$(id --group --name)" repo cache + fi + + ostree summary --repo=repo --update + +# Compose an Ostree Native Container OCI image +compose-image variant=default_variant: + #!/bin/bash + set -euxo pipefail + + declare -A pretty_names={{pretty_names}} + variant={{variant}} + variant_pretty=${pretty_names[$variant]-} + if [[ -z $variant_pretty ]]; then + echo "Unknown variant" + exit 1 + fi + + ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1) + + mkdir -p repo cache + if [[ ! -f "repo/config" ]]; then + pushd repo > /dev/null || exit 1 + ostree init --repo . --mode=bare-user + popd > /dev/null || exit 1 + fi + # Set option to reduce fsync for transient builds + ostree --repo=repo config set 'core.fsync' 'false' + + buildid="$(date '+%Y%m%d.0')" + timestamp="$(date --iso-8601=sec)" + echo "${buildid}" > .buildid + + version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')" + echo "Composing ${variant_pretty} ${version}.${buildid} ..." + + ARGS="--cachedir=cache --initialize" + if [[ {{force_nocache}} == "true" ]]; then + ARGS+=" --force-nocache" + fi + # To debug with gdb, use: gdb --args ... + CMD="rpm-ostree" + if [[ ${EUID} -ne 0 ]]; then + CMD="sudo rpm-ostree" + fi + + ${CMD} compose image ${ARGS} \ + --label="quay.expires-after=4w" \ + "${variant}.yaml" \ + "${variant}.ociarchive" + +# Clean up everything +clean-all: + just clean-repo + just clean-cache + +# Only clean the ostree repo +clean-repo: + rm -rf ./repo + +# Only clean the package and repo caches +clean-cache: + rm -rf ./cache From c7f2ffe7cb170e0ae1180f2a10442b0718d622a2 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 17 Mar 2025 13:19:32 -0400 Subject: [PATCH 105/118] Default root config to mount sysroot as read only See: https://github.com/fedora-iot/iot-distro/issues/81 https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 ++ sysroot-ro.yaml | 15 +++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 sysroot-ro.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 1c13f3f..08e92cf 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,6 +2,8 @@ include: - bootupd.yaml # Enable composefs - composefs.yaml + # Read only sysroot + - sysroot-ro.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/sysroot-ro.yaml b/sysroot-ro.yaml new file mode 100644 index 0000000..8214f05 --- /dev/null +++ b/sysroot-ro.yaml @@ -0,0 +1,15 @@ +# Set up default root config to mount sysroot as read only +# https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot +# See: https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml +# See: https://github.com/fedora-iot/iot-distro/issues/81 + +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + install -dm 0755 -o 0 -g 0 /usr/lib/ostree + cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' + [sysroot] + readonly = true + EOF From cc96761b139c82ffa91d8271e223e2318aa78361 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 11 Aug 2025 14:25:38 -0400 Subject: [PATCH 106/118] IoT: Update rawhide for F-44 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-43.repo => fedora-44.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-43.repo => fedora-44.repo (61%) diff --git a/config.ini b/config.ini index f09325d..4dbcdf5 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f43 +release = f44 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-43.repo b/fedora-44.repo similarity index 61% rename from fedora-43.repo rename to fedora-44.repo index c510019..99cde87 100644 --- a/fedora-43.repo +++ b/fedora-44.repo @@ -1,12 +1,12 @@ -[fedora-43] -name=Fedora 43 - $basearch +[fedora-44] +name=Fedora 44 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/43/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-43&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/44/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-44&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 08e92cf..2172526 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -10,8 +10,8 @@ selinux: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '43' -mutate-os-release: '43' +automatic_version_prefix: '44' +mutate-os-release: '44' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 7f39e3e..8da9960 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -2,4 +2,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-43 +- fedora-44 From fc7be035129cd2246053197056b0dedd3de25551 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 4 Feb 2026 11:07:52 -0500 Subject: [PATCH 107/118] fix: drop ssh-key-dir Package has been deprecated in F44. See: https://github.com/coreos/ssh-key-dir/issues/188 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 2172526..116e78f 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -160,7 +160,6 @@ packages: - shadow-utils - skopeo - slirp4netns -- ssh-key-dir - sssd-client - sudo - systemd From dccd3a2e18cbe1c3e7ae121cdd738e61693043f4 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 6 Feb 2026 11:22:08 -0500 Subject: [PATCH 108/118] IoT: Update rawhide for F-45 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-44.repo => fedora-45.