From d7234d28478f673f605aee0647d28ee688fd40f3 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sat, 14 Mar 2026 17:09:04 +0100 Subject: [PATCH 01/82] chore(beta): make F44 build (#1879) Co-authored-by: inffy <10782843+inffy@users.noreply.github.com> --- .github/workflows/build-image-beta.yml | 2 +- build_files/base/01-packages.sh | 15 ++++------- .../base/02-install-common-kernel-akmods.sh | 7 +++--- build_files/base/17-cleanup.sh | 2 -- build_files/base/20-tests.sh | 3 ++- build_files/dx/00-dx.sh | 25 ++++++++++--------- build_files/dx/10-tests-dx.sh | 6 +---- build_files/shared/clean-stage.sh | 1 + 8 files changed, 27 insertions(+), 34 deletions(-) diff --git a/.github/workflows/build-image-beta.yml b/.github/workflows/build-image-beta.yml index 41104abc..a530793a 100644 --- a/.github/workflows/build-image-beta.yml +++ b/.github/workflows/build-image-beta.yml @@ -1,6 +1,6 @@ name: Beta Images on: - merge_group: + #merge_group: pull_request: branches: - beta diff --git a/build_files/base/01-packages.sh b/build_files/base/01-packages.sh index 46e910c5..780c7ae7 100755 --- a/build_files/base/01-packages.sh +++ b/build_files/base/01-packages.sh @@ -94,7 +94,6 @@ FEDORA_PACKAGES=( htop icoutils ifuse - igt-gpu-tools input-remapper iwd just @@ -269,6 +268,10 @@ dnf5 -y swap \ --repo=copr:copr.fedorainfracloud.org:ublue-os:staging \ fwupd fwupd + +# needs to be removed before we swap the version +systemctl disable flatpak-add-fedora-repos.service + # TODO: remove me on next flatpak release when preinstall landed in Fedora dnf5 -y copr enable ublue-os/flatpak-test dnf5 -y copr disable ublue-os/flatpak-test @@ -287,15 +290,7 @@ dnf5 -y --repo=copr:copr.fedorainfracloud.org:ublue-os:flatpak-test install flat # dnf5 upgrade --refresh --advisory=FEDORA-2024-dd2e9fb225 #fi -# Explicitly install KDE Plasma related packages with the same version as in base image -if [[ "${UBLUE_IMAGE_TAG}" == "beta" ]]; then - dnf -y copr enable @kdesig/kde-beta - dnf -y copr disable @kdesig/kde-beta - dnf -y --repo=copr:copr.fedorainfracloud.org:group_kdesig:kde-beta install plasma-firewall -else - dnf -y install \ - plasma-firewall-$(rpm -q --qf "%{VERSION}" plasma-desktop) -fi +dnf -y install plasma-firewall-$(rpm -q --qf "%{VERSION}" plasma-desktop) # Install DX specific packages if [[ "${IMAGE_FLAVOR}" == "dx" ]]; then diff --git a/build_files/base/02-install-common-kernel-akmods.sh b/build_files/base/02-install-common-kernel-akmods.sh index 99ba3741..e890cc1d 100755 --- a/build_files/base/02-install-common-kernel-akmods.sh +++ b/build_files/base/02-install-common-kernel-akmods.sh @@ -32,8 +32,9 @@ mkdir -p /etc/pki/akmods/certs ghcurl "https://github.com/ublue-os/akmods/raw/refs/heads/main/certs/public_key.der" --retry 3 -Lo /etc/pki/akmods/certs/akmods-ublue.der # OpenRazer from hardware:razer repo (not a COPR) -dnf -y config-manager addrepo --from-repofile=https://openrazer.github.io/hardware:razer.repo -dnf -y install openrazer-daemon || true -sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/hardware:razer.repo +# TODO: decide if we drop this on F44 or not +#dnf -y config-manager addrepo --from-repofile=https://openrazer.github.io/hardware:razer.repo +#dnf -y install openrazer-daemon || true +#sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/hardware:razer.repo echo "::endgroup::" diff --git a/build_files/base/17-cleanup.sh b/build_files/base/17-cleanup.sh index 3d26849f..60d5a367 100755 --- a/build_files/base/17-cleanup.sh +++ b/build_files/base/17-cleanup.sh @@ -44,8 +44,6 @@ for file in htop nvtop; do fi done -systemctl disable flatpak-add-fedora-repos.service - # NOTE: With isolated COPR installation, most repos are never enabled globally. # We only need to clean up repos that were enabled during the build process. diff --git a/build_files/base/20-tests.sh b/build_files/base/20-tests.sh index f5fce6f3..4dc64e39 100755 --- a/build_files/base/20-tests.sh +++ b/build_files/base/20-tests.sh @@ -90,7 +90,7 @@ IMPORTANT_PACKAGES=( plasma-desktop podman ptyxis - sddm + plasma-login-manager Sunshine systemd tailscale @@ -140,6 +140,7 @@ for package in "${UNWANTED_PACKAGES[@]}"; do fi done +#TODO: add libnvidia-container-tools back once its available for F44 if [[ "${IMAGE_NAME}" =~ nvidia ]]; then NV_PACKAGES=( kmod-nvidia diff --git a/build_files/dx/00-dx.sh b/build_files/dx/00-dx.sh index 612c3114..006eff9f 100755 --- a/build_files/dx/00-dx.sh +++ b/build_files/dx/00-dx.sh @@ -74,15 +74,16 @@ if [[ ! "${IMAGE_NAME}" =~ nvidia ]]; then fi # Docker packages from their repo -dnf config-manager addrepo --from-repofile=https://download.docker.com/linux/fedora/docker-ce.repo -sed -i "s/enabled=.*/enabled=0/g" /etc/yum.repos.d/docker-ce.repo -dnf -y install --enablerepo=docker-ce-stable \ - containerd.io \ - docker-buildx-plugin \ - docker-ce \ - docker-ce-cli \ - docker-compose-plugin \ - docker-model-plugin +# TODO: enable ones these are available for Fedora 44 +#dnf config-manager addrepo --from-repofile=https://download.docker.com/linux/fedora/docker-ce.repo +#sed -i "s/enabled=.*/enabled=0/g" /etc/yum.repos.d/docker-ce.repo +#dnf -y install --enablerepo=docker-ce-stable \ +# containerd.io \ +# docker-buildx-plugin \ +# docker-ce \ +# docker-ce-cli \ +# docker-compose-plugin \ +# docker-model-plugin # VSCode package from Microsoft repo echo "Installing VSCode from official repo..." @@ -126,9 +127,9 @@ if [[ "${#EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then fi # Enable DX services -if rpm -q docker-ce >/dev/null; then - systemctl enable docker.socket -fi +#if rpm -q docker-ce >/dev/null; then +# systemctl enable docker.socket +#fi systemctl enable podman.socket systemctl enable swtpm-workaround.service systemctl enable ublue-os-libvirt-workarounds.service diff --git a/build_files/dx/10-tests-dx.sh b/build_files/dx/10-tests-dx.sh index 7e1f583a..2b792063 100755 --- a/build_files/dx/10-tests-dx.sh +++ b/build_files/dx/10-tests-dx.sh @@ -6,10 +6,6 @@ set -eoux pipefail IMPORTANT_PACKAGES_DX=( code - containerd.io - docker-ce - docker-buildx-plugin - docker-compose-plugin flatpak-builder libvirt podman-bootc @@ -21,7 +17,7 @@ for package in "${IMPORTANT_PACKAGES_DX[@]}"; do done IMPORTANT_UNITS=( - docker.socket + #docker.socket podman.socket ) diff --git a/build_files/shared/clean-stage.sh b/build_files/shared/clean-stage.sh index e0b52d09..887fa789 100755 --- a/build_files/shared/clean-stage.sh +++ b/build_files/shared/clean-stage.sh @@ -9,6 +9,7 @@ dnf config-manager setopt keepcache=0 dnf versionlock clear # This comes last because we can't *ever* afford to ship fedora flatpaks on the image +systemctl disable flatpak-add-fedora-repos.service || true systemctl mask flatpak-add-fedora-repos.service rm -f /usr/lib/systemd/system/flatpak-add-fedora-repos.service From f2ad60cba8752ad0b2ac5330fb90331ee38f7ef7 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sat, 14 Mar 2026 18:58:27 +0100 Subject: [PATCH 02/82] fix(beta): add mariadb back (#1902) When rebasing from our kinoite base image to aurora:beta the ostree deployment will fail with this error: ``` libsemanage.semanage_direct_get_module_info: Unable to open mariadb-plugin-cracklib-password-check module lang ext file at /etc/selinux/targeted/tmp/modules/200/mariadb-plugin-cracklib-password-check/lang_ext. (No such file or directory). ``` Adding mariadb-cracklib-password-check back to our image resolves this issue. --- build_files/base/01-packages.sh | 3 --- 1 file changed, 3 deletions(-) diff --git a/build_files/base/01-packages.sh b/build_files/base/01-packages.sh index 780c7ae7..b308f2ed 100755 --- a/build_files/base/01-packages.sh +++ b/build_files/base/01-packages.sh @@ -227,9 +227,6 @@ EXCLUDED_PACKAGES=( khelpcenter krfb krfb-libs - mariadb - mariadb-common - mariadb-errmsg plasma-discover-kns plasma-discover-rpm-ostree plasma-welcome-fedora From 7a0ff57b0f9b3e95be3b4c9b9e0c973e6a580365 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sat, 14 Mar 2026 21:23:55 +0100 Subject: [PATCH 03/82] chore: remove SDDM workarounds (#1837) Plasma Login Manager can do this natively, no hacks needed https://github.com/ublue-os/aurora/issues/1718 --- build_files/base/17-cleanup.sh | 1 - build_files/base/20-tests.sh | 1 - .../system/usr-share-sddm-themes.mount | 20 ------------------- .../lib/tmpfiles.d/usr-share-sddm-themes.conf | 6 ------ 4 files changed, 28 deletions(-) delete mode 100644 system_files/shared/usr/lib/systemd/system/usr-share-sddm-themes.mount delete mode 100644 system_files/shared/usr/lib/tmpfiles.d/usr-share-sddm-themes.conf diff --git a/build_files/base/17-cleanup.sh b/build_files/base/17-cleanup.sh index 60d5a367..672a8792 100755 --- a/build_files/base/17-cleanup.sh +++ b/build_files/base/17-cleanup.sh @@ -13,7 +13,6 @@ systemctl enable tailscaled.service systemctl enable dconf-update.service systemctl enable brew-setup.service systemctl enable aurora-groups.service -systemctl enable usr-share-sddm-themes.mount systemctl enable ublue-system-setup.service systemctl --global enable ublue-user-setup.service systemctl --global enable podman-auto-update.timer diff --git a/build_files/base/20-tests.sh b/build_files/base/20-tests.sh index 4dc64e39..8149cb4a 100755 --- a/build_files/base/20-tests.sh +++ b/build_files/base/20-tests.sh @@ -58,7 +58,6 @@ desktop-file-validate \ # Check for KDE Plasma version mismatch # Fedora Repos have gotten the newer one, trying to upgrade -# everything except a few packages, breaking SDDM and shell KDE_VER="$(rpm -q --qf '%{VERSION}' plasma-desktop)" # package picked by failures in the past diff --git a/system_files/shared/usr/lib/systemd/system/usr-share-sddm-themes.mount b/system_files/shared/usr/lib/systemd/system/usr-share-sddm-themes.mount deleted file mode 100644 index af5f3e7d..00000000 --- a/system_files/shared/usr/lib/systemd/system/usr-share-sddm-themes.mount +++ /dev/null @@ -1,20 +0,0 @@ -# Workaround to allow KDE Discover to install sddm themes -# TODO: Remove this whenever sddm allows installing themes other than in /usr/share. -# See https://github.com/sddm/sddm/issues/1561 - -[Unit] -Description=KDE writable sddm workaround -RequiresMountsFor=/usr /var -ConditionPathExists=/usr/share/sddm -ConditionPathExists=/var/sddm_themes/themes -ConditionPathExists=/var/sddm_themes/themes.work -PartOf=aurora-kde-themes-workaround.target - -[Mount] -Type=overlay -What=overlay -Where=/usr/share/sddm/themes -Options=lowerdir=/usr/share/sddm/themes,upperdir=/var/sddm_themes/themes,workdir=/var/sddm_themes/themes.work - -[Install] -WantedBy=multi-user.target diff --git a/system_files/shared/usr/lib/tmpfiles.d/usr-share-sddm-themes.conf b/system_files/shared/usr/lib/tmpfiles.d/usr-share-sddm-themes.conf deleted file mode 100644 index 2048af8d..00000000 --- a/system_files/shared/usr/lib/tmpfiles.d/usr-share-sddm-themes.conf +++ /dev/null @@ -1,6 +0,0 @@ -# Workaround to allow KDE Discover to install sddm themes -# TODO: Remove this whenever sddm allows installing themes other than in /usr/share. -# See https://github.com/sddm/sddm/issues/1561 - -d /var/sddm_themes/themes 0755 - - - -d /var/sddm_themes/themes.work 0755 - - - From aec2ca5c779836a42d87ed23808f182f99d6b8b9 Mon Sep 17 00:00:00 2001 From: dreamyuki <49896401+dreamyukii@users.noreply.github.com> Date: Sun, 15 Mar 2026 03:56:04 +0700 Subject: [PATCH 04/82] feat: remove ptyxis from image (#1784) * feat: remove ptyxis from image * fix: remove ptyxis stuff * chore: remove gschema override related things we don't need this anymore as we longer do any gschema overrides needs: https://github.com/get-aurora-dev/common/pull/119 --------- Co-authored-by: renner Co-authored-by: renner <80410025+renner0e@users.noreply.github.com> --- build_files/base/01-packages.sh | 1 - build_files/base/16-override-install.sh | 19 ------------------- build_files/base/20-tests.sh | 4 +--- 3 files changed, 1 insertion(+), 23 deletions(-) diff --git a/build_files/base/01-packages.sh b/build_files/base/01-packages.sh index b308f2ed..b1187890 100755 --- a/build_files/base/01-packages.sh +++ b/build_files/base/01-packages.sh @@ -121,7 +121,6 @@ FEDORA_PACKAGES=( plasma-wallpapers-dynamic powerstat powertop - ptyxis rclone restic samba-winbind diff --git a/build_files/base/16-override-install.sh b/build_files/base/16-override-install.sh index 4ae42285..5b8a2625 100755 --- a/build_files/base/16-override-install.sh +++ b/build_files/base/16-override-install.sh @@ -39,30 +39,11 @@ done rm /etc/xdg/autostart/org.kde.discover.notifier.desktop # Use Bazaar for Flatpak refs -# Force Ptyxis version opened via dbus (e.g., keyboard shortcut) to use the proper shim # https://github.com/ublue-os/bazzite/pull/3620 -sed -i 's@Exec=/usr/bin/ptyxis@Exec=/usr/bin/kde-ptyxis@g' /usr/share/dbus-1/services/org.gnome.Ptyxis.service echo "application/vnd.flatpak.ref=io.github.kolunmi.Bazaar.desktop" >> /usr/share/applications/mimeapps.list -# Ptyxis Terminal -sed -i 's@\[Desktop Action new-window\]@\[Desktop Action new-window\]\nX-KDE-Shortcuts=Ctrl+Alt+T@g' /usr/share/applications/org.gnome.Ptyxis.desktop -sed -i 's@Exec=ptyxis@Exec=kde-ptyxis@g' /usr/share/applications/org.gnome.Ptyxis.desktop -sed -i 's@Keywords=@Keywords=konsole;console;@g' /usr/share/applications/org.gnome.Ptyxis.desktop -# GTK 4.20 changed how it handles input methods; see https://github.com/ghostty-org/ghostty/discussions/8899#discussioncomment-14717979 -desktop-file-edit --set-key=Exec --set-value='env GTK_IM_MODULE=ibus kde-ptyxis' /usr/share/applications/org.gnome.Ptyxis.desktop -cp /usr/share/applications/org.gnome.Ptyxis.desktop /usr/share/kglobalaccel/ - rm -f /etc/profile.d/gnome-ssh-askpass.