Merge upstream ublue-os/aurora main
This commit is contained in:
forgejo-actions
commit
085b5d2e65
38 changed files with 421 additions and 217 deletions
42
.github/renovate.json5
vendored
42
.github/renovate.json5
vendored
|
|
@ -8,25 +8,8 @@
|
|||
|
||||
// Do not rebase when the default branch is updated
|
||||
"rebaseWhen": "never",
|
||||
customManagers: [
|
||||
{
|
||||
customType: 'regex',
|
||||
managerFilePatterns: [
|
||||
'/^Justfile$/',
|
||||
],
|
||||
matchStrings: [
|
||||
'(?<justName>.+?)\\s:=\\s"(?<packageName>\\S+):(?<currentValue>\\S+)@(?<currentDigest>sha256:[a-f0-9]+?)"',
|
||||
],
|
||||
datasourceTemplate: 'docker',
|
||||
},
|
||||
],
|
||||
|
||||
"packageRules": [
|
||||
{
|
||||
"description": "Use merge commits when automerging into stable branches to match branch ruleset restrictions",
|
||||
"matchBaseBranches": ["/^stable-f[0-9][0-9]$/"],
|
||||
"automergeStrategy": "merge-commit"
|
||||
},
|
||||
{
|
||||
"automerge": true,
|
||||
"matchUpdateTypes": ["pin", "pinDigest"]
|
||||
|
|
@ -36,13 +19,6 @@
|
|||
"matchManagers": ["dockerfile"],
|
||||
"matchUpdateTypes": ["digest"]
|
||||
},
|
||||
{
|
||||
// We always want to trigger a fresh build when we have a new base image on every branch
|
||||
// so we get package and security updates
|
||||
"matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"],
|
||||
"automerge": true,
|
||||
"matchUpdateTypes": ["digest"]
|
||||
},
|
||||
{
|
||||
"matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"],
|
||||
"matchUpdateTypes": ["major"],
|
||||
|
|
@ -72,9 +48,27 @@
|
|||
"matchDepNames": [
|
||||
"!oras-project/setup-oras",
|
||||
"!sigstore/cosign-installer",
|
||||
"!sigstore/cosign",
|
||||
"!zizmorcore/zizmor-action",
|
||||
"!anchore/sbom-action"
|
||||
],
|
||||
"schedule": ["on sunday"]
|
||||
},
|
||||
// these two are needed because we don't really run images based on a schedule
|
||||
// :testing/main branch must be defined first or else it overwrites rules for stable
|
||||
{
|
||||
"description": "Automerge kinoite digest updates on main with default merge strategy",
|
||||
"matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"],
|
||||
"matchUpdateTypes": ["digest"],
|
||||
"automerge": true
|
||||
},
|
||||
{
|
||||
"description": "Use merge commits when automerging into stable branches to match branch ruleset restrictions",
|
||||
"matchDepNames": ["quay.io/fedora-ostree-desktops/kinoite"],
|
||||
"matchUpdateTypes": ["digest"],
|
||||
"matchBaseBranches": ["/^stable-f[0-9][0-9]$/"],
|
||||
"automergeStrategy": "merge-commit",
|
||||
"automerge": true
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
|
|||
|
|
@ -25,7 +25,7 @@ permissions: {}
|
|||
jobs:
|
||||
build-image-latest:
|
||||
name: Build Latest Images
|
||||
uses: ./.github/workflows/reusable-build.yml
|
||||
uses: $/.github/workflows/reusable-build.yml
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
|
@ -48,6 +48,6 @@ jobs:
|
|||
needs: [build-image-latest]
|
||||
permissions:
|
||||
contents: write
|
||||
uses: ./.github/workflows/generate-release.yml
|
||||
uses: $/.github/workflows/generate-release.yml
|
||||
with:
|
||||
stream_name: '["latest"]'
|
||||
|
|
|
|||
4
.github/workflows/build-image-stable.yml
vendored
4
.github/workflows/build-image-stable.yml
vendored
|
|
@ -19,7 +19,7 @@ permissions: {}
|
|||
jobs:
|
||||
build-image-stable:
|
||||
name: Build Stable Images
|
||||
uses: ./.github/workflows/reusable-build.yml
|
||||
uses: $/.github/workflows/reusable-build.yml
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
|
@ -40,6 +40,6 @@ jobs:
|
|||
needs: [build-image-stable]
|
||||
permissions:
|
||||
contents: write
|
||||
uses: ./.github/workflows/generate-release.yml
|
||||
uses: $/.github/workflows/generate-release.yml
|
||||
with:
|
||||
stream_name: '["stable"]'
|
||||
|
|
|
|||
4
.github/workflows/build-image-testing.yml
vendored
4
.github/workflows/build-image-testing.yml
vendored
|
|
@ -16,7 +16,7 @@ permissions: {}
|
|||
jobs:
|
||||
build-image-testing:
|
||||
name: Build Testing Images
|
||||
uses: ./.github/workflows/reusable-build.yml
|
||||
uses: $/.github/workflows/reusable-build.yml
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
|
@ -39,6 +39,6 @@ jobs:
|
|||
needs: [build-image-testing]
|
||||
permissions:
|
||||
contents: write
|
||||
uses: ./.github/workflows/generate-release.yml
|
||||
uses: $/.github/workflows/generate-release.yml
|
||||
with:
|
||||
stream_name: '["testing"]'
|
||||
|
|
|
|||
7
.github/workflows/cherry-pick-to-stable.yml
vendored
7
.github/workflows/cherry-pick-to-stable.yml
vendored
|
|
@ -18,10 +18,13 @@ jobs:
|
|||
steps:
|
||||
- name: Generate a GitHub App Token
|
||||
id: generate-token
|
||||
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
|
||||
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
|
||||
with:
|
||||
client-id: ${{ secrets.AURORABOT_APP_ID }}
|
||||
private-key: ${{ secrets.AURORABOT_PRIVATE_KEY }}
|
||||
repositories: ${{ github.event.repository.name }}
|
||||
permission-contents: write
|
||||
permission-pull-requests: write
|
||||
|
||||
- name: Checkout
|
||||
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
|
|
@ -43,7 +46,7 @@ jobs:
|
|||
|
||||
- name: Create Backport Pull Requests
|
||||
id: backport
|
||||
uses: korthout/backport-action@6b65649031ac6d18ffdfd0c0820e9436f3fde22b # v4.6.1
|
||||
uses: korthout/backport-action@8560fb503c275d433c56f05a2f64850093baa9f7 # v4.7.0
|
||||
with:
|
||||
# Use the dynamically generated GitHub App token here too
|
||||
github_token: ${{ steps.generate-token.outputs.token }}
|
||||
|
|
|
|||
2
.github/workflows/generate-release.yml
vendored
2
.github/workflows/generate-release.yml
vendored
|
|
@ -48,7 +48,7 @@ jobs:
|
|||
just check
|
||||
|
||||
- name: Install ORAS
|
||||
uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
|
||||
uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3
|
||||
|
||||
- name: Generate Release Text
|
||||
id: generate-release-text
|
||||
|
|
|
|||
37
.github/workflows/needinfo-close.yml
vendored
Normal file
37
.github/workflows/needinfo-close.yml
vendored
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
name: Close Inactive Tagged Issues
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 0 * * *' # Runs daily at midnight UTC
|
||||
workflow_dispatch: # Allows manual testing via the Actions tab
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
close-issues-without-info:
|
||||
name: Close issues without info
|
||||
runs-on: ubuntu-slim
|
||||
if: github.repository == 'ublue-os/aurora'
|
||||
permissions:
|
||||
issues: write # posts comments on issues
|
||||
steps:
|
||||
- uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
|
||||
with:
|
||||
# Only process issues that carry this specific label
|
||||
only-issue-labels: 'NEEDSINFO'
|
||||
|
||||
# By treating your tag as the stale marker, it closes after X days of inactivity
|
||||
stale-issue-label: 'NEEDSINFO'
|
||||
days-before-issue-stale: -1 # Prevents adding any other stale label
|
||||
days-before-issue-close: 14 # Closes 14 day after the label was added with no activity
|
||||
|
||||
# Prevents PRs from being processed or closed
|
||||
days-before-pr-stale: -1
|
||||
days-before-pr-close: -1
|
||||
|
||||
close-issue-message: 'This issue was closed because requested info was not provided.'
