diff --git a/.github/renovate.json5 b/.github/renovate.json5 index ff7f471e..92b96d6a 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -38,7 +38,7 @@ "automerge": true, "matchUpdateTypes": ["digest"], "matchDepNames": [ - "ghcr.io/ublue-os/kinoite-main", + "quay.io/fedora-ostree-desktops/kinoite", "ghcr.io/ublue-os/brew", "ghcr.io/get-aurora-dev/common" ] diff --git a/Containerfile b/Containerfile index 0a96a692..abed632f 100644 --- a/Containerfile +++ b/Containerfile @@ -1,7 +1,7 @@ ARG BASE_IMAGE_NAME="kinoite" -ARG FEDORA_MAJOR_VERSION="41" -ARG SOURCE_IMAGE="${BASE_IMAGE_NAME}-main" -ARG BASE_IMAGE="ghcr.io/ublue-os/${SOURCE_IMAGE}" +ARG FEDORA_MAJOR_VERSION="43" +ARG SOURCE_IMAGE="${BASE_IMAGE_NAME}" +ARG BASE_IMAGE="quay.io/fedora-ostree-desktops/${SOURCE_IMAGE}" ARG COMMON_IMAGE="ghcr.io/get-aurora-dev/common:latest" ARG COMMON_IMAGE_SHA="" ARG BREW_IMAGE="ghcr.io/ublue-os/brew:latest" diff --git a/Justfile b/Justfile index 4cdf36dc..99918594 100644 --- a/Justfile +++ b/Justfile @@ -127,8 +127,7 @@ build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}') # Verify Base Image with cosign - {{ just }} verify-container "${base_image_name}-main:${fedora_version}" - + {{ just }} verify-container ${base_image_name}:${fedora_version} quay.io/fedora-ostree-desktops "https://gitlab.com/fedora/ostree/ci-test/-/raw/main/quay.io-fedora-ostree-desktops.pub?ref_type=heads" # Kernel Release/Pin if [[ -z "${kernel_pin:-}" ]]; then kernel_release=$(skopeo inspect --retry-times 3 docker://ghcr.io/ublue-os/akmods:"${akmods_flavor}"-"${fedora_version}" | jq -r '.Labels["ostree.linux"]') @@ -196,7 +195,7 @@ build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline # Pull in most recent upstream base image # if building locally/not ghcr pull the new image if [[ {{ ghcr }} == "0" ]]; then - ${PODMAN} pull "ghcr.io/ublue-os/kinoite-main:${fedora_version}" + ${PODMAN} pull "quay.io/fedora-ostree-desktops/${base_image_name}:${fedora_version}" fi # Labels @@ -326,7 +325,7 @@ rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0": # Cleanup Space during Github Action if [[ "{{ ghcr }}" == "1" ]]; then - base_image_name=kinoite-main + base_image_name=kinoite if [[ "${tag}" =~ stable ]]; then tag="stable-daily" fi diff --git a/build_files/base/03-install-kernel-akmods.sh b/build_files/base/03-install-kernel-akmods.sh index ebd0e0aa..9537ec76 100755 --- a/build_files/base/03-install-kernel-akmods.sh +++ b/build_files/base/03-install-kernel-akmods.sh @@ -31,9 +31,7 @@ dnf5 -y install \ dnf5 versionlock add kernel kernel-devel kernel-devel-matched kernel-core kernel-modules kernel-modules-core kernel-modules-extra -# Everyone -# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -sed -i 's@enabled=0@enabled=1@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo +dnf copr enable -y ublue-os/akmods # RPMFUSION Dependent AKMODS dnf5 -y install \ @@ -47,6 +45,8 @@ dnf5 -y install \ v4l2loopback /tmp/akmods/kmods/*v4l2loopback*.rpm dnf5 -y remove rpmfusion-free-release rpmfusion-nonfree-release +mkdir -p /etc/pki/akmods/certs +ghcurl "https://github.com/ublue-os/akmods/raw/refs/heads/main/certs/public_key.der" --retry 3 -Lo /etc/pki/akmods/certs/akmods-ublue.der # Nvidia AKMODS if [[ "${IMAGE_NAME}" =~ nvidia ]]; then diff --git a/build_files/base/04-packages.sh b/build_files/base/04-packages.sh index f9667a5e..ecfaaea3 100755 --- a/build_files/base/04-packages.sh +++ b/build_files/base/04-packages.sh @@ -4,6 +4,41 @@ echo "::group:: ===$(basename "$0")===" set -ouex pipefail +# use negativo17 for 3rd party packages with higher priority than default +if ! grep -q fedora-multimedia <(dnf5 repolist); then + # Enable or Install Repofile + dnf5 config-manager setopt fedora-multimedia.enabled=1 || + dnf5 config-manager addrepo --from-repofile="https://negativo17.org/repos/fedora-multimedia.repo" +fi +# Set higher priority +dnf5 config-manager setopt fedora-multimedia.priority=90 + +# Add Flathub to the image for eventual application +mkdir -p /etc/flatpak/remotes.d/ +curl --retry 3 -Lo /etc/flatpak/remotes.d/flathub.flatpakrepo https://dl.flathub.org/repo/flathub.flatpakrepo + +# may break SDDM/KWin when upgraded +dnf5 versionlock add "qt6-*" + +# use override to replace mesa and others with less crippled versions +OVERRIDES=( + "intel-gmmlib" + "intel-mediasdk" + "intel-vpl-gpu-rt" + "libheif" + "libva" + "libva-intel-media-driver" + "mesa-dri-drivers" + "mesa-filesystem" + "mesa-libEGL" + "mesa-libGL" + "mesa-libgbm" + "mesa-va-drivers" + "mesa-vulkan-drivers" +) + +dnf5 distro-sync --skip-unavailable -y --repo='fedora-multimedia' "${OVERRIDES[@]}" +dnf5 versionlock add "${OVERRIDES[@]}" # All DNF-related operations should be done here whenever possible #shellcheck source=build_files/shared/copr-helpers.sh source /ctx/build_files/shared/copr-helpers.sh @@ -22,29 +57,72 @@ dnf5 versionlock add plasma-desktop FEDORA_PACKAGES=( adcli + alsa-firmware + apr + apr-util borgbackup davfs2 + distrobox evtest fastfetch + fcitx5-chinese-addons + fcitx5-configtool + fcitx5-gtk + fcitx5-hangul + fcitx5-libthai + fcitx5-mozc + fcitx5-qt + fcitx5-sayura + fcitx5-unikey + fdk-aac + ffmpeg + ffmpeg-libs fish + flatpak-spawn foo2zjs freeipa-client git-credential-libsecret glow + google-noto-sans-balinese-fonts + google-noto-sans-cjk-fonts + google-noto-sans-javanese-fonts + google-noto-sans-sundanese-fonts + grub2-tools-extra gum + heif-pixbuf-loader + htop + icoutils ifuse igt-gpu-tools input-remapper + intel-vaapi-driver iwd just + kate kcm-fcitx5 krb5-workstation + ksshaskpass ksystemlog + libavcodec + libcamera-gstreamer + libcamera-tools + libfdk-aac + libheif libimobiledevice + libimobiledevice-utils + libratbag-ratbagd libsss_autofs + libva-utils libxcrypt-compat lm_sensors + lshw + nvtop oddjob-mkhomedir + openrgb-udev-rules + pam-u2f + pam_yubico + pamu2fcfg + pipewire-libs-extra plasma-wallpapers-dynamic powerstat powertop @@ -55,14 +133,21 @@ FEDORA_PACKAGES=( samba-winbind-clients samba-winbind-modules setools-console + solaar-udev + squashfs-tools sssd-ad sssd-ipa sssd-krb5 + symlinks + tcpdump tmux + traceroute uld + vim virtualbox-guest-additions wireguard-tools wl-clipboard + yubikey-manager zsh ) @@ -102,8 +187,9 @@ copr_install_isolated "ublue-os/staging" \ # From ublue-os/packages copr_install_isolated "ublue-os/packages" \ - "krunner-bazaar" \ "kcm_ublue" \ + "krunner-bazaar" \ + "oversteer-udev" \ "uupd" # Version-specific COPR packages @@ -130,13 +216,16 @@ copr_install_isolated "lizardbyte/beta" \ EXCLUDED_PACKAGES=( akonadi-server akonadi-server-mysql - cosign + default-fonts-cjk-sans fedora-bookmarks fedora-chromium-config fedora-chromium-config-kde + fedora-third-party + ffmpegthumbnailer firefox firefox-langpacks firewall-config + google-noto-sans-cjk-vf-fonts kcharselect khelpcenter krfb @@ -145,6 +234,7 @@ EXCLUDED_PACKAGES=( mariadb-common mariadb-errmsg plasma-discover-kns + plasma-discover-rpm-ostree plasma-welcome-fedora podman-docker ) @@ -199,6 +289,11 @@ dnf5 -y --repo=copr:copr.fedorainfracloud.org:ublue-os:flatpak-test install flat # dnf5 upgrade --refresh --advisory=FEDORA-2024-dd2e9fb225 #fi +# mitigate upstream packaging bug: https://bugzilla.redhat.com/show_bug.cgi?id=2332429 +# swap the incorrectly installed OpenCL-ICD-Loader for ocl-icd, the expected package +dnf5 -y swap --repo='fedora' \ + OpenCL-ICD-Loader ocl-icd + # Explicitly install KDE Plasma related packages with the same version as in base image dnf5 -y install \ plasma-firewall-$(rpm -q --qf "%{VERSION}" plasma-desktop) diff --git a/build_files/base/06-override-install.sh b/build_files/base/06-override-install.sh index e0c278fd..9aeca179 100755 --- a/build_files/base/06-override-install.sh +++ b/build_files/base/06-override-install.sh @@ -4,6 +4,16 @@ echo "::group:: ===$(basename "$0")===" set -eoux pipefail +# Footgun, See: https://github.com/ublue-os/main/issues/598 +rm -f /usr/bin/chsh /usr/bin/lchsh + +# Add linuxbrew to the list of paths usable by `sudo` +# not a sudoers.d override because we want to get updates from upstream and not break everything +sed -Ei "s/secure_path = (.*)/secure_path = \1:\/home\/linuxbrew\/.linuxbrew\/bin/" /etc/sudoers + +# https://github.com/ublue-os/main/pull/334 +ln -s "/usr/share/fonts/google-noto-sans-cjk-fonts" "/usr/share/fonts/noto-cjk" + # Documentation is available online rm -rf /usr/share/doc @@ -32,6 +42,12 @@ mv /tmp/SymbolsNerdFont*.ttf /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/ # Bash Prexec v0.6.0 ghcurl https://raw.githubusercontent.com/rcaloras/bash-preexec/b73ed5f7f953207b958f15b1773721dded697ac3/bash-preexec.sh --retry 3 -Lo /usr/share/bash-prexec +# use CoreOS' generator for emergency/rescue boot +# see detail: https://github.com/ublue-os/main/issues/653 +mkdir -p /usr/lib/systemd/system-generators +ghcurl "https://raw.githubusercontent.com/coreos/fedora-coreos-config/refs/heads/stable/overlay.d/05core/usr/lib/systemd/system-generators/coreos-sulogin-force-generator" --retry 3 -Lo /usr/lib/systemd/system-generators/coreos-sulogin-force-generator +chmod +x /usr/lib/systemd/system-generators/coreos-sulogin-force-generator + # Caps setcap 'cap_net_raw+ep' /usr/libexec/ksysguard/ksgrd_network_helper diff --git a/build_files/base/17-cleanup.sh b/build_files/base/17-cleanup.sh index dd39e682..513761fa 100755 --- a/build_files/base/17-cleanup.sh +++ b/build_files/base/17-cleanup.sh @@ -52,7 +52,7 @@ systemctl disable flatpak-add-fedora-repos.service # We only need to clean up repos that were enabled during the build process. # Disable third-party repos -for repo in negativo17-fedora-multimedia tailscale fedora-cisco-openh264; do +for repo in fedora-multimedia tailscale fedora-cisco-openh264; do if [[ -f "/etc/yum.repos.d/${repo}.repo" ]]; then sed -i 's@enabled=1@enabled=0@g' "/etc/yum.repos.d/${repo}.repo" fi @@ -77,11 +77,6 @@ for i in /etc/yum.repos.d/_copr:*.repo; do fi done -# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -if [[ -f "/etc/yum.repos.d/_copr_ublue-os-akmods.repo" ]]; then - sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo -fi - # Disable RPM Fusion repos for i in /etc/yum.repos.d/rpmfusion-*.repo; do if [[ -f "$i" ]]; then diff --git a/build_files/base/20-tests.sh b/build_files/base/20-tests.sh index 41cdb08d..14ba0814 100755 --- a/build_files/base/20-tests.sh +++ b/build_files/base/20-tests.sh @@ -105,6 +105,7 @@ done # and are considered footguns UNWANTED_PACKAGES=( akonadi-server + fedora-flathub-remote fedora-logos