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-44.repo => fedora-45.repo (61%) diff --git a/config.ini b/config.ini index 4dbcdf5..2e7f7da 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f44 +release = f45 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-44.repo b/fedora-45.repo similarity index 61% rename from fedora-44.repo rename to fedora-45.repo index 99cde87..85e6dd9 100644 --- a/fedora-44.repo +++ b/fedora-45.repo @@ -1,12 +1,12 @@ -[fedora-44] -name=Fedora 44 - $basearch +[fedora-45] +name=Fedora 45 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/44/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-44&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/45/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-45&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-45-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 116e78f..6178ec3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -10,8 +10,8 @@ selinux: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '44' -mutate-os-release: '44' +automatic_version_prefix: '45' +mutate-os-release: '45' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 8da9960..4e3caeb 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -2,4 +2,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-44 +- fedora-45 From 240bff70e742b6916271144f9d61ca79bc98f24b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 10 Feb 2026 15:44:02 -0500 Subject: [PATCH 109/118] fix: add systemd-pam to fix rootless podman In Fedora 44 systemd changed systemd-pam to recommends and it was dropped from the compose. See: https://github.com/fedora-iot/iot-distro/issues/127 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 6178ec3..d159307 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -163,6 +163,7 @@ packages: - sssd-client - sudo - systemd +- systemd-pam - systemd-resolved - tar - tmux From e0898e8a38c5b9a5a9bc848bdd5cb1d6e51b600b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 15:36:39 -0500 Subject: [PATCH 110/118] fix: restore SSH key management for Ignition Configures OpenSSH to read keys from ~/.ssh/authorized_keys.d/* in addition to authorized_keys, restoring functionality lost when ssh-key-dir was removed. Follows the same approach as CoreOS: https://github.com/coreos/fedora-coreos-config/pull/3885 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 +++- sshd-authorized-keys.yaml | 21 +++++++++++++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 sshd-authorized-keys.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index d159307..329fac2 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,9 +1,11 @@ -include: +include: - bootupd.yaml # Enable composefs - composefs.yaml # Read only sysroot - sysroot-ro.yaml + # SSH authorized keys configuration for Ignition + - sshd-authorized-keys.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml new file mode 100644 index 0000000..07657bc --- /dev/null +++ b/sshd-authorized-keys.yaml @@ -0,0 +1,21 @@ +# Configuration to have OpenSSH read authorized keys from files in +# ~/.ssh/authorized_keys.d/* in addition to ~/.ssh/authorized_keys +# This enables Ignition to write keys to authorized_keys.d/ignition +# +# Replaces the deprecated ssh-key-dir package +# See: https://github.com/coreos/ssh-key-dir/issues/188 +# See: https://github.com/coreos/fedora-coreos-config/pull/3885 + +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + # Create sshd config directory if it doesn't exist + install -dm 0755 -o 0 -g 0 /etc/ssh/sshd_config.d + + # Configure sshd to read keys from authorized_keys.d directory + cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' + # Also accept keys configured by Ignition and Afterburn + AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* + EOF From 7a121ed5e79b27529a6adaa3467b3c7f97e2d1ce Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 15:52:24 -0500 Subject: [PATCH 111/118] fix: do not create etc/ssh/sshd_config.d Do not create etc/ssh/sshd_config.d, it should already exist and is owned by openssh-clients and systemd. Signed-off-by: Paul Whalen --- sshd-authorized-keys.