|
||||
close-issue-reason: 'not_planned'
|
||||
39
.github/workflows/reusable-build.yml
vendored
39
.github/workflows/reusable-build.yml
vendored
|
|
@ -31,6 +31,7 @@ on:
|
|||
|
||||
env:
|
||||
IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
|
||||
GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
|
||||
|
|
@ -89,10 +90,10 @@ jobs:
|
|||
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
|
||||
# be careful when upgrading major versions
|
||||
with:
|
||||
cosign-release: 'v3.1.3'
|
||||
cosign-release: 'v3.1.4'
|
||||
|
||||
- name: Install ORAS
|
||||
uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
|
||||
uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3
|
||||
|
||||
- name: Check Just Syntax
|
||||
shell: bash
|
||||
|
|
@ -142,7 +143,7 @@ jobs:
|
|||
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
|
||||
run: |
|
||||
$(command -v just) \
|
||||
repo_organization="${{ github.repository_owner }}" \
|
||||
repo_organization="${GITHUB_REPOSITORY_OWNER}" \
|
||||
build \
|
||||
--image "${MATRIX_BASE_NAME}" \
|
||||
--tag "${MATRIX_STREAM_NAME}" \
|
||||
|
|
@ -186,7 +187,7 @@ jobs:
|
|||
- name: Setup Syft
|
||||
id: setup-syft
|
||||
if: inputs.publish
|
||||
uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
|
||||
uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
|
||||
|
||||
- name: Generate SBOM
|
||||
if: inputs.publish
|
||||
|
|
@ -231,7 +232,7 @@ jobs:
|
|||
|
||||
- name: Upload OCI Archive as Artifact
|
||||
if: github.event_name == 'pull_request'
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
||||
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
||||
with:
|
||||
name: ${{ env.IMAGE_NAME }}-${{ matrix.architecture }}.oci
|
||||
path: ${{ env.IMAGE_NAME }}-${{ matrix.architecture }}.oci
|
||||
|
|
@ -404,25 +405,25 @@ jobs:
|
|||
run: |
|
||||
just login-registry oras ghcr.io
|
||||
|
||||
- name: Upload SBOM
|
||||
- name: Attach SBOM
|
||||
if: inputs.publish
|
||||
id: upload-sbom
|
||||
id: attach-sbom
|
||||
env:
|
||||
IMAGE: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
MATRIX_BASE_NAME: "${{ matrix.base_name }}"
|
||||
MATRIX_STREAM_NAME: "${{ matrix.stream_name }}"
|
||||
MATRIX_IMAGE_FLAVOR: "${{ matrix.image_flavor }}"
|
||||
DIGEST: ${{ steps.pre-push.outputs.digest }}
|
||||
IMAGE_NAME: ${{ env.IMAGE_NAME }}
|
||||
run: |
|
||||
SBOM="sbom_out/${IMAGE_NAME}/sbom.json"
|
||||
set -euox pipefail
|
||||
|
||||
cd "$(dirname "${SBOM}")"
|
||||
oras attach \
|
||||
--artifact-type application/vnd.spdx+json \
|
||||
--annotation filename=$(basename "$SBOM") \
|
||||
"${IMAGE}@${DIGEST}" \
|
||||
"$(basename ${SBOM})"
|
||||
|
||||
sbom_digest=$(oras discover --format json "${IMAGE}@${DIGEST}" | jq -r '.referrers[] | select(.artifactType == "application/vnd.spdx+json") | .digest')
|
||||
$(command -v just) attach-sbom \
|
||||
--image "${MATRIX_BASE_NAME}" \
|
||||
--tag "${MATRIX_STREAM_NAME}" \
|
||||
--flavor "${MATRIX_IMAGE_FLAVOR}" \
|
||||
--registry "${IMAGE_REGISTRY}" \
|
||||
--digest "${DIGEST}"
|
||||
|
||||
sbom_digest=$(< /tmp/sbom-digestfile)
|
||||
echo "sbom_digest=${sbom_digest}" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Sign SBOM OCI Artifact
|
||||
|
|
@ -431,7 +432,7 @@ jobs:
|
|||
COSIGN_EXPERIMENTAL: false
|
||||
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
|
||||
IMAGE_NAME: ${{ env.IMAGE_NAME }}
|
||||
SBOM_DIGEST: ${{ steps.upload-sbom.outputs.sbom_digest }}
|
||||
SBOM_DIGEST: ${{ steps.attach-sbom.outputs.sbom_digest }}
|
||||
run: |
|
||||
cosign sign -y --use-signing-config=false --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${SBOM_DIGEST}
|
||||
|
||||
|
|
|
|||
6
.github/workflows/scorecard.yml
vendored
6
.github/workflows/scorecard.yml
vendored
|
|
@ -37,7 +37,7 @@ jobs:
|
|||
persist-credentials: false
|
||||
|
||||
- name: "Run analysis"
|
||||
uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
|
||||
uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
|
||||
with:
|
||||
results_file: results.sarif
|
||||
results_format: sarif
|
||||
|
|
@ -62,7 +62,7 @@ jobs:
|
|||
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
|
||||
# format to the repository Actions tab.
|
||||
- name: "Upload artifact"
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
||||
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
||||
with:
|
||||
name: SARIF file
|
||||
path: results.sarif
|
||||
|
|
@ -71,6 +71,6 @@ jobs:
