From 16c554471c0bf12185450ba146af83fdf9a42ad8 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 12 Aug 2024 15:44:55 -0400 Subject: [PATCH 1/9] Setup for F-41 branched Signed-off-by: Paul Whalen --- config.ini | 4 ++-- fedora-iot-base.yaml | 2 +- fedora-iot-updates-stable.yaml | 2 +- fedora-iot-updates-testing.yaml | 2 +- fedora-iot.yaml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config.ini b/config.ini index 0b65ffb..4e7d4a9 100644 --- a/config.ini +++ b/config.ini @@ -11,8 +11,8 @@ tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 release = f41 -ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s -yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ +ref = %(os_name)s/devel/%(arch)s/%(tree_name)s +yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/41/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot docker_os_name = fedora diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 25d3bdd..70f2ac9 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,5 +1,5 @@ include: bootupd.yaml -ref: fedora/rawhide/${basearch}/iot +ref: fedora/devel/${basearch}/iot repos: [] selinux: true ima: true diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml index 263bd4b..446cfb9 100644 --- a/fedora-iot-updates-stable.yaml +++ b/fedora-iot-updates-stable.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/updates/iot +ref: fedora/devel/${basearch}/updates/iot diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml index c6eb5a5..596961a 100644 --- a/fedora-iot-updates-testing.yaml +++ b/fedora-iot-updates-testing.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/testing/iot +ref: fedora/devel/${basearch}/testing/iot diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 51c17ad..bcd18ca 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/iot +ref: fedora/devel/${basearch}/iot repos: - fedora-41 From ad5623c52a7d45aa13e7805d779ab385b4e7a279 Mon Sep 17 00:00:00 2001 From: Micah Abbott Date: Wed, 28 Aug 2024 13:54:39 -0400 Subject: [PATCH 2/9] F41: bootupd: add some contextual comments Cherry-picked 1a898a7 Signed-off-by: Micah Abbott --- bootupd.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/bootupd.yaml b/bootupd.yaml index 949f504..3328d41 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,3 +1,7 @@ +# KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml +# See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml +# +#Integration with https://github.com/coreos/bootupd packages: - bootupd From 0aa593407dfa3e8ef60729efa97af978d051f6ae Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 3 Sep 2024 09:47:45 -0400 Subject: [PATCH 3/9] fedora-iot-base: Add workaround for issue with newer GRUB2 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 5 ++++- grub2-workaround.yaml | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) create mode 100644 grub2-workaround.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 70f2ac9..54026b0 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,4 +1,7 @@ -include: bootupd.yaml +include: + - bootupd.yaml + # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 + - grub2-workaround.yaml ref: fedora/devel/${basearch}/iot repos: [] selinux: true diff --git a/grub2-workaround.yaml b/grub2-workaround.yaml new file mode 100644 index 0000000..3b58a9e --- /dev/null +++ b/grub2-workaround.yaml @@ -0,0 +1,22 @@ +# Temporarily disable new GRUB2 config options until we can ensure that we +# have an updated bootloader via bootupd. +# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 +# See: https://github.com/fedora-silverblue/issue-tracker/issues/587 +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + # Completely disable this module + sed -i '2i exit 0' /etc/grub.d/25_bli + + # Skip check that was not performed in previous Fedora versions + sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware + sed -i '/\tif/d' /etc/grub.d/30_uefi-firmware + sed -i '/\tfi/d' /etc/grub.d/30_uefi-firmware + sed -i 's/\t\t/\t/' /etc/grub.d/30_uefi-firmware + + # Verify that the content matches what we expect the file to look like. + # This will fail the build here instead of breaking users' systems. + hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b" + echo "$hash /etc/grub.d/30_uefi-firmware" | sha256sum -c From 7fad539f14b45a86c55646f7bae468a7146fdac1 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 20 Sep 2024 15:28:56 +0100 Subject: [PATCH 4/9] drop dnsmasq Not sure why it was included, I suspect it was once used for container networking. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 54026b0..23dc294 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -99,7 +99,6 @@ packages: - dbus-parsec - dnf5 - dnf5-plugins -- dnsmasq - dosfstools - dracut-config-generic - dracut-network From 750a452d9ddf2466a43f85214a02a7cff10b60ba Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 27 Sep 2024 16:51:54 -0400 Subject: [PATCH 5/9] F41: Add iot base bootc image Signed-off-by: Paul Whalen --- fedora-bootc-base/autoupdates.yaml | 9 --- fedora-bootc-base/bootc-config.yaml | 10 --- fedora-bootc-base/bootupd.yaml | 2 +- fedora-bootc-base/initramfs.yaml | 6 +- fedora-bootc-base/iot.yaml | 113 ++++++++++++++++++++++++++++ fedora-bootc-base/manifest.yaml | 11 +-- fedora-bootc.yaml | 15 ---- fedora-iot-bootc.yaml | 15 ++++ 8 files changed, 136 insertions(+), 45 deletions(-) delete mode 100644 fedora-bootc-base/autoupdates.yaml create mode 100644 fedora-bootc-base/iot.yaml delete mode 100644 fedora-bootc.yaml create mode 100644 fedora-iot-bootc.yaml diff --git a/fedora-bootc-base/autoupdates.yaml b/fedora-bootc-base/autoupdates.yaml deleted file mode 100644 index a416699..0000000 --- a/fedora-bootc-base/autoupdates.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# Enable automatic updates by default -postprocess: - - | - #!/usr/bin/env bash - set -euo pipefail - target=/usr/lib/systemd/system/default.target.wants - mkdir -p $target - set -x - ln -s ../bootc-fetch-apply-updates.timer $target diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml index 4d4b24e..e69de29 100644 --- a/fedora-bootc-base/bootc-config.yaml +++ b/fedora-bootc-base/bootc-config.yaml @@ -1,10 +0,0 @@ -# Configuration for bootc -postprocess: - # ext4 is our default filesystem in iot - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/bootc/install/ - cat > /usr/lib/bootc/install/20-default-root.toml << EOF - [install] - root-fs-type = "ext4" - EOF diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml index 7d3ebf3..cc83d20 100644 --- a/fedora-bootc-base/bootupd.yaml +++ b/fedora-bootc-base/bootupd.yaml @@ -13,7 +13,7 @@ packages-s390x: # provided by s390utils-base, but soon will be -core too. - /usr/sbin/zipl packages-x86_64: - - grub2 grub2-efi-x64 efibootmgr shim + - grub2-efi-x64 efibootmgr shim - microcode_ctl conditional-include: diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml index de65333..95146e2 100644 --- a/fedora-bootc-base/initramfs.yaml +++ b/fedora-bootc-base/initramfs.yaml @@ -6,13 +6,13 @@ postprocess: cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' # We want a generic image; hostonly makes no sense as part of a server side build hostonly=no - dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " + add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " EOF cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' # Extra modules that we want by default that are known to exist in the kernel - dracutmodules+=" virtiofs " + add_dracutmodules+=" virtiofs " EOF cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' # We want this for systemd-cryptsetup tpm2 locking - dracutmodules+=" tpm2-tss " + add_dracutmodules+=" systemd-cryptsetup tpm2-tss " EOF diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml new file mode 100644 index 0000000..2c02ca6 --- /dev/null +++ b/fedora-bootc-base/iot.yaml @@ -0,0 +1,113 @@ +# Fedora IoT specific packages +packages: + - fedora-release-iot + - aardvark-dns + - atheros-firmware + - attr + - authselect + - basesystem + - bash + - bash-completion + - bootc + - brcmfmac-firmware + - chrony + - clevis + - clevis-dracut + - clevis-luks + - clevis-pin-tpm2 + - container-selinux + - containernetworking-plugins + - coreutils + - cracklib-dicts + - criu + - criu-libs + - cryptsetup + - curl + - dbus-parsec + - dnf5-plugins + - dosfstools + - dracut-config-generic + - dracut-network + - e2fsprogs + - efibootmgr + - fdo-client + - firewalld + - fwupd + - fwupd-efi + - fwupd-plugin-modem-manager + - fwupd-plugin-uefi-capsule-data + - glibc + - glibc-minimal-langpack + - gnupg2 + - greenboot + - greenboot-default-health-checks + - gzip + - hostname + - ignition + - ima-evm-utils + - iproute + - iputils + - iwd + - iwlwifi-mvm-firmware + - kernel-tools + - keyutils + - less + - libsss_sudo + - linux-firmware + - lvm2 + - netavark + - NetworkManager + - NetworkManager-wifi + - NetworkManager-wwan + - nss-altfiles + - openssl + - openssh-clients + - openssh-server + - passt + - passt-selinux + - parsec + - pinentry + - podman + - policycoreutils + - policycoreutils-python-utils + - polkit + - procps-ng + - realtek-firmware + - rootfiles + - rpm + - screen + - selinux-policy-targeted + - setools-console + - setup + - shadow-utils + - skopeo + - slirp4netns + - sssd-client + - sudo + - systemd + - systemd-resolved + - tar + - tmux + - tpm2-pkcs11 + - traceroute + - usbguard + - util-linux + - vim-minimal + - wpa_supplicant + - wireless-regdb + - xfsprogs + - xz + - zezere-ignition + - zram-generator + - zram-generator-defaults +packages-aarch64: + - arm-image-installer + - bcm283x-firmware + - grub2-efi-aa64 + - optee_client + - shim-aa64 + - uboot-images-armv8 +packages-x86_64: + - grub2-efi-x64 + - microcode_ctl + - shim-x64 diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml index 007f6d7..f836419 100644 --- a/fedora-bootc-base/manifest.yaml +++ b/fedora-bootc-base/manifest.yaml @@ -50,13 +50,15 @@ remove-from-packages: include: - bootc.yaml + - bootupd.yaml - ostree.yaml - - bootc-config.yaml - initramfs.yaml - - autoupdates.yaml - basic-fixes.yaml + - iot.yaml packages: + # needed for building derived container images + - dnf5 # Even in tier-0, we have this. If you don't want SELinux today, you'll need # to build a custom image. - selinux-policy-targeted @@ -64,8 +66,3 @@ packages: - container-selinux # Needed for tpm2 bound luks - tpm2-tools - -# See https://github.com/coreos/bootupd -arch-include: - x86_64: bootupd.yaml - aarch64: bootupd.yaml diff --git a/fedora-bootc.yaml b/fedora-bootc.yaml deleted file mode 100644 index 7067275..0000000 --- a/fedora-bootc.yaml +++ /dev/null @@ -1,15 +0,0 @@ -releasever: rawhide -variables: - distro: "fedora" - -repos: - - fedora-rawhide - -metadata: - name: fedora-bootc - summary: Fedora base bootc image - -include: - - fedora-bootc-base/manifest.yaml - - fedora-bootc-base/kernel.yaml - diff --git a/fedora-iot-bootc.yaml b/fedora-iot-bootc.yaml new file mode 100644 index 0000000..475c0ca --- /dev/null +++ b/fedora-iot-bootc.yaml @@ -0,0 +1,15 @@ +releasever: 41 +variables: + distro: "fedora-iot" + +repos: + - fedora-41 + +metadata: + name: fedora-iot-bootc-base + summary: Fedora IoT bootc base image + +include: + - fedora-bootc-base/manifest.yaml + - fedora-bootc-base/kernel.yaml + From 52884d20e4a467892bb4c723c3cfa331b39e21bd Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 25 Oct 2024 10:58:21 -0400 Subject: [PATCH 6/9] F41: Update for final Signed-off-by: Paul Whalen --- config.ini | 4 ++-- fedora-iot-base.yaml | 2 +- fedora-iot-updates-stable.yaml | 2 +- fedora-iot-updates-testing.yaml | 2 +- fedora-iot.yaml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config.ini b/config.ini index 4e7d4a9..d4c4586 100644 --- a/config.ini +++ b/config.ini @@ -11,8 +11,8 @@ tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 release = f41 -ref = %(os_name)s/devel/%(arch)s/%(tree_name)s -yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/41/Everything/%(arch)s/os/ +ref = %(os_name)s/stable/%(arch)s/%(tree_name)s +yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/releases/41/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot docker_os_name = fedora diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 23dc294..87f7fb4 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,7 +2,7 @@ include: - bootupd.yaml # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - grub2-workaround.yaml -ref: fedora/devel/${basearch}/iot +ref: fedora/stable/${basearch}/iot repos: [] selinux: true ima: true diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml index 446cfb9..f8d1849 100644 --- a/fedora-iot-updates-stable.yaml +++ b/fedora-iot-updates-stable.