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml index 07657bc..600321f 100644 --- a/sshd-authorized-keys.yaml +++ b/sshd-authorized-keys.yaml @@ -11,9 +11,6 @@ postprocess: #!/usr/bin/env bash set -xeuo pipefail - # Create sshd config directory if it doesn't exist - install -dm 0755 -o 0 -g 0 /etc/ssh/sshd_config.d - # Configure sshd to read keys from authorized_keys.d directory cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' # Also accept keys configured by Ignition and Afterburn From 1b3ede31d963d32f8789f6e7393d4cd19bfe60a0 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 17:04:31 -0500 Subject: [PATCH 112/118] fix: use 90- prefix for authorized-keys-file.conf Updates the config file numbering to ensure crypto policies(40) and security configs(50) are applied before user keys are sourced. Signed-off-by: Paul Whalen --- sshd-authorized-keys.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml index 600321f..4080a64 100644 --- a/sshd-authorized-keys.yaml +++ b/sshd-authorized-keys.yaml @@ -12,7 +12,7 @@ postprocess: set -xeuo pipefail # Configure sshd to read keys from authorized_keys.d directory - cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' + cat > /etc/ssh/sshd_config.d/90-authorized-keys-file.conf << 'EOF' # Also accept keys configured by Ignition and Afterburn AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* EOF From e49d841a842753be9b7d3ff0fd5dabdf38cda6f6 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 26 Feb 2026 15:07:19 -0500 Subject: [PATCH 113/118] fix: drop sshd-authorized-keys workaround Openssh config snippet now shipped with ignition. See: https://src.fedoraproject.org/rpms/ignition/pull-request/143 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 -- sshd-authorized-keys.yaml | 18 ------------------ 2 files changed, 20 deletions(-) delete mode 100644 sshd-authorized-keys.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 329fac2..ed81137 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -4,8 +4,6 @@ include: - composefs.yaml # Read only sysroot - sysroot-ro.yaml - # SSH authorized keys configuration for Ignition - - sshd-authorized-keys.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml deleted file mode 100644 index 4080a64..0000000 --- a/sshd-authorized-keys.yaml +++ /dev/null @@ -1,18 +0,0 @@ -# Configuration to have OpenSSH read authorized keys from files in -# ~/.ssh/authorized_keys.d/* in addition to ~/.ssh/authorized_keys -# This enables Ignition to write keys to authorized_keys.d/ignition -# -# Replaces the deprecated ssh-key-dir package -# See: https://github.com/coreos/ssh-key-dir/issues/188 -# See: https://github.com/coreos/fedora-coreos-config/pull/3885 - -postprocess: - - | - #!/usr/bin/env bash - set -xeuo pipefail - - # Configure sshd to read keys from authorized_keys.d directory - cat > /etc/ssh/sshd_config.d/90-authorized-keys-file.conf << 'EOF' - # Also accept keys configured by Ignition and Afterburn - AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* - EOF From ce421037460b975d95281855fb2ae9f027eba285 Mon Sep 17 00:00:00 2001 From: Joel Capitao Date: Thu, 12 Mar 2026 09:44:22 +0100 Subject: [PATCH 114/118] Remove ignition package Since [1], the ignition-edge subpackage requires ignition, so it's no longer needed to require ignition explicitly here. [1] https://src.fedoraproject.org/rpms/ignition/c/3ccce9fe2c0462f4a17923937933ab9c26db0aa5?branch=rawhide --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index ed81137..fc454fd 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -122,7 +122,6 @@ packages: - greenboot-default-health-checks - gzip - hostname -- ignition - ignition-edge - ima-evm-utils - iproute From 3738d4889fe646799213cd552c01421b5611a84f Mon Sep 17 00:00:00 2001 From: Kenneth Giusti Date: Mon, 15 Jun 2026 12:56:47 -0400 Subject: [PATCH 115/118] fix: use kmscon as default VT console The kernel console fbcon has been replaced with the userspace console kmscon in Fedora 45. See: https://github.com/fedora-iot/iot-distro/issues/137 Signed-off-by: Kenneth Giusti --- fedora-iot-base.yaml | 1 + justfile | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index fc454fd..f15f5e3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -130,6 +130,7 @@ packages: - iwlwifi-mvm-firmware - kernel - keyutils +- kmscon - less - libsss_sudo - linux-firmware diff --git a/justfile b/justfile index 313ea6c..3eaf256 100644 --- a/justfile +++ b/justfile @@ -87,7 +87,7 @@ compose-legacy variant=default_variant: ${CMD} compose tree ${ARGS} \ --add-metadata-string="version=${variant_pretty} ${version}.