|
|||
# Upload the results to GitHub's code scanning dashboard (optional).
|
||||
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
|
||||
- name: "Upload to code-scanning"
|
||||
uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
|
||||
uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
|
||||
with:
|
||||
sarif_file: results.sarif
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ permissions: {}
|
|||
jobs:
|
||||
trigger-stable-build:
|
||||
runs-on: ubuntu-slim
|
||||
if: github.repository == 'ublue-os/aurora'
|
||||
permissions:
|
||||
contents: read
|
||||
actions: write
|
||||
|
|
|
|||
2
.github/workflows/validate-renovate.yml
vendored
2
.github/workflows/validate-renovate.yml
vendored
|
|
@ -24,7 +24,7 @@ jobs:
|
|||
persist-credentials: false
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
||||
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
|
||||
with:
|
||||
node-version: latest
|
||||
|
||||
|
|
|
|||
2
.github/workflows/zizmor.yml
vendored
2
.github/workflows/zizmor.yml
vendored
|
|
@ -29,6 +29,6 @@ jobs:
|
|||
persist-credentials: false
|
||||
|
||||
- name: Run zizmor
|
||||
uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
|
||||
uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
|
||||
with:
|
||||
persona: auditor
|
||||
|
|
|
|||
|
|
@ -94,7 +94,7 @@ RUN --network=none \
|
|||
/ctx/build_scripts/base/18-image-info.sh && \
|
||||
/ctx/build_scripts/base/19-initramfs.sh && \
|
||||
/ctx/build_scripts/shared/clean-stage.sh && \
|
||||
/ctx/build_scripts/shared/chunkah-xattr.sh && \
|
||||
/ctx/build_scripts/shared/unpackaged.sh && \
|
||||
/ctx/build_scripts/base/20-tests.sh
|
||||
|
||||
CMD ["/sbin/init"]
|
||||
|
|
|
|||
111
Justfile
111
Justfile
|
|
@ -24,7 +24,7 @@ tags := '(
|
|||
)'
|
||||
|
||||
default_image := "aurora"
|
||||
default_tag := "latest"
|
||||
default_tag := "testing"
|
||||
default_flavor := "main"
|
||||
|
||||
# Build Containers
|
||||
|
|
@ -345,70 +345,6 @@ rechunk $image=default_image $tag=default_tag $flavor=default_flavor:
|
|||
CHUNKED_IMAGE="$(podman pull "oci:${CHUNKAH_OUTPUT_DIR}/chunked")"
|
||||
podman tag "${CHUNKED_IMAGE}" "${image_name}:${tag}"
|
||||
|
||||
# build-chunked-oci
|
||||
[arg("flavor", long="flavor", short="f")]
|
||||
[arg("ghcr", long="ghcr", value="true")]
|
||||
[arg("image", long="image", short="i")]
|
||||
[arg("previous_build", long="previous-build", value="true")]
|
||||
[arg("tag", long="tag", short="t")]
|
||||
[group('Image')]
|
||||
ostree-rechunk $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="false" $previous_build="false":
|
||||
#!/usr/bin/env bash
|
||||
set -eoux pipefail
|
||||
|
||||
{{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
|
||||
image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
|
||||
fedora_version=$({{ just }} fedora_version --image "${image}" --tag "${tag}" --flavor "${flavor}")
|
||||
|
||||
if [[ "{{ ghcr }}" == "false" ]]; then
|
||||
{{ just }} load-rootful --image "${image}" --tag "${tag}" --flavor "${flavor}"
|
||||
fi
|
||||
|
||||
# TODO: Redo everything here with --previous-build in rpm-ostree 2026.1+
|
||||
# so we don't have to pull an old image + rename it
|
||||
if [[ "${previous_build}" == "true" ]]; then
|
||||
PREVIOUS_IMAGE=ghcr.io/{{ repo_organization }}/"${image_name}":"${tag}"
|
||||
|
||||
# https://github.com/coreos/rpm-ostree/blob/7e2f2065a4aa4d5965b4537bb7d74e0b2898650e/rust/src/compose.rs#L522-L529
|
||||
if skopeo inspect docker://"${PREVIOUS_IMAGE}" | jq -e '.LayersData[1:] | all(.Annotations?["ostree.components"]?)'; then
|
||||
${SUDOIF} ${PODMAN} pull ${PREVIOUS_IMAGE}
|
||||
else
|
||||
echo "${PREVIOUS_IMAGE} doesn't exist. Making a fresh layer Plan instead."
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "${ghcr}" == "true" ]]; then
|
||||
CHUNKED_IMAGE="${image_name}:${tag}"
|
||||
if [[ "${previous_build}" == "true" ]]; then
|
||||
CHUNKED_IMAGE="${PREVIOUS_IMAGE}"
|
||||
fi
|
||||
else
|
||||
# keep the original unrechunked image for local builds
|
||||
CHUNKED_IMAGE="${image_name}:${tag}-chunked"
|
||||
fi
|
||||
|
||||
# 96 layers, conservative default, same what ci-test is using
|
||||
# one layer is secretly being added for the ostree export
|
||||
# 499 is podman run limit
|
||||
# 128 is docker pull limit
|
||||
${SUDOIF} ${PODMAN} run --rm \
|
||||
--privileged \
|
||||
-v "/var/lib/containers:/var/lib/containers" \
|
||||
--entrypoint /usr/bin/rpm-ostree \
|
||||
"${base_image_org}/${base_image_name}:${fedora_version}" \
|
||||
compose build-chunked-oci \
|
||||
--max-layers 127 \
|
||||
--format-version=2 \
|
||||
--bootc \
|
||||
--from "localhost/${image_name}:${tag}" \
|
||||
--output containers-storage:${CHUNKED_IMAGE}
|
||||
|
||||
# rename the image to localhost
|
||||
if [[ "${ghcr}" == "true" && "${previous_build}" == "true" ]]; then
|
||||
${SUDOIF} ${PODMAN} tag ${CHUNKED_IMAGE} "${image_name}:${tag}"
|
||||
${SUDOIF} ${PODMAN} image rm -f ${CHUNKED_IMAGE}
|
||||
fi
|
||||
|
||||
# For Privileged operations
|
||||
[arg("flavor", long="flavor", short="f")]
|
||||
[arg("image", long="image", short="i")]
|
||||
|
|
