From 6d1c943aa31f073bb5362f7e557a6511d35c6445 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 27 May 2018 01:18:40 +0100 Subject: [PATCH 001/163] initial f29 config --- config.ini | 2 +- fedora-28.repo => fedora-29.repo | 34 ++++++++++++++++---------------- fedora-iot-base.json | 10 +++++----- fedora-iot-updates-stable.json | 2 +- fedora-iot-updates-testing.json | 2 +- fedora-iot.json | 4 ++-- 6 files changed, 27 insertions(+), 27 deletions(-) rename fedora-28.repo => fedora-29.repo (56%) diff --git a/config.ini b/config.ini index 8b2941a..bcf221a 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f28 +release = f29 ref = %(os_name)s/%(release)s/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux//development/rawhide/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-28.repo b/fedora-29.repo similarity index 56% rename from fedora-28.repo rename to fedora-29.repo index 03077f8..62ccffc 100644 --- a/fedora-28.repo +++ b/fedora-29.repo @@ -1,34 +1,34 @@ -[fedora-28] -name=Fedora 28 - $basearch +[fedora-29] +name=Fedora 29 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/28/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-28&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/29/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-29&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-28-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-$basearch skip_if_unavailable=False -[fedora-28-updates] -name=Fedora 28 - $basearch - Updates +[fedora-29-updates] +name=Fedora 29 - $basearch - Updates failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/28/$basearch/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f28&arch=$basearch -enabled=1 +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/29/$basearch/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f29&arch=$basearch +enabled=0 repo_gpgcheck=0 type=rpm gpgcheck=1 metadata_expire=6h -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-28-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-$basearch skip_if_unavailable=False -[fedora-28-updates-testing] -name=Fedora 28 - $basearch - Test Updates +[fedora-29-updates-testing] +name=Fedora 29 - $basearch - Test Updates failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/testing/28/$basearch/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f28&arch=$basearch -enabled=1 +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/testing/29/$basearch/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f29&arch=$basearch +enabled=0 gpgcheck=1 metadata_expire=6h -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-28-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index b62cca3..d9a5697 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -1,5 +1,5 @@ { - "ref": "fedora/28/${basearch}/iot", + "ref": "fedora/29/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", "repos": [], @@ -8,8 +8,8 @@ "documentation": false, - "automatic_version_prefix": "28", - "mutate-os-release": "28", + "automatic_version_prefix": "29", + "mutate-os-release": "29", "initramfs-args": ["--no-hostonly"], "boot_location": "new", @@ -111,10 +111,10 @@ "packages-aarch64": ["grub2-efi", "ostree-grub2", "efibootmgr", "shim", "atomic-devmode", - "uboot-tools", "uboot-images-armv8", "bcm283x-firmware"], + "uboot-tools", "uboot-images-armv8", "bcm293x-firmware"], "packages-armhfp": ["extlinux-bootloader", - "uboot-tools", "uboot-images-armv7", "bcm283x-firmware"], + "uboot-tools", "uboot-images-armv7", "bcm293x-firmware"], "packages-x86_64": ["grub2", "grub2-efi-x64", "ostree-grub2", "efibootmgr", "shim", "atomic-devmode", diff --git a/fedora-iot-updates-stable.json b/fedora-iot-updates-stable.json index 9fdc273..c954c21 100644 --- a/fedora-iot-updates-stable.json +++ b/fedora-iot-updates-stable.json @@ -1,5 +1,5 @@ - "ref": "fedora/28/${basearch}/updates/iot", + "ref": "fedora/29/${basearch}/updates/iot", "ex-jigdo-spec": "fedora-iot.spec", "include": "fedora-iot-base.json" } diff --git a/fedora-iot-updates-testing.json b/fedora-iot-updates-testing.json index eaa9d91..6e49a20 100644 --- a/fedora-iot-updates-testing.json +++ b/fedora-iot-updates-testing.json @@ -1,5 +1,5 @@ { - "ref": "fedora/28/${basearch}/testing/iot", + "ref": "fedora/29/${basearch}/testing/iot", "ex-jigdo-spec": "fedora-iot.spec", "include": "fedora-iot-base.json" } diff --git a/fedora-iot.json b/fedora-iot.json index e0cd83c..2ce09e3 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { - "ref": "fedora/28/${basearch}/iot", + "ref": "fedora/29/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-28", "fedora-28-updates"], + "repos": ["fedora-29"], "include": "fedora-iot-base.json" } From f5708155a7e46b218ca57cf66f0d15a3f1433c94 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 27 May 2018 23:29:04 +0100 Subject: [PATCH 002/163] Minor boot loader and related updates Signed-off-by: Peter Robinson --- fedora-iot-base.json | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index d9a5697..a2f4a1f 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -109,16 +109,17 @@ "podman", "attr"], - "packages-aarch64": ["grub2-efi", "ostree-grub2", - "efibootmgr", "shim", "atomic-devmode", - "uboot-tools", "uboot-images-armv8", "bcm293x-firmware"], + "packages-aarch64": ["grub2-efi-aa64", "ostree-grub2", + "efibootmgr", "shim-aa64", "atomic-devmode", + "uboot-tools", "uboot-images-armv8", "bcm293x-firmware", + "fwupdate", "fwupdate-efi"], "packages-armhfp": ["extlinux-bootloader", - "uboot-tools", "uboot-images-armv7", "bcm293x-firmware"], + "uboot-tools", "uboot-images-armv7", "bcm293x-firmware"], "packages-x86_64": ["grub2", "grub2-efi-x64", "ostree-grub2", - "efibootmgr", "shim", "atomic-devmode", - "microcode_ctl"], + "efibootmgr", "shim-x64", "atomic-devmode", + "fwupdate", "fwupdate-efi", "microcode_ctl"], "default_target": "multi-user.target", From 45c991336849135331e965169c16845bb4a14009 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 6 Jul 2018 12:29:19 +0100 Subject: [PATCH 003/163] Config updates for rawhide Signed-off-by: Peter Robinson --- fedora-29.repo | 22 ---------------------- fedora-iot.spec | 2 +- 2 files changed, 1 insertion(+), 23 deletions(-) diff --git a/fedora-29.repo b/fedora-29.repo index 62ccffc..f1343dc 100644 --- a/fedora-29.repo +++ b/fedora-29.repo @@ -10,25 +10,3 @@ type=rpm gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-$basearch skip_if_unavailable=False -[fedora-29-updates] -name=Fedora 29 - $basearch - Updates -failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/29/$basearch/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f29&arch=$basearch -enabled=0 -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -metadata_expire=6h -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-$basearch -skip_if_unavailable=False -[fedora-29-updates-testing] -name=Fedora 29 - $basearch - Test Updates -failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/testing/29/$basearch/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f29&arch=$basearch -enabled=0 -gpgcheck=1 -metadata_expire=6h -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-$basearch -skip_if_unavailable=False diff --git a/fedora-iot.spec b/fedora-iot.spec index 254f067..f8b12a5 100644 --- a/fedora-iot.spec +++ b/fedora-iot.spec @@ -3,7 +3,7 @@ Name: fedora-iot Version: %{ostree_version} Release: 1%{?dist} -Summary: Image (rpm-ostree jigdo) for Fedora Atomic Host +Summary: Image (rpm-ostree jigdo) for Fedora IoT License: MIT #@@@rpmostree_jigdo_meta@@@ From 654fa4bf233042be143a20441d1ac348be6d3766 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 6 Jul 2018 13:49:15 +0100 Subject: [PATCH 004/163] Fix bcm28x-firmware naming Signed-off-by: Peter Robinson --- fedora-iot-base.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index a2f4a1f..4b87f72 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -111,11 +111,11 @@ "packages-aarch64": ["grub2-efi-aa64", "ostree-grub2", "efibootmgr", "shim-aa64", "atomic-devmode", - "uboot-tools", "uboot-images-armv8", "bcm293x-firmware", + "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", "fwupdate", "fwupdate-efi"], "packages-armhfp": ["extlinux-bootloader", - "uboot-tools", "uboot-images-armv7", "bcm293x-firmware"], + "uboot-tools", "uboot-images-armv7", "bcm283x-firmware"], "packages-x86_64": ["grub2", "grub2-efi-x64", "ostree-grub2", "efibootmgr", "shim-x64", "atomic-devmode", From 64266f9d4ac615312ad98a0dd815043056ed5584 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 19 Jul 2018 13:28:34 +0100 Subject: [PATCH 005/163] add arm-image-installer for ARM arches, zram --- fedora-iot-base.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 4b87f72..0f41b4c 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -74,7 +74,7 @@ "dracut-config-generic", "kernel", "dracut-network", "rpm-ostree", "lvm2", - "chrony", + "chrony", "zram", "cryptsetup", "authconfig", "e2fsprogs", @@ -112,9 +112,9 @@ "packages-aarch64": ["grub2-efi-aa64", "ostree-grub2", "efibootmgr", "shim-aa64", "atomic-devmode", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", - "fwupdate", "fwupdate-efi"], + "fwupdate", "fwupdate-efi", "arm-image-installer"], - "packages-armhfp": ["extlinux-bootloader", + "packages-armhfp": ["extlinux-bootloader", "arm-image-installer", "uboot-tools", "uboot-images-armv7", "bcm283x-firmware"], "packages-x86_64": ["grub2", "grub2-efi-x64", "ostree-grub2", From 9ad76b7e196c4d2f1c18de93e62eed34810a6818 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 11 Aug 2018 14:13:36 +0100 Subject: [PATCH 006/163] drop initscripts from the base config, no longer needed Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 0f41b4c..28edfd6 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -89,7 +89,7 @@ "iptables-services", "iptables", "firewalld", "NetworkManager", "NetworkManager-wifi", "dnsmasq", "traceroute", - "hostname", "initscripts", "iproute", "iputils", + "hostname", "iproute", "iputils", "openssh-clients", "openssh-server", "passwd", "policycoreutils", "procps-ng", "rootfiles", "rpm", "selinux-policy-targeted", "setup", "shadow-utils", From 1a52e363446115b8542defd154db52c50a90fc61 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 11 Aug 2018 17:15:33 +0100 Subject: [PATCH 007/163] Enable grub2 and efimanager for ARMv7 Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 28edfd6..e75f6f3 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -114,8 +114,9 @@ "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", "fwupdate", "fwupdate-efi", "arm-image-installer"], - "packages-armhfp": ["extlinux-bootloader", "arm-image-installer", + "packages-armhfp": ["grub2-efi-arm", "ostree-grub2", "efibootmgr", "atomic-devmode", "uboot-tools", "uboot-images-armv7", "bcm283x-firmware"], + "arm-image-installer"], "packages-x86_64": ["grub2", "grub2-efi-x64", "ostree-grub2", "efibootmgr", "shim-x64", "atomic-devmode", From 7498d6cf8dee5a514bb7c976fabf5bd672fb6d6a Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 23 Aug 2018 11:14:47 +0100 Subject: [PATCH 008/163] set up for Fedora 30 development Signed-off-by: Peter Robinson --- config.ini | 2 +- fedora-29.repo => fedora-30.repo | 10 +++++----- fedora-iot-base.json | 6 +++--- fedora-iot-updates-stable.json | 2 +- fedora-iot-updates-testing.json | 2 +- fedora-iot.json | 4 ++-- 6 files changed, 13 insertions(+), 13 deletions(-) rename fedora-29.repo => fedora-30.repo (61%) diff --git a/config.ini b/config.ini index bcf221a..39c41a0 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f29 +release = f30 ref = %(os_name)s/%(release)s/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux//development/rawhide/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-29.repo b/fedora-30.repo similarity index 61% rename from fedora-29.repo rename to fedora-30.repo index f1343dc..5d6de44 100644 --- a/fedora-29.repo +++ b/fedora-30.repo @@ -1,12 +1,12 @@ -[fedora-29] -name=Fedora 29 - $basearch +[fedora-30] +name=Fedora 30 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/29/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-29&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/30/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-30&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-30-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index e75f6f3..ff7a729 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -1,5 +1,5 @@ { - "ref": "fedora/29/${basearch}/iot", + "ref": "fedora/30/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", "repos": [], @@ -8,8 +8,8 @@ "documentation": false, - "automatic_version_prefix": "29", - "mutate-os-release": "29", + "automatic_version_prefix": "30", + "mutate-os-release": "30", "initramfs-args": ["--no-hostonly"], "boot_location": "new", diff --git a/fedora-iot-updates-stable.json b/fedora-iot-updates-stable.json index c954c21..ed4b841 100644 --- a/fedora-iot-updates-stable.json +++ b/fedora-iot-updates-stable.json @@ -1,5 +1,5 @@ - "ref": "fedora/29/${basearch}/updates/iot", + "ref": "fedora/30/${basearch}/updates/iot", "ex-jigdo-spec": "fedora-iot.spec", "include": "fedora-iot-base.json" } diff --git a/fedora-iot-updates-testing.json b/fedora-iot-updates-testing.json index 6e49a20..942a0b3 100644 --- a/fedora-iot-updates-testing.json +++ b/fedora-iot-updates-testing.json @@ -1,5 +1,5 @@ { - "ref": "fedora/29/${basearch}/testing/iot", + "ref": "fedora/30/${basearch}/testing/iot", "ex-jigdo-spec": "fedora-iot.spec", "include": "fedora-iot-base.json" } diff --git a/fedora-iot.json b/fedora-iot.json index 2ce09e3..49f6b04 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { - "ref": "fedora/29/${basearch}/iot", + "ref": "fedora/30/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-29"], + "repos": ["fedora-30"], "include": "fedora-iot-base.json" } From c1a499cc22c21573d0195e2d22a276d73e25f42c Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 23 Aug 2018 11:37:01 +0100 Subject: [PATCH 009/163] fix armhfp package list quoting Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index ff7a729..f44830a 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -115,7 +115,7 @@ "fwupdate", "fwupdate-efi", "arm-image-installer"], "packages-armhfp": ["grub2-efi-arm", "ostree-grub2", "efibootmgr", "atomic-devmode", - "uboot-tools", "uboot-images-armv7", "bcm283x-firmware"], + "uboot-tools", "uboot-images-armv7", "bcm283x-firmware", "arm-image-installer"], "packages-x86_64": ["grub2", "grub2-efi-x64", "ostree-grub2", From 8c4e4f1bbf29c40f03506f960b4158c69f70751e Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 26 Aug 2018 09:21:27 +0100 Subject: [PATCH 010/163] Include fedora-release-iot Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index f44830a..b55a59a 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -68,7 +68,7 @@ "check-groups": { "type": "file", "filename": "group" }, "packages": ["atomic", - "fedora-release", + "fedora-release-iot", "glibc", "nss-altfiles", "shadow-utils", "sssd-client", "libsss_sudo", "dracut-config-generic", "kernel", From 938292469be18b38ca89ce9a50a3b6687dd683de Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 30 Aug 2018 00:38:41 +0100 Subject: [PATCH 011/163] drop atomic package Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index b55a59a..8d38df1 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -67,8 +67,7 @@ "check-passwd": { "type": "file", "filename": "passwd" }, "check-groups": { "type": "file", "filename": "group" }, - "packages": ["atomic", - "fedora-release-iot", + "packages": ["fedora-release-iot", "glibc", "nss-altfiles", "shadow-utils", "sssd-client", "libsss_sudo", "dracut-config-generic", "kernel", From b4f7952c1f7b490b6a94cb1ad46fc2742af6758d Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 12 Sep 2018 11:18:42 +0100 Subject: [PATCH 012/163] Enable recommends false to disable weak dependencies Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 8d38df1..f196cfc 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -6,6 +6,8 @@ "selinux": true, + "recommends": false, + "documentation": false, "automatic_version_prefix": "30", From 2f8151b23bb807a97f3d6ce795881266242ebf52 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 12 Sep 2018 12:43:01 +0100 Subject: [PATCH 013/163] explicitly add pinentry Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index f196cfc..037b51c 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -76,7 +76,7 @@ "dracut-network", "rpm-ostree", "lvm2", "chrony", "zram", - "cryptsetup", + "cryptsetup", "pinentry", "authconfig", "e2fsprogs", "gnupg2", From 1641be95d5c60f2462a7dbe5c80aa759f6daee17 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 6 Oct 2018 13:40:59 +0100 Subject: [PATCH 014/163] adjust services enabled in the installer Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 037b51c..079cbf8 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -125,5 +125,5 @@ "default_target": "multi-user.target", - "units": ["initial-setup.service"] + "units": ["NetworkManager.service", "sshd.service", "rngd.service", "zram-swap.service"] } From 3d5e55a45bcd505ae077395360b5cdc528007443 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 10 Oct 2018 20:05:11 +0100 Subject: [PATCH 015/163] add greenboot to compose Signed-off-by: Peter Robinson --- fedora-iot-base.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 079cbf8..68560f7 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -95,8 +95,8 @@ "policycoreutils", "procps-ng", "rootfiles", "rpm", "selinux-policy-targeted", "setup", "shadow-utils", "sudo", "systemd", "util-linux", "vim-minimal", - "less", - "tar", + "less", "tar", + "greenboot", "greenboot-grub2", "greenboot-ostree-grub2", "greenboot-reboot", "initial-setup", "cloud-utils-growpart", "rsync", From dc7ce7c210dda7dcda764cbf6850bda28ca159e4 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 11 Oct 2018 10:17:46 +0100 Subject: [PATCH 016/163] add criu for container checkpoint/restore Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 68560f7..742174d 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -107,7 +107,7 @@ "audit", "rng-tools", "bluez", "bluez-libs", "wpan-tools", "kernel-tools", "libgpiod-utils", - "podman", + "podman", "criu", "attr"], "packages-aarch64": ["grub2-efi-aa64", "ostree-grub2", From e9f393f865734abd69095cb1185f5b2917164b58 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 27 Oct 2018 12:13:18 +0100 Subject: [PATCH 017/163] Add clevis for TPM2 support Signed-off-by: Peter Robinson --- fedora-iot-base.json | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 742174d..75089ab 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -108,6 +108,7 @@ "bluez", "bluez-libs", "wpan-tools", "kernel-tools", "libgpiod-utils", "podman", "criu", + "clevis", "clevis-dracut", "clevis-luks", "attr"], "packages-aarch64": ["grub2-efi-aa64", "ostree-grub2", From 08781d1409c5e4ce09488d95e7350d23440bc3e9 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 12 Nov 2018 07:43:31 +0000 Subject: [PATCH 018/163] add intel iwl wireless firmwares Signed-off-by: Peter Robinson --- fedora-iot-base.json | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 75089ab..fe7b5d7 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -99,7 +99,7 @@ "greenboot", "greenboot-grub2", "greenboot-ostree-grub2", "greenboot-reboot", "initial-setup", "cloud-utils-growpart", - "rsync", + "rsync", "atomic-devmode", "bash-completion", "tmux", "screen", "policycoreutils-python-utils", @@ -111,18 +111,19 @@ "clevis", "clevis-dracut", "clevis-luks", "attr"], - "packages-aarch64": ["grub2-efi-aa64", "ostree-grub2", - "efibootmgr", "shim-aa64", "atomic-devmode", + "packages-aarch64": ["grub2-efi-aa64", "ostree-grub2", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", "fwupdate", "fwupdate-efi", "arm-image-installer"], - "packages-armhfp": ["grub2-efi-arm", "ostree-grub2", "efibootmgr", "atomic-devmode", + "packages-armhfp": ["grub2-efi-arm", "ostree-grub2", "efibootmgr", "uboot-tools", "uboot-images-armv7", "bcm283x-firmware", "arm-image-installer"], - "packages-x86_64": ["grub2", "grub2-efi-x64", "ostree-grub2", - "efibootmgr", "shim-x64", "atomic-devmode", - "fwupdate", "fwupdate-efi", "microcode_ctl"], + "packages-x86_64": ["grub2", "grub2-efi-x64", "ostree-grub2", "efibootmgr", "shim-x64", + "fwupdate", "fwupdate-efi", "microcode_ctl", + "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", + "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", + "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware", "iwl7260-firmware"], "default_target": "multi-user.target", From 1784a9517f8805827332a0bb426beacf72cd05c0 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 13 Nov 2018 13:14:04 +0000 Subject: [PATCH 019/163] add support for WWAN for 3G/LTE support Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index fe7b5d7..c55af99 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -88,7 +88,7 @@ "which", "curl", "iptables-services", "iptables", "firewalld", - "NetworkManager", "NetworkManager-wifi", + "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", "dnsmasq", "traceroute", "hostname", "iproute", "iputils", "openssh-clients", "openssh-server", "passwd", From 8a4a1bd1bbfe4f470f9896c48fde406e5bcd710e Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 21 Nov 2018 13:00:33 +0000 Subject: [PATCH 020/163] add usbguard for USB port policies, fwupd for device firmware management Signed-off-by: Peter Robinson --- fedora-iot-base.json | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index c55af99..fb26c2a 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -96,6 +96,7 @@ "selinux-policy-targeted", "setup", "shadow-utils", "sudo", "systemd", "util-linux", "vim-minimal", "less", "tar", + "fwupd", "usbguard", "greenboot", "greenboot-grub2", "greenboot-ostree-grub2", "greenboot-reboot", "initial-setup", "cloud-utils-growpart", From d4898e9eb0a35c416cd53f43ce82b098266f4c69 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 1 Dec 2018 22:04:50 +0000 Subject: [PATCH 021/163] update ostree branches for devel naming Signed-off-by: Peter Robinson --- config.ini | 2 +- fedora-iot-base.json | 2 +- fedora-iot-updates-stable.json | 2 +- fedora-iot-updates-testing.json | 2 +- fedora-iot.json | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/config.ini b/config.ini index 39c41a0..3a0c11e 100644 --- a/config.ini +++ b/config.ini @@ -11,7 +11,7 @@ tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 release = f30 -ref = %(os_name)s/%(release)s/%(arch)s/%(tree_name)s +ref = %(os_name)s/devel/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux//development/rawhide/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot diff --git a/fedora-iot-base.json b/fedora-iot-base.json index fb26c2a..de35d47 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -1,5 +1,5 @@ { - "ref": "fedora/30/${basearch}/iot", + "ref": "fedora/devel/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", "repos": [], diff --git a/fedora-iot-updates-stable.json b/fedora-iot-updates-stable.json index ed4b841..1bacd21 100644 --- a/fedora-iot-updates-stable.json +++ b/fedora-iot-updates-stable.json @@ -1,5 +1,5 @@ - "ref": "fedora/30/${basearch}/updates/iot", + "ref": "fedora/devel/${basearch}/updates/iot", "ex-jigdo-spec": "fedora-iot.spec", "include": "fedora-iot-base.json" } diff --git a/fedora-iot-updates-testing.json b/fedora-iot-updates-testing.json index 942a0b3..d0b3866 100644 --- a/fedora-iot-updates-testing.json +++ b/fedora-iot-updates-testing.json @@ -1,5 +1,5 @@ { - "ref": "fedora/30/${basearch}/testing/iot", + "ref": "fedora/devel/${basearch}/testing/iot", "ex-jigdo-spec": "fedora-iot.spec", "include": "fedora-iot-base.json" } diff --git a/fedora-iot.json b/fedora-iot.json index 49f6b04..c2fd98b 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,5 +1,5 @@ { - "ref": "fedora/30/${basearch}/iot", + "ref": "fedora/devel/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", "repos": ["fedora-30"], "include": "fedora-iot-base.json" From 3b6c6197a952ac49b3e8b06abb7b91805775ad5d Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 25 Feb 2019 07:56:05 +0000 Subject: [PATCH 022/163] don't disable firewalld OOTB Signed-off-by: Peter Robinson --- treecompose-post.sh | 4 ---- 1 file changed, 4 deletions(-) diff --git a/treecompose-post.sh b/treecompose-post.sh index 3658863..81d6c5e 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -18,7 +18,3 @@ for x in /usr/sbin/glibc_post_upgrade.*; do ln -srf /usr/bin/true ${x} fi done - -# Disable firewalld - we include it but don't want it enabled by default -# See https://pagure.io/atomic-wg/issue/372 -systemctl disable firewalld From e64034d21e23e3b9294feeb333f9b66caafe49ec Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 25 Feb 2019 08:51:35 +0000 Subject: [PATCH 023/163] setup rawhdie for F-31 Signed-off-by: Peter Robinson --- config.ini | 2 +- fedora-30.repo => fedora-31.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-30.repo => fedora-31.repo (61%) diff --git a/config.ini b/config.ini index 3a0c11e..28aca89 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f30 +release = f31 ref = %(os_name)s/devel/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux//development/rawhide/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-30.repo b/fedora-31.repo similarity index 61% rename from fedora-30.repo rename to fedora-31.repo index 5d6de44..d3d6e07 100644 --- a/fedora-30.repo +++ b/fedora-31.repo @@ -1,12 +1,12 @@ -[fedora-30] -name=Fedora 30 - $basearch +[fedora-31] +name=Fedora 31 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/30/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-30&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/31/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-31&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-30-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-31-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index de35d47..456f6a8 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -10,8 +10,8 @@ "documentation": false, - "automatic_version_prefix": "30", - "mutate-os-release": "30", + "automatic_version_prefix": "31", + "mutate-os-release": "31", "initramfs-args": ["--no-hostonly"], "boot_location": "new", diff --git a/fedora-iot.json b/fedora-iot.json index c2fd98b..a6d63d8 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/devel/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-30"], + "repos": ["fedora-31"], "include": "fedora-iot-base.json" } From 1281c816fe49774243283e24fa98dbd2ac26362f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 1 Apr 2019 02:37:44 +0100 Subject: [PATCH 024/163] don't ship atomic-devmode Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 456f6a8..f97a05d 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -100,7 +100,7 @@ "greenboot", "greenboot-grub2", "greenboot-ostree-grub2", "greenboot-reboot", "initial-setup", "cloud-utils-growpart", - "rsync", "atomic-devmode", + "rsync", "bash-completion", "tmux", "screen", "policycoreutils-python-utils", From 6ef07ed7c0fbb5871b4ed790fb6b6d826053543f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 2 Apr 2019 10:47:38 +0100 Subject: [PATCH 025/163] add keyutils to image Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index f97a05d..7daa91a 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -77,7 +77,7 @@ "rpm-ostree", "lvm2", "chrony", "zram", "cryptsetup", "pinentry", - "authconfig", + "authconfig", "keyutils", "e2fsprogs", "gnupg2", "basesystem", From 464ee760a3923d159427835516164b79d61f7d93 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 6 Apr 2019 02:48:35 +0100 Subject: [PATCH 026/163] drop ostree-grub2 as it's now handled by BLS config in grub2 Signed-off-by: Peter Robinson --- fedora-iot-base.