refactor: simplify checking for enabled 3rd party repos (#2931)
* refactor: simplify checking for enabled 3rd party repos We are generally no longer doing the dnf enable/disable dance (except for the nvidia install script) because we are vendoring the .repo files which simplifies things a bit. Also I think that the move to checking what is allowed instead of checking what is not allowed makes more sense anyway. resolves: https://github.com/ublue-os/aurora/issues/2854 [1]1e4d10b9ac/build_files/nvidia/nvidia-install.sh* get openh264 from negativo Our base image [1] can't legally include this from fedora-cisco-openh264 repo. Comparing the spec files for Fedora [2] and Negativo [3], they seem to be built with the same build flags, so they should not have any differing functionality. The fedora-cisco-openh264 repo is currently enabled (which is not the case for F44 images) because our repo validation script broke due to the move to /usr [4]. We are already shipping various other codecs on the system, including mesa, they get more irrelevant each day but we should have this. I don't know why exactly but for some reason we now have a stray /var/log/dnf5.log which makes bootc container lint fail. [1]54e811f17a/common.yaml (L144)[2]cd15228484/f/openh264.spec[3]dfac89f533/openh264.spec[4] https://fedoraproject.org/wiki/Changes/RelocateRpmRepoConfigsToUsr
This commit is contained in:
renner
GitHub
parent
a76fa2e80c
commit
b2d6f3cfb3
8 changed files with 40 additions and 163 deletions
|
|
@ -84,14 +84,15 @@ RUN --mount=type=tmpfs,dst=/boot \
|
|||
#endif
|
||||
|
||||
# /* Everything that can be done offline after things are in place should be done here */
|
||||
# /* dracut freaks out if /var is a different filesystem */
|
||||
RUN --network=none \
|
||||
--mount=type=tmpfs,dst=/boot \
|
||||
--mount=type=tmpfs,dst=/var/log \
|
||||
--mount=type=bind,from=ctx,source=/,target=/ctx \
|
||||
/ctx/build_scripts/base/16-override-install.sh && \
|
||||
/ctx/build_scripts/base/17-cleanup.sh && \
|
||||
/ctx/build_scripts/base/17-services.sh && \
|
||||
/ctx/build_scripts/base/18-image-info.sh && \
|
||||
/ctx/build_scripts/base/19-initramfs.sh && \
|
||||
/ctx/build_scripts/shared/validate-repos.sh && \
|
||||
/ctx/build_scripts/shared/clean-stage.sh && \
|
||||
/ctx/build_scripts/shared/chunkah-xattr.sh && \
|
||||
/ctx/build_scripts/base/20-tests.sh
|
||||
|
|
|
|||
|
|
@ -22,6 +22,7 @@ OVERRIDES=(
|
|||
"mesa-libGL"
|
||||
"mesa-libgbm"
|
||||
"mesa-vulkan-drivers"
|
||||
"openh264"
|
||||
)
|
||||
|
||||
dnf5 distro-sync --skip-unavailable -y --repo='fedora-multimedia' "${OVERRIDES[@]}"
|
||||
|
|
|
|||
|
|
@ -1,44 +0,0 @@
|
|||
#!/usr/bin/bash
|
||||
|
||||
echo "::group:: ===$(basename "$0")==="
|
||||
|
||||
set -eoux pipefail
|
||||
|
||||
|
||||
systemctl preset-all
|
||||
systemctl --global preset-all
|
||||
|
||||
# Disable third-party repos
|
||||
for repo in fedora-multimedia tailscale fedora-cisco-openh264; do
|
||||
if [[ -f "/etc/yum.repos.d/${repo}.repo" ]]; then
|
||||
sed -i 's@enabled=1@enabled=0@g' "/etc/yum.repos.d/${repo}.repo"
|
||||
fi
|
||||
done
|
||||
|
||||
# Disable Terra repos (installed on F42 and earlier)
|
||||
for i in /etc/yum.repos.d/terra*.repo; do
|
||||
if [[ -f "$i" ]]; then
|
||||
sed -i 's@enabled=1@enabled=0@g' "$i"
|
||||
fi
|
||||
done
|
||||
|
||||
# Disable all COPR repos (should already be disabled by helpers, but ensure)
|
||||
for i in /etc/yum.repos.d/_copr:*.repo; do
|
||||
if [[ -f "$i" ]]; then
|
||||
sed -i 's@enabled=1@enabled=0@g' "$i"