@ -463,7 +399,7 @@ run $image=default_image $tag=default_tag $flavor=default_flavor:
|
|||
fi
|
||||
|
||||
# Run Container
|
||||
${PODMAN} run -it --rm "${image_name}:${tag}" bash
|
||||
${PODMAN} run -it --rm "${image_name}:${tag}" bash -l
|
||||
|
||||
# Test Changelogs
|
||||
[group('Changelogs')]
|
||||
|
|
@ -739,6 +675,43 @@ gen-sbom $image=default_image $tag=default_tag $flavor=default_flavor $syft_cmd=
|
|||
|
||||
rm -rf "${ROOTFS}"
|
||||
|
||||
# Attach sbom to exisitng image
|
||||
[arg("digest", long="digest")]
|
||||
[arg("flavor", long="flavor", short="f")]
|
||||
[arg("image", long="image", short="i")]
|
||||
[arg("registry", long="registry")]
|
||||
[arg("tag", long="tag", short="t")]
|
||||
[group('Utility')]
|
||||
attach-sbom $image=default_image $tag=default_tag $flavor=default_flavor $registry="" $digest="":
|
||||
#!/usr/bin/env bash
|
||||
set -eoux pipefail
|
||||
|
||||
{{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
|
||||
image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
|
||||
|
||||
OUT_DIR="sbom_out/${image_name}"
|
||||
SBOM="sbom.json"
|
||||
FULL_SBOM_PATH="${OUT_DIR}/${SBOM}"
|
||||
IMAGE="${registry}/${image_name}:${tag}@${digest}"
|
||||
|
||||
# we need to be in the directory of the sbom json file or else we end up having the directories in the oci artifact
|
||||
pushd "${OUT_DIR}"
|
||||
|
||||
oras attach \
|
||||
--artifact-type application/vnd.spdx+json \
|
||||
--annotation filename="${SBOM}" \
|
||||
"${IMAGE}" \
|
||||
"${SBOM}"
|
||||
|
||||
popd
|
||||
|
||||
SBOM_DIGEST="$(oras discover --format json "${IMAGE}" | jq -r '.referrers[] | select(.artifactType == "application/vnd.spdx+json") | .digest')"
|
||||
|
||||
echo "${SBOM_DIGEST}" > /tmp/sbom-digestfile
|
||||
|
||||
# debugging
|
||||
echo "oras pull ${registry}/${image_name}:${tag}@${SBOM_DIGEST}"
|
||||
|
||||
# We are not using https://github.com/actions/cache because of:
|
||||
# https://github.com/ublue-os/aurora/issues/2351
|
||||
# https://github.com/actions/cache/issues/1537
|
||||
|
|
@ -756,7 +729,7 @@ gen-sbom $image=default_image $tag=default_tag $flavor=default_flavor $syft_cmd=
|
|||
[private]
|
||||
setup-cache $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="false" $pull="false" $push="false" $registry="" $github_event="":
|
||||
#!/usr/bin/env bash
|
||||
set -eou pipefail
|
||||
set -eoux pipefail
|
||||
|
||||
image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
|
||||
|
||||
|
|
@ -777,7 +750,7 @@ setup-cache $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="
|
|||
BLESSED_DAY="Sunday"
|
||||
|
||||
# Always attempt to pull cache, but don't on the first run that will publish the build on Sundays
|
||||
if [[ "${CURRENT_DAY}" == "${BLESSED_DAY}" && "$POINT" == "1" && "${ghcr}" == "true" && ( "${github_event}" == "workflow_dispatch" || "${github_event}" == "merge_queue" ) ]]; then
|
||||
if [[ "${CURRENT_DAY}" == "${BLESSED_DAY}" && "$POINT" == "1" && "${ghcr}" == "true" && ( "${github_event}" == "workflow_dispatch" || "${github_event}" == "merge_group" ) ]]; then
|
||||
echo "Not pulling build cache. Uploading fresh cache later."
|
||||
elif [[ "${pull}" == "true" ]]; then
|
||||
# We want to avoid using --allow-path-traversal
|
||||
|
|
@ -792,7 +765,7 @@ setup-cache $image=default_image $tag=default_tag $flavor=default_flavor $ghcr="
|
|||
[[ "${ghcr}" == "true" ]] && \
|
||||
[[ "${CURRENT_DAY}" == "${BLESSED_DAY}" ]] && \
|
||||
[[ "${POINT}" == "1" ]] && \
|
||||
[[ ( "${github_event}" == "workflow_dispatch" || "${github_event}" == "merge_queue" ) ]]; then
|
||||
[[ ( "${github_event}" == "workflow_dispatch" || "${github_event}" == "merge_group" ) ]]; then
|
||||
|
||||
{{ just }} login-registry oras ghcr.io
|
||||
pushd "${BUILDAH_CACHE_DIR}"
|
||||
|
|
|
|||
|
|
@ -8,3 +8,4 @@ gpgkey=https://download.copr.fedorainfracloud.org/results/karmab/kcli/pubkey.gpg
|
|||
repo_gpgcheck=0
|
||||
enabled=0
|
||||
enabled_metadata=1
|
||||
includepkgs=kcli
|
||||
|
|
|
|||
|
|
@ -1,9 +1,15 @@
|
|||
# update includepkgs, remove docker-model-plugin
|
||||
# podman run --rm -ti quay.io/fedora/fedora:45
|
||||
# dnf config-manager addrepo --from-repofile https://download.docker.com/linux/fedora/docker-ce.repo
|
||||
# dnf list --available --repo=docker-ce-stable | grep "docker-ce-stable" | grep -vE "(debug|devel|\.src)" | cut -f1 -d\ | sed 's/\.x86_64//' | sed 's/\.noarch//' | paste -sd " " -
|
||||
|
||||
[docker-ce-stable]
|
||||
name=Docker CE Stable - $basearch
|
||||
baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/stable
|
||||
enabled=0
|
||||
gpgcheck=1
|
||||
gpgkey=https://download.docker.com/linux/fedora/gpg
|
||||
includepkgs=containerd.io docker-buildx-plugin docker-ce docker-ce-cli docker-ce-rootless-extras docker-compose-plugin
|
||||
|
||||
[docker-ce-stable-source]
|
||||
name=Docker CE Stable - Sources
|
||||
|
|
|
|||
|
|
@ -4,3 +4,4 @@ baseurl=https://packages.microsoft.com/yumrepos/vscode
|
|||
enabled=0
|
||||
gpgcheck=1
|
||||
gpgkey=https://packages.microsoft.com/keys/microsoft.asc
|
||||
includepkgs=code
|
||||
|
|
|
|||
|
|
@ -8,3 +8,4 @@ gpgkey=https://download.copr.fedorainfracloud.org/results/ledif/kairpods/pubkey.