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 7daa91a..d7eb143 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -112,15 +112,15 @@ "clevis", "clevis-dracut", "clevis-luks", "attr"], - "packages-aarch64": ["grub2-efi-aa64", "ostree-grub2", "efibootmgr", "shim-aa64", + "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", "fwupdate", "fwupdate-efi", "arm-image-installer"], - "packages-armhfp": ["grub2-efi-arm", "ostree-grub2", "efibootmgr", + "packages-armhfp": ["grub2-efi-arm", "efibootmgr", "uboot-tools", "uboot-images-armv7", "bcm283x-firmware", "arm-image-installer"], - "packages-x86_64": ["grub2", "grub2-efi-x64", "ostree-grub2", "efibootmgr", "shim-x64", + "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "fwupdate", "fwupdate-efi", "microcode_ctl", "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", From cb723b2ead3776f19464e166b04b1c2834a8d026 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 14 Apr 2019 12:53:17 +0100 Subject: [PATCH 027/163] update greenboot package names for changes in 0.7 Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index d7eb143..0101474 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -97,7 +97,7 @@ "sudo", "systemd", "util-linux", "vim-minimal", "less", "tar", "fwupd", "usbguard", - "greenboot", "greenboot-grub2", "greenboot-ostree-grub2", "greenboot-reboot", + "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "initial-setup", "cloud-utils-growpart", "rsync", From 859bbfba5299d0f9445380e26413e18afae41971 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 15 Apr 2019 13:07:39 +0100 Subject: [PATCH 028/163] add iwl7260-firmware for new intel WiFi firmware on Jetson Nano and similar Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 0101474..d75e7cd 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -114,7 +114,8 @@ "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", - "fwupdate", "fwupdate-efi", "arm-image-installer"], + "fwupdate", "fwupdate-efi", "arm-image-installer", + "iwl7260-firmware"], "packages-armhfp": ["grub2-efi-arm", "efibootmgr", "uboot-tools", "uboot-images-armv7", "bcm283x-firmware", From cbd00dd21aaf25a80d7126e6c4e8c6ae79c9792c Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 15 Apr 2019 13:10:53 +0100 Subject: [PATCH 029/163] add firewalld.service to defaults Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index d75e7cd..fdb6901 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -129,5 +129,5 @@ "default_target": "multi-user.target", - "units": ["NetworkManager.service", "sshd.service", "rngd.service", "zram-swap.service"] + "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", "zram-swap.service"] } From f02eab27239ea8bf2d79495ef9b9abbea1257753 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 15 Apr 2019 14:58:46 +0100 Subject: [PATCH 030/163] add polkit, it's needed by rpm-ostree, was previously pulled in by atomic package Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index fdb6901..9421808 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -74,7 +74,7 @@ "sssd-client", "libsss_sudo", "dracut-config-generic", "kernel", "dracut-network", - "rpm-ostree", "lvm2", + "rpm-ostree", "polkit", "lvm2", "chrony", "zram", "cryptsetup", "pinentry", "authconfig", "keyutils", From fcc2a1d556d53f930723de14ac543743da0082bb Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 24 Apr 2019 14:14:18 +0100 Subject: [PATCH 031/163] explicitly add skopeo and container-selinux Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 9421808..30cbb20 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -108,7 +108,7 @@ "audit", "rng-tools", "bluez", "bluez-libs", "wpan-tools", "kernel-tools", "libgpiod-utils", - "podman", "criu", + "podman", "container-selinux", "skopeo", "criu", "clevis", "clevis-dracut", "clevis-luks", "attr"], From 41b6b08aa577ecb827996296712210ce1889040c Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 4 Jun 2019 11:27:27 +0100 Subject: [PATCH 032/163] add slirp4netns for non root container networks Signed-off-by: Peter Robinson --- fedora-iot-base.json | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 30cbb20..4dc402f 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -109,6 +109,7 @@ "bluez", "bluez-libs", "wpan-tools", "kernel-tools", "libgpiod-utils", "podman", "container-selinux", "skopeo", "criu", + "slirp4netns", "clevis", "clevis-dracut", "clevis-luks", "attr"], From 2ec34be6055fd3f3445be8d491551391e1ffe7ed Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 4 Jul 2019 11:59:48 +0100 Subject: [PATCH 033/163] setup f31 for rawhide ostree branch Signed-off-by: Peter Robinson --- config.ini | 2 +- fedora-iot-base.json | 2 +- fedora-iot-updates-testing.json | 2 +- fedora-iot.json | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config.ini b/config.ini index 28aca89..45ff24a 100644 --- a/config.ini +++ b/config.ini @@ -11,7 +11,7 @@ tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 release = f31 -ref = %(os_name)s/devel/%(arch)s/%(tree_name)s +ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux//development/rawhide/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 4dc402f..0fb62f7 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -1,5 +1,5 @@ { - "ref": "fedora/devel/${basearch}/iot", + "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", "repos": [], diff --git a/fedora-iot-updates-testing.json b/fedora-iot-updates-testing.json index d0b3866..96b50ac 100644 --- a/fedora-iot-updates-testing.json +++ b/fedora-iot-updates-testing.json @@ -1,5 +1,5 @@ { - "ref": "fedora/devel/${basearch}/testing/iot", + "ref": "fedora/rawhide/${basearch}/testing/iot", "ex-jigdo-spec": "fedora-iot.spec", "include": "fedora-iot-base.json" } diff --git a/fedora-iot.json b/fedora-iot.json index a6d63d8..d9f8e40 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,5 +1,5 @@ { - "ref": "fedora/devel/${basearch}/iot", + "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", "repos": ["fedora-31"], "include": "fedora-iot-base.json" From 7d09b3f1d1819d9f42c26498e54d4b19be8822ae Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 22 Jul 2019 23:17:06 +0100 Subject: [PATCH 034/163] drop iptables-services as we already ship/enable firewalld Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 0fb62f7..bf5ca32 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -87,7 +87,7 @@ "coreutils", "which", "curl", - "iptables-services", "iptables", "firewalld", + "firewalld", "iptables", "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", "dnsmasq", "traceroute", "hostname", "iproute", "iputils", From 9895115f3c9d5b3dea1786e42718ba5ef45369d5 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 14 Aug 2019 13:00:22 +0100 Subject: [PATCH 035/163] setup rawhide for F-32 Signed-off-by: Peter Robinson --- config.ini | 2 +- fedora-31.repo => fedora-32.repo | 12 ++++++------ fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 10 insertions(+), 10 deletions(-) rename fedora-31.repo => fedora-32.repo (57%) diff --git a/config.ini b/config.ini index 45ff24a..18ba958 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f31 +release = f32 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux//development/rawhide/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-31.repo b/fedora-32.repo similarity index 57% rename from fedora-31.repo rename to fedora-32.repo index d3d6e07..551d24d 100644 --- a/fedora-31.repo +++ b/fedora-32.repo @@ -1,12 +1,12 @@ -[fedora-31] -name=Fedora 31 - $basearch +[fedora-32] +name=Fedora 32 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/31/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-31&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/32/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-32&arch=$basearch enabled=1 #metadata_expire=7d -repo_gpgcheck=0 +repo_gpgcheck=1 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-31-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-32-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index bf5ca32..7b609a3 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -10,8 +10,8 @@ "documentation": false, - "automatic_version_prefix": "31", - "mutate-os-release": "31", + "automatic_version_prefix": "32", + "mutate-os-release": "32", "initramfs-args": ["--no-hostonly"], "boot_location": "new", diff --git a/fedora-iot.json b/fedora-iot.json index d9f8e40..f19b166 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-31"], + "repos": ["fedora-32"], "include": "fedora-iot-base.json" } From 1a8a6c38df0bb35ab9d9844b78ea0c905b3a9feb Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 27 Aug 2019 19:12:52 +0100 Subject: [PATCH 036/163] fwupdate packages are now merged into fwupd Signed-off-by: Peter Robinson --- fedora-iot-base.json | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 7b609a3..a9127c5 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -115,15 +115,13 @@ "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", - "fwupdate", "fwupdate-efi", "arm-image-installer", - "iwl7260-firmware"], + "arm-image-installer", "iwl7260-firmware"], "packages-armhfp": ["grub2-efi-arm", "efibootmgr", "uboot-tools", "uboot-images-armv7", "bcm283x-firmware", "arm-image-installer"], - "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", - "fwupdate", "fwupdate-efi", "microcode_ctl", + "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "microcode_ctl", "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware", "iwl7260-firmware"], From 1f0f049135014947515a1aa1e8f6b92410412e5f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 27 Aug 2019 23:12:35 +0100 Subject: [PATCH 037/163] Explicitly add wpa_supplicant and iwd Signed-off-by: Peter Robinson --- fedora-iot-base.json | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index a9127c5..c2437fb 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -89,6 +89,7 @@ "curl", "firewalld", "iptables", "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", + "wpa_supplicant", "iwd", "dnsmasq", "traceroute", "hostname", "iproute", "iputils", "openssh-clients", "openssh-server", "passwd", From 67aef814e24004ec9fb1b3ccd9826f40722c8c2f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 9 Sep 2019 10:42:21 +0100 Subject: [PATCH 038/163] switch to ignition for configuration Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index c2437fb..cb24d5e 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -99,8 +99,7 @@ "less", "tar", "fwupd", "usbguard", "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", - "initial-setup", - "cloud-utils-growpart", + "ignition", "rsync", "bash-completion", "tmux", "screen", From 3234333f4a123216665cc2bef7e570accb4fd821 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 24 Sep 2019 16:39:23 +0100 Subject: [PATCH 039/163] add bluetooth mesh subpackage Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index cb24d5e..219948b 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -106,7 +106,7 @@ "policycoreutils-python-utils", "setools-console", "audit", "rng-tools", - "bluez", "bluez-libs", "wpan-tools", + "bluez", "bluez-libs", "bluez-mesh", "wpan-tools", "kernel-tools", "libgpiod-utils", "podman", "container-selinux", "skopeo", "criu", "slirp4netns", From f277f527f0b80ee07303cce81521e307498a0aa2 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Tue, 29 Oct 2019 17:18:53 +0100 Subject: [PATCH 040/163] Add ignition initramfs module Signed-off-by: Patrick Uiterwijk --- fedora-iot-base.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 219948b..d468033 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -13,7 +13,8 @@ "automatic_version_prefix": "32", "mutate-os-release": "32", - "initramfs-args": ["--no-hostonly"], + "initramfs-args": ["--no-hostonly", + "--add", "ignition"], "boot_location": "new", "install-langs-comment": "Keep this in sync with treecompose-post.sh", From 4e5d3952753bcf43942d93b68886e46fae82452a Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 15 Nov 2019 12:20:08 +0000 Subject: [PATCH 041/163] authconfig has been retired Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index d468033..3cfa9c1 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -78,7 +78,7 @@ "rpm-ostree", "polkit", "lvm2", "chrony", "zram", "cryptsetup", "pinentry", - "authconfig", "keyutils", + "keyutils", "e2fsprogs", "gnupg2", "basesystem", From 465c8a2c1d1c0cf4b762477af87fb1d82c8ee002 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 5 Dec 2019 11:02:26 +0000 Subject: [PATCH 042/163] Package updates for F-32 Signed-off-by: Peter Robinson --- fedora-iot-base.json | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 3cfa9c1..76f0ce5 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -71,23 +71,19 @@ "check-groups": { "type": "file", "filename": "group" }, "packages": ["fedora-release-iot", - "glibc", "nss-altfiles", "shadow-utils", - "sssd-client", "libsss_sudo", - "dracut-config-generic", "kernel", - "dracut-network", + "glibc", "glibc-minimal-langpack", "nss-altfiles", + "sssd-client", "libsss_sudo", "shadow-utils", + "kernel", + "dracut-config-generic", "dracut-network", "rpm-ostree", "polkit", "lvm2", "chrony", "zram", "cryptsetup", "pinentry", "keyutils", - "e2fsprogs", + "e2fsprogs", "dosfstools", "gnupg2", - "basesystem", - "python3", - "bash", + "basesystem", "python3", "bash", "xz", "gzip", - "coreutils", - "which", - "curl", + "coreutils", "which", "curl", "firewalld", "iptables", "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", "wpa_supplicant", "iwd", @@ -102,6 +98,7 @@ "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "ignition", "rsync", + "ima-evm-utils", "bash-completion", "tmux", "screen", "policycoreutils-python-utils", From a5bd72df74233e17abdf5c4bb99413eb82dd25dd Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 17 Jan 2020 04:55:42 +0000 Subject: [PATCH 043/163] add xfsprogs Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 76f0ce5..2ecc150 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -79,7 +79,7 @@ "chrony", "zram", "cryptsetup", "pinentry", "keyutils", - "e2fsprogs", "dosfstools", + "e2fsprogs", "xfsprogs", "dosfstools", "gnupg2", "basesystem", "python3", "bash", "xz", "gzip", From 96d279458fa08f55ba4f925247ab77c3d32a2068 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 6 Feb 2020 12:18:19 +0000 Subject: [PATCH 044/163] add authselect (temporaily to work around an anaconda bug) Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 2ecc150..8c46481 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -78,7 +78,7 @@ "rpm-ostree", "polkit", "lvm2", "chrony", "zram", "cryptsetup", "pinentry", - "keyutils", + "authselect", "keyutils", "e2fsprogs", "xfsprogs", "dosfstools", "gnupg2", "basesystem", "python3", "bash", From 589a19b2793afbbd8b8485bc01e4ef4440a9b8d8 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 17 Feb 2020 08:12:35 +0000 Subject: [PATCH 045/163] IoT: Update rawhide for F-33 --- config.ini | 2 +- fedora-32.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/config.ini b/config.ini index 18ba958..3d79dfc 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f32 +release = f33 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux//development/rawhide/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-32.repo b/fedora-32.repo index 551d24d..5d5c0a0 100644 --- a/fedora-32.repo +++ b/fedora-32.repo @@ -1,12 +1,12 @@ -[fedora-32] -name=Fedora 32 - $basearch +[fedora-33] +name=Fedora 33 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/32/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-32&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/33/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-33&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=1 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-32-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-33-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 8c46481..dd676c9 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -10,8 +10,8 @@ "documentation": false, - "automatic_version_prefix": "32", - "mutate-os-release": "32", + "automatic_version_prefix": "33", + "mutate-os-release": "33", "initramfs-args": ["--no-hostonly", "--add", "ignition"], diff --git a/fedora-iot.json b/fedora-iot.json index f19b166..3892dcc 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-32"], + "repos": ["fedora-33"], "include": "fedora-iot-base.json" } From 6aafd971bd9008c7a9e7772495d61aa6abcf27d6 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 24 Feb 2020 12:09:50 +0000 Subject: [PATCH 046/163] drop authselect Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index dd676c9..8caa1e1 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -78,7 +78,7 @@ "rpm-ostree", "polkit", "lvm2", "chrony", "zram", "cryptsetup", "pinentry", - "authselect", "keyutils", + "keyutils", "e2fsprogs", "xfsprogs", "dosfstools", "gnupg2", "basesystem", "python3", "bash", From c5cbb655ebe0dbbb092c5000d0898534839fd03f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 26 Feb 2020 15:06:31 +0000 Subject: [PATCH 047/163] add cracklib-dicts to stop various things from crashing until they're fixed Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 8caa1e1..487c750 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -78,7 +78,7 @@ "rpm-ostree", "polkit", "lvm2", "chrony", "zram", "cryptsetup", "pinentry", - "keyutils", + "keyutils", "cracklib-dicts", "e2fsprogs", "xfsprogs", "dosfstools", "gnupg2", "basesystem", "python3", "bash", From b1685b48febf4896caf09cc386247443c061923f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 2 Mar 2020 16:12:21 +0000 Subject: [PATCH 048/163] Update README Signed-off-by: Peter Robinson --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index c4dac3d..25e27d2 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,3 @@ -# atomic +# ostree -Atomic compose configs for Fedora IoT \ No newline at end of file +This is the repo for the ostree compose configs for Fedora IoT. From ff82d595bfe8cdc267f3054daf8239601e42b372 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 2 Mar 2020 16:32:46 +0000 Subject: [PATCH 049/163] Drop chrony Signed-off-by: Peter Robinson --- fedora-iot-base.json | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 487c750..b5cb26b 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -76,13 +76,12 @@ "kernel", "dracut-config-generic", "dracut-network", "rpm-ostree", "polkit", "lvm2", - "chrony", "zram", "cryptsetup", "pinentry", "keyutils", "cracklib-dicts", "e2fsprogs", "xfsprogs", "dosfstools", "gnupg2", "basesystem", "python3", "bash", - "xz", "gzip", + "xz", "gzip", "zram", "coreutils", "which", "curl", "firewalld", "iptables", "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", @@ -97,7 +96,7 @@ "fwupd", "usbguard", "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "ignition", - "rsync", + "rsync", "attr", "ima-evm-utils", "bash-completion", "tmux", "screen", @@ -108,8 +107,7 @@ "kernel-tools", "libgpiod-utils", "podman", "container-selinux", "skopeo", "criu", "slirp4netns", - "clevis", "clevis-dracut", "clevis-luks", - "attr"], + "clevis", "clevis-dracut", "clevis-luks"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", From f89e63b312f9213cd3ce1e409c12ca213ce72453 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 5 Mar 2020 10:49:05 +0000 Subject: [PATCH 050/163] re-add chrony, it's not crond :-/ Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index b5cb26b..ac869c2 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -102,7 +102,7 @@ "tmux", "screen", "policycoreutils-python-utils", "setools-console", - "audit", "rng-tools", + "audit", "rng-tools", "chrony", "bluez", "bluez-libs", "bluez-mesh", "wpan-tools", "kernel-tools", "libgpiod-utils", "podman", "container-selinux", "skopeo", "criu", From b3ed4fa76eb4df402a1f3482133811f45798d461 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 18 Mar 2020 13:10:07 +0000 Subject: [PATCH 051/163] Add zezere-ignition for provisioning Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index ac869c2..c0a6892 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -95,7 +95,7 @@ "less", "tar", "fwupd", "usbguard", "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", - "ignition", + "ignition", "zezere-ignition", "rsync", "attr", "ima-evm-utils", "bash-completion", From 18dd9aef1fda157a6daa02aa2233470ca215caad Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 1 Apr 2020 09:02:17 +0100 Subject: [PATCH 052/163] Enable zezere ignition timer in units Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index c0a6892..d0766a1 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -124,5 +124,5 @@ "default_target": "multi-user.target", - "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", "zram-swap.service"] + "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", "zram-swap.service", "zezere_ignition.timer"] } From c023ae985ca48fdd7b6cef6b5069b358a96b72ea Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 2 Apr 2020 11:19:35 +0100 Subject: [PATCH 053/163] zezere: enable service to update provisioning banner Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index d0766a1..ec22ecd 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -124,5 +124,5 @@ "default_target": "multi-user.target", - "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", "zram-swap.service", "zezere_ignition.timer"] + "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", "zram-swap.service", "zezere_ignition.timer", "zezere_ignition_banner.service"] } From 47d2fc00305ad6829bd21d14bb3fc8c7b01dfd34 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 7 Apr 2020 12:55:00 +0100 Subject: [PATCH 054/163] Add fuse-overlayfs for containers (rhbz 1818744) Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index ec22ecd..1f4b157 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -106,7 +106,7 @@ "bluez", "bluez-libs", "bluez-mesh", "wpan-tools", "kernel-tools", "libgpiod-utils", "podman", "container-selinux", "skopeo", "criu", - "slirp4netns", + "slirp4netns", "fuse-overlayfs", "clevis", "clevis-dracut", "clevis-luks"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", From d2d45931d089b4e9471222f51ea1c5df3d05a326 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 16 Apr 2020 13:03:45 +0100 Subject: [PATCH 055/163] Add tpm2-pkcs11 Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 1f4b157..1c737af 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -85,7 +85,7 @@ "coreutils", "which", "curl", "firewalld", "iptables", "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", - "wpa_supplicant", "iwd", + "wpa_supplicant", "iwd", "tpm2-pkcs11", "dnsmasq", "traceroute", "hostname", "iproute", "iputils", "openssh-clients", "openssh-server", "passwd", From 537caa946d6a04a75b7053eaf3a08b25c266048d Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 17 Aug 2020 09:07:57 +0100 Subject: [PATCH 056/163] service updates, minor package updates Signed-off-by: Peter Robinson --- fedora-iot-base.json | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 1c737af..bd18a09 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -81,7 +81,7 @@ "e2fsprogs", "xfsprogs", "dosfstools", "gnupg2", "basesystem", "python3", "bash", - "xz", "gzip", "zram", + "xz", "gzip", "coreutils", "which", "curl", "firewalld", "iptables", "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", @@ -124,5 +124,8 @@ "default_target": "multi-user.target", - "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", "zram-swap.service", "zezere_ignition.timer", "zezere_ignition_banner.service"] + "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", + "zezere_ignition.timer", "zezere_ignition_banner.service", + "greenboot-grub2-set-counter", "greenboot-grub2-set-success", "greenboot-healthcheck", "greenboot-rpm-ostree-grub2-check-fallback", + "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "edboot-task-runner"] } From b8e040235faa05d0e1c6690e3e65aa62763a58c8 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 17 Aug 2020 09:25:46 +0100 Subject: [PATCH 057/163] IoT: Update rawhide for F-34 Signed-off-by: Peter Robinson --- config.ini | 4 ++-- fedora-32.repo => fedora-34.