From 728717d75e97c011222b4fec69c8370793feec62 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sat, 10 Oct 2026 17:30:41 +0200 Subject: [PATCH] refactor: use dnf do for some 3rd-party repositories (#2983) In the past we have moved away from doing big dnf transactions spanning multiple rpm repositories [1] because of the associated risk of third party repos injecting packages we expect to get from Fedora. With this we explicitly set which packages are allowed to be installed from each repo. This means we still get to do big transactions which are generally faster. The downside of this is that if subpackages or dependencies from a 3rd-party repo get introduced/change then our builds will break, I think this is fine as the ones I'm changing here have been unchanging for a while. This should only touch repositories with a very specific purpose/single projects. This purposefully doesn't touch any ublue-os coprs or negativo (also they are difficult to handle as we use them in the nvidia script [2]), those are the only mono-repos so outright excluding the packages is not an easy option as we would make custom image builds (and usr-overlays for testing) more annoying. [1] https://github.com/ublue-os/aurora/issues/1115 [2] https://github.com/ublue-os/akmods/blob/1e4d10b9acb2c59da485403ccd89d689ec32e9ea/build_files/nvidia/nvidia-install.sh --- ...copr.fedorainfracloud.org:karmab:kcli.repo | 1 + .../dx/usr/share/dnf5/repos.d/docker-ce.repo | 6 ++++ .../dx/usr/share/dnf5/repos.d/vscode.repo | 1 + ...r.fedorainfracloud.org:ledif:kairpods.repo | 1 + ...edorainfracloud.org:lizardbyte:stable.repo | 1 + .../usr/share/dnf5/repos.d/tailscale.repo | 1 + build_scripts/base/01-packages.sh | 20 ++++++++----- build_scripts/dx/00-dx.sh | 28 ++++++++++--------- 8 files changed, 39 insertions(+), 20 deletions(-) diff --git a/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo b/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo index 55810d39..d23e3d84 100644 --- a/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo +++ b/build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo @@ -8,3 +8,4 @@ gpgkey=https://download.copr.fedorainfracloud.org/results/karmab/kcli/pubkey.gpg repo_gpgcheck=0 enabled=0 enabled_metadata=1 +includepkgs=kcli diff --git a/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo b/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo index 27bea4ee..e370362a 100644 --- a/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo +++ b/build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo @@ -1,9 +1,15 @@ +# update includepkgs, remove docker-model-plugin +# podman run --rm -ti quay.io/fedora/fedora:45 +# dnf config-manager addrepo --from-repofile https://download.docker.com/linux/fedora/docker-ce.repo +# dnf list --available --repo=docker-ce-stable | grep "docker-ce-stable" | grep -vE "(debug|devel|\.src)" | cut -f1 -d\ | sed 's/\.x86_64//' | sed 's/\.noarch//' | paste -sd " " - + [docker-ce-stable] name=Docker CE Stable - $basearch baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/stable enabled=0 gpgcheck=1 gpgkey=https://download.docker.com/linux/fedora/gpg +includepkgs=containerd.io docker-buildx-plugin docker-ce docker-ce-cli docker-ce-rootless-extras docker-compose-plugin [docker-ce-stable-source] name=Docker CE Stable - Sources diff --git a/build_files/dx/usr/share/dnf5/repos.d/vscode.repo b/build_files/dx/usr/share/dnf5/repos.d/vscode.repo index 3159383c..86e03f82 100644 --- a/build_files/dx/usr/share/dnf5/repos.d/vscode.repo +++ b/build_files/dx/usr/share/dnf5/repos.d/vscode.repo @@ -4,3 +4,4 @@ baseurl=https://packages.microsoft.com/yumrepos/vscode enabled=0 gpgcheck=1 gpgkey=https://packages.microsoft.com/keys/microsoft.asc +includepkgs=code diff --git a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo index 3ddb325a..bc84b829 100644 --- a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo +++ b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo @@ -8,3 +8,4 @@ gpgkey=https://download.copr.fedorainfracloud.org/results/ledif/kairpods/pubkey. repo_gpgcheck=0 enabled=0 enabled_metadata=1 +includepkgs=kairpods diff --git a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo index 22ae23ab..1eedbd1d 100644 --- a/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo +++ b/build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo @@ -9,3 +9,4 @@ repo_gpgcheck=0 enabled=0 enabled_metadata=1 priority=1 +includepkgs=Sunshine diff --git a/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo b/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo index 791f20a1..1b2ef49a 100644 --- a/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo +++ b/build_files/shared/usr/share/dnf5/repos.d/tailscale.repo @@ -6,3 +6,4 @@ type=rpm repo_gpgcheck=1 gpgcheck=1 gpgkey=https://pkgs.tailscale.com/stable/fedora/repo.gpg +includepkgs=tailscale diff --git a/build_scripts/base/01-packages.sh b/build_scripts/base/01-packages.sh index 99353288..ff75157e 100755 --- a/build_scripts/base/01-packages.sh +++ b/build_scripts/base/01-packages.sh @@ -128,9 +128,6 @@ fi dnf -y install --enablerepo='fedora-multimedia' "${PACKAGES[@]}" -# Fedora Tailscale is usually behind -dnf -y install --from-repo='tailscale-stable' tailscale - COPR_UBLUE_OS_PACKAGES=( kcm_ublue krunner-bazaar @@ -138,13 +135,22 @@ COPR_UBLUE_OS_PACKAGES=( # https://github.com/ublue-os/akmods/issues/537 ublue-os-selinux-workarounds uupd - ) +) -dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ublue-os:packages' "${COPR_UBLUE_OS_PACKAGES[@]}" +# Fedora Tailscale is usually behind +TAILSCALE=(tailscale) -dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ledif:kairpods' kairpods +COPR_PREFIX="copr:copr.fedorainfracloud.org" -dnf -y install --from-repo='copr:copr.fedorainfracloud.org:lizardbyte:stable' sunshine +dnf -y install --from-repo="${COPR_PREFIX}:ublue-os:packages" "${COPR_UBLUE_OS_PACKAGES[@]}" + +# TODO: figure something out that works well across DX, nvidia with the ublue-os coprs +# so we can have less transactions, while still not being vulnerable to copr injections +# shellcheck disable=SC1010 +dnf do -y \ + --action install --from-repo='tailscale-stable' "${TAILSCALE[@]}" \ + --action install --from-repo="${COPR_PREFIX}:ledif:kairpods" kairpods \ + --action install --from-repo="${COPR_PREFIX}:lizardbyte:stable" Sunshine # Packages to exclude - common to all versions EXCLUDED_PACKAGES=( diff --git a/build_scripts/dx/00-dx.sh b/build_scripts/dx/00-dx.sh index 5e0a77ae..634e9549 100755 --- a/build_scripts/dx/00-dx.sh +++ b/build_scripts/dx/00-dx.sh @@ -61,24 +61,26 @@ if [[ ! "${IMAGE_NAME}" =~ nvidia ]]; then FEDORA_PACKAGES+=("rocm-hip" "rocm-opencl" "rocm-smi") fi -echo "Installing ${#FEDORA_PACKAGES[@]} DX packages from Fedora repos..." dnf5 -y install "${FEDORA_PACKAGES[@]}" -# Docker packages from their repo -dnf -y install --from-repo=docker-ce-stable \ - containerd.io \ - docker-buildx-plugin \ - docker-ce \ - docker-ce-cli \ - docker-compose-plugin +# We could use Fedora's moby packages, these are "official" +DOCKER_CE=( + containerd.io + docker-buildx-plugin + docker-ce + docker-ce-cli + docker-compose-plugin +) -# VSCode package from Microsoft repo -dnf -y install --from-repo=code \ - code +COPR_PREFIX="copr:copr.fedorainfracloud.org" -dnf -y install --from-repo='copr:copr.fedorainfracloud.org:karmab:kcli' kcli +# shellcheck disable=SC1010 +dnf do -y \ + --action install --from-repo=code code \ + --action install --from-repo=docker-ce-stable "${DOCKER_CE[@]}" \ + --action install --from-repo="${COPR_PREFIX}:karmab:kcli" kcli -dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ublue-os:packages' ublue-os-libvirt-workarounds +dnf -y install --from-repo="${COPR_PREFIX}:ublue-os:packages" ublue-os-libvirt-workarounds rsync -rvK /ctx/system_files/dx/ /