{csh,sh} # This shouldn't be pulled in -# Test aurora gschema override for errors. If there are no errors, proceed with compiling aurora gschema, which includes setting overrides. -mkdir -p /tmp/aurora-schema-test -find /usr/share/glib-2.0/schemas/ -type f ! -name "*.gschema.override" -exec cp {} /tmp/aurora-schema-test/ \; -cp /usr/share/glib-2.0/schemas/zz0-aurora-modifications.gschema.override /tmp/aurora-schema-test/ -echo "Running error test for aurora gschema override. Aborting if failed." -glib-compile-schemas --strict /tmp/aurora-schema-test -echo "Compiling gschema to include aurora setting overrides" -glib-compile-schemas /usr/share/glib-2.0/schemas &>/dev/null - # Make Samba usershares work OOTB mkdir -p /var/lib/samba/usershares chown -R root:usershares /var/lib/samba/usershares diff --git a/build_files/base/20-tests.sh b/build_files/base/20-tests.sh index 8149cb4a..c55fa580 100755 --- a/build_files/base/20-tests.sh +++ b/build_files/base/20-tests.sh @@ -53,8 +53,7 @@ desktop-file-validate \ /usr/share/applications/dev.getaurora.boot-to-windows.desktop \ /usr/share/applications/dev.getaurora.offline-docs.desktop \ /usr/share/applications/dev.getaurora.documentation.desktop \ - /usr/share/applications/dev.getaurora.system-update.desktop \ - /usr/share/applications/org.gnome.Ptyxis.desktop + /usr/share/applications/dev.getaurora.system-update.desktop # Check for KDE Plasma version mismatch # Fedora Repos have gotten the newer one, trying to upgrade @@ -88,7 +87,6 @@ IMPORTANT_PACKAGES=( pipewire plasma-desktop podman - ptyxis plasma-login-manager Sunshine systemd From 58861579bfdd6ecc13e85ec5d98305e429c13438 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 15 Mar 2026 01:07:55 +0100 Subject: [PATCH 05/82] chore(beta): remove discover (#1903) -libs is currently not removed with the base package. See: https://bugzilla.redhat.com/show_bug.cgi?id=2417275 fixes: https://github.com/ublue-os/aurora/issues/1703 Removing the krunner_appstream plugin gets rid of the option in the settings to enable the option for discover to be set as the search provider. It's part of the plasma-workspace-libs package. --- build_files/base/01-packages.sh | 2 ++ build_files/base/16-override-install.sh | 17 +---------------- build_files/base/20-tests.sh | 3 +-- 3 files changed, 4 insertions(+), 18 deletions(-) diff --git a/build_files/base/01-packages.sh b/build_files/base/01-packages.sh index b1187890..9a307074 100755 --- a/build_files/base/01-packages.sh +++ b/build_files/base/01-packages.sh @@ -228,6 +228,8 @@ EXCLUDED_PACKAGES=( krfb-libs plasma-discover-kns plasma-discover-rpm-ostree + plasma-discover + plasma-discover-libs plasma-welcome-fedora podman-docker ) diff --git a/build_files/base/16-override-install.sh b/build_files/base/16-override-install.sh index 5b8a2625..2fe84bb8 100755 --- a/build_files/base/16-override-install.sh +++ b/build_files/base/16-override-install.sh @@ -21,22 +21,7 @@ rm -rf /usr/share/doc/HTML # BASE IMAGE CHANGES # ###### -# Hide Discover entries by renaming them (allows for easy re-enabling) -discover_apps=( - "org.kde.discover.desktop" - "org.kde.discover.flatpak.desktop" - "org.kde.discover.notifier.desktop" - "org.kde.discover.urlhandler.desktop" -) - -for app in "${discover_apps[@]}"; do - if [ -f "/usr/share/applications/${app}" ]; then - mv "/usr/share/applications/${app}" "/usr/share/applications/${app}.disabled" - fi -done - -# These notifications are useless and confusing -rm /etc/xdg/autostart/org.kde.discover.notifier.desktop +rm -f /usr/lib64/qt6/plugins/kf6/krunner/krunner_appstream.so # Use Bazaar for Flatpak refs # https://github.com/ublue-os/bazzite/pull/3620 diff --git a/build_files/base/20-tests.sh b/build_files/base/20-tests.sh index c55fa580..3b1e1b1d 100755 --- a/build_files/base/20-tests.sh +++ b/build_files/base/20-tests.sh @@ -125,8 +125,7 @@ UNWANTED_PACKAGES=( fedora-logos fedora-third-party firefox - plasma-discover-kns - plasma-discover-rpm-ostree + plasma-discover plasma-lookandfeel-fedora podman-docker ) From d89ab2b01f22340d9d8dd82655d715993fb2cf46 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 15 Mar 2026 07:01:18 +0100 Subject: [PATCH 06/82] chore: remove starship (#1851) Starship can be installed with homebrew, for multi user systems you can either setup the shared linuxbrew group or download the binary from the github releases and drop it in /usr/local/bin as that is wriable or ~/.local/bin. fixes: https://github.com/ublue-os/aurora/issues/1742 --- build_files/base/03-fetch.sh | 8 -------- 1 file changed, 8 deletions(-) diff --git a/build_files/base/03-fetch.sh b/build_files/base/03-fetch.sh index f914b949..d241e479 100755 --- a/build_files/base/03-fetch.sh +++ b/build_files/base/03-fetch.sh @@ -20,14 +20,6 @@ curl -X 'GET' \ 'https://flathub.org/api/v2/stats/io.github.kolunmi.Bazaar?all=false&days=1' \ -H 'accept: application/json' | jq -r ".installs_last_7_days" | numfmt --to=si --round=nearest > /usr/share/ublue-os/bazaar-install-count -# Starship Shell Prompt -ghcurl "https://github.com/starship/starship/releases/latest/download/starship-$(uname -m)-unknown-linux-gnu.tar.gz" --retry 3 -o /tmp/starship.tar.gz -ghcurl "https://github.com/starship/starship/releases/latest/download/starship-$(uname -m)-unknown-linux-gnu.tar.gz.sha256" --retry 3 -o /tmp/starship.tar.gz.sha256 - -echo "$(cat /tmp/starship.tar.gz.sha256) /tmp/starship.tar.gz" | sha256sum --check -tar -xzf /tmp/starship.tar.gz -C /tmp -install -c -m 0755 /tmp/starship /usr/bin - # Nerdfont symbols # to fix motd and prompt atleast temporarily ghcurl "https://github.com/ryanoasis/nerd-fonts/releases/latest/download/NerdFontsSymbolsOnly.zip" --retry 3 -o /tmp/nerdfontsymbols.zip From 72e0a87f8762c0fd00d944de22da27075d232449 Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Sun, 15 Mar 2026 08:31:19 +0200 Subject: [PATCH 07/82] Add push trigger for beta branch in workflow --- .github/workflows/build-image-beta.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/build-image-beta.yml b/.github/workflows/build-image-beta.yml index a530793a..01124d9e 100644 --- a/.github/workflows/build-image-beta.yml +++ b/.github/workflows/build-image-beta.yml @@ -7,6 +7,12 @@ on: paths-ignore: - "**.md" - ".github/workflows/moderator.yml" + push: + branches: + - beta + paths-ignore: + - "**.md" + - ".github/workflows/moderator.yml" workflow_call: workflow_dispatch: From 5371951f7b730138448f61ac59bd5251508298d4 Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Sun, 15 Mar 2026 09:21:21 +0200 Subject: [PATCH 08/82] chore: remove fw-fanctrl package for now (#1674) --- build_files/base/01-packages.sh | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/build_files/base/01-packages.sh b/build_files/base/01-packages.sh index 9a307074..535a27c5 100755 --- a/build_files/base/01-packages.sh +++ b/build_files/base/01-packages.sh @@ -177,10 +177,6 @@ dnf -y install --enablerepo='tailscale-stable' tailscale # Install COPR packages using isolated enablement (secure) echo "Installing COPR packages with isolated repo enablement..." -# From ublue-os/staging -copr_install_isolated "ublue-os/staging" \ - "fw-fanctrl" - # From ublue-os/packages copr_install_isolated "ublue-os/packages" \ "kcm_ublue" \ @@ -262,6 +258,8 @@ rm -rf /usr/share/plasma/look-and-feel/org.fedoraproject.fedora.desktop/ # https://github.com/ublue-os/bazzite/issues/1400 # TODO: test if we still need this when upgrading firmware with fwupd +dnf -y copr enable ublue-os/staging +dnf -y copr disable ublue-os/staging dnf5 -y swap \ --repo=copr:copr.fedorainfracloud.org:ublue-os:staging \ fwupd fwupd From 202a7eceac15ab684848978463e51a4d14024b18 Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Sun, 15 Mar 2026 10:41:26 +0200 Subject: [PATCH 09/82] chore: catchup beta with main (#1908) * chore: Disable merge_group trigger in beta workflow (#1901) * chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to 69f74bf (#1905) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:43 docker digest to 3c66a9e (#1906) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update softprops/action-gh-release digest to 71d29a0 (#1904) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update softprops/action-gh-release digest to b25b93d (#1907) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --------- Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/generate-release.yml | 2 +- image-versions.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml index 9c7a85e2..8ea433ed 100644 --- a/.github/workflows/generate-release.yml +++ b/.github/workflows/generate-release.yml @@ -56,7 +56,7 @@ jobs: echo "tag=${TAG}" >> $GITHUB_OUTPUT - name: Create Release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2 + uses: softprops/action-gh-release@b25b93d384199fc0fc8c2e126b2d937a0cbeb2ae # v2 if: contains(fromJson('["stable"]'), matrix.version) && (github.event.schedule == '0 1 * * TUE' || contains(fromJson('["workflow_dispatch", "workflow_call"]'), github.event_name)) with: name: ${{ steps.generate-release-text.outputs.title }} diff --git a/image-versions.yml b/image-versions.yml index 22419ae9..6ce04f46 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 43 - digest: sha256:d4fb6ae0935e7c470ddf35a8f84f1c0f069db605d8c22d9b4dd093362d9b6103 + digest: sha256:3c66a9e879a815bc279d4f600784cffa08fb36b1d297631521353a7c2d5d82b2 - name: common image: ghcr.io/get-aurora-dev/common tag: latest @@ -10,4 +10,4 @@ images: - name: brew image: ghcr.io/ublue-os/brew tag: latest - digest: sha256:1272e7f46b34e4212dcf01d356ef25612762a328c94ac0c04920c8585a2b98cf + digest: sha256:69f74bf6401b6f077a0548fce747c275ad1e02b53b56ca5879d7535d6d15247b From c036ecfe7a47b0362f0ac6d8063e668672d909a3 Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Tue, 17 Mar 2026 13:08:22 +0200 Subject: [PATCH 10/82] chore: rename sunshine service to app-dev.lizardbyte.app.Sunshine --- build_files/base/17-cleanup.