From 2678890be6df0557458470aa8f94a5567f516648 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Tue, 13 Jan 2026 05:52:08 +0100 Subject: [PATCH] feat: FROM quay.io/fedora-ostree-desktops/kinoite (#1615) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat: FROM quay.io/fedora-ostree-desktops/kinoite Instead of using the ublue-os/kinoite-main base image we would be using the ones built by Timothée over at https://gitlab.com/fedora/ostree/ci-test This is a good path forward for Aurora because: - we no longer have to undo things we inherit from ublue-os/main - less overall dependencies - we can make more conscious decisions about what goes into the image - it's easier now to build images on top of upcoming Fedora versions (even KDE nightly ones) or to base on top of potential future images that are more aligned with our goals and needs This would come at the cost of maintaining most of what main did previously ourselves. * chore: remove ublue-os-akmods-addons * chore: codecs from negativo * feat: add flathub * fix: fedora flatpak be gone * feat: miscellaneous workarounds * feat: CoreOS rescue boot generator * feat: allow brew programs with sudo * chore: re-add packages from main * chore: remove packages we removed in main * chore: renovate there is no latest tag * fix: remove explicit ublue akmods copr cleanup already included with all the others * chore: remove added fedora flatpak service We don't need this * fix(renovate): set proper tag --------- Co-authored-by: inffy <10782843+inffy@users.noreply.github.com> --- .github/renovate.json5 | 2 +- Containerfile | 6 +- Justfile | 7 +- build_files/base/03-install-kernel-akmods.sh | 6 +- build_files/base/04-packages.sh | 99 ++++++++++++++++++- build_files/base/06-override-install.sh | 16 +++ build_files/base/17-cleanup.sh | 7 +- build_files/base/20-tests.sh | 1 + build_files/dx/00-dx.sh | 3 +- build_files/shared/build.sh | 2 - build_files/shared/validate-repos.sh | 2 +- image-versions.yml | 8 +- .../usr/share/dnf/plugins/copr.vendor.conf | 19 ++++ 13 files changed, 150 insertions(+), 28 deletions(-) create mode 100644 system_files/shared/usr/share/dnf/plugins/copr.vendor.conf diff --git a/.github/renovate.json5 b/.github/renovate.json5 index ff7f471e..92b96d6a 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -38,7 +38,7 @@ "automerge": true, "matchUpdateTypes": ["digest"], "matchDepNames": [ - "ghcr.io/ublue-os/kinoite-main", + "quay.io/fedora-ostree-desktops/kinoite", "ghcr.io/ublue-os/brew", "ghcr.io/get-aurora-dev/common" ] diff --git a/Containerfile b/Containerfile index 0a96a692..abed632f 100644 --- a/Containerfile +++ b/Containerfile @@ -1,7 +1,7 @@ ARG BASE_IMAGE_NAME="kinoite" -ARG FEDORA_MAJOR_VERSION="41" -ARG SOURCE_IMAGE="${BASE_IMAGE_NAME}-main" -ARG BASE_IMAGE="ghcr.io/ublue-os/${SOURCE_IMAGE}" +ARG FEDORA_MAJOR_VERSION="43" +ARG SOURCE_IMAGE="${BASE_IMAGE_NAME}" +ARG BASE_IMAGE="quay.io/fedora-ostree-desktops/${SOURCE_IMAGE}" ARG COMMON_IMAGE="ghcr.io/get-aurora-dev/common:latest" ARG COMMON_IMAGE_SHA="" ARG BREW_IMAGE="ghcr.io/ublue-os/brew:latest" diff --git a/Justfile b/Justfile index 4cdf36dc..99918594 100644 --- a/Justfile +++ b/Justfile @@ -127,8 +127,7 @@ build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}') # Verify Base Image with cosign - {{ just }} verify-container "${base_image_name}-main:${fedora_version}" - + {{ just }} verify-container ${base_image_name}:${fedora_version} quay.io/fedora-ostree-desktops "https://gitlab.com/fedora/ostree/ci-test/-/raw/main/quay.io-fedora-ostree-desktops.pub?ref_type=heads" # Kernel Release/Pin if [[ -z "${kernel_pin:-}" ]]; then kernel_release=$(skopeo inspect --retry-times 3 docker://ghcr.io/ublue-os/akmods:"${akmods_flavor}"-"${fedora_version}" | jq -r '.Labels["ostree.linux"]') @@ -196,7 +195,7 @@ build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline # Pull in most recent upstream base image # if building locally/not ghcr pull the new image if [[ {{ ghcr }} == "0" ]]; then - ${PODMAN} pull "ghcr.io/ublue-os/kinoite-main:${fedora_version}" + ${PODMAN} pull "quay.io/fedora-ostree-desktops/${base_image_name}:${fedora_version}" fi # Labels @@ -326,7 +325,7 @@ rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0": # Cleanup Space during Github Action if [[ "{{ ghcr }}" == "1" ]]; then - base_image_name=kinoite-main + base_image_name=kinoite if [[ "${tag}" =~ stable ]]; then tag="stable-daily" fi diff --git a/build_files/base/03-install-kernel-akmods.sh b/build_files/base/03-install-kernel-akmods.sh index ebd0e0aa..9537ec76 100755 --- a/build_files/base/03-install-kernel-akmods.sh +++ b/build_files/base/03-install-kernel-akmods.sh @@ -31,9 +31,7 @@ dnf5 -y install \ dnf5 versionlock add kernel kernel-devel kernel-devel-matched kernel-core kernel-modules kernel-modules-core kernel-modules-extra -# Everyone -# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -sed -i 's@enabled=0@enabled=1@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo +dnf copr enable -y ublue-os/akmods # RPMFUSION Dependent AKMODS dnf5 -y install \ @@ -47,6 +45,8 @@ dnf5 -y install \ v4l2loopback /tmp/akmods/kmods/*v4l2loopback*.rpm dnf5 -y remove rpmfusion-free-release rpmfusion-nonfree-release +mkdir -p /etc/pki/akmods/certs +ghcurl "https://github.com/ublue-os/akmods/raw/refs/heads/main/certs/public_key.der" --retry 3 -Lo /etc/pki/akmods/certs/akmods-ublue.der # Nvidia AKMODS if [[ "${IMAGE_NAME}" =~ nvidia ]]; then diff --git a/build_files/base/04-packages.sh b/build_files/base/04-packages.sh index f9667a5e..ecfaaea3 100755 --- a/build_files/base/04-packages.sh +++ b/build_files/base/04-packages.sh @@ -4,6 +4,41 @@ echo "::group:: ===$(basename "$0")===" set -ouex pipefail +# use negativo17 for 3rd party packages with higher priority than default +if ! grep -q fedora-multimedia <(dnf5 repolist); then + # Enable or Install Repofile + dnf5 config-manager setopt fedora-multimedia.enabled=1 || + dnf5 config-manager addrepo --from-repofile="https://negativo17.org/repos/fedora-multimedia.repo" +fi +# Set higher priority +dnf5 config-manager setopt fedora-multimedia.priority=90 + +# Add Flathub to the image for eventual application +mkdir -p /etc/flatpak/remotes.d/ +curl --retry 3 -Lo /etc/flatpak/remotes.d/flathub.flatpakrepo https://dl.flathub.org/repo/flathub.flatpakrepo + +# may break SDDM/KWin when upgraded +dnf5 versionlock add "qt6-*" + +# use override to replace mesa and others with less crippled versions +OVERRIDES=( + "intel-gmmlib" + "intel-mediasdk" + "intel-vpl-gpu-rt" + "libheif" + "libva" + "libva-intel-media-driver" + "mesa-dri-drivers" + "mesa-filesystem" + "mesa-libEGL" + "mesa-libGL" + "mesa-libgbm" + "mesa-va-drivers" + "mesa-vulkan-drivers" +) + +dnf5 distro-sync --skip-unavailable -y --repo='fedora-multimedia' "${OVERRIDES[@]}" +dnf5 versionlock add "${OVERRIDES[@]}" # All DNF-related operations should be done here whenever possible #shellcheck source=build_files/shared/copr-helpers.sh source /ctx/build_files/shared/copr-helpers.sh @@ -22,29 +57,72 @@ dnf5 versionlock add plasma-desktop FEDORA_PACKAGES=( adcli + alsa-firmware + apr + apr-util borgbackup davfs2 + distrobox evtest fastfetch + fcitx5-chinese-addons + fcitx5-configtool + fcitx5-gtk + fcitx5-hangul + fcitx5-libthai + fcitx5-mozc + fcitx5-qt + fcitx5-sayura + fcitx5-unikey + fdk-aac + ffmpeg + ffmpeg-libs fish + flatpak-spawn foo2zjs freeipa-client git-credential-libsecret glow + google-noto-sans-balinese-fonts + google-noto-sans-cjk-fonts + google-noto-sans-javanese-fonts + google-noto-sans-sundanese-fonts + grub2-tools-extra gum + heif-pixbuf-loader + htop + icoutils ifuse igt-gpu-tools input-remapper + intel-vaapi-driver iwd just + kate kcm-fcitx5 krb5-workstation + ksshaskpass ksystemlog + libavcodec + libcamera-gstreamer + libcamera-tools + libfdk-aac + libheif libimobiledevice + libimobiledevice-utils + libratbag-ratbagd libsss_autofs + libva-utils libxcrypt-compat lm_sensors + lshw + nvtop oddjob-mkhomedir + openrgb-udev-rules + pam-u2f + pam_yubico + pamu2fcfg + pipewire-libs-extra plasma-wallpapers-dynamic powerstat