feat: FROM quay.io/fedora-ostree-desktops/kinoite (#1615)
* feat: FROM quay.io/fedora-ostree-desktops/kinoite Instead of using the ublue-os/kinoite-main base image we would be using the ones built by Timothée over at https://gitlab.com/fedora/ostree/ci-test This is a good path forward for Aurora because: - we no longer have to undo things we inherit from ublue-os/main - less overall dependencies - we can make more conscious decisions about what goes into the image - it's easier now to build images on top of upcoming Fedora versions (even KDE nightly ones) or to base on top of potential future images that are more aligned with our goals and needs This would come at the cost of maintaining most of what main did previously ourselves. * chore: remove ublue-os-akmods-addons * chore: codecs from negativo * feat: add flathub * fix: fedora flatpak be gone * feat: miscellaneous workarounds * feat: CoreOS rescue boot generator * feat: allow brew programs with sudo * chore: re-add packages from main * chore: remove packages we removed in main * chore: renovate there is no latest tag * fix: remove explicit ublue akmods copr cleanup already included with all the others * chore: remove added fedora flatpak service We don't need this * fix(renovate): set proper tag --------- Co-authored-by: inffy <10782843+inffy@users.noreply.github.com>
This commit is contained in:
renner
GitHub
parent
2952ac1e93
commit
2678890be6
13 changed files with 150 additions and 28 deletions
2
.github/renovate.json5
vendored
2
.github/renovate.json5
vendored
|
|
@ -38,7 +38,7 @@
|
|||
"automerge": true,
|
||||
"matchUpdateTypes": ["digest"],
|
||||
"matchDepNames": [
|
||||
"ghcr.io/ublue-os/kinoite-main",
|
||||
"quay.io/fedora-ostree-desktops/kinoite",
|
||||
"ghcr.io/ublue-os/brew",
|
||||
"ghcr.io/get-aurora-dev/common"
|
||||
]
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
ARG BASE_IMAGE_NAME="kinoite"
|
||||
ARG FEDORA_MAJOR_VERSION="41"
|
||||
ARG SOURCE_IMAGE="${BASE_IMAGE_NAME}-main"
|
||||
ARG BASE_IMAGE="ghcr.io/ublue-os/${SOURCE_IMAGE}"
|
||||
ARG FEDORA_MAJOR_VERSION="43"
|
||||
ARG SOURCE_IMAGE="${BASE_IMAGE_NAME}"
|
||||
ARG BASE_IMAGE="quay.io/fedora-ostree-desktops/${SOURCE_IMAGE}"
|
||||
ARG COMMON_IMAGE="ghcr.io/get-aurora-dev/common:latest"
|
||||
ARG COMMON_IMAGE_SHA=""
|
||||
ARG BREW_IMAGE="ghcr.io/ublue-os/brew:latest"
|
||||
|
|
|
|||
7
Justfile
7
Justfile
|
|
@ -127,8 +127,7 @@ build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline
|
|||
fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}')
|
||||
|
||||
# Verify Base Image with cosign
|
||||
{{ just }} verify-container "${base_image_name}-main:${fedora_version}"
|
||||
|
||||
{{ just }} verify-container ${base_image_name}:${fedora_version} quay.io/fedora-ostree-desktops "https://gitlab.com/fedora/ostree/ci-test/-/raw/main/quay.io-fedora-ostree-desktops.pub?ref_type=heads"
|
||||
# Kernel Release/Pin
|
||||
if [[ -z "${kernel_pin:-}" ]]; then
|
||||
kernel_release=$(skopeo inspect --retry-times 3 docker://ghcr.io/ublue-os/akmods:"${akmods_flavor}"-"${fedora_version}" | jq -r '.Labels["ostree.linux"]')