|
||||
fi
|
||||
done
|
||||
|
||||
# Disable RPM Fusion repos
|
||||
for i in /etc/yum.repos.d/rpmfusion-*.repo; do
|
||||
if [[ -f "$i" ]]; then
|
||||
sed -i 's@enabled=1@enabled=0@g' "$i"
|
||||
fi
|
||||
done
|
||||
|
||||
# Disable fedora-coreos-pool if it exists
|
||||
if [ -f /etc/yum.repos.d/fedora-coreos-pool.repo ]; then
|
||||
sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-coreos-pool.repo
|
||||
fi
|
||||
|
||||
echo "::endgroup::"
|
||||
10
build_scripts/base/17-services.sh
Executable file
10
build_scripts/base/17-services.sh
Executable file
|
|
@ -0,0 +1,10 @@
|
|||
#!/usr/bin/bash
|
||||
|
||||
echo "::group:: ===$(basename "$0")==="
|
||||
|
||||
set -eoux pipefail
|
||||
|
||||
systemctl preset-all
|
||||
systemctl --global preset-all
|
||||
|
||||
echo "::endgroup::"
|
||||
|
|
@ -166,4 +166,6 @@ if [[ "${IMAGE_FLAVOR}" == "dx" ]]; then
|
|||
/ctx/build_scripts/dx/10-tests-dx.sh;
|
||||
fi
|
||||
|
||||
/ctx/build_scripts/shared/validate-repos.sh
|
||||
|
||||
echo "::endgroup::"
|
||||
|
|
|
|||
|
|
@ -109,11 +109,4 @@ EOF
|
|||
# Branding Changes
|
||||
echo "Variant=Developer Experience" >> /usr/share/kde-settings/kde-profile/default/xdg/kcm-about-distrorc
|
||||
|
||||
# Disable RPM Fusion repos
|
||||
for i in /etc/yum.repos.d/rpmfusion-*.repo; do
|
||||
if [[ -f "$i" ]]; then
|
||||
sed -i 's@enabled=1@enabled=0@g' "$i"
|
||||
fi
|
||||
done
|
||||
|
||||
echo "::endgroup::"
|
||||
|
|
|
|||
|
|
@ -19,8 +19,13 @@ fi
|
|||
|
||||
rsync -rvKl "${BUILD_FILES[@]}" /
|
||||
|
||||
# mostly for codecs fedora can't ship
|
||||
dnf config-manager setopt fedora-multimedia.priority=90
|
||||
|
||||
# https://fedoraproject.org/wiki/OpenH264
|
||||
# this would be fine to use as well, negativo just has it, one less repo
|
||||
dnf config-manager setopt fedora-cisco-openh264.enabled=0
|
||||
|
||||
mkdir -p /tmp/scripts/helpers
|
||||
install -Dm0755 /ctx/build_scripts/shared/utils/ghcurl /tmp/scripts/helpers/ghcurl
|
||||
|
||||
|
|
|
|||
|
|
@ -1,121 +1,30 @@
|
|||
#!/usr/bin/bash
|
||||
|
||||
echo "::group:: ===$(basename "$0")==="
|
||||
|
||||
set -eou pipefail
|
||||
|
||||
REPOS_DIR="/etc/yum.repos.d"
|
||||
VALIDATION_FAILED=0
|
||||
ENABLED_REPOS=()
|
||||
|
||||
echo "Validating all repository files are disabled..."
|
||||
|
||||
# Check if repos directory exists
|
||||
if [[ ! -d "$REPOS_DIR" ]]; then
|
||||
echo "Warning: $REPOS_DIR does not exist"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Function to check if a repo file has any enabled repos
|
||||
check_repo_file() {
|
||||
local repo_file="$1"
|
||||
local basename_file
|
||||
basename_file=$(basename "$repo_file")
|
||||
|
||||
# Skip if file doesn't exist or isn't readable
|
||||
[[ ! -f "$repo_file" ]] && return 0
|
||||
[[ ! -r "$repo_file" ]] && return 0
|
||||
|
||||
# Check for enabled=1 in the file
|
||||
if grep -q "^enabled=1" "$repo_file" 2>/dev/null; then
|
||||
echo "ENABLED: $basename_file"
|
||||
ENABLED_REPOS+=("$basename_file")
|
||||
VALIDATION_FAILED=1
|
||||
|
||||
# Show which sections are enabled
|
||||
echo " Enabled sections:"
|
||||
local section_name=""
|
||||
while IFS= read -r line; do
|
||||
if [[ "$line" =~ ^\[.*\]$ ]]; then
|
||||
section_name="$line"
|
||||
elif [[ "$line" =~ ^enabled=1 ]]; then
|
||||
echo " - $section_name"
|
||||
fi
|
||||
done < "$repo_file"
|
||||
else
|
||||
echo "Disabled: $basename_file"
|
||||
fi
|
||||
}
|
||||
|
||||
echo ""
|
||||
echo "Checking COPR repositories (standard naming)..."
