feat: add readymade live ISOs + taidan (#490)

2025-05-20 17:58:09 +03:00 · 2025-05-20 17:58:09 +03:00 · cd01e65029
commit cd01e65029
parent 0e26f924f8
4 changed files with 268 additions and 0 deletions
--- a/.github/workflows/reusable-build-iso-readymade.yml
+++ b/.github/workflows/reusable-build-iso-readymade.yml
@ -0,0 +1,131 @@
+---
+name: Build ISOs (Readymade)
+
+on:
+  workflow_dispatch:
+    inputs:
+      upload-to-cloudflare:
+        description: "Upload to Cloudflare"
+        required: false
+        default: false
+        type: boolean
+  schedule:
+    - cron: "0 1 * * *"
+
+env:
+  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
+  IMAGE_NAME: "aurora"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build ISOs
+    runs-on: ${{ matrix.platform == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [amd64]
+        flavor: ["", "nvidia-open"]
+        image_version: ["stable"]
+
+    permissions:
+      contents: read
+      packages: read
+      id-token: write
+
+    steps:
+      - name: Install dependencies
+        if: matrix.platform == 'arm64'
+        run: |
+          set -x
+          sudo apt update -y
+          sudo apt install -y \
+            podman
+
+      - name: Maximize build space
+        if: matrix.platform != 'arm64'
+        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
+        with:
+          remove-codeql: true
+
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Format image ref
+        id: image_ref
+        env:
+          FLAVOR: ${{ matrix.flavor }}
+        run: |
+          OUTPUT_NAME="${IMAGE_REGISTRY}/${IMAGE_NAME}"
+          ARTIFACT_FORMAT=""
+          KARGS="NONE"
+          if [ "$FLAVOR" != "" ] ; then
+            OUTPUT_NAME="${OUTPUT_NAME}-${FLAVOR}"
+            ARTIFACT_FORMAT="-${FLAVOR}"
+            if [[ "$FLAVOR" =~ nvidia ]] ; then
+              KARGS="rd.driver.blacklist=nouveau,modprobe.blacklist=nouveau,nvidia-drm.modeset=1"
+            fi
+          fi
+          echo "image_ref=$OUTPUT_NAME" >> "${GITHUB_OUTPUT}"
+          echo "artifact_format=$ARTIFACT_FORMAT" >> "${GITHUB_OUTPUT}"
+          echo "kargs=$KARGS" >> "${GITHUB_OUTPUT}"
+
+      - name: Build ISO
+        id: build
+        uses: ublue-os/titanoboa@main
+        with:
+          image-ref: ${{ steps.image_ref.outputs.image_ref }}:${{ matrix.image_version }}
+          flatpaks-list: ${{ github.workspace }}/aurora_flatpaks/flatpaks
+          hook-post-rootfs: ${{ github.workspace }}/iso_files/configure_iso.sh
+          kargs: ${{ steps.image_ref.outputs.kargs }}
+
+      - name: Rename ISO
+        id: rename
+        env:
+          OUTPUT_PATH: ${{ steps.build.outputs.iso-dest }}
+          FLAVOR: ${{ matrix.flavor }}
+          ARTIFACT_FORMAT: ${{ steps.image_ref.outputs.artifact_format }}
+          IMAGE_VERSION: ${{ matrix.image_version }}
+        run: |
+          set -x
+          mkdir -p output
+          OUTPUT_NAME="readymade-${IMAGE_NAME}${ARTIFACT_FORMAT}-${IMAGE_VERSION}"
+          OUTPUT_DIRECTORY="$(realpath output)"
+          if [ "${FLAVOR}" != "" ] ; then
+            IMAGE_NAME="${IMAGE_NAME}-${FLAVOR}"
