Drop bash-completion due to duplicate file issue with libsecret

See: https://github.com/fedora-iot/iot-distro/issues/87

Signed-off-by: Paul Whalen <pwhalen@fedoraproject.org>

bootupd.yaml

@@ -1,3 +1,7 @@
+# KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml
+# See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml
+#
+#Integration with https://github.com/coreos/bootupd
 packages:
   - bootupd
 

composefs.yaml

@@ -0,0 +1,11 @@
+# Force disable composefs
+# See: https://github.com/ostreedev/ostree/pull/3353
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+
+    cat >> /usr/lib/ostree/prepare-root.conf << 'EOF'
+    [composefs]
+    enabled = no
+    EOF

config.ini

@@ -11,8 +11,8 @@ tree_name   = docker-host
 tree_file   = %(os_name)s-%(tree_name)s.json
 arch        = x86_64
 release     = f41
-ref         = %(os_name)s/rawhide/%(arch)s/%(tree_name)s
-yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/
+ref         = %(os_name)s/stable/%(arch)s/%(tree_name)s
+yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/releases/41/Everything/%(arch)s/os/
 # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides
 lorax_include_packages = fedora-productimg-iot
 docker_os_name = fedora

fedora-bootc-base/autoupdates.yaml

@@ -1,9 +0,0 @@
-# Enable automatic updates by default
-postprocess:
-  - |
-    #!/usr/bin/env bash
-    set -euo pipefail
-    target=/usr/lib/systemd/system/default.target.wants
-    mkdir -p $target
-    set -x
-    ln -s ../bootc-fetch-apply-updates.timer $target

fedora-bootc-base/bootc-config.yaml

@@ -1,10 +0,0 @@
-# Configuration for bootc
-postprocess:
-  # ext4 is our default filesystem in iot
-  - |
-    #!/usr/bin/env bash
-    mkdir -p /usr/lib/bootc/install/
-    cat > /usr/lib/bootc/install/20-default-root.toml << EOF
-    [install]
-    root-fs-type = "ext4"
-    EOF

fedora-bootc-base/bootupd.yaml

@@ -13,7 +13,7 @@ packages-s390x:
   # provided by s390utils-base, but soon will be -core too.
   - /usr/sbin/zipl
 packages-x86_64:
-  - grub2 grub2-efi-x64 efibootmgr shim
+  - grub2-efi-x64 efibootmgr shim
   - microcode_ctl
 
 conditional-include:

fedora-bootc-base/initramfs.yaml

@@ -6,13 +6,13 @@ postprocess:
     cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF'
     # We want a generic image; hostonly makes no sense as part of a server side build
     hostonly=no
-    dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree "
+    add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree "
     EOF
     cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF'
     # Extra modules that we want by default that are known to exist in the kernel
-    dracutmodules+=" virtiofs "
+    add_dracutmodules+=" virtiofs "
     EOF
     cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF'
     # We want this for systemd-cryptsetup tpm2 locking
-    dracutmodules+=" tpm2-tss "
+    add_dracutmodules+=" systemd-cryptsetup tpm2-tss "
     EOF

fedora-bootc-base/iot.yaml

@@ -0,0 +1,113 @@
+# Fedora IoT specific packages
+packages:
+  - fedora-release-iot
+  - aardvark-dns
+  - atheros-firmware
+  - attr
+  - authselect
+  - basesystem
+  - bash
+  - bash-completion
+  - bootc
+  - brcmfmac-firmware
+  - chrony
+  - clevis
+  - clevis-dracut
+  - clevis-luks
+  - clevis-pin-tpm2
+  - container-selinux
+  - containernetworking-plugins
+  - coreutils
+  - cracklib-dicts
+  - criu
+  - criu-libs
+  - cryptsetup
+  - curl
+  - dbus-parsec
+  - dnf5-plugins
+  - dosfstools
+  - dracut-config-generic
+  - dracut-network
+  - e2fsprogs
+  - efibootmgr
+  - fdo-client
+  - firewalld
+  - fwupd
+  - fwupd-efi
+  - fwupd-plugin-modem-manager
+  - fwupd-plugin-uefi-capsule-data
+  - glibc
+  - glibc-minimal-langpack
+  - gnupg2
+  - greenboot
+  - greenboot-default-health-checks
+  - gzip
+  - hostname
+  - ignition
+  - ima-evm-utils
+  - iproute
+  - iputils
+  - iwd
+  - iwlwifi-mvm-firmware
+  - kernel-tools
+  - keyutils
+  - less
+  - libsss_sudo
+  - linux-firmware
+  - lvm2
+  - netavark
+  - NetworkManager
+  - NetworkManager-wifi
+  - NetworkManager-wwan
+  - nss-altfiles
+  - openssl
+  - openssh-clients
+  - openssh-server
+  - passt
+  - passt-selinux
+  - parsec
+  - pinentry
+  - podman
+  - policycoreutils
+  - policycoreutils-python-utils
+  - polkit
+  - procps-ng
+  - realtek-firmware
+  - rootfiles
+  - rpm
+  - screen
+  - selinux-policy-targeted
+  - setools-console
+  - setup
+  - shadow-utils
+  - skopeo
+  - slirp4netns
+  - sssd-client
+  - sudo
+  - systemd
+  - systemd-resolved
+  - tar
+  - tmux
+  - tpm2-pkcs11
+  - traceroute
+  - usbguard
+  - util-linux
+  - vim-minimal
+  - wpa_supplicant
+  - wireless-regdb
+  - xfsprogs
+  - xz
+  - zezere-ignition
+  - zram-generator
+  - zram-generator-defaults
+packages-aarch64:
+  - arm-image-installer
+  - bcm283x-firmware
+  - grub2-efi-aa64
+  - optee_client
+  - shim-aa64
+  - uboot-images-armv8
+packages-x86_64:
+  - grub2-efi-x64
+  - microcode_ctl
+  - shim-x64