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 10 insertions(+), 10 deletions(-) rename fedora-32.repo => fedora-34.repo (61%) diff --git a/config.ini b/config.ini index 3d79dfc..c437a00 100644 --- a/config.ini +++ b/config.ini @@ -10,9 +10,9 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f33 +release = f34 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s -yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux//development/rawhide/%(arch)s/os/ +yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot docker_os_name = fedora diff --git a/fedora-32.repo b/fedora-34.repo similarity index 61% rename from fedora-32.repo rename to fedora-34.repo index 5d5c0a0..64b8944 100644 --- a/fedora-32.repo +++ b/fedora-34.repo @@ -1,12 +1,12 @@ -[fedora-33] -name=Fedora 33 - $basearch +[fedora-34] +name=Fedora 34 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/33/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-33&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/34/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-34&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=1 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-33-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-34-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index bd18a09..9248564 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -10,8 +10,8 @@ "documentation": false, - "automatic_version_prefix": "33", - "mutate-os-release": "33", + "automatic_version_prefix": "34", + "mutate-os-release": "34", "initramfs-args": ["--no-hostonly", "--add", "ignition"], diff --git a/fedora-iot.json b/fedora-iot.json index 3892dcc..4f3cf35 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-33"], + "repos": ["fedora-34"], "include": "fedora-iot-base.json" } From c8bdd80ca466ea8f01d7fd39c34ac025e943064f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 24 Aug 2020 13:16:12 +0100 Subject: [PATCH 058/163] Add new clevis tpm2 pin Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 9248564..c5ee169 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -107,7 +107,7 @@ "kernel-tools", "libgpiod-utils", "podman", "container-selinux", "skopeo", "criu", "slirp4netns", "fuse-overlayfs", - "clevis", "clevis-dracut", "clevis-luks"], + "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", From a933bdf17b8c6bf8bd8ef5ab6a779ed666f58a5c Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 16 Sep 2020 14:13:41 +0100 Subject: [PATCH 059/163] Add and enable parsec/dbus-parsec, minor tweaks Signed-off-by: Peter Robinson --- fedora-iot-base.json | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index c5ee169..d01de44 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -103,11 +103,12 @@ "policycoreutils-python-utils", "setools-console", "audit", "rng-tools", "chrony", - "bluez", "bluez-libs", "bluez-mesh", "wpan-tools", + "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", "podman", "container-selinux", "skopeo", "criu", - "slirp4netns", "fuse-overlayfs", - "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2"], + "slirp4netns", "fuse-overlayfs", + "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", + "parsec", "dbus-parsec"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", @@ -127,5 +128,6 @@ "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", "zezere_ignition.timer", "zezere_ignition_banner.service", "greenboot-grub2-set-counter", "greenboot-grub2-set-success", "greenboot-healthcheck", "greenboot-rpm-ostree-grub2-check-fallback", - "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "edboot-task-runner"] + "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "edboot-task-runner", + "parsec", "dbus-parsec"] } From aefa3387f8e30b3498034a9f74adfe2fa904bda0 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 17 Sep 2020 09:04:33 +0100 Subject: [PATCH 060/163] Add tpm2-abrmd Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index d01de44..c51a9f7 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -108,7 +108,7 @@ "podman", "container-selinux", "skopeo", "criu", "slirp4netns", "fuse-overlayfs", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", - "parsec", "dbus-parsec"], + "parsec", "dbus-parsec", "tpm2-abrmd"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", From f8b9a68f929f7d2e5c8a549928f251621d9e1c6b Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 17 Sep 2020 14:28:04 +0100 Subject: [PATCH 061/163] Revert "Add tpm2-abrmd" This reverts commit bcc9459ea2e69c5086c48c637ed3016d870e6fc5. Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index c51a9f7..d01de44 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -108,7 +108,7 @@ "podman", "container-selinux", "skopeo", "criu", "slirp4netns", "fuse-overlayfs", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", - "parsec", "dbus-parsec", "tpm2-abrmd"], + "parsec", "dbus-parsec"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", From 16bae90f46c5556f3abe2b1a12994fb4d0a43683 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 30 Sep 2020 12:30:43 +0100 Subject: [PATCH 062/163] fix typo in redboot service Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index d01de44..242670d 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -128,6 +128,6 @@ "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", "zezere_ignition.timer", "zezere_ignition_banner.service", "greenboot-grub2-set-counter", "greenboot-grub2-set-success", "greenboot-healthcheck", "greenboot-rpm-ostree-grub2-check-fallback", - "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "edboot-task-runner", + "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "redboot-task-runner", "parsec", "dbus-parsec"] } From b84ecbd52d22e2d6bfde41adc2b81468f0362850 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 8 Oct 2020 18:33:33 +0100 Subject: [PATCH 063/163] Add podman-plugins as it's not pulled in now Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 242670d..b7a508c 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -105,7 +105,7 @@ "audit", "rng-tools", "chrony", "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", - "podman", "container-selinux", "skopeo", "criu", + "podman", "podman-plugins", "container-selinux", "skopeo", "criu", "slirp4netns", "fuse-overlayfs", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "parsec", "dbus-parsec"], From 3bcf4fcde08762a5b9b70813a1f185e34570af06 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 19 Dec 2020 11:35:36 +0000 Subject: [PATCH 064/163] add openssl option explicitly to allow for certificate pieces Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index b7a508c..688f0c3 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -97,7 +97,7 @@ "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "ignition", "zezere-ignition", "rsync", "attr", - "ima-evm-utils", + "ima-evm-utils", "openssl", "bash-completion", "tmux", "screen", "policycoreutils-python-utils", From c073a1e95799ac5122ef9b978665d33413243b4a Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 31 Dec 2020 10:57:36 +0000 Subject: [PATCH 065/163] Add wireless-regdb to ensure wireless location can be set Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 688f0c3..a52b3a5 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -85,7 +85,7 @@ "coreutils", "which", "curl", "firewalld", "iptables", "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", - "wpa_supplicant", "iwd", "tpm2-pkcs11", + "wpa_supplicant", "wireless-regdb", "iwd", "tpm2-pkcs11", "dnsmasq", "traceroute", "hostname", "iproute", "iputils", "openssh-clients", "openssh-server", "passwd", From 635d2c5f12ba50d8795da3f1f188c3f970f1a31c Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 14 Feb 2021 11:57:05 +0000 Subject: [PATCH 066/163] Add zram-generator, zram-generator-defaults which replace zram Signed-off-by: Peter Robinson --- fedora-iot-base.json | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index a52b3a5..db7f2e8 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -96,6 +96,7 @@ "fwupd", "usbguard", "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "ignition", "zezere-ignition", + "zram-generator", "zram-generator-defaults", "rsync", "attr", "ima-evm-utils", "openssl", "bash-completion", From c5e20d4103cbd6ac6eb4c173b1466847180b8e4f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 14 Feb 2021 14:38:01 +0000 Subject: [PATCH 067/163] IoT: Update rawhide for F-35 Signed-off-by: Peter Robinson --- config.ini | 2 +- fedora-34.repo => fedora-35.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-34.repo => fedora-35.repo (61%) diff --git a/config.ini b/config.ini index c437a00..c3def07 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f34 +release = f35 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-34.repo b/fedora-35.repo similarity index 61% rename from fedora-34.repo rename to fedora-35.repo index 64b8944..4943b25 100644 --- a/fedora-34.repo +++ b/fedora-35.repo @@ -1,12 +1,12 @@ -[fedora-34] -name=Fedora 34 - $basearch +[fedora-35] +name=Fedora 35 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/34/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-34&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/35/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-35&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=1 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-34-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-35-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index db7f2e8..cd49f99 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -10,8 +10,8 @@ "documentation": false, - "automatic_version_prefix": "34", - "mutate-os-release": "34", + "automatic_version_prefix": "35", + "mutate-os-release": "35", "initramfs-args": ["--no-hostonly", "--add", "ignition"], diff --git a/fedora-iot.json b/fedora-iot.json index 4f3cf35..1b7ca7a 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-34"], + "repos": ["fedora-35"], "include": "fedora-iot-base.json" } From ab7db2e1f08d83f47e081e288f86f244ddb03116 Mon Sep 17 00:00:00 2001 From: Alexander Wellbrock Date: Tue, 30 Mar 2021 12:03:02 +0000 Subject: [PATCH 068/163] treefile: fix unit file names Observed from dmesg since F33 the unit symlinks created with this treefile have invalid names and are ignored by systemd. It seems that it worked nonetheless since the units are started anyway and most have correct symlinks placed alongside the invalid ones. This should get rid of those warnings in dmesg. Apparently rpm-ostree takes the specified strings here and places them as-is in the .wants/ dir. --- fedora-iot-base.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index cd49f99..3fce376 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -128,7 +128,7 @@ "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", "zezere_ignition.timer", "zezere_ignition_banner.service", - "greenboot-grub2-set-counter", "greenboot-grub2-set-success", "greenboot-healthcheck", "greenboot-rpm-ostree-grub2-check-fallback", - "greenboot-status", "greenboot-task-runner", "redboot-auto-reboot", "redboot-task-runner", - "parsec", "dbus-parsec"] + "greenboot-grub2-set-counter.service", "greenboot-grub2-set-success.service", "greenboot-healthcheck.service", + "greenboot-rpm-ostree-grub2-check-fallback.service", "greenboot-status.service", "greenboot-task-runner.service", + "redboot-auto-reboot.service", "redboot-task-runner.service", "parsec.service", "dbus-parsec.service"] } From fb64a374e895e5b76e2d2337bffc046bb3bd2731 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 21 Apr 2021 12:57:36 +0100 Subject: [PATCH 069/163] initrd: include the watchdog module Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 3fce376..394d611 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -14,7 +14,7 @@ "mutate-os-release": "35", "initramfs-args": ["--no-hostonly", - "--add", "ignition"], + "--add", "ignition watchdog"], "boot_location": "new", "install-langs-comment": "Keep this in sync with treecompose-post.sh", From 0f8a7c76f8a66790c29981a65eb2eba6a355c6b6 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 27 Apr 2021 12:54:29 +0100 Subject: [PATCH 070/163] Fedora repo metadata isn't signed by default Signed-off-by: Peter Robinson --- fedora-35.repo | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-35.repo b/fedora-35.repo index 4943b25..901cd0a 100644 --- a/fedora-35.repo +++ b/fedora-35.repo @@ -5,7 +5,7 @@ failovermethod=priority metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-35&arch=$basearch enabled=1 #metadata_expire=7d -repo_gpgcheck=1 +repo_gpgcheck=0 type=rpm gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-35-$basearch From abc66898e9eeef09f88c4ddcece5d186b1131d72 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 3 May 2021 17:49:40 +0100 Subject: [PATCH 071/163] Add fwupd-plugin-modem-manager Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 394d611..fe0abc1 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -93,7 +93,7 @@ "selinux-policy-targeted", "setup", "shadow-utils", "sudo", "systemd", "util-linux", "vim-minimal", "less", "tar", - "fwupd", "usbguard", + "fwupd", "fwupd-plugin-modem-manager", "usbguard", "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "ignition", "zezere-ignition", "zram-generator", "zram-generator-defaults", From 32111f79bb8d8e422d90d5d778e3f5a1c89631c6 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 8 May 2021 13:05:38 +0100 Subject: [PATCH 072/163] Add fwupd-efi Signed-off-by: Peter Robinson --- fedora-iot-base.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index fe0abc1..8902b27 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -93,7 +93,7 @@ "selinux-policy-targeted", "setup", "shadow-utils", "sudo", "systemd", "util-linux", "vim-minimal", "less", "tar", - "fwupd", "fwupd-plugin-modem-manager", "usbguard", + "fwupd", "fwupd-plugin-modem-manager", "fwupd-efi", "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "ignition", "zezere-ignition", "zram-generator", "zram-generator-defaults", @@ -102,7 +102,7 @@ "bash-completion", "tmux", "screen", "policycoreutils-python-utils", - "setools-console", + "setools-console", "usbguard", "audit", "rng-tools", "chrony", "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", From 6490f41732f91861a2dfd7103508e08fa7f4c2ee Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 25 May 2021 13:09:21 +0100 Subject: [PATCH 073/163] fwupd-efi is only on x86_64/aarch64 Signed-off-by: Peter Robinson --- fedora-iot-base.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 8902b27..f9664aa 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -93,7 +93,7 @@ "selinux-policy-targeted", "setup", "shadow-utils", "sudo", "systemd", "util-linux", "vim-minimal", "less", "tar", - "fwupd", "fwupd-plugin-modem-manager", "fwupd-efi", + "fwupd", "fwupd-plugin-modem-manager", "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", "ignition", "zezere-ignition", "zram-generator", "zram-generator-defaults", @@ -111,7 +111,7 @@ "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "parsec", "dbus-parsec"], - "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", + "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "fwupd-efi", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer", "iwl7260-firmware"], @@ -119,7 +119,7 @@ "uboot-tools", "uboot-images-armv7", "bcm283x-firmware", "arm-image-installer"], - "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "microcode_ctl", + "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "fwupd-efi", "microcode_ctl", "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware", "iwl7260-firmware"], From a3112cdac08a84cd65d044750d43d276ecd4f4e0 Mon Sep 17 00:00:00 2001 From: Christian Glombek Date: Thu, 10 Jun 2021 19:46:51 +0200 Subject: [PATCH 074/163] treefile: remove redboot-* service units The redboot services should not be started by the default target. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1959861 --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index f9664aa..24edd7b 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -130,5 +130,5 @@ "zezere_ignition.timer", "zezere_ignition_banner.service", "greenboot-grub2-set-counter.service", "greenboot-grub2-set-success.service", "greenboot-healthcheck.service", "greenboot-rpm-ostree-grub2-check-fallback.service", "greenboot-status.service", "greenboot-task-runner.service", - "redboot-auto-reboot.service", "redboot-task-runner.service", "parsec.service", "dbus-parsec.service"] + "parsec.service", "dbus-parsec.service"] } From df477fc624c02e5b9781178f477e5cf4fe2c33a2 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 29 Jul 2021 20:21:56 +0100 Subject: [PATCH 075/163] add systemd-resolved Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 24edd7b..02d2dae 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -91,7 +91,8 @@ "openssh-clients", "openssh-server", "passwd", "policycoreutils", "procps-ng", "rootfiles", "rpm", "selinux-policy-targeted", "setup", "shadow-utils", - "sudo", "systemd", "util-linux", "vim-minimal", + "sudo", "util-linux", "vim-minimal", + "systemd", "systemd-resolved", "less", "tar", "fwupd", "fwupd-plugin-modem-manager", "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", From c269f11ae9fc8d1eb0ef6c3264b28842e114c0b1 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 20 Aug 2021 08:37:38 +0100 Subject: [PATCH 076/163] Drop fuse-overlayfs It's no longer needed for rootless containers Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 02d2dae..c7675bc 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -107,8 +107,7 @@ "audit", "rng-tools", "chrony", "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", - "podman", "podman-plugins", "container-selinux", "skopeo", "criu", - "slirp4netns", "fuse-overlayfs", + "podman", "podman-plugins", "container-selinux", "skopeo", "criu", "slirp4netns", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "parsec", "dbus-parsec"], From 97aeeeccb1a31a861173098d1df2d30e8cd1da1b Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 20 Aug 2021 08:54:29 +0100 Subject: [PATCH 077/163] IoT: Update rawhide for F-36 Signed-off-by: Peter Robinson --- config.ini | 2 +- fedora-35.repo => fedora-36.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-35.repo => fedora-36.repo (61%) diff --git a/config.ini b/config.ini index c3def07..d16b945 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f35 +release = f36 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-35.repo b/fedora-36.repo similarity index 61% rename from fedora-35.repo rename to fedora-36.repo index 901cd0a..51639ff 100644 --- a/fedora-35.repo +++ b/fedora-36.repo @@ -1,12 +1,12 @@ -[fedora-35] -name=Fedora 35 - $basearch +[fedora-36] +name=Fedora 36 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/35/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-35&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/36/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-36&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-35-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-36-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index c7675bc..52a1fe8 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -10,8 +10,8 @@ "documentation": false, - "automatic_version_prefix": "35", - "mutate-os-release": "35", + "automatic_version_prefix": "36", + "mutate-os-release": "36", "initramfs-args": ["--no-hostonly", "--add", "ignition watchdog"], diff --git a/fedora-iot.json b/fedora-iot.json index 1b7ca7a..df9035d 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-35"], + "repos": ["fedora-36"], "include": "fedora-iot-base.json" } From 0dec23f77f454280d685f5455dfffdae34b37dcb Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 28 Aug 2021 13:29:30 +0100 Subject: [PATCH 078/163] drop audit from package set audit for unknown and unexplained reasons keeps depending on the long legacy Sys-V initscripts/chkconfig and we don't want to pull in the legacy deps so drop audit. Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 52a1fe8..059a48d 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -104,7 +104,7 @@ "tmux", "screen", "policycoreutils-python-utils", "setools-console", "usbguard", - "audit", "rng-tools", "chrony", + "rng-tools", "chrony", "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", "podman", "podman-plugins", "container-selinux", "skopeo", "criu", "slirp4netns", From df56f712a945147d27589d1a6080b49e8d4412e7 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 10 Oct 2021 13:29:48 +0100 Subject: [PATCH 079/163] Add Intel Wireless AX2xx firmware Signed-off-by: Peter Robinson --- fedora-iot-base.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 059a48d..e7b83b4 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -113,7 +113,7 @@ "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "fwupd-efi", "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", - "arm-image-installer", "iwl7260-firmware"], + "arm-image-installer", "iwl7260-firmware", "iwlax2xx-firmware"], "packages-armhfp": ["grub2-efi-arm", "efibootmgr", "uboot-tools", "uboot-images-armv7", "bcm283x-firmware", @@ -122,7 +122,8 @@ "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "fwupd-efi", "microcode_ctl", "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", - "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware", "iwl7260-firmware"], + "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware", "iwl7260-firmware", + "iwlax2xx-firmware"], "default_target": "multi-user.target", From d0ac7aebe2505908983de8a2ca3e48cadf8084c5 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 10 Nov 2021 14:35:42 +0000 Subject: [PATCH 080/163] Update greenboot packages for upstream changes Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index e7b83b4..caeac22 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -95,7 +95,7 @@ "systemd", "systemd-resolved", "less", "tar", "fwupd", "fwupd-plugin-modem-manager", - "greenboot", "greenboot-grub2", "greenboot-rpm-ostree-grub2", "greenboot-reboot", "greenboot-status", + "greenboot", "greenboot-default-health-checks", "ignition", "zezere-ignition", "zram-generator", "zram-generator-defaults", "rsync", "attr", From bf190f31480d36a4488438c867367b364a4d6291 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 11 Dec 2021 16:55:04 +0000 Subject: [PATCH 081/163] Add fwupd-plugin-uefi-capsule-data Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index caeac22..e692826 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -94,7 +94,7 @@ "sudo", "util-linux", "vim-minimal", "systemd", "systemd-resolved", "less", "tar", - "fwupd", "fwupd-plugin-modem-manager", + "fwupd", "fwupd-plugin-modem-manager", "fwupd-plugin-uefi-capsule-data", "greenboot", "greenboot-default-health-checks", "ignition", "zezere-ignition", "zram-generator", "zram-generator-defaults", From 80e2ffbc85fa8652d2559b783c5f3ba4c2c5eb34 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 11 Dec 2021 17:40:07 +0000 Subject: [PATCH 082/163] Drop uboot-tools, now unnessary Signed-off-by: Peter Robinson --- fedora-iot-base.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index e692826..e01793e 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -112,11 +112,11 @@ "parsec", "dbus-parsec"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "fwupd-efi", - "uboot-tools", "uboot-images-armv8", "bcm283x-firmware", + "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer", "iwl7260-firmware", "iwlax2xx-firmware"], "packages-armhfp": ["grub2-efi-arm", "efibootmgr", - "uboot-tools", "uboot-images-armv7", "bcm283x-firmware", + "uboot-images-armv7", "bcm283x-firmware", "arm-image-installer"], "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "fwupd-efi", "microcode_ctl", From 97fc77899bc92a34f3d001a53f9a0ac2dc7f7f62 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 12 Dec 2021 20:55:06 +0000 Subject: [PATCH 083/163] no fwupd-plugin-uefi-capsule-data on armhfp Signed-off-by: Peter Robinson --- fedora-iot-base.json | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index e01793e..58e25d9 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -94,7 +94,7 @@ "sudo", "util-linux", "vim-minimal", "systemd", "systemd-resolved", "less", "tar", - "fwupd", "fwupd-plugin-modem-manager", "fwupd-plugin-uefi-capsule-data", + "fwupd", "fwupd-plugin-modem-manager", "greenboot", "greenboot-default-health-checks", "ignition", "zezere-ignition", "zram-generator", "zram-generator-defaults", @@ -112,18 +112,17 @@ "parsec", "dbus-parsec"], "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "fwupd-efi", - "uboot-images-armv8", "bcm283x-firmware", + "uboot-images-armv8", "bcm283x-firmware", "fwupd-plugin-uefi-capsule-data", "arm-image-installer", "iwl7260-firmware", "iwlax2xx-firmware"], - "packages-armhfp": ["grub2-efi-arm", "efibootmgr", - "uboot-images-armv7", "bcm283x-firmware", + "packages-armhfp": ["grub2-efi-arm", "efibootmgr", "uboot-images-armv7", "bcm283x-firmware", "arm-image-installer"], "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "fwupd-efi", "microcode_ctl", "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware", "iwl7260-firmware", - "iwlax2xx-firmware"], + "iwlax2xx-firmware", "fwupd-plugin-uefi-capsule-data"], "default_target": "multi-user.target", From 88df205fd33094553bda26b836462cf62a3bde5b Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 9 Feb 2022 10:18:58 +0000 Subject: [PATCH 084/163] IoT: Update rawhide for F-37 Signed-off-by: Peter Robinson --- config.ini | 2 +- fedora-36.repo => fedora-37.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot-updates-stable.json | 2 +- fedora-iot.json | 2 +- 5 files changed, 10 insertions(+), 10 deletions(-) rename fedora-36.repo => fedora-37.repo (61%) diff --git a/config.ini b/config.ini index d16b945..a2f3084 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f36 +release = f37 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-36.repo b/fedora-37.repo similarity index 61% rename from fedora-36.repo rename to fedora-37.repo index 51639ff..9cbd5a6 100644 --- a/fedora-36.repo +++ b/fedora-37.repo @@ -1,12 +1,12 @@ -[fedora-36] -name=Fedora 36 - $basearch +[fedora-37] +name=Fedora 37 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/36/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-36&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/37/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-37&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-36-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-37-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 58e25d9..d50af30 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -10,8 +10,8 @@ "documentation": false, - "automatic_version_prefix": "36", - "mutate-os-release": "36", + "automatic_version_prefix": "37", + "mutate-os-release": "37", "initramfs-args": ["--no-hostonly", "--add", "ignition watchdog"], diff --git a/fedora-iot-updates-stable.json b/fedora-iot-updates-stable.json index 1bacd21..a3fb5ed 100644 --- a/fedora-iot-updates-stable.json +++ b/fedora-iot-updates-stable.json @@ -1,5 +1,5 @@ - "ref": "fedora/devel/${basearch}/updates/iot", + "ref": "fedora/rawhide/${basearch}/updates/iot", "ex-jigdo-spec": "fedora-iot.spec", "include": "fedora-iot-base.json" } diff --git a/fedora-iot.json b/fedora-iot.json index df9035d..be6b73b 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-36"], + "repos": ["fedora-37"], "include": "fedora-iot-base.json" } From 1c4f3e7dcdb5bf35a6bba761fee63224053ba0c1 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 9 Feb 2022 11:10:13 +0000 Subject: [PATCH 085/163] add authselect for Fedora feature, drop rng-tools Signed-off-by: Peter Robinson --- fedora-iot-base.