From dccd3a2e18cbe1c3e7ae121cdd738e61693043f4 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 6 Feb 2026 11:22:08 -0500 Subject: [PATCH 01/11] IoT: Update rawhide for F-45 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-44.repo => fedora-45.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-44.repo => fedora-45.repo (61%) diff --git a/config.ini b/config.ini index 4dbcdf5..2e7f7da 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f44 +release = f45 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-44.repo b/fedora-45.repo similarity index 61% rename from fedora-44.repo rename to fedora-45.repo index 99cde87..85e6dd9 100644 --- a/fedora-44.repo +++ b/fedora-45.repo @@ -1,12 +1,12 @@ -[fedora-44] -name=Fedora 44 - $basearch +[fedora-45] +name=Fedora 45 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/44/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-44&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/45/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-45&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-45-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 116e78f..6178ec3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -10,8 +10,8 @@ selinux: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '44' -mutate-os-release: '44' +automatic_version_prefix: '45' +mutate-os-release: '45' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 8da9960..4e3caeb 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -2,4 +2,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-44 +- fedora-45 From 240bff70e742b6916271144f9d61ca79bc98f24b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 10 Feb 2026 15:44:02 -0500 Subject: [PATCH 02/11] fix: add systemd-pam to fix rootless podman In Fedora 44 systemd changed systemd-pam to recommends and it was dropped from the compose. See: https://github.com/fedora-iot/iot-distro/issues/127 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 6178ec3..d159307 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -163,6 +163,7 @@ packages: - sssd-client - sudo - systemd +- systemd-pam - systemd-resolved - tar - tmux From e0898e8a38c5b9a5a9bc848bdd5cb1d6e51b600b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 15:36:39 -0500 Subject: [PATCH 03/11] fix: restore SSH key management for Ignition Configures OpenSSH to read keys from ~/.ssh/authorized_keys.d/* in addition to authorized_keys, restoring functionality lost when ssh-key-dir was removed. Follows the same approach as CoreOS: https://github.com/coreos/fedora-coreos-config/pull/3885 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 +++- sshd-authorized-keys.yaml | 21 +++++++++++++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 sshd-authorized-keys.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index d159307..329fac2 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,9 +1,11 @@ -include: +include: - bootupd.yaml # Enable composefs - composefs.yaml # Read only sysroot - sysroot-ro.yaml + # SSH authorized keys configuration for Ignition + - sshd-authorized-keys.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml new file mode 100644 index 0000000..07657bc --- /dev/null +++ b/sshd-authorized-keys.yaml @@ -0,0 +1,21 @@ +# Configuration to have OpenSSH read authorized keys from files in +# ~/.ssh/authorized_keys.d/* in addition to ~/.ssh/authorized_keys +# This enables Ignition to write keys to authorized_keys.d/ignition +# +# Replaces the deprecated ssh-key-dir package +# See: https://github.com/coreos/ssh-key-dir/issues/188 +# See: https://github.com/coreos/fedora-coreos-config/pull/3885 + +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + # Create sshd config directory if it doesn't exist + install -dm 0755 -o 0 -g 0 /etc/ssh/sshd_config.d + + # Configure sshd to read keys from authorized_keys.d directory + cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' + # Also accept keys configured by Ignition and Afterburn + AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* + EOF From 7a121ed5e79b27529a6adaa3467b3c7f97e2d1ce Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 15:52:24 -0500 Subject: [PATCH 04/11] fix: do not create etc/ssh/sshd_config.d Do not create etc/ssh/sshd_config.d, it should already exist and is owned by openssh-clients and systemd. Signed-off-by: Paul Whalen --- sshd-authorized-keys.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml index 07657bc..600321f 100644 --- a/sshd-authorized-keys.yaml +++ b/sshd-authorized-keys.yaml @@ -11,9 +11,6 @@ postprocess: #!