powertop @@ -55,14 +133,21 @@ FEDORA_PACKAGES=( samba-winbind-clients samba-winbind-modules setools-console + solaar-udev + squashfs-tools sssd-ad sssd-ipa sssd-krb5 + symlinks + tcpdump tmux + traceroute uld + vim virtualbox-guest-additions wireguard-tools wl-clipboard + yubikey-manager zsh ) @@ -102,8 +187,9 @@ copr_install_isolated "ublue-os/staging" \ # From ublue-os/packages copr_install_isolated "ublue-os/packages" \ - "krunner-bazaar" \ "kcm_ublue" \ + "krunner-bazaar" \ + "oversteer-udev" \ "uupd" # Version-specific COPR packages @@ -130,13 +216,16 @@ copr_install_isolated "lizardbyte/beta" \ EXCLUDED_PACKAGES=( akonadi-server akonadi-server-mysql - cosign + default-fonts-cjk-sans fedora-bookmarks fedora-chromium-config fedora-chromium-config-kde + fedora-third-party + ffmpegthumbnailer firefox firefox-langpacks firewall-config + google-noto-sans-cjk-vf-fonts kcharselect khelpcenter krfb @@ -145,6 +234,7 @@ EXCLUDED_PACKAGES=( mariadb-common mariadb-errmsg plasma-discover-kns + plasma-discover-rpm-ostree plasma-welcome-fedora podman-docker ) @@ -199,6 +289,11 @@ dnf5 -y --repo=copr:copr.fedorainfracloud.org:ublue-os:flatpak-test install flat # dnf5 upgrade --refresh --advisory=FEDORA-2024-dd2e9fb225 #fi +# mitigate upstream packaging bug: https://bugzilla.redhat.com/show_bug.cgi?id=2332429 +# swap the incorrectly installed OpenCL-ICD-Loader for ocl-icd, the expected package +dnf5 -y swap --repo='fedora' \ + OpenCL-ICD-Loader ocl-icd + # Explicitly install KDE Plasma related packages with the same version as in base image dnf5 -y install \ plasma-firewall-$(rpm -q --qf "%{VERSION}" plasma-desktop) diff --git a/build_files/base/06-override-install.sh b/build_files/base/06-override-install.sh index e0c278fd..9aeca179 100755 --- a/build_files/base/06-override-install.sh +++ b/build_files/base/06-override-install.sh @@ -4,6 +4,16 @@ echo "::group:: ===$(basename "$0")===" set -eoux pipefail +# Footgun, See: https://github.com/ublue-os/main/issues/598 +rm -f /usr/bin/chsh /usr/bin/lchsh + +# Add linuxbrew to the list of paths usable by `sudo` +# not a sudoers.d override because we want to get updates from upstream and not break everything +sed -Ei "s/secure_path = (.*)/secure_path = \1:\/home\/linuxbrew\/.linuxbrew\/bin/" /etc/sudoers + +# https://github.com/ublue-os/main/pull/334 +ln -s "/usr/share/fonts/google-noto-sans-cjk-fonts" "/usr/share/fonts/noto-cjk" + # Documentation is available online rm -rf /usr/share/doc @@ -32,6 +42,12 @@ mv /tmp/SymbolsNerdFont*.ttf /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/ # Bash Prexec v0.6.0 ghcurl https://raw.githubusercontent.com/rcaloras/bash-preexec/b73ed5f7f953207b958f15b1773721dded697ac3/bash-preexec.sh --retry 3 -Lo /usr/share/bash-prexec +# use CoreOS' generator for emergency/rescue boot +# see detail: https://github.com/ublue-os/main/issues/653 +mkdir -p /usr/lib/systemd/system-generators +ghcurl "https://raw.githubusercontent.com/coreos/fedora-coreos-config/refs/heads/stable/overlay.d/05core/usr/lib/systemd/system-generators/coreos-sulogin-force-generator" --retry 3 -Lo /usr/lib/systemd/system-generators/coreos-sulogin-force-generator +chmod +x /usr/lib/systemd/system-generators/coreos-sulogin-force-generator + # Caps setcap 'cap_net_raw+ep' /usr/libexec/ksysguard/ksgrd_network_helper diff --git a/build_files/base/17-cleanup.sh b/build_files/base/17-cleanup.sh index dd39e682..513761fa 100755 --- a/build_files/base/17-cleanup.sh +++ b/build_files/base/17-cleanup.sh @@ -52,7 +52,7 @@ systemctl disable flatpak-add-fedora-repos.service # We only need to clean up repos that were enabled during the build process. # Disable third-party repos -for repo in negativo17-fedora-multimedia tailscale fedora-cisco-openh264; do +for repo in fedora-multimedia tailscale fedora-cisco-openh264; do if [[ -f "/etc/yum.repos.d/${repo}.repo" ]]; then sed -i 's@enabled=1@enabled=0@g' "/etc/yum.repos.d/${repo}.repo" fi @@ -77,11 +77,6 @@ for i in /etc/yum.repos.d/_copr:*.repo; do fi done -# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -if [[ -f "/etc/yum.repos.d/_copr_ublue-os-akmods.repo" ]]; then - sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo -fi - # Disable RPM Fusion repos for i in /etc/yum.repos.d/rpmfusion-*.repo; do if [[ -f "$i" ]]; then diff --git a/build_files/base/20-tests.sh b/build_files/base/20-tests.sh index 41cdb08d..14ba0814 100755 --- a/build_files/base/20-tests.sh +++ b/build_files/base/20-tests.sh @@ -105,6 +105,7 @@ done # and are considered footguns UNWANTED_PACKAGES=( akonadi-server + fedora-flathub-remote fedora-logos fedora-third-party firefox diff --git a/build_files/dx/00-dx.sh b/build_files/dx/00-dx.sh index 8ea51ebe..c97c8a89 100755 --- a/build_files/dx/00-dx.sh +++ b/build_files/dx/00-dx.sh @@ -136,8 +136,7 @@ systemctl enable --global aurora-dx-user-vscode.service # We only need to clean up repos that were enabled during the build process. sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo -# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo +sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr:copr.fedorainfracloud.org:ublue-os:akmods.repo # Disable RPM Fusion repos for i in /etc/yum.repos.d/rpmfusion-*.repo; do diff --git a/build_files/shared/build.sh b/build_files/shared/build.sh index c39d449f..06549b32 100755 --- a/build_files/shared/build.sh +++ b/build_files/shared/build.sh @@ -5,8 +5,6 @@ set -eoux pipefail echo "::group:: Copy Files" # We need to remove this package here because lots of files we add from `{projectbluefin,get-aurora-dev}/common` override the rpm files and they also go away when you do `dnf remove` -# TODO: this can be removed whenever we stop doing FROM ublue-os/kinoite-main -dnf remove -y ublue-os-just ublue-os-signing ublue-os-udev-rules ublue-os-luks ublue-os-update-services rpm --erase --nodeps fedora-logos # Copy Files to Container diff --git a/build_files/shared/validate-repos.sh b/build_files/shared/validate-repos.sh index e05b2be1..8535444a 100755 --- a/build_files/shared/validate-repos.sh +++ b/build_files/shared/validate-repos.sh @@ -65,7 +65,7 @@ echo "" echo "Checking other third-party repositories..." # List of known third-party repos that should be disabled OTHER_REPOS=( - "negativo17-fedora-multimedia.repo" + "fedora-multimedia.repo" "tailscale.repo" "vscode.repo" "docker-ce.repo" diff --git a/image-versions.yml b/image-versions.yml index b3a74ee9..4b3db9b5 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -1,8 +1,8 @@ images: - - name: kinoite-main - image: ghcr.io/ublue-os/kinoite-main - tag: latest - digest: sha256:f1efb104b4d45d37fb6758be49a144a7ee241a5bacdd33fa6ed2f9bc149b7f0a + - name: kinoite + image: quay.io/fedora-ostree-desktops/kinoite + tag: 43 + digest: sha256:93962fe63d3ac16d395e00c319a08e84c20df655b53220a8761d399e34864dc7 - name: common image: ghcr.io/get-aurora-dev/common tag: latest diff --git a/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf b/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf new file mode 100644 index 00000000..3ad3bc76 --- /dev/null +++ b/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf @@ -0,0 +1,19 @@ +# This override is to handle the default behavior of dnf5 using ID at /etc/os-release +# to select which chroot gets used to fetch the copr repo. +# +# An example of the behavior displayed without this override in Bazzite: +# sudo dnf5 copr enable ublue-os/bling +# https://copr.fedorainfracloud.org/api_3/rpmrepo/ublue-os/bling/bazzite-41/ 100% | 946.0 B/s | 500.0 B | 00m01s +# Chroot not found in the given Copr project (bazzite-41-x86_64). You can choose one of the available chroots explicitly: +# fedora-38-x86_64 +# fedora-39-x86_64 +# fedora-40-x86_64 +# fedora-41-x86_64 +# fedora-rawhide-x86_64 +# +# See: +# https://github.com/rpm-software-management/dnf5/blob/01d4df824ff4a94ae1fc288f81923d02ba71173a/dnf5-plugins/copr_plugin/copr_config.cpp#L79-L81 +# https://github.com/rpm-software-management/dnf5/blob/01d4df824ff4a94ae1fc288f81923d02ba71173a/dnf5-plugins/copr_plugin/copr_repo.cpp#L146 + +[main] +distribution = fedora