|
||||
|
|
@ -196,7 +195,7 @@ build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline
|
|||
# Pull in most recent upstream base image
|
||||
# if building locally/not ghcr pull the new image
|
||||
if [[ {{ ghcr }} == "0" ]]; then
|
||||
${PODMAN} pull "ghcr.io/ublue-os/kinoite-main:${fedora_version}"
|
||||
${PODMAN} pull "quay.io/fedora-ostree-desktops/${base_image_name}:${fedora_version}"
|
||||
fi
|
||||
|
||||
# Labels
|
||||
|
|
@ -326,7 +325,7 @@ rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0":
|
|||
|
||||
# Cleanup Space during Github Action
|
||||
if [[ "{{ ghcr }}" == "1" ]]; then
|
||||
base_image_name=kinoite-main
|
||||
base_image_name=kinoite
|
||||
if [[ "${tag}" =~ stable ]]; then
|
||||
tag="stable-daily"
|
||||
fi
|
||||
|
|
|
|||
|
|
@ -31,9 +31,7 @@ dnf5 -y install \
|
|||
|
||||
dnf5 versionlock add kernel kernel-devel kernel-devel-matched kernel-core kernel-modules kernel-modules-core kernel-modules-extra
|
||||
|
||||
# Everyone
|
||||
# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming
|
||||
sed -i 's@enabled=0@enabled=1@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo
|
||||
dnf copr enable -y ublue-os/akmods
|
||||
|
||||
# RPMFUSION Dependent AKMODS
|
||||
dnf5 -y install \
|
||||
|
|
@ -47,6 +45,8 @@ dnf5 -y install \
|
|||
v4l2loopback /tmp/akmods/kmods/*v4l2loopback*.rpm
|
||||
dnf5 -y remove rpmfusion-free-release rpmfusion-nonfree-release
|
||||
|
||||
mkdir -p /etc/pki/akmods/certs
|
||||
ghcurl "https://github.com/ublue-os/akmods/raw/refs/heads/main/certs/public_key.der" --retry 3 -Lo /etc/pki/akmods/certs/akmods-ublue.der
|
||||
|
||||
# Nvidia AKMODS
|
||||
if [[ "${IMAGE_NAME}" =~ nvidia ]]; then
|
||||
|
|
|
|||
|
|
@ -4,6 +4,41 @@ echo "::group:: ===$(basename "$0")==="
|
|||
|
||||
set -ouex pipefail
|
||||
|
||||
# use negativo17 for 3rd party packages with higher priority than default
|
||||
if ! grep -q fedora-multimedia <(dnf5 repolist); then
|
||||
# Enable or Install Repofile
|
||||
dnf5 config-manager setopt fedora-multimedia.enabled=1 ||
|
||||
dnf5 config-manager addrepo --from-repofile="https://negativo17.org/repos/fedora-multimedia.repo"
|
||||
fi
|
||||
# Set higher priority
|
||||
dnf5 config-manager setopt fedora-multimedia.priority=90
|
||||
|
||||
# Add Flathub to the image for eventual application
|
||||
mkdir -p /etc/flatpak/remotes.d/
|
||||
curl --retry 3 -Lo /etc/flatpak/remotes.d/flathub.flatpakrepo https://dl.flathub.org/repo/flathub.flatpakrepo
|
||||
|
||||
# may break SDDM/KWin when upgraded
|
||||
dnf5 versionlock add "qt6-*"
|
||||
|
||||
# use override to replace mesa and others with less crippled versions
|
||||
OVERRIDES=(
|
||||
"intel-gmmlib"
|
||||
"intel-mediasdk"
|
||||
"intel-vpl-gpu-rt"
|
||||
"libheif"
|
||||
"libva"
|
||||
"libva-intel-media-driver"
|
||||
"mesa-dri-drivers"
|
||||
"mesa-filesystem"
|
||||
"mesa-libEGL"
|
||||
"mesa-libGL"
|
||||
"mesa-libgbm"
|
||||
"mesa-va-drivers"
|
||||
"mesa-vulkan-drivers"
|
||||
