From ff51441ef9171cbf8645951c9cb3fda0d6f49fdf Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Mon, 28 Sep 2026 11:57:14 +0300 Subject: [PATCH 01/92] feat: add iwd notifier (#2871) Co-authored-by: renner --- .../usr/bin/aurora-iwd-deprecation-notifier | 30 +++++++++++++++++++ .../systemd/system-preset/89-aurora.preset | 1 + .../aurora-iwd-deprecation-notifier.service | 12 ++++++++ .../aurora-iwd-deprecation-notifier.timer | 12 ++++++++ 4 files changed, 55 insertions(+) create mode 100755 system_files/shared/usr/bin/aurora-iwd-deprecation-notifier create mode 100644 system_files/shared/usr/lib/systemd/system/aurora-iwd-deprecation-notifier.service create mode 100644 system_files/shared/usr/lib/systemd/system/aurora-iwd-deprecation-notifier.timer diff --git a/system_files/shared/usr/bin/aurora-iwd-deprecation-notifier b/system_files/shared/usr/bin/aurora-iwd-deprecation-notifier new file mode 100755 index 00000000..3e847acf --- /dev/null +++ b/system_files/shared/usr/bin/aurora-iwd-deprecation-notifier @@ -0,0 +1,30 @@ +#!/usr/bin/env bash + +set -euo pipefail + +TITLE="IWD Wi-Fi backend is deprecated" +MESSAGE="Intel has discontinued IWD development. Please move back to wpa_supplicant. + +Note: Reverting will require reconnecting to your Wi-Fi networks (saved passwords must be re-entered). + +To switch now, run: 'ujust toggle-iwd'" + +URL="https://docs.getaurora.dev/blog/deprecating-iwd" + +USERS="$(loginctl list-users --no-legend | awk '$1 != 0 {print $2}')" + +for username in ${USERS}; do + machinectl shell "${username}@.host" /usr/bin/bash -c ' + ACTION=$(notify-send \ + --app-name=Aurora \ + --icon=network-wireless \ + --urgency=critical \ + "$1" \ + "$2" \ + --action="open=More Info") + + if [ "$ACTION" = "open" ]; then + systemd-run --user /usr/bin/xdg-open "$3" + fi + ' _ "$TITLE" "$MESSAGE" "$URL" +done diff --git a/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset b/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset index e84b6fb1..330fc962 100644 --- a/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset +++ b/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset @@ -3,6 +3,7 @@ enable brew-setup.service enable dconf-update.service enable flatpak-preinstall.service enable input-remapper.service +enable aurora-iwd-deprecation-notifier.timer # DO NOT REMOVE THIS # see /usr/bin/rechunker-group-fix enable rechunker-group-fix.service diff --git a/system_files/shared/usr/lib/systemd/system/aurora-iwd-deprecation-notifier.service b/system_files/shared/usr/lib/systemd/system/aurora-iwd-deprecation-notifier.service new file mode 100644 index 00000000..6824db80 --- /dev/null +++ b/system_files/shared/usr/lib/systemd/system/aurora-iwd-deprecation-notifier.service @@ -0,0 +1,12 @@ +[Unit] +Description=Aurora IWD Deprecation Notifier +Documentation=https://docs.getaurora.dev/blog/deprecating-iwd +After=network.target + +[Service] +Type=oneshot +ExecCondition=/usr/bin/bash -c "/usr/bin/NetworkManager --print-config | /usr/bin/grep -q '^wifi.backend=iwd'" +ExecStart=/usr/bin/aurora-iwd-deprecation-notifier + +[Install] +WantedBy=graphical.target diff --git a/system_files/shared/usr/lib/systemd/system/aurora-iwd-deprecation-notifier.timer b/system_files/shared/usr/lib/systemd/system/aurora-iwd-deprecation-notifier.timer new file mode 100644 index 00000000..77012215 --- /dev/null +++ b/system_files/shared/usr/lib/systemd/system/aurora-iwd-deprecation-notifier.timer @@ -0,0 +1,12 @@ +[Unit] +Description=Run aurora-iwd-deprecation-notifier 20 mins after boot +Documentation=https://docs.getaurora.dev/blog/deprecating-iwd + +[Timer] +OnBootSec=20min +Unit=aurora-iwd-deprecation-notifier.service +OnUnitActiveSec=1w +Persistent=true + +[Install] +WantedBy=timers.target From 88fa66d2bce3d6196629bb2eaeaa335152c5a6d1 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 18:33:33 +0000 Subject: [PATCH 02/92] chore(deps): update quay.io/coreos/chunkah:latest docker digest to 8b56578 (#2947) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index f7dc8118..a816425e 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -21,4 +21,4 @@ images: - name: chunkah image: quay.io/coreos/chunkah tag: latest - digest: sha256:ff8b8b466a942ec6000445d4001fc661e2fc5a952ad9ee29b4de9ab09d1d1708 + digest: sha256:8b56578258d1d10d3e1c7b0f71a4d05317c5fde331c4f483576a1b60e65f0cea From 9680209dcc243f6e886f83a13d0718e39a36a148 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 29 Sep 2026 02:55:32 +0000 Subject: [PATCH 03/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 5035169 (#2950) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index a816425e..aa48a342 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:3f180f9445a00fc278397755b49bc038d51dbf9a64feecff9dc8a0e9fb0d9533 + digest: sha256:50351699b2dfa76987e82e7aa0b6bd81c6fb9d577c20fc1155d1d9818ec26e91 # https://github.com/get-aurora-dev/common - name: common From 458f8aef2230ddcff3a75d364c649509029e9bda Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Tue, 29 Sep 2026 04:58:49 +0000 Subject: [PATCH 04/92] refactor(initramfs): almost make it reproducible (#2569) If we are using the exact same ublue-os/akmods image and the same inputs for the initramfs, then it should be stable between builds, make updates smaller and allow soft-rebooting between deployments (as long as all the requirements for soft-reboot are met of course). Thanks secureblue! xref: https://github.com/ublue-os/aurora/issues/2568 --- build_scripts/base/19-initramfs.sh | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/build_scripts/base/19-initramfs.sh b/build_scripts/base/19-initramfs.sh index 10396aa5..ac287734 100755 --- a/build_scripts/base/19-initramfs.sh +++ b/build_scripts/base/19-initramfs.sh @@ -5,9 +5,32 @@ echo "::group:: ===$(basename "$0")===" set -ouex pipefail KERNEL_VERSION=$(rpm -q --queryformat="%{evr}.%{arch}" kernel-core) +INITRAMFS="/usr/lib/modules/${KERNEL_VERSION}/initramfs.img" -export DRACUT_NO_XATTR=1 -/usr/bin/dracut --kver "${KERNEL_VERSION}" --reproducible -v -f "/usr/lib/modules/${KERNEL_VERSION}/initramfs.img" -chmod 0600 "/usr/lib/modules/${KERNEL_VERSION}/initramfs.img" +# https://github.com/ublue-os/aurora/issues/2568 +# these strings change with every build +TMP_OS_RELEASE=$(mktemp --tmpdir 'os-release-XXXXXXXXXX') +OS_RELEASE="/usr/lib/os-release" +cp "${OS_RELEASE}" "${TMP_OS_RELEASE}" +sed -Ei -e '/^((OSTREE_)?(IMAGE_)?VERSION|PRETTY_NAME|BUILD_ID)=/d' "${OS_RELEASE}" + +DRACUT_NO_XATTR=1 /usr/bin/dracut \ + --kver "${KERNEL_VERSION}" \ + --reproducible \ + --verbose \ + --force \ + "${INITRAMFS}" + +# mv causes permissions to change +cp "${TMP_OS_RELEASE}" "${OS_RELEASE}" +rm "${TMP_OS_RELEASE}" + +chmod 0600 "${INITRAMFS}" + +# for reproducibility +touch -a -m -d "1970-01-01T00:00:00Z" "${INITRAMFS}" + +# for debugging +sha256sum "${INITRAMFS}" echo "::endgroup::" From a723f1eda813641f8a33dbc28e9164eab5fb4374 Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Tue, 29 Sep 2026 17:25:39 +0300 Subject: [PATCH 05/92] chore: add autoclose of issues without requested info (#2955) * chore: add autoclose of issues without requested info Same as https://github.com/get-aurora-dev/common/commit/ba6f78b1af76708b2c5b13b0de04bff9410ee00a - autocloses issues 14 days after the issue was labeled with NEEDSINFO label and now update (comment) example of it can be seen here: https://github.com/get-aurora-dev/common/issues/281 * concurrency and properly named job * make zizmor happy --------- Co-authored-by: renner --- .github/workflows/needinfo-close.yml | 36 ++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 .github/workflows/needinfo-close.yml diff --git a/.github/workflows/needinfo-close.yml b/.github/workflows/needinfo-close.yml new file mode 100644 index 00000000..46833a4f --- /dev/null +++ b/.github/workflows/needinfo-close.yml @@ -0,0 +1,36 @@ +name: Close Inactive Tagged Issues + +on: + schedule: + - cron: '0 0 * * *' # Runs daily at midnight UTC + workflow_dispatch: # Allows manual testing via the Actions tab + +concurrency: + group: ${{ github.workflow }} + cancel-in-progress: true + +permissions: {} + +jobs: + close-issues-without-info: + name: Close issues without info + runs-on: ubuntu-slim + permissions: + issues: write # posts comments on issues + steps: + - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0 + with: + # Only process issues that carry this specific label + only-issue-labels: 'NEEDSINFO' + + # By treating your tag as the stale marker, it closes after X days of inactivity + stale-issue-label: 'NEEDSINFO' + days-before-issue-stale: -1 # Prevents adding any other stale label + days-before-issue-close: 14 # Closes 14 day after the label was added with no activity + + # Prevents PRs from being processed or closed + days-before-pr-stale: -1 + days-before-pr-close: -1 + + close-issue-message: 'This issue was closed because requested info was not provided.' + close-issue-reason: 'not_planned' From 75188e997c5734a29ac7d3e44b850a03ba3a34cc Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Tue, 29 Sep 2026 17:45:51 +0000 Subject: [PATCH 06/92] chore(ci): use new self-repository syntax for workflows (#2956) See: https://docs.zizmor.sh/audits/#self-repository --- .github/workflows/build-image-latest-main.yml | 4 ++-- .github/workflows/build-image-stable.yml | 4 ++-- .github/workflows/build-image-testing.yml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build-image-latest-main.yml b/.github/workflows/build-image-latest-main.yml index 774c6846..2c8127e1 100644 --- a/.github/workflows/build-image-latest-main.yml +++ b/.github/workflows/build-image-latest-main.yml @@ -25,7 +25,7 @@ permissions: {} jobs: build-image-latest: name: Build Latest Images - uses: ./.github/workflows/reusable-build.yml + uses: $/.github/workflows/reusable-build.yml permissions: contents: read packages: write @@ -48,6 +48,6 @@ jobs: needs: [build-image-latest] permissions: contents: write - uses: ./.github/workflows/generate-release.yml + uses: $/.github/workflows/generate-release.yml with: stream_name: '["latest"]' diff --git a/.github/workflows/build-image-stable.yml b/.github/workflows/build-image-stable.yml index b02d1bd6..13f4553e 100644 --- a/.github/workflows/build-image-stable.yml +++ b/.github/workflows/build-image-stable.yml @@ -19,7 +19,7 @@ permissions: {} jobs: build-image-stable: name: Build Stable Images - uses: ./.github/workflows/reusable-build.yml + uses: $/.github/workflows/reusable-build.yml permissions: contents: read packages: write @@ -40,6 +40,6 @@ jobs: needs: [build-image-stable] permissions: contents: write - uses: ./.github/workflows/generate-release.yml + uses: $/.github/workflows/generate-release.yml with: stream_name: '["stable"]' diff --git a/.github/workflows/build-image-testing.yml b/.github/workflows/build-image-testing.yml index 5a353d54..86342554 100644 --- a/.github/workflows/build-image-testing.yml +++ b/.github/workflows/build-image-testing.yml @@ -16,7 +16,7 @@ permissions: {} jobs: build-image-testing: name: Build Testing Images - uses: ./.github/workflows/reusable-build.yml + uses: $/.github/workflows/reusable-build.yml permissions: contents: read packages: write @@ -39,6 +39,6 @@ jobs: needs: [build-image-testing] permissions: contents: write - uses: ./.github/workflows/generate-release.yml + uses: $/.github/workflows/generate-release.yml with: stream_name: '["testing"]' From dbc58acc744a9ad178f7ea2a526d65b356e57cc5 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 29 Sep 2026 19:31:25 +0000 Subject: [PATCH 07/92] chore(deps): update oras-project/setup-oras action to v2.0.2 (#2957) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/generate-release.yml | 2 +- .github/workflows/reusable-build.