|
|||
repo_gpgcheck=0
|
||||
enabled=0
|
||||
enabled_metadata=1
|
||||
includepkgs=kairpods
|
||||
|
|
|
|||
|
|
@ -9,3 +9,4 @@ repo_gpgcheck=0
|
|||
enabled=0
|
||||
enabled_metadata=1
|
||||
priority=1
|
||||
includepkgs=Sunshine
|
||||
|
|
|
|||
|
|
@ -6,3 +6,4 @@ type=rpm
|
|||
repo_gpgcheck=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://pkgs.tailscale.com/stable/fedora/repo.gpg
|
||||
includepkgs=tailscale
|
||||
|
|
|
|||
25
build_files/shared/usr/share/dnf5/repos.d/terra.repo
Normal file
25
build_files/shared/usr/share/dnf5/repos.d/terra.repo
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
[terra]
|
||||
name=Terra $releasever
|
||||
# disable mirrors because they are very flakey
|
||||
baseurl=https://repos.fyralabs.com/terra$releasever
|
||||
# metalink=https://tetsudou.fyralabs.com/metalink?repo=terra$releasever&arch=$basearch
|
||||
metadata_expire=6h
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=https://repos.fyralabs.com/terra$releasever/key.asc
|
||||
repo_gpgcheck=1
|
||||
enabled=0
|
||||
enabled_metadata=1
|
||||
countme=1
|
||||
|
||||
[terra-source]
|
||||
name=Terra $releasever - Source
|
||||
baseurl=https://repos.fyralabs.com/terra$releasever-source
|
||||
# metalink=https://tetsudou.fyralabs.com/metalink?repo=terra$releasever-source&arch=$basearch
|
||||
metadata_expire=6h
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=https://repos.fyralabs.com/terra$releasever/key.asc
|
||||
repo_gpgcheck=1
|
||||
enabled=0
|
||||
enabled_metadata=0
|
||||
|
|
@ -21,6 +21,7 @@ OVERRIDES=(
|
|||
"mesa-libEGL"
|
||||
"mesa-libGL"
|
||||
"mesa-libgbm"
|
||||
"mesa-libOpenCL"
|
||||
"mesa-vulkan-drivers"
|
||||
"openh264"
|
||||
)
|
||||
|
|
@ -60,10 +61,12 @@ FEDORA_PACKAGES=(
|
|||
ifuse
|
||||
igt-gpu-tools
|
||||
input-remapper
|
||||
intel-compute-runtime
|
||||
iwd
|
||||
just
|
||||
kate
|
||||
kate{-krunner-plugin,-plugins}
|
||||
kcm-fcitx5
|
||||
fzf # for just
|
||||
krb5-workstation
|
||||
ksystemlog
|
||||
libcamera-gstreamer
|
||||
|
|
@ -82,7 +85,10 @@ FEDORA_PACKAGES=(
|
|||
plasma-firewall-"${PLASMA_VERS}"
|
||||
plasma-oxygen
|
||||
plasma-union-"${PLASMA_VERS}"
|
||||
plasma-wallpapers-dynamic
|
||||
# TODO: look into removing this, plasma supports the transition feature of this natively
|
||||
plasma-wallpapers-dynamic-builder
|
||||
plasma-wallpapers-dynamic-builder{-bash,-fish,-zsh}-completion
|
||||
pocl
|
||||
powertop
|
||||
rclone
|
||||
restic
|
||||
|
|
@ -98,6 +104,7 @@ FEDORA_PACKAGES=(
|
|||
tmux
|
||||
traceroute
|
||||
vim
|
||||
xdg-native-messaging-proxy
|
||||
yubikey-manager
|
||||
zsh
|
||||
)
|
||||
|
|
@ -125,10 +132,9 @@ if [[ $(arch) == x86_64 ]]; then
|
|||
PACKAGES+=( "${FEDORA_PACKAGES_AMD64[@]}" "${NEGATIVO_PACKAGES_AMD64[@]}" )
|
||||
fi
|
||||
|
||||
dnf -y install --enablerepo='fedora-multimedia' "${PACKAGES[@]}"
|
||||
|
||||
# Fedora Tailscale is usually behind
|
||||
dnf -y install --from-repo='tailscale-stable' tailscale
|
||||
dnf -y install \
|
||||
--setopt=install_weak_deps=False \
|
||||
--enablerepo='fedora-multimedia' "${PACKAGES[@]}"
|
||||
|
||||
COPR_UBLUE_OS_PACKAGES=(
|
||||
kcm_ublue
|
||||
|
|
@ -136,14 +142,31 @@ COPR_UBLUE_OS_PACKAGES=(
|
|||
oversteer-udev
|
||||
# https://github.com/ublue-os/akmods/issues/537
|
||||
ublue-os-selinux-workarounds
|
||||
)
|
||||
TERRA_PACKAGES=(
|
||||
# our auto-updater
|
||||
uupd
|
||||
)
|
||||
# used in motd, in general useful to have
|
||||
nerdfontssymbolsonly-nerd-fonts
|
||||
game-devices-udev
|
||||
)
|
||||
|
||||
dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ublue-os:packages' "${COPR_UBLUE_OS_PACKAGES[@]}"
|
||||
# Fedora Tailscale is usually behind
|
||||
TAILSCALE=(tailscale)
|
||||
|
||||
dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ledif:kairpods' kairpods
|
||||
dnf -y install --from-repo="terra" "${TERRA_PACKAGES[@]}"
|
||||
|
||||
dnf -y install --from-repo='copr:copr.fedorainfracloud.org:lizardbyte:stable' sunshine
|
||||
COPR_PREFIX="copr:copr.fedorainfracloud.org"
|
||||
|
||||
dnf -y install --from-repo="${COPR_PREFIX}:ublue-os:packages" "${COPR_UBLUE_OS_PACKAGES[@]}"
|
||||
|
||||
# TODO: figure something out that works well across DX, nvidia with the ublue-os coprs
|
||||
# so we can have less transactions, while still not being vulnerable to copr injections
|
||||
# shellcheck disable=SC1010
|
||||
dnf do -y \
|
||||
--action install --from-repo="${COPR_PREFIX}:ledif:kairpods" kairpods \
|
||||
--action install --from-repo="${COPR_PREFIX}:lizardbyte:stable" Sunshine \
|
||||
--action install --from-repo='tailscale-stable' "${TAILSCALE[@]}"
|
||||
|
||||
# Packages to exclude - common to all versions
|
||||
EXCLUDED_PACKAGES=(
|
||||
|
|
@ -158,6 +181,8 @@ EXCLUDED_PACKAGES=(
|
|||
krfb{,-libs}
|
||||
plasma-discover{,-libs}
|
||||
plasma-welcome-fedora
|
||||
# https://github.com/ublue-os/aurora/issues/3066
|
||||
xwaylandvideobridge
|
||||
)
|
||||
|
||||
dnf -y remove "${EXCLUDED_PACKAGES[@]}"
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ echo "::group:: ===$(basename "$0")==="
|
|||
set -eoux pipefail
|
||||
|
||||
# Enable Flathub
|
||||
curl --retry 3 -Lo /etc/flatpak/remotes.d/flathub.flatpakrepo https://dl.flathub.org/repo/flathub.flatpakrepo
|
||||
curl --retry 3 -Lo /usr/share/flatpak/remotes.d/flathub.flatpakrepo https://dl.flathub.org/repo/flathub.flatpakrepo
|
||||
|
||||
# Offline Aurora documentation
|
||||
ghcurl "https://github.com/ublue-os/aurora-docs/releases/download/0.1/aurora.pdf" --retry 3 -o /tmp/aurora.pdf