+          fi
+          if [ $PLATFORM == "amd64" ]; then
+            sha256sum "${OUTPUT_PATH}" | tee "${OUTPUT_DIRECTORY}/${OUTPUT_NAME}-$(uname -m).iso-CHECKSUM"
+            mv "${OUTPUT_PATH}" "${OUTPUT_DIRECTORY}/${OUTPUT_NAME}-$(uname -m).iso"
+          else
+            sha256sum "${OUTPUT_PATH}" | tee "${OUTPUT_DIRECTORY}/${OUTPUT_NAME}-$(uname -m).iso-CHECKSUM"
+            mv "${OUTPUT_PATH}" "${OUTPUT_DIRECTORY}/${OUTPUT_NAME}-$(uname -m).iso"
+          fi
+          echo "output_directory=$OUTPUT_DIRECTORY" >> "${GITHUB_OUTPUT}"
+
+      - name: Upload to Job Artifacts
+        if: inputs.upload-to-cloudflare == false || github.event_name == 'pull_request'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: ${{ env.IMAGE_NAME }}-live${{ steps.image_ref.outputs.artifact_format }}-${{ matrix.image_version }}-${{ matrix.platform }}-iso
+          if-no-files-found: error
+          path: ${{ steps.rename.outputs.output_directory }}
+
+      - name: Upload to CloudFlare
+        if: inputs.upload-to-cloudflare == true && github.event_name != 'pull_request'
+        shell: bash
+        env:
+          RCLONE_CONFIG_R2_TYPE: s3
+          RCLONE_CONFIG_R2_PROVIDER: Cloudflare
+          RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.AURORA_R2_ACCESS_KEY_ID }}
+          RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.AURORA_R2_SECRET_ACCESS_KEY }}
+          RCLONE_CONFIG_R2_REGION: auto
+          RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.AURORA_R2_ENDPOINT }}
+          SOURCE_DIR: ${{ steps.upload-directory.outputs.iso-upload-dir }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y rclone
+          rclone copy "${SOURCE_DIR}" R2:aurora-dl
--- a/iso_files/configure_iso.sh
+++ b/iso_files/configure_iso.sh
@ -0,0 +1,132 @@
+#!/usr/bin/env bash
+
+set -x
+
+dnf -y --enablerepo copr:copr.fedorainfracloud.org:ublue-os:staging install -y \
+  readymade-nightly
+
+# This has more than just branding -- it has repart configs
+dnf -y --enablerepo copr:copr.fedorainfracloud.org:ublue-os:packages install -y \
+  aurora-readymade-config
+
+sudo ln -sf /usr/share/zoneinfo/UTC /etc/localtime
+
+IMAGE_INFO="$(cat /usr/share/ublue-os/image-info.json)"
+IMAGE_TAG="$(jq -c -r '."image-tag"' <<<$IMAGE_INFO)"
+IMAGE_FLAVOR="$(jq -c -r '."image-flavor"' <<<$IMAGE_INFO)"
+
+#TODO
+OUTPUT_NAME="ghcr.io/ublue-os/aurora"
+if [ "$IMAGE_FLAVOR" != "main" ]; then
+  OUTPUT_NAME="${OUTPUT_NAME}-${IMAGE_FLAVOR}"
+fi
+KARGS=""
+if [ "$IMAGE_FLAVOR" =~ nvidia ]; then
+  KARGS='bootc_kargs = ["rd.driver.blacklist=nouveau", "modprobe.blacklist=nouveau", "nvidia-drm.modeset=1"]'
+fi
+
+tee /etc/readymade.toml <<EOF
+[install]
+allowed_installtypes = ["wholedisk"]
+copy_mode = "bootc"
+bootc_imgref = "containers-storage:$OUTPUT_NAME:$IMAGE_TAG"
+bootc_enforce_sigpolicy = true
+bootc_args = ["--skip-fetch-check"]
+$KARGS
+
+[[bento]]
+title = "page-welcome"
+desc = "page-installation-welcome-desc"
+link = "https://getaurora.dev"
+icon = "explore-symbolic"
+
+[[bento]]
+title = "page-installation-help"
+desc = "page-installation-help-desc"