${buildid}" \ - "${variant}-ostree.yaml" \ + "${variant}.yaml" \ |& tee "logs/${variant}_${version}_${buildid}.${timestamp}.log" if [[ ${EUID} -ne 0 ]]; then From 63d2e9c3f52e65f502cefafb39725f4b13e8843f Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 28 Jul 2026 16:15:56 -0400 Subject: [PATCH 116/118] Update workstation-ostree-config references to Forge - bootupd.yaml: Update comment URL to atomic-desktops/config on Forge - treecompose-post.sh: Update comment URL to atomic-desktops/config on Forge Assisted-by: Claude Opus 4.6 Signed-off-by: Paul Whalen --- bootupd.yaml | 2 +- treecompose-post.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/bootupd.yaml b/bootupd.yaml index e15c48a..62ebb0d 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,5 +1,5 @@ # KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml -# See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml +# See also: https://forge.fedoraproject.org/atomic-desktops/config/src/branch/main/bootupd.yaml # # Integration with https://github.com/coreos/bootupd packages: diff --git a/treecompose-post.sh b/treecompose-post.sh index a47d8cf..e62b942 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -18,7 +18,7 @@ done # Remove loader directory causing issues in Anaconda in unified core mode # Will be obsolete once we start using bootupd -# See - https://pagure.io/workstation-ostree-config/pull-request/344 +# See - https://forge.fedoraproject.org/atomic-desktops/config/pulls/344 rm -rf /usr/lib/ostree-boot/loader # Undo RPM scripts enabling units; we want the presets to be canonical From f570c87de928f01e14722144ff3d227c151201d0 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 12 Aug 2026 10:17:54 -0400 Subject: [PATCH 117/118] Bump rawhide to Fedora 46 --- config.ini | 2 +- fedora-46.repo | 12 ++++++++++++ fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 16 insertions(+), 4 deletions(-) create mode 100644 fedora-46.repo diff --git a/config.ini b/config.ini index 2e7f7da..a91c1c6 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f45 +release = f46 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-46.repo b/fedora-46.repo new file mode 100644 index 0000000..3af8c93 --- /dev/null +++ b/fedora-46.repo @@ -0,0 +1,12 @@ +[fedora-46] +name=Fedora 46 - $basearch +failovermethod=priority +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/46/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-46&arch=$basearch +enabled=1 +#metadata_expire=7d +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch +skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index f15f5e3..79160b5 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -10,8 +10,8 @@ selinux: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '45' -mutate-os-release: '45' +automatic_version_prefix: '46' +mutate-os-release: '46' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 4e3caeb..b770dff 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -2,4 +2,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-45 +- fedora-46 From 87eaa6a42bd33968869d8f4a1cf9ef596e3ce74b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 17 Aug 2026 14:41:53 -0400 Subject: [PATCH 118/118] Update gpgkey path in fedora-46.repo, drop unused fedora-45.repo Update gpgkey path in fedora-46.repo from /etc/pki/rpm-gpg/ to /usr/share/pki/rpm-gpg/ for the F45 GPG key relocation. See: https://discussion.fedoraproject.org/t/f45-change-proposal-relocate-rpm-repo-configs-to-usr-selfcontained/188916 Remove fedora-45.repo from main (rawhide) - it belongs on f45-branch. Assisted-by: Claude Opus 4.6 Signed-off-by: Paul Whalen --- fedora-45.repo | 12 ------------ fedora-46.repo | 2 +- 2 files changed, 1 insertion(+), 13 deletions(-) delete mode 100644 fedora-45.repo diff --git a/fedora-45.repo b/fedora-45.repo deleted file mode 100644 index 85e6dd9..0000000 --- a/fedora-45.repo +++ /dev/null @@ -1,12 +0,0 @@ -[fedora-45] -name=Fedora 45 - $basearch -failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/45/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-45&arch=$basearch -enabled=1 -#metadata_expire=7d -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-45-$basearch -skip_if_unavailable=False diff --git a/fedora-46.repo b/fedora-46.repo index 3af8c93..03af70c 100644 --- a/fedora-46.repo +++ b/fedora-46.repo @@ -8,5 +8,5 @@ enabled=1 repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch +gpgkey=file:///usr/share/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch skip_if_unavailable=False