fedora-third-party firefox diff --git a/build_files/dx/00-dx.sh b/build_files/dx/00-dx.sh index 8ea51ebe..c97c8a89 100755 --- a/build_files/dx/00-dx.sh +++ b/build_files/dx/00-dx.sh @@ -136,8 +136,7 @@ systemctl enable --global aurora-dx-user-vscode.service # We only need to clean up repos that were enabled during the build process. sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo -# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo +sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr:copr.fedorainfracloud.org:ublue-os:akmods.repo # Disable RPM Fusion repos for i in /etc/yum.repos.d/rpmfusion-*.repo; do diff --git a/build_files/shared/build.sh b/build_files/shared/build.sh index c39d449f..06549b32 100755 --- a/build_files/shared/build.sh +++ b/build_files/shared/build.sh @@ -5,8 +5,6 @@ set -eoux pipefail echo "::group:: Copy Files" # We need to remove this package here because lots of files we add from `{projectbluefin,get-aurora-dev}/common` override the rpm files and they also go away when you do `dnf remove` -# TODO: this can be removed whenever we stop doing FROM ublue-os/kinoite-main -dnf remove -y ublue-os-just ublue-os-signing ublue-os-udev-rules ublue-os-luks ublue-os-update-services rpm --erase --nodeps fedora-logos # Copy Files to Container diff --git a/build_files/shared/validate-repos.sh b/build_files/shared/validate-repos.sh index e05b2be1..8535444a 100755 --- a/build_files/shared/validate-repos.sh +++ b/build_files/shared/validate-repos.sh @@ -65,7 +65,7 @@ echo "" echo "Checking other third-party repositories..." # List of known third-party repos that should be disabled OTHER_REPOS=( - "negativo17-fedora-multimedia.repo" + "fedora-multimedia.repo" "tailscale.repo" "vscode.repo" "docker-ce.repo" diff --git a/image-versions.yml b/image-versions.yml index b3a74ee9..4b3db9b5 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -1,8 +1,8 @@ images: - - name: kinoite-main - image: ghcr.io/ublue-os/kinoite-main - tag: latest - digest: sha256:f1efb104b4d45d37fb6758be49a144a7ee241a5bacdd33fa6ed2f9bc149b7f0a + - name: kinoite + image: quay.io/fedora-ostree-desktops/kinoite + tag: 43 + digest: sha256:93962fe63d3ac16d395e00c319a08e84c20df655b53220a8761d399e34864dc7 - name: common image: ghcr.io/get-aurora-dev/common tag: latest diff --git a/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf b/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf new file mode 100644 index 00000000..3ad3bc76 --- /dev/null +++ b/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf @@ -0,0 +1,19 @@ +# This override is to handle the default behavior of dnf5 using ID at /etc/os-release +# to select which chroot gets used to fetch the copr repo. +# +# An example of the behavior displayed without this override in Bazzite: +# sudo dnf5 copr enable ublue-os/bling +# https://copr.fedorainfracloud.org/api_3/rpmrepo/ublue-os/bling/bazzite-41/ 100% | 946.0 B/s | 500.0 B | 00m01s +# Chroot not found in the given Copr project (bazzite-41-x86_64). You can choose one of the available chroots explicitly: +# fedora-38-x86_64 +# fedora-39-x86_64 +# fedora-40-x86_64 +# fedora-41-x86_64 +# fedora-rawhide-x86_64 +# +# See: +# https://github.com/rpm-software-management/dnf5/blob/01d4df824ff4a94ae1fc288f81923d02ba71173a/dnf5-plugins/copr_plugin/copr_config.cpp#L79-L81 +# https://github.com/rpm-software-management/dnf5/blob/01d4df824ff4a94ae1fc288f81923d02ba71173a/dnf5-plugins/copr_plugin/copr_repo.cpp#L146 + +[main] +distribution = fedora