From be50458d4c18f4d3caeb5dbf333037980ff7802b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 6 Feb 2026 11:27:00 -0500 Subject: [PATCH 1/6] Setup for F-44 branched Signed-off-by: Paul Whalen --- config.ini | 4 ++-- fedora-iot-base.yaml | 2 +- fedora-iot-updates-stable.yaml | 2 +- fedora-iot-updates-testing.yaml | 2 +- fedora-iot.yaml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config.ini b/config.ini index 4dbcdf5..21e8078 100644 --- a/config.ini +++ b/config.ini @@ -11,8 +11,8 @@ tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 release = f44 -ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s -yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ +ref = %(os_name)s/devel/%(arch)s/%(tree_name)s +yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/44/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot docker_os_name = fedora diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 116e78f..a3f95ea 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -4,7 +4,7 @@ include: - composefs.yaml # Read only sysroot - sysroot-ro.yaml -ref: fedora/rawhide/${basearch}/iot +ref: fedora/devel/${basearch}/iot repos: [] selinux: true tmp-is-dir: true diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml index 263bd4b..446cfb9 100644 --- a/fedora-iot-updates-stable.yaml +++ b/fedora-iot-updates-stable.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/updates/iot +ref: fedora/devel/${basearch}/updates/iot diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml index c6eb5a5..596961a 100644 --- a/fedora-iot-updates-testing.yaml +++ b/fedora-iot-updates-testing.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/testing/iot +ref: fedora/devel/${basearch}/testing/iot diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 8da9960..8840a0f 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,5 +1,5 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/iot +ref: fedora/devel/${basearch}/iot repos: - fedora-44 From 718f50a22c5c3801cf802f6fb697c24aac836c8a Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 10 Feb 2026 15:53:02 -0500 Subject: [PATCH 2/6] fix: add systemd-pam to fix rootless podman In Fedora 44 systemd changed systemd-pam to recommends and it was dropped from the compose. See: https://github.com/fedora-iot/iot-distro/issues/127 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index a3f95ea..defc385 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -163,6 +163,7 @@ packages: - sssd-client - sudo - systemd +- systemd-pam - systemd-resolved - tar - tmux From 750f7890701ff94f5c0942cbd2fe243aaddda2cb Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 16:43:34 -0500 Subject: [PATCH 3/6] fix: restore SSH key management for Ignition Configures OpenSSH to read keys from ~/.ssh/authorized_keys.d/* in addition to authorized_keys, restoring functionality lost when ssh-key-dir was removed. Uses 90- prefix to ensure crypto policies and security configs are applied before user keys are sourced. Follows the same approach as CoreOS: https://github.com/coreos/fedora-coreos-config/pull/3885 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 +++- sshd-authorized-keys.yaml | 18 ++++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 sshd-authorized-keys.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index defc385..857b4de 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,9 +1,11 @@ -include: +include: - bootupd.yaml # Enable composefs - composefs.yaml # Read only sysroot - sysroot-ro.yaml + # SSH authorized keys configuration for Ignition + - sshd-authorized-keys.yaml ref: fedora/devel/${basearch}/iot repos: [] selinux: true diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml new file mode 100644 index 0000000..4080a64 --- /dev/null +++ b/sshd-authorized-keys.yaml @@ -0,0 +1,18 @@ +# Configuration to have OpenSSH read authorized keys from files in +# ~/.ssh/authorized_keys.d/* in addition to ~/.ssh/authorized_keys +# This enables Ignition to write keys to authorized_keys.d/ignition +# +# Replaces the deprecated ssh-key-dir package +# See: https://github.com/coreos/ssh-key-dir/issues/188 +# See: https://github.com/coreos/fedora-coreos-config/pull/3885 + +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + # Configure sshd to read keys from authorized_keys.d directory + cat > /etc/ssh/sshd_config.d/90-authorized-keys-file.conf << 'EOF' + # Also accept keys configured by Ignition and Afterburn + AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* + EOF From fd5242392c767753e4be1b9bd9796f6548e0263f Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 26 Feb 2026 15:05:07 -0500 Subject: [PATCH 4/6] fix: drop sshd-authorized-keys workaround Openssh config snippet now shipped with ignition. See: https://src.fedoraproject.org/rpms/ignition/pull-request/143 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 -- sshd-authorized-keys.yaml | 18 ------------------ 2 files changed, 20 deletions(-) delete mode 100644 sshd-authorized-keys.