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index d50af30..3598f5f 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -79,7 +79,7 @@ "cryptsetup", "pinentry", "keyutils", "cracklib-dicts", "e2fsprogs", "xfsprogs", "dosfstools", - "gnupg2", + "gnupg2", "authselect", "basesystem", "python3", "bash", "xz", "gzip", "coreutils", "which", "curl", @@ -104,7 +104,7 @@ "tmux", "screen", "policycoreutils-python-utils", "setools-console", "usbguard", - "rng-tools", "chrony", + "chrony", "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", "podman", "podman-plugins", "container-selinux", "skopeo", "criu", "slirp4netns", From 57af56375908dbea96654527693899b366e3fb1f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 9 Feb 2022 13:45:55 +0000 Subject: [PATCH 086/163] Updates for F-36+ Signed-off-by: Peter Robinson --- fedora-iot-base.json | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 3598f5f..dfe548a 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -73,7 +73,7 @@ "packages": ["fedora-release-iot", "glibc", "glibc-minimal-langpack", "nss-altfiles", "sssd-client", "libsss_sudo", "shadow-utils", - "kernel", + "kernel", "linux-firmware", "dracut-config-generic", "dracut-network", "rpm-ostree", "polkit", "lvm2", "cryptsetup", "pinentry", @@ -107,7 +107,8 @@ "chrony", "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", - "podman", "podman-plugins", "container-selinux", "skopeo", "criu", "slirp4netns", + "podman", "podman-plugins", "container-selinux", "skopeo", "criu", + "slirp4netns", " containernetworking-plugins", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "parsec", "dbus-parsec"], @@ -126,7 +127,7 @@ "default_target": "multi-user.target", - "units": ["NetworkManager.service", "firewalld.service", "rngd.service", "sshd.service", + "units": ["NetworkManager.service", "firewalld.service", "sshd.service", "zezere_ignition.timer", "zezere_ignition_banner.service", "greenboot-grub2-set-counter.service", "greenboot-grub2-set-success.service", "greenboot-healthcheck.service", "greenboot-rpm-ostree-grub2-check-fallback.service", "greenboot-status.service", "greenboot-task-runner.service", From 28a6a677762138aabc23dcfb9973e4ec3507e27d Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 9 Feb 2022 13:47:29 +0000 Subject: [PATCH 087/163] Drop ARMv7 specific package set Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 --- 1 file changed, 3 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index dfe548a..2d3230e 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -116,9 +116,6 @@ "uboot-images-armv8", "bcm283x-firmware", "fwupd-plugin-uefi-capsule-data", "arm-image-installer", "iwl7260-firmware", "iwlax2xx-firmware"], - "packages-armhfp": ["grub2-efi-arm", "efibootmgr", "uboot-images-armv7", "bcm283x-firmware", - "arm-image-installer"], - "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "fwupd-efi", "microcode_ctl", "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", From 1c0a8aa02f10e1a9b2a8c9802d8bd7028fca5752 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 9 Feb 2022 17:01:07 +0000 Subject: [PATCH 088/163] De-dupe and cleanup architecture specific packages With ARMv7 we can clean up a few exceptions that are identical across the two aarch64/x86_64 architectures. We also explicitly drop traditional BIOS piecs, we've never officially supported it and including it stops enhancements around security so explicitly definte it. Signed-off-by: Peter Robinson --- fedora-iot-base.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 2d3230e..cf8fc88 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -109,18 +109,18 @@ "kernel-tools", "libgpiod-utils", "podman", "podman-plugins", "container-selinux", "skopeo", "criu", "slirp4netns", " containernetworking-plugins", + "parsec", "dbus-parsec", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", - "parsec", "dbus-parsec"], + "efibootmgr", "fwupd-efi", "fwupd-plugin-uefi-capsule-data", + "iwl7260-firmware", "iwlax2xx-firmware"], - "packages-aarch64": ["grub2-efi-aa64", "efibootmgr", "shim-aa64", "fwupd-efi", - "uboot-images-armv8", "bcm283x-firmware", "fwupd-plugin-uefi-capsule-data", - "arm-image-installer", "iwl7260-firmware", "iwlax2xx-firmware"], + "packages-aarch64": ["grub2-efi-aa64", "shim-aa64", + "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer"], - "packages-x86_64": ["grub2", "grub2-efi-x64", "efibootmgr", "shim-x64", "fwupd-efi", "microcode_ctl", - "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", - "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", - "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware", "iwl7260-firmware", - "iwlax2xx-firmware", "fwupd-plugin-uefi-capsule-data"], + "packages-x86_64": ["grub2-efi-x64", "shim-x64", "microcode_ctl", + "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", + "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", + "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware"], "default_target": "multi-user.target", From 0c7f01f93b3b5afe15b351caa9450200545c058e Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 18 Mar 2022 08:12:18 +0000 Subject: [PATCH 089/163] Add netavark for new podman 4 network Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index cf8fc88..7c4d3e1 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -108,7 +108,7 @@ "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", "podman", "podman-plugins", "container-selinux", "skopeo", "criu", - "slirp4netns", " containernetworking-plugins", + "containernetworking-plugins", "slirp4netns", "netavark", "parsec", "dbus-parsec", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "efibootmgr", "fwupd-efi", "fwupd-plugin-uefi-capsule-data", From bd8545ee95bc5004d8c5d53d9ec1abfe2c92fa86 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 20 Mar 2022 10:40:21 +0000 Subject: [PATCH 090/163] Add aardvark-dns for local container lookups Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 7c4d3e1..0222428 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -108,7 +108,7 @@ "bluez", "bluez-libs", "bluez-mesh", "kernel-tools", "libgpiod-utils", "podman", "podman-plugins", "container-selinux", "skopeo", "criu", - "containernetworking-plugins", "slirp4netns", "netavark", + "containernetworking-plugins", "slirp4netns", "netavark", "aardvark-dns", "parsec", "dbus-parsec", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "efibootmgr", "fwupd-efi", "fwupd-plugin-uefi-capsule-data", From f51a1e4263c39a94a2127f761f1114583714d6ee Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 26 Mar 2022 19:47:14 +0000 Subject: [PATCH 091/163] drop rsync Signed-off-by: Peter Robinson --- fedora-iot-base.json | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 0222428..65a33fe 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -75,21 +75,21 @@ "sssd-client", "libsss_sudo", "shadow-utils", "kernel", "linux-firmware", "dracut-config-generic", "dracut-network", - "rpm-ostree", "polkit", "lvm2", + "rpm-ostree", "rpm", "polkit", "lvm2", "cryptsetup", "pinentry", "keyutils", "cracklib-dicts", "e2fsprogs", "xfsprogs", "dosfstools", "gnupg2", "authselect", "basesystem", "python3", "bash", "xz", "gzip", - "coreutils", "which", "curl", + "coreutils", "which", "curl", "attr", "firewalld", "iptables", "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", "wpa_supplicant", "wireless-regdb", "iwd", "tpm2-pkcs11", "dnsmasq", "traceroute", "hostname", "iproute", "iputils", "openssh-clients", "openssh-server", "passwd", - "policycoreutils", "procps-ng", "rootfiles", "rpm", + "policycoreutils", "procps-ng", "rootfiles", "selinux-policy-targeted", "setup", "shadow-utils", "sudo", "util-linux", "vim-minimal", "systemd", "systemd-resolved", @@ -98,7 +98,6 @@ "greenboot", "greenboot-default-health-checks", "ignition", "zezere-ignition", "zram-generator", "zram-generator-defaults", - "rsync", "attr", "ima-evm-utils", "openssl", "bash-completion", "tmux", "screen", From 1811f791326a804d51f104ae6abec9113acd693e Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 26 Mar 2022 19:52:35 +0000 Subject: [PATCH 092/163] Drop xfsprogs, it's not a default IoT filesystem Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 65a33fe..f7ef3b2 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -78,7 +78,7 @@ "rpm-ostree", "rpm", "polkit", "lvm2", "cryptsetup", "pinentry", "keyutils", "cracklib-dicts", - "e2fsprogs", "xfsprogs", "dosfstools", + "e2fsprogs", "dosfstools", "gnupg2", "authselect", "basesystem", "python3", "bash", "xz", "gzip", From 906ef6941640cf67eda447d9bb7da998ae252db8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 20 Oct 2021 20:30:18 +0200 Subject: [PATCH 093/163] README: Minor update --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 25e27d2..2eb5265 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,3 @@ -# ostree +# Fedora IoT ostree/rpm-ostree treefiles This is the repo for the ostree compose configs for Fedora IoT. From 603a779550c50b7d09624132837be5377a87a494 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Mon, 11 Oct 2021 12:50:54 +0200 Subject: [PATCH 094/163] Remove fedora-iot-rawhide.tdl & fedora-iot.spec - fedora-iot-rawhide.tdl has out of date content - fedora-iot.spec: support for jigdo/rojig was dropped from rpm-ostree. See: https://github.com/coreos/rpm-ostree/pull/2841 & https://github.com/coreos/rpm-ostree/pull/2842 --- fedora-iot-rawhide.tdl | 13 ------------- fedora-iot.spec | 22 ---------------------- 2 files changed, 35 deletions(-) delete mode 100644 fedora-iot-rawhide.tdl delete mode 100644 fedora-iot.spec diff --git a/fedora-iot-rawhide.tdl b/fedora-iot-rawhide.tdl deleted file mode 100644 index 8ad38cb..0000000 --- a/fedora-iot-rawhide.tdl +++ /dev/null @@ -1,13 +0,0 @@ - - diff --git a/fedora-iot.spec b/fedora-iot.spec deleted file mode 100644 index f8b12a5..0000000 --- a/fedora-iot.spec +++ /dev/null @@ -1,22 +0,0 @@ -# Suppress most build root processing since we are just carrying binary data -%global __os_install_post /usr/lib/rpm/brp-compress %{nil} -Name: fedora-iot -Version: %{ostree_version} -Release: 1%{?dist} -Summary: Image (rpm-ostree jigdo) for Fedora IoT -License: MIT -#@@@rpmostree_jigdo_meta@@@ - -%description -%{summary} - -%prep - -%build - -%install -mkdir -p %{buildroot}%{_prefix}/lib/ostree-jigdo/%{name} -for x in *; do mv ${x} %{buildroot}%{_prefix}/lib/ostree-jigdo/%{name}; done - -%files -%{_prefix}/lib/ostree-jigdo/%{name} From 179518bbab031d6c523ffaff66bae88a2e11ed0d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 20 Oct 2021 20:30:43 +0200 Subject: [PATCH 095/163] fedora-iot-base: Update persistent journal workaround Add a systemd configuration drop-in instead of modyfing the default configuration file. Imported from: https://github.com/coreos/fedora-coreos-config/blob/testing-devel/overlay.d/05core/usr/lib/systemd/journald.conf.d/10-coreos-persistent.conf --- treecompose-post.sh | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/treecompose-post.sh b/treecompose-post.sh index 81d6c5e..4b86bf3 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -2,12 +2,8 @@ set -xeuo pipefail -# Work around https://bugzilla.redhat.com/show_bug.cgi?id=1265295 -# Also note the create-new-then-rename dance for rofiles-fuse compat -if ! grep -q '^Storage=persistent' /etc/systemd/journald.conf; then - (cat /etc/systemd/journald.conf && echo 'Storage=persistent') > /etc/systemd.journald.conf.new - mv /etc/systemd.journald.conf{.new,} -fi +# From https://github.com/coreos/fedora-coreos-config/blob/testing-devel/overlay.d/05core/usr/lib/systemd/journald.conf.d/10-coreos-persistent.conf +echo -e "[Journal]\nStorage=persistent" > /usr/lib/systemd/journald.conf.d/10-persistent.conf # See: https://src.fedoraproject.org/rpms/glibc/pull-request/4 # Basically that program handles deleting old shared library directories From 8d4aec8722da60a1499aa0e9eb4ff10f2ed6962d Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 30 May 2022 13:22:03 -0400 Subject: [PATCH 096/163] Fix missing directory in treecompose-post.sh Signed-off-by: Paul Whalen --- treecompose-post.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/treecompose-post.sh b/treecompose-post.sh index 4b86bf3..8cf8e61 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -3,6 +3,7 @@ set -xeuo pipefail # From https://github.com/coreos/fedora-coreos-config/blob/testing-devel/overlay.d/05core/usr/lib/systemd/journald.conf.d/10-coreos-persistent.conf +install -dm0755 /usr/lib/systemd/journald.conf.d/ echo -e "[Journal]\nStorage=persistent" > /usr/lib/systemd/journald.conf.d/10-persistent.conf # See: https://src.fedoraproject.org/rpms/glibc/pull-request/4 From f22dd5b0854043e96f21e4d4a145df953bf83076 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 13 Aug 2022 15:02:37 +0100 Subject: [PATCH 097/163] IoT: Update rawhide for F-38 Signed-off-by: Peter Robinson --- config.ini | 2 +- fedora-37.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/config.ini b/config.ini index a2f3084..cc2f879 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f37 +release = f38 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-37.repo b/fedora-37.repo index 9cbd5a6..ae158a8 100644 --- a/fedora-37.repo +++ b/fedora-37.repo @@ -1,12 +1,12 @@ -[fedora-37] -name=Fedora 37 - $basearch +[fedora-38] +name=Fedora 38 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/37/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-37&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/38/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-38&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-37-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-38-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index f7ef3b2..18eec22 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -10,8 +10,8 @@ "documentation": false, - "automatic_version_prefix": "37", - "mutate-os-release": "37", + "automatic_version_prefix": "38", + "mutate-os-release": "38", "initramfs-args": ["--no-hostonly", "--add", "ignition watchdog"], diff --git a/fedora-iot.json b/fedora-iot.json index be6b73b..31c9ec4 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-37"], + "repos": ["fedora-38"], "include": "fedora-iot-base.json" } From 91c9bdb99f5e6fcadaebdf82323d8d98dd02e910 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 27 Aug 2022 09:32:57 +0100 Subject: [PATCH 098/163] Set tmp-is-dir = True Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 18eec22..eaedd75 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -6,6 +6,8 @@ "selinux": true, + "tmp-is-dir": true, + "recommends": false, "documentation": false, From 91e80aecf0971f20b83496e3b77d78543eaf4079 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 10 Feb 2023 10:52:28 -0500 Subject: [PATCH 099/163] IoT: Update rawhide for F-39 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-37.repo => fedora-39.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-37.repo => fedora-39.repo (61%) diff --git a/config.ini b/config.ini index cc2f879..7032043 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f38 +release = f39 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-37.repo b/fedora-39.repo similarity index 61% rename from fedora-37.repo rename to fedora-39.repo index ae158a8..739626d 100644 --- a/fedora-37.repo +++ b/fedora-39.repo @@ -1,12 +1,12 @@ -[fedora-38] -name=Fedora 38 - $basearch +[fedora-39] +name=Fedora 39 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/38/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-38&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/39/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-39&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-38-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-39-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index eaedd75..cbb4c49 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -12,8 +12,8 @@ "documentation": false, - "automatic_version_prefix": "38", - "mutate-os-release": "38", + "automatic_version_prefix": "39", + "mutate-os-release": "39", "initramfs-args": ["--no-hostonly", "--add", "ignition watchdog"], diff --git a/fedora-iot.json b/fedora-iot.json index 31c9ec4..7e8c051 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-38"], + "repos": ["fedora-39"], "include": "fedora-iot-base.json" } From f0727787bc11e267dde0f3f1e59701f78ce54af1 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 24 Mar 2023 13:47:40 -0400 Subject: [PATCH 100/163] Add workaround for anaconda unified-core issue. Signed-off-by: Paul Whalen --- treecompose-post.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/treecompose-post.sh b/treecompose-post.sh index 8cf8e61..08dd6ca 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -15,3 +15,8 @@ for x in /usr/sbin/glibc_post_upgrade.*; do ln -srf /usr/bin/true ${x} fi done + +# Remove loader directory causing issues in Anaconda in unified core mode +# Will be obsolete once we start using bootupd +# See - https://pagure.io/workstation-ostree-config/pull-request/344 +rm -rf /usr/lib/ostree-boot/loader From a3b9689aea3de54de4d1710f8e5ec6e7976c381a Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 20 Apr 2023 14:51:16 +0100 Subject: [PATCH 101/163] Add split out wifi firmwares explicitly Signed-off-by: Peter Robinson --- fedora-iot-base.json | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index cbb4c49..257c049 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -114,6 +114,7 @@ "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "efibootmgr", "fwupd-efi", "fwupd-plugin-uefi-capsule-data", "iwl7260-firmware", "iwlax2xx-firmware"], + "atheros-firmware", "brcmfmac-firmware", "realtek-firmware"], "packages-aarch64": ["grub2-efi-aa64", "shim-aa64", "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer"], From 7fb6ff3c3202d85269271eebdcf1cda67a7b4019 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 21 Apr 2023 14:05:50 -0400 Subject: [PATCH 102/163] Fix json formatting Signed-off-by: Paul Whalen --- fedora-iot-base.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 257c049..ead5d2f 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -113,8 +113,8 @@ "parsec", "dbus-parsec", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "efibootmgr", "fwupd-efi", "fwupd-plugin-uefi-capsule-data", - "iwl7260-firmware", "iwlax2xx-firmware"], - "atheros-firmware", "brcmfmac-firmware", "realtek-firmware"], + "iwl7260-firmware", "iwlax2xx-firmware", "atheros-firmware", + "brcmfmac-firmware", "realtek-firmware"], "packages-aarch64": ["grub2-efi-aa64", "shim-aa64", "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer"], From 2c3ce9490458469e60076e0c59ad83044c8d7af4 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 6 Jul 2023 11:11:56 +0100 Subject: [PATCH 103/163] firmware: Updates for changes in iwlwifi packaging The Intel WiFi firmware was consolidated/adjusted to better align with the kernel drivers. Signed-off-by: Peter Robinson --- fedora-iot-base.json | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index ead5d2f..59495b7 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -75,7 +75,6 @@ "packages": ["fedora-release-iot", "glibc", "glibc-minimal-langpack", "nss-altfiles", "sssd-client", "libsss_sudo", "shadow-utils", - "kernel", "linux-firmware", "dracut-config-generic", "dracut-network", "rpm-ostree", "rpm", "polkit", "lvm2", "cryptsetup", "pinentry", @@ -113,16 +112,14 @@ "parsec", "dbus-parsec", "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", "efibootmgr", "fwupd-efi", "fwupd-plugin-uefi-capsule-data", - "iwl7260-firmware", "iwlax2xx-firmware", "atheros-firmware", - "brcmfmac-firmware", "realtek-firmware"], + "kernel", "linux-firmware", + "iwlwifi-mvm-firmware", "iwlwifi-dvm-firmware", + "atheros-firmware", "brcmfmac-firmware", "realtek-firmware"], "packages-aarch64": ["grub2-efi-aa64", "shim-aa64", "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer"], - "packages-x86_64": ["grub2-efi-x64", "shim-x64", "microcode_ctl", - "iwl1000-firmware", "iwl100-firmware", "iwl105-firmware", "iwl135-firmware", - "iwl2000-firmware", "iwl2030-firmware", "iwl3160-firmware", "iwl5000-firmware", - "iwl5150-firmware", "iwl6000-firmware", "iwl6050-firmware"], + "packages-x86_64": ["grub2-efi-x64", "shim-x64", "microcode_ctl"], "default_target": "multi-user.target", From 2af239a9795f4b5c43005ad93fbe5e2f6b7e4d2f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 8 Jul 2023 13:37:54 +0100 Subject: [PATCH 104/163] aarch64: add optee_client package The optee_client TEE supplicant client and library enable interaction with the OP-TEE trusted execution environment which runs in the Arm TrustZone. The client is useful for certain devices. Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 59495b7..d8d0e8d 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -117,7 +117,8 @@ "atheros-firmware", "brcmfmac-firmware", "realtek-firmware"], "packages-aarch64": ["grub2-efi-aa64", "shim-aa64", - "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer"], + "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer", + "optee_client"], "packages-x86_64": ["grub2-efi-x64", "shim-x64", "microcode_ctl"], From 513aced27d634ecf2fcd7b2e1a3faa0c86577345 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 10 Jul 2023 20:26:26 -0400 Subject: [PATCH 105/163] Move boot-location to modules Signed-off-by: Paul Whalen --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index d8d0e8d..56411d0 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -17,7 +17,7 @@ "initramfs-args": ["--no-hostonly", "--add", "ignition watchdog"], - "boot_location": "new", + "boot_location": "modules", "install-langs-comment": "Keep this in sync with treecompose-post.sh", "install-langs": [ From d9d9360619bc818f776cd4128a2faf64c14e699f Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 26 Jul 2023 14:47:56 +0100 Subject: [PATCH 106/163] IoT: Update the package set and sort alphanetically Some minor updates to the package set, we add the FDO client and drop bluez/libgpiod, if they're needed it's easy to layer them, and then we sort it all alphabetically. Signed-off-by: Peter Robinson --- fedora-iot-base.json | 169 ++++++++++++++++++++++++++++++------------- 1 file changed, 118 insertions(+), 51 deletions(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 56411d0..35c7bd1 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -73,60 +73,127 @@ "check-groups": { "type": "file", "filename": "group" }, "packages": ["fedora-release-iot", - "glibc", "glibc-minimal-langpack", "nss-altfiles", - "sssd-client", "libsss_sudo", "shadow-utils", - "dracut-config-generic", "dracut-network", - "rpm-ostree", "rpm", "polkit", "lvm2", - "cryptsetup", "pinentry", - "keyutils", "cracklib-dicts", - "e2fsprogs", "dosfstools", - "gnupg2", "authselect", - "basesystem", "python3", "bash", - "xz", "gzip", - "coreutils", "which", "curl", "attr", - "firewalld", "iptables", - "NetworkManager", "NetworkManager-wifi", "NetworkManager-wwan", - "wpa_supplicant", "wireless-regdb", "iwd", "tpm2-pkcs11", - "dnsmasq", "traceroute", - "hostname", "iproute", "iputils", - "openssh-clients", "openssh-server", "passwd", - "policycoreutils", "procps-ng", "rootfiles", - "selinux-policy-targeted", "setup", "shadow-utils", - "sudo", "util-linux", "vim-minimal", - "systemd", "systemd-resolved", - "less", "tar", - "fwupd", "fwupd-plugin-modem-manager", - "greenboot", "greenboot-default-health-checks", - "ignition", "zezere-ignition", - "zram-generator", "zram-generator-defaults", - "ima-evm-utils", "openssl", - "bash-completion", - "tmux", "screen", - "policycoreutils-python-utils", - "setools-console", "usbguard", - "chrony", - "bluez", "bluez-libs", "bluez-mesh", - "kernel-tools", "libgpiod-utils", - "podman", "podman-plugins", "container-selinux", "skopeo", "criu", - "containernetworking-plugins", "slirp4netns", "netavark", "aardvark-dns", - "parsec", "dbus-parsec", - "clevis", "clevis-dracut", "clevis-luks", "clevis-pin-tpm2", - "efibootmgr", "fwupd-efi", "fwupd-plugin-uefi-capsule-data", - "kernel", "linux-firmware", - "iwlwifi-mvm-firmware", "iwlwifi-dvm-firmware", - "atheros-firmware", "brcmfmac-firmware", "realtek-firmware"], + "aardvark-dns", + "atheros-firmware", + "attr", + "authselect", + "basesystem", + "bash", + "bash-completion", + "brcmfmac-firmware", + "chrony", + "clevis", + "clevis-dracut", + "clevis-luks", + "clevis-pin-tpm2", + "container-selinux", + "containernetworking-plugins", + "coreutils", + "cracklib-dicts", + "criu", + "cryptsetup", + "curl", + "dbus-parsec", + "dnsmasq", + "dosfstools", + "dracut-config-generic", + "dracut-network", + "e2fsprogs", + "efibootmgr", + "fdo-client", + "firewalld", + "fwupd", + "fwupd-efi", + "fwupd-plugin-modem-manager", + "fwupd-plugin-uefi-capsule-data", + "glibc", + "glibc-minimal-langpack", + "gnupg2", + "greenboot", + "greenboot-default-health-checks", + "gzip", + "hostname", + "ignition", + "ima-evm-utils", + "iproute", + "iputils", + "iwd", + "iwlwifi-mvm-firmware", + "kernel-tools", + "keyutils", + "less", + "libsss_sudo", + "linux-firmware", + "lvm2", + "netavark", + "NetworkManager", + "NetworkManager-wifi", + "NetworkManager-wwan", + "nss-altfiles", + "openssl", + "openssh-clients", + "openssh-server", + "parsec", + "passwd", + "pinentry", + "podman", + "podman-plugins", + "policycoreutils", + "policycoreutils-python-utils", + "polkit", + "procps-ng", + "realtek-firmware", + "rootfiles", + "rpm", + "screen", + "selinux-policy-targeted", + "setools-console", + "setup", + "shadow-utils", + "skopeo", + "slirp4netns", + "sssd-client", + "sudo", + "systemd", + "systemd-resolved", + "tar", + "tmux", + "tpm2-pkcs11", + "traceroute", + "usbguard", + "util-linux", + "vim-minimal", + "wpa_supplicant", + "wireless-regdb", + "xfsprogs", + "xz", + "zezere-ignition", + "zram-generator"], - "packages-aarch64": ["grub2-efi-aa64", "shim-aa64", - "uboot-images-armv8", "bcm283x-firmware", "arm-image-installer", - "optee_client"], + "packages-aarch64": ["arm-image-installer", + "bcm283x-firmware", + "grub2-efi-aa64", + "optee_client", + "shim-aa64", + "uboot-images-armv8"], - "packages-x86_64": ["grub2-efi-x64", "shim-x64", "microcode_ctl"], + "packages-x86_64": ["grub2-efi-x64", + "microcode_ctl", + "shim-x64"], "default_target": "multi-user.target", - "units": ["NetworkManager.service", "firewalld.service", "sshd.service", - "zezere_ignition.timer", "zezere_ignition_banner.service", - "greenboot-grub2-set-counter.service", "greenboot-grub2-set-success.service", "greenboot-healthcheck.service", - "greenboot-rpm-ostree-grub2-check-fallback.service", "greenboot-status.service", "greenboot-task-runner.service", - "parsec.service", "dbus-parsec.service"] + "units": ["NetworkManager.service", + "firewalld.service", + "sshd.service", + "greenboot-grub2-set-counter.service", + "greenboot-grub2-set-success.service", + "greenboot-healthcheck.service", + "greenboot-rpm-ostree-grub2-check-fallback.service", + "greenboot-status.service", + "greenboot-task-runner.service", + "parsec.service", + "dbus-parsec.service", + "zezere_ignition.timer", + "zezere_ignition_banner.service",] } From b994f0b5a4d87dacf4a6a7133d607049e6bea8f4 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 26 Jul 2023 11:29:44 -0400 Subject: [PATCH 107/163] Remove trailing comma in fedora-iot-base.json Signed-off-by: Paul Whalen --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 35c7bd1..9ad4979 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -195,5 +195,5 @@ "parsec.service", "dbus-parsec.service", "zezere_ignition.timer", - "zezere_ignition_banner.service",] + "zezere_ignition_banner.service"] } From 1d9600d8e3c4887fbc6c216c5829c4dcd935a1e6 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 26 Jul 2023 17:28:10 +0100 Subject: [PATCH 108/163] Add kernel back, remove trailing space Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 9ad4979..0e26d24 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -119,6 +119,7 @@ "iputils", "iwd", "iwlwifi-mvm-firmware", + "kernel", "kernel-tools", "keyutils", "less", @@ -188,7 +189,7 @@ "sshd.service", "greenboot-grub2-set-counter.service", "greenboot-grub2-set-success.service", - "greenboot-healthcheck.service", + "greenboot-healthcheck.service", "greenboot-rpm-ostree-grub2-check-fallback.service", "greenboot-status.service", "greenboot-task-runner.service", From 1349eef26a1b67d78e8d204b7b57ee0a42846226 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 26 Jul 2023 20:27:35 +0100 Subject: [PATCH 109/163] Add a missing dep from copy/paste Signed-off-by: Peter Robinson --- fedora-iot-base.