fedora-bootc-base/manifest.yaml

@@ -50,13 +50,15 @@ remove-from-packages:
 
 include:
   - bootc.yaml
+  - bootupd.yaml
   - ostree.yaml
-  - bootc-config.yaml
   - initramfs.yaml
-  - autoupdates.yaml
   - basic-fixes.yaml
+  - iot.yaml
 
 packages:
+  # needed for building derived container images
+  - dnf5
   # Even in tier-0, we have this.  If you don't want SELinux today, you'll need
   # to build a custom image.
   - selinux-policy-targeted
@@ -64,8 +66,3 @@ packages:
   - container-selinux
   # Needed for tpm2 bound luks
   - tpm2-tools
-
-# See https://github.com/coreos/bootupd
-arch-include:
-  x86_64: bootupd.yaml
-  aarch64: bootupd.yaml

fedora-bootc.yaml

@@ -1,15 +0,0 @@
-releasever: rawhide
-variables:
-  distro: "fedora"
-
-repos:
-  - fedora-rawhide
-
-metadata:
-  name: fedora-bootc
-  summary: Fedora base bootc image
-
-include:
-  - fedora-bootc-base/manifest.yaml
-  - fedora-bootc-base/kernel.yaml
-

fedora-iot-base.yaml

@@ -1,5 +1,10 @@
-include: bootupd.yaml
-ref: fedora/rawhide/${basearch}/iot
+include:
+  - bootupd.yaml
+  # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291
+  - grub2-workaround.yaml
+  # Force disable composefs
+  - composefs.yaml
+ref: fedora/stable/${basearch}/iot
 repos: []
 selinux: true
 ima: true
@@ -70,14 +75,17 @@ check-groups:
   type: file
   filename: group
 packages:
+# This list of packages should be kept in sync with
+# the iot-commit definition is osbuild, as found here:
+# https://github.com/osbuild/images/blob/0584c20b0c14a89e833b875252114ceff61805e8/pkg/distro/fedora/package_sets.go#L73
 - fedora-release-iot
+- fedora-iot-config
 - aardvark-dns
 - atheros-firmware
 - attr
 - authselect
 - basesystem
 - bash
-- bash-completion
 - bootc
 - brcmfmac-firmware
 - chrony
@@ -96,13 +104,13 @@ packages:
 - dbus-parsec
 - dnf5
 - dnf5-plugins
-- dnsmasq
 - dosfstools
 - dracut-config-generic
 - dracut-network
 - e2fsprogs
 - efibootmgr
 - fdo-client
+- fdo-owner-cli
 - firewalld
 - fwupd
 - fwupd-efi
@@ -116,6 +124,7 @@ packages:
 - gzip
 - hostname
 - ignition
+- ignition-edge
 - ima-evm-utils
 - iproute
 - iputils
@@ -155,6 +164,7 @@ packages:
 - shadow-utils
 - skopeo
 - slirp4netns
+- ssh-key-dir
 - sssd-client
 - sudo
 - systemd

fedora-iot-bootc.yaml

@@ -0,0 +1,15 @@
+releasever: 41
+variables:
+  distro: "fedora-iot"
+
+repos:
+  - fedora-41
+
+metadata:
+  name: fedora-iot-bootc-base
+  summary: Fedora IoT bootc base image
+
+include:
+  - fedora-bootc-base/manifest.yaml
+  - fedora-bootc-base/kernel.yaml
+

fedora-iot-updates-stable.yaml

@@ -1,2 +1,2 @@
 include: fedora-iot-base.yaml
-ref: fedora/rawhide/${basearch}/updates/iot
+ref: fedora/stable/${basearch}/updates/iot

fedora-iot-updates-testing.yaml

@@ -1,2 +1,2 @@
 include: fedora-iot-base.yaml
-ref: fedora/rawhide/${basearch}/testing/iot
+ref: fedora/stable/${basearch}/testing/iot

fedora-iot.yaml

@@ -1,4 +1,4 @@
 include: fedora-iot-base.yaml
-ref: fedora/rawhide/${basearch}/iot
+ref: fedora/stable/${basearch}/iot
 repos:
 - fedora-41

grub2-workaround.yaml

@@ -0,0 +1,22 @@
+# Temporarily disable new GRUB2 config options until we can ensure that we
+# have an updated bootloader via bootupd.
+# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291
+# See: https://github.com/fedora-silverblue/issue-tracker/issues/587
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+
+    # Completely disable this module
+    sed -i '2i exit 0' /etc/grub.d/25_bli
+
+    # Skip check that was not performed in previous Fedora versions
+    sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware
+    sed -i '/\tif/d'                   /etc/grub.d/30_uefi-firmware
+    sed -i '/\tfi/d'                   /etc/grub.d/30_uefi-firmware
+    sed -i 's/\t\t/\t/'                /etc/grub.d/30_uefi-firmware
+
+    # Verify that the content matches what we expect the file to look like.
+    # This will fail the build here instead of breaking users' systems.
+    hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b"
+    echo "$hash  /etc/grub.d/30_uefi-firmware" | sha256sum -c