From f465587ca59f6a7ade5557cceba9b512882ca41a Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 4 Feb 2025 15:33:06 -0500 Subject: [PATCH 01/11] Setup for F-42 branched Signed-off-by: Paul Whalen --- config.ini | 4 ++-- fedora-iot-base.yaml | 2 +- fedora-iot-updates-stable.yaml | 2 +- fedora-iot-updates-testing.yaml | 2 +- fedora-iot.yaml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config.ini b/config.ini index f7e27f5..afc70c5 100644 --- a/config.ini +++ b/config.ini @@ -11,8 +11,8 @@ tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 release = f42 -ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s -yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ +ref = %(os_name)s/devel/%(arch)s/%(tree_name)s +yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/42/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot docker_os_name = fedora diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index e6358e3..d66774f 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,7 +2,7 @@ include: - bootupd.yaml # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - grub2-workaround.yaml -ref: fedora/rawhide/${basearch}/iot +ref: fedora/devel/${basearch}/iot repos: [] selinux: true ima: true diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml index 263bd4b..446cfb9 100644 --- a/fedora-iot-updates-stable.yaml +++ b/fedora-iot-updates-stable.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/updates/iot +ref: fedora/devel/${basearch}/updates/iot diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml index c6eb5a5..596961a 100644 --- a/fedora-iot-updates-testing.yaml +++ b/fedora-iot-updates-testing.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/testing/iot +ref: fedora/devel/${basearch}/testing/iot diff --git a/fedora-iot.yaml b/fedora-iot.yaml index f765bfe..133fe31 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/iot +ref: fedora/devel/${basearch}/iot repos: - fedora-42 From 87303d3fc4d226461fcfed29d876e653b7fe7d79 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 18 Feb 2025 16:36:16 -0500 Subject: [PATCH 02/11] Remove Zezere and enable systemd-firstboot Remove Zezere and enable systemd-firstboot for local configuration. See: https://fedoraproject.org/wiki/Changes/Retire_Zezere Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index d66774f..8f2837b 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -179,7 +179,6 @@ packages: - wireless-regdb - xfsprogs - xz -- zezere-ignition - zram-generator - zram-generator-defaults packages-aarch64: @@ -200,6 +199,7 @@ units: - fedora-iot-config-remote-fix.service - firewalld.service - sshd.service +- systemd-firstboot.service - greenboot-grub2-set-counter.service - greenboot-grub2-set-success.service - greenboot-healthcheck.service @@ -208,5 +208,3 @@ units: - greenboot-task-runner.service - parsec.service - dbus-parsec.service -- zezere_ignition.timer -- zezere_ignition_banner.service From 8e0acef7aaa237a349b47d89ba455ce39bb20433 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 18 Feb 2025 16:38:44 -0500 Subject: [PATCH 03/11] Drop parsec no longer supported upstream Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 8f2837b..2c2fe21 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -100,7 +100,6 @@ packages: - criu-libs - cryptsetup - curl -- dbus-parsec - dnf5 - dnf5-plugins - dosfstools @@ -146,7 +145,6 @@ packages: - openssh-server - passt - passt-selinux -- parsec - pinentry - podman - policycoreutils @@ -206,5 +204,3 @@ units: - greenboot-rpm-ostree-grub2-check-fallback.service - greenboot-status.service - greenboot-task-runner.service -- parsec.service -- dbus-parsec.service From a743314472c14fbc65e79587c1b6cf165d50f76f Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 24 Feb 2025 10:45:37 -0500 Subject: [PATCH 04/11] Disable ima in ostree due to ongoing compose issues See: https://bugzilla.redhat.com/show_bug.cgi?id=2346265 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 2c2fe21..3b7ef65 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -5,7 +5,6 @@ include: ref: fedora/devel/${basearch}/iot repos: [] selinux: true -ima: true tmp-is-dir: true recommends: false documentation: false From fdf36adb8b87012c96187afa4f348d80bbf571eb Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 27 Feb 2025 15:28:38 -0500 Subject: [PATCH 05/11] Migrate systems to a static GRUB config See: https://pagure.io/workstation-ostree-config/pull-request/591 