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 0e26d24..2b670e1 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -169,7 +169,8 @@ "xfsprogs", "xz", "zezere-ignition", - "zram-generator"], + "zram-generator", + "zram-generator-defaults"], "packages-aarch64": ["arm-image-installer", "bcm283x-firmware", From d6a3afca84eb0de56a62f3949aac8e4f283529e3 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 14 Aug 2023 13:50:42 -0400 Subject: [PATCH 110/163] IoT: Update rawhide for F-40 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-39.repo => fedora-40.repo | 10 +++++----- fedora-iot-base.json | 4 ++-- fedora-iot.json | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-39.repo => fedora-40.repo (61%) diff --git a/config.ini b/config.ini index 7032043..fedaedd 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f39 +release = f40 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-39.repo b/fedora-40.repo similarity index 61% rename from fedora-39.repo rename to fedora-40.repo index 739626d..7a3c762 100644 --- a/fedora-39.repo +++ b/fedora-40.repo @@ -1,12 +1,12 @@ -[fedora-39] -name=Fedora 39 - $basearch +[fedora-40] +name=Fedora 40 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/39/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-39&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/40/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-40&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-39-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-40-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 2b670e1..f6a05cf 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -12,8 +12,8 @@ "documentation": false, - "automatic_version_prefix": "39", - "mutate-os-release": "39", + "automatic_version_prefix": "40", + "mutate-os-release": "40", "initramfs-args": ["--no-hostonly", "--add", "ignition watchdog"], diff --git a/fedora-iot.json b/fedora-iot.json index 7e8c051..19a0373 100644 --- a/fedora-iot.json +++ b/fedora-iot.json @@ -1,6 +1,6 @@ { "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-39"], + "repos": ["fedora-40"], "include": "fedora-iot-base.json" } From f1fdb7a4d9a037e1a0a6db59b0fc3116ee227907 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 25 Oct 2023 16:38:48 +0100 Subject: [PATCH 111/163] Add criu-libs as criu doesn't pull it in Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index f6a05cf..432222b 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -90,7 +90,7 @@ "containernetworking-plugins", "coreutils", "cracklib-dicts", - "criu", + "criu", "criu-libs", "cryptsetup", "curl", "dbus-parsec", From efc8d5c336db0573eddc308d7d1dde5bfd18eec8 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 8 Nov 2023 13:13:27 +0000 Subject: [PATCH 112/163] Enable IMA signatures Signed-off-by: Peter Robinson --- fedora-iot-base.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 432222b..7140481 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -6,6 +6,8 @@ "selinux": true, + "ima": true, + "tmp-is-dir": true, "recommends": false, From d085d6d8192d65ee7033d31d90405ebc8a31e40a Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 27 Nov 2023 15:30:29 -0500 Subject: [PATCH 113/163] Undo rpm scripts enabling units, use only systemd presets Signed-off-by: Paul Whalen --- treecompose-post.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/treecompose-post.sh b/treecompose-post.sh index 08dd6ca..a47d8cf 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -20,3 +20,10 @@ done # Will be obsolete once we start using bootupd # See - https://pagure.io/workstation-ostree-config/pull-request/344 rm -rf /usr/lib/ostree-boot/loader + +# Undo RPM scripts enabling units; we want the presets to be canonical +# https://github.com/projectatomic/rpm-ostree/issues/1803 +rm -rf /etc/systemd/system/* +systemctl preset-all +rm -rf /etc/systemd/user/* +systemctl --user --global preset-all From 6b0bb8dcf66d064caec7bb0adea0b8bb6deca267 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 5 Dec 2023 16:25:59 -0500 Subject: [PATCH 114/163] Add min-free-space-percent to fix compose failure Signed-off-by: Paul Whalen --- fedora-iot-base.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fedora-iot-base.json b/fedora-iot-base.json index 7140481..481bb90 100644 --- a/fedora-iot-base.json +++ b/fedora-iot-base.json @@ -2,6 +2,8 @@ "ref": "fedora/rawhide/${basearch}/iot", "ex-jigdo-spec": "fedora-iot.spec", + "min-free-space-percent": "1", + "repos": [], "selinux": true, From eef364fa517b23af89fcb60c850bdab9f6cd5686 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 26 Jan 2024 20:16:47 -0500 Subject: [PATCH 115/163] Convert json to yaml Signed-off-by: Paul Whalen --- fedora-iot-base.json | 205 -------------------------------- fedora-iot-base.yaml | 202 +++++++++++++++++++++++++++++++ fedora-iot-updates-stable.json | 5 - fedora-iot-updates-stable.yaml | 2 + fedora-iot-updates-testing.json | 5 - fedora-iot-updates-testing.yaml | 2 + fedora-iot.json | 6 - fedora-iot.yaml | 8 ++ 8 files changed, 214 insertions(+), 221 deletions(-) delete mode 100644 fedora-iot-base.json create mode 100644 fedora-iot-base.yaml delete mode 100644 fedora-iot-updates-stable.json create mode 100644 fedora-iot-updates-stable.yaml delete mode 100644 fedora-iot-updates-testing.json create mode 100644 fedora-iot-updates-testing.yaml delete mode 100644 fedora-iot.json create mode 100644 fedora-iot.yaml diff --git a/fedora-iot-base.json b/fedora-iot-base.json deleted file mode 100644 index 481bb90..0000000 --- a/fedora-iot-base.json +++ /dev/null @@ -1,205 +0,0 @@ -{ - "ref": "fedora/rawhide/${basearch}/iot", - "ex-jigdo-spec": "fedora-iot.spec", - - "min-free-space-percent": "1", - - "repos": [], - - "selinux": true, - - "ima": true, - - "tmp-is-dir": true, - - "recommends": false, - - "documentation": false, - - "automatic_version_prefix": "40", - "mutate-os-release": "40", - - "initramfs-args": ["--no-hostonly", - "--add", "ignition watchdog"], - "boot_location": "modules", - - "install-langs-comment": "Keep this in sync with treecompose-post.sh", - "install-langs": [ - "pt_BR", - "fr", - "fr_FR", - "de", - "de_DE", - "it", - "it_IT", - "ru", - "ru_RU", - "es", - "es_ES", - "en_US", - "zh_CN", - "ja", - "ja_JP", - "ko", - "ko_KR", - "zh_TW", - "as", - "as_IN", - "bn", - "bn_IN", - "gu", - "gu_IN", - "hi", - "hi_IN", - "kn", - "kn_IN", - "ml", - "ml_IN", - "mr", - "mr_IN", - "or", - "or_IN", - "pa", - "pa_IN", - "ta", - "ta_IN", - "te", - "te_IN" - ], - - "postprocess-script": "treecompose-post.sh", - - "etc-group-members": ["wheel", "docker"], - - "ignore-removed-users": ["root"], - "ignore-removed-groups": ["root"], - "check-passwd": { "type": "file", "filename": "passwd" }, - "check-groups": { "type": "file", "filename": "group" }, - - "packages": ["fedora-release-iot", - "aardvark-dns", - "atheros-firmware", - "attr", - "authselect", - "basesystem", - "bash", - "bash-completion", - "brcmfmac-firmware", - "chrony", - "clevis", - "clevis-dracut", - "clevis-luks", - "clevis-pin-tpm2", - "container-selinux", - "containernetworking-plugins", - "coreutils", - "cracklib-dicts", - "criu", "criu-libs", - "cryptsetup", - "curl", - "dbus-parsec", - "dnsmasq", - "dosfstools", - "dracut-config-generic", - "dracut-network", - "e2fsprogs", - "efibootmgr", - "fdo-client", - "firewalld", - "fwupd", - "fwupd-efi", - "fwupd-plugin-modem-manager", - "fwupd-plugin-uefi-capsule-data", - "glibc", - "glibc-minimal-langpack", - "gnupg2", - "greenboot", - "greenboot-default-health-checks", - "gzip", - "hostname", - "ignition", - "ima-evm-utils", - "iproute", - "iputils", - "iwd", - "iwlwifi-mvm-firmware", - "kernel", - "kernel-tools", - "keyutils", - "less", - "libsss_sudo", - "linux-firmware", - "lvm2", - "netavark", - "NetworkManager", - "NetworkManager-wifi", - "NetworkManager-wwan", - "nss-altfiles", - "openssl", - "openssh-clients", - "openssh-server", - "parsec", - "passwd", - "pinentry", - "podman", - "podman-plugins", - "policycoreutils", - "policycoreutils-python-utils", - "polkit", - "procps-ng", - "realtek-firmware", - "rootfiles", - "rpm", - "screen", - "selinux-policy-targeted", - "setools-console", - "setup", - "shadow-utils", - "skopeo", - "slirp4netns", - "sssd-client", - "sudo", - "systemd", - "systemd-resolved", - "tar", - "tmux", - "tpm2-pkcs11", - "traceroute", - "usbguard", - "util-linux", - "vim-minimal", - "wpa_supplicant", - "wireless-regdb", - "xfsprogs", - "xz", - "zezere-ignition", - "zram-generator", - "zram-generator-defaults"], - - "packages-aarch64": ["arm-image-installer", - "bcm283x-firmware", - "grub2-efi-aa64", - "optee_client", - "shim-aa64", - "uboot-images-armv8"], - - "packages-x86_64": ["grub2-efi-x64", - "microcode_ctl", - "shim-x64"], - - "default_target": "multi-user.target", - - "units": ["NetworkManager.service", - "firewalld.service", - "sshd.service", - "greenboot-grub2-set-counter.service", - "greenboot-grub2-set-success.service", - "greenboot-healthcheck.service", - "greenboot-rpm-ostree-grub2-check-fallback.service", - "greenboot-status.service", - "greenboot-task-runner.service", - "parsec.service", - "dbus-parsec.service", - "zezere_ignition.timer", - "zezere_ignition_banner.service"] -} diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml new file mode 100644 index 0000000..8e9ab6d --- /dev/null +++ b/fedora-iot-base.yaml @@ -0,0 +1,202 @@ +--- +ref: fedora/rawhide/${basearch}/iot +rojig: + name: fedora-iot + summary: "Fedora IoT image" + license: MIT +repos: [] +selinux: true +ima: true +tmp-is-dir: true +recommends: false +documentation: false +automatic_version_prefix: '40' +mutate-os-release: '40' +initramfs-args: +- "--no-hostonly" +- "--add" +- ignition watchdog +boot_location: modules + # Keep this in sync with treecompose-post.sh +install-langs: +- pt_BR +- fr +- fr_FR +- de +- de_DE +- it +- it_IT +- ru +- ru_RU +- es +- es_ES +- en_US +- zh_CN +- ja +- ja_JP +- ko +- ko_KR +- zh_TW +- as +- as_IN +- bn +- bn_IN +- gu +- gu_IN +- hi +- hi_IN +- kn +- kn_IN +- ml +- ml_IN +- mr +- mr_IN +- or +- or_IN +- pa +- pa_IN +- ta +- ta_IN +- te +- te_IN +postprocess-script: treecompose-post.sh +etc-group-members: +- wheel +- docker +ignore-removed-users: +- root +ignore-removed-groups: +- root +check-passwd: + type: file + filename: passwd +check-groups: + type: file + filename: group +packages: +- fedora-release-iot +- aardvark-dns +- atheros-firmware +- attr +- authselect +- basesystem +- bash +- bash-completion +- brcmfmac-firmware +- chrony +- clevis +- clevis-dracut +- clevis-luks +- clevis-pin-tpm2 +- container-selinux +- containernetworking-plugins +- coreutils +- cracklib-dicts +- criu +- criu-libs +- cryptsetup +- curl +- dbus-parsec +- dnsmasq +- dosfstools +- dracut-config-generic +- dracut-network +- e2fsprogs +- efibootmgr +- fdo-client +- firewalld +- fwupd +- fwupd-efi +- fwupd-plugin-modem-manager +- fwupd-plugin-uefi-capsule-data +- glibc +- glibc-minimal-langpack +- gnupg2 +- greenboot +- greenboot-default-health-checks +- gzip +- hostname +- ignition +- ima-evm-utils +- iproute +- iputils +- iwd +- iwlwifi-mvm-firmware +- kernel +- kernel-tools +- keyutils +- less +- libsss_sudo +- linux-firmware +- lvm2 +- netavark +- NetworkManager +- NetworkManager-wifi +- NetworkManager-wwan +- nss-altfiles +- openssl +- openssh-clients +- openssh-server +- parsec +- passwd +- pinentry +- podman +- podman-plugins +- policycoreutils +- policycoreutils-python-utils +- polkit +- procps-ng +- realtek-firmware +- rootfiles +- rpm +- screen +- selinux-policy-targeted +- setools-console +- setup +- shadow-utils +- skopeo +- slirp4netns +- sssd-client +- sudo +- systemd +- systemd-resolved +- tar +- tmux +- tpm2-pkcs11 +- traceroute +- usbguard +- util-linux +- vim-minimal +- wpa_supplicant +- wireless-regdb +- xfsprogs +- xz +- zezere-ignition +- zram-generator +- zram-generator-defaults +packages-aarch64: +- arm-image-installer +- bcm283x-firmware +- grub2-efi-aa64 +- optee_client +- shim-aa64 +- uboot-images-armv8 +packages-x86_64: +- grub2-efi-x64 +- microcode_ctl +- shim-x64 +default_target: multi-user.target +units: +- NetworkManager.service +- firewalld.service +- sshd.service +- greenboot-grub2-set-counter.service +- greenboot-grub2-set-success.service +- greenboot-healthcheck.service +- greenboot-rpm-ostree-grub2-check-fallback.service +- greenboot-status.service +- greenboot-task-runner.service +- parsec.service +- dbus-parsec.service +- zezere_ignition.timer +- zezere_ignition_banner.service diff --git a/fedora-iot-updates-stable.json b/fedora-iot-updates-stable.json deleted file mode 100644 index a3fb5ed..0000000 --- a/fedora-iot-updates-stable.json +++ /dev/null @@ -1,5 +0,0 @@ - - "ref": "fedora/rawhide/${basearch}/updates/iot", - "ex-jigdo-spec": "fedora-iot.spec", - "include": "fedora-iot-base.json" -} diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml new file mode 100644 index 0000000..263bd4b --- /dev/null +++ b/fedora-iot-updates-stable.yaml @@ -0,0 +1,2 @@ +include: fedora-iot-base.yaml +ref: fedora/rawhide/${basearch}/updates/iot diff --git a/fedora-iot-updates-testing.json b/fedora-iot-updates-testing.json deleted file mode 100644 index 96b50ac..0000000 --- a/fedora-iot-updates-testing.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "ref": "fedora/rawhide/${basearch}/testing/iot", - "ex-jigdo-spec": "fedora-iot.spec", - "include": "fedora-iot-base.json" -} diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml new file mode 100644 index 0000000..c6eb5a5 --- /dev/null +++ b/fedora-iot-updates-testing.yaml @@ -0,0 +1,2 @@ +include: fedora-iot-base.yaml +ref: fedora/rawhide/${basearch}/testing/iot diff --git a/fedora-iot.json b/fedora-iot.json deleted file mode 100644 index 19a0373..0000000 --- a/fedora-iot.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "ref": "fedora/rawhide/${basearch}/iot", - "ex-jigdo-spec": "fedora-iot.spec", - "repos": ["fedora-40"], - "include": "fedora-iot-base.json" -} diff --git a/fedora-iot.yaml b/fedora-iot.yaml new file mode 100644 index 0000000..f174396 --- /dev/null +++ b/fedora-iot.yaml @@ -0,0 +1,8 @@ +include: fedora-iot-base.yaml +ref: fedora/rawhide/${basearch}/iot +rojig: + name: fedora-iot-base + summary: "Fedora base image for IoT" + license: MIT +repos: +- fedora-40 From 6cb006c96fa31812bdc25ce36132985578f651c2 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 30 Jan 2024 15:19:39 -0500 Subject: [PATCH 116/163] Add bootupd, minor clean up Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 6 +----- fedora-iot.yaml | 4 ---- 2 files changed, 1 insertion(+), 9 deletions(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 8e9ab6d..3151c9a 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,9 +1,4 @@ ---- ref: fedora/rawhide/${basearch}/iot -rojig: - name: fedora-iot - summary: "Fedora IoT image" - license: MIT repos: [] selinux: true ima: true @@ -82,6 +77,7 @@ packages: - basesystem - bash - bash-completion +- bootupd - brcmfmac-firmware - chrony - clevis diff --git a/fedora-iot.yaml b/fedora-iot.yaml index f174396..b83ea21 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,8 +1,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot -rojig: - name: fedora-iot-base - summary: "Fedora base image for IoT" - license: MIT repos: - fedora-40 From 0fdf7b34245fca5d6db5571e98fca21f241f2590 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 1 Feb 2024 10:06:05 -0500 Subject: [PATCH 117/163] Revert adding bootupd for now. Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 3151c9a..33ddd60 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -77,7 +77,6 @@ packages: - basesystem - bash - bash-completion -- bootupd - brcmfmac-firmware - chrony - clevis From ff8dab07b1c51a6aaf153aaa67e0a069d859ddfc Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 8 Feb 2024 09:56:34 -0500 Subject: [PATCH 118/163] Drop passwd, now provided by shadow-utils Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 33ddd60..1c115ec 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -133,7 +133,6 @@ packages: - openssh-clients - openssh-server - parsec -- passwd - pinentry - podman - podman-plugins From 20661a3bb14e6f5ab7422992853435f72bb694df Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 8 Feb 2024 07:33:03 -0500 Subject: [PATCH 119/163] Add fedora-iot-config service to presets Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 1c115ec..2c98c56 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -182,6 +182,7 @@ packages-x86_64: default_target: multi-user.target units: - NetworkManager.service +- fedora-iot-config-remote-fix.service - firewalld.service - sshd.service - greenboot-grub2-set-counter.service From efa477093872dd33aa4948cf6e212c4595e46fd9 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 13 Feb 2024 13:06:27 -0500 Subject: [PATCH 120/163] IoT: Update rawhide for F-41 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-40.repo => fedora-41.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-40.repo => fedora-41.repo (61%) diff --git a/config.ini b/config.ini index fedaedd..0b65ffb 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f40 +release = f41 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-40.repo b/fedora-41.repo similarity index 61% rename from fedora-40.repo rename to fedora-41.repo index 7a3c762..1412aca 100644 --- a/fedora-40.repo +++ b/fedora-41.repo @@ -1,12 +1,12 @@ -[fedora-40] -name=Fedora 40 - $basearch +[fedora-41] +name=Fedora 41 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/40/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-40&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/41/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-41&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-40-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-41-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 2c98c56..a154890 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -5,8 +5,8 @@ ima: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '40' -mutate-os-release: '40' +automatic_version_prefix: '41' +mutate-os-release: '41' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index b83ea21..51c17ad 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-40 +- fedora-41 From ede36f3a2c68f9d8fe24c768fd5343b57e0697cd Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 14 Feb 2024 16:53:30 -0500 Subject: [PATCH 121/163] Drop podman-plugins package Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index a154890..54ecf6c 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -135,7 +135,6 @@ packages: - parsec - pinentry - podman -- podman-plugins - policycoreutils - policycoreutils-python-utils - polkit From 4ef41ffa05c6973590756ea4307d8899904e46b9 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 21 Feb 2024 15:46:40 -0500 Subject: [PATCH 122/163] f41: enable bootupd Signed-off-by: Paul Whalen --- bootupd.yaml | 9 +++++++++ fedora-iot-base.yaml | 1 + 2 files changed, 10 insertions(+) create mode 100644 bootupd.yaml diff --git a/bootupd.yaml b/bootupd.yaml new file mode 100644 index 0000000..949f504 --- /dev/null +++ b/bootupd.yaml @@ -0,0 +1,9 @@ +packages: + - bootupd + +postprocess: + - | + #!/bin/bash + set -xeuo pipefail + # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload + /usr/bin/bootupctl backend generate-update-metadata diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 54ecf6c..3da21d4 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,3 +1,4 @@ +include: bootupd.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true From b908de5dc79ffa83b0e5f38384d2fa4e6818959e Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 19 Mar 2024 14:13:26 +0000 Subject: [PATCH 123/163] add passt userspace network for podmn5 requirements It seems podman5 has changed the rootless container network stack to passt so add this into our compose alongside the exisitng slirp4netns while we find out how the migration works so we can document it. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 3da21d4..6f429f6 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -133,6 +133,8 @@ packages: - openssl - openssh-clients - openssh-server +- passt +- passt-selinux - parsec - pinentry - podman From 187a596a33f43dce9f259b77a92e82ad77ca5ec3 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 12 Apr 2024 08:48:50 -0400 Subject: [PATCH 124/163] F41: enable fdo-client-linuxapp.service Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 6f429f6..1604965 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -184,6 +184,7 @@ packages-x86_64: default_target: multi-user.target units: - NetworkManager.service +- fdo-client-linuxapp.service - fedora-iot-config-remote-fix.service - firewalld.service - sshd.service From 8329945ded68e83941eb2ade0ca309f2d2965e3a Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 15 Apr 2024 11:47:11 -0400 Subject: [PATCH 125/163] F41: Add base bootc container Signed-off-by: Paul Whalen --- fedora-bootc-base/autoupdates.yaml | 9 ++++ fedora-bootc-base/basic-fixes.yaml | 29 +++++++++++ fedora-bootc-base/bootc-config.yaml | 10 ++++ fedora-bootc-base/bootc.yaml | 12 +++++ fedora-bootc-base/bootupd.yaml | 31 ++++++++++++ fedora-bootc-base/group | 46 +++++++++++++++++ fedora-bootc-base/grub2-removals.yaml | 8 +++ fedora-bootc-base/initramfs.yaml | 18 +++++++ fedora-bootc-base/kernel.yaml | 6 +++ fedora-bootc-base/manifest.yaml | 71 +++++++++++++++++++++++++++ fedora-bootc-base/ostree.yaml | 17 +++++++ fedora-bootc-base/passwd | 32 ++++++++++++ fedora-bootc.yaml | 15 ++++++ fedora.repo | 65 ++++++++++++++++++++++++ 14 files changed, 369 insertions(+) create mode 100644 fedora-bootc-base/autoupdates.yaml create mode 100644 fedora-bootc-base/basic-fixes.yaml create mode 100644 fedora-bootc-base/bootc-config.yaml create mode 100644 fedora-bootc-base/bootc.yaml create mode 100644 fedora-bootc-base/bootupd.yaml create mode 100644 fedora-bootc-base/group create mode 100644 fedora-bootc-base/grub2-removals.yaml create mode 100644 fedora-bootc-base/initramfs.yaml create mode 100644 fedora-bootc-base/kernel.yaml create mode 100644 fedora-bootc-base/manifest.yaml create mode 100644 fedora-bootc-base/ostree.yaml create mode 100644 fedora-bootc-base/passwd create mode 100644 fedora-bootc.yaml create mode 100644 fedora.repo diff --git a/fedora-bootc-base/autoupdates.yaml b/fedora-bootc-base/autoupdates.yaml new file mode 100644 index 0000000..a416699 --- /dev/null +++ b/fedora-bootc-base/autoupdates.yaml @@ -0,0 +1,9 @@ +# Enable automatic updates by default +postprocess: + - | + #!/usr/bin/env bash + set -euo pipefail + target=/usr/lib/systemd/system/default.target.wants + mkdir -p $target + set -x + ln -s ../bootc-fetch-apply-updates.timer $target diff --git a/fedora-bootc-base/basic-fixes.yaml b/fedora-bootc-base/basic-fixes.yaml new file mode 100644 index 0000000..d9fe059 --- /dev/null +++ b/fedora-bootc-base/basic-fixes.yaml @@ -0,0 +1,29 @@ +# Fix general bugs + +postprocess: + # See also https://github.com/openshift/os/blob/f6cde963ee140c02364674db378b2bc4ac42675b/common.yaml#L156 + # This one is undoes the effect of + # # RHEL-only: Disable /tmp on tmpfs. + #Wants=tmp.mount + # in /usr/lib/systemd/system/basic.target + # We absolutely must have tmpfs-on-tmp for multiple reasons, + # but the biggest is that when we have composefs for / it's read-only, + # and for units with ProtectSystem=full systemd clones / but needs + # a writable place. + - | + #!/usr/bin/env bash + set -xeuo pipefail + mkdir -p /usr/lib/systemd/system/local-fs.target.wants + if test '!' -f /usr/lib/systemd/system/local-fs.target.wants/tmp.mount; then + ln -sf ../tmp.mount /usr/lib/systemd/system/local-fs.target.wants + fi + + # See https://github.com/containers/bootc/issues/358 + # basically systemd-tmpfiles doesn't follow symlinks; ordinarily our + # tmpfiles.d unit for `/var/roothome` is fine, but this actually doesn't + # work if we want to use tmpfiles.d to write to `/root/.ssh` because + # tmpfiles gives up on that before getting to `/var/roothome`. + sed -ie 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf + # Because /var/roothome is also defined in rpm-ostree-0-integration.conf + # we need to delete /var/roothome + sed -ie '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml new file mode 100644 index 0000000..4d4b24e --- /dev/null +++ b/fedora-bootc-base/bootc-config.yaml @@ -0,0 +1,10 @@ +# Configuration for bootc +postprocess: + # ext4 is our default filesystem in iot + - | + #!