|
||||
|
|
@ -20,13 +20,6 @@ curl -X 'GET' \
|
|||
'https://flathub.org/api/v2/stats/io.github.kolunmi.Bazaar?all=false&days=1' \
|
||||
-H 'accept: application/json' | jq -r ".installs_last_7_days" | numfmt --to=si --round=nearest > /usr/share/ublue-os/bazaar-install-count
|
||||
|
||||
# Nerdfont symbols
|
||||
# to fix motd and prompt atleast temporarily
|
||||
ghcurl "https://github.com/ryanoasis/nerd-fonts/releases/latest/download/NerdFontsSymbolsOnly.zip" --retry 3 -o /tmp/nerdfontsymbols.zip
|
||||
unzip /tmp/nerdfontsymbols.zip -d /tmp
|
||||
mkdir -p /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/
|
||||
mv /tmp/SymbolsNerdFont*.ttf /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/
|
||||
|
||||
# Bash Preexec v0.6.0
|
||||
ghcurl https://raw.githubusercontent.com/rcaloras/bash-preexec/b73ed5f7f953207b958f15b1773721dded697ac3/bash-preexec.sh --retry 3 -Lo /usr/share/bash-preexec
|
||||
|
||||
|
|
|
|||
|
|
@ -5,9 +5,38 @@ echo "::group:: ===$(basename "$0")==="
|
|||
set -ouex pipefail
|
||||
|
||||
KERNEL_VERSION=$(rpm -q --queryformat="%{evr}.%{arch}" kernel-core)
|
||||
INITRAMFS="/usr/lib/modules/${KERNEL_VERSION}/initramfs.img"
|
||||
|
||||
export DRACUT_NO_XATTR=1
|
||||
/usr/bin/dracut --kver "${KERNEL_VERSION}" --reproducible -v -f "/usr/lib/modules/${KERNEL_VERSION}/initramfs.img"
|
||||
chmod 0600 "/usr/lib/modules/${KERNEL_VERSION}/initramfs.img"
|
||||
V4L2_PATH="$(rpm -ql kmod-v4l2loopback)"
|
||||
|
||||
DRACUT_REMOVE=(
|
||||
# makes no difference if in initramfs or not
|
||||
# this is a hack FIXME in ublue-os/akmods
|
||||
${V4L2_PATH} # ko.kz file has build id's changing -> non-reproducible
|
||||
)
|
||||
|
||||
# https://github.com/ublue-os/aurora/issues/2568
|
||||
# these strings change with every build
|
||||
TMP_OS_RELEASE=$(mktemp --tmpdir 'os-release-XXXXXXXXXX')
|
||||
OS_RELEASE="/usr/lib/os-release"
|
||||
cp "${OS_RELEASE}" "${TMP_OS_RELEASE}"
|
||||
sed -Ei -e '/^((OSTREE_)?(IMAGE_)?VERSION|PRETTY_NAME|BUILD_ID)=/d' "${OS_RELEASE}"
|
||||
|
||||
DRACUT_NO_XATTR=1 /usr/bin/dracut \
|
||||
--kver "${KERNEL_VERSION}" \
|
||||
--reproducible \
|
||||
--verbose \
|
||||
--force \
|
||||
--remove "${DRACUT_REMOVE[@]}" \
|
||||
"${INITRAMFS}"
|
||||
|
||||
# mv causes permissions to change
|
||||
cp "${TMP_OS_RELEASE}" "${OS_RELEASE}"
|
||||
rm "${TMP_OS_RELEASE}"
|
||||
|
||||
chmod 0600 "${INITRAMFS}"
|
||||
|
||||
# for debugging
|
||||
sha256sum "${INITRAMFS}"
|
||||
|
||||
echo "::endgroup::"
|
||||
|
|
|
|||
|
|
@ -43,7 +43,7 @@ test -f /usr/share/flatpak/preinstall.d/bazaar.preinstall
|
|||
test -f /usr/lib/systemd/system/flatpak-add-fedora-repos.service && false
|
||||
|
||||
# Is flathub enabled by default?
|
||||
test -f /etc/flatpak/remotes.d/flathub.flatpakrepo
|
||||
test -f /usr/share/flatpak/remotes.d/flathub.flatpakrepo
|
||||
|
||||
# Make sure to not pull in the bazzite one
|
||||
rpm -q plasma-setup --qf "%{RELEASE}" | grep -q aurora
|
||||
|
|
@ -129,6 +129,7 @@ UNWANTED_PACKAGES=(
|
|||
fedora-third-party
|
||||
firefox
|
||||
plasma-discover
|
||||
xwaylandvideobridge
|
||||
)
|
||||
|
||||
for package in "${UNWANTED_PACKAGES[@]}"; do
|
||||
|
|
|
|||
|
|
@ -61,39 +61,26 @@ if [[ ! "${IMAGE_NAME}" =~ nvidia ]]; then
|
|||
FEDORA_PACKAGES+=("rocm-hip" "rocm-opencl" "rocm-smi")
|
||||
fi
|
||||
|
||||
echo "Installing ${#FEDORA_PACKAGES[@]} DX packages from Fedora repos..."
|
||||
dnf5 -y install "${FEDORA_PACKAGES[@]}"
|
||||
|
||||
# docker is not available for f45 yet
|
||||
# https://github.com/docker/docker-ce-packaging/issues/1353
|
||||
# TODO: get it from docker again once it's available
|
||||
if [[ $(rpm -E %fedora) == "44" ]]; then
|
||||
# Docker packages from their repo
|
||||
dnf -y install --from-repo=docker-ce-stable \
|
||||
containerd.io \
|
||||
docker-buildx-plugin \
|
||||
docker-ce \
|
||||
docker-ce-cli \
|
||||
# We could use Fedora's moby packages, these are "official"
|
||||
DOCKER_CE=(
|
||||
containerd.io
|
||||
docker-buildx-plugin
|
||||
docker-ce
|
||||
docker-ce-cli
|
||||
docker-compose-plugin
|
||||
else
|
||||
# we get this from common, the fedora package provides the exact same one
|
||||
rm -f /usr/lib/sysusers.d/docker.conf
|
||||
)
|
||||
|
||||
dnf -y install \
|
||||
containerd \
|
||||
docker-buildx \
|
||||
moby-engine \
|
||||
docker-cli \
|
||||
docker-compose
|
||||
fi
|
||||
COPR_PREFIX="copr:copr.fedorainfracloud.org"
|
||||
|
||||
# VSCode package from Microsoft repo
|
||||
dnf -y install --from-repo=code \
|
||||
code
|
||||
# shellcheck disable=SC1010
|
||||
dnf do -y \
|
||||
--action install --from-repo=code code \
|
||||
--action install --from-repo=docker-ce-stable "${DOCKER_CE[@]}" \
|
||||
--action install --from-repo="${COPR_PREFIX}:karmab:kcli" kcli
|
||||
|
||||
dnf -y install --from-repo='copr:copr.fedorainfracloud.org:karmab:kcli' kcli
|
||||
|
||||
dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ublue-os:packages' ublue-os-libvirt-workarounds
|
||||
dnf -y install --from-repo="${COPR_PREFIX}:ublue-os:packages" ublue-os-libvirt-workarounds
|
||||
|
||||
rsync -rvK /ctx/system_files/dx/ /
|
||||
|
||||
|
|
|
|||
|
|
@ -6,11 +6,10 @@ set -eoux pipefail
|
|||
|
||||
IMPORTANT_PACKAGES_DX=(
|
||||
code
|
||||
# containerd.io
|
||||
containerd
|
||||
# docker-ce
|
||||
# docker-buildx-plugin
|
||||
# docker-compose-plugin
|
||||
containerd.io
|
||||
docker-ce
|
||||
docker-buildx-plugin
|
||||
docker-compose-plugin
|
||||
flatpak-builder