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml index 492f2f18..1bff0a61 100644 --- a/.github/workflows/generate-release.yml +++ b/.github/workflows/generate-release.yml @@ -48,7 +48,7 @@ jobs: just check - name: Install ORAS - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1 + uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2 - name: Generate Release Text id: generate-release-text diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 26c2e4ae..5bb6fb23 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -92,7 +92,7 @@ jobs: cosign-release: 'v3.1.3' - name: Install ORAS - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1 + uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2 - name: Check Just Syntax shell: bash From 194b4c31b15e12de85d62d9cc0c91953c8f84efc Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 30 Sep 2026 03:00:19 +0000 Subject: [PATCH 08/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to a927050 (#2959) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index aa48a342..5098552f 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:50351699b2dfa76987e82e7aa0b6bd81c6fb9d577c20fc1155d1d9818ec26e91 + digest: sha256:a9270502ab76357ac26e0969f5516ddfae0d04c730ce0043b0a27aadea0b7e80 # https://github.com/get-aurora-dev/common - name: common From 82b3cc4dc2c9079c9ceed391d605d5082a5ac4b7 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 03:12:17 +0000 Subject: [PATCH 09/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 6e09ec3 (#2962) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 5098552f..c8eea514 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:a9270502ab76357ac26e0969f5516ddfae0d04c730ce0043b0a27aadea0b7e80 + digest: sha256:6e09ec3884a8452edb43e20aa44c14b35db73a117bfa9286e14b48d4ecdcaca8 # https://github.com/get-aurora-dev/common - name: common From 9f11d650e0d6e0bf1f0e335b2183fc51b425b2a8 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 2 Oct 2026 02:59:16 +0000 Subject: [PATCH 10/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to e776108 (#2964) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index c8eea514..aa28ff34 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:6e09ec3884a8452edb43e20aa44c14b35db73a117bfa9286e14b48d4ecdcaca8 + digest: sha256:e776108216f43683dcf0982b7908f6bf85c83677645a1fed7412d7d40cd56064 # https://github.com/get-aurora-dev/common - name: common From 0ddd3ec7fcbb63bd4dc591716a2ce62b27897078 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sat, 3 Oct 2026 21:51:52 +0200 Subject: [PATCH 11/92] chore(renovate): remove Justfile custom rule (#2971) We are not using that right now in Justfiles, we should be using image-versions.yaml from the org-renovate config [1] [1] https://github.com/ublue-os/renovate-config/blob/915bbf3a9ae1fb30e50d0743b1a752e3bf3c4a0c/org-inherited-config.json --- .github/renovate.json5 | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 557a458e..6873fcd9 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -8,18 +8,6 @@ // Do not rebase when the default branch is updated "rebaseWhen": "never", - customManagers: [ - { - customType: 'regex', - managerFilePatterns: [ - '/^Justfile$/', - ], - matchStrings: [ - '(?.+?)\\s:=\\s"(?\\S+):(?\\S+)@(?sha256:[a-f0-9]+?)"', - ], - datasourceTemplate: 'docker', - }, - ], "packageRules": [ { From cfc55e14afbca3c50b01ba84d0a1904c24459808 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sat, 3 Oct 2026 21:52:25 +0200 Subject: [PATCH 12/92] feat(bootc): add enforce-container-sigpolicy for install (#2968) This is a requirement for using bootc with Anaconda or else we don't enforce signed images for subsequent updates. In the past we have used bootc switch --mutate-in-place (in combination with ostree-container which is what we are currently using for the installation media), but this no longer works with bootc for whatever reason. This doesn't seem to matter for local builds, so this is fine to just add here on the image. xref: https://github.com/get-aurora-dev/iso/pull/93 --- system_files/shared/usr/lib/bootc/install/20-aurora.toml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/system_files/shared/usr/lib/bootc/install/20-aurora.toml b/system_files/shared/usr/lib/bootc/install/20-aurora.toml index 55cc5088..0906b168 100644 --- a/system_files/shared/usr/lib/bootc/install/20-aurora.toml +++ b/system_files/shared/usr/lib/bootc/install/20-aurora.toml @@ -1,2 +1,5 @@ [install] root-fs-type = "btrfs" + +# do not remove this, this is used during the installation for signed images +enforce-container-sigpolicy = true From 4434fcf1444ba3a18a52007ee0fff901a0344500 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 4 Oct 2026 02:55:44 +0000 Subject: [PATCH 13/92] chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to f602842 (#2975) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index aa28ff34..aef85530 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -15,7 +15,7 @@ images: - name: brew image: ghcr.io/ublue-os/brew tag: latest - digest: sha256:cf6388d6edb3a6fad699f06c0ceb3807f8f1368f942b08f8cc6d45ac4fd1cd92 + digest: sha256:f6028423b2f8066ae18278e42db1a5c974e69dfd1b0746921d7ca721ba08a81d # https://github.com/coreos/chunkah - name: chunkah From 737fda57d52d7c83223deb94fda91b445c01cf88 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 4 Oct 2026 04:07:57 +0000 Subject: [PATCH 14/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to a2c6226 (#2976) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index aef85530..d1577f0d 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:e776108216f43683dcf0982b7908f6bf85c83677645a1fed7412d7d40cd56064 + digest: sha256:a2c6226e68ad584997476a314a0e80ddf176b223dcd22b288b7283da11b69865 # https://github.com/get-aurora-dev/common - name: common From b9ab984496b9f8bcddbd979846822abafb4b7b0d Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 4 Oct 2026 04:26:42 +0000 Subject: [PATCH 15/92] chore(deps): update korthout/backport-action action to v4.7.0 (#2973) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/cherry-pick-to-stable.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cherry-pick-to-stable.yml b/.github/workflows/cherry-pick-to-stable.yml index a9349185..1d173a28 100644 --- a/.github/workflows/cherry-pick-to-stable.yml +++ b/.github/workflows/cherry-pick-to-stable.yml @@ -43,7 +43,7 @@ jobs: - name: Create Backport Pull Requests id: backport - uses: korthout/backport-action@6b65649031ac6d18ffdfd0c0820e9436f3fde22b # v4.6.1 + uses: korthout/backport-action@8560fb503c275d433c56f05a2f64850093baa9f7 # v4.7.0 with: # Use the dynamically generated GitHub App token here too github_token: ${{ steps.generate-token.outputs.token }} From 71c3ca2a243b9235498b638e36674be64f9e30f4 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 4 Oct 2026 04:30:41 +0000 Subject: [PATCH 16/92] chore(ci): only run scheduled jobs in ublue-os/aurora (#2972) This is quite annoying and unneeded in forks. --- .github/workflows/needinfo-close.yml | 1 + .github/workflows/trigger-schedule-stable-image.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/needinfo-close.yml b/.github/workflows/needinfo-close.yml index 46833a4f..f9aace63 100644 --- a/.github/workflows/needinfo-close.yml +++ b/.github/workflows/needinfo-close.yml @@ -15,6 +15,7 @@ jobs: close-issues-without-info: name: Close issues without info runs-on: ubuntu-slim + if: github.repository == 'ublue-os/aurora' permissions: issues: write # posts comments on issues steps: diff --git a/.github/workflows/trigger-schedule-stable-image.yml b/.github/workflows/trigger-schedule-stable-image.yml index f5aebe5b..e88e7b34 100644 --- a/.github/workflows/trigger-schedule-stable-image.yml +++ b/.github/workflows/trigger-schedule-stable-image.yml @@ -10,6 +10,7 @@ permissions: {} jobs: trigger-stable-build: runs-on: ubuntu-slim + if: github.repository == 'ublue-os/aurora' permissions: contents: read actions: write From 176fe2479c3730855d28e3084cdd2b52cd338aa9 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 4 Oct 2026 05:01:15 +0000 Subject: [PATCH 17/92] chore(deps): update anchore/sbom-action action to v0.24.3 (#2966) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/reusable-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 5bb6fb23..04fe0613 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -186,7 +186,7 @@ jobs: - name: Setup Syft id: setup-syft if: inputs.publish - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 - name: Generate SBOM if: inputs.publish From dfd216d50c517ddaa68c4e75da34e135d1f8bec0 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 4 Oct 2026 20:36:41 +0000 Subject: [PATCH 18/92] refactor: rewrite attach SBOM in just (#2961) For consistency and debugability. --- .github/workflows/reusable-build.yml | 28 ++++++++++----------- Justfile | 37 ++++++++++++++++++++++++++++ 2 files changed, 51 insertions(+), 14 deletions(-) diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 04fe0613..0e3348be 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -404,25 +404,25 @@ jobs: run: | just login-registry oras ghcr.io - - name: Upload SBOM + - name: Attach SBOM if: inputs.publish - id: upload-sbom + id: attach-sbom env: - IMAGE: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }} + MATRIX_BASE_NAME: "${{ matrix.base_name }}" + MATRIX_STREAM_NAME: "${{ matrix.stream_name }}" + MATRIX_IMAGE_FLAVOR: "${{ matrix.image_flavor }}" DIGEST: ${{ steps.pre-push.outputs.digest }} - IMAGE_NAME: ${{ env.IMAGE_NAME }} run: | - SBOM="sbom_out/${IMAGE_NAME}/sbom.json" + set -euox pipefail - cd "$(dirname "${SBOM}")" - oras attach \ - --artifact-type application/vnd.spdx+json \ - --annotation filename=$(basename "$SBOM") \ - "${IMAGE}@${DIGEST}" \ - "$(basename ${SBOM})" - - sbom_digest=$(oras discover --format json "${IMAGE}@${DIGEST}" | jq -r '.referrers[] | select(.artifactType == "application/vnd.spdx+json") | .digest') + $(command -v just) attach-sbom \ + --image "${MATRIX_BASE_NAME}" \ + --tag "${MATRIX_STREAM_NAME}" \ + --flavor "${MATRIX_IMAGE_FLAVOR}" \ + --registry "${IMAGE_REGISTRY}" \ + --digest "${DIGEST}" + sbom_digest=$(< /tmp/sbom-digestfile) echo "sbom_digest=${sbom_digest}" >> $GITHUB_OUTPUT - name: Sign SBOM OCI Artifact @@ -431,7 +431,7 @@ jobs: COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} IMAGE_NAME: ${{ env.IMAGE_NAME }} - SBOM_DIGEST: ${{ steps.upload-sbom.outputs.sbom_digest }} + SBOM_DIGEST: ${{ steps.attach-sbom.outputs.sbom_digest }} run: | cosign sign -y --use-signing-config=false --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${SBOM_DIGEST} diff --git a/Justfile b/Justfile index f9ccfda8..9dc73031 100644 --- a/Justfile +++ b/Justfile @@ -739,6 +739,43 @@ gen-sbom $image=default_image $tag=default_tag $flavor=default_flavor $syft_cmd= rm -rf "${ROOTFS}" +# Attach sbom to exisitng image +[arg("digest", long="digest")] +[arg("flavor", long="flavor", short="f")] +[arg("image", long="image", short="i")] +[arg("registry", long="registry")] +[arg("tag", long="tag", short="t")] +[group('Utility')] +attach-sbom $image=default_image $tag=default_tag $flavor=default_flavor $registry="" $digest="": + #!/usr/bin/env bash + set -eoux pipefail + + {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}" + image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}") + + OUT_DIR="sbom_out/${image_name}" + SBOM="sbom.json" + FULL_SBOM_PATH="${OUT_DIR}/${SBOM}" + IMAGE="${registry}/${image_name}:${tag}@${digest}" + + # we need to be in the directory of the sbom json file or else we end up having the directories in the oci artifact + pushd "${OUT_DIR}" + + oras attach \ + --artifact-type application/vnd.spdx+json \ + --annotation filename="${SBOM}" \ + "${IMAGE}" \ + "${SBOM}" + + popd + + SBOM_DIGEST="$(oras discover --format json "${IMAGE}" | jq -r '.referrers[] | select(.artifactType == "application/vnd.spdx+json") | .digest')" + + echo "${SBOM_DIGEST}" > /tmp/sbom-digestfile + + # debugging + echo "oras pull ${registry}/${image_name}:${tag}@${SBOM_DIGEST}" + # We are not using https://github.com/actions/cache because of: # https://github.com/ublue-os/aurora/issues/2351 # https://github.com/actions/cache/issues/1537 From 1ba15a87a3c0ff2ddffb893a5146860029254112 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Mon, 5 Oct 2026 08:57:23 +0000 Subject: [PATCH 19/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to f1a166b (#2980) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index d1577f0d..44d0e465 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:a2c6226e68ad584997476a314a0e80ddf176b223dcd22b288b7283da11b69865 + digest: sha256:f1a166b107740b1641484ef07d1cfe514aa2b7b0b2e4d1cdbd231608d4d62b11 # https://github.com/get-aurora-dev/common - name: common From 99b6e2d63fe7c8f80ceba7a1aee2dcda9356bb50 Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:53:19 +0000 Subject: [PATCH 20/92] feat: enable native-messaging-proxy (#2984) --- build_scripts/base/01-packages.