https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops Signed-off-by: Paul Whalen --- bootupd.yaml | 25 +++++++++---------------- 1 file changed, 9 insertions(+), 16 deletions(-) diff --git a/bootupd.yaml b/bootupd.yaml index 61a6a9a..2d50c71 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -12,21 +12,14 @@ postprocess: # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload /usr/bin/bootupctl backend generate-update-metadata - # Trigger a bootloader update on boot - cat > /usr/lib/systemd/system/bootloader-update.service << 'EOF' - [Unit] - Description=Update bootloader on boot - Documentation=https://github.com/coreos/bootupd - ConditionFirmware=uefi - + # Enable migration to a static GRUB config + install -dm0755 /usr/lib/systemd/system/bootloader-update.service.d + cat > /usr/lib/systemd/system/bootloader-update.service.d/migrate-static-grub-config.conf << 'EOF' [Service] - Type=oneshot - ExecStart=/usr/bin/bootupctl update - RemainAfterExit=yes - MountFlags=slave - - [Install] - WantedBy=multi-user.target + ExecStart=/usr/bin/bootupctl migrate-static-grub-config EOF - chmod 644 /usr/lib/systemd/system/bootloader-update.service - echo "enable bootloader-update.service" > /usr/lib/systemd/system-preset/81-iot.preset \ No newline at end of file + + echo "enable bootloader-update.service" >> /usr/lib/systemd/system-preset/80-iot.preset + + # Turn permissive mode on for bootupd until all SELinux issues are fixed + semanage permissive --noreload --add bootupd_t From fa72929f397d47272d3384e1f4c64f356a9bab1f Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 27 Feb 2025 15:33:53 -0500 Subject: [PATCH 06/11] Enable composefs by default See: https://pagure.io/workstation-ostree-config/pull-request/591 https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops Signed-off-by: Paul Whalen --- composefs.yaml | 13 +++++++++++++ fedora-iot-base.yaml | 2 ++ 2 files changed, 15 insertions(+) create mode 100644 composefs.yaml diff --git a/composefs.yaml b/composefs.yaml new file mode 100644 index 0000000..1081a8c --- /dev/null +++ b/composefs.yaml @@ -0,0 +1,13 @@ +# Enable composefs +# See: https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops +# https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' + [composefs] + enabled = yes + EOF + diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 3b7ef65..2a03d17 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,6 +2,8 @@ include: - bootupd.yaml # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - grub2-workaround.yaml + # Enable composefs + - composefs.yaml ref: fedora/devel/${basearch}/iot repos: [] selinux: true From 612ca8c340b3d74aafcdeb37edb26c54cfeeb8da Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 27 Feb 2025 14:40:52 +0000 Subject: [PATCH 07/11] iot: drop kernel-tools It too should be layered, not included in the base image. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 2a03d17..49132df 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -130,7 +130,6 @@ packages: - iwd - iwlwifi-mvm-firmware - kernel -- kernel-tools - keyutils - less - libsss_sudo From a395381b71db0d820a61b1bbd4b75e867330738f Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 6 Mar 2025 14:15:03 -0500 Subject: [PATCH 08/11] Remove grub2-workaround Remove grub2-workaround.yaml, bug has been fixed. See: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 -- grub2-workaround.yaml | 22 ---------------------- 2 files changed, 24 deletions(-) delete mode 100644 grub2-workaround.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 49132df..082f292 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,7 +1,5 @@ include: - bootupd.yaml - # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - - grub2-workaround.yaml # Enable composefs - composefs.yaml ref: fedora/devel/${basearch}/iot diff --git a/grub2-workaround.yaml b/grub2-workaround.yaml deleted file mode 100644 index 3b58a9e..0000000 --- a/grub2-workaround.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# Temporarily disable new GRUB2 config options until we can ensure that we -# have an updated bootloader via bootupd. -# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 -# See: https://github.com/fedora-silverblue/issue-tracker/issues/587 -postprocess: - - | - #!