/usr/bin/env bash set -xeuo pipefail - # Create sshd config directory if it doesn't exist - install -dm 0755 -o 0 -g 0 /etc/ssh/sshd_config.d - # Configure sshd to read keys from authorized_keys.d directory cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' # Also accept keys configured by Ignition and Afterburn From 1b3ede31d963d32f8789f6e7393d4cd19bfe60a0 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 17:04:31 -0500 Subject: [PATCH 05/11] fix: use 90- prefix for authorized-keys-file.conf Updates the config file numbering to ensure crypto policies(40) and security configs(50) are applied before user keys are sourced. Signed-off-by: Paul Whalen --- sshd-authorized-keys.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml index 600321f..4080a64 100644 --- a/sshd-authorized-keys.yaml +++ b/sshd-authorized-keys.yaml @@ -12,7 +12,7 @@ postprocess: set -xeuo pipefail # Configure sshd to read keys from authorized_keys.d directory - cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' + cat > /etc/ssh/sshd_config.d/90-authorized-keys-file.conf << 'EOF' # Also accept keys configured by Ignition and Afterburn AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* EOF From e49d841a842753be9b7d3ff0fd5dabdf38cda6f6 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 26 Feb 2026 15:07:19 -0500 Subject: [PATCH 06/11] fix: drop sshd-authorized-keys workaround Openssh config snippet now shipped with ignition. See: https://src.fedoraproject.org/rpms/ignition/pull-request/143 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 -- sshd-authorized-keys.yaml | 18 ------------------ 2 files changed, 20 deletions(-) delete mode 100644 sshd-authorized-keys.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 329fac2..ed81137 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -4,8 +4,6 @@ include: - composefs.yaml # Read only sysroot - sysroot-ro.yaml - # SSH authorized keys configuration for Ignition - - sshd-authorized-keys.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml deleted file mode 100644 index 4080a64..0000000 --- a/sshd-authorized-keys.yaml +++ /dev/null @@ -1,18 +0,0 @@ -# Configuration to have OpenSSH read authorized keys from files in -# ~/.ssh/authorized_keys.d/* in addition to ~/.ssh/authorized_keys -# This enables Ignition to write keys to authorized_keys.d/ignition -# -# Replaces the deprecated ssh-key-dir package -# See: https://github.com/coreos/ssh-key-dir/issues/188 -# See: https://github.com/coreos/fedora-coreos-config/pull/3885 - -postprocess: - - | - #!/usr/bin/env bash - set -xeuo pipefail - - # Configure sshd to read keys from authorized_keys.d directory - cat > /etc/ssh/sshd_config.d/90-authorized-keys-file.conf << 'EOF' - # Also accept keys configured by Ignition and Afterburn - AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* - EOF From ce421037460b975d95281855fb2ae9f027eba285 Mon Sep 17 00:00:00 2001 From: Joel Capitao Date: Thu, 12 Mar 2026 09:44:22 +0100 Subject: [PATCH 07/11] Remove ignition package Since [1], the ignition-edge subpackage requires ignition, so it's no longer needed to require ignition explicitly here. [1] https://src.fedoraproject.org/rpms/ignition/c/3ccce9fe2c0462f4a17923937933ab9c26db0aa5?branch=rawhide --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index ed81137..fc454fd 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -122,7 +122,6 @@ packages: - greenboot-default-health-checks - gzip - hostname -- ignition - ignition-edge - ima-evm-utils - iproute From 3738d4889fe646799213cd552c01421b5611a84f Mon Sep 17 00:00:00 2001 From: Kenneth Giusti Date: Mon, 15 Jun 2026 12:56:47 -0400 Subject: [PATCH 08/11] fix: use kmscon as default VT console The kernel console fbcon has been replaced with the userspace console kmscon in Fedora 45. See: https://github.com/fedora-iot/iot-distro/issues/137 Signed-off-by: Kenneth Giusti --- fedora-iot-base.yaml | 1 + justfile | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index fc454fd..f15f5e3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -130,6 +130,7 @@ packages: - iwlwifi-mvm-firmware - kernel - keyutils +- kmscon - less - libsss_sudo - linux-firmware diff --git a/justfile b/justfile index 313ea6c..3eaf256 100644 --- a/justfile +++ b/justfile @@ -87,7 +87,7 @@ compose-legacy variant=default_variant: ${CMD} compose tree ${ARGS} \ --add-metadata-string="version=${variant_pretty} ${version}.