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/build_scripts/base/01-packages.sh b/build_scripts/base/01-packages.sh index 804dc538..99353288 100755 --- a/build_scripts/base/01-packages.sh +++ b/build_scripts/base/01-packages.sh @@ -98,6 +98,7 @@ FEDORA_PACKAGES=( tmux traceroute vim + xdg-native-messaging-proxy yubikey-manager zsh ) From 7c04dcf68d7e369d25351d5db85eb99a4a3e3e94 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Mon, 5 Oct 2026 15:08:05 +0000 Subject: [PATCH 21/92] chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 9350cbb (#2985) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 44d0e465..633015c9 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -9,7 +9,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:06278789114c4138d7dda9cf259f938e2a15d6ce834ff121ac8e0dbe8cf19cbe + digest: sha256:9350cbb8db3b6412c0883d377f0907c4b836c053a2ae1e75b846040f35eeb79b # https://github.com/ublue-os/brew - name: brew From 8d4c60676e8b3e358c7f531bd7777191ff2013f8 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 6 Oct 2026 02:59:00 +0000 Subject: [PATCH 22/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 39e937f (#2987) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 633015c9..055f6273 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:f1a166b107740b1641484ef07d1cfe514aa2b7b0b2e4d1cdbd231608d4d62b11 + digest: sha256:39e937fbcd4e3da6bd252d876ead4588957763159a8b279cc4ea0cd6a4294424 # https://github.com/get-aurora-dev/common - name: common From 1f30a2cae3fcd662b69d59b15e20f5d4450a8318 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 7 Oct 2026 03:08:45 +0000 Subject: [PATCH 23/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to b80dfab (#2989) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 055f6273..5cfb2895 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:39e937fbcd4e3da6bd252d876ead4588957763159a8b279cc4ea0cd6a4294424 + digest: sha256:b80dfab2e815c034b0adc9e5d284a1eff4ce9c9eaad7930f0adfbd6ffec41912 # https://github.com/get-aurora-dev/common - name: common From b6aa5812836acfd080f19edd374013862bde084f Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Wed, 7 Oct 2026 12:05:54 +0000 Subject: [PATCH 24/92] chore: enable debug on setup-cache (#2992) Caching is currently broken on f45 at least, on sundays it should make new cache --- Justfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Justfile b/Justfile index 9dc73031..604acc24 100644 --- a/Justfile +++ b/Justfile @@ -793,7 +793,7 @@ attach-sbom $image=default_image $tag=default_tag $flavor=default_flavor $regist [private] setup-cache $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="false" $pull="false" $push="false" $registry="" $github_event="": #!/usr/bin/env bash - set -eou pipefail + set -eoux pipefail image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}") From 93a0ae253d12dbb46a967fef7b4fe758c1dd27f2 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Wed, 7 Oct 2026 12:06:15 +0000 Subject: [PATCH 25/92] fix(ci): mitigate code injection in build from repo_organization (#2991) * fix(ci): mitigate code injection in build from repo_organization https://docs.github.com/en/actions/concepts/security/script-injections * make it global is pretty reusable --- .github/workflows/reusable-build.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 0e3348be..2fc1922a 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -31,6 +31,7 @@ on: env: IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }} + GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }} concurrency: group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }} @@ -142,7 +143,7 @@ jobs: MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }} run: | $(command -v just) \ - repo_organization="${{ github.repository_owner }}" \ + repo_organization="${GITHUB_REPOSITORY_OWNER}" \ build \ --image "${MATRIX_BASE_NAME}" \ --tag "${MATRIX_STREAM_NAME}" \ From fa6fea0bf68774f06c404f80dbad95a11f16bdf1 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Thu, 8 Oct 2026 03:03:54 +0000 Subject: [PATCH 26/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to f83bc05 (#2994) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 5cfb2895..0d6f6a3d 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:b80dfab2e815c034b0adc9e5d284a1eff4ce9c9eaad7930f0adfbd6ffec41912 + digest: sha256:f83bc0565f5846b89d4d3ebc136f971dfe1805945d71fdea8a0b26a7bb0230d3 # https://github.com/get-aurora-dev/common - name: common From 9e720e7188b25328d76850065a7058dd144d1674 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 03:10:41 +0000 Subject: [PATCH 27/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 9562b0b (#2996) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 0d6f6a3d..a07d34cf 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:f83bc0565f5846b89d4d3ebc136f971dfe1805945d71fdea8a0b26a7bb0230d3 + digest: sha256:9562b0bad4b686c81228f9004543d72ce2780a8dd5b69428039ba8d7b50eb35e # https://github.com/get-aurora-dev/common - name: common From 674303ff17f0f16321ba8b2c4d4920be86a5afb1 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sat, 10 Oct 2026 03:02:02 +0000 Subject: [PATCH 28/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 17110eb (#3000) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index a07d34cf..a8c4dcf2 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:9562b0bad4b686c81228f9004543d72ce2780a8dd5b69428039ba8d7b50eb35e + digest: sha256:17110ebc30e5b3740e19220b66f61f455cc8efd4c791e05ceb0e114a55f05288 # https://github.com/get-aurora-dev/common - name: common From 969ea00ce210f3b971e730deabcbbf4b504dd3c8 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sat, 10 Oct 2026 05:44:32 +0000 Subject: [PATCH 29/92] chore: get docker packages from docker-ce again (#2999) partial revert of: 70d98ffa resolves: https://github.com/ublue-os/aurora/issues/2919 --- build_scripts/dx/00-dx.sh | 29 +++++++---------------------- build_scripts/dx/10-tests-dx.sh | 9 ++++----- 2 files changed, 11 insertions(+), 27 deletions(-) diff --git a/build_scripts/dx/00-dx.sh b/build_scripts/dx/00-dx.sh index 089d0f2d..5e0a77ae 100755 --- a/build_scripts/dx/00-dx.sh +++ b/build_scripts/dx/00-dx.sh @@ -64,28 +64,13 @@ fi echo "Installing ${#FEDORA_PACKAGES[@]} DX packages from Fedora repos..." dnf5 -y install "${FEDORA_PACKAGES[@]}" -# docker is not available for f45 yet -# https://github.com/docker/docker-ce-packaging/issues/1353 -# TODO: get it from docker again once it's available -if [[ $(rpm -E %fedora) == "44" ]]; then - # Docker packages from their repo - dnf -y install --from-repo=docker-ce-stable \ - containerd.io \ - docker-buildx-plugin \ - docker-ce \ - docker-ce-cli \ - docker-compose-plugin -else - # we get this from common, the fedora package provides the exact same one - rm -f /usr/lib/sysusers.d/docker.conf - - dnf -y install \ - containerd \ - docker-buildx \ - moby-engine \ - docker-cli \ - docker-compose -fi +# Docker packages from their repo +dnf -y install --from-repo=docker-ce-stable \ + containerd.io \ + docker-buildx-plugin \ + docker-ce \ + docker-ce-cli \ + docker-compose-plugin # VSCode package from Microsoft repo dnf -y install --from-repo=code \ diff --git a/build_scripts/dx/10-tests-dx.sh b/build_scripts/dx/10-tests-dx.sh index 0436fe58..8d4a9e0c 100755 --- a/build_scripts/dx/10-tests-dx.sh +++ b/build_scripts/dx/10-tests-dx.sh @@ -6,11 +6,10 @@ set -eoux pipefail IMPORTANT_PACKAGES_DX=( code - # containerd.io - containerd - # docker-ce - # docker-buildx-plugin - # docker-compose-plugin + containerd.io + docker-ce + docker-buildx-plugin + docker-compose-plugin flatpak-builder libvirt qemu From 728717d75e97c011222b4fec69c8370793feec62 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sat, 10 Oct 2026 17:30:41 +0200 Subject: [PATCH 30/92] refactor: use dnf do for some 3rd-party repositories (#2983) In the past we have moved away from doing big dnf transactions spanning multiple rpm repositories [1] because of the associated risk of third party repos injecting packages we expect to get from Fedora. With this we explicitly set which packages are allowed to be installed from each repo. This means we still get to do big transactions which are generally faster. The downside of this is that if subpackages or dependencies from a 3rd-party repo get introduced/change then our builds will break, I think this is fine as the ones I'm changing here have been unchanging for a while. This should only touch repositories with a very specific purpose/single projects. This purposefully doesn't touch any ublue-os coprs or negativo (also they are difficult to handle as we use them in the nvidia script [2]), those are the only mono-repos so outright excluding the packages is not an easy option as we would make custom image builds (and usr-overlays for testing) more annoying. [1] https://github.com/ublue-os/aurora/issues/1115 [2] https://github.com/ublue-os/akmods/blob/1e4d10b9acb2c59da485403ccd89d689ec32e9ea/build_files/nvidia/nvidia-install.sh --- ...copr.fedorainfracloud.org:karmab:kcli.repo | 1 + .../dx/usr/share/dnf5/repos.d/docker-ce.repo | 6 ++++ .../dx/usr/share/dnf5/repos.d/vscode.repo | 1 + ...r.fedorainfracloud.org:ledif:kairpods.repo | 1 + ...edorainfracloud.org:lizardbyte:stable.repo | 1 + .../usr/share/dnf5/repos.d/tailscale.repo | 1 + build_scripts/base/01-packages.sh | 20 ++++++++----- build_scripts/dx/00-dx.sh | 28 ++++++++++--------- 8 files changed, 39 insertions(+), 20 deletions(-) diff --git a/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo b/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo index 55810d39..d23e3d84 100644 --- a/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo +++ b/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo @@ -8,3 +8,4 @@ gpgkey=https://download.copr.fedorainfracloud.org/results/karmab/kcli/pubkey.gpg repo_gpgcheck=0 enabled=0 enabled_metadata=1 +includepkgs=kcli diff --git a/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo b/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo index 27bea4ee..e370362a 100644 --- a/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo +++ b/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo @@ -1,9 +1,15 @@ +# update includepkgs, remove docker-model-plugin +# podman run --rm -ti quay.io/fedora/fedora:45 +# dnf config-manager addrepo --from-repofile https://download.docker.com/linux/fedora/docker-ce.repo +# dnf list --available --repo=docker-ce-stable | grep "docker-ce-stable" | grep -vE "(debug|devel|\.src)" | cut -f1 -d\ | sed 's/\.x86_64//' | sed 's/\.noarch//' | paste -sd " " - + [docker-ce-stable] name=Docker CE Stable - $basearch baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/stable enabled=0 gpgcheck=1 gpgkey=https://download.docker.com/linux/fedora/gpg +includepkgs=containerd.io docker-buildx-plugin docker-ce docker-ce-cli docker-ce-rootless-extras docker-compose-plugin [docker-ce-stable-source] name=Docker CE Stable - Sources diff --git a/build_files/dx/usr/share/dnf5/repos.d/vscode.repo b/build_files/dx/usr/share/dnf5/repos.d/vscode.repo index 3159383c..86e03f82 100644 --- a/build_files/dx/usr/share/dnf5/repos.d/vscode.repo +++ b/build_files/dx/usr/share/dnf5/repos.d/vscode.repo @@ -4,3 +4,4 @@ baseurl=https://packages.microsoft.com/yumrepos/vscode enabled=0 gpgcheck=1 gpgkey=https://packages.microsoft.com/keys/microsoft.asc +includepkgs=code diff --git a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo index 3ddb325a..bc84b829 100644 --- a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo +++ b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo @@ -8,3 +8,4 @@ gpgkey=https://download.copr.fedorainfracloud.org/results/ledif/kairpods/pubkey. repo_gpgcheck=0 enabled=0 enabled_metadata=1 +includepkgs=kairpods diff --git a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo index 22ae23ab..1eedbd1d 100644 --- a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo +++ b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo @@ -9,3 +9,4 @@ repo_gpgcheck=0 enabled=0 enabled_metadata=1 priority=1 +includepkgs=Sunshine diff --git a/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo b/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo index 791f20a1..1b2ef49a 100644 --- a/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo +++ b/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo @@ -6,3 +6,4 @@ type=rpm repo_gpgcheck=1 gpgcheck=1 gpgkey=https://pkgs.tailscale.com/stable/fedora/repo.gpg +includepkgs=tailscale diff --git a/build_scripts/base/01-packages.sh b/build_scripts/base/01-packages.sh index 99353288..ff75157e 100755 --- a/build_scripts/base/01-packages.sh +++ b/build_scripts/base/01-packages.sh @@ -128,9 +128,6 @@ fi dnf -y install --enablerepo='fedora-multimedia' "${PACKAGES[@]}" -# Fedora Tailscale is usually behind -dnf -y install --from-repo='tailscale-stable' tailscale - COPR_UBLUE_OS_PACKAGES=( kcm_ublue krunner-bazaar @@ -138,13 +135,22 @@ COPR_UBLUE_OS_PACKAGES=( # https://github.com/ublue-os/akmods/issues/537 ublue-os-selinux-workarounds uupd - ) +) -dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ublue-os:packages' "${COPR_UBLUE_OS_PACKAGES[@]}" +# Fedora Tailscale is usually behind +TAILSCALE=(tailscale) -dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ledif:kairpods' kairpods +COPR_PREFIX="copr:copr.fedorainfracloud.org" -dnf -y install --from-repo='copr:copr.fedorainfracloud.org:lizardbyte:stable' sunshine +dnf -y install --from-repo="${COPR_PREFIX}:ublue-os:packages" "${COPR_UBLUE_OS_PACKAGES[@]}" + +# TODO: figure something out that works well across DX, nvidia with the ublue-os coprs +# so we can have less transactions, while still not being vulnerable to copr injections +# shellcheck disable=SC1010 +dnf do -y \ + --action install --from-repo='tailscale-stable' "${TAILSCALE[@]}" \ + --action install --from-repo="${COPR_PREFIX}:ledif:kairpods" kairpods \ + --action install --from-repo="${COPR_PREFIX}:lizardbyte:stable" Sunshine # Packages to exclude - common to all versions EXCLUDED_PACKAGES=( diff --git a/build_scripts/dx/00-dx.sh b/build_scripts/dx/00-dx.sh index 5e0a77ae..634e9549 100755 --- a/build_scripts/dx/00-dx.sh +++ b/build_scripts/dx/00-dx.sh @@ -61,24 +61,26 @@ if [[ ! "${IMAGE_NAME}" =~ nvidia ]]; then FEDORA_PACKAGES+=("rocm-hip" "rocm-opencl" "rocm-smi") fi -echo "Installing ${#FEDORA_PACKAGES[@]} DX packages from Fedora repos..." dnf5 -y install "${FEDORA_PACKAGES[@]}" -# Docker packages from their repo -dnf -y install --from-repo=docker-ce-stable \ - containerd.io \ - docker-buildx-plugin \ - docker-ce \ - docker-ce-cli \ - docker-compose-plugin +# We could use Fedora's moby packages, these are "official" +DOCKER_CE=( + containerd.io + docker-buildx-plugin + docker-ce + docker-ce-cli + docker-compose-plugin +) -# VSCode package from Microsoft repo -dnf -y install --from-repo=code \ - code +COPR_PREFIX="copr:copr.fedorainfracloud.org" -dnf -y install --from-repo='copr:copr.fedorainfracloud.org:karmab:kcli' kcli +# shellcheck disable=SC1010 +dnf do -y \ + --action install --from-repo=code code \ + --action install --from-repo=docker-ce-stable "${DOCKER_CE[@]}" \ + --action install --from-repo="${COPR_PREFIX}:karmab:kcli" kcli -dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ublue-os:packages' ublue-os-libvirt-workarounds +dnf -y install --from-repo="${COPR_PREFIX}:ublue-os:packages" ublue-os-libvirt-workarounds rsync -rvK /ctx/system_files/dx/ / From 0fec9eb5219ebbb0364bd3d6a46cb9735343173d Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 11 Oct 2026 03:05:09 +0000 Subject: [PATCH 31/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to df64931 (#3008) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index a8c4dcf2..b49dfc2d 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:17110ebc30e5b3740e19220b66f61f455cc8efd4c791e05ceb0e114a55f05288 + digest: sha256:df64931a1034dd798008c8da66fb07de9140716950fe21ddb71ae4ca9a6693aa # https://github.com/get-aurora-dev/common - name: common From d665a1517c626d0b66d51c4115c8d2cb2fed0ae9 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 11 Oct 2026 03:13:43 +0000 Subject: [PATCH 32/92] chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to 31b49a6 (#3007) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index b49dfc2d..d1c79817 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -15,7 +15,7 @@ images: - name: brew image: ghcr.io/ublue-os/brew tag: latest - digest: sha256:f6028423b2f8066ae18278e42db1a5c974e69dfd1b0746921d7ca721ba08a81d + digest: sha256:31b49a6794384190add2ae54ef6bd918cc207a2a3a8e0817ac2d5bf0f0e9e709 # https://github.com/coreos/chunkah - name: chunkah From b298cef9ef2b07edfd2ecb61a129dc19673b690d Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 11 Oct 2026 08:51:19 +0300 Subject: [PATCH 33/92] chore(deps): update github/codeql-action action to v4.38.3 (main) (#3006) --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index efd33282..f34fefb4 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -71,6 +71,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard (optional). # Commenting out will disable upload of results to your repo's Code Scanning dashboard - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: results.sarif From 1e63e4b836bc2685395e50bbc56561bea02ed407 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 11 Oct 2026 05:50:21 +0000 Subject: [PATCH 34/92] chore(deps): update actions/setup-node action to v7.1.0 (#3009) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/validate-renovate.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/validate-renovate.yml b/.github/workflows/validate-renovate.yml index 945e0bd7..be0d4636 100644 --- a/.github/workflows/validate-renovate.yml +++ b/.github/workflows/validate-renovate.yml @@ -24,7 +24,7 @@ jobs: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: latest From ecaac936ff252e2a9cbfa39f2b6f766d5bd0491e Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 11 Oct 2026 05:50:46 +0000 Subject: [PATCH 35/92] chore(deps): update actions/upload-artifact action to v7.0.2 (#3005) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/reusable-build.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 2fc1922a..492ab081 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -232,7 +232,7 @@ jobs: - name: Upload OCI Archive as Artifact if: github.event_name == 'pull_request' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ env.IMAGE_NAME }}-${{ matrix.architecture }}.oci path: ${{ env.IMAGE_NAME }}-${{ matrix.architecture }}.oci diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f34fefb4..12b1cf03 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -62,7 +62,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: SARIF file path: results.sarif From 771c87e8cd9f59e029aec2bf2fd7e666e0554816 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 11 Oct 2026 15:28:06 +0000 Subject: [PATCH 36/92] feat: remove v4l2loopback from initramfs (#3002) This makes the initramfs reproducible, because currently the kmod-v4l2loopback is the only thing that is not reproducible. This is not the proper way to do this, it has to be fixed in ublue-os/akmods and see what step introduces timestamps into the build. xref: https://github.com/ublue-os/aurora/issues/2579 --- build_scripts/base/19-initramfs.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/build_scripts/base/19-initramfs.sh b/build_scripts/base/19-initramfs.sh index ac287734..fa105ab2 100755 --- a/build_scripts/base/19-initramfs.sh +++ b/build_scripts/base/19-initramfs.sh @@ -7,6 +7,14 @@ set -ouex pipefail KERNEL_VERSION=$(rpm -q --queryformat="%{evr}.%{arch}" kernel-core) INITRAMFS="/usr/lib/modules/${KERNEL_VERSION}/initramfs.img" +V4L2_PATH="$(rpm -ql kmod-v4l2loopback)" + +DRACUT_REMOVE=( + # makes no difference if in initramfs or not + # this is a hack FIXME in ublue-os/akmods + ${V4L2_PATH} # ko.kz file has build id's changing -> non-reproducible +) + # https://github.com/ublue-os/aurora/issues/2568 # these strings change with every build TMP_OS_RELEASE=$(mktemp --tmpdir 'os-release-XXXXXXXXXX') @@ -19,6 +27,7 @@ DRACUT_NO_XATTR=1 /usr/bin/dracut \ --reproducible \ --verbose \ --force \ + --remove "${DRACUT_REMOVE[@]}" \ "${INITRAMFS}" # mv causes permissions to change From 2ffc50047437e5da5caa2328d66ab042954a63f3 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 11 Oct 2026 21:15:54 +0200 Subject: [PATCH 37/92] fix(dnf-cache): trigger on correct merge_group event (#3014) merge_queue is not an event that exists --- Justfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Justfile b/Justfile index 604acc24..02ab762c 100644 --- a/Justfile +++ b/Justfile @@ -814,7 +814,7 @@ setup-cache $image=default_image $tag=default_tag $flavor=default_flavor $ghcr=" BLESSED_DAY="Sunday" # Always attempt to pull cache, but don't on the first run that will publish the build on Sundays - if [[ "${CURRENT_DAY}" == "${BLESSED_DAY}" && "$POINT" == "1" && "${ghcr}" == "true" && ( "${github_event}" == "workflow_dispatch" || "${github_event}" == "merge_queue" ) ]]; then + if [[ "${CURRENT_DAY}" == "${BLESSED_DAY}" && "$POINT" == "1" && "${ghcr}" == "true" && ( "${github_event}" == "workflow_dispatch" || "${github_event}" == "merge_group" ) ]]; then echo "Not pulling build cache. Uploading fresh cache later." elif [[ "${pull}" == "true" ]]; then # We want to avoid using --allow-path-traversal @@ -829,7 +829,7 @@ setup-cache $image=default_image $tag=default_tag $flavor=default_flavor $ghcr=" [[ "${ghcr}" == "true" ]] && \ [[ "${CURRENT_DAY}" == "${BLESSED_DAY}" ]] && \ [[ "${POINT}" == "1" ]] && \ - [[ ( "${github_event}" == "workflow_dispatch" || "${github_event}" == "merge_queue" ) ]]; then + [[ ( "${github_event}" == "workflow_dispatch" || "${github_event}" == "merge_group" ) ]]; then {{ just }} login-registry oras ghcr.io pushd "${BUILDAH_CACHE_DIR}" From c4c32765892ab046390c570e2d9802ee69480143 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 11 Oct 2026 21:20:39 +0000 Subject: [PATCH 38/92] chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 409899f (#3016) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index d1c79817..bde7b5ed 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -9,7 +9,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:9350cbb8db3b6412c0883d377f0907c4b836c053a2ae1e75b846040f35eeb79b + digest: sha256:409899f9bcf98b16c6c4f671fd7988406132be53dfadf8da55d5f985ccd00948 # https://github.com/ublue-os/brew - name: brew From 25f575e922a5bef6cbafdebbbad13cf8c7ae9de9 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Mon, 12 Oct 2026 05:12:23 +0000 Subject: [PATCH 39/92] chore: use new syntax for disabling/enabling repos (#3015) See [1] [1] https://fosstodon.org/@carlwgeorge/116489160183936662 --- build_scripts/shared/build-prep.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build_scripts/shared/build-prep.sh b/build_scripts/shared/build-prep.sh index a20ef344..f86c5158 100755 --- a/build_scripts/shared/build-prep.sh +++ b/build_scripts/shared/build-prep.sh @@ -24,7 +24,7 @@ dnf config-manager setopt fedora-multimedia.priority=90 # https://fedoraproject.org/wiki/OpenH264 # this would be fine to use as well, negativo just has it, one less repo -dnf config-manager setopt fedora-cisco-openh264.enabled=0 +dnf config-manager disable fedora-cisco-openh264 mkdir -p /tmp/scripts/helpers install -Dm0755 /ctx/build_scripts/shared/utils/ghcurl /tmp/scripts/helpers/ghcurl From 7b22717d3aa0321a16548a9549e55884ff25be3d Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Mon, 12 Oct 2026 05:13:30 +0000 Subject: [PATCH 40/92] feat: default to testing branch for local builds (#3017) This makes way more sense, nobody who builds a local image wants to use a potentially older fedora release, especially on the same branch, this is also a mismatch between what is built in CI as that builds from a stable branch instead of main. --- Justfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Justfile b/Justfile index 02ab762c..256881c6 100644 --- a/Justfile +++ b/Justfile @@ -24,7 +24,7 @@ tags := '( )' default_image := "aurora" -default_tag := "latest" +default_tag := "testing" default_flavor := "main" # Build Containers From 40f881f2ddac6a66b803902d95025cfac6a3ac9d Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Mon, 12 Oct 2026 05:15:00 +0000 Subject: [PATCH 41/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to ee562fe (#3018) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index bde7b5ed..44b2294e 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:df64931a1034dd798008c8da66fb07de9140716950fe21ddb71ae4ca9a6693aa + digest: sha256:ee562fe2520b96368567e386268c56110f2f770a309b037ab3fe131752b3b2ba # https://github.com/get-aurora-dev/common - name: common From 0e470b0179b7f530acd01622e3f71dec27ac0a54 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 13 Oct 2026 03:13:24 +0000 Subject: [PATCH 42/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to d2a26a0 (#3022) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 44b2294e..b3eae86b 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:ee562fe2520b96368567e386268c56110f2f770a309b037ab3fe131752b3b2ba + digest: sha256:d2a26a0f902dab10a7550c8993370a065ccff7e68baec59ce30ee96a715bd162 # https://github.com/get-aurora-dev/common - name: common From 0d9a7d4e81a48e84e0ab019b3cd83e7110124c7c Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Tue, 13 Oct 2026 04:51:14 +0000 Subject: [PATCH 43/92] chore(just): delete rpm-ostree rechunker (#3021) Chunkah is overall better and the future of the ecosystem, we will absolutely not be going back. --- Justfile | 64 -------------------------------------------------------- 1 file changed, 64 deletions(-) diff --git a/Justfile b/Justfile index 256881c6..323fb0ea 100644 --- a/Justfile +++ b/Justfile @@ -345,70 +345,6 @@ rechunk $image=default_image $tag=default_tag $flavor=default_flavor: CHUNKED_IMAGE="$(podman pull "oci:${CHUNKAH_OUTPUT_DIR}/chunked")" podman tag "${CHUNKED_IMAGE}" "${image_name}:${tag}" -# build-chunked-oci -[arg("flavor", long="flavor", short="f")] -[arg("ghcr", long="ghcr", value="true")] -[arg("image", long="image", short="i")] -[arg("previous_build", long="previous-build", value="true")] -[arg("tag", long="tag", short="t")] -[group('Image')] -ostree-rechunk $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="false" $previous_build="false": - #!/usr/bin/env bash - set -eoux pipefail - - {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}" - image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}") - fedora_version=$({{ just }} fedora_version --image "${image}" --tag "${tag}" --flavor "${flavor}") - - if [[ "{{ ghcr }}" == "false" ]]; then - {{ just }} load-rootful --image "${image}" --tag "${tag}" --flavor "${flavor}" - fi - - # TODO: Redo everything here with --previous-build in rpm-ostree 2026.1+ - # so we don't have to pull an old image + rename it - if [[ "${previous_build}" == "true" ]]; then - PREVIOUS_IMAGE=ghcr.io/{{ repo_organization }}/"${image_name}":"${tag}" - - # https://github.com/coreos/rpm-ostree/blob/7e2f2065a4aa4d5965b4537bb7d74e0b2898650e/rust/src/compose.rs#L522-L529 - if skopeo inspect docker://"${PREVIOUS_IMAGE}" | jq -e '.LayersData[1:] | all(.Annotations?