|
||||
libvirt
|
||||
qemu
|
||||
|
|
|
|||
|
|
@ -1,10 +1,9 @@
|
|||
# This script should generally set up the build so we can move on to start installing packages
|
||||
|
||||
#!/usr/bin/bash
|
||||
# This script should generally set up the build so we can move on to start installing packages
|
||||
|
||||
set -eoux pipefail
|
||||
|
||||
# Speeds up local builds and workaround network flakes, mainly for COPR and negativo
|
||||
# Speeds up local builds and workaround network flakes, mainly for COPR, negativo and terra
|
||||
cp /etc/dnf/dnf.conf /etc/dnf/dnf.conf.bak
|
||||
dnf config-manager setopt keepcache=1 timeout=60
|
||||
|
||||
|
|
@ -24,7 +23,7 @@ dnf config-manager setopt fedora-multimedia.priority=90
|
|||
|
||||
# https://fedoraproject.org/wiki/OpenH264
|
||||
# this would be fine to use as well, negativo just has it, one less repo
|
||||
dnf config-manager setopt fedora-cisco-openh264.enabled=0
|
||||
dnf config-manager disable fedora-cisco-openh264
|
||||
|
||||
mkdir -p /tmp/scripts/helpers
|
||||
install -Dm0755 /ctx/build_scripts/shared/utils/ghcurl /tmp/scripts/helpers/ghcurl
|
||||
|
|
|
|||
|
|
@ -1,26 +0,0 @@
|
|||
# See: https://github.com/coreos/chunkah#customizing-the-layers
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -eoux pipefail
|
||||
|
||||
setfattr -n user.component -v "aurora-wallpapers" /usr/share/backgrounds/aurora
|
||||
setfattr -n user.update-interval -v "monthly" /usr/share/backgrounds/aurora
|
||||
|
||||
setfattr -n user.component -v "aurora-assets" /usr/share/plasma/avatars/{echo,lumina,scope,tina,vincent}.png
|
||||
setfattr -n user.component -v "aurora-assets" /etc/bazaar/*.jxl
|
||||
setfattr -n user.update-interval -v "quarterly" /etc/bazaar/*.jxl
|
||||
|
||||
setfattr -n user.component -v "aurora-plasma-theme" /usr/share/plasma/look-and-feel/dev.getaurora.aurora{,light}.desktop
|
||||
setfattr -n user.update-interval -v "quarterly" /usr/share/plasma/look-and-feel/dev.getaurora.aurora{,light}.desktop
|
||||
|
||||
setfattr -n user.component -v "aurora-config" /usr/share/ublue-os
|
||||
setfattr -n user.component -v "homebrew" /usr/share/homebrew.tar.zst
|
||||
|
||||
setfattr -n user.component -v "aurora-offline-docs" /usr/share/doc/aurora/aurora.pdf
|
||||
|
||||
setfattr -n user.component -v "nerdfonts" /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly
|
||||
setfattr -n user.update-interval -v "yearly" /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly
|
||||
|
||||
setfattr -n user.component -v "aurora-config" /usr/lib/systemd/system-generators/coreos-sulogin-force-generator
|
||||
|
||||
setfattr -n user.component -v "aurora-config" /usr/share/bash-preexec
|
||||
56
build_scripts/shared/unpackaged.sh
Executable file
56
build_scripts/shared/unpackaged.sh
Executable file
|
|
@ -0,0 +1,56 @@
|
|||
#!/usr/bin/env bash
|
||||
# See: https://github.com/coreos/chunkah#customizing-the-layers
|
||||
echo "::group:: ===$(basename "$0")==="
|
||||
|
||||
set -eoux pipefail
|
||||
|
||||
HOMEBREW_TARBALL=/usr/share/homebrew.tar.zst
|
||||
setfattr -n user.component -v "homebrew" "${HOMEBREW_TARBALL}"
|
||||
|
||||
# rpm-ostree creates tmpfiles from packages having owned files in /{var,run}
|
||||
RPM_OSTREE_TMPFILES=/usr/lib/rpm-ostree/tmpfiles.d
|
||||
setfattr -n user.component -v "rpm-ostree-tmpfiles.d" "${RPM_OSTREE_TMPFILES}"
|
||||
# vibes, shouldn't change super often
|
||||
setfattr -n user.update-interval -v "quarterly" "${RPM_OSTREE_TMPFILES}"
|
||||
|
||||
FONTCONFIG_CACHE=/usr/lib/fontconfig/cache
|
||||
setfattr -n user.component -v "fontconfig-cache" "${FONTCONFIG_CACHE}"
|
||||
# also vibes, no idea how often this changes, but it seems to change often
|
||||
setfattr -n user.update-interval -v "daily" "${FONTCONFIG_CACHE}"
|
||||
|
||||
WALLPAPERS=/usr/share/backgrounds/aurora
|
||||
setfattr -n user.component -v "aurora-wallpapers" "${WALLPAPERS}"
|
||||
setfattr -n user.update-interval -v "monthly" "${WALLPAPERS}"
|
||||
|
||||
AURORA_CHARS=(/usr/share/plasma/avatars/{echo,lumina,scope,tina,vincent}.png)
|
||||
setfattr -n user.component -v "aurora-assets" "${AURORA_CHARS[@]}"
|
||||
|
||||
BAZAAR=(/etc/bazaar/*.jxl)
|
||||
setfattr -n user.component -v "aurora-assets" "${BAZAAR[@]}"
|
||||
setfattr -n user.update-interval -v "quarterly" "${BAZAAR[@]}"
|
||||
|
||||
AURORA_DOCS_PDF="/usr/share/doc/aurora/aurora.pdf"
|
||||
setfattr -n user.component -v "aurora-offline-docs" "${AURORA_DOCS_PDF}"
|
||||
|
||||
# TODO: everything else we can probably add here
|
||||
FRAMEWORK_ICC=(/usr/share/color/icc/colord/framework1{3,6}.icc)
|
||||
setfattr -n user.component -v "never-change" "${FRAMEWORK_ICC[@]}"
|
||||
setfattr -n user.update-interval -v "yearly" "${FRAMEWORK_ICC[@]}"
|
||||
|
||||
# This is absolutely nasty, ideally we'd use SOURCE_DATE_EPOCH=0 on chunkah
|
||||
# instead of all the touch invocations but this (potentially) affects the layer
|
||||
# plan negatively See: https://github.com/coreos/chunkah/issues/160
|
||||
#
|
||||
# on the composefs backend this also makes it so that bootc inconsistently gets
|
||||
# the image creation date across backends (uupd will send a notification) this
|
||||
# doesn't happen on ostree, but is an issue on composefs
|
||||
# https://github.com/bootc-dev/bootc/issues/2227
|
||||
|
||||
# EPOCH=1 or else we may lose some of our changes due to native overay diff being set to false
|
||||
# https://github.com/ublue-os/aurora/issues/3093
|
||||