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 857b4de..6004dc7 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -4,8 +4,6 @@ include: - composefs.yaml # Read only sysroot - sysroot-ro.yaml - # SSH authorized keys configuration for Ignition - - sshd-authorized-keys.yaml ref: fedora/devel/${basearch}/iot repos: [] selinux: true diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml deleted file mode 100644 index 4080a64..0000000 --- a/sshd-authorized-keys.yaml +++ /dev/null @@ -1,18 +0,0 @@ -# Configuration to have OpenSSH read authorized keys from files in -# ~/.ssh/authorized_keys.d/* in addition to ~/.ssh/authorized_keys -# This enables Ignition to write keys to authorized_keys.d/ignition -# -# Replaces the deprecated ssh-key-dir package -# See: https://github.com/coreos/ssh-key-dir/issues/188 -# See: https://github.com/coreos/fedora-coreos-config/pull/3885 - -postprocess: - - | - #!/usr/bin/env bash - set -xeuo pipefail - - # Configure sshd to read keys from authorized_keys.d directory - cat > /etc/ssh/sshd_config.d/90-authorized-keys-file.conf << 'EOF' - # Also accept keys configured by Ignition and Afterburn - AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* - EOF From 943a248a2e281b4c865d7102c8a396d6f57004e8 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 12 Mar 2026 10:12:45 -0400 Subject: [PATCH 5/6] Remove ignition from packages list Since [1], the ignition-edge subpackage requires ignition, so it's no longer needed to require ignition explicitly here. [1] https://src.fedoraproject.org/rpms/ignition/c/3ccce9fe2c0462f4a17923937933ab9c26db0aa5?branch=f44 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 6004dc7..bcda68d 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -122,7 +122,6 @@ packages: - greenboot-default-health-checks - gzip - hostname -- ignition - ignition-edge - ima-evm-utils - iproute From 44f52cc33e3fd9b3902b1e303720d370a483c8fd Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 24 Apr 2026 11:34:33 -0400 Subject: [PATCH 6/6] F-44: Update for stable Generated-by: Claude Code Signed-off-by: Paul Whalen --- config.ini | 4 ++-- fedora-iot-base.yaml | 2 +- fedora-iot-updates-stable.yaml | 2 +- fedora-iot-updates-testing.yaml | 2 +- fedora-iot.yaml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config.ini b/config.ini index 21e8078..19b955f 100644 --- a/config.ini +++ b/config.ini @@ -11,8 +11,8 @@ tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 release = f44 -ref = %(os_name)s/devel/%(arch)s/%(tree_name)s -yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/44/Everything/%(arch)s/os/ +ref = %(os_name)s/stable/%(arch)s/%(tree_name)s +yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/releases/44/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot docker_os_name = fedora diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index bcda68d..b27c919 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -4,7 +4,7 @@ include: - composefs.yaml # Read only sysroot - sysroot-ro.yaml -ref: fedora/devel/${basearch}/iot +ref: fedora/stable/${basearch}/iot repos: [] selinux: true tmp-is-dir: true diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml index 446cfb9..f8d1849 100644 --- a/fedora-iot-updates-stable.yaml +++ b/fedora-iot-updates-stable.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/devel/${basearch}/updates/iot +ref: fedora/stable/${basearch}/updates/iot diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml index 596961a..11cb696 100644 --- a/fedora-iot-updates-testing.yaml +++ b/fedora-iot-updates-testing.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/devel/${basearch}/testing/iot +ref: fedora/stable/${basearch}/testing/iot diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 8840a0f..1df1c6d 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,5 +1,5 @@ include: fedora-iot-base.yaml -ref: fedora/devel/${basearch}/iot +ref: fedora/stable/${basearch}/iot repos: - fedora-44