["ostree.components"]?)'; then - ${SUDOIF} ${PODMAN} pull ${PREVIOUS_IMAGE} - else - echo "${PREVIOUS_IMAGE} doesn't exist. Making a fresh layer Plan instead." - fi - fi - - if [[ "${ghcr}" == "true" ]]; then - CHUNKED_IMAGE="${image_name}:${tag}" - if [[ "${previous_build}" == "true" ]]; then - CHUNKED_IMAGE="${PREVIOUS_IMAGE}" - fi - else - # keep the original unrechunked image for local builds - CHUNKED_IMAGE="${image_name}:${tag}-chunked" - fi - - # 96 layers, conservative default, same what ci-test is using - # one layer is secretly being added for the ostree export - # 499 is podman run limit - # 128 is docker pull limit - ${SUDOIF} ${PODMAN} run --rm \ - --privileged \ - -v "/var/lib/containers:/var/lib/containers" \ - --entrypoint /usr/bin/rpm-ostree \ - "${base_image_org}/${base_image_name}:${fedora_version}" \ - compose build-chunked-oci \ - --max-layers 127 \ - --format-version=2 \ - --bootc \ - --from "localhost/${image_name}:${tag}" \ - --output containers-storage:${CHUNKED_IMAGE} - - # rename the image to localhost - if [[ "${ghcr}" == "true" && "${previous_build}" == "true" ]]; then - ${SUDOIF} ${PODMAN} tag ${CHUNKED_IMAGE} "${image_name}:${tag}" - ${SUDOIF} ${PODMAN} image rm -f ${CHUNKED_IMAGE} - fi - # For Privileged operations [arg("flavor", long="flavor", short="f")] [arg("image", long="image", short="i")] From 25e7a6252beed9de69f8890062e9aabda42c0841 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 03:14:57 +0000 Subject: [PATCH 44/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to dae4ec2 (#3026) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index b3eae86b..bacdfc27 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:d2a26a0f902dab10a7550c8993370a065ccff7e68baec59ce30ee96a715bd162 + digest: sha256:dae4ec21e67aa847443c34b575e8adea680655f7bf76035ae8c4e37854493bbf # https://github.com/get-aurora-dev/common - name: common From 7d7c48188199ac2292b9b7c721e9722f4074dea7 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Wed, 14 Oct 2026 16:19:20 +0000 Subject: [PATCH 45/92] refactor: get uupd and nerdfonts-symbols from terra (#3025) reasons stated in URL below resolves: https://github.com/ublue-os/aurora/issues/3024 --- .../shared/usr/share/dnf5/repos.d/terra.repo | 25 +++++++++++++++++++ build_scripts/base/01-packages.sh | 13 +++++++--- build_scripts/base/03-fetch.sh | 7 ------ build_scripts/shared/build-prep.sh | 2 +- build_scripts/shared/chunkah-xattr.sh | 3 --- 5 files changed, 36 insertions(+), 14 deletions(-) create mode 100644 build_files/shared/usr/share/dnf5/repos.d/terra.repo diff --git a/build_files/shared/usr/share/dnf5/repos.d/terra.repo b/build_files/shared/usr/share/dnf5/repos.d/terra.repo new file mode 100644 index 00000000..c2b290ec --- /dev/null +++ b/build_files/shared/usr/share/dnf5/repos.d/terra.repo @@ -0,0 +1,25 @@ +[terra] +name=Terra $releasever +# disable mirrors because they are very flakey +baseurl=https://repos.fyralabs.com/terra$releasever +# metalink=https://tetsudou.fyralabs.com/metalink?repo=terra$releasever&arch=$basearch +metadata_expire=6h +type=rpm +gpgcheck=1 +gpgkey=https://repos.fyralabs.com/terra$releasever/key.asc +repo_gpgcheck=1 +enabled=0 +enabled_metadata=1 +countme=1 + +[terra-source] +name=Terra $releasever - Source +baseurl=https://repos.fyralabs.com/terra$releasever-source +# metalink=https://tetsudou.fyralabs.com/metalink?repo=terra$releasever-source&arch=$basearch +metadata_expire=6h +type=rpm +gpgcheck=1 +gpgkey=https://repos.fyralabs.com/terra$releasever/key.asc +repo_gpgcheck=1 +enabled=0 +enabled_metadata=0 diff --git a/build_scripts/base/01-packages.sh b/build_scripts/base/01-packages.sh index ff75157e..1b131684 100755 --- a/build_scripts/base/01-packages.sh +++ b/build_scripts/base/01-packages.sh @@ -134,12 +134,19 @@ COPR_UBLUE_OS_PACKAGES=( oversteer-udev # https://github.com/ublue-os/akmods/issues/537 ublue-os-selinux-workarounds - uupd +) +TERRA_PACKAGES=( + # our auto-updater + uupd + # used in motd, in general useful to have + nerdfontssymbolsonly-nerd-fonts ) # Fedora Tailscale is usually behind TAILSCALE=(tailscale) +dnf -y install --from-repo="terra" "${TERRA_PACKAGES[@]}" + COPR_PREFIX="copr:copr.fedorainfracloud.org" dnf -y install --from-repo="${COPR_PREFIX}:ublue-os:packages" "${COPR_UBLUE_OS_PACKAGES[@]}" @@ -148,9 +155,9 @@ dnf -y install --from-repo="${COPR_PREFIX}:ublue-os:packages" "${COPR_UBLUE_OS_P # so we can have less transactions, while still not being vulnerable to copr injections # shellcheck disable=SC1010 dnf do -y \ - --action install --from-repo='tailscale-stable' "${TAILSCALE[@]}" \ --action install --from-repo="${COPR_PREFIX}:ledif:kairpods" kairpods \ - --action install --from-repo="${COPR_PREFIX}:lizardbyte:stable" Sunshine + --action install --from-repo="${COPR_PREFIX}:lizardbyte:stable" Sunshine \ + --action install --from-repo='tailscale-stable' "${TAILSCALE[@]}" # Packages to exclude - common to all versions EXCLUDED_PACKAGES=( diff --git a/build_scripts/base/03-fetch.sh b/build_scripts/base/03-fetch.sh index 0a6877b9..1de77dea 100755 --- a/build_scripts/base/03-fetch.sh +++ b/build_scripts/base/03-fetch.sh @@ -20,13 +20,6 @@ curl -X 'GET' \ 'https://flathub.org/api/v2/stats/io.github.kolunmi.Bazaar?all=false&days=1' \ -H 'accept: application/json' | jq -r ".installs_last_7_days" | numfmt --to=si --round=nearest > /usr/share/ublue-os/bazaar-install-count -# Nerdfont symbols -# to fix motd and prompt atleast temporarily -ghcurl "https://github.com/ryanoasis/nerd-fonts/releases/latest/download/NerdFontsSymbolsOnly.zip" --retry 3 -o /tmp/nerdfontsymbols.zip -unzip /tmp/nerdfontsymbols.zip -d /tmp -mkdir -p /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/ -mv /tmp/SymbolsNerdFont*.ttf /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/ - # Bash Preexec v0.6.0 ghcurl https://raw.githubusercontent.com/rcaloras/bash-preexec/b73ed5f7f953207b958f15b1773721dded697ac3/bash-preexec.sh --retry 3 -Lo /usr/share/bash-preexec diff --git a/build_scripts/shared/build-prep.sh b/build_scripts/shared/build-prep.sh index f86c5158..7f61521e 100755 --- a/build_scripts/shared/build-prep.sh +++ b/build_scripts/shared/build-prep.sh @@ -4,7 +4,7 @@ set -eoux pipefail -# Speeds up local builds and workaround network flakes, mainly for COPR and negativo +# Speeds up local builds and workaround network flakes, mainly for COPR, negativo and terra cp /etc/dnf/dnf.conf /etc/dnf/dnf.conf.bak dnf config-manager setopt keepcache=1 timeout=60 diff --git a/build_scripts/shared/chunkah-xattr.sh b/build_scripts/shared/chunkah-xattr.sh index 2fd36e11..8a9b4e41 100755 --- a/build_scripts/shared/chunkah-xattr.sh +++ b/build_scripts/shared/chunkah-xattr.sh @@ -18,9 +18,6 @@ setfattr -n user.component -v "homebrew" /usr/share/homebrew.tar.zst setfattr -n user.component -v "aurora-offline-docs" /usr/share/doc/aurora/aurora.pdf -setfattr -n user.component -v "nerdfonts" /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly -setfattr -n user.update-interval -v "yearly" /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly - setfattr -n user.component -v "aurora-config" /usr/lib/systemd/system-generators/coreos-sulogin-force-generator setfattr -n user.component -v "aurora-config" /usr/share/bash-preexec From fa7f65cc6849e6fa2a589518ba33fa223f04d7bd Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Thu, 15 Oct 2026 03:17:47 +0000 Subject: [PATCH 46/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 188e25d (#3030) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index bacdfc27..10f7da22 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:dae4ec21e67aa847443c34b575e8adea680655f7bf76035ae8c4e37854493bbf + digest: sha256:188e25ddfb597da6ff1084e57e02fbf039696b30b311018cc6206ae0332f79b3 # https://github.com/get-aurora-dev/common - name: common From 1476a9093d85897bdc5c92e652baa49190750cbc Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Thu, 15 Oct 2026 15:18:36 +0200 Subject: [PATCH 47/92] fix(build-prep): put shebang in first line (#3033) shellcheck complains about this --- build_scripts/shared/build-prep.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/build_scripts/shared/build-prep.sh b/build_scripts/shared/build-prep.sh index 7f61521e..0e00be92 100755 --- a/build_scripts/shared/build-prep.sh +++ b/build_scripts/shared/build-prep.sh @@ -1,6 +1,5 @@ -# This script should generally set up the build so we can move on to start installing packages - #!/usr/bin/bash +# This script should generally set up the build so we can move on to start installing packages set -eoux pipefail From 93dd586b9f7cdc213b619a6d1b6179bdd984ddc6 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Thu, 15 Oct 2026 16:34:21 +0000 Subject: [PATCH 48/92] chore(deps): update quay.io/coreos/chunkah:latest docker digest to 71e5934 (#3034) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 10f7da22..7a07844c 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -21,4 +21,4 @@ images: - name: chunkah image: quay.io/coreos/chunkah tag: latest - digest: sha256:8b56578258d1d10d3e1c7b0f71a4d05317c5fde331c4f483576a1b60e65f0cea + digest: sha256:71e593421c5de7dcc7c8c5c50e98d3bac572055a76f399f61a491d123c20a523 From 2ae50c039265276a712ea63857c2c95893ddeb44 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 03:16:04 +0000 Subject: [PATCH 49/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 3ba8aae (#3035) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 7a07844c..d8c666e6 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:188e25ddfb597da6ff1084e57e02fbf039696b30b311018cc6206ae0332f79b3 + digest: sha256:3ba8aaeaf4ab29cad3f86ed9ae23690b73a197717de25050dfdf56537b4964dd # https://github.com/get-aurora-dev/common - name: common From 3ef1256cd3c3878ab2d10a3efee5619e6d5e15b1 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Fri, 16 Oct 2026 07:11:44 +0000 Subject: [PATCH 50/92] feat: timestamp all files with epoch 0 (#3028) * feat: timestamp all files with epoch 0 We have been using this chunkah feature [1] to put non-rpm content like the brew tarball in dedicated layers, we didn't actually save any bandwith on downloads with this as the copying sets the file modification and access time. Which makes it non-reproducible and every single update would re-download everything not in RPMs. This should make updates smaller especially noticeable on daily/multiple daily image builds. I'm not sure how much of a positive effect this is gonna have on the stable weekly images as the brew tarball is refreshed weekly. Things like the wallpapers should at least no longer be downloaded when they haven't changed. There are still some files we could do but I think it's mostly not worth it. xref: https://github.com/ublue-os/aurora/issues/2579 [1] https://github.com/coreos/chunkah#customizing-the-layers * typo Co-authored-by: Adam Fidel --------- Co-authored-by: Adam Fidel --- Containerfile.in | 2 +- build_scripts/base/19-initramfs.sh | 3 +- build_scripts/shared/chunkah-xattr.sh | 23 ----------- build_scripts/shared/unpackaged.sh | 56 +++++++++++++++++++++++++++ 4 files changed, 59 insertions(+), 25 deletions(-) delete mode 100755 build_scripts/shared/chunkah-xattr.sh create mode 100755 build_scripts/shared/unpackaged.sh diff --git a/Containerfile.in b/Containerfile.in index f378cf2e..5441968a 100644 --- a/Containerfile.in +++ b/Containerfile.in @@ -94,7 +94,7 @@ RUN --network=none \ /ctx/build_scripts/base/18-image-info.sh && \ /ctx/build_scripts/base/19-initramfs.sh && \ /ctx/build_scripts/shared/clean-stage.sh && \ - /ctx/build_scripts/shared/chunkah-xattr.sh && \ + /ctx/build_scripts/shared/unpackaged.sh && \ /ctx/build_scripts/base/20-tests.sh CMD ["/sbin/init"] diff --git a/build_scripts/base/19-initramfs.sh b/build_scripts/base/19-initramfs.sh index fa105ab2..7d97726e 100755 --- a/build_scripts/base/19-initramfs.sh +++ b/build_scripts/base/19-initramfs.sh @@ -37,7 +37,8 @@ rm "${TMP_OS_RELEASE}" chmod 0600 "${INITRAMFS}" # for reproducibility -touch -a -m -d "1970-01-01T00:00:00Z" "${INITRAMFS}" +# This is done globally now +# touch -a -m -d "1970-01-01T00:00:00Z" "${INITRAMFS}" # for debugging sha256sum "${INITRAMFS}" diff --git a/build_scripts/shared/chunkah-xattr.sh b/build_scripts/shared/chunkah-xattr.sh deleted file mode 100755 index 8a9b4e41..00000000 --- a/build_scripts/shared/chunkah-xattr.sh +++ /dev/null @@ -1,23 +0,0 @@ -# See: https://github.com/coreos/chunkah#customizing-the-layers -#!/usr/bin/env bash - -set -eoux pipefail - -setfattr -n user.component -v "aurora-wallpapers" /usr/share/backgrounds/aurora -setfattr -n user.update-interval -v "monthly" /usr/share/backgrounds/aurora - -setfattr -n user.component -v "aurora-assets" /usr/share/plasma/avatars/{echo,lumina,scope,tina,vincent}.png -setfattr -n user.component -v "aurora-assets" /etc/bazaar/*.jxl -setfattr -n user.update-interval -v "quarterly" /etc/bazaar/*.jxl - -setfattr -n user.component -v "aurora-plasma-theme" /usr/share/plasma/look-and-feel/dev.getaurora.aurora{,light}.desktop -setfattr -n user.update-interval -v "quarterly" /usr/share/plasma/look-and-feel/dev.getaurora.aurora{,light}.desktop - -setfattr -n user.component -v "aurora-config" /usr/share/ublue-os -setfattr -n user.component -v "homebrew" /usr/share/homebrew.tar.zst - -setfattr -n user.component -v "aurora-offline-docs" /usr/share/doc/aurora/aurora.pdf - -setfattr -n user.component -v "aurora-config" /usr/lib/systemd/system-generators/coreos-sulogin-force-generator - -setfattr -n user.component -v "aurora-config" /usr/share/bash-preexec diff --git a/build_scripts/shared/unpackaged.sh b/build_scripts/shared/unpackaged.sh new file mode 100755 index 00000000..a450ce42 --- /dev/null +++ b/build_scripts/shared/unpackaged.sh @@ -0,0 +1,56 @@ +#!