find /usr /etc /opt -newermt '1970-01-01T00:00:00Z' -exec touch -h -a -m -d '1970-01-01T00:00:01Z' {} +
|
||||
|
||||
# getfattr -R -d /usr 2> /dev/null || true
|
||||
# getfattr -R -d /etc 2> /dev/null || true
|
||||
|
||||
echo "::endgroup::"
|
||||
|
|
@ -3,22 +3,22 @@ images:
|
|||
- name: kinoite
|
||||
image: quay.io/fedora-ostree-desktops/kinoite
|
||||
tag: 45
|
||||
digest: sha256:3f180f9445a00fc278397755b49bc038d51dbf9a64feecff9dc8a0e9fb0d9533
|
||||
digest: sha256:2a1fea9adbd27dd87935508115d88ab5c7b335114e32994e7c2c615545ea5cac
|
||||
|
||||
# https://github.com/get-aurora-dev/common
|
||||
- name: common
|
||||
image: ghcr.io/get-aurora-dev/common
|
||||
tag: latest
|
||||
digest: sha256:06278789114c4138d7dda9cf259f938e2a15d6ce834ff121ac8e0dbe8cf19cbe
|
||||
digest: sha256:2888e957bd72e1656c8de374bbfa3a933c19aad82dccd0994bd1766e03973ff1
|
||||
|
||||
# https://github.com/ublue-os/brew
|
||||
- name: brew
|
||||
image: ghcr.io/ublue-os/brew
|
||||
tag: latest
|
||||
digest: sha256:cf6388d6edb3a6fad699f06c0ceb3807f8f1368f942b08f8cc6d45ac4fd1cd92
|
||||
digest: sha256:0c9703f1a49faa89a44d9458a68c0ca03270e8bdd32018285dad8b14ddd7cdc3
|
||||
|
||||
# https://github.com/coreos/chunkah
|
||||
- name: chunkah
|
||||
image: quay.io/coreos/chunkah
|
||||
tag: latest
|
||||
digest: sha256:ff8b8b466a942ec6000445d4001fc661e2fc5a952ad9ee29b4de9ab09d1d1708
|
||||
digest: sha256:71e593421c5de7dcc7c8c5c50e98d3bac572055a76f399f61a491d123c20a523
|
||||
|
|
|
|||
30
system_files/shared/usr/bin/aurora-iwd-deprecation-notifier
Executable file
30
system_files/shared/usr/bin/aurora-iwd-deprecation-notifier
Executable file
|
|
@ -0,0 +1,30 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
TITLE="IWD Wi-Fi backend is deprecated"
|
||||
MESSAGE="Intel has discontinued IWD development. Please move back to wpa_supplicant.
|
||||
|
||||
Note: Reverting will require reconnecting to your Wi-Fi networks (saved passwords must be re-entered).
|
||||
|
||||
To switch now, run: 'ujust toggle-iwd'"
|
||||
|
||||
URL="https://docs.getaurora.dev/blog/deprecating-iwd"
|
||||
|
||||
USERS="$(loginctl list-users --no-legend | awk '$1 != 0 {print $2}')"
|
||||
|
||||
for username in ${USERS}; do
|
||||
machinectl shell "${username}@.host" /usr/bin/bash -c '
|
||||
ACTION=$(notify-send \
|
||||
--app-name=Aurora \
|
||||
--icon=network-wireless \
|
||||
--urgency=critical \
|
||||
"$1" \
|
||||
"$2" \
|
||||
--action="open=More Info")
|
||||
|
||||
if [ "$ACTION" = "open" ]; then
|
||||
systemd-run --user /usr/bin/xdg-open "$3"
|
||||
fi
|
||||
' _ "$TITLE" "$MESSAGE" "$URL"
|
||||
done
|
||||
|
|
@ -1,2 +1,5 @@
|
|||
[install]
|
||||
root-fs-type = "btrfs"
|
||||
|
||||
# do not remove this, this is used during the installation for signed images
|
||||
enforce-container-sigpolicy = true
|
||||
|
|
|
|||
|
|
@ -1,8 +1,11 @@
|
|||
enable aurora-groups.service
|
||||
enable bootc-update-ca-trust.service
|
||||
enable bootc-update-crypto-policies.service
|
||||
enable brew-setup.service
|
||||
enable dconf-update.service
|
||||
enable flatpak-preinstall.service
|
||||
enable input-remapper.service
|
||||
enable aurora-iwd-deprecation-notifier.timer
|
||||
# DO NOT REMOVE THIS
|
||||
# see /usr/bin/rechunker-group-fix
|
||||
enable rechunker-group-fix.service
|
||||
|
|
|
|||
|
|
@ -0,0 +1,12 @@
|
|||
[Unit]
|
||||
Description=Aurora IWD Deprecation Notifier
|
||||
Documentation=https://docs.getaurora.dev/blog/deprecating-iwd
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecCondition=/usr/bin/bash -c "/usr/bin/NetworkManager --print-config | /usr/bin/grep -q '^wifi.backend=iwd'"
|
||||
ExecStart=/usr/bin/aurora-iwd-deprecation-notifier
|
||||
|
||||
[Install]
|
||||
WantedBy=graphical.target
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
[Unit]
|
||||
Description=Run aurora-iwd-deprecation-notifier 20 mins after boot
|
||||
Documentation=https://docs.getaurora.dev/blog/deprecating-iwd
|
||||
|
||||
[Timer]
|
||||
OnBootSec=20min
|
||||
Unit=aurora-iwd-deprecation-notifier.service
|
||||
OnUnitActiveSec=1w
|
||||
Persistent=true
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
# Regenerate files preserved by the /etc three-way merge after image upgrades.
|
||||
[Unit]
|
||||
Description=Regenerate CA certificate trust store
|
||||
Documentation=https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663
|
||||
ConditionPathIsMountPoint=/sysroot
|
||||
ConditionPathExists=/usr/bin/update-ca-trust
|
||||
DefaultDependencies=no
|
||||
Requires=local-fs.target
|
||||
After=local-fs.target
|
||||
Before=sysinit.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=/usr/bin/update-ca-trust extract
|
||||
|
||||
[Install]
|
||||
WantedBy=sysinit.target
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
# Regenerate backend files preserved by the /etc three-way merge after image upgrades.
|
||||
[Unit]
|
||||
Description=Regenerate crypto-policies backend configuration
|
||||
Documentation=https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663
|
||||
ConditionPathIsMountPoint=/sysroot
|
||||
ConditionPathExists=/usr/bin/update-crypto-policies
|
||||
DefaultDependencies=no
|
||||
Requires=local-fs.target
|
||||
After=local-fs.target
|
||||
Before=sysinit.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=/bin/bash -ec 'policy=$(/usr/bin/update-crypto-policies --show); exec /usr/bin/update-crypto-policies --set "$$policy"'
|
||||
|
||||
[Install]
|
||||
WantedBy=sysinit.target
|
||||
Loading…
Reference in a new issue