/usr/bin/env bash + mkdir -p /usr/lib/bootc/install/ + cat > /usr/lib/bootc/install/20-default-root.toml << EOF + [install] + root-fs-type = "ext4" + EOF diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml new file mode 100644 index 0000000..a862e6c --- /dev/null +++ b/fedora-bootc-base/bootc.yaml @@ -0,0 +1,12 @@ +# The bootc components. +packages: + - systemd + - bootc + # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk + - gdisk xfsprogs e2fsprogs dosfstools + +exclude-packages: + # Exclude kernel-debug-core to make sure that it doesn't somehow get + # chosen as the package to satisfy the `kernel-core` dependency from + # the kernel package. + - kernel-debug-core diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml new file mode 100644 index 0000000..7d3ebf3 --- /dev/null +++ b/fedora-bootc-base/bootupd.yaml @@ -0,0 +1,31 @@ +# Integration with https://github.com/coreos/bootupd and bootloader logic +# xref https://github.com/coreos/fedora-coreos-tracker/issues/510 +packages: + - bootupd + +# bootloader +packages-aarch64: + - grub2-efi-aa64 efibootmgr shim +packages-ppc64le: + - grub2 ostree-grub2 +packages-s390x: + # On Fedora, this is provided by s390utils-core. on RHEL, this is for now + # provided by s390utils-base, but soon will be -core too. + - /usr/sbin/zipl +packages-x86_64: + - grub2 grub2-efi-x64 efibootmgr shim + - microcode_ctl + +conditional-include: + - if: basearch != "s390x" + # And remove some cruft from grub2 + include: grub2-removals.yaml + +postprocess: + - | + #!/bin/bash + set -xeuo pipefail + # Until we have https://github.com/coreos/rpm-ostree/pull/2275 + mkdir -p /run + # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload + /usr/bin/bootupctl backend generate-update-metadata diff --git a/fedora-bootc-base/group b/fedora-bootc-base/group new file mode 100644 index 0000000..2fd197c --- /dev/null +++ b/fedora-bootc-base/group @@ -0,0 +1,46 @@ +root:x:0: +bin:x:1: +daemon:x:2: +sys:x:3: +adm:x:4: +tty:x:5: +disk:x:6: +lp:x:7: +mem:x:8: +kmem:x:9: +wheel:x:10: +cdrom:x:11: +mail:x:12: +man:x:15: +sudo:x:16: +dialout:x:18: +floppy:x:19: +games:x:20: +tape:x:33: +video:x:39: +ftp:x:50: +lock:x:54: +audio:x:63: +nobody:x:99: +users:x:100: +ssh_keys:x:999: +systemd-journal:x:190: +polkitd:x:998: +etcd:x:997: +dip:x:40: +cgred:x:996: +avahi-autoipd:x:170: +sssd:x:993: +dockerroot:x:986: +rpcuser:x:29: +nfsnobody:x:65534: +kube:x:994: +chrony:x:992: +tcpdump:x:72: +ceph:x:167: +input:x:104: +systemd-timesync:x:991: +systemd-network:x:990: +systemd-resolve:x:989: +systemd-bus-proxy:x:988: +cockpit-ws:x:987: diff --git a/fedora-bootc-base/grub2-removals.yaml b/fedora-bootc-base/grub2-removals.yaml new file mode 100644 index 0000000..f4800dd --- /dev/null +++ b/fedora-bootc-base/grub2-removals.yaml @@ -0,0 +1,8 @@ +remove-from-packages: + # The grub bits are mainly designed for desktops, and IMO haven't seen + # enough testing in concert with ostree. At some point we'll flesh out + # the full plan in https://github.com/coreos/fedora-coreos-tracker/issues/47 + - [grub2-tools, /etc/grub.d/08_fallback_counting, + /etc/grub.d/10_reset_boot_success, + /etc/grub.d/12_menu_auto_hide, + /usr/lib/systemd/.*] diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml new file mode 100644 index 0000000..de65333 --- /dev/null +++ b/fedora-bootc-base/initramfs.yaml @@ -0,0 +1,18 @@ +# Configuration for the initramfs +postprocess: + - | + #!/usr/bin/env bash + mkdir -p /usr/lib/dracut/dracut.conf.d + cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' + # We want a generic image; hostonly makes no sense as part of a server side build + hostonly=no + dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " + EOF + cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' + # Extra modules that we want by default that are known to exist in the kernel + dracutmodules+=" virtiofs " + EOF + cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' + # We want this for systemd-cryptsetup tpm2 locking + dracutmodules+=" tpm2-tss " + EOF diff --git a/fedora-bootc-base/kernel.yaml b/fedora-bootc-base/kernel.yaml new file mode 100644 index 0000000..0dd777d --- /dev/null +++ b/fedora-bootc-base/kernel.yaml @@ -0,0 +1,6 @@ +# Enable the Linux kernel; see also kernel-rt. +packages: + - kernel + +exclude-packages: + - kernel-debug diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml new file mode 100644 index 0000000..007f6d7 --- /dev/null +++ b/fedora-bootc-base/manifest.yaml @@ -0,0 +1,71 @@ + +# Modern defaults we want +boot-location: modules +tmp-is-dir: true +# https://github.com/CentOS/centos-bootc/issues/167 +machineid-compat: true +# Be minimal +recommends: false + +ignore-removed-users: + - root +ignore-removed-groups: + - root +etc-group-members: + - wheel + - sudo + - systemd-journal + - adm + +# Default to `bash` in our container, the same as other containers we ship. +container-cmd: + - /sbin/init + +# Note that the default for c9s+ is sqlite; we can't rely on rpm being +# in the target (it isn't in tier-0!) so turn this to host here. This +# does break the "hermetic build" aspect a bit. Maybe eventually +# what we should do is special case this and actually install RPM temporarily +# and then remove it... +rpmdb: host + +check-passwd: + type: "file" + filename: "passwd" +check-groups: + type: "file" + filename: "group" + +automatic-version-prefix: "${releasever}." +mutate-os-release: "${releasever}" + +remove-from-packages: + # Generally we expect other tools to do this (e.g. Ignition or cloud-init) + - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service] + # We don't want auto-generated mount units. See also + # https://github.com/systemd/systemd/issues/13099 + - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator] + # Drop some buggy sysusers fragments which do not match static IDs allocation: + # https://bugzilla.redhat.com/show_bug.cgi?id=2105177 + - [dbus-common, /usr/lib/sysusers.d/dbus.conf] + +include: + - bootc.yaml + - ostree.yaml + - bootc-config.yaml + - initramfs.yaml + - autoupdates.yaml + - basic-fixes.yaml + +packages: + # Even in tier-0, we have this. If you don't want SELinux today, you'll need + # to build a custom image. + - selinux-policy-targeted + # And we want container-selinux because trying to layer it on later currently causes issues. + - container-selinux + # Needed for tpm2 bound luks + - tpm2-tools + +# See https://github.com/coreos/bootupd +arch-include: + x86_64: bootupd.yaml + aarch64: bootupd.yaml diff --git a/fedora-bootc-base/ostree.yaml b/fedora-bootc-base/ostree.yaml new file mode 100644 index 0000000..6f30861 --- /dev/null +++ b/fedora-bootc-base/ostree.yaml @@ -0,0 +1,17 @@ +packages: + - ostree nss-altfiles + +# We want content lifecycled with the image +opt-usrlocal: "root" + +postprocess: + # Set up default root config + - | + #!/usr/bin/env bash + mkdir -p /usr/lib/ostree + cat > /usr/lib/ostree/prepare-root.conf << EOF + [composefs] + enabled = yes + [sysroot] + readonly = true + EOF diff --git a/fedora-bootc-base/passwd b/fedora-bootc-base/passwd new file mode 100644 index 0000000..ea84802 --- /dev/null +++ b/fedora-bootc-base/passwd @@ -0,0 +1,32 @@ +adm:x:3:4:adm:/var/adm:/usr/sbin/nologin +avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin +bin:x:1:1:bin:/bin:/usr/sbin/nologin +ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin +chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin +cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin +daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin +dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin +dockerroot:x:997:986:Docker User:/var/lib/docker:/usr/sbin/nologin +etcd:x:998:997:etcd user:/var/lib/etcd:/usr/sbin/nologin +ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin +games:x:12:100:games:/usr/games:/usr/sbin/nologin +halt:x:7:0:halt:/sbin:/sbin/halt +kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin +lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin +mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin +nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin +nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin +operator:x:11:0:operator:/root:/usr/sbin/nologin +polkitd:x:999:998:User for polkitd:/:/usr/sbin/nologin +root:x:0:0:Super User:/root:/bin/bash +rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin +rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin +shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown +sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin +sssd:x:995:993:User for sssd:/:/usr/sbin/nologin +sync:x:5:0:sync:/sbin:/bin/sync +systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin +systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin +systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin +systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin +tcpdump:x:72:72::/:/usr/sbin/nologin diff --git a/fedora-bootc.yaml b/fedora-bootc.yaml new file mode 100644 index 0000000..9bb1cf7 --- /dev/null +++ b/fedora-bootc.yaml @@ -0,0 +1,15 @@ +releasever: rawhide +variables: + distro: "fedora" + +repos: + - rawhide + +metadata: + name: fedora-bootc + summary: Fedora base bootc image + +include: + - fedora-bootc-base/manifest.yaml + - fedora-bootc-base/kernel.yaml + diff --git a/fedora.repo b/fedora.repo new file mode 100644 index 0000000..7101cb9 --- /dev/null +++ b/fedora.repo @@ -0,0 +1,65 @@ +# Note we use baseurl= here because using auto-selected mirrors conflicts with +# change detection: https://github.com/coreos/fedora-coreos-pipeline/issues/85. + +[fedora] +name=Fedora $releasever - $basearch +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ + https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch +enabled=1 +#metadata_expire=7d +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False + +[fedora-updates] +name=Fedora $releasever - $basearch - Updates +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Everything/$basearch/ + https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Everything/$basearch/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch +enabled=1 +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +metadata_expire=6h +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False + +[fedora-updates-testing] +name=Fedora $releasever - $basearch - Test Updates +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Everything/$basearch/ + https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Everything/$basearch/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch +enabled=1 +gpgcheck=1 +metadata_expire=6h +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False + +[rawhide] +name=Fedora - Rawhide - Developmental packages for the next Fedora release +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ + https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch +enabled=1 +#metadata_expire=7d +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False + +[fedora-devel] +name=Fedora $releasever - $basearch +baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ + https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ +#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch +enabled=1 +#metadata_expire=7d +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary +skip_if_unavailable=False From 1314f2a3f25aa6b9932b9a1a7195de9381929842 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 16 Apr 2024 13:43:24 -0400 Subject: [PATCH 126/163] F41: Adjust repo to use mirrors Signed-off-by: Paul Whalen --- fedora-bootc.yaml | 2 +- fedora-rawhide.repo | 6 +++++ fedora.repo | 65 --------------------------------------------- 3 files changed, 7 insertions(+), 66 deletions(-) create mode 100644 fedora-rawhide.repo delete mode 100644 fedora.repo diff --git a/fedora-bootc.yaml b/fedora-bootc.yaml index 9bb1cf7..7067275 100644 --- a/fedora-bootc.yaml +++ b/fedora-bootc.yaml @@ -3,7 +3,7 @@ variables: distro: "fedora" repos: - - rawhide + - fedora-rawhide metadata: name: fedora-bootc diff --git a/fedora-rawhide.repo b/fedora-rawhide.repo new file mode 100644 index 0000000..30b51c9 --- /dev/null +++ b/fedora-rawhide.repo @@ -0,0 +1,6 @@ +[fedora-rawhide] +name=Fedora rawhide $basearch +mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=rawhide&arch=$basearch +enabled=1 +gpgcheck=1 +metadata_expire=1d diff --git a/fedora.repo b/fedora.repo deleted file mode 100644 index 7101cb9..0000000 --- a/fedora.repo +++ /dev/null @@ -1,65 +0,0 @@ -# Note we use baseurl= here because using auto-selected mirrors conflicts with -# change detection: https://github.com/coreos/fedora-coreos-pipeline/issues/85. - -[fedora] -name=Fedora $releasever - $basearch -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ - https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch -enabled=1 -#metadata_expire=7d -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False - -[fedora-updates] -name=Fedora $releasever - $basearch - Updates -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Everything/$basearch/ - https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Everything/$basearch/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch -enabled=1 -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -metadata_expire=6h -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False - -[fedora-updates-testing] -name=Fedora $releasever - $basearch - Test Updates -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Everything/$basearch/ - https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Everything/$basearch/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch -enabled=1 -gpgcheck=1 -metadata_expire=6h -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False - -[rawhide] -name=Fedora - Rawhide - Developmental packages for the next Fedora release -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ - https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch -enabled=1 -#metadata_expire=7d -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False - -[fedora-devel] -name=Fedora $releasever - $basearch -baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/ - https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/ -#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch -enabled=1 -#metadata_expire=7d -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary -skip_if_unavailable=False From c1ecf382b89fcdcc85ddbca1fd2dfc1b3123c762 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 3 May 2024 10:49:13 -0400 Subject: [PATCH 127/163] F41: add bootc to packages Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 1604965..8c21026 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -78,6 +78,7 @@ packages: - basesystem - bash - bash-completion +- bootc - brcmfmac-firmware - chrony - clevis From 985a450f7c3dfbc07b29e148e60c9ae0290b533c Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 15 Jul 2024 13:39:36 -0400 Subject: [PATCH 128/163] F41: Add dnf5 to packages Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 8c21026..25d3bdd 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -94,6 +94,8 @@ packages: - cryptsetup - curl - dbus-parsec +- dnf5 +- dnf5-plugins - dnsmasq - dosfstools - dracut-config-generic From 023d15b50fc0f862bd1b1b9fee9011ea03c27780 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 12 Aug 2024 15:26:49 -0400 Subject: [PATCH 129/163] IoT: Update rawhide for F-42 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-41.repo => fedora-42.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-41.repo => fedora-42.repo (61%) diff --git a/config.ini b/config.ini index 0b65ffb..f7e27f5 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f41 +release = f42 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-41.repo b/fedora-42.repo similarity index 61% rename from fedora-41.repo rename to fedora-42.repo index 1412aca..f9343b8 100644 --- a/fedora-41.repo +++ b/fedora-42.repo @@ -1,12 +1,12 @@ -[fedora-41] -name=Fedora 41 - $basearch +[fedora-42] +name=Fedora 42 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/41/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-41&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/42/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-42&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-41-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 25d3bdd..b665f4b 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -6,8 +6,8 @@ ima: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '41' -mutate-os-release: '41' +automatic_version_prefix: '42' +mutate-os-release: '42' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 51c17ad..f765bfe 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-41 +- fedora-42 From 1a898a733753e9700e305e41ea218456780efe13 Mon Sep 17 00:00:00 2001 From: Micah Abbott Date: Wed, 28 Aug 2024 13:54:39 -0400 Subject: [PATCH 130/163] bootupd: add some contextual comments Signed-off-by: Micah Abbott --- bootupd.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/bootupd.yaml b/bootupd.yaml index 949f504..3328d41 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,3 +1,7 @@ +# KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml +# See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml +# +#Integration with https://github.com/coreos/bootupd packages: - bootupd From 36ab3daaf041fe8f822fd639a3d31a093939cc93 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 3 Sep 2024 09:38:53 -0400 Subject: [PATCH 131/163] fedora-iot-base: Add workaround for issue with newer GRUB2 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 5 ++++- grub2-workaround.yaml | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) create mode 100644 grub2-workaround.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index b665f4b..a7afbd1 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,4 +1,7 @@ -include: bootupd.yaml +include: + - bootupd.yaml + # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 + - grub2-workaround.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/grub2-workaround.yaml b/grub2-workaround.yaml new file mode 100644 index 0000000..3b58a9e --- /dev/null +++ b/grub2-workaround.yaml @@ -0,0 +1,22 @@ +# Temporarily disable new GRUB2 config options until we can ensure that we +# have an updated bootloader via bootupd. +# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 +# See: https://github.com/fedora-silverblue/issue-tracker/issues/587 +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + # Completely disable this module + sed -i '2i exit 0' /etc/grub.d/25_bli + + # Skip check that was not performed in previous Fedora versions + sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware + sed -i '/\tif/d' /etc/grub.d/30_uefi-firmware + sed -i '/\tfi/d' /etc/grub.d/30_uefi-firmware + sed -i 's/\t\t/\t/' /etc/grub.d/30_uefi-firmware + + # Verify that the content matches what we expect the file to look like. + # This will fail the build here instead of breaking users' systems. + hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b" + echo "$hash /etc/grub.d/30_uefi-firmware" | sha256sum -c From 176b0add790ece0b16b41337569b9170b0514117 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 20 Sep 2024 15:28:56 +0100 Subject: [PATCH 132/163] drop dnsmasq Not sure why it was included, I suspect it was once used for container networking. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index a7afbd1..4c64cd1 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -99,7 +99,6 @@ packages: - dbus-parsec - dnf5 - dnf5-plugins -- dnsmasq - dosfstools - dracut-config-generic - dracut-network From 597796c53f30950d9edaa85b6d6a07ee1a829d5c Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 25 Sep 2024 08:57:05 -0400 Subject: [PATCH 133/163] Add iot base bootc image Signed-off-by: Paul Whalen --- fedora-bootc-base/autoupdates.yaml | 9 -- fedora-bootc-base/bootc-config.yaml | 10 --- fedora-bootc-base/bootc.yaml | 4 + fedora-bootc-base/bootupd.yaml | 2 +- fedora-bootc-base/initramfs.yaml | 12 ++- fedora-bootc-base/iot.yaml | 100 +++++++++++++++++++++ fedora-bootc-base/manifest.yaml | 14 +-- fedora-bootc.yaml => fedora-iot-bootc.yaml | 6 +- 8 files changed, 121 insertions(+), 36 deletions(-) delete mode 100644 fedora-bootc-base/autoupdates.yaml create mode 100644 fedora-bootc-base/iot.yaml rename fedora-bootc.yaml => fedora-iot-bootc.yaml (61%) diff --git a/fedora-bootc-base/autoupdates.yaml b/fedora-bootc-base/autoupdates.yaml deleted file mode 100644 index a416699..0000000 --- a/fedora-bootc-base/autoupdates.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# Enable automatic updates by default -postprocess: - - | - #!/usr/bin/env bash - set -euo pipefail - target=/usr/lib/systemd/system/default.target.wants - mkdir -p $target - set -x - ln -s ../bootc-fetch-apply-updates.timer $target diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml index 4d4b24e..e69de29 100644 --- a/fedora-bootc-base/bootc-config.yaml +++ b/fedora-bootc-base/bootc-config.yaml @@ -1,10 +0,0 @@ -# Configuration for bootc -postprocess: - # ext4 is our default filesystem in iot - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/bootc/install/ - cat > /usr/lib/bootc/install/20-default-root.toml << EOF - [install] - root-fs-type = "ext4" - EOF diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml index a862e6c..d44ee08 100644 --- a/fedora-bootc-base/bootc.yaml +++ b/fedora-bootc-base/bootc.yaml @@ -2,6 +2,10 @@ packages: - systemd - bootc + # bootc pulls in podman, which pulls in containers-common, which wants + # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name + # iptables-nft instead to satisfy it. + - iptables-nft # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk - gdisk xfsprogs e2fsprogs dosfstools diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml index 7d3ebf3..cc83d20 100644 --- a/fedora-bootc-base/bootupd.yaml +++ b/fedora-bootc-base/bootupd.yaml @@ -13,7 +13,7 @@ packages-s390x: # provided by s390utils-base, but soon will be -core too. - /usr/sbin/zipl packages-x86_64: - - grub2 grub2-efi-x64 efibootmgr shim + - grub2-efi-x64 efibootmgr shim - microcode_ctl conditional-include: diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml index de65333..fe4bbeb 100644 --- a/fedora-bootc-base/initramfs.yaml +++ b/fedora-bootc-base/initramfs.yaml @@ -6,13 +6,19 @@ postprocess: cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' # We want a generic image; hostonly makes no sense as part of a server side build hostonly=no - dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " + add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " EOF cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' # Extra modules that we want by default that are known to exist in the kernel - dracutmodules+=" virtiofs " + add_dracutmodules+=" virtiofs " EOF cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' # We want this for systemd-cryptsetup tpm2 locking - dracutmodules+=" tpm2-tss " + add_dracutmodules+=" tpm2-tss " + EOF + cat > /usr/lib/dracut/dracut.conf.d/59-altfiles.conf << 'EOF' + # https://issues.redhat.com/browse/RHEL-49590 + # On image mode systems we use nss-altfiles for passwd and group, + # this makes sure dracut uses them which also fixes kdump writing to NFS. + install_items+=" /usr/lib/passwd /usr/lib/group " EOF diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml new file mode 100644 index 0000000..611ff9a --- /dev/null +++ b/fedora-bootc-base/iot.yaml @@ -0,0 +1,100 @@ +# Fedora IoT specific packages +packages: + - fedora-release-iot + - aardvark-dns + - atheros-firmware + - attr + - authselect + - basesystem + - bash + - bash-completion + - brcmfmac-firmware + - chrony + - clevis + - clevis-dracut + - clevis-luks + - clevis-pin-tpm2 + - containernetworking-plugins + - coreutils + - cracklib-dicts + - criu + - criu-libs + - cryptsetup + - curl + - dbus-parsec + - dnf5-plugins + - dracut-config-generic + - dracut-network + - efibootmgr + - fdo-client + - firewalld + - fwupd + - fwupd-efi + - fwupd-plugin-modem-manager + - fwupd-plugin-uefi-capsule-data + - glibc + - glibc-minimal-langpack + - gnupg2 + - greenboot + - greenboot-default-health-checks + - gzip + - hostname + - ignition + - ima-evm-utils + - iproute + - iputils + - iwd + - iwlwifi-mvm-firmware + - kernel-tools + - keyutils + - less + - libsss_sudo + - linux-firmware + - lvm2 + - netavark + - NetworkManager + - NetworkManager-wifi + - NetworkManager-wwan + - nss-altfiles + - openssl + - openssh-clients + - openssh-server + - passt + - passt-selinux + - parsec + - pinentry + - podman + - policycoreutils + - policycoreutils-python-utils + - polkit + - procps-ng + - realtek-firmware + - rootfiles + - rpm + - screen + - setools-console + - setup + - shadow-utils + - skopeo + - slirp4netns + - sssd-client + - sudo + - systemd-resolved + - tar + - tmux + - tpm2-pkcs11 + - traceroute + - usbguard + - util-linux + - vim-minimal + - wpa_supplicant + - wireless-regdb + - xz + - zezere-ignition + - zram-generator + - zram-generator-defaults +packages-aarch64: + - arm-image-installer + - bcm283x-firmware + - optee_client + - uboot-images-armv8 diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml index 007f6d7..9a21ff3 100644 --- a/fedora-bootc-base/manifest.yaml +++ b/fedora-bootc-base/manifest.yaml @@ -44,19 +44,18 @@ remove-from-packages: # We don't want auto-generated mount units. See also # https://github.com/systemd/systemd/issues/13099 - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator] - # Drop some buggy sysusers fragments which do not match static IDs allocation: - # https://bugzilla.redhat.com/show_bug.cgi?id=2105177 - - [dbus-common, /usr/lib/sysusers.d/dbus.conf] include: - bootc.yaml + - bootupd.yaml - ostree.yaml - - bootc-config.yaml - initramfs.yaml - - autoupdates.yaml - basic-fixes.yaml + - iot.yaml packages: + # needed for building derived container images + - dnf5 # Even in tier-0, we have this. If you don't want SELinux today, you'll need # to build a custom image. - selinux-policy-targeted @@ -64,8 +63,3 @@ packages: - container-selinux # Needed for tpm2 bound luks - tpm2-tools - -# See https://github.com/coreos/bootupd -arch-include: - x86_64: bootupd.yaml - aarch64: bootupd.yaml diff --git a/fedora-bootc.yaml b/fedora-iot-bootc.yaml similarity index 61% rename from fedora-bootc.yaml rename to fedora-iot-bootc.yaml index 7067275..6ae5882 100644 --- a/fedora-bootc.yaml +++ b/fedora-iot-bootc.yaml @@ -1,13 +1,13 @@ releasever: rawhide variables: - distro: "fedora" + distro: "fedora-iot" repos: - fedora-rawhide metadata: - name: fedora-bootc - summary: Fedora base bootc image + name: fedora-iot-bootc-base + summary: Fedora IoT bootc base image include: - fedora-bootc-base/manifest.yaml From 91539fbf82555ede87f931277a090612a23c5680 Mon Sep 17 00:00:00 2001 From: David Jachimowicz Date: Fri, 15 Nov 2024 16:15:33 +0000 Subject: [PATCH 134/163] Update fedora-iot-base.yaml to sync with osbuild iot-commit Adds ssh-key-dir and ignition-edge packages to base yaml. ssh-key-dir is needed to transfer ssh keys to the iot system during boot and ignition-edge is needed to allow ssh-key-dir to work properly. Explicitly adds fedora-iot-config package. Was previously pulled in as a requirement, added for clarity. Adds fdo-owner-cli package to increase FDO functionality. These changes should help bring the package list more in line with the osbuild iot-commit, as well as rectifying issue 70 and issue 49 (relating to ssh key login and home directory creation on iot systems). Issue 70: https://github.com/fedora-iot/iot-distro/issues/70 Issue 49: https://github.com/fedora-iot/iot-distro/issues/49 Signed-off-by: djach7 --- fedora-iot-base.