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build_files/base/17-cleanup.sh b/build_files/base/17-cleanup.sh index 672a8792..2fbff2b6 100755 --- a/build_files/base/17-cleanup.sh +++ b/build_files/base/17-cleanup.sh @@ -28,7 +28,7 @@ systemctl enable flatpak-nuke-fedora.service systemctl enable flatpak-preinstall.service # disable sunshine service -systemctl --global disable sunshine.service +systemctl --global disable app-dev.lizardbyte.app.Sunshine.service # Updater systemctl enable uupd.timer From c36243a4db0f50ff4b6a615d356352e2a4254b27 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Tue, 17 Mar 2026 15:13:59 +0100 Subject: [PATCH 11/82] feat: rechunk with rpm-ostree (#1476) * feat: rechunk with rpm-ostree The legacy rechunker is basically unmaintained, this is a much safer option to reduce our (delta) image size. https://coreos.github.io/rpm-ostree/build-chunked-oci/ We can further reduce the layer diff by utilizing --previous-build in the next rpm-ostree release. It still has a couple problems in the current release in combination with non-rpm layers. https://github.com/coreos/chunkah is very early in development, don't bother for now. * fix: handle dance regarding stable, stable-daily * chore: add horrible workaround because of hhd-dev/rechunk * fix: for layer annotations not being pushed We need a newer podman version than ubuntu 24.04 provides, homebrew is the most elegant solution. We need the layer annotations for the rpm-ostree rechunker so that updates are more efficient. workaround for: https://github.com/containers/podman/issues/27796 * feat: assign layers to files we download * chore: autostart rechunker-group-fix * fix: don't do beta tag logic * chore: only run when deployed with ostree so this doesn't run on the ISO etc will need to be changed on composefs native backend. --- .github/workflows/reusable-build.yml | 84 +++++--- .gitignore | 3 +- Justfile | 188 +++++------------- build_files/base/03-fetch.sh | 3 + build_files/base/17-cleanup.sh | 4 + build_files/shared/build.sh | 7 + .../shared/usr/bin/rechunker-group-fix | 18 ++ .../system/rechunker-group-fix.service | 32 +++ 8 files changed, 161 insertions(+), 178 deletions(-) create mode 100755 system_files/shared/usr/bin/rechunker-group-fix create mode 100644 system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 0f5a9f85..2a5995bc 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -141,32 +141,19 @@ jobs: echo "SBOM=${SBOM}" >> $GITHUB_OUTPUT sudo rm -rf ${OCI_DIR} - - name: Rechunk Image - id: rechunk-image - shell: bash + - name: Rechunk Image with rpm-ostree + id: rechunker env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} MATRIX_BASE_NAME: ${{ matrix.base_name }} MATRIX_STREAM_NAME: ${{ matrix.stream_name }} MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }} + DEFAULT_TAG: ${{ env.DEFAULT_TAG }} run: | sudo -E $(command -v just) rechunk "${MATRIX_BASE_NAME}" \ "${MATRIX_STREAM_NAME}" \ "${MATRIX_IMAGE_FLAVOR}" \ "1" - - name: Load Image into Podman - id: load-rechunk - shell: bash - env: - MATRIX_BASE_NAME: ${{ matrix.base_name }} - DEFAULT_TAG: ${{ env.DEFAULT_TAG }} - MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }} - run: | - sudo -E $(command -v just) load-rechunk "${MATRIX_BASE_NAME}" \ - "${DEFAULT_TAG}" \ - "${MATRIX_IMAGE_FLAVOR}" - - name: Secureboot Check id: secureboot shell: bash @@ -179,6 +166,39 @@ jobs: "${DEFAULT_TAG}" \ "${MATRIX_IMAGE_FLAVOR}" + - name: Export to OCI Archive + if: github.event_name == 'pull_request' + id: oci-archive + env: + MATRIX_BASE_NAME: ${{ matrix.base_name }} + DEFAULT_TAG: ${{ env.DEFAULT_TAG }} + MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }} + run: | + sudo -E $(command -v just) export-oci "${MATRIX_BASE_NAME}" \ + "${DEFAULT_TAG}" \ + "${MATRIX_IMAGE_FLAVOR}" + + - name: Upload OCI dir as Artifact + if: github.event_name == 'pull_request' + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7 + with: + name: ${{ env.IMAGE_NAME }}.oci + path: ${{ env.IMAGE_NAME }}.oci + archive: false + if-no-files-found: error + retention-days: 1 + + - name: PR Testing Instructions + if: github.event_name == 'pull_request' + id: pr-summary + env: + IMAGE_NAME: ${{ env.IMAGE_NAME }} + MATRIX_STREAM_NAME: "${{ matrix.stream_name }}" + run: | + echo "Download the .oci file" >> $GITHUB_STEP_SUMMARY + echo "Rebase: sudo bootc switch --transport oci-archive /path/to/${IMAGE_NAME}".oci >> $GITHUB_STEP_SUMMARY + echo "Go back to the production image e.g.: sudo bootc switch --enforce-container-sigpolicy ghcr.io/ublue-os/${IMAGE_NAME}:${MATRIX_STREAM_NAME}" >> $GITHUB_STEP_SUMMARY + - name: Generate tags id: generate-tags shell: bash @@ -228,6 +248,14 @@ jobs: run: | echo "lowercase=${IMAGE_REGISTRY,,}" >> $GITHUB_OUTPUT + # TODO: remove me when we have a new podman in 26.04 runners + # needed because old podman doesn't push layer annotations for + # the rpm-ostree rechunker at all + - name: install podman from brew + if: github.event_name != 'pull_request' + run: | + /home/linuxbrew/.linuxbrew/bin/brew install podman + - name: Login to GitHub Container Registry if: github.event_name != 'pull_request' run: | @@ -248,31 +276,21 @@ jobs: attempt_delay: 15000 command: | set -euox pipefail + # HACK: push a second time so layer annotations are pushed + # TODO: remove me when https://github.com/containers/podman/issues/27796 fixed for tag in ${ALIAS_TAGS}; do - sudo -E podman push ${IMAGE_NAME}:${tag} ${LOWERCASE}/${IMAGE_NAME}:${tag} + sudo -E /home/linuxbrew/.linuxbrew/bin/podman push ${IMAGE_NAME}:${tag} ${LOWERCASE}/${IMAGE_NAME}:${tag} + done + + for tag in ${ALIAS_TAGS}; do + sudo -E /home/linuxbrew/.linuxbrew/bin/podman push ${IMAGE_NAME}:${tag} ${LOWERCASE}/${IMAGE_NAME}:${tag} done digest=$(skopeo inspect docker://${LOWERCASE}/${IMAGE_NAME}:${DEFAULT_TAG} --format '{{.Digest}}') echo "digest=${digest}" >> $GITHUB_OUTPUT - - name: Upload OCI dir as Artifact - if: github.event_name == 'pull_request' - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7 - with: - name: ${{ env.IMAGE_NAME }}.oci - path: ${{ env.IMAGE_NAME }}_build - if-no-files-found: error - retention-days: 1 - - - name: PR Testing Instructions - if: github.event_name == 'pull_request' - run: | - echo "Download an image, run unzip aurora.oci.zip -d aurora" >> $GITHUB_STEP_SUMMARY - echo "Rebase to them: sudo bootc switch --transport oci /absolute/path/to/dir/aurora" >> $GITHUB_STEP_SUMMARY - echo "Go back: sudo bootc switch --enforce-container-sigpolicy ghcr.io/ublue-os/aurora" >> $GITHUB_STEP_SUMMARY - - name: Install Cosign uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1 if: github.event_name != 'pull_request' diff --git a/.gitignore b/.gitignore index 879fe1e7..9d706f46 100644 --- a/.gitignore +++ b/.gitignore @@ -3,8 +3,7 @@ flatpaks_with_deps flatpak.* -*_build -*_build.* +aurora*.oci previous.manifest.json changelog.md output.env diff --git a/Justfile b/Justfile index f4e61776..fb8201b0 100644 --- a/Justfile +++ b/Justfile @@ -248,7 +248,7 @@ build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline elif [[ "{{ rechunk }}" == "1" && "{{ ghcr }}" == "1" ]]; then ${SUDOIF} {{ just }} rechunk "${image}" "${tag}" "${flavor}" 1 elif [[ "{{ rechunk }}" == "1" ]]; then - ${SUDOIF} {{ just }} rechunk "${image}" "${tag}" "${flavor}" + {{ just }} rechunk "${image}" "${tag}" "${flavor}" fi # Build Image and Rechunk @@ -278,7 +278,6 @@ build-pipeline image="aurora" tag="latest" flavor="main" kernel_pin="": rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0": #!/usr/bin/bash - echo "::group:: Rechunk Prep" set -eoux pipefail # Validate @@ -286,154 +285,46 @@ rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0": # Image Name image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }}) + fedora_version=$(jq -r '.Labels["org.opencontainers.image.version"]' < /tmp/manifest.json | grep -oP '^[0-9]+') + DEFAULT_TAG=$({{ just }} generate-default-tag {{ tag }} {{ ghcr }}) - # Check if image is already built - ID=$(${PODMAN} images --filter reference=localhost/"${image_name}":"${tag}" --format "'{{ '{{.ID}}' }}'") - if [[ -z "$ID" ]]; then - {{ just }} build "${image}" "${tag}" "${flavor}" + if [[ "{{ ghcr }}" == "0" ]]; then + {{ just }} load-rootful "${image}" "${tag}" "${flavor}" fi - # Load into Rootful Podman - ID=$(${SUDOIF} ${PODMAN} images --filter reference=localhost/"${image_name}":"${tag}" --format "'{{ '{{.ID}}' }}'") - if [[ -z "$ID" && ! ${PODMAN} =~ docker ]]; then - COPYTMP=$(mktemp -p "${PWD}" -d -t podman_scp.XXXXXXXXXX) - ${SUDOIF} TMPDIR=${COPYTMP} ${PODMAN} image scp ${UID}@localhost::localhost/"${image_name}":"${tag}" root@localhost::localhost/"${image_name}":"${tag}" - rm -rf "${COPYTMP}" - fi - - # Prep Container - CREF=$(${SUDOIF} ${PODMAN} create localhost/"${image_name}":"${tag}" bash) - OLD_IMAGE=$(${SUDOIF} ${PODMAN} inspect $CREF | jq -r '.[].Image') - OUT_NAME="${image_name}_build" - MOUNT=$(${SUDOIF} ${PODMAN} mount "${CREF}") - - # Fedora Version - fedora_version=$(${SUDOIF} ${PODMAN} inspect $CREF | jq -r '.[].Config.Labels["ostree.linux"]' | grep -oP 'fc\K[0-9]+') - - # Label Version - VERSION=$(${SUDOIF} ${PODMAN} inspect $CREF | jq -r '.[].Config.Labels["org.opencontainers.image.version"]') - - # Git SHA - SHA="dedbeef" - if [[ -z "$(git status -s)" ]]; then - SHA=$(git rev-parse HEAD) - fi - - # Rest of Labels - LABELS=" - io.artifacthub.package.deprecated=false - io.artifacthub.package.keywords=bootc,fedora,aurora,ublue,universal-blue - io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4 - io.artifacthub.package.maintainers=[{\"name\": \"NiHaiden\", \"email\": \"me@nhaiden.io\"}] - io.artifacthub.package.readme-url=https://raw.githubusercontent.com/ublue-os/aurora/refs/heads/main/README.md - org.opencontainers.image.created=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z) - org.opencontainers.image.license=Apache-2.0 - org.opencontainers.image.source=https://raw.githubusercontent.com/ublue-os/aurora/refs/heads/main/Containerfile - org.opencontainers.image.title=${image_name} - org.opencontainers.image.url=https://getaurora.dev - org.opencontainers.image.vendor={{ repo_organization }} - ostree.linux=$(${SUDOIF} ${PODMAN} inspect $CREF | jq -r '.[].Config.Labels["ostree.linux"]') - containers.bootc=1 - " - - # Cleanup Space during Github Action + # In CI this will replace the unrechunked image if [[ "{{ ghcr }}" == "1" ]]; then - base_image_name=kinoite - if [[ "${tag}" =~ stable ]]; then - tag="stable-daily" - fi - ID=$(${SUDOIF} ${PODMAN} images --filter reference=ghcr.io/{{ repo_organization }}/"${base_image_name}":${fedora_version} --format "{{ '{{.ID}}' }}") - if [[ -n "$ID" ]]; then - ${PODMAN} rmi "$ID" - fi + CHUNKED_IMAGE="localhost/"${image_name}":"${DEFAULT_TAG}"" + else + CHUNKED_IMAGE="localhost/"${image_name}":"${DEFAULT_TAG}"-chunked" fi - # Rechunk Container - rechunker="{{ rechunker_image }}" - - echo "::endgroup::" - echo "::group:: Prune" - - # Run Rechunker's Prune + # 96 layers, conservative default, same what ci-test is using + # 499 is podman run limit + # in CI this renames stable to stable-daily ${SUDOIF} ${PODMAN} run --rm \ --pull=${PULL_POLICY} \ - --security-opt label=disable \ - --volume "$MOUNT":/var/tree \ - --env TREE=/var/tree \ - --user 0:0 \ - "${rechunker}" \ - /sources/rechunk/1_prune.sh - - echo "::endgroup::" - echo "::group:: Create ostree tree" - - # Run Rechunker's Create - ${SUDOIF} ${PODMAN} run --rm \ - --security-opt label=disable \ - --volume "$MOUNT":/var/tree \ - --volume "cache_ostree:/var/ostree" \ - --env TREE=/var/tree \ - --env REPO=/var/ostree/repo \ - --env RESET_TIMESTAMP=1 \ - --user 0:0 \ - "${rechunker}" \ - /sources/rechunk/2_create.sh - - # Cleanup Temp Container Reference - ${SUDOIF} ${PODMAN} unmount "$CREF" - ${SUDOIF} ${PODMAN} rm "$CREF" - ${SUDOIF} ${PODMAN} rmi "$OLD_IMAGE" - - echo "::endgroup::" - echo "::group:: Rechunker" - - # Run Rechunker - ${SUDOIF} ${PODMAN} run --rm \ - --pull=${PULL_POLICY} \ - --security-opt label=disable \ - --volume "$PWD:/workspace" \ - --volume "$PWD:/var/git" \ - --volume cache_ostree:/var/ostree \ - --env REPO=/var/ostree/repo \ - --env PREV_REF=ghcr.io/ublue-os/"${image_name}":"${tag}" \ - --env OUT_NAME="$OUT_NAME" \ - --env LABELS="${LABELS}" \ - --env "DESCRIPTION='The ultimate productivity workstation'" \ - --env "VERSION=${VERSION}" \ - --env VERSION_FN=/workspace/version.txt \ - --env OUT_REF="oci:$OUT_NAME" \ - --env GIT_DIR="/var/git" \ - --env REVISION="$SHA" \ - --user 0:0 \ - "${rechunker}" \ - /sources/rechunk/3_chunk.sh - - # Fix Permissions of OCI - ${SUDOIF} find ${OUT_NAME} -type d -exec chmod 0755 {} \; || true - ${SUDOIF} find ${OUT_NAME}* -type f -exec chmod 0644 {} \; || true - - if [[ "${UID}" -gt "0" ]]; then - ${SUDOIF} chown "${UID}:${GROUPS}" -R "${PWD}" - elif [[ -n "${SUDO_UID:-}" ]]; then - chown "${SUDO_UID}":"${SUDO_GID}" -R "${PWD}" - fi - - # Remove cache_ostree - ${SUDOIF} ${PODMAN} volume rm cache_ostree - - echo "::endgroup::" + --privileged \ + -v "/var/lib/containers:/var/lib/containers" \ + --entrypoint /usr/bin/rpm-ostree \ + "${base_image_org}/${base_image_name}:${fedora_version}" \ + compose build-chunked-oci \ + --max-layers 128 \ + --format-version=2 \ + --bootc \ + --from "localhost/"${image_name}":"${tag}"" \ + --output containers-storage:${CHUNKED_IMAGE} # Pipeline Checks if [[ {{ pipeline }} == "1" && -n "${SUDO_USER:-}" ]]; then - sudo -u "${SUDO_USER}" {{ just }} load-rechunk "${image}" "${tag}" "${flavor}" sudo -u "${SUDO_USER}" {{ just }} secureboot "${image}" "${tag}" "${flavor}" fi -# Load OCI into Podman Store +# For Rechunk [group('Image')] -load-rechunk image="aurora" tag="latest" flavor="main": +load-rootful $image="aurora" $tag="latest" $flavor="main": #!