/usr/bin/env bash +# See: https://github.com/coreos/chunkah#customizing-the-layers +echo "::group:: ===$(basename "$0")===" + +set -eoux pipefail + +HOMEBREW_TARBALL=/usr/share/homebrew.tar.zst +setfattr -n user.component -v "homebrew" "${HOMEBREW_TARBALL}" + +# rpm-ostree creates tmpfiles from packages having owned files in /{var,run} +RPM_OSTREE_TMPFILES=/usr/lib/rpm-ostree/tmpfiles.d +setfattr -n user.component -v "rpm-ostree-tmpfiles.d" "${RPM_OSTREE_TMPFILES}" +# vibes, shouldn't change super often +setfattr -n user.update-interval -v "quarterly" "${RPM_OSTREE_TMPFILES}" + +FONTCONFIG_CACHE=/usr/lib/fontconfig/cache +setfattr -n user.component -v "fontconfig-cache" "${FONTCONFIG_CACHE}" +# also vibes, no idea how often this changes, but it seems to change often +setfattr -n user.update-interval -v "daily" "${FONTCONFIG_CACHE}" + +WALLPAPERS=/usr/share/backgrounds/aurora +setfattr -n user.component -v "aurora-wallpapers" "${WALLPAPERS}" +setfattr -n user.update-interval -v "monthly" "${WALLPAPERS}" + +AURORA_CHARS=(/usr/share/plasma/avatars/{echo,lumina,scope,tina,vincent}.png) +setfattr -n user.component -v "aurora-assets" "${AURORA_CHARS[@]}" + +BAZAAR=(/etc/bazaar/*.jxl) +setfattr -n user.component -v "aurora-assets" "${BAZAAR[@]}" +setfattr -n user.update-interval -v "quarterly" "${BAZAAR[@]}" + +AURORA_DOCS_PDF="/usr/share/doc/aurora/aurora.pdf" +setfattr -n user.component -v "aurora-offline-docs" "${AURORA_DOCS_PDF}" + +# TODO: everything else we can probably add here +FRAMEWORK_ICC=(/usr/share/color/icc/colord/framework1{3,6}.icc) +setfattr -n user.component -v "never-change" "${FRAMEWORK_ICC[@]}" +setfattr -n user.update-interval -v "yearly" "${FRAMEWORK_ICC[@]}" + +# This is absolutely nasty, ideally we'd use SOURCE_DATE_EPOCH=0 on chunkah for +# all the touch invocations but this (potentially) affects the layer plan +# negatively +# See: https://github.com/coreos/chunkah/issues/160 +# +# on the composefs backend this also makes it so that bootc (uupd notification) +# flags the image as outdated with label org.opencontainers.image.created and +# ".Created" (it's set to 1970 after all) this doesn't happen on ostree +# https://github.com/bootc-dev/bootc/issues/2227 + +# This shouldn't hurt anything, Epoch 0 is what RPMs are using, we don't want to override that +find /usr /etc /opt -exec touch -h -a -m -d '1970-01-01T00:00:00Z' {} + + +# getfattr -R -d /usr 2> /dev/null || true +# getfattr -R -d /etc 2> /dev/null || true + +echo "::endgroup::" From 15c49f95477a8eaadc7d4ff4632d9a33efd7cd8e Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Fri, 16 Oct 2026 15:37:22 +0000 Subject: [PATCH 51/92] fix(just): use login shell for run recipe (#3037) It's quite annoying not having things like shell completions inside the container by default. --- Justfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Justfile b/Justfile index 323fb0ea..25bf1415 100644 --- a/Justfile +++ b/Justfile @@ -399,7 +399,7 @@ run $image=default_image $tag=default_tag $flavor=default_flavor: fi # Run Container - ${PODMAN} run -it --rm "${image_name}:${tag}" bash + ${PODMAN} run -it --rm "${image_name}:${tag}" bash -l # Test Changelogs [group('Changelogs')] From 3dd50f7edd2b4ad204701b76ec27ec8297cf98c2 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sat, 17 Oct 2026 03:20:59 +0000 Subject: [PATCH 52/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 6391cbd (#3039) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index d8c666e6..1e8b44e4 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:3ba8aaeaf4ab29cad3f86ed9ae23690b73a197717de25050dfdf56537b4964dd + digest: sha256:6391cbddb6f5ee4c5d6ab3e0af3c42ecd097cb34e9eabc11a6b2c32b511d2eb3 # https://github.com/get-aurora-dev/common - name: common From ba9a0fbd2ca5ced92ef6e2938e78399f9acc3209 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 02:06:36 +0000 Subject: [PATCH 53/92] chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to ce2de9e (#3043) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 1e8b44e4..9c02c695 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -15,7 +15,7 @@ images: - name: brew image: ghcr.io/ublue-os/brew tag: latest - digest: sha256:31b49a6794384190add2ae54ef6bd918cc207a2a3a8e0817ac2d5bf0f0e9e709 + digest: sha256:ce2de9ea1bd8ecfc3b64c0415ce85b9f22eb469be5307add0f46a0d8eecfb8db # https://github.com/coreos/chunkah - name: chunkah From 9f40cb110a64ae0b674ffe142aaffb59c7f2b967 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 04:02:35 +0000 Subject: [PATCH 54/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to db874cd (#3047) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 9c02c695..b7cb983d 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:6391cbddb6f5ee4c5d6ab3e0af3c42ecd097cb34e9eabc11a6b2c32b511d2eb3 + digest: sha256:db874cd20b04042e4443785e1d7c923966896c52d0540c03a9ba9447fedf0317 # https://github.com/get-aurora-dev/common - name: common From 4c4181720afac34f9a7fe25dab21c0dde1d4b0cf Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 09:29:29 +0300 Subject: [PATCH 55/92] chore(deps): update github/codeql-action action to v4.39.0 (main) (#3042) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 12b1cf03..3a696c5e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -71,6 +71,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard (optional). # Commenting out will disable upload of results to your repo's Code Scanning dashboard - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: results.sarif From 905b5d868a7251b35e3db3037e16b8f8f98c8e62 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 09:29:56 +0300 Subject: [PATCH 56/92] chore(deps): update ossf/scorecard-action action to v2.5.0 (main) (#3044) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 3a696c5e..0e25d8ee 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -37,7 +37,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: results.sarif results_format: sarif From e1e8e88f5c97d1e396a1d9250f2cca1aa14223c2 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 06:28:55 +0000 Subject: [PATCH 57/92] chore(deps): update actions/create-github-app-token digest to 64ab729 (#3041) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/cherry-pick-to-stable.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cherry-pick-to-stable.yml b/.github/workflows/cherry-pick-to-stable.yml index 1d173a28..48ffc5ee 100644 --- a/.github/workflows/cherry-pick-to-stable.yml +++ b/.github/workflows/cherry-pick-to-stable.yml @@ -18,7 +18,7 @@ jobs: steps: - name: Generate a GitHub App Token id: generate-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3 with: client-id: ${{ secrets.AURORABOT_APP_ID }} private-key: ${{ secrets.AURORABOT_PRIVATE_KEY }} From 37fde370b11d8e17d52eec159322c5906447554e Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 06:31:00 +0000 Subject: [PATCH 58/92] chore(deps): update zizmorcore/zizmor-action action to v0.7.1 (#3045) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 092bbfa5..71f19263 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -29,6 +29,6 @@ jobs: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 with: persona: auditor From eee1a0285c23a0a59610162b21e0c4e70348bd07 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 18 Oct 2026 11:20:42 +0000 Subject: [PATCH 59/92] fix: only reset timestmaps for files that aren't already epoch 0 (#3051) This caused a little regression in the build times as it would relabel absolutely everything, vast majority of content is of course RPM packages which already have this timestamp set. Before the normal image build was around 5-7min, now it has gone up by 2-3min. Follow-up of: 3ef1256cd3c3. Figured out by Bazzite in [1]. [1] https://github.com/ublue-os/bazzite/commit/a4ccbec9f6d6fbdc78ff565272eff58d09d1b040 --- build_scripts/shared/unpackaged.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build_scripts/shared/unpackaged.sh b/build_scripts/shared/unpackaged.sh index a450ce42..f490deb7 100755 --- a/build_scripts/shared/unpackaged.sh +++ b/build_scripts/shared/unpackaged.sh @@ -48,7 +48,7 @@ setfattr -n user.update-interval -v "yearly" "${FRAMEWORK_ICC[@]}" # https://github.com/bootc-dev/bootc/issues/2227 # This shouldn't hurt anything, Epoch 0 is what RPMs are using, we don't want to override that -find /usr /etc /opt -exec touch -h -a -m -d '1970-01-01T00:00:00Z' {} + +find /usr /etc /opt -newermt '1970-01-01T00:00:00Z' -exec touch -h -a -m -d '1970-01-01T00:00:00Z' {} + # getfattr -R -d /usr 2> /dev/null || true # getfattr -R -d /etc 2> /dev/null || true From 42b90550b908c788cdee86a4c4a79590c235cc15 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 14:46:52 +0000 Subject: [PATCH 60/92] chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 7c45eba (#3053) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index b7cb983d..21e869d2 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -9,7 +9,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:409899f9bcf98b16c6c4f671fd7988406132be53dfadf8da55d5f985ccd00948 + digest: sha256:7c45eba77e5d0dc53caf4f6808b9ca0f28a664a20ffce2dfa5f8af1251fe2bbd # https://github.com/ublue-os/brew - name: brew From 253e9103122aaaf648eedbf606d4cac9e80b8ea5 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 18 Oct 2026 15:45:42 +0000 Subject: [PATCH 61/92] chore: move flathub remote config to /usr (#3052) /usr is generally preferred over /etc --- build_scripts/base/03-fetch.sh | 2 +- build_scripts/base/20-tests.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build_scripts/base/03-fetch.sh b/build_scripts/base/03-fetch.sh index 1de77dea..abcb1c5e 100755 --- a/build_scripts/base/03-fetch.sh +++ b/build_scripts/base/03-fetch.sh @@ -5,7 +5,7 @@ echo "::group:: ===$(basename "$0")===" set -eoux pipefail # Enable Flathub -curl --retry 3 -Lo /etc/flatpak/remotes.d/flathub.flatpakrepo https://dl.flathub.org/repo/flathub.flatpakrepo +curl --retry 3 -Lo /usr/share/flatpak/remotes.d/flathub.flatpakrepo https://dl.flathub.org/repo/flathub.flatpakrepo # Offline Aurora documentation ghcurl "https://github.com/ublue-os/aurora-docs/releases/download/0.1/aurora.pdf" --retry 3 -o /tmp/aurora.pdf diff --git a/build_scripts/base/20-tests.sh b/build_scripts/base/20-tests.sh index 526f5fa2..17adcd2b 100755 --- a/build_scripts/base/20-tests.sh +++ b/build_scripts/base/20-tests.sh @@ -43,7 +43,7 @@ test -f /usr/share/flatpak/preinstall.d/bazaar.preinstall test -f /usr/lib/systemd/system/flatpak-add-fedora-repos.service && false # Is flathub enabled by default? -test -f /etc/flatpak/remotes.d/flathub.flatpakrepo +test -f /usr/share/flatpak/remotes.d/flathub.flatpakrepo # Make sure to not pull in the bazzite one rpm -q plasma-setup --qf "%{RELEASE}" | grep -q aurora From 6f59f93768914b644f084fe2d3986a5b0776f24d Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 02:53:41 +0000 Subject: [PATCH 62/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to df08f4b (#3057) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 21e869d2..3753f572 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:db874cd20b04042e4443785e1d7c923966896c52d0540c03a9ba9447fedf0317 + digest: sha256:df08f4ba1067d1cba4c7fc6dbb1972556c14ff9a696f7bcf13f62e83c180bbd5 # https://github.com/get-aurora-dev/common - name: common From 293ddd493b4a6f9886a717b37d766a168cd691ae Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Mon, 19 Oct 2026 04:01:24 +0000 Subject: [PATCH 63/92] fix(renovate): trigger automerge for stable branch for kinoite (#3054) We had to enable it manually, not sure when this broke. --- .github/renovate.json5 | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 6873fcd9..4c661199 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -10,11 +10,6 @@ "rebaseWhen": "never", "packageRules": [ - { - "description": "Use merge commits when automerging into stable branches to match branch ruleset restrictions", - "matchBaseBranches": ["/^stable-f[0-9][0-9]$/"], - "automergeStrategy": "merge-commit" - }, { "automerge": true, "matchUpdateTypes": ["pin", "pinDigest"] @@ -24,13 +19,6 @@ "matchManagers": ["dockerfile"], "matchUpdateTypes": ["digest"] }, - { - // We always want to trigger a fresh build when we have a new base image on every branch - // so we get package and security updates - "matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"], - "automerge": true, - "matchUpdateTypes": ["digest"] - }, { "matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"], "matchUpdateTypes": ["major"], @@ -63,6 +51,22 @@ "!anchore/sbom-action" ], "schedule": ["on sunday"] + }, + // these two are needed because we don't really run images based on a schedule + // :testing/main branch must be defined first or else it overwrites rules for stable + { + "description": "Automerge kinoite digest updates on main with default merge strategy", + "matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"], + "matchUpdateTypes": ["digest"], + "automerge": true + }, + { + "description": "Use merge commits when automerging into stable branches to match branch ruleset restrictions", + "matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"], + "matchUpdateTypes": ["digest"], + "matchBaseBranches": ["/^stable-f[0-9][0-9]$/"], + "automergeStrategy": "merge-commit", + "automerge": true } ] } From c15ef2cd168b882bd42423d7cc419aaea31681ae Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Mon, 19 Oct 2026 16:41:52 +0300 Subject: [PATCH 64/92] feat(renovate): delay renovate for 3 days (#3059) * feat(renovate): delay renovate for 3 days * add comment + link --- .github/renovate.json5 | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 4c661199..bf6beebf 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -43,6 +43,13 @@ "matchBaseBranches": ["/^stable-f[0-9][0-9]$/"], "enabled": false }, + { + // Cooldown for 3 days as done with dependabot @ github: + // https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/ + "description": "Delay GitHub Actions updates by 3 days", + "matchManagers": ["github-actions"], + "minimumReleaseAge": "3 days" + }, { "matchManagers": ["github-actions"], "matchDepNames": [ From 04f1bfe77fe48078616c727947602e4ab86c2bb0 Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Mon, 19 Oct 2026 17:26:08 +0300 Subject: [PATCH 65/92] fix(ci): fix blankiet installation permissions for backport action (#3060) --- .github/workflows/cherry-pick-to-stable.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/cherry-pick-to-stable.yml b/.github/workflows/cherry-pick-to-stable.yml index 48ffc5ee..e4548f05 100644 --- a/.github/workflows/cherry-pick-to-stable.yml +++ b/.github/workflows/cherry-pick-to-stable.yml @@ -22,6 +22,9 @@ jobs: with: client-id: ${{ secrets.AURORABOT_APP_ID }} private-key: ${{ secrets.AURORABOT_PRIVATE_KEY }} + repositories: ${{ github.event.repository.name }} + permission-contents: write + permission-pull-requests: write - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 From fbf4762eb628a9f97b57549af0975313bb6f5d29 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 03:19:08 +0000 Subject: [PATCH 66/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to eca0916 (#3063) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 3753f572..4e403d92 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:df08f4ba1067d1cba4c7fc6dbb1972556c14ff9a696f7bcf13f62e83c180bbd5 + digest: sha256:eca09169f0a9edb645f6e7bfec17bf3b87aff650b78702e9b7fc362eaafa61c2 # https://github.com/get-aurora-dev/common - name: common From 607b9f5190f9740847ef2317e5b494257a58658d Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 21 Oct 2026 03:16:27 +0000 Subject: [PATCH 67/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 97cf7d9 (#3067) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 4e403d92..d7c9ee02 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:eca09169f0a9edb645f6e7bfec17bf3b87aff650b78702e9b7fc362eaafa61c2 + digest: sha256:97cf7d9a5d86d207f4e87ba4ad874667f41b6f2c3f116c80eec8d0f46623145c # https://github.com/get-aurora-dev/common - name: common From 54cbc2a853588efd5db0d75cebabaebfabeb80ae Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Thu, 22 Oct 2026 03:18:21 +0000 Subject: [PATCH 68/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 4427cbf (#3070) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index d7c9ee02..de82d5bb 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:97cf7d9a5d86d207f4e87ba4ad874667f41b6f2c3f116c80eec8d0f46623145c + digest: sha256:4427cbfee55aabd2db12a05f5fce4b8e1f45cfb01bc73f78e214f624d2a41f14 # https://github.com/get-aurora-dev/common - name: common From 88d8e4960f3ba93c4c11b2f9907cbf29b01a11e0 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 23 Oct 2026 03:20:53 +0000 Subject: [PATCH 69/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 2b932e3 (#3077) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index de82d5bb..a764019d 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:4427cbfee55aabd2db12a05f5fce4b8e1f45cfb01bc73f78e214f624d2a41f14 + digest: sha256:2b932e3af1c28cfb6da196a72b2cc49e5d7653289304048e6ae2148ff6e2bbc4 # https://github.com/get-aurora-dev/common - name: common From aaf45e678ad2d6418876cf5db9852db406335eb5 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Fri, 23 Oct 2026 23:33:44 +0000 Subject: [PATCH 70/92] feat: Add various OpenCL runtimes (#3061) Add weak_deps=False to main dnf install so we don't pull in the world, some things that are gonna be noticeable I added here manually. OpenCL in containers/flatpak is kinda bad to my understanding. So we sadly have to include them on the host. resovles: https://github.com/ublue-os/aurora/issues/2998 Co-authored-by: Jed --- build_scripts/base/01-packages.sh | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/build_scripts/base/01-packages.sh b/build_scripts/base/01-packages.sh index 1b131684..07b2e7fb 100755 --- a/build_scripts/base/01-packages.sh +++ b/build_scripts/base/01-packages.sh @@ -21,6 +21,7 @@ OVERRIDES=( "mesa-libEGL" "mesa-libGL" "mesa-libgbm" + "mesa-libOpenCL" "mesa-vulkan-drivers" "openh264" ) @@ -60,10 +61,12 @@ FEDORA_PACKAGES=( ifuse igt-gpu-tools input-remapper + intel-compute-runtime iwd just - kate + kate{-krunner-plugin,-plugins} kcm-fcitx5 + fzf # for just krb5-workstation ksystemlog libcamera-gstreamer @@ -82,7 +85,10 @@ FEDORA_PACKAGES=( plasma-firewall-"${PLASMA_VERS}" plasma-oxygen plasma-union-"${PLASMA_VERS}" - plasma-wallpapers-dynamic + # TODO: look into removing this, plasma supports the transition feature of this natively + plasma-wallpapers-dynamic-builder + plasma-wallpapers-dynamic-builder{-bash,-fish,-zsh}-completion + pocl powertop rclone restic @@ -126,7 +132,9 @@ if [[ $(arch) == x86_64 ]]; then PACKAGES+=( "${FEDORA_PACKAGES_AMD64[@]}" "${NEGATIVO_PACKAGES_AMD64[@]}" ) fi -dnf -y install --enablerepo='fedora-multimedia' "${PACKAGES[@]}" +dnf -y install \ + --setopt=install_weak_deps=False \ + --enablerepo='fedora-multimedia' "${PACKAGES[@]}" COPR_UBLUE_OS_PACKAGES=( kcm_ublue From 6ee91e0dca8353e6280147f644f2fe79e81ab4f2 Mon Sep 17 00:00:00 2001 From: Quinn! <128195750+HuntedRaven7@users.noreply.github.com> Date: Sat, 24 Oct 2026 01:08:00 +0000 Subject: [PATCH 71/92] chore: remove xwaylandvideobridge (#3082) The bridge runs a background process at login and is no longer needed now that Discord and Zoom support the desktop portal. Closes #3066 --- build_scripts/base/01-packages.sh | 2 ++ build_scripts/base/20-tests.sh | 1 + 2 files changed, 3 insertions(+) diff --git a/build_scripts/base/01-packages.sh b/build_scripts/base/01-packages.sh index 07b2e7fb..b01c883a 100755 --- a/build_scripts/base/01-packages.sh +++ b/build_scripts/base/01-packages.sh @@ -180,6 +180,8 @@ EXCLUDED_PACKAGES=( krfb{,-libs} plasma-discover{,-libs} plasma-welcome-fedora + # https://github.com/ublue-os/aurora/issues/3066 + xwaylandvideobridge ) dnf -y remove "${EXCLUDED_PACKAGES[@]}" diff --git a/build_scripts/base/20-tests.sh b/build_scripts/base/20-tests.sh index 17adcd2b..4cfaafaa 100755 --- a/build_scripts/base/20-tests.sh +++ b/build_scripts/base/20-tests.sh @@ -129,6 +129,7 @@ UNWANTED_PACKAGES=( fedora-third-party firefox plasma-discover + xwaylandvideobridge ) for package in "${UNWANTED_PACKAGES[@]}"; do From 444e88653048823116be2b1706d6b2f2fecb5988 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sat, 24 Oct 2026 03:16:29 +0000 Subject: [PATCH 72/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to b7b6e5d (#3084) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index a764019d..3878b3cd 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:2b932e3af1c28cfb6da196a72b2cc49e5d7653289304048e6ae2148ff6e2bbc4 + digest: sha256:b7b6e5d05e5240e0ad750c200b52d7e52d37ad9615e740b89cf61117c238e922 # https://github.com/get-aurora-dev/common - name: common From f4ec6304698ce7a181b36c4c2d990efad1528a44 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sat, 24 Oct 2026 05:47:40 +0000 Subject: [PATCH 73/92] chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 0b90841 (#3086) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 3878b3cd..943e949b 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -9,7 +9,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:7c45eba77e5d0dc53caf4f6808b9ca0f28a664a20ffce2dfa5f8af1251fe2bbd + digest: sha256:0b90841f8882202ab1f84551b1577a74f7a3e0cc63b760d0917481f423dbaefc # https://github.com/ublue-os/brew - name: brew From ad6bba35dd9f60957c813be7a2359fa2d8cfb9a6 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sat, 24 Oct 2026 15:44:55 +0000 Subject: [PATCH 74/92] chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to f09d75a (#3087) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 943e949b..4502a21c 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -9,7 +9,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:0b90841f8882202ab1f84551b1577a74f7a3e0cc63b760d0917481f423dbaefc + digest: sha256:f09d75a232efbcea012ab26710c1cdb21b013f56c9bc69e59f844f6a82599034 # https://github.com/ublue-os/brew - name: brew From f86fe91bd699770aad40e532352f0c6df8fc0762 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 25 Oct 2026 02:04:48 +0000 Subject: [PATCH 75/92] chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to 025ddf2 (#3089) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 4502a21c..6a212f00 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -15,7 +15,7 @@ images: - name: brew image: ghcr.io/ublue-os/brew tag: latest - digest: sha256:ce2de9ea1bd8ecfc3b64c0415ce85b9f22eb469be5307add0f46a0d8eecfb8db + digest: sha256:025ddf28db2d176379809b1c1f3c6479d5a08f22c579e8883a4305a24a7d0ddb # https://github.com/coreos/chunkah - name: chunkah From bc033fb2fd811379e7ec3300aa494f5e0186aa4f Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 25 Oct 2026 03:18:20 +0000 Subject: [PATCH 76/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 879ac56 (#3090) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 6a212f00..81d0b2fd 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:b7b6e5d05e5240e0ad750c200b52d7e52d37ad9615e740b89cf61117c238e922 + digest: sha256:879ac56d47e99369140f79a1ac025591b5a82aec05de8353556d2f529dbe4bd7 # https://github.com/get-aurora-dev/common - name: common From cff9396a0f354b5310141c5505c0448648d78141 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 25 Oct 2026 06:38:22 +0000 Subject: [PATCH 77/92] chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 76f11d8 (#3092) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 81d0b2fd..35705d35 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -9,7 +9,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:f09d75a232efbcea012ab26710c1cdb21b013f56c9bc69e59f844f6a82599034 + digest: sha256:76f11d8e176052bcb3e0e9a89df9107a963268bf3cd1845afa8bad0b79c46621 # https://github.com/ublue-os/brew - name: brew From a0855c4ccc6a6feda843a8d63a2e333c74f440a0 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 03:22:50 +0000 Subject: [PATCH 78/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 6887b7c (#3094) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 35705d35..848df1ce 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:879ac56d47e99369140f79a1ac025591b5a82aec05de8353556d2f529dbe4bd7 + digest: sha256:6887b7cb766fd174aa047613833182b1ffe72be1b3c305f8756f924922cdb406 # https://github.com/get-aurora-dev/common - name: common From 481bdfe702ead0dac2f8516f67deb2041981fb48 Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Mon, 26 Oct 2026 14:10:26 +0000 Subject: [PATCH 79/92] fix: Regenerate CA trust and crypto policies for eMudhra incident (#3098) This handles an issue where the three way /etc merge can leave a user unpatched despite having the new package. Adapted from https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663 (cherry picked from commit bfa213b13bc967d4652a908ec457e3f1aed34d6d https://github.com/ublue-os/main/pull/3029) Co-authored-by: Kyle Gospodnetich --- .../lib/systemd/system-preset/89-aurora.preset | 2 ++ .../system/bootc-update-ca-trust.service | 18 ++++++++++++++++++ .../bootc-update-crypto-policies.service | 18 ++++++++++++++++++ 3 files changed, 38 insertions(+) create mode 100644 system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service create mode 100644 system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service diff --git a/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset b/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset index 330fc962..9abc2cc7 100644 --- a/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset +++ b/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset @@ -1,4 +1,6 @@ enable aurora-groups.service +enable bootc-update-ca-trust.service +enable bootc-update-crypto-policies.service enable brew-setup.service enable dconf-update.service enable flatpak-preinstall.service diff --git a/system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service b/system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service new file mode 100644 index 00000000..4b4eb641 --- /dev/null +++ b/system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service @@ -0,0 +1,18 @@ +# Regenerate files preserved by the /etc three-way merge after image upgrades. +[Unit] +Description=Regenerate CA certificate trust store +Documentation=https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663 +ConditionPathIsMountPoint=/sysroot +ConditionPathExists=/usr/bin/update-ca-trust +DefaultDependencies=no +Requires=local-fs.target +After=local-fs.target +Before=sysinit.target + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/bin/update-ca-trust extract + +[Install] +WantedBy=sysinit.target diff --git a/system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service b/system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service new file mode 100644 index 00000000..f77a4a3b --- /dev/null +++ b/system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service @@ -0,0 +1,18 @@ +# Regenerate backend files preserved by the /etc three-way merge after image upgrades. +[Unit] +Description=Regenerate crypto-policies backend configuration +Documentation=https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663 +ConditionPathIsMountPoint=/sysroot +ConditionPathExists=/usr/bin/update-crypto-policies +DefaultDependencies=no +Requires=local-fs.target +After=local-fs.target +Before=sysinit.target + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/bin/bash -ec 'policy=$(/usr/bin/update-crypto-policies --show); exec /usr/bin/update-crypto-policies --set "$$policy"' + +[Install] +WantedBy=sysinit.target From 54f446c39e4f023026f24afa707cbb0cde7c1e29 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 05:25:57 +0000 Subject: [PATCH 80/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 79afb5b (#3101) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 848df1ce..b7a8b956 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:6887b7cb766fd174aa047613833182b1ffe72be1b3c305f8756f924922cdb406 + digest: sha256:79afb5bef0bd1acd9718204001ccccdd5cedbc71703d9a2f12184586d39e6961 # https://github.com/get-aurora-dev/common - name: common From a26c26e938cb325fca84ae81b22649c0dcd04f77 Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Tue, 27 Oct 2026 12:24:10 +0000 Subject: [PATCH 81/92] feat: use terra pkg to get gaming udev rules (#3103) --- build_scripts/base/01-packages.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/build_scripts/base/01-packages.sh b/build_scripts/base/01-packages.sh index b01c883a..c1500ce7 100755 --- a/build_scripts/base/01-packages.sh +++ b/build_scripts/base/01-packages.sh @@ -148,6 +148,7 @@ TERRA_PACKAGES=( uupd # used in motd, in general useful to have nerdfontssymbolsonly-nerd-fonts + game-devices-udev ) # Fedora Tailscale is usually behind From c34f1fa928619278d6fe708718bfaf5a8505b85e Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 13:02:30 +0000 Subject: [PATCH 82/92] chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 2888e95 (#3105) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index b7a8b956..d11f1aba 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -9,7 +9,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:76f11d8e176052bcb3e0e9a89df9107a963268bf3cd1845afa8bad0b79c46621 + digest: sha256:2888e957bd72e1656c8de374bbfa3a933c19aad82dccd0994bd1766e03973ff1 # https://github.com/ublue-os/brew - name: brew From 0826f8d08107686a9e4ca81fb7139b7b95c4e53c Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 19:46:56 +0000 Subject: [PATCH 83/92] chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to 0c9703f (#3106) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index d11f1aba..8cd56b91 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -15,7 +15,7 @@ images: - name: brew image: ghcr.io/ublue-os/brew tag: latest - digest: sha256:025ddf28db2d176379809b1c1f3c6479d5a08f22c579e8883a4305a24a7d0ddb + digest: sha256:0c9703f1a49faa89a44d9458a68c0ca03270e8bdd32018285dad8b14ddd7cdc3 # https://github.com/coreos/chunkah - name: chunkah From c57816a3ee2a15213214e11798b9549de053ba43 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 28 Oct 2026 03:13:34 +0000 Subject: [PATCH 84/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 0218c33 (#3108) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 8cd56b91..96647049 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:79afb5bef0bd1acd9718204001ccccdd5cedbc71703d9a2f12184586d39e6961 + digest: sha256:0218c33bf078a122a1f7f8911f857809b892be161eddad191740790ac3454f9a # https://github.com/get-aurora-dev/common - name: common From 59f4248e8f1c715fc24fc3998b34094d589f7760 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Wed, 28 Oct 2026 04:48:58 +0000 Subject: [PATCH 85/92] fix: set timestamp for unpackaged content to EPOCH=1 instead of 0 (#3096) resolves: https://github.com/ublue-os/aurora/issues/3093 --- build_scripts/base/19-initramfs.sh | 4 ---- build_scripts/shared/unpackaged.sh | 18 +++++++++--------- 2 files changed, 9 insertions(+), 13 deletions(-) diff --git a/build_scripts/base/19-initramfs.sh b/build_scripts/base/19-initramfs.sh index 7d97726e..3ada1d0c 100755 --- a/build_scripts/base/19-initramfs.sh +++ b/build_scripts/base/19-initramfs.sh @@ -36,10 +36,6 @@ rm "${TMP_OS_RELEASE}" chmod 0600 "${INITRAMFS}" -# for reproducibility -# This is done globally now -# touch -a -m -d "1970-01-01T00:00:00Z" "${INITRAMFS}" - # for debugging sha256sum "${INITRAMFS}" diff --git a/build_scripts/shared/unpackaged.sh b/build_scripts/shared/unpackaged.sh index f490deb7..85666d58 100755 --- a/build_scripts/shared/unpackaged.sh +++ b/build_scripts/shared/unpackaged.sh @@ -37,18 +37,18 @@ FRAMEWORK_ICC=(/usr/share/color/icc/colord/framework1{3,6}.icc) setfattr -n user.component -v "never-change" "${FRAMEWORK_ICC[@]}" setfattr -n user.update-interval -v "yearly" "${FRAMEWORK_ICC[@]}" -# This is absolutely nasty, ideally we'd use SOURCE_DATE_EPOCH=0 on chunkah for -# all the touch invocations but this (potentially) affects the layer plan -# negatively -# See: https://github.com/coreos/chunkah/issues/160 +# This is absolutely nasty, ideally we'd use SOURCE_DATE_EPOCH=0 on chunkah +# instead of all the touch invocations but this (potentially) affects the layer +# plan negatively See: https://github.com/coreos/chunkah/issues/160 # -# on the composefs backend this also makes it so that bootc (uupd notification) -# flags the image as outdated with label org.opencontainers.image.created and -# ".Created" (it's set to 1970 after all) this doesn't happen on ostree +# on the composefs backend this also makes it so that bootc inconsistently gets +# the image creation date across backends (uupd will send a notification) this +# doesn't happen on ostree, but is an issue on composefs # https://github.com/bootc-dev/bootc/issues/2227 -# This shouldn't hurt anything, Epoch 0 is what RPMs are using, we don't want to override that -find /usr /etc /opt -newermt '1970-01-01T00:00:00Z' -exec touch -h -a -m -d '1970-01-01T00:00:00Z' {} + +# EPOCH=1 or else we may lose some of our changes due to native overay diff being set to false +# https://github.com/ublue-os/aurora/issues/3093 +find /usr /etc /opt -newermt '1970-01-01T00:00:00Z' -exec touch -h -a -m -d '1970-01-01T00:00:01Z' {} + # getfattr -R -d /usr 2> /dev/null || true # getfattr -R -d /etc 2> /dev/null || true From 0f7d21d2c59da150d9b6c8943db6c34553f3c55a Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Wed, 28 Oct 2026 18:13:27 +0200 Subject: [PATCH 86/92] fix(renovate): add cosign to exclusion rules and remove cooldown (#3110) * fix(renovate): add cosign to exclusion rules * remove cooldown for now * also add zizmor to excludes --- .github/renovate.json5 | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index bf6beebf..a792d1cc 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -43,18 +43,13 @@ "matchBaseBranches": ["/^stable-f[0-9][0-9]$/"], "enabled": false }, - { - // Cooldown for 3 days as done with dependabot @ github: - // https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/ - "description": "Delay GitHub Actions updates by 3 days", - "matchManagers": ["github-actions"], - "minimumReleaseAge": "3 days" - }, { "matchManagers": ["github-actions"], "matchDepNames": [ "!oras-project/setup-oras", "!sigstore/cosign-installer", + "!sigstore/cosign", + "!zizmorcore/zizmor-action", "!anchore/sbom-action" ], "schedule": ["on sunday"] From 45a1f73c1c9871d82f0db34c79ac505d76cabe2b Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 28 Oct 2026 18:25:09 +0200 Subject: [PATCH 87/92] chore(deps): update github/codeql-action action to v4.39.1 (#3112) --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 0e25d8ee..0a9df197 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -71,6 +71,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard (optional). # Commenting out will disable upload of results to your repo's Code Scanning dashboard - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif From c38c174c6a7d6fbf87c356077d9ad610f4f92f81 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 28 Oct 2026 16:46:59 +0000 Subject: [PATCH 88/92] chore(deps): update oras-project/setup-oras action to v2.0.3 (#3113) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/generate-release.yml | 2 +- .github/workflows/reusable-build.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml index 1bff0a61..4e483290 100644 --- a/.github/workflows/generate-release.yml +++ b/.github/workflows/generate-release.yml @@ -48,7 +48,7 @@ jobs: just check - name: Install ORAS - uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2 + uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3 - name: Generate Release Text id: generate-release-text diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 492ab081..8e6aaf63 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -93,7 +93,7 @@ jobs: cosign-release: 'v3.1.3' - name: Install ORAS - uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2 + uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3 - name: Check Just Syntax shell: bash From cc0676b10b9ba208503b91d570a50048aab48cf6 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 28 Oct 2026 16:52:10 +0000 Subject: [PATCH 89/92] chore(deps): update zizmorcore/zizmor-action action to v0.8.0 (#3114) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 71f19263..324a4114 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -29,6 +29,6 @@ jobs: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 + uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0 with: persona: auditor From a9fcc799660b6dcc9e81c925ea23eaa393c7bca0 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 28 Oct 2026 16:59:21 +0000 Subject: [PATCH 90/92] chore(deps): update dependency sigstore/cosign to v3.1.4 (#3111) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/reusable-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 8e6aaf63..c9cedbc0 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -90,7 +90,7 @@ jobs: uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 # be careful when upgrading major versions with: - cosign-release: 'v3.1.3' + cosign-release: 'v3.1.4' - name: Install ORAS uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3 From 1724a279164233544e7a22e8bd6c3620a8f8c153 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Thu, 29 Oct 2026 03:12:54 +0000 Subject: [PATCH 91/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 87090e4 (#3118) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 96647049..cbae166e 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:0218c33bf078a122a1f7f8911f857809b892be161eddad191740790ac3454f9a + digest: sha256:87090e4972da2531f06d695fb3e758bb0191edb9f7bd17d02f3073b0c77435cb # https://github.com/get-aurora-dev/common - name: common From 71dbbd7716975c2dd6a88fe939e506945acc3a3e Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 30 Oct 2026 03:58:51 +0000 Subject: [PATCH 92/92] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:45 docker digest to 2a1fea9 (#3121) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index cbae166e..2d5a797c 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -3,7 +3,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 45 - digest: sha256:87090e4972da2531f06d695fb3e758bb0191edb9f7bd17d02f3073b0c77435cb + digest: sha256:2a1fea9adbd27dd87935508115d88ab5c7b335114e32994e7c2c615545ea5cac # https://github.com/get-aurora-dev/common - name: common