/usr/bin/env bash - set -xeuo pipefail - - # Completely disable this module - sed -i '2i exit 0' /etc/grub.d/25_bli - - # Skip check that was not performed in previous Fedora versions - sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware - sed -i '/\tif/d' /etc/grub.d/30_uefi-firmware - sed -i '/\tfi/d' /etc/grub.d/30_uefi-firmware - sed -i 's/\t\t/\t/' /etc/grub.d/30_uefi-firmware - - # Verify that the content matches what we expect the file to look like. - # This will fail the build here instead of breaking users' systems. - hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b" - echo "$hash /etc/grub.d/30_uefi-firmware" | sha256sum -c From 74ff4a4e6cfc75f882ff15a1cfdf87225f87169d Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 19 Feb 2025 15:34:27 +0000 Subject: [PATCH 09/11] drop policycoreutils-python-utils in base The policycoreutils-python-utils pulls in a bunch of extra SELinux utils which aren't used in day to day, it pulls in a bunch of python packages, it can easily be layered and isn't generally needed. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 082f292..7894f08 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -146,7 +146,6 @@ packages: - pinentry - podman - policycoreutils -- policycoreutils-python-utils - polkit - procps-ng - realtek-firmware From 1ef441bdb3886a813fbb6ffb6338ded94a0d3279 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 24 Mar 2025 10:53:27 -0400 Subject: [PATCH 10/11] Default root config to mount sysroot as read only See: https://github.com/fedora-iot/iot-distro/issues/81 https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 ++ sysroot-ro.yaml | 14 ++++++++++++++ 2 files changed, 16 insertions(+) create mode 100644 sysroot-ro.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 7894f08..37cf175 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,6 +2,8 @@ include: - bootupd.yaml # Enable composefs - composefs.yaml + # Read only sysroot + - sysroot-ro.yaml ref: fedora/devel/${basearch}/iot repos: [] selinux: true diff --git a/sysroot-ro.yaml b/sysroot-ro.yaml new file mode 100644 index 0000000..46bc791 --- /dev/null +++ b/sysroot-ro.yaml @@ -0,0 +1,14 @@ +# Set up default root config to mount sysroot as read only +# See: https://github.com/fedora-iot/iot-distro/issues/81 +# https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot + +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + install -dm 0755 -o 0 -g 0 /usr/lib/ostree + cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' + [sysroot] + readonly = true + EOF From 781895866f9400302cd281b1e8751dbcfa3b3d17 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 10 Apr 2025 15:43:52 -0400 Subject: [PATCH 11/11] F42: Update for final Signed-off-by: Paul Whalen --- config.ini | 4 ++-- fedora-iot-base.yaml | 2 +- fedora-iot-updates-stable.yaml | 2 +- fedora-iot-updates-testing.yaml | 2 +- fedora-iot.yaml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config.ini b/config.ini index afc70c5..c0887d3 100644 --- a/config.ini +++ b/config.ini @@ -11,8 +11,8 @@ tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 release = f42 -ref = %(os_name)s/devel/%(arch)s/%(tree_name)s -yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/42/Everything/%(arch)s/os/ +ref = %(os_name)s/stable/%(arch)s/%(tree_name)s +yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/releases/42/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot docker_os_name = fedora diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 37cf175..b0967de 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -4,7 +4,7 @@ include: - composefs.yaml # Read only sysroot - sysroot-ro.yaml -ref: fedora/devel/${basearch}/iot +ref: fedora/stable/${basearch}/iot repos: [] selinux: true tmp-is-dir: true diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml index 446cfb9..f8d1849 100644 --- a/fedora-iot-updates-stable.yaml +++ b/fedora-iot-updates-stable.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/devel/${basearch}/updates/iot +ref: fedora/stable/${basearch}/updates/iot diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml index 596961a..11cb696 100644 --- a/fedora-iot-updates-testing.yaml +++ b/fedora-iot-updates-testing.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/devel/${basearch}/testing/iot +ref: fedora/stable/${basearch}/testing/iot diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 133fe31..b6018eb 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml -ref: fedora/devel/${basearch}/iot +ref: fedora/stable/${basearch}/iot repos: - fedora-42