/usr/bin/bash - set -eou pipefail + set -oux pipefail # Validate {{ just }} validate {{ image }} {{ tag }} {{ flavor }} @@ -441,14 +332,27 @@ load-rechunk image="aurora" tag="latest" flavor="main": # Image Name image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }}) - # Load Image - OUT_NAME="${image_name}_build" - IMAGE=$(${PODMAN} pull oci:"${PWD}"/"${OUT_NAME}") - ${PODMAN} tag ${IMAGE} localhost/"${image_name}":{{ tag }} + if [[ ! "$(id -u)" == 0 && ! ${PODMAN} =~ docker ]]; then + ID=$(${PODMAN} images --filter reference=localhost/"${image_name}":"${tag}" --format "'{{ '{{.ID}}' }}'") + if [[ -z "$ID" ]]; then + {{ just }} build "$image" "$tag" "$flavor" + fi + ${PODMAN} image scp localhost/"${image_name}":"${tag}" root@localhost:: + fi - # Cleanup - rm -rf "${OUT_NAME}*" - rm -f previous.manifest.json +# Generate OCI Archive for PR Testing +[group('Image')] +export-oci $image="aurora" $tag="latest" $flavor="main": + #!/usr/bin/bash + set -oux pipefail + + # Validate + {{ just }} validate {{ image }} {{ tag }} {{ flavor }} + + # Image Name + image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }}) + + ${PODMAN} push localhost/"${image_name}":"${tag}" oci-archive:"${image_name}".oci # Run Container [group('Image')] @@ -701,8 +605,6 @@ tag-images image_name="" default_tag="" tags="": ${PODMAN} tag $IMAGE {{ image_name }}:${tag} done - - # Show Images ${PODMAN} images diff --git a/build_files/base/03-fetch.sh b/build_files/base/03-fetch.sh index d241e479..61a251ef 100755 --- a/build_files/base/03-fetch.sh +++ b/build_files/base/03-fetch.sh @@ -10,6 +10,7 @@ flatpak remote-add --system --if-not-exists flathub https://flathub.org/repo/fla # Offline Aurora documentation ghcurl "https://github.com/ublue-os/aurora-docs/releases/download/0.1/aurora.pdf" --retry 3 -o /tmp/aurora.pdf install -Dm0644 -t /usr/share/doc/aurora/ /tmp/aurora.pdf +setfattr -n user.component -v "aurora-offline-docs" /usr/share/doc/aurora/aurora.pdf cp /usr/share/applications/dev.getaurora.offline-docs.desktop /usr/share/kglobalaccel/ # Weekly user count for fastfetch @@ -29,12 +30,14 @@ mv /tmp/SymbolsNerdFont*.ttf /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/ # Bash Prexec v0.6.0 ghcurl https://raw.githubusercontent.com/rcaloras/bash-preexec/b73ed5f7f953207b958f15b1773721dded697ac3/bash-preexec.sh --retry 3 -Lo /usr/share/bash-prexec +setfattr -n user.component -v "bash-prexec" /usr/share/bash-prexec # use CoreOS' generator for emergency/rescue boot # see detail: https://github.com/ublue-os/main/issues/653 mkdir -p /usr/lib/systemd/system-generators ghcurl "https://raw.githubusercontent.com/coreos/fedora-coreos-config/refs/heads/stable/overlay.d/05core/usr/lib/systemd/system-generators/coreos-sulogin-force-generator" --retry 3 -Lo /usr/lib/systemd/system-generators/coreos-sulogin-force-generator chmod +x /usr/lib/systemd/system-generators/coreos-sulogin-force-generator +setfattr -n user.component -v "coreos-sulogin-force-generator" /usr/lib/systemd/system-generators/coreos-sulogin-force-generator echo "::endgroup::" diff --git a/build_files/base/17-cleanup.sh b/build_files/base/17-cleanup.sh index 2fbff2b6..0a0d5ddc 100755 --- a/build_files/base/17-cleanup.sh +++ b/build_files/base/17-cleanup.sh @@ -24,6 +24,10 @@ systemctl enable flatpak-nuke-fedora.service # TODO: Reinvestigate when bazaar gains dbus activation # systemctl --global enable bazaar.service +# see /usr/bin/rechunker-group-fix +# DO NOT REMOVE THIS +systemctl enable rechunker-group-fix.service + # run flatpak preinstall once at startup systemctl enable flatpak-preinstall.service diff --git a/build_files/shared/build.sh b/build_files/shared/build.sh index 1a288b23..ce2049bc 100755 --- a/build_files/shared/build.sh +++ b/build_files/shared/build.sh @@ -17,6 +17,13 @@ rpm --erase --nodeps --nodb generic-logos # Copy Files to Container rsync -rvKl /ctx/system_files/shared/ / +setfattr -n user.component -v "aurora-wallpapers" /usr/share/backgrounds/aurora +setfattr -n user.component -v "aurora-assets" /usr/share/plasma/avatars/{echo,lumina,scope,tina,vincent}.png +setfattr -n user.component -v "aurora-assets" /etc/bazaar +setfattr -n user.component -v "aurora-plasma-theme" /usr/share/plasma/look-and-feel/dev.getaurora.aurora{,light}.desktop +setfattr -n user.component -v "aurora-config" /usr/share/ublue-os +setfattr -n user.component -v "homebrew" /usr/share/homebrew.tar.zst + if [[ "${IMAGE_FLAVOR}" == "dx" ]]; then /ctx/build_files/shared/build-dx.sh fi diff --git a/system_files/shared/usr/bin/rechunker-group-fix b/system_files/shared/usr/bin/rechunker-group-fix new file mode 100755 index 00000000..4a6d5a9f --- /dev/null +++ b/system_files/shared/usr/bin/rechunker-group-fix @@ -0,0 +1,18 @@ +#!/usr/bin/env bash + +# To use this script, you'll want to put this in your systemd service: +# rm /etc/gshadow +# systemd-sysusers +# (run this script) +# systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev +# This will populate /etc/group successfully, and then populate /etc/gshadow +# with any missing groups that we nuked when we removed /etc/gshadow + +GSHADOW_FILE="/etc/gshadow" +GROUP_FILE="/etc/group" + +for f in $(cat $GROUP_FILE); do + cut -f1 -d':' <(echo $f) | xargs -I{} grep ^"{}" $GSHADOW_FILE &>/dev/null || \ + echo $(cut -f1 -d':' <(echo $f)):'!*::' >> $GSHADOW_FILE +done + diff --git a/system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service b/system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service new file mode 100644 index 00000000..e05f2450 --- /dev/null +++ b/system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service @@ -0,0 +1,32 @@ +# We have this script so that people using images with `nss-altfiles` (`/usr/lib/g{roup,shadow}`) +# do not break their systems when rebasing to an image without that +# This usually happens when using https://github.com/hhd-dev/rechunk then rebasing to an image without it. +# Please DO NOT remove this unless this is fully, completely obsolete. +# This is exactly what is making it break: https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e99afbdc2eb06788ae28e157a88b03d70/1_prune.sh#L41-L47 +# Users WILL experience black screens and systems will NOT boot if this script malfunctions. Please test this properly and always make sure this works +# Relevant issues: +# - https://github.com/bootc-dev/bootc/issues/1179#issuecomment-2708305926 +# - https://github.com/ublue-os/main/issues/759 +# - https://github.com/ublue-os/bluefin-lts/issues/918 +# - https://github.com/ublue-os/image-template/issues/177 +# - https://github.com/ublue-os/aurora/issues/1468 +# - https://github.com/ublue-os/bluefin/issues/3852 +# This got created on Tue, 16 Dec 2025 00:44:58 -0300 +[Unit] +Description=Fix groups for Legacy rechunker +ConditionPathExists=/run/ostree-booted +Wants=local-fs.target +After=local-fs.target +Before=systemd-user-sessions.service +# Before=systemd-sysusers.service + +[Service] +Type=oneshot +ExecStart=bash -c 'touch /etc/gshadow && chmod 600 /etc/gshadow' +ExecStart=bash -c 'rm /etc/gshadow' +ExecStart=systemd-sysusers +ExecStart=rechunker-group-fix +ExecStart=systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev + +[Install] +WantedBy=default.target multi-user.target From 8e462de93c4e1fac41c26695447f022579aa4902 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Tue, 17 Mar 2026 15:36:23 +0100 Subject: [PATCH 12/82] chore(beta): plasma-setup branding (#1916) * chore(beta): plasma-setup branding fixes: https://github.com/ublue-os/aurora/issues/1704 Needs: https://github.com/ublue-os/packages/pull/1191 * switch to the new r eal package from copr * chore: make plasma-setup synced with plasma-desktop If this breaks then we know that we have to update the package, this is to prevent us running an old version --------- Co-authored-by: inffy <10782843+inffy@users.noreply.github.com> --- build_files/base/01-packages.sh | 22 +++++++++++++++------- build_files/base/16-override-install.sh | 7 +++++++ 2 files changed, 22 insertions(+), 7 deletions(-) diff --git a/build_files/base/01-packages.sh b/build_files/base/01-packages.sh index 535a27c5..c569a17d 100755 --- a/build_files/base/01-packages.sh +++ b/build_files/base/01-packages.sh @@ -250,12 +250,6 @@ if [[ "${#EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then fi fi -# we can't remove plasma-lookandfeel-fedora package because it is a dependency of plasma-desktop -rpm --erase --nodeps plasma-lookandfeel-fedora -# rpm erase doesn't remove actual files -rm -rf /usr/share/plasma/look-and-feel/org.fedoraproject.fedora.desktop/ - - # https://github.com/ublue-os/bazzite/issues/1400 # TODO: test if we still need this when upgrading firmware with fwupd dnf -y copr enable ublue-os/staging @@ -276,6 +270,10 @@ dnf5 -y --repo=copr:copr.fedorainfracloud.org:ublue-os:flatpak-test swap flatpak dnf5 -y --repo=copr:copr.fedorainfracloud.org:ublue-os:flatpak-test swap flatpak-session-helper flatpak-session-helper dnf5 -y --repo=copr:copr.fedorainfracloud.org:ublue-os:flatpak-test install flatpak-debuginfo flatpak-libs-debuginfo flatpak-session-helper-debuginfo + +PLASMA_VERS=$(rpm -q --qf "%{VERSION}" plasma-desktop) +dnf -y install plasma-firewall-"${PLASMA_VERS}" + ## Pins and Overrides ## Use this section to pin packages in order to avoid regressions # Remember to leave a note with rationale/link to issue for each pin! @@ -286,7 +284,17 @@ dnf5 -y --repo=copr:copr.fedorainfracloud.org:ublue-os:flatpak-test install flat # dnf5 upgrade --refresh --advisory=FEDORA-2024-dd2e9fb225 #fi -dnf -y install plasma-firewall-$(rpm -q --qf "%{VERSION}" plasma-desktop) +# https://invent.kde.org/plasma/plasma-setup/-/issues/72 +dnf -y copr enable ublue-os/staging +dnf -y copr disable ublue-os/staging +dnf5 -y swap \ + --repo=copr:copr.fedorainfracloud.org:ublue-os:staging \ +plasma-setup plasma-setup-"${PLASMA_VERS}" + +# we can't remove plasma-lookandfeel-fedora package because it is a dependency of plasma-desktop +rpm --erase --nodeps plasma-lookandfeel-fedora +# rpm erase doesn't remove actual files +rm -rf /usr/share/plasma/look-and-feel/org.fedoraproject.fedora.desktop/ # Install DX specific packages if [[ "${IMAGE_FLAVOR}" == "dx" ]]; then diff --git a/build_files/base/16-override-install.sh b/build_files/base/16-override-install.sh index 2fe84bb8..3f02c441 100755 --- a/build_files/base/16-override-install.sh +++ b/build_files/base/16-override-install.sh @@ -38,4 +38,11 @@ setsebool -P samba_export_all_ro=1 setsebool -P samba_export_all_rw=1 sed -i '/^\[homes\]/,/^\[/{/^\[homes\]/d;/^\[/!d}' /etc/samba/smb.conf +# so we can share the plasma-setup package with bazzite +# symlinking ours to be named like bazzite's default convergence wallpaper +# https://invent.kde.org/plasma/plasma-setup/-/issues/72 +# https://github.com/ublue-os/packages/pull/1191 +mkdir -p /usr/share/wallpapers/.ublue-plasma-setup/contents/images +ln -s /usr/share/backgrounds/default.jxl /usr/share/wallpapers/.ublue-plasma-setup/contents/images/3940x2160.jxl + echo "::endgroup::" From 2196c34656354628c683b07d715347188b85573a Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Thu, 19 Mar 2026 06:41:17 +0200 Subject: [PATCH 13/82] chore: remove openrazer-kmod (#1923) * chore: remove openrazer-kmod Remove installation of openrazer-kmod. The daemon is already commented out (removed) in beta * remove commented out daemon part * test: remove razer repo --------- Co-authored-by: renner --- build_files/base/02-install-common-kernel-akmods.sh | 8 +------- build_files/base/17-cleanup.sh | 5 ----- 2 files changed, 1 insertion(+), 12 deletions(-) diff --git a/build_files/base/02-install-common-kernel-akmods.sh b/build_files/base/02-install-common-kernel-akmods.sh index e890cc1d..f10cb44a 100755 --- a/build_files/base/02-install-common-kernel-akmods.sh +++ b/build_files/base/02-install-common-kernel-akmods.sh @@ -24,17 +24,11 @@ fi dnf5 versionlock add kernel kernel-devel kernel-devel-matched kernel-core kernel-modules kernel-modules-core kernel-modules-extra -dnf -y install /tmp/rpms/{common,kmods}/*xone*.rpm /tmp/rpms/{common,kmods}/*openrazer*.rpm || true +dnf -y install /tmp/rpms/{common,kmods}/*xone*.rpm || true dnf -y install /tmp/rpms/{kmods,common}/*v4l2loopback*.rpm || true mkdir -p /etc/pki/akmods/certs ghcurl "https://github.com/ublue-os/akmods/raw/refs/heads/main/certs/public_key.der" --retry 3 -Lo /etc/pki/akmods/certs/akmods-ublue.der -# OpenRazer from hardware:razer repo (not a COPR) -# TODO: decide if we drop this on F44 or not -#dnf -y config-manager addrepo --from-repofile=https://openrazer.github.io/hardware:razer.repo -#dnf -y install openrazer-daemon || true -#sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/hardware:razer.repo - echo "::endgroup::" diff --git a/build_files/base/17-cleanup.sh b/build_files/base/17-cleanup.sh index 0a0d5ddc..e6e91fe1 100755 --- a/build_files/base/17-cleanup.sh +++ b/build_files/base/17-cleanup.sh @@ -57,11 +57,6 @@ for repo in fedora-multimedia tailscale fedora-cisco-openh264; do fi done -# Disable hardware:razer repo if it exists -if [[ -f "/etc/yum.repos.d/hardware:razer.repo" ]]; then - sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/hardware:razer.repo -fi - # Disable Terra repos (installed on F42 and earlier) for i in /etc/yum.repos.d/terra*.repo; do if [[ -f "$i" ]]; then From f74180aea33bd8bbf271a0ad74aa1f339b81e2b2 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Thu, 19 Mar 2026 05:43:34 +0100 Subject: [PATCH 14/82] fix(beta): replace konsole with ptyxis in plasma (#1928) * fix(beta): replace konsole with ptyxis in Plasma * fix: skill issue --- build_files/base/16-override-install.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/build_files/base/16-override-install.sh b/build_files/base/16-override-install.sh index 3f02c441..ab5e03c2 100755 --- a/build_files/base/16-override-install.sh +++ b/build_files/base/16-override-install.sh @@ -38,6 +38,10 @@ setsebool -P samba_export_all_ro=1 setsebool -P samba_export_all_rw=1 sed -i '/^\[homes\]/,/^\[/{/^\[homes\]/d;/^\[/!d}' /etc/samba/smb.conf +# beta only quirk, remove when https://github.com/get-aurora-dev/common/pull/119 merged +sed -i "s/org.gnome.Ptyxis/org.kde.konsole/" /usr/share/kde-settings/kde-profile/default/xdg/kicker-extra-favoritesrc +sed -i "s/org.gnome.Ptyxis/org.kde.konsole/" /usr/share/plasma/look-and-feel/dev.getaurora.aurora.desktop/contents/layouts/org.kde.plasma.desktop-layout.js + # so we can share the plasma-setup package with bazzite # symlinking ours to be named like bazzite's default convergence wallpaper # https://invent.kde.org/plasma/plasma-setup/-/issues/72 From d707c687b076f1b6f9ba249af4f41cc752987bd8 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Thu, 19 Mar 2026 18:59:18 +0100 Subject: [PATCH 15/82] fix(beta): make docker able to pull the image (#1934) * fix(beta): make docker able to pull the image https://docs.docker.com/engine/storage/drivers/overlayfs-driver/#how-the-overlay2-driver-works * fix(beta): consolidate shell scripts in aurora-config layer It doesn't make sense for a shell script which is just a couple KiB big to get it's own dedicated layer. --- Justfile | 4 +++- build_files/base/03-fetch.sh | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/Justfile b/Justfile index fb8201b0..dea4b689 100644 --- a/Justfile +++ b/Justfile @@ -300,7 +300,9 @@ rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0": fi # 96 layers, conservative default, same what ci-test is using + # one layer is secretly being added for the ostree export # 499 is podman run limit + # 128 is docker pull limit # in CI this renames stable to stable-daily ${SUDOIF} ${PODMAN} run --rm \ --pull=${PULL_POLICY} \ @@ -309,7 +311,7 @@ rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0": --entrypoint /usr/bin/rpm-ostree \ "${base_image_org}/${base_image_name}:${fedora_version}" \ compose build-chunked-oci \ - --max-layers 128 \ + --max-layers 127 \ --format-version=2 \ --bootc \ --from "localhost/"${image_name}":"${tag}"" \ diff --git a/build_files/base/03-fetch.sh b/build_files/base/03-fetch.sh index 61a251ef..12d56ae1 100755 --- a/build_files/base/03-fetch.sh +++ b/build_files/base/03-fetch.sh @@ -30,14 +30,14 @@ mv /tmp/SymbolsNerdFont*.ttf /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/ # Bash Prexec v0.6.0 ghcurl https://raw.githubusercontent.com/rcaloras/bash-preexec/b73ed5f7f953207b958f15b1773721dded697ac3/bash-preexec.sh --retry 3 -Lo /usr/share/bash-prexec -setfattr -n user.component -v "bash-prexec" /usr/share/bash-prexec +setfattr -n user.component -v "aurora-config" /usr/share/bash-prexec # use CoreOS' generator for emergency/rescue boot # see detail: https://github.com/ublue-os/main/issues/653 mkdir -p /usr/lib/systemd/system-generators ghcurl "https://raw.githubusercontent.com/coreos/fedora-coreos-config/refs/heads/stable/overlay.d/05core/usr/lib/systemd/system-generators/coreos-sulogin-force-generator" --retry 3 -Lo /usr/lib/systemd/system-generators/coreos-sulogin-force-generator chmod +x /usr/lib/systemd/system-generators/coreos-sulogin-force-generator -setfattr -n user.component -v "coreos-sulogin-force-generator" /usr/lib/systemd/system-generators/coreos-sulogin-force-generator +setfattr -n user.component -v "aurora-config" /usr/lib/systemd/system-generators/coreos-sulogin-force-generator echo "::endgroup::" From 5ebd9f1a7cd09eb8f60ed4289ca7e968a0fb6fbd Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Fri, 20 Mar 2026 14:35:31 +0100 Subject: [PATCH 16/82] chore: use aurora package variant for plasma-setup (#1933) needs: https://github.com/ublue-os/packages/pull/1199 fixes: https://github.com/ublue-os/aurora/issues/1704 Co-authored-by: inffy <10782843+inffy@users.noreply.github.com> --- build_files/base/01-packages.sh | 7 ++++--- build_files/base/16-override-install.sh | 7 ------- build_files/base/20-tests.sh | 5 ++++- 3 files changed, 8 insertions(+), 11 deletions(-) diff --git a/build_files/base/01-packages.sh b/build_files/base/01-packages.sh index c569a17d..45f61659 100755 --- a/build_files/base/01-packages.sh +++ b/build_files/base/01-packages.sh @@ -287,9 +287,10 @@ dnf -y install plasma-firewall-"${PLASMA_VERS}" # https://invent.kde.org/plasma/plasma-setup/-/issues/72 dnf -y copr enable ublue-os/staging dnf -y copr disable ublue-os/staging -dnf5 -y swap \ - --repo=copr:copr.fedorainfracloud.org:ublue-os:staging \ -plasma-setup plasma-setup-"${PLASMA_VERS}" +dnf -y swap --repo=copr:copr.fedorainfracloud.org:ublue-os:staging \ + plasma-setup plasma-setup-"${PLASMA_VERS}"-*.aurora + +dnf versionlock add plasma-setup # we can't remove plasma-lookandfeel-fedora package because it is a dependency of plasma-desktop rpm --erase --nodeps plasma-lookandfeel-fedora diff --git a/build_files/base/16-override-install.sh b/build_files/base/16-override-install.sh index ab5e03c2..a5144d96 100755 --- a/build_files/base/16-override-install.sh +++ b/build_files/base/16-override-install.sh @@ -42,11 +42,4 @@ sed -i '/^\[homes\]/,/^\[/{/^\[homes\]/d;/^\[/!d}' /etc/samba/smb.conf sed -i "s/org.gnome.Ptyxis/org.kde.konsole/" /usr/share/kde-settings/kde-profile/default/xdg/kicker-extra-favoritesrc sed -i "s/org.gnome.Ptyxis/org.kde.konsole/" /usr/share/plasma/look-and-feel/dev.getaurora.aurora.desktop/contents/layouts/org.kde.plasma.desktop-layout.js -# so we can share the plasma-setup package with bazzite -# symlinking ours to be named like bazzite's default convergence wallpaper -# https://invent.kde.org/plasma/plasma-setup/-/issues/72 -# https://github.com/ublue-os/packages/pull/1191 -mkdir -p /usr/share/wallpapers/.ublue-plasma-setup/contents/images -ln -s /usr/share/backgrounds/default.jxl /usr/share/wallpapers/.ublue-plasma-setup/contents/images/3940x2160.jxl - echo "::endgroup::" diff --git a/build_files/base/20-tests.sh b/build_files/base/20-tests.sh index 3b1e1b1d..13929143 100755 --- a/build_files/base/20-tests.sh +++ b/build_files/base/20-tests.sh @@ -43,7 +43,10 @@ test -f /usr/share/flatpak/preinstall.d/bazaar.preinstall test -f /usr/lib/systemd/system/flatpak-add-fedora-repos.service && false # Basic smoke test to check if the flatpak version is from our copr -flatpak preinstall --help +flatpak preinstall --help > /dev/null 2>&1 + +# Make sure to not pull in the bazzite one +rpm -q plasma-setup --qf "%{RELEASE}" | grep -q aurora test -f /usr/share/doc/aurora/aurora.pdf test -f /usr/share/homebrew.tar.zst From 508115c3746cf62a23fb519bacdf26553d6813c4 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sat, 21 Mar 2026 07:34:39 +0100 Subject: [PATCH 17/82] chore: catchup beta with main (#1941) * chore: Disable merge_group trigger in beta workflow (#1901) * chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to 69f74bf (#1905) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:43 docker digest to 3c66a9e (#1906) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update softprops/action-gh-release digest to 71d29a0 (#1904) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update softprops/action-gh-release digest to b25b93d (#1907) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * fix(ci): run scorecard once per week with stable (#1909) * fix(ci): run scorecard once per week with stable This wasn't supposed to run at every 15 minutes * chore(ci): do not build images when changing scorecard * chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to a4758dd (#1910) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore: remove remaining sssd packages (#1911) followup of https://github.com/ublue-os/aurora/pull/1811 related upstream issue: https://bugzilla.redhat.com/show_bug.cgi?id=2417703 * chore(deps): update softprops/action-gh-release digest to 153bb8e (#1912) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:43 docker digest to 45e92dc (#1913) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update github/codeql-action digest to b1bff81 (#1915) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:43 docker digest to 1b716db (#1918) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore: rename the Sunshine service (#1920) * chore: rename the Sunshine service * derp Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 1f60519 (#1921) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 47ce300 (#1922) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:43 docker digest to 0eac2a6 (#1925) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update actions/cache action to v5.0.4 (#1927) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:43 docker digest to aa5f004 (#1929) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore: Add LFX Health Score badge to README (#1930) * chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 281f5ad (#1932) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/kinoite:43 docker digest to 77d0a92 (#1936) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update