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 4c64cd1..e6358e3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -73,7 +73,11 @@ check-groups: type: file filename: group packages: +# This list of packages should be kept in sync with +# the iot-commit definition is osbuild, as found here: +# https://github.com/osbuild/images/blob/0584c20b0c14a89e833b875252114ceff61805e8/pkg/distro/fedora/package_sets.go#L123 - fedora-release-iot +- fedora-iot-config - aardvark-dns - atheros-firmware - attr @@ -105,6 +109,7 @@ packages: - e2fsprogs - efibootmgr - fdo-client +- fdo-owner-cli - firewalld - fwupd - fwupd-efi @@ -118,6 +123,7 @@ packages: - gzip - hostname - ignition +- ignition-edge - ima-evm-utils - iproute - iputils @@ -157,6 +163,7 @@ packages: - shadow-utils - skopeo - slirp4netns +- ssh-key-dir - sssd-client - sudo - systemd From c611d4da9615ec908287774382e88fcfaf9ff240 Mon Sep 17 00:00:00 2001 From: djach7 Date: Mon, 16 Dec 2024 14:58:43 -0500 Subject: [PATCH 135/163] Adds bootupd update to boot process Updates bootupd.yaml to enable bootupctl-update upon system boot. This allows bootupd to work as expected on Fedora IoT raw image systems, with all expected components installed. Signed-off-by: djach7 --- bootupd.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/bootupd.yaml b/bootupd.yaml index 3328d41..61a6a9a 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -11,3 +11,22 @@ postprocess: set -xeuo pipefail # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload /usr/bin/bootupctl backend generate-update-metadata + + # Trigger a bootloader update on boot + cat > /usr/lib/systemd/system/bootloader-update.service << 'EOF' + [Unit] + Description=Update bootloader on boot + Documentation=https://github.com/coreos/bootupd + ConditionFirmware=uefi + + [Service] + Type=oneshot + ExecStart=/usr/bin/bootupctl update + RemainAfterExit=yes + MountFlags=slave + + [Install] + WantedBy=multi-user.target + EOF + chmod 644 /usr/lib/systemd/system/bootloader-update.service + echo "enable bootloader-update.service" > /usr/lib/systemd/system-preset/81-iot.preset \ No newline at end of file From d6ec8e0b0e553a2ce129c21115f89d679b214641 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 4 Feb 2025 15:29:24 -0500 Subject: [PATCH 136/163] IoT: Update rawhide for F-43 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-42.repo => fedora-43.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-42.repo => fedora-43.repo (61%) diff --git a/config.ini b/config.ini index f7e27f5..f09325d 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f42 +release = f43 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-42.repo b/fedora-43.repo similarity index 61% rename from fedora-42.repo rename to fedora-43.repo index f9343b8..c510019 100644 --- a/fedora-42.repo +++ b/fedora-43.repo @@ -1,12 +1,12 @@ -[fedora-42] -name=Fedora 42 - $basearch +[fedora-43] +name=Fedora 43 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/42/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-42&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/43/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-43&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index e6358e3..11b35f3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -9,8 +9,8 @@ ima: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '42' -mutate-os-release: '42' +automatic_version_prefix: '43' +mutate-os-release: '43' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index f765bfe..2f1ddd3 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-42 +- fedora-43 From 625d7631959acac84ca8d6e9a9955c4cb3969a6e Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Fri, 7 Feb 2025 09:34:26 -0800 Subject: [PATCH 137/163] Replace basesystem with filesystem See https://src.fedoraproject.org/rpms/filesystem/c/3f741bf2a89c9e1bb685943c41fd298e6683dd50?branch=rawhide Signed-off-by: Adam Williamson --- fedora-iot-base.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 11b35f3..fc21de0 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -82,7 +82,6 @@ packages: - atheros-firmware - attr - authselect -- basesystem - bash - bash-completion - bootc @@ -110,6 +109,7 @@ packages: - efibootmgr - fdo-client - fdo-owner-cli +- filesystem - firewalld - fwupd - fwupd-efi From b799fe0c9d8bf09bcfa855b46599f60ecd190f17 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 18 Feb 2025 16:36:16 -0500 Subject: [PATCH 138/163] Remove Zezere and enable systemd-firstboot Remove Zezere and enable systemd-firstboot for local configuration. See: https://fedoraproject.org/wiki/Changes/Retire_Zezere Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index fc21de0..c61164b 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -179,7 +179,6 @@ packages: - wireless-regdb - xfsprogs - xz -- zezere-ignition - zram-generator - zram-generator-defaults packages-aarch64: @@ -200,6 +199,7 @@ units: - fedora-iot-config-remote-fix.service - firewalld.service - sshd.service +- systemd-firstboot.service - greenboot-grub2-set-counter.service - greenboot-grub2-set-success.service - greenboot-healthcheck.service @@ -208,5 +208,3 @@ units: - greenboot-task-runner.service - parsec.service - dbus-parsec.service -- zezere_ignition.timer -- zezere_ignition_banner.service From 17d9d31eb8216fc0ac4d1def372acae86bd4802d Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 18 Feb 2025 16:38:44 -0500 Subject: [PATCH 139/163] Drop parsec no longer supported upstream Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index c61164b..58d3480 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -99,7 +99,6 @@ packages: - criu-libs - cryptsetup - curl -- dbus-parsec - dnf5 - dnf5-plugins - dosfstools @@ -146,7 +145,6 @@ packages: - openssh-server - passt - passt-selinux -- parsec - pinentry - podman - policycoreutils @@ -206,5 +204,3 @@ units: - greenboot-rpm-ostree-grub2-check-fallback.service - greenboot-status.service - greenboot-task-runner.service -- parsec.service -- dbus-parsec.service From ce25ead8e58f35271963d19c792827de443ae869 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 19 Feb 2025 15:34:27 +0000 Subject: [PATCH 140/163] drop policycoreutils-python-utils in base The policycoreutils-python-utils pulls in a bunch of extra SELinux utils which aren't used in day to day, it pulls in a bunch of python packages, it can easily be layered and isn't generally needed. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 58d3480..c5071fa 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -148,7 +148,6 @@ packages: - pinentry - podman - policycoreutils -- policycoreutils-python-utils - polkit - procps-ng - realtek-firmware From b3fd2930a9249c25e94eb32bbe9dbdfc8843e254 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 24 Feb 2025 10:43:18 -0500 Subject: [PATCH 141/163] Disable ima in ostree due to ongoing compose issues See: https://bugzilla.redhat.com/show_bug.cgi?id=2346265 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index c5071fa..62a22bc 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -5,7 +5,6 @@ include: ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true -ima: true tmp-is-dir: true recommends: false documentation: false From a6e7212b561662f8ce507e51dd95ddc354785b45 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 27 Feb 2025 10:58:35 -0500 Subject: [PATCH 142/163] Migrate systems to a static GRUB config See: https://pagure.io/workstation-ostree-config/pull-request/591 https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops Signed-off-by: Paul Whalen --- bootupd.yaml | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-) diff --git a/bootupd.yaml b/bootupd.yaml index 61a6a9a..857de65 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -9,24 +9,18 @@ postprocess: - | #!/bin/bash set -xeuo pipefail + # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload /usr/bin/bootupctl backend generate-update-metadata - - # Trigger a bootloader update on boot - cat > /usr/lib/systemd/system/bootloader-update.service << 'EOF' - [Unit] - Description=Update bootloader on boot - Documentation=https://github.com/coreos/bootupd - ConditionFirmware=uefi - + + # Enable migration to a static GRUB config + install -dm0755 /usr/lib/systemd/system/bootloader-update.service.d + cat > /usr/lib/systemd/system/bootloader-update.service.d/migrate-static-grub-config.conf << 'EOF' [Service] - Type=oneshot - ExecStart=/usr/bin/bootupctl update - RemainAfterExit=yes - MountFlags=slave - - [Install] - WantedBy=multi-user.target + ExecStart=/usr/bin/bootupctl migrate-static-grub-config EOF - chmod 644 /usr/lib/systemd/system/bootloader-update.service - echo "enable bootloader-update.service" > /usr/lib/systemd/system-preset/81-iot.preset \ No newline at end of file + + echo "enable bootloader-update.service" >> /usr/lib/systemd/system-preset/80-iot.preset + + # Turn permissive mode on for bootupd until all SELinux issues are fixed + semanage permissive --noreload --add bootupd_t From c739a8c05ac86fd6f8b8091e9268e22561eb6a2d Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 27 Feb 2025 11:02:20 -0500 Subject: [PATCH 143/163] Enable composefs by default See: https://pagure.io/workstation-ostree-config/pull-request/591 https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops Signed-off-by: Paul Whalen --- composefs.yaml | 12 ++++++++++++ fedora-iot-base.yaml | 2 ++ 2 files changed, 14 insertions(+) create mode 100644 composefs.yaml diff --git a/composefs.yaml b/composefs.yaml new file mode 100644 index 0000000..8a721f3 --- /dev/null +++ b/composefs.yaml @@ -0,0 +1,12 @@ +# Enable composefs +# See: https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops +# https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' + [composefs] + enabled = yes + EOF diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 62a22bc..03e21c3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,6 +2,8 @@ include: - bootupd.yaml # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - grub2-workaround.yaml + # Enable composefs + - composefs.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true From 6529ca201d34fc21b338722c97fcccddb5e4ea42 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 27 Feb 2025 14:40:52 +0000 Subject: [PATCH 144/163] iot: drop kernel-tools It too should be layered, not included in the base image. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 03e21c3..11e982f 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -130,7 +130,6 @@ packages: - iwd - iwlwifi-mvm-firmware - kernel -- kernel-tools - keyutils - less - libsss_sudo From 2fda060e855080cb329c5d637a7dfca68e8e8999 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 6 Mar 2025 14:02:39 -0500 Subject: [PATCH 145/163] Remove grub2-workaround Remove grub2-workaround, bug has been fixed. See: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 -- grub2-workaround.yaml | 22 ---------------------- 2 files changed, 24 deletions(-) delete mode 100644 grub2-workaround.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 11e982f..1c13f3f 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,7 +1,5 @@ include: - bootupd.yaml - # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - - grub2-workaround.yaml # Enable composefs - composefs.yaml ref: fedora/rawhide/${basearch}/iot diff --git a/grub2-workaround.yaml b/grub2-workaround.yaml deleted file mode 100644 index 3b58a9e..0000000 --- a/grub2-workaround.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# Temporarily disable new GRUB2 config options until we can ensure that we -# have an updated bootloader via bootupd. -# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 -# See: https://github.com/fedora-silverblue/issue-tracker/issues/587 -postprocess: - - | - #!/usr/bin/env bash - set -xeuo pipefail - - # Completely disable this module - sed -i '2i exit 0' /etc/grub.d/25_bli - - # Skip check that was not performed in previous Fedora versions - sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware - sed -i '/\tif/d' /etc/grub.d/30_uefi-firmware - sed -i '/\tfi/d' /etc/grub.d/30_uefi-firmware - sed -i 's/\t\t/\t/' /etc/grub.d/30_uefi-firmware - - # Verify that the content matches what we expect the file to look like. - # This will fail the build here instead of breaking users' systems. - hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b" - echo "$hash /etc/grub.d/30_uefi-firmware" | sha256sum -c From 6b92bbcbbc38b5c50cebf01c1f78115376949789 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Fri, 7 Mar 2025 13:49:18 +0100 Subject: [PATCH 146/163] Remove fedora-bootc-base Now moved to https://github.com/fedora-iot/fedora-iot-bootc --- fedora-bootc-base/basic-fixes.yaml | 29 -------- fedora-bootc-base/bootc-config.yaml | 0 fedora-bootc-base/bootc.yaml | 16 ----- fedora-bootc-base/bootupd.yaml | 31 -------- fedora-bootc-base/group | 46 ------------ fedora-bootc-base/grub2-removals.yaml | 8 --- fedora-bootc-base/initramfs.yaml | 24 ------- fedora-bootc-base/iot.yaml | 100 -------------------------- fedora-bootc-base/kernel.yaml | 6 -- fedora-bootc-base/manifest.yaml | 65 ----------------- fedora-bootc-base/ostree.yaml | 17 ----- fedora-bootc-base/passwd | 32 --------- 12 files changed, 374 deletions(-) delete mode 100644 fedora-bootc-base/basic-fixes.yaml delete mode 100644 fedora-bootc-base/bootc-config.yaml delete mode 100644 fedora-bootc-base/bootc.yaml delete mode 100644 fedora-bootc-base/bootupd.yaml delete mode 100644 fedora-bootc-base/group delete mode 100644 fedora-bootc-base/grub2-removals.yaml delete mode 100644 fedora-bootc-base/initramfs.yaml delete mode 100644 fedora-bootc-base/iot.yaml delete mode 100644 fedora-bootc-base/kernel.yaml delete mode 100644 fedora-bootc-base/manifest.yaml delete mode 100644 fedora-bootc-base/ostree.yaml delete mode 100644 fedora-bootc-base/passwd diff --git a/fedora-bootc-base/basic-fixes.yaml b/fedora-bootc-base/basic-fixes.yaml deleted file mode 100644 index d9fe059..0000000 --- a/fedora-bootc-base/basic-fixes.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# Fix general bugs - -postprocess: - # See also https://github.com/openshift/os/blob/f6cde963ee140c02364674db378b2bc4ac42675b/common.yaml#L156 - # This one is undoes the effect of - # # RHEL-only: Disable /tmp on tmpfs. - #Wants=tmp.mount - # in /usr/lib/systemd/system/basic.target - # We absolutely must have tmpfs-on-tmp for multiple reasons, - # but the biggest is that when we have composefs for / it's read-only, - # and for units with ProtectSystem=full systemd clones / but needs - # a writable place. - - | - #!/usr/bin/env bash - set -xeuo pipefail - mkdir -p /usr/lib/systemd/system/local-fs.target.wants - if test '!' -f /usr/lib/systemd/system/local-fs.target.wants/tmp.mount; then - ln -sf ../tmp.mount /usr/lib/systemd/system/local-fs.target.wants - fi - - # See https://github.com/containers/bootc/issues/358 - # basically systemd-tmpfiles doesn't follow symlinks; ordinarily our - # tmpfiles.d unit for `/var/roothome` is fine, but this actually doesn't - # work if we want to use tmpfiles.d to write to `/root/.ssh` because - # tmpfiles gives up on that before getting to `/var/roothome`. - sed -ie 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf - # Because /var/roothome is also defined in rpm-ostree-0-integration.conf - # we need to delete /var/roothome - sed -ie '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml deleted file mode 100644 index d44ee08..0000000 --- a/fedora-bootc-base/bootc.yaml +++ /dev/null @@ -1,16 +0,0 @@ -# The bootc components. -packages: - - systemd - - bootc - # bootc pulls in podman, which pulls in containers-common, which wants - # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name - # iptables-nft instead to satisfy it. - - iptables-nft - # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk - - gdisk xfsprogs e2fsprogs dosfstools - -exclude-packages: - # Exclude kernel-debug-core to make sure that it doesn't somehow get - # chosen as the package to satisfy the `kernel-core` dependency from - # the kernel package. - - kernel-debug-core diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml deleted file mode 100644 index cc83d20..0000000 --- a/fedora-bootc-base/bootupd.yaml +++ /dev/null @@ -1,31 +0,0 @@ -# Integration with https://github.com/coreos/bootupd and bootloader logic -# xref https://github.com/coreos/fedora-coreos-tracker/issues/510 -packages: - - bootupd - -# bootloader -packages-aarch64: - - grub2-efi-aa64 efibootmgr shim -packages-ppc64le: - - grub2 ostree-grub2 -packages-s390x: - # On Fedora, this is provided by s390utils-core. on RHEL, this is for now - # provided by s390utils-base, but soon will be -core too. - - /usr/sbin/zipl -packages-x86_64: - - grub2-efi-x64 efibootmgr shim - - microcode_ctl - -conditional-include: - - if: basearch != "s390x" - # And remove some cruft from grub2 - include: grub2-removals.yaml - -postprocess: - - | - #!/bin/bash - set -xeuo pipefail - # Until we have https://github.com/coreos/rpm-ostree/pull/2275 - mkdir -p /run - # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload - /usr/bin/bootupctl backend generate-update-metadata diff --git a/fedora-bootc-base/group b/fedora-bootc-base/group deleted file mode 100644 index 2fd197c..0000000 --- a/fedora-bootc-base/group +++ /dev/null @@ -1,46 +0,0 @@ -root:x:0: -bin:x:1: -daemon:x:2: -sys:x:3: -adm:x:4: -tty:x:5: -disk:x:6: -lp:x:7: -mem:x:8: -kmem:x:9: -wheel:x:10: -cdrom:x:11: -mail:x:12: -man:x:15: -sudo:x:16: -dialout:x:18: -floppy:x:19: -games:x:20: -tape:x:33: -video:x:39: -ftp:x:50: -lock:x:54: -audio:x:63: -nobody:x:99: -users:x:100: -ssh_keys:x:999: -systemd-journal:x:190: -polkitd:x:998: -etcd:x:997: -dip:x:40: -cgred:x:996: -avahi-autoipd:x:170: -sssd:x:993: -dockerroot:x:986: -rpcuser:x:29: -nfsnobody:x:65534: -kube:x:994: -chrony:x:992: -tcpdump:x:72: -ceph:x:167: -input:x:104: -systemd-timesync:x:991: -systemd-network:x:990: -systemd-resolve:x:989: -systemd-bus-proxy:x:988: -cockpit-ws:x:987: diff --git a/fedora-bootc-base/grub2-removals.yaml b/fedora-bootc-base/grub2-removals.yaml deleted file mode 100644 index f4800dd..0000000 --- a/fedora-bootc-base/grub2-removals.yaml +++ /dev/null @@ -1,8 +0,0 @@ -remove-from-packages: - # The grub bits are mainly designed for desktops, and IMO haven't seen - # enough testing in concert with ostree. At some point we'll flesh out - # the full plan in https://github.com/coreos/fedora-coreos-tracker/issues/47 - - [grub2-tools, /etc/grub.d/08_fallback_counting, - /etc/grub.d/10_reset_boot_success, - /etc/grub.d/12_menu_auto_hide, - /usr/lib/systemd/.*] diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml deleted file mode 100644 index fe4bbeb..0000000 --- a/fedora-bootc-base/initramfs.yaml +++ /dev/null @@ -1,24 +0,0 @@ -# Configuration for the initramfs -postprocess: - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/dracut/dracut.conf.d - cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' - # We want a generic image; hostonly makes no sense as part of a server side build - hostonly=no - add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " - EOF - cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' - # Extra modules that we want by default that are known to exist in the kernel - add_dracutmodules+=" virtiofs " - EOF - cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' - # We want this for systemd-cryptsetup tpm2 locking - add_dracutmodules+=" tpm2-tss " - EOF - cat > /usr/lib/dracut/dracut.conf.d/59-altfiles.conf << 'EOF' - # https://issues.redhat.com/browse/RHEL-49590 - # On image mode systems we use nss-altfiles for passwd and group, - # this makes sure dracut uses them which also fixes kdump writing to NFS. - install_items+=" /usr/lib/passwd /usr/lib/group " - EOF diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml deleted file mode 100644 index 611ff9a..0000000 --- a/fedora-bootc-base/iot.yaml +++ /dev/null @@ -1,100 +0,0 @@ -# Fedora IoT specific packages -packages: - - fedora-release-iot - - aardvark-dns - - atheros-firmware - - attr - - authselect - - basesystem - - bash - - bash-completion - - brcmfmac-firmware - - chrony - - clevis - - clevis-dracut - - clevis-luks - - clevis-pin-tpm2 - - containernetworking-plugins - - coreutils - - cracklib-dicts - - criu - - criu-libs - - cryptsetup - - curl - - dbus-parsec - - dnf5-plugins - - dracut-config-generic - - dracut-network - - efibootmgr - - fdo-client - - firewalld - - fwupd - - fwupd-efi - - fwupd-plugin-modem-manager - - fwupd-plugin-uefi-capsule-data - - glibc - - glibc-minimal-langpack - - gnupg2 - - greenboot - - greenboot-default-health-checks - - gzip - - hostname - - ignition - - ima-evm-utils - - iproute - - iputils - - iwd - - iwlwifi-mvm-firmware - - kernel-tools - - keyutils - - less - - libsss_sudo - - linux-firmware - - lvm2 - - netavark - - NetworkManager - - NetworkManager-wifi - - NetworkManager-wwan - - nss-altfiles - - openssl - - openssh-clients - - openssh-server - - passt - - passt-selinux - - parsec - - pinentry - - podman - - policycoreutils - - policycoreutils-python-utils - - polkit - - procps-ng - - realtek-firmware - - rootfiles - - rpm - - screen - - setools-console - - setup - - shadow-utils - - skopeo - - slirp4netns - - sssd-client - - sudo - - systemd-resolved - - tar - - tmux - - tpm2-pkcs11 - - traceroute - - usbguard - - util-linux - - vim-minimal - - wpa_supplicant - - wireless-regdb - - xz - - zezere-ignition - - zram-generator - - zram-generator-defaults -packages-aarch64: - - arm-image-installer - - bcm283x-firmware - - optee_client - - uboot-images-armv8 diff --git a/fedora-bootc-base/kernel.yaml b/fedora-bootc-base/kernel.yaml deleted file mode 100644 index 0dd777d..0000000 --- a/fedora-bootc-base/kernel.yaml +++ /dev/null @@ -1,6 +0,0 @@ -# Enable the Linux kernel; see also kernel-rt. -packages: - - kernel - -exclude-packages: - - kernel-debug diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml deleted file mode 100644 index 9a21ff3..0000000 --- a/fedora-bootc-base/manifest.yaml +++ /dev/null @@ -1,65 +0,0 @@ - -# Modern defaults we want -boot-location: modules -tmp-is-dir: true -# https://github.com/CentOS/centos-bootc/issues/167 -machineid-compat: true -# Be minimal -recommends: false - -ignore-removed-users: - - root -ignore-removed-groups: - - root -etc-group-members: - - wheel - - sudo - - systemd-journal - - adm - -# Default to `bash` in our container, the same as other containers we ship. -container-cmd: - - /sbin/init - -# Note that the default for c9s+ is sqlite; we can't rely on rpm being -# in the target (it isn't in tier-0!) so turn this to host here. This -# does break the "hermetic build" aspect a bit. Maybe eventually -# what we should do is special case this and actually install RPM temporarily -# and then remove it... -rpmdb: host - -check-passwd: - type: "file" - filename: "passwd" -check-groups: - type: "file" - filename: "group" - -automatic-version-prefix: "${releasever}." -mutate-os-release: "${releasever}" - -remove-from-packages: - # Generally we expect other tools to do this (e.g. Ignition or cloud-init) - - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service] - # We don't want auto-generated mount units. See also - # https://github.com/systemd/systemd/issues/13099 - - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator] - -include: - - bootc.yaml - - bootupd.yaml - - ostree.yaml - - initramfs.yaml - - basic-fixes.yaml - - iot.yaml - -packages: - # needed for building derived container images - - dnf5 - # Even in tier-0, we have this. If you don't want SELinux today, you'll need - # to build a custom image. - - selinux-policy-targeted - # And we want container-selinux because trying to layer it on later currently causes issues. - - container-selinux - # Needed for tpm2 bound luks - - tpm2-tools diff --git a/fedora-bootc-base/ostree.yaml b/fedora-bootc-base/ostree.yaml deleted file mode 100644 index 6f30861..0000000 --- a/fedora-bootc-base/ostree.yaml +++ /dev/null @@ -1,17 +0,0 @@ -packages: - - ostree nss-altfiles - -# We want content lifecycled with the image -opt-usrlocal: "root" - -postprocess: - # Set up default root config - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/ostree - cat > /usr/lib/ostree/prepare-root.conf << EOF - [composefs] - enabled = yes - [sysroot] - readonly = true - EOF diff --git a/fedora-bootc-base/passwd b/fedora-bootc-base/passwd deleted file mode 100644 index ea84802..0000000 --- a/fedora-bootc-base/passwd +++ /dev/null @@ -1,32 +0,0 @@ -adm:x:3:4:adm:/var/adm:/usr/sbin/nologin -avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin -bin:x:1:1:bin:/bin:/usr/sbin/nologin -ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin -chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin -cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin -daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin -dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin -dockerroot:x:997:986:Docker User:/var/lib/docker:/usr/sbin/nologin -etcd:x:998:997:etcd user:/var/lib/etcd:/usr/sbin/nologin -ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin -games:x:12:100:games:/usr/games:/usr/sbin/nologin -halt:x:7:0:halt:/sbin:/sbin/halt -kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin -lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin -mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin -nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin -nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin -operator:x:11:0:operator:/root:/usr/sbin/nologin -polkitd:x:999:998:User for polkitd:/:/usr/sbin/nologin -root:x:0:0:Super User:/root:/bin/bash -rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin -rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin -shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown -sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin -sssd:x:995:993:User for sssd:/:/usr/sbin/nologin -sync:x:5:0:sync:/sbin:/bin/sync -systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin -systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin -systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin -systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin -tcpdump:x:72:72::/:/usr/sbin/nologin From e4bd292f1ab6ea63403b99efbe82e9c7fb47b602 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 19 Feb 2025 19:07:22 +0100 Subject: [PATCH 147/163] Whitespace & indentation cleanup --- bootupd.yaml | 4 ++-- fedora-iot.yaml | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/bootupd.yaml b/bootupd.yaml index 857de65..e15c48a 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,7 +1,7 @@ # KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml # See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml # -#Integration with https://github.com/coreos/bootupd +# Integration with https://github.com/coreos/bootupd packages: - bootupd @@ -12,7 +12,7 @@ postprocess: # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload /usr/bin/bootupctl backend generate-update-metadata - + # Enable migration to a static GRUB config install -dm0755 /usr/lib/systemd/system/bootloader-update.service.d cat > /usr/lib/systemd/system/bootloader-update.service.d/migrate-static-grub-config.conf << 'EOF' diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 2f1ddd3..7f39e3e 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,5 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot + repos: - fedora-43 From ce81f37ea5a7419a16eb03343c553129a96964c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 19 Feb 2025 19:07:37 +0100 Subject: [PATCH 148/163] ci: Add a script to help validate manifest syntax --- ci/validate | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100755 ci/validate diff --git a/ci/validate b/ci/validate new file mode 100755 index 0000000..c9e6a32 --- /dev/null +++ b/ci/validate @@ -0,0 +1,57 @@ +#!