)
|
||||
|
||||
dnf5 distro-sync --skip-unavailable -y --repo='fedora-multimedia' "${OVERRIDES[@]}"
|
||||
dnf5 versionlock add "${OVERRIDES[@]}"
|
||||
# All DNF-related operations should be done here whenever possible
|
||||
#shellcheck source=build_files/shared/copr-helpers.sh
|
||||
source /ctx/build_files/shared/copr-helpers.sh
|
||||
|
|
@ -22,29 +57,72 @@ dnf5 versionlock add plasma-desktop
|
|||
|
||||
FEDORA_PACKAGES=(
|
||||
adcli
|
||||
alsa-firmware
|
||||
apr
|
||||
apr-util
|
||||
borgbackup
|
||||
davfs2
|
||||
distrobox
|
||||
evtest
|
||||
fastfetch
|
||||
fcitx5-chinese-addons
|
||||
fcitx5-configtool
|
||||
fcitx5-gtk
|
||||
fcitx5-hangul
|
||||
fcitx5-libthai
|
||||
fcitx5-mozc
|
||||
fcitx5-qt
|
||||
fcitx5-sayura
|
||||
fcitx5-unikey
|
||||
fdk-aac
|
||||
ffmpeg
|
||||
ffmpeg-libs
|
||||
fish
|
||||
flatpak-spawn
|
||||
foo2zjs
|
||||
freeipa-client
|
||||
git-credential-libsecret
|
||||
glow
|
||||
google-noto-sans-balinese-fonts
|
||||
google-noto-sans-cjk-fonts
|
||||
google-noto-sans-javanese-fonts
|
||||
google-noto-sans-sundanese-fonts
|
||||
grub2-tools-extra
|
||||
gum
|
||||
heif-pixbuf-loader
|
||||
htop
|
||||
icoutils
|
||||
ifuse
|
||||
igt-gpu-tools
|
||||
input-remapper
|
||||
intel-vaapi-driver
|
||||
iwd
|
||||
just
|
||||
kate
|
||||
kcm-fcitx5
|
||||
krb5-workstation
|
||||
ksshaskpass
|
||||
ksystemlog
|
||||
libavcodec
|
||||
libcamera-gstreamer
|
||||
libcamera-tools
|
||||
libfdk-aac
|
||||
libheif
|
||||
libimobiledevice
|
||||
libimobiledevice-utils
|
||||
libratbag-ratbagd
|
||||
libsss_autofs
|
||||
libva-utils
|
||||
libxcrypt-compat
|
||||
lm_sensors
|
||||
lshw
|
||||
nvtop
|
||||
oddjob-mkhomedir
|
||||
openrgb-udev-rules
|
||||
pam-u2f
|
||||
pam_yubico
|
||||
pamu2fcfg
|
||||
pipewire-libs-extra
|
||||
plasma-wallpapers-dynamic
|
||||
powerstat
|
||||
powertop
|
||||
|
|
@ -55,14 +133,21 @@ FEDORA_PACKAGES=(
|
|||
samba-winbind-clients
|
||||
samba-winbind-modules
|
||||
setools-console
|
||||
solaar-udev
|
||||
squashfs-tools
|
||||
sssd-ad
|
||||
sssd-ipa
|
||||
sssd-krb5
|
||||
symlinks
|
||||
tcpdump
|
||||
tmux
|
||||
traceroute
|
||||
uld
|
||||
vim
|
||||
virtualbox-guest-additions
|
||||
wireguard-tools
|
||||
wl-clipboard
|
||||
yubikey-manager
|
||||
zsh
|
||||
)
|
||||
|
||||
|
|
@ -102,8 +187,9 @@ copr_install_isolated "ublue-os/staging" \
|
|||
|
||||
# From ublue-os/packages
|
||||
copr_install_isolated "ublue-os/packages" \
|
||||
"krunner-bazaar" \
|
||||
"kcm_ublue" \
|
||||
"krunner-bazaar" \
|
||||
"oversteer-udev" \
|
||||
"uupd"
|
||||
|
||||
# Version-specific COPR packages
|
||||
|
|
@ -130,13 +216,16 @@ copr_install_isolated "lizardbyte/beta" \
|
|||
EXCLUDED_PACKAGES=(
|
||||
akonadi-server
|
||||
akonadi-server-mysql
|
||||
cosign
|
||||
default-fonts-cjk-sans
|
||||
fedora-bookmarks
|
||||
fedora-chromium-config
|
||||
fedora-chromium-config-kde
|
||||
fedora-third-party
|
||||
ffmpegthumbnailer
|
||||
firefox
|
||||
firefox-langpacks
|
||||
firewall-config
|
||||
google-noto-sans-cjk-vf-fonts
|
||||
kcharselect