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/devel/${basearch}/updates/iot +ref: fedora/stable/${basearch}/updates/iot diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml index 596961a..11cb696 100644 --- a/fedora-iot-updates-testing.yaml +++ b/fedora-iot-updates-testing.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/devel/${basearch}/testing/iot +ref: fedora/stable/${basearch}/testing/iot diff --git a/fedora-iot.yaml b/fedora-iot.yaml index bcd18ca..eee67dd 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml -ref: fedora/devel/${basearch}/iot +ref: fedora/stable/${basearch}/iot repos: - fedora-41 From 71a1f8be5fcd41feb6602d72691feb7668bb21c4 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 10 Jan 2025 15:04:30 -0500 Subject: [PATCH 7/9] F41: force disable composefs Signed-off-by: Paul Whalen --- composefs.yaml | 11 +++++++++++ fedora-iot-base.yaml | 2 ++ 2 files changed, 13 insertions(+) create mode 100644 composefs.yaml diff --git a/composefs.yaml b/composefs.yaml new file mode 100644 index 0000000..c51f832 --- /dev/null +++ b/composefs.yaml @@ -0,0 +1,11 @@ +# Force disable composefs +# See: https://github.com/ostreedev/ostree/pull/3353 +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' + [composefs] + enabled = no + EOF diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 87f7fb4..a17a42a 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,6 +2,8 @@ include: - bootupd.yaml # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - grub2-workaround.yaml + # Force disable composefs + - composefs.yaml ref: fedora/stable/${basearch}/iot repos: [] selinux: true From 06b41a222ef0964151d0aafb8300738fbf597542 Mon Sep 17 00:00:00 2001 From: djach7 Date: Tue, 28 Jan 2025 13:13:23 -0500 Subject: [PATCH 8/9] Update package list to sync with rawhide and osbuild iot-commit Adds ignition-edge and ssh-key-dir packages to ensure ignition functionality. Also adds fedora-iot-config package and fdo-owner-cli package to bring package list in synch with rawhide and osbuild iot-commit. Osbuild iot-commit found here: https://github.com/osbuild/images/blob/0584c20b0c14a89e833b875252114ceff61805e8/pkg/distro/fedora/package_sets.go#L73 Original update pr for rawhide found here: https://pagure.io/fedora-iot/ostree/c/91539fbf82555ede87f931277a090612a23c5680?branch=main Signed-off-by: djach7 --- fedora-iot-base.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index a17a42a..d11a81e 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -75,7 +75,11 @@ check-groups: type: file filename: group packages: +# This list of packages should be kept in sync with +# the iot-commit definition is osbuild, as found here: +# https://github.com/osbuild/images/blob/0584c20b0c14a89e833b875252114ceff61805e8/pkg/distro/fedora/package_sets.go#L73 - fedora-release-iot +- fedora-iot-config - aardvark-dns - atheros-firmware - attr @@ -107,6 +111,7 @@ packages: - e2fsprogs - efibootmgr - fdo-client +- fdo-owner-cli - firewalld - fwupd - fwupd-efi @@ -120,6 +125,7 @@ packages: - gzip - hostname - ignition +- ignition-edge - ima-evm-utils - iproute - iputils @@ -159,6 +165,7 @@ packages: - shadow-utils - skopeo - slirp4netns +- ssh-key-dir - sssd-client - sudo - systemd From a6f6d3e9d7302219b4439a290f864b06ea91b0aa Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 8 Apr 2025 10:04:41 -0400 Subject: [PATCH 9/9] Drop bash-completion due to duplicate file issue with libsecret See: https://github.com/fedora-iot/iot-distro/issues/87 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index d11a81e..4cc389a 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -86,7 +86,6 @@ packages: - authselect - basesystem - bash -- bash-completion - bootc - brcmfmac-firmware - chrony