diff --git a/bootupd.yaml b/bootupd.yaml index 949f504..3328d41 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,3 +1,7 @@ +# KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml +# See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml +# +#Integration with https://github.com/coreos/bootupd packages: - bootupd diff --git a/composefs.yaml b/composefs.yaml new file mode 100644 index 0000000..c51f832 --- /dev/null +++ b/composefs.yaml @@ -0,0 +1,11 @@ +# Force disable composefs +# See: https://github.com/ostreedev/ostree/pull/3353 +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' + [composefs] + enabled = no + EOF diff --git a/config.ini b/config.ini index 0b65ffb..d4c4586 100644 --- a/config.ini +++ b/config.ini @@ -11,8 +11,8 @@ tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 release = f41 -ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s -yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ +ref = %(os_name)s/stable/%(arch)s/%(tree_name)s +yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/releases/41/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot docker_os_name = fedora diff --git a/fedora-bootc-base/autoupdates.yaml b/fedora-bootc-base/autoupdates.yaml deleted file mode 100644 index a416699..0000000 --- a/fedora-bootc-base/autoupdates.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# Enable automatic updates by default -postprocess: - - | - #!/usr/bin/env bash - set -euo pipefail - target=/usr/lib/systemd/system/default.target.wants - mkdir -p $target - set -x - ln -s ../bootc-fetch-apply-updates.timer $target diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml index 4d4b24e..e69de29 100644 --- a/fedora-bootc-base/bootc-config.yaml +++ b/fedora-bootc-base/bootc-config.yaml @@ -1,10 +0,0 @@ -# Configuration for bootc -postprocess: - # ext4 is our default filesystem in iot - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/bootc/install/ - cat > /usr/lib/bootc/install/20-default-root.toml << EOF - [install] - root-fs-type = "ext4" - EOF diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml index 7d3ebf3..cc83d20 100644 --- a/fedora-bootc-base/bootupd.yaml +++ b/fedora-bootc-base/bootupd.yaml @@ -13,7 +13,7 @@ packages-s390x: # provided by s390utils-base, but soon will be -core too. - /usr/sbin/zipl packages-x86_64: - - grub2 grub2-efi-x64 efibootmgr shim + - grub2-efi-x64 efibootmgr shim - microcode_ctl conditional-include: diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml index de65333..95146e2 100644 --- a/fedora-bootc-base/initramfs.yaml +++ b/fedora-bootc-base/initramfs.yaml @@ -6,13 +6,13 @@ postprocess: cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' # We want a generic image; hostonly makes no sense as part of a server side build hostonly=no - dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " + add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " EOF cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' # Extra modules that we want by default that are known to exist in the kernel - dracutmodules+=" virtiofs " + add_dracutmodules+=" virtiofs " EOF cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' # We want this for systemd-cryptsetup tpm2 locking - dracutmodules+=" tpm2-tss " + add_dracutmodules+=" systemd-cryptsetup tpm2-tss " EOF diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml new file mode 100644 index 0000000..2c02ca6 --- /dev/null +++ b/fedora-bootc-base/iot.yaml @@ -0,0 +1,113 @@ +# Fedora IoT specific packages +packages: + - fedora-release-iot + - aardvark-dns + - atheros-firmware + - attr + - authselect + - basesystem + - bash + - bash-completion + - bootc + - brcmfmac-firmware + - chrony + - clevis + - clevis-dracut + - clevis-luks + - clevis-pin-tpm2 + - container-selinux + - containernetworking-plugins + - coreutils + - cracklib-dicts + - criu + - criu-libs + - cryptsetup + - curl + - dbus-parsec + - dnf5-plugins + - dosfstools + - dracut-config-generic + - dracut-network + - e2fsprogs + - efibootmgr + - fdo-client + - firewalld + - fwupd + - fwupd-efi + - fwupd-plugin-modem-manager + - fwupd-plugin-uefi-capsule-data + - glibc + - glibc-minimal-langpack + - gnupg2 + - greenboot + - greenboot-default-health-checks + - gzip + - hostname + - ignition + - ima-evm-utils + - iproute + - iputils + - iwd + - iwlwifi-mvm-firmware + - kernel-tools + - keyutils + - less + - libsss_sudo + - linux-firmware + - lvm2 + - netavark + - NetworkManager + - NetworkManager-wifi + - NetworkManager-wwan + - nss-altfiles + - openssl + - openssh-clients + - openssh-server + - passt + - passt-selinux + - parsec + - pinentry + - podman + - policycoreutils + - policycoreutils-python-utils + - polkit + - procps-ng + - realtek-firmware + - rootfiles + - rpm + - screen + - selinux-policy-targeted + - setools-console + - setup + - shadow-utils + - skopeo + - slirp4netns + - sssd-client + - sudo + - systemd + - systemd-resolved + - tar + - tmux + - tpm2-pkcs11 + - traceroute + - usbguard + - util-linux + - vim-minimal + - wpa_supplicant + - wireless-regdb + - xfsprogs + - xz + - zezere-ignition + - zram-generator + - zram-generator-defaults +packages-aarch64: + - arm-image-installer + - bcm283x-firmware + - grub2-efi-aa64 + - optee_client + - shim-aa64 + - uboot-images-armv8 +packages-x86_64: + - grub2-efi-x64 + - microcode_ctl + - shim-x64 diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml index 007f6d7..f836419 100644 --- a/fedora-bootc-base/manifest.yaml +++ b/fedora-bootc-base/manifest.yaml @@ -50,13 +50,15 @@ remove-from-packages: include: - bootc.yaml + - bootupd.yaml - ostree.yaml - - bootc-config.yaml - initramfs.yaml - - autoupdates.yaml - basic-fixes.yaml + - iot.yaml packages: + # needed for building derived container images + - dnf5 # Even in tier-0, we have this. If you don't want SELinux today, you'll need # to build a custom image. - selinux-policy-targeted @@ -64,8 +66,3 @@ packages: - container-selinux # Needed for tpm2 bound luks - tpm2-tools - -# See https://github.com/coreos/bootupd -arch-include: - x86_64: bootupd.yaml - aarch64: bootupd.yaml diff --git a/fedora-bootc.yaml b/fedora-bootc.yaml deleted file mode 100644 index 7067275..0000000 --- a/fedora-bootc.yaml +++ /dev/null @@ -1,15 +0,0 @@ -releasever: rawhide -variables: - distro: "fedora" - -repos: - - fedora-rawhide - -metadata: - name: fedora-bootc - summary: Fedora base bootc image - -include: - - fedora-bootc-base/manifest.yaml - - fedora-bootc-base/kernel.yaml - diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 25d3bdd..4cc389a 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,5 +1,10 @@ -include: bootupd.yaml -ref: fedora/rawhide/${basearch}/iot +include: + - bootupd.yaml + # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 + - grub2-workaround.yaml + # Force disable composefs + - composefs.yaml +ref: fedora/stable/${basearch}/iot repos: [] selinux: true ima: true @@ -70,14 +75,17 @@ check-groups: type: file filename: group packages: +# This list of packages should be kept in sync with +# the iot-commit definition is osbuild, as found here: +# https://github.com/osbuild/images/blob/0584c20b0c14a89e833b875252114ceff61805e8/pkg/distro/fedora/package_sets.go#L73 - fedora-release-iot +- fedora-iot-config - aardvark-dns - atheros-firmware - attr - authselect - basesystem - bash -- bash-completion - bootc - brcmfmac-firmware - chrony @@ -96,13 +104,13 @@ packages: - dbus-parsec - dnf5 - dnf5-plugins -- dnsmasq - dosfstools - dracut-config-generic - dracut-network - e2fsprogs - efibootmgr - fdo-client +- fdo-owner-cli - firewalld - fwupd - fwupd-efi @@ -116,6 +124,7 @@ packages: - gzip - hostname - ignition +- ignition-edge - ima-evm-utils - iproute - iputils @@ -155,6 +164,7 @@ packages: - shadow-utils - skopeo - slirp4netns +- ssh-key-dir - sssd-client - sudo - systemd diff --git a/fedora-iot-bootc.yaml b/fedora-iot-bootc.yaml new file mode 100644 index 0000000..475c0ca --- /dev/null +++ b/fedora-iot-bootc.yaml @@ -0,0 +1,15 @@ +releasever: 41 +variables: + distro: "fedora-iot" + +repos: + - fedora-41 + +metadata: + name: fedora-iot-bootc-base + summary: Fedora IoT bootc base image + +include: + - fedora-bootc-base/manifest.yaml + - fedora-bootc-base/kernel.yaml + diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml index 263bd4b..f8d1849 100644 --- a/fedora-iot-updates-stable.yaml +++ b/fedora-iot-updates-stable.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/updates/iot +ref: fedora/stable/${basearch}/updates/iot diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml index c6eb5a5..11cb696 100644 --- a/fedora-iot-updates-testing.yaml +++ b/fedora-iot-updates-testing.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/testing/iot +ref: fedora/stable/${basearch}/testing/iot diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 51c17ad..eee67dd 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/iot +ref: fedora/stable/${basearch}/iot repos: - fedora-41 diff --git a/grub2-workaround.yaml b/grub2-workaround.yaml new file mode 100644 index 0000000..3b58a9e --- /dev/null +++ b/grub2-workaround.yaml @@ -0,0 +1,22 @@ +# Temporarily disable new GRUB2 config options until we can ensure that we +# have an updated bootloader via bootupd. +# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 +# See: https://github.com/fedora-silverblue/issue-tracker/issues/587 +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + # Completely disable this module + sed -i '2i exit 0' /etc/grub.d/25_bli + + # Skip check that was not performed in previous Fedora versions + sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware + sed -i '/\tif/d' /etc/grub.d/30_uefi-firmware + sed -i '/\tfi/d' /etc/grub.d/30_uefi-firmware + sed -i 's/\t\t/\t/' /etc/grub.d/30_uefi-firmware + + # Verify that the content matches what we expect the file to look like. + # This will fail the build here instead of breaking users' systems. + hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b" + echo "$hash /etc/grub.d/30_uefi-firmware" | sha256sum -c