|
||||
khelpcenter
|
||||
krfb
|
||||
|
|
@ -145,6 +234,7 @@ EXCLUDED_PACKAGES=(
|
|||
mariadb-common
|
||||
mariadb-errmsg
|
||||
plasma-discover-kns
|
||||
plasma-discover-rpm-ostree
|
||||
plasma-welcome-fedora
|
||||
podman-docker
|
||||
)
|
||||
|
|
@ -199,6 +289,11 @@ dnf5 -y --repo=copr:copr.fedorainfracloud.org:ublue-os:flatpak-test install flat
|
|||
# dnf5 upgrade --refresh --advisory=FEDORA-2024-dd2e9fb225
|
||||
#fi
|
||||
|
||||
# mitigate upstream packaging bug: https://bugzilla.redhat.com/show_bug.cgi?id=2332429
|
||||
# swap the incorrectly installed OpenCL-ICD-Loader for ocl-icd, the expected package
|
||||
dnf5 -y swap --repo='fedora' \
|
||||
OpenCL-ICD-Loader ocl-icd
|
||||
|
||||
# Explicitly install KDE Plasma related packages with the same version as in base image
|
||||
dnf5 -y install \
|
||||
plasma-firewall-$(rpm -q --qf "%{VERSION}" plasma-desktop)
|
||||
|
|
|
|||
|
|
@ -4,6 +4,16 @@ echo "::group:: ===$(basename "$0")==="
|
|||
|
||||
set -eoux pipefail
|
||||
|
||||
# Footgun, See: https://github.com/ublue-os/main/issues/598
|
||||
rm -f /usr/bin/chsh /usr/bin/lchsh
|
||||
|
||||
# Add linuxbrew to the list of paths usable by `sudo`
|
||||
# not a sudoers.d override because we want to get updates from upstream and not break everything
|
||||
sed -Ei "s/secure_path = (.*)/secure_path = \1:\/home\/linuxbrew\/.linuxbrew\/bin/" /etc/sudoers
|
||||
|
||||
# https://github.com/ublue-os/main/pull/334
|
||||
ln -s "/usr/share/fonts/google-noto-sans-cjk-fonts" "/usr/share/fonts/noto-cjk"
|
||||
|
||||
# Documentation is available online
|
||||
rm -rf /usr/share/doc
|
||||
|
||||
|
|
@ -32,6 +42,12 @@ mv /tmp/SymbolsNerdFont*.ttf /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/
|
|||
# Bash Prexec v0.6.0
|
||||
ghcurl https://raw.githubusercontent.com/rcaloras/bash-preexec/b73ed5f7f953207b958f15b1773721dded697ac3/bash-preexec.sh --retry 3 -Lo /usr/share/bash-prexec
|
||||
|
||||
# use CoreOS' generator for emergency/rescue boot
|
||||
# see detail: https://github.com/ublue-os/main/issues/653
|
||||
mkdir -p /usr/lib/systemd/system-generators
|
||||
ghcurl "https://raw.githubusercontent.com/coreos/fedora-coreos-config/refs/heads/stable/overlay.d/05core/usr/lib/systemd/system-generators/coreos-sulogin-force-generator" --retry 3 -Lo /usr/lib/systemd/system-generators/coreos-sulogin-force-generator
|
||||
chmod +x /usr/lib/systemd/system-generators/coreos-sulogin-force-generator
|
||||
|
||||
# Caps
|
||||
setcap 'cap_net_raw+ep' /usr/libexec/ksysguard/ksgrd_network_helper
|
||||
|
||||
|
|
|
|||
|
|
@ -52,7 +52,7 @@ systemctl disable flatpak-add-fedora-repos.service
|
|||
# We only need to clean up repos that were enabled during the build process.
|
||||
|
||||
# Disable third-party repos
|
||||
for repo in negativo17-fedora-multimedia tailscale fedora-cisco-openh264; do
|
||||
for repo in fedora-multimedia tailscale fedora-cisco-openh264; do
|
||||
if [[ -f "/etc/yum.repos.d/${repo}.repo" ]]; then
|
||||
sed -i 's@enabled=1@enabled=0@g' "/etc/yum.repos.d/${repo}.repo"