github/codeql-action digest to c6f9311 (#1937) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update github/codeql-action digest to 3869755 (#1939) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * chore(deps): update anchore/sbom-action digest to e22c389 (#1938) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --------- Co-authored-by: inffy <10782843+inffy@users.noreply.github.com> Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/build-image-beta.yml | 6 ++++-- .github/workflows/build-image-latest-main.yml | 1 + .github/workflows/build-image-stable.yml | 1 + .github/workflows/generate-release.yml | 2 +- .github/workflows/reusable-build.yml | 4 ++-- .github/workflows/scorecard.yml | 4 ++-- README.md | 2 +- build_files/base/01-packages.sh | 4 ---- image-versions.yml | 4 ++-- 9 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/build-image-beta.yml b/.github/workflows/build-image-beta.yml index 01124d9e..2c8471df 100644 --- a/.github/workflows/build-image-beta.yml +++ b/.github/workflows/build-image-beta.yml @@ -7,12 +7,14 @@ on: paths-ignore: - "**.md" - ".github/workflows/moderator.yml" + - ".github/workflows/scorecard.yml" push: branches: - beta paths-ignore: - - "**.md" - - ".github/workflows/moderator.yml" + - "**.md" + - ".github/workflows/moderator.yml" + - ".github/workflows/scorecard.yml" workflow_call: workflow_dispatch: diff --git a/.github/workflows/build-image-latest-main.yml b/.github/workflows/build-image-latest-main.yml index de845426..e3646eab 100644 --- a/.github/workflows/build-image-latest-main.yml +++ b/.github/workflows/build-image-latest-main.yml @@ -8,6 +8,7 @@ on: paths-ignore: - "**.md" - ".github/workflows/moderator.yml" + - ".github/workflows/scorecard.yml" workflow_call: workflow_dispatch: diff --git a/.github/workflows/build-image-stable.yml b/.github/workflows/build-image-stable.yml index f055dfd7..4e99c2fa 100644 --- a/.github/workflows/build-image-stable.yml +++ b/.github/workflows/build-image-stable.yml @@ -8,6 +8,7 @@ on: paths-ignore: - "**.md" - ".github/workflows/moderator.yml" + - ".github/workflows/scorecard.yml" schedule: - cron: "0 1 * * TUE" # Every Tuesday at 1:15 AM workflow_call: diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml index 8ea433ed..4c6f64de 100644 --- a/.github/workflows/generate-release.yml +++ b/.github/workflows/generate-release.yml @@ -56,7 +56,7 @@ jobs: echo "tag=${TAG}" >> $GITHUB_OUTPUT - name: Create Release - uses: softprops/action-gh-release@b25b93d384199fc0fc8c2e126b2d937a0cbeb2ae # v2 + uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2 if: contains(fromJson('["stable"]'), matrix.version) && (github.event.schedule == '0 1 * * TUE' || contains(fromJson('["workflow_dispatch", "workflow_call"]'), github.event_name)) with: name: ${{ steps.generate-release-text.outputs.title }} diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 2a5995bc..7131ef3f 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -88,7 +88,7 @@ jobs: echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV - name: Setup DNF package cache - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 env: IMAGE_NAME: ${{ env.IMAGE_NAME }} with: @@ -116,7 +116,7 @@ jobs: - name: Setup Syft id: setup-syft if: github.event_name != 'pull_request' - uses: anchore/sbom-action/download-syft@57aae528053a48a3f6235f2d9461b05fbcb7366d # v0 + uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0 with: syft-version: v1.39.0 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 2689aa00..29f4e211 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -10,7 +10,7 @@ on: # To guarantee Maintained check is occasionally updated. See # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained schedule: - - cron: '* * 1/7 * *' + - cron: "0 1 * * TUE" # Every Tuesday at 1:15 AM push: branches: [ "main" ] @@ -71,6 +71,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard (optional). # Commenting out will disable upload of results to your repo's Code Scanning dashboard - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4 + uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4 with: sarif_file: results.sarif diff --git a/README.md b/README.md index 2d603786..928fa538 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ [![Codacy Badge](https://app.codacy.com/project/badge/Grade/a940189170c8456c85a75ea36edb32c7)](https://app.codacy.com/gh/ublue-os/aurora/dashboard?utm_source=gh&utm_medium=referral&utm_content=&utm_campaign=Badge_grade) [![Stable Images](https://github.com/ublue-os/aurora/actions/workflows/build-image-stable.yml/badge.svg)](https://github.com/ublue-os/aurora/actions/workflows/build-image-stable.yml) [![Latest Images](https://github.com/ublue-os/aurora/actions/workflows/build-image-latest-main.yml/badge.svg)](https://github.com/ublue-os/aurora/actions/workflows/build-image-latest-main.yml) [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/ublue-os/aurora-docs) -[![LFX Active Contributors](https://insights.linuxfoundation.org/api/badge/active-contributors?project=aurora&repos=https://github.com/ublue-os/aurora)](https://insights.linuxfoundation.org/project/aurora) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ublue-os/aurora/badge)](https://scorecard.dev/viewer/?uri=github.com/ublue-os/aurora) +[![LFX Active Contributors](https://insights.linuxfoundation.org/api/badge/active-contributors?project=aurora&repos=https://github.com/ublue-os/aurora)](https://insights.linuxfoundation.org/project/aurora) [![LFX Health Score](https://insights.linuxfoundation.org/api/badge/health-score?project=aurora)](https://insights.linuxfoundation.org/project/aurora) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ublue-os/aurora/badge)](https://scorecard.dev/viewer/?uri=github.com/ublue-os/aurora) [](https://github.com/ublue-os/aurora) diff --git a/build_files/base/01-packages.sh b/build_files/base/01-packages.sh index 45f61659..bdd6100c 100755 --- a/build_files/base/01-packages.sh +++ b/build_files/base/01-packages.sh @@ -108,7 +108,6 @@ FEDORA_PACKAGES=( libfdk-aac libimobiledevice-utils libratbag-ratbagd - libsss_autofs libxcrypt-compat lm_sensors lshw @@ -129,9 +128,6 @@ FEDORA_PACKAGES=( setools-console solaar-udev squashfs-tools - sssd-ad - sssd-ipa - sssd-krb5 symlinks tcpdump tesseract-devel diff --git a/image-versions.yml b/image-versions.yml index 6ce04f46..180edcae 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,11 +2,11 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 43 - digest: sha256:3c66a9e879a815bc279d4f600784cffa08fb36b1d297631521353a7c2d5d82b2 + digest: sha256:77d0a924af29410565e83e6686ea9c4ef261cc5c5ff6a432eb97131e8719ef89 - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:6a75a9e785d6a706796ebde095441b3e60b8680716c5a07d3c433bbcec57d7a6 + digest: sha256:281f5ad18e4ed3d3af93d9c39139576653eaa5a3e2bc1e487933b1156a7e29d7 - name: brew image: ghcr.io/ublue-os/brew tag: latest From 096b890dee2606eab5235ea9944f35d0f8b2544c Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Mon, 23 Mar 2026 16:46:29 +0100 Subject: [PATCH 18/82] feat(ci): enable zstd:chunked compression (#1951) * feat(ci): enable zstd:chunked compression https://github.com/projectbluefin/common/issues/239 * fix: only use zstd compression for artifacts The old podman version we use on the 24.04 runners seems to be really slow with pushing zstd:chunked compressed images (to tarballs), we are only using the newer podman version from brew when we actually push images to the registry. For testing PRs this is good enough. This makes the Exporting to OCI Archive step take 1m30s again and 4m for DX, with :chunked it took 4m and 7m respectively. --- .github/workflows/reusable-build.yml | 4 ++-- Justfile | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 7131ef3f..087fac4c 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -280,11 +280,11 @@ jobs: # TODO: remove me when https://github.com/containers/podman/issues/27796 fixed for tag in ${ALIAS_TAGS}; do - sudo -E /home/linuxbrew/.linuxbrew/bin/podman push ${IMAGE_NAME}:${tag} ${LOWERCASE}/${IMAGE_NAME}:${tag} + sudo -E /home/linuxbrew/.linuxbrew/bin/podman push --compression-format=zstd:chunked --compression-level=3 ${IMAGE_NAME}:${tag} ${LOWERCASE}/${IMAGE_NAME}:${tag} done for tag in ${ALIAS_TAGS}; do - sudo -E /home/linuxbrew/.linuxbrew/bin/podman push ${IMAGE_NAME}:${tag} ${LOWERCASE}/${IMAGE_NAME}:${tag} + sudo -E /home/linuxbrew/.linuxbrew/bin/podman push --compression-format=zstd:chunked --compression-level=3 ${IMAGE_NAME}:${tag} ${LOWERCASE}/${IMAGE_NAME}:${tag} done digest=$(skopeo inspect docker://${LOWERCASE}/${IMAGE_NAME}:${DEFAULT_TAG} --format '{{.Digest}}') diff --git a/Justfile b/Justfile index dea4b689..8232f0fa 100644 --- a/Justfile +++ b/Justfile @@ -354,7 +354,7 @@ export-oci $image="aurora" $tag="latest" $flavor="main": # Image Name image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }}) - ${PODMAN} push localhost/"${image_name}":"${tag}" oci-archive:"${image_name}".oci + ${PODMAN} push --compression-format=zstd --compression-level=3 localhost/"${image_name}":"${tag}" oci-archive:"${image_name}".oci # Run Container [group('Image')] From 97f7c588f45358596d8e9b8452b8796f2f31ec77 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sat, 21 Mar 2026 04:52:28 +0000 Subject: [PATCH 19/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:43 docker digest to 2fa389e (#1943) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 180edcae..fb4b60b5 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 43 - digest: sha256:77d0a924af29410565e83e6686ea9c4ef261cc5c5ff6a432eb97131e8719ef89 + digest: sha256:2fa389e034c3bed6567b15ebba5556e5a6b983e66b3fffc3162311bf06a747c5 - name: common image: ghcr.io/get-aurora-dev/common tag: latest From 3861cceb6e6a9506e49ebfa6232bbe6cc4c8c2f7 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 22 Mar 2026 02:13:26 +0000 Subject: [PATCH 20/82] chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to b405118 (#1944) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index fb4b60b5..65533b1e 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -10,4 +10,4 @@ images: - name: brew image: ghcr.io/ublue-os/brew tag: latest - digest: sha256:69f74bf6401b6f077a0548fce747c275ad1e02b53b56ca5879d7535d6d15247b + digest: sha256:b4051183784a5503863340a6f5765332d90912f375167cd3cc15aea19dd9f253 From 0a916029c7c904ca41ea0383871688475f9e305a Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 22 Mar 2026 04:53:26 +0000 Subject: [PATCH 21/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:43 docker digest to b7b1ab6 (#1945) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 65533b1e..529fcf6b 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 43 - digest: sha256:2fa389e034c3bed6567b15ebba5556e5a6b983e66b3fffc3162311bf06a747c5 + digest: sha256:b7b1ab6aa0031cd1a7079edae67aff6d70b05c363cedc4e1733ff6e954ffcf4a - name: common image: ghcr.io/get-aurora-dev/common tag: latest From 519cc8db83d82c28ca607e73a93a981c94fd5200 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 22 Mar 2026 18:07:16 +0100 Subject: [PATCH 22/82] chore(ci): add attestation (#1872) This proves how and where aurora was built --- .github/workflows/build-image-beta.yml | 1 + .github/workflows/build-image-latest-main.yml | 1 + .github/workflows/build-image-stable.yml | 1 + .github/workflows/reusable-build.yml | 9 +++++++++ 4 files changed, 12 insertions(+) diff --git a/.github/workflows/build-image-beta.yml b/.github/workflows/build-image-beta.yml index 2c8471df..2eed4634 100644 --- a/.github/workflows/build-image-beta.yml +++ b/.github/workflows/build-image-beta.yml @@ -22,6 +22,7 @@ permissions: contents: read packages: write id-token: write + attestations: write jobs: build-image-beta: diff --git a/.github/workflows/build-image-latest-main.yml b/.github/workflows/build-image-latest-main.yml index e3646eab..c27340ea 100644 --- a/.github/workflows/build-image-latest-main.yml +++ b/.github/workflows/build-image-latest-main.yml @@ -16,6 +16,7 @@ permissions: contents: read packages: write id-token: write + attestations: write jobs: build-image-latest: diff --git a/.github/workflows/build-image-stable.yml b/.github/workflows/build-image-stable.yml index 4e99c2fa..12d8f8dc 100644 --- a/.github/workflows/build-image-stable.yml +++ b/.github/workflows/build-image-stable.yml @@ -18,6 +18,7 @@ permissions: contents: read packages: write id-token: write + attestations: write jobs: build-image-stable: diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 087fac4c..710c505e 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -36,6 +36,7 @@ jobs: contents: read packages: write id-token: write + attestations: write continue-on-error: false strategy: fail-fast: false @@ -345,6 +346,14 @@ jobs: run: | cosign sign -y --key env://COSIGN_PRIVATE_KEY ${LOWERCASE}/${IMAGE_NAME}@${SBOM_DIGEST} + - name: Attestation + if: github.event_name != 'pull_request' + uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0 + with: + subject-name: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }} + subject-digest: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }} + push-to-registry: true + # https://github.com/actions/cache/issues/1533 - name: Hack around permission issue caching id: cache-perms From 771542e9c2c9b13f68eb8ec0b0bd597647e0be87 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 22 Mar 2026 19:20:51 +0100 Subject: [PATCH 23/82] fix(ci): add missing permission for attestations (#1947) ``` Warning: Failed to create storage record: Error: Failed to persist storage record: no artifacts found - https://docs.github.com/rest/orgs/artifact-metadata#create-artifact-metadata-storage-record Warning: Please check that the "artifact-metadata:write" permission has been included ``` --- .github/workflows/build-image-beta.yml | 1 + .github/workflows/build-image-latest-main.yml | 1 + .github/workflows/build-image-stable.yml | 1 + .github/workflows/reusable-build.yml | 2 ++ 4 files changed, 5 insertions(+) diff --git a/.github/workflows/build-image-beta.yml b/.github/workflows/build-image-beta.yml index 2eed4634..ca4833b3 100644 --- a/.github/workflows/build-image-beta.yml +++ b/.github/workflows/build-image-beta.yml @@ -23,6 +23,7 @@ permissions: packages: write id-token: write attestations: write + artifact-metadata: write jobs: build-image-beta: diff --git a/.github/workflows/build-image-latest-main.yml b/.github/workflows/build-image-latest-main.yml index c27340ea..25a7400c 100644 --- a/.github/workflows/build-image-latest-main.yml +++ b/.github/workflows/build-image-latest-main.yml @@ -17,6 +17,7 @@ permissions: packages: write id-token: write attestations: write + artifact-metadata: write jobs: build-image-latest: diff --git a/.github/workflows/build-image-stable.yml b/.github/workflows/build-image-stable.yml index 12d8f8dc..fa80086b 100644 --- a/.github/workflows/build-image-stable.yml +++ b/.github/workflows/build-image-stable.yml @@ -19,6 +19,7 @@ permissions: packages: write id-token: write attestations: write + artifact-metadata: write jobs: build-image-stable: diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 710c505e..d9f4c6e7 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -37,6 +37,8 @@ jobs: packages: write id-token: write attestations: write + artifact-metadata: write + continue-on-error: false strategy: fail-fast: false From 1f795ad2b6943c18eb2b4111fb7ea17539df5d31 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Mon, 23 Mar 2026 04:53:27 +0000 Subject: [PATCH 24/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:43 docker digest to 293353e (#1949) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 529fcf6b..8cb757ad 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 43 - digest: sha256:b7b1ab6aa0031cd1a7079edae67aff6d70b05c363cedc4e1733ff6e954ffcf4a + digest: sha256:293353e419ae7b91809e3060b9938fc4027192ce1408f91c04d830267588208c - name: common image: ghcr.io/get-aurora-dev/common tag: latest From d7fd6e4c56e4beece68ad17aef86a568e8b527ca Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Mon, 23 Mar 2026 18:26:57 +0100 Subject: [PATCH 25/82] fix(ci): be smarter about DNF package caching (#1952) Currently we are very inefficient with our cache usage as every image has it's own cache where most of the packages are the same across variants anyway. See 973333f. This should fix a couple problems around this as we are now also considering the Fedora version in the cache key and only allowing one blessed image to create cache. Which is why I decided to implement this into the Justfile even tho this is only needed when running from github as it just makes things easier to troubleshoot. aurora-dx makes the most sense here as that is the heaviest image. We don't need a separate nvidia image cache as the biggest RPMs exclusive to that variant are cached in akmods anyway and don't have to be downloaded. Only allowing cache to be created at all on workflow_dispatch and on schedule happens to go hand in hand with the limitation/design of the cache action as we only build images from the main branch in those two cases, rest is merge queue, which also happens to address the "infighting" across stable and latest builds when they kick off at the same time. This should make it easier going forward especially when we take future possible ARM, testing images or any other reason for our matrix to get bigger into consideration. --- .github/workflows/reusable-build.yml | 49 +++++++++++++++++++++------- Justfile | 21 ++++++++++++ 2 files changed, 58 insertions(+), 12 deletions(-) diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index d9f4c6e7..5f5f0b03 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -90,15 +90,30 @@ jobs: echo "Default Tag: ${DEFAULT_TAG}" echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV - - name: Setup DNF package cache - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 + - name: DNF Package Cache Setup + shell: bash + id: setup-cache env: - IMAGE_NAME: ${{ env.IMAGE_NAME }} + MATRIX_BASE_NAME: ${{ matrix.base_name }} + GITHUB_EVENT_NAME: ${{ github.event_name }} + run: | + CACHE="$(just setup-cache "${MATRIX_BASE_NAME}" \ + "1" \ + "${GITHUB_EVENT_NAME}")" + + CACHE_NAME="$(echo "${CACHE}" | cut -d' ' -f 1)" + ALLOW_CACHE_WRITE="$(echo "${CACHE}" | cut -d' ' -f 2)" + + echo "cache_name=${CACHE_NAME}" >> "$GITHUB_OUTPUT" + echo "allow_cache_write=${ALLOW_CACHE_WRITE}" >> "$GITHUB_OUTPUT" + + - name: Restore DNF package cache + uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + env: + CACHE_NAME: ${{ steps.setup-cache.outputs.cache_name }} with: path: /var/tmp/buildah-cache-* - key: ${{ runner.os }}-buildah-${{ env.IMAGE_NAME }} - restore-keys: | - ${{ runner.os }}-buildah-${{ env.IMAGE_NAME }} + key: ${{ runner.os }}-${{ runner.arch }}-buildah-${{ env.CACHE_NAME }} - name: Build Image id: build-image @@ -116,6 +131,22 @@ jobs: "${MATRIX_IMAGE_FLAVOR}" \ "${INPUTS_KERNEL_PIN}" + # https://github.com/actions/cache/issues/1533 + - name: Hack around permission issue caching + shell: bash + id: cache-perms + run: | + sudo chmod 777 --recursive /var/tmp/buildah-cache-0 + + - name: Write new DNF package cache + if: steps.setup-cache.outputs.allow_cache_write == 'true' + uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + env: + CACHE_NAME: ${{ steps.setup-cache.outputs.cache_name }} + with: + path: /var/tmp/buildah-cache-* + key: ${{ runner.os }}-${{ runner.arch }}-buildah-${{ env.CACHE_NAME }} + - name: Setup Syft id: setup-syft if: github.event_name != 'pull_request' @@ -356,12 +387,6 @@ jobs: subject-digest: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }} push-to-registry: true - # https://github.com/actions/cache/issues/1533 - - name: Hack around permission issue caching - id: cache-perms - run: | - sudo chmod 777 --recursive /var/tmp/buildah-cache-0 - check: name: Check all ${{ matrix.stream_name }} builds successful if: always() diff --git a/Justfile b/Justfile index 8232f0fa..192bcc81 100644 --- a/Justfile +++ b/Justfile @@ -610,6 +610,27 @@ tag-images image_name="" default_tag="" tags="": # Show Images ${PODMAN} images +# DNF CI package cache +[group('Utility')] +setup-cache $image="aurora" $ghcr="0" $github_event="0": + #!/usr/bin/bash + set -eou pipefail + + image_name=$({{ just }} image_name '{{ image }}') + fedora_version=$({{ just }} fedora_version '{{ image }}') + + ALLOW_CACHE_WRITE="false" + + if [[ "${image_name}" == "aurora-dx" ]] && \ + [[ "{{ ghcr }}" == "1" ]] && \ + [[ "${github_event}" == "workflow_dispatch" || "${github_event}" == "schedule" ]]; then + ALLOW_CACHE_WRITE="true" + fi + + CACHE_NAME="${image_name}"-"${fedora_version}" + + echo "${CACHE_NAME}" "${ALLOW_CACHE_WRITE}" + # # Examples: # > just retag-nvidia-on-ghcr stable-daily stable-daily-41.20250126.3 0 # > just retag-nvidia-on-ghcr latest latest-41.20250228.1 0 From 4a9f2d2ca16ddb0251ec2c38251c533f2e138d0d Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 24 Mar 2026 03:14:02 +0100 Subject: [PATCH 26/82] chore(deps): update actions/cache action to v5.0.4 (#1953) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/reusable-build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 5f5f0b03..0ac13a1c 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -108,7 +108,7 @@ jobs: echo "allow_cache_write=${ALLOW_CACHE_WRITE}" >> "$GITHUB_OUTPUT" - name: Restore DNF package cache - uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 env: CACHE_NAME: ${{ steps.setup-cache.outputs.cache_name }} with: @@ -140,7 +140,7 @@ jobs: - name: Write new DNF package cache if: steps.setup-cache.outputs.allow_cache_write == 'true' - uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 env: CACHE_NAME: ${{ steps.setup-cache.outputs.cache_name }} with: From b4142db825fc9130f9e5b5abf9de18832057e128 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 24 Mar 2026 04:50:41 +0000 Subject: [PATCH 27/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:43 docker digest to fafc784 (#1954) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 8cb757ad..f2c904ad 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 43 - digest: sha256:293353e419ae7b91809e3060b9938fc4027192ce1408f91c04d830267588208c + digest: sha256:fafc7848e8cbef942f5aaad2def48f03163fa1a242c6dbe447969d016a5bcc8f - name: common image: ghcr.io/get-aurora-dev/common tag: latest From e247c850e84a0af716dfb110d4cfac2bfe5ed9c4 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Tue, 24 Mar 2026 18:15:25 +0100 Subject: [PATCH 28/82] fix: typo in bash-preexec (#1955) --- build_files/base/03-fetch.