${buildid}" \ - "${variant}-ostree.yaml" \ + "${variant}.yaml" \ |& tee "logs/${variant}_${version}_${buildid}.${timestamp}.log" if [[ ${EUID} -ne 0 ]]; then From 63d2e9c3f52e65f502cefafb39725f4b13e8843f Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 28 Jul 2026 16:15:56 -0400 Subject: [PATCH 09/11] Update workstation-ostree-config references to Forge - bootupd.yaml: Update comment URL to atomic-desktops/config on Forge - treecompose-post.sh: Update comment URL to atomic-desktops/config on Forge Assisted-by: Claude Opus 4.6 Signed-off-by: Paul Whalen --- bootupd.yaml | 2 +- treecompose-post.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/bootupd.yaml b/bootupd.yaml index e15c48a..62ebb0d 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,5 +1,5 @@ # KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml -# See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml +# See also: https://forge.fedoraproject.org/atomic-desktops/config/src/branch/main/bootupd.yaml # # Integration with https://github.com/coreos/bootupd packages: diff --git a/treecompose-post.sh b/treecompose-post.sh index a47d8cf..e62b942 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -18,7 +18,7 @@ done # Remove loader directory causing issues in Anaconda in unified core mode # Will be obsolete once we start using bootupd -# See - https://pagure.io/workstation-ostree-config/pull-request/344 +# See - https://forge.fedoraproject.org/atomic-desktops/config/pulls/344 rm -rf /usr/lib/ostree-boot/loader # Undo RPM scripts enabling units; we want the presets to be canonical From f570c87de928f01e14722144ff3d227c151201d0 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 12 Aug 2026 10:17:54 -0400 Subject: [PATCH 10/11] Bump rawhide to Fedora 46 --- config.ini | 2 +- fedora-46.repo | 12 ++++++++++++ fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 16 insertions(+), 4 deletions(-) create mode 100644 fedora-46.repo diff --git a/config.ini b/config.ini index 2e7f7da..a91c1c6 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f45 +release = f46 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-46.repo b/fedora-46.repo new file mode 100644 index 0000000..3af8c93 --- /dev/null +++ b/fedora-46.repo @@ -0,0 +1,12 @@ +[fedora-46] +name=Fedora 46 - $basearch +failovermethod=priority +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/46/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-46&arch=$basearch +enabled=1 +#metadata_expire=7d +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch +skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index f15f5e3..79160b5 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -10,8 +10,8 @@ selinux: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '45' -mutate-os-release: '45' +automatic_version_prefix: '46' +mutate-os-release: '46' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 4e3caeb..b770dff 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -2,4 +2,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-45 +- fedora-46 From 87eaa6a42bd33968869d8f4a1cf9ef596e3ce74b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 17 Aug 2026 14:41:53 -0400 Subject: [PATCH 11/11] Update gpgkey path in fedora-46.repo, drop unused fedora-45.repo Update gpgkey path in fedora-46.repo from /etc/pki/rpm-gpg/ to /usr/share/pki/rpm-gpg/ for the F45 GPG key relocation. See: https://discussion.fedoraproject.org/t/f45-change-proposal-relocate-rpm-repo-configs-to-usr-selfcontained/188916 Remove fedora-45.repo from main (rawhide) - it belongs on f45-branch. Assisted-by: Claude Opus 4.6 Signed-off-by: Paul Whalen --- fedora-45.repo | 12 ------------ fedora-46.repo | 2 +- 2 files changed, 1 insertion(+), 13 deletions(-) delete mode 100644 fedora-45.repo diff --git a/fedora-45.repo b/fedora-45.repo deleted file mode 100644 index 85e6dd9..0000000 --- a/fedora-45.repo +++ /dev/null @@ -1,12 +0,0 @@ -[fedora-45] -name=Fedora 45 - $basearch -failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/45/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-45&arch=$basearch -enabled=1 -#metadata_expire=7d -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-45-$basearch -skip_if_unavailable=False diff --git a/fedora-46.repo b/fedora-46.repo index 3af8c93..03af70c 100644 --- a/fedora-46.repo +++ b/fedora-46.repo @@ -8,5 +8,5 @@ enabled=1 repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch +gpgkey=file:///usr/share/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch skip_if_unavailable=False