|
||||
fi
|
||||
|
|
@ -77,11 +77,6 @@ for i in /etc/yum.repos.d/_copr:*.repo; do
|
|||
fi
|
||||
done
|
||||
|
||||
# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming
|
||||
if [[ -f "/etc/yum.repos.d/_copr_ublue-os-akmods.repo" ]]; then
|
||||
sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo
|
||||
fi
|
||||
|
||||
# Disable RPM Fusion repos
|
||||
for i in /etc/yum.repos.d/rpmfusion-*.repo; do
|
||||
if [[ -f "$i" ]]; then
|
||||
|
|
|
|||
|
|
@ -105,6 +105,7 @@ done
|
|||
# and are considered footguns
|
||||
UNWANTED_PACKAGES=(
|
||||
akonadi-server
|
||||
fedora-flathub-remote
|
||||
fedora-logos
|
||||
fedora-third-party
|
||||
firefox
|
||||
|
|
|
|||
|
|
@ -136,8 +136,7 @@ systemctl enable --global aurora-dx-user-vscode.service
|
|||
# We only need to clean up repos that were enabled during the build process.
|
||||
sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo
|
||||
|
||||
# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming
|
||||
sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo
|
||||
sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr:copr.fedorainfracloud.org:ublue-os:akmods.repo
|
||||
|
||||
# Disable RPM Fusion repos
|
||||
for i in /etc/yum.repos.d/rpmfusion-*.repo; do
|
||||
|
|
|
|||
|
|
@ -5,8 +5,6 @@ set -eoux pipefail
|
|||
echo "::group:: Copy Files"
|
||||
|
||||
# We need to remove this package here because lots of files we add from `{projectbluefin,get-aurora-dev}/common` override the rpm files and they also go away when you do `dnf remove`
|
||||
# TODO: this can be removed whenever we stop doing FROM ublue-os/kinoite-main
|
||||
dnf remove -y ublue-os-just ublue-os-signing ublue-os-udev-rules ublue-os-luks ublue-os-update-services
|
||||
rpm --erase --nodeps fedora-logos
|
||||
|
||||
# Copy Files to Container
|
||||
|
|
|
|||
|
|
@ -65,7 +65,7 @@ echo ""
|
|||
echo "Checking other third-party repositories..."
|
||||
# List of known third-party repos that should be disabled
|
||||
OTHER_REPOS=(
|
||||
"negativo17-fedora-multimedia.repo"
|
||||
"fedora-multimedia.repo"
|
||||
"tailscale.repo"
|
||||
"vscode.repo"
|
||||
"docker-ce.repo"
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
images:
|
||||
- name: kinoite-main
|
||||
image: ghcr.io/ublue-os/kinoite-main
|
||||
tag: latest
|
||||
digest: sha256:f1efb104b4d45d37fb6758be49a144a7ee241a5bacdd33fa6ed2f9bc149b7f0a
|
||||
- name: kinoite
|
||||
image: quay.io/fedora-ostree-desktops/kinoite
|
||||
tag: 43
|
||||
digest: sha256:93962fe63d3ac16d395e00c319a08e84c20df655b53220a8761d399e34864dc7
|
||||
- name: common
|
||||
image: ghcr.io/get-aurora-dev/common
|
||||
tag: latest
|
||||
|
|
|
|||
19
system_files/shared/usr/share/dnf/plugins/copr.vendor.conf
Normal file
19
system_files/shared/usr/share/dnf/plugins/copr.vendor.conf
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
# This override is to handle the default behavior of dnf5 using ID at /etc/os-release
|
||||
# to select which chroot gets used to fetch the copr repo.
|
||||
#
|
||||
# An example of the behavior displayed without this override in Bazzite:
|
||||
# sudo dnf5 copr enable ublue-os/bling
|
||||
# https://copr.fedorainfracloud.org/api_3/rpmrepo/ublue-os/bling/bazzite-41/ 100% | 946.0 B/s | 500.0 B | 00m01s
|
||||
# Chroot not found in the given Copr project (bazzite-41-x86_64). You can choose one of the available chroots explicitly:
|
||||
# fedora-38-x86_64
|
||||
# fedora-39-x86_64
|
||||
# fedora-40-x86_64
|
||||
# fedora-41-x86_64
|
||||
# fedora-rawhide-x86_64
|
||||
#
|
||||
# See:
|
||||
# https://github.com/rpm-software-management/dnf5/blob/01d4df824ff4a94ae1fc288f81923d02ba71173a/dnf5-plugins/copr_plugin/copr_config.cpp#L79-L81
|
||||
# https://github.com/rpm-software-management/dnf5/blob/01d4df824ff4a94ae1fc288f81923d02ba71173a/dnf5-plugins/copr_plugin/copr_repo.cpp#L146
|
||||
|
||||
[main]
|
||||
distribution = fedora
|
||||
Loading…
Reference in a new issue