+link = "https://universal-blue.discourse.group/c/aurora/11"
+icon = "chat-symbolic"
+
+[[bento]]
+title = "page-installation-contrib"
+desc = "page-installation-contrib-desc"
+link = "https://docs.getaurora.dev"
+icon = "applications-development-symbolic"
+
+[distro]
+name = "Aurora"
+
+[[postinstall]]
+module = "Script"
+EOF
+
+rm -f /usr/share/applications/liveinst.desktop
+sed -i '/NoDisplay=.*/d' /usr/share/applications/com.fyralabs.Readymade.desktop
+cp -f /usr/share/applications/com.fyralabs.Readymade.desktop /etc/xdg/autostart
+
+mkdir -p /usr/share/readymade/postinstall.d
+tee /usr/share/readymade/postinstall.d/10-flatpaks.sh <<EOF
+#!/usr/bin/bash
+set -x
+mkdir -p /ostree/deploy/default/var/lib
+rsync -aWHA /run/host/var/lib/flatpak /ostree/deploy/default/var/lib
+EOF
+chmod +x /usr/share/readymade/postinstall.d/10-flatpaks.sh
+
+tee /usr/share/readymade/postinstall.d/11-taidan.sh <<EOF
+#!/usr/bin/bash
+set -x
+mkdir -p /ostree/deploy/default/var/lib
+touch /ostree/deploy/default/var/lib/taidan
+EOF
+chmod +x /usr/share/readymade/postinstall.d/11-taidan.sh
+
+tee /usr/share/readymade/postinstall.d/99-mok.sh <<"EOF"
+#!/usr/bin/bash
+set -x
+
+ENROLLMENT_PASSWORD=universalblue
+SECUREBOOT_KEY="/etc/pki/akmods/certs/akmods-ublue.der"
+
+if [[ ! -d "/sys/firmware/efi" ]]; then
+	echo "EFI mode not detected. Skipping key enrollment."
+	exit 0
+fi
+
+if [[ ! -f "$SECUREBOOT_KEY" ]]; then
+	echo "Secure boot key not provided: $SECUREBOOT_KEY"
+	exit 0
+fi
+
+# SYS_ID="(cat /sys/devices/virtual/dmi/id/product_name)"
+# if [[ ":Jupiter:Galileo:" =~ ":$SYS_ID:" ]]; then
+# echo "Steam Deck hardware detected. Skipping key enrollment."
+# exit 0
+# fi
+
+mokutil --timeout -1 || :
+echo -e "$ENROLLMENT_PASSWORD\n$ENROLLMENT_PASSWORD" | mokutil --import "$SECUREBOOT_KEY" || :
+EOF
+chmod +x /usr/share/readymade/postinstall.d/99-mok.sh
+
+# Disable screen locking
+mkdir -p /etc/skel/.config
+cat >/etc/skel/.config/kscreenlockerrc <<'EOF'
+[Daemon]
+Autolock=false
+LockOnResume=false
+EOF
+
+systemctl disable rpm-ostree-countme.service
+systemctl disable tailscaled.service
+systemctl disable bootloader-update.service
+systemctl disable brew-upgrade.timer
+systemctl disable brew-update.timer
+systemctl disable brew-setup.service
+systemctl disable rpm-ostree.service
+systemctl disable uupd.timer
+systemctl disable ublue-system-setup.service
+systemctl disable ublue-guest-user.service
+systemctl disable check-sb-key.service
+systemctl --global disable ublue-flatpak-manager.service
+systemctl --global disable podman-auto-update.timer
+systemctl --global disable ublue-user-setup.service
--- a/packages.json
+++ b/packages.json
@ -72,6 +72,7 @@
 				"sssd-nfs-idmap",
 				"starship",
 				"sunshine",
+				"taidan",
 				"tailscale",
 				"tmux",
 				"ublue-bling",
--- a/system_files/shared/usr/lib/systemd/system/taidan-initial-setup-reconfiguration.service.d/override.conf
+++ b/system_files/shared/usr/lib/systemd/system/taidan-initial-setup-reconfiguration.service.d/override.conf
@ -0,0 +1,4 @@
+[Service]
+ExecStartPost=
+ExecStartPost=systemctl disable taidan-initial-setup-reconfiguration
+ExecStartPost=rm /var/lib/taidan