/usr/bin/python3 +# Validate basic syntax of shell script and yaml. + +import os +import stat +import subprocess +import yaml + +validated=0 + +def openat(dirfd, name, mode='r'): + def opener(path, flags): + return os.open(path, flags, dir_fd=dirfd) + return open(name, mode, opener=opener) + + +def validate_shell(rootfd, name): + subprocess.check_call(['bash', '-n', name], preexec_fn=lambda: os.fchdir(rootfd)) + global validated + validated +=1 + + +for root, dirs, files, rootfd in os.fwalk('.'): + # Skip folders that do not include content to validate + for d in ['.git', '.github', 'repo', 'cache', 'tmp', 'logs', 'fedora-comps']: + if d in dirs: + dirs.remove(d) + for f in ['.gitlab-ci.yml']: + if f in files: + files.remove(f) + for name in files: + if name.endswith(('.yaml', '.yml')): + print("Validating:", name) + with open(os.open(name, dir_fd=rootfd, flags=os.O_RDONLY)) as f: + yaml.safe_load(f) + result = subprocess.run(['grep', '-RniEv', '^( )*[a-z#/-]|^( )*\\[|^$|^#', name], encoding='UTF-8', + preexec_fn=lambda: os.fchdir(rootfd)) + if result.returncode == 0: + raise Exception("Found likely invalid indentation in YAML file: {}".format(name)) + validated +=1 + continue + elif name.endswith('.sh'): + print("Validating:", name) + validate_shell(rootfd, name) + continue + stbuf = os.lstat(name, dir_fd=rootfd) + if not stat.S_ISREG(stbuf.st_mode): + continue + if not stbuf.st_mode & stat.S_IXUSR: + continue + mimetype = subprocess.check_output(['file', '-b', '--mime-type', name], encoding='UTF-8', + preexec_fn=lambda: os.fchdir(rootfd)).strip() + if mimetype == 'text/x-shellscript': + print("Validating:", name) + validate_shell(rootfd, name) + +print(f"Validated {validated} files") From 465d88c040cc3f40e1967479f23aee90d84c0dde Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 19 Feb 2025 19:07:56 +0100 Subject: [PATCH 149/163] Add a justfile with common commands --- justfile | 156 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 156 insertions(+) create mode 100644 justfile diff --git a/justfile b/justfile new file mode 100644 index 0000000..313ea6c --- /dev/null +++ b/justfile @@ -0,0 +1,156 @@ +# This is a justfile. See https://github.com/casey/just +# This is only used for local development. The builds made on the Fedora +# infrastructure are run via Pungi in a Koji runroot. + +# Set a default for some recipes +default_variant := "fedora-iot" +default_arch := "default" +# Current default in Pungi +force_nocache := "true" + +# Just doesn't have a native dict type, but quoted bash dictionary works fine +pretty_names := '( + [fedora-iot]="IoT" +)' + +# Default is to only validate the manifests +all: validate + +# Basic validation to make sure the manifests are not completely broken +validate: + ./ci/validate + +# Output the processed manifest for a given variant (defaults to Silverblue) +manifest variant=default_variant: + #!/bin/bash + set -euo pipefail + + rpm-ostree compose tree --print-only --repo=repo {{variant}}.yaml + +# Perform dependency resolution for a given variant (defaults to Silverblue) +compose-dry-run variant=default_variant: + #!/bin/bash + set -euxo pipefail + + mkdir -p repo cache logs + if [[ ! -f "repo/config" ]]; then + pushd repo > /dev/null || exit 1 + ostree init --repo . --mode=bare-user + popd > /dev/null || exit 1 + fi + + rpm-ostree compose tree --unified-core --repo=repo --dry-run {{variant}}.yaml + +# Alias/shortcut for compose-image command +compose variant=default_variant: (compose-image variant) + +# Compose a variant using the legacy non container path (defaults to Silverblue) +compose-legacy variant=default_variant: + #!/bin/bash + set -euxo pipefail + + declare -A pretty_names={{pretty_names}} + variant={{variant}} + variant_pretty=${pretty_names[$variant]-} + if [[ -z $variant_pretty ]]; then + echo "Unknown variant" + exit 1 + fi + + ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1) + + mkdir -p repo cache logs + if [[ ! -f "repo/config" ]]; then + pushd repo > /dev/null || exit 1 + ostree init --repo . --mode=bare-user + popd > /dev/null || exit 1 + fi + # Set option to reduce fsync for transient builds + ostree --repo=repo config set 'core.fsync' 'false' + + buildid="$(date '+%Y%m%d.0')" + timestamp="$(date --iso-8601=sec)" + echo "${buildid}" > .buildid + + version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')" + echo "Composing ${variant_pretty} ${version}.${buildid} ..." + + ARGS="--repo=repo --cachedir=cache" + ARGS+=" --unified-core" + if [[ {{force_nocache}} == "true" ]]; then + ARGS+=" --force-nocache" + fi + CMD="rpm-ostree" + if [[ ${EUID} -ne 0 ]]; then + CMD="sudo rpm-ostree" + fi + + ${CMD} compose tree ${ARGS} \ + --add-metadata-string="version=${variant_pretty} ${version}.${buildid}" \ + "${variant}-ostree.yaml" \ + |& tee "logs/${variant}_${version}_${buildid}.${timestamp}.log" + + if [[ ${EUID} -ne 0 ]]; then + sudo chown --recursive "$(id --user --name):$(id --group --name)" repo cache + fi + + ostree summary --repo=repo --update + +# Compose an Ostree Native Container OCI image +compose-image variant=default_variant: + #!/bin/bash + set -euxo pipefail + + declare -A pretty_names={{pretty_names}} + variant={{variant}} + variant_pretty=${pretty_names[$variant]-} + if [[ -z $variant_pretty ]]; then + echo "Unknown variant" + exit 1 + fi + + ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1) + + mkdir -p repo cache + if [[ ! -f "repo/config" ]]; then + pushd repo > /dev/null || exit 1 + ostree init --repo . --mode=bare-user + popd > /dev/null || exit 1 + fi + # Set option to reduce fsync for transient builds + ostree --repo=repo config set 'core.fsync' 'false' + + buildid="$(date '+%Y%m%d.0')" + timestamp="$(date --iso-8601=sec)" + echo "${buildid}" > .buildid + + version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')" + echo "Composing ${variant_pretty} ${version}.${buildid} ..." + + ARGS="--cachedir=cache --initialize" + if [[ {{force_nocache}} == "true" ]]; then + ARGS+=" --force-nocache" + fi + # To debug with gdb, use: gdb --args ... + CMD="rpm-ostree" + if [[ ${EUID} -ne 0 ]]; then + CMD="sudo rpm-ostree" + fi + + ${CMD} compose image ${ARGS} \ + --label="quay.expires-after=4w" \ + "${variant}.yaml" \ + "${variant}.ociarchive" + +# Clean up everything +clean-all: + just clean-repo + just clean-cache + +# Only clean the ostree repo +clean-repo: + rm -rf ./repo + +# Only clean the package and repo caches +clean-cache: + rm -rf ./cache From c7f2ffe7cb170e0ae1180f2a10442b0718d622a2 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 17 Mar 2025 13:19:32 -0400 Subject: [PATCH 150/163] Default root config to mount sysroot as read only See: https://github.com/fedora-iot/iot-distro/issues/81 https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 ++ sysroot-ro.yaml | 15 +++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 sysroot-ro.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 1c13f3f..08e92cf 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,6 +2,8 @@ include: - bootupd.yaml # Enable composefs - composefs.yaml + # Read only sysroot + - sysroot-ro.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/sysroot-ro.yaml b/sysroot-ro.yaml new file mode 100644 index 0000000..8214f05 --- /dev/null +++ b/sysroot-ro.yaml @@ -0,0 +1,15 @@ +# Set up default root config to mount sysroot as read only +# https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot +# See: https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml +# See: https://github.com/fedora-iot/iot-distro/issues/81 + +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + install -dm 0755 -o 0 -g 0 /usr/lib/ostree + cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' + [sysroot] + readonly = true + EOF From cc96761b139c82ffa91d8271e223e2318aa78361 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 11 Aug 2025 14:25:38 -0400 Subject: [PATCH 151/163] IoT: Update rawhide for F-44 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-43.repo => fedora-44.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-43.repo => fedora-44.repo (61%) diff --git a/config.ini b/config.ini index f09325d..4dbcdf5 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f43 +release = f44 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-43.repo b/fedora-44.repo similarity index 61% rename from fedora-43.repo rename to fedora-44.repo index c510019..99cde87 100644 --- a/fedora-43.repo +++ b/fedora-44.repo @@ -1,12 +1,12 @@ -[fedora-43] -name=Fedora 43 - $basearch +[fedora-44] +name=Fedora 44 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/43/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-43&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/44/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-44&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 08e92cf..2172526 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -10,8 +10,8 @@ selinux: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '43' -mutate-os-release: '43' +automatic_version_prefix: '44' +mutate-os-release: '44' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 7f39e3e..8da9960 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -2,4 +2,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-43 +- fedora-44 From fc7be035129cd2246053197056b0dedd3de25551 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 4 Feb 2026 11:07:52 -0500 Subject: [PATCH 152/163] fix: drop ssh-key-dir Package has been deprecated in F44. See: https://github.com/coreos/ssh-key-dir/issues/188 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 2172526..116e78f 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -160,7 +160,6 @@ packages: - shadow-utils - skopeo - slirp4netns -- ssh-key-dir - sssd-client - sudo - systemd From dccd3a2e18cbe1c3e7ae121cdd738e61693043f4 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 6 Feb 2026 11:22:08 -0500 Subject: [PATCH 153/163] IoT: Update rawhide for F-45 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-44.repo => fedora-45.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-44.repo => fedora-45.repo (61%) diff --git a/config.ini b/config.ini index 4dbcdf5..2e7f7da 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f44 +release = f45 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-44.repo b/fedora-45.repo similarity index 61% rename from fedora-44.repo rename to fedora-45.repo index 99cde87..85e6dd9 100644 --- a/fedora-44.repo +++ b/fedora-45.repo @@ -1,12 +1,12 @@ -[fedora-44] -name=Fedora 44 - $basearch +[fedora-45] +name=Fedora 45 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/44/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-44&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/45/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-45&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-45-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 116e78f..6178ec3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -10,8 +10,8 @@ selinux: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '44' -mutate-os-release: '44' +automatic_version_prefix: '45' +mutate-os-release: '45' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 8da9960..4e3caeb 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -2,4 +2,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-44 +- fedora-45 From 240bff70e742b6916271144f9d61ca79bc98f24b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 10 Feb 2026 15:44:02 -0500 Subject: [PATCH 154/163] fix: add systemd-pam to fix rootless podman In Fedora 44 systemd changed systemd-pam to recommends and it was dropped from the compose. See: https://github.com/fedora-iot/iot-distro/issues/127 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 6178ec3..d159307 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -163,6 +163,7 @@ packages: - sssd-client - sudo - systemd +- systemd-pam - systemd-resolved - tar - tmux From e0898e8a38c5b9a5a9bc848bdd5cb1d6e51b600b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 15:36:39 -0500 Subject: [PATCH 155/163] fix: restore SSH key management for Ignition Configures OpenSSH to read keys from ~/.ssh/authorized_keys.d/* in addition to authorized_keys, restoring functionality lost when ssh-key-dir was removed. Follows the same approach as CoreOS: https://github.com/coreos/fedora-coreos-config/pull/3885 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 +++- sshd-authorized-keys.yaml | 21 +++++++++++++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 sshd-authorized-keys.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index d159307..329fac2 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,9 +1,11 @@ -include: +include: - bootupd.yaml # Enable composefs - composefs.yaml # Read only sysroot - sysroot-ro.yaml + # SSH authorized keys configuration for Ignition + - sshd-authorized-keys.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml new file mode 100644 index 0000000..07657bc --- /dev/null +++ b/sshd-authorized-keys.yaml @@ -0,0 +1,21 @@ +# Configuration to have OpenSSH read authorized keys from files in +# ~/.ssh/authorized_keys.d/* in addition to ~/.ssh/authorized_keys +# This enables Ignition to write keys to authorized_keys.d/ignition +# +# Replaces the deprecated ssh-key-dir package +# See: https://github.com/coreos/ssh-key-dir/issues/188 +# See: https://github.com/coreos/fedora-coreos-config/pull/3885 + +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + # Create sshd config directory if it doesn't exist + install -dm 0755 -o 0 -g 0 /etc/ssh/sshd_config.d + + # Configure sshd to read keys from authorized_keys.d directory + cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' + # Also accept keys configured by Ignition and Afterburn + AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* + EOF From 7a121ed5e79b27529a6adaa3467b3c7f97e2d1ce Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 15:52:24 -0500 Subject: [PATCH 156/163] fix: do not create etc/ssh/sshd_config.d Do not create etc/ssh/sshd_config.d, it should already exist and is owned by openssh-clients and systemd. Signed-off-by: Paul Whalen --- sshd-authorized-keys.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml index 07657bc..600321f 100644 --- a/sshd-authorized-keys.yaml +++ b/sshd-authorized-keys.yaml @@ -11,9 +11,6 @@ postprocess: #!/usr/bin/env bash set -xeuo pipefail - # Create sshd config directory if it doesn't exist - install -dm 0755 -o 0 -g 0 /etc/ssh/sshd_config.d - # Configure sshd to read keys from authorized_keys.d directory cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' # Also accept keys configured by Ignition and Afterburn From 1b3ede31d963d32f8789f6e7393d4cd19bfe60a0 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 17:04:31 -0500 Subject: [PATCH 157/163] fix: use 90- prefix for authorized-keys-file.conf Updates the config file numbering to ensure crypto policies(40) and security configs(50) are applied before user keys are sourced. Signed-off-by: Paul Whalen --- sshd-authorized-keys.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml index 600321f..4080a64 100644 --- a/sshd-authorized-keys.yaml +++ b/sshd-authorized-keys.yaml @@ -12,7 +12,7 @@ postprocess: set -xeuo pipefail # Configure sshd to read keys from authorized_keys.d directory - cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' + cat > /etc/ssh/sshd_config.d/90-authorized-keys-file.conf << 'EOF' # Also accept keys configured by Ignition and Afterburn AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* EOF From e49d841a842753be9b7d3ff0fd5dabdf38cda6f6 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 26 Feb 2026 15:07:19 -0500 Subject: [PATCH 158/163] fix: drop sshd-authorized-keys workaround Openssh config snippet now shipped with ignition. See: https://src.fedoraproject.org/rpms/ignition/pull-request/143 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 -- sshd-authorized-keys.yaml | 18 ------------------ 2 files changed, 20 deletions(-) delete mode 100644 sshd-authorized-keys.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 329fac2..ed81137 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -4,8 +4,6 @@ include: - composefs.yaml # Read only sysroot - sysroot-ro.yaml - # SSH authorized keys configuration for Ignition - - sshd-authorized-keys.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml deleted file mode 100644 index 4080a64..0000000 --- a/sshd-authorized-keys.yaml +++ /dev/null @@ -1,18 +0,0 @@ -# Configuration to have OpenSSH read authorized keys from files in -# ~/.ssh/authorized_keys.d/* in addition to ~/.ssh/authorized_keys -# This enables Ignition to write keys to authorized_keys.d/ignition -# -# Replaces the deprecated ssh-key-dir package -# See: https://github.com/coreos/ssh-key-dir/issues/188 -# See: https://github.com/coreos/fedora-coreos-config/pull/3885 - -postprocess: - - | - #!/usr/bin/env bash - set -xeuo pipefail - - # Configure sshd to read keys from authorized_keys.d directory - cat > /etc/ssh/sshd_config.d/90-authorized-keys-file.conf << 'EOF' - # Also accept keys configured by Ignition and Afterburn - AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* - EOF From ce421037460b975d95281855fb2ae9f027eba285 Mon Sep 17 00:00:00 2001 From: Joel Capitao Date: Thu, 12 Mar 2026 09:44:22 +0100 Subject: [PATCH 159/163] Remove ignition package Since [1], the ignition-edge subpackage requires ignition, so it's no longer needed to require ignition explicitly here. [1] https://src.fedoraproject.org/rpms/ignition/c/3ccce9fe2c0462f4a17923937933ab9c26db0aa5?branch=rawhide --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index ed81137..fc454fd 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -122,7 +122,6 @@ packages: - greenboot-default-health-checks - gzip - hostname -- ignition - ignition-edge - ima-evm-utils - iproute From 3738d4889fe646799213cd552c01421b5611a84f Mon Sep 17 00:00:00 2001 From: Kenneth Giusti Date: Mon, 15 Jun 2026 12:56:47 -0400 Subject: [PATCH 160/163] fix: use kmscon as default VT console The kernel console fbcon has been replaced with the userspace console kmscon in Fedora 45. See: https://github.com/fedora-iot/iot-distro/issues/137 Signed-off-by: Kenneth Giusti --- fedora-iot-base.yaml | 1 + justfile | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index fc454fd..f15f5e3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -130,6 +130,7 @@ packages: - iwlwifi-mvm-firmware - kernel - keyutils +- kmscon - less - libsss_sudo - linux-firmware diff --git a/justfile b/justfile index 313ea6c..3eaf256 100644 --- a/justfile +++ b/justfile @@ -87,7 +87,7 @@ compose-legacy variant=default_variant: ${CMD} compose tree ${ARGS} \ --add-metadata-string="version=${variant_pretty} ${version}.${buildid}" \ - "${variant}-ostree.yaml" \ + "${variant}.yaml" \ |& tee "logs/${variant}_${version}_${buildid}.${timestamp}.log" if [[ ${EUID} -ne 0 ]]; then From 63d2e9c3f52e65f502cefafb39725f4b13e8843f Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 28 Jul 2026 16:15:56 -0400 Subject: [PATCH 161/163] Update workstation-ostree-config references to Forge - bootupd.yaml: Update comment URL to atomic-desktops/config on Forge - treecompose-post.sh: Update comment URL to atomic-desktops/config on Forge Assisted-by: Claude Opus 4.6 Signed-off-by: Paul Whalen --- bootupd.yaml | 2 +- treecompose-post.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/bootupd.yaml b/bootupd.yaml index e15c48a..62ebb0d 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,5 +1,5 @@ # KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml -# See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml +# See also: https://forge.fedoraproject.org/atomic-desktops/config/src/branch/main/bootupd.yaml # # Integration with https://github.com/coreos/bootupd packages: diff --git a/treecompose-post.sh b/treecompose-post.sh index a47d8cf..e62b942 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -18,7 +18,7 @@ done # Remove loader directory causing issues in Anaconda in unified core mode # Will be obsolete once we start using bootupd -# See - https://pagure.io/workstation-ostree-config/pull-request/344 +# See - https://forge.fedoraproject.org/atomic-desktops/config/pulls/344 rm -rf /usr/lib/ostree-boot/loader # Undo RPM scripts enabling units; we want the presets to be canonical From f570c87de928f01e14722144ff3d227c151201d0 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 12 Aug 2026 10:17:54 -0400 Subject: [PATCH 162/163] Bump rawhide to Fedora 46 --- config.ini | 2 +- fedora-46.repo | 12 ++++++++++++ fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 16 insertions(+), 4 deletions(-) create mode 100644 fedora-46.repo diff --git a/config.ini b/config.ini index 2e7f7da..a91c1c6 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f45 +release = f46 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-46.repo b/fedora-46.repo new file mode 100644 index 0000000..3af8c93 --- /dev/null +++ b/fedora-46.repo @@ -0,0 +1,12 @@ +[fedora-46] +name=Fedora 46 - $basearch +failovermethod=priority +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/46/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-46&arch=$basearch +enabled=1 +#metadata_expire=7d +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch +skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index f15f5e3..79160b5 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -10,8 +10,8 @@ selinux: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '45' -mutate-os-release: '45' +automatic_version_prefix: '46' +mutate-os-release: '46' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 4e3caeb..b770dff 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -2,4 +2,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-45 +- fedora-46 From 87eaa6a42bd33968869d8f4a1cf9ef596e3ce74b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 17 Aug 2026 14:41:53 -0400 Subject: [PATCH 163/163] Update gpgkey path in fedora-46.repo, drop unused fedora-45.repo Update gpgkey path in fedora-46.repo from /etc/pki/rpm-gpg/ to /usr/share/pki/rpm-gpg/ for the F45 GPG key relocation. See: https://discussion.fedoraproject.org/t/f45-change-proposal-relocate-rpm-repo-configs-to-usr-selfcontained/188916 Remove fedora-45.repo from main (rawhide) - it belongs on f45-branch. Assisted-by: Claude Opus 4.6 Signed-off-by: Paul Whalen --- fedora-45.repo | 12 ------------ fedora-46.repo | 2 +- 2 files changed, 1 insertion(+), 13 deletions(-) delete mode 100644 fedora-45.repo diff --git a/fedora-45.repo b/fedora-45.repo deleted file mode 100644 index 85e6dd9..0000000 --- a/fedora-45.repo +++ /dev/null @@ -1,12 +0,0 @@ -[fedora-45] -name=Fedora 45 - $basearch -failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/45/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-45&arch=$basearch -enabled=1 -#metadata_expire=7d -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-45-$basearch -skip_if_unavailable=False diff --git a/fedora-46.repo b/fedora-46.repo index 3af8c93..03af70c 100644 --- a/fedora-46.repo +++ b/fedora-46.repo @@ -8,5 +8,5 @@ enabled=1 repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch +gpgkey=file:///usr/share/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch skip_if_unavailable=False