|
||||
echo "NOTE: With secure isolated installation, NO COPRs should be globally enabled!"
|
||||
for repo in "$REPOS_DIR"/_copr:copr.fedorainfracloud.org:*.repo; do
|
||||
[[ -f "$repo" ]] && check_repo_file "$repo"
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "Checking COPR repositories (non-standard naming)..."
|
||||
echo "SECURITY: Enabled COPRs can inject malicious versions of Fedora packages!"
|
||||
for repo in "$REPOS_DIR"/_copr_*.repo; do
|
||||
[[ -f "$repo" ]] && check_repo_file "$repo"
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "Checking other third-party repositories..."
|
||||
# List of known third-party repos that should be disabled
|
||||
OTHER_REPOS=(
|
||||
"fedora-multimedia.repo"
|
||||
"tailscale.repo"
|
||||
"vscode.repo"
|
||||
"docker-ce.repo"
|
||||
"fedora-cisco-openh264.repo"
|
||||
"fedora-coreos-pool.repo"
|
||||
"terra.repo"
|
||||
ALLOWED_REPOS=(
|
||||
fedora
|
||||
updates{-archive,}
|
||||
)
|
||||
|
||||
for repo_name in "${OTHER_REPOS[@]}"; do
|
||||
repo_path="$REPOS_DIR/$repo_name"
|
||||
if [[ -f "$repo_path" ]]; then
|
||||
check_repo_file "$repo_path"
|
||||
fi
|
||||
done
|
||||
BETA_REPOS=(updates-testing)
|
||||
|
||||
echo ""
|
||||
echo "Checking RPM Fusion repositories..."
|
||||
for repo in "$REPOS_DIR"/rpmfusion-*.repo; do
|
||||
[[ -f "$repo" ]] && check_repo_file "$repo"
|
||||
done
|
||||
source /usr/lib/os-release
|
||||
|
||||
echo ""
|
||||
echo "Checking Fedora updates-testing (should be disabled unless beta)..."
|
||||
if [[ -f "$REPOS_DIR/fedora-updates-testing.repo" ]]; then
|
||||
if grep -q "^enabled=1" "$REPOS_DIR/fedora-updates-testing.repo" 2>/dev/null; then
|
||||
# Allow updates-testing to be enabled for beta builds
|
||||
if [[ "${UBLUE_IMAGE_TAG:-stable}" == "beta" ]]; then
|
||||
echo "updates-testing is enabled (allowed for beta builds)"
|
||||
else
|
||||
echo "ENABLED: fedora-updates-testing.repo (should only be enabled for beta)"
|
||||
ENABLED_REPOS+=("fedora-updates-testing.repo")
|
||||
VALIDATION_FAILED=1
|
||||
fi
|
||||
else
|
||||
echo "Disabled: fedora-updates-testing.repo"
|
||||
fi
|
||||
# TODO: we need a way to temporarily allow this on stable releases by checking
|
||||
# installed packages via dnf
|
||||
# Betas/pre-releases use updates-testing
|
||||
if [[ "$RELEASE_TYPE" == "development" ]]; then
|
||||
ALLOWED_REPOS=( "${ALLOWED_REPOS[@]}" "${BETA_REPOS[@]}" )
|
||||
fi
|
||||
|
||||
# Final summary
|
||||
echo ""
|
||||
echo "======================================"
|
||||
if [[ $VALIDATION_FAILED -eq 1 ]]; then
|
||||
echo "VALIDATION FAILED"
|
||||
echo "======================================"
|
||||
echo ""
|
||||
echo "The following repositories are still ENABLED:"
|
||||
for repo in "${ENABLED_REPOS[@]}"; do
|
||||
echo " • $repo"
|
||||
done
|
||||
exit 1
|
||||
fi
|
||||
ALLOWED_REPO_LIST="$(printf '%s\n' "${ALLOWED_REPOS[@]}")"
|
||||
|
||||
echo "::endgroup::"
|
||||
ENABLED_REPOS="$(dnf repolist --enabled | awk 'NR>1 {print $1}')"
|
||||
|
||||
BAD_REPOS="$(grep -v --fixed-strings --line-regexp -f <(echo "$ALLOWED_REPO_LIST") <<< "$ENABLED_REPOS" || true)"
|
||||
|
||||
if [[ -n "$BAD_REPOS" ]]; then
|
||||
echo "unexpected enabled repo(s) detected:"
|
||||
echo "$BAD_REPOS"; exit 1
|
||||
fi
|
||||
|
|
|
|||
Loading…
Reference in a new issue