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build_files/base/03-fetch.sh b/build_files/base/03-fetch.sh index 12d56ae1..7455152d 100755 --- a/build_files/base/03-fetch.sh +++ b/build_files/base/03-fetch.sh @@ -29,8 +29,8 @@ mkdir -p /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/ mv /tmp/SymbolsNerdFont*.ttf /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/ # Bash Prexec v0.6.0 -ghcurl https://raw.githubusercontent.com/rcaloras/bash-preexec/b73ed5f7f953207b958f15b1773721dded697ac3/bash-preexec.sh --retry 3 -Lo /usr/share/bash-prexec -setfattr -n user.component -v "aurora-config" /usr/share/bash-prexec +ghcurl https://raw.githubusercontent.com/rcaloras/bash-preexec/b73ed5f7f953207b958f15b1773721dded697ac3/bash-preexec.sh --retry 3 -Lo /usr/share/bash-preexec +setfattr -n user.component -v "aurora-config" /usr/share/bash-preexec # use CoreOS' generator for emergency/rescue boot # see detail: https://github.com/ublue-os/main/issues/653 From a3cb401ffd52fb6a9c4ea92bfab53c07c0a9b273 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Tue, 24 Mar 2026 18:54:26 +0100 Subject: [PATCH 29/82] fix(ci): actually hardcode the cache restore key to aurora-dx (#1956) We are writing cache to the proper location but not adjusting the restore keys properly, i.e. aurora wants to look for cache at aurora even tho we are purposefully only allowing aurora-dx cache to be created. --- Justfile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Justfile b/Justfile index 192bcc81..5fbb41e9 100644 --- a/Justfile +++ b/Justfile @@ -621,13 +621,15 @@ setup-cache $image="aurora" $ghcr="0" $github_event="0": ALLOW_CACHE_WRITE="false" - if [[ "${image_name}" == "aurora-dx" ]] && \ + BLESSED_IMAGE=aurora-dx + + if [[ "${image_name}" == "${BLESSED_IMAGE}" ]] && \ [[ "{{ ghcr }}" == "1" ]] && \ [[ "${github_event}" == "workflow_dispatch" || "${github_event}" == "schedule" ]]; then ALLOW_CACHE_WRITE="true" fi - CACHE_NAME="${image_name}"-"${fedora_version}" + CACHE_NAME="${BLESSED_IMAGE}-${fedora_version}" echo "${CACHE_NAME}" "${ALLOW_CACHE_WRITE}" From c0babf3eccb31c774910b6acbc2e8152835aa316 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 24 Mar 2026 19:28:03 +0000 Subject: [PATCH 30/82] chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to d53b00c (#1957) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index f2c904ad..f9d56a64 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -6,7 +6,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:281f5ad18e4ed3d3af93d9c39139576653eaa5a3e2bc1e487933b1156a7e29d7 + digest: sha256:d53b00c13f22c22107bf86bb254b95d798e45de345182af4a9e15041848f59eb - name: brew image: ghcr.io/ublue-os/brew tag: latest From f8056fafec6db0f4d6752bd5a9671ff6429281de Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 25 Mar 2026 04:52:19 +0000 Subject: [PATCH 31/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:43 docker digest to 836f4a7 (#1959) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index f9d56a64..9d369e06 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 43 - digest: sha256:fafc7848e8cbef942f5aaad2def48f03163fa1a242c6dbe447969d016a5bcc8f + digest: sha256:836f4a7a98ae37eab8545562612b7e472d0a98d541ceefa210eaf79a82cde032 - name: common image: ghcr.io/get-aurora-dev/common tag: latest From aab5038c5de103d92c31d4da5351183880d5b5b5 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Wed, 25 Mar 2026 19:05:08 +0100 Subject: [PATCH 32/82] fix(ci): make cache use proper fedora version (#1961) This always defaulted to latest, which resolves to F43 currently, meaning F44 beta images will never make their own cache otherwise. --- .github/workflows/reusable-build.yml | 2 ++ Justfile | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 0ac13a1c..9cdf6107 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -95,9 +95,11 @@ jobs: id: setup-cache env: MATRIX_BASE_NAME: ${{ matrix.base_name }} + MATRIX_STREAM_NAME: ${{ matrix.stream_name }} GITHUB_EVENT_NAME: ${{ github.event_name }} run: | CACHE="$(just setup-cache "${MATRIX_BASE_NAME}" \ + "${MATRIX_STREAM_NAME}" \ "1" \ "${GITHUB_EVENT_NAME}")" diff --git a/Justfile b/Justfile index 5fbb41e9..7b5e8fb7 100644 --- a/Justfile +++ b/Justfile @@ -612,12 +612,12 @@ tag-images image_name="" default_tag="" tags="": # DNF CI package cache [group('Utility')] -setup-cache $image="aurora" $ghcr="0" $github_event="0": +setup-cache $image="aurora" $tag="latest" $ghcr="0" $github_event="0": #!/usr/bin/bash set -eou pipefail image_name=$({{ just }} image_name '{{ image }}') - fedora_version=$({{ just }} fedora_version '{{ image }}') + fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}') ALLOW_CACHE_WRITE="false" From e3145690404ad39a53916d8a66c09d3fa0ff32dc Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Thu, 26 Mar 2026 07:51:29 +0200 Subject: [PATCH 33/82] chore: remove mesa-va-drivers from f44 (#1965) --- build_files/base/01-packages.sh | 1 - build_files/base/20-tests.sh | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/build_files/base/01-packages.sh b/build_files/base/01-packages.sh index bdd6100c..6811e4e4 100755 --- a/build_files/base/01-packages.sh +++ b/build_files/base/01-packages.sh @@ -33,7 +33,6 @@ OVERRIDES=( "mesa-libEGL" "mesa-libGL" "mesa-libgbm" - "mesa-va-drivers" "mesa-vulkan-drivers" ) diff --git a/build_files/base/20-tests.sh b/build_files/base/20-tests.sh index 13929143..9e436238 100755 --- a/build_files/base/20-tests.sh +++ b/build_files/base/20-tests.sh @@ -110,7 +110,7 @@ NEGATIVO=( libheif libva mesa-filesystem - mesa-va-drivers + mesa-dri-drivers pipewire-libs-extra x264-libs x265-libs From 2d1b0392373a0f9151e6eb7a110da83c751da5d9 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sat, 28 Mar 2026 20:59:02 +0100 Subject: [PATCH 34/82] chore(beta): adjust fedora version logic for beta in rechunker (#1972) * chore(ci): remove akmods check for fedora version (#1966) This is unnecessary and doesn't work all that well, caching is not super well implemented anyway. Setting the fedora version per image tag statically works just fine and if we were to set some version that is not yet available then it will simply fail a couple seconds later on the cosign verification or akmods image pull. * chore(beta): adjust fedora version logic for beta in rechunker --- Justfile | 41 ++++++++++------------------------------- 1 file changed, 10 insertions(+), 31 deletions(-) diff --git a/Justfile b/Justfile index 7b5e8fb7..9875b049 100644 --- a/Justfile +++ b/Justfile @@ -285,7 +285,7 @@ rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0": # Image Name image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }}) - fedora_version=$(jq -r '.Labels["org.opencontainers.image.version"]' < /tmp/manifest.json | grep -oP '^[0-9]+') + fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}') DEFAULT_TAG=$({{ just }} generate-default-tag {{ tag }} {{ ghcr }}) if [[ "{{ ghcr }}" == "0" ]]; then @@ -469,38 +469,17 @@ fedora_version image="aurora" tag="latest" flavor="main" $kernel_pin="": #!/usr/bin/bash set -eou pipefail {{ just }} validate {{ image }} {{ tag }} {{ flavor }} - if [[ ! -f /tmp/manifest.json ]]; then - # Determine Version - if [[ "{{ tag }}" =~ stable ]]; then - VERSION="{{ stable_version }}" - elif [[ "{{ tag }}" =~ beta ]]; then - VERSION="{{ beta_version }}" - else - VERSION="{{ latest_version }}" - fi - # Determine Akmods Flavor - if [[ "{{ tag }}" =~ stable ]]; then - AKMODS_FLAVOR="coreos-stable" - else - AKMODS_FLAVOR="main" - fi - - # Verify akmods existence - echo "Checking for akmods: ghcr.io/ublue-os/akmods:${AKMODS_FLAVOR}-${VERSION}" >&2 - if ! skopeo inspect --retry-times 3 "docker://ghcr.io/ublue-os/akmods:${AKMODS_FLAVOR}-${VERSION}" > /dev/null; then - echo "Error: Akmods not found for flavor ${AKMODS_FLAVOR} and version ${VERSION}" >&2 - exit 1 - fi - - # Write cache - echo "{\"Labels\": {\"org.opencontainers.image.version\": \"${VERSION}\"}}" > /tmp/manifest.json + # Determine Version + if [[ "{{ tag }}" =~ stable ]]; then + VERSION="{{ stable_version }}" + elif [[ "{{ tag }}" =~ beta ]]; then + VERSION="{{ beta_version }}" + else + VERSION="{{ latest_version }}" fi - fedora_version=$(jq -r '.Labels["org.opencontainers.image.version"]' < /tmp/manifest.json | grep -oP '^[0-9]+') - if [[ -n "${kernel_pin:-}" ]]; then - fedora_version=$(echo "${kernel_pin}" | grep -oP 'fc\K[0-9]+') - fi - echo "${fedora_version}" + + echo "${VERSION}" # Image Name [group('Utility')] From 838b9fc4c377faec9c0b8dfa1787f9d093018a0c Mon Sep 17 00:00:00 2001 From: Adam Fidel Date: Wed, 1 Apr 2026 08:51:52 -0500 Subject: [PATCH 35/82] fix(beta): uncomment docker enablement (#1979) * fix(beta): uncomment docker enablement * Try without docker-buildx-plugin * enable docker packages --------- Co-authored-by: inffy <10782843+inffy@users.noreply.github.com> --- build_files/dx/00-dx.sh | 25 ++++++++++++------------- build_files/dx/10-tests-dx.sh | 2 +- 2 files changed, 13 insertions(+), 14 deletions(-) diff --git a/build_files/dx/00-dx.sh b/build_files/dx/00-dx.sh index 006eff9f..612c3114 100755 --- a/build_files/dx/00-dx.sh +++ b/build_files/dx/00-dx.sh @@ -74,16 +74,15 @@ if [[ ! "${IMAGE_NAME}" =~ nvidia ]]; then fi # Docker packages from their repo -# TODO: enable ones these are available for Fedora 44 -#dnf config-manager addrepo --from-repofile=https://download.docker.com/linux/fedora/docker-ce.repo -#sed -i "s/enabled=.*/enabled=0/g" /etc/yum.repos.d/docker-ce.repo -#dnf -y install --enablerepo=docker-ce-stable \ -# containerd.io \ -# docker-buildx-plugin \ -# docker-ce \ -# docker-ce-cli \ -# docker-compose-plugin \ -# docker-model-plugin +dnf config-manager addrepo --from-repofile=https://download.docker.com/linux/fedora/docker-ce.repo +sed -i "s/enabled=.*/enabled=0/g" /etc/yum.repos.d/docker-ce.repo +dnf -y install --enablerepo=docker-ce-stable \ + containerd.io \ + docker-buildx-plugin \ + docker-ce \ + docker-ce-cli \ + docker-compose-plugin \ + docker-model-plugin # VSCode package from Microsoft repo echo "Installing VSCode from official repo..." @@ -127,9 +126,9 @@ if [[ "${#EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then fi # Enable DX services -#if rpm -q docker-ce >/dev/null; then -# systemctl enable docker.socket -#fi +if rpm -q docker-ce >/dev/null; then + systemctl enable docker.socket +fi systemctl enable podman.socket systemctl enable swtpm-workaround.service systemctl enable ublue-os-libvirt-workarounds.service diff --git a/build_files/dx/10-tests-dx.sh b/build_files/dx/10-tests-dx.sh index 2b792063..ee1ca784 100755 --- a/build_files/dx/10-tests-dx.sh +++ b/build_files/dx/10-tests-dx.sh @@ -17,7 +17,7 @@ for package in "${IMPORTANT_PACKAGES_DX[@]}"; do done IMPORTANT_UNITS=( - #docker.socket + docker.socket podman.socket ) From 166aad8d00e312cb0c8efad759f32d2aae446719 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Fri, 3 Apr 2026 06:20:03 +0200 Subject: [PATCH 36/82] feat: put nerdfonts into it's own layer (#1990) These are roughly 5MiB and rarely change, this makes sense to put into it's own layer so refetching this on every update is avoided. --- build_files/base/03-fetch.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/build_files/base/03-fetch.sh b/build_files/base/03-fetch.sh index 7455152d..cc27fb62 100755 --- a/build_files/base/03-fetch.sh +++ b/build_files/base/03-fetch.sh @@ -27,6 +27,7 @@ ghcurl "https://github.com/ryanoasis/nerd-fonts/releases/latest/download/NerdFon unzip /tmp/nerdfontsymbols.zip -d /tmp mkdir -p /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/ mv /tmp/SymbolsNerdFont*.ttf /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly/ +setfattr -n user.component -v "nerdfonts" /usr/share/fonts/nerd-fonts/NerdFontsSymbolsOnly # Bash Prexec v0.6.0 ghcurl https://raw.githubusercontent.com/rcaloras/bash-preexec/b73ed5f7f953207b958f15b1773721dded697ac3/bash-preexec.sh --retry 3 -Lo /usr/share/bash-preexec From 447b35d1874d708604575b377272b28703551e81 Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Fri, 3 Apr 2026 13:50:54 +0300 Subject: [PATCH 37/82] chore: update image versions and add new nvdia sync from main (#1993) * update image versions and add new nvdia sync * permission fix --- Containerfile.in | 10 +++++----- build_files/base/{nvidia.sh => 04-nvidia.sh} | 3 +++ image-versions.yml | 6 +++--- 3 files changed, 11 insertions(+), 8 deletions(-) rename build_files/base/{nvidia.sh => 04-nvidia.sh} (86%) diff --git a/Containerfile.in b/Containerfile.in index 5b39cc5b..9ee2b001 100644 --- a/Containerfile.in +++ b/Containerfile.in @@ -104,8 +104,8 @@ RUN --mount=type=tmpfs,dst=/boot \ /ctx/build_files/shared/build.sh && \ /ctx/build_files/base/01-packages.sh && \ /ctx/build_files/base/02-install-common-kernel-akmods.sh && \ - /ctx/build_files/base/nvidia.sh && \ - /ctx/build_files/base/03-fetch.sh + /ctx/build_files/base/03-fetch.sh && \ + /ctx/build_files/base/04-nvidia.sh #endif # /* aurora-nvidia-open:stable with ZFS */ @@ -123,9 +123,9 @@ RUN --mount=type=tmpfs,dst=/boot \ /ctx/build_files/shared/build.sh && \ /ctx/build_files/base/01-packages.sh && \ /ctx/build_files/base/02-install-common-kernel-akmods.sh && \ - /ctx/build_files/base/nvidia.sh && \ - /ctx/build_files/base/zfs.sh && \ - /ctx/build_files/base/03-fetch.sh + /ctx/build_files/base/03-fetch.sh && \ + /ctx/build_files/base/04-nvidia.sh && \ + /ctx/build_files/base/zfs.sh #endif # /* Everything that can be done offline after things are in place should be done here */ diff --git a/build_files/base/nvidia.sh b/build_files/base/04-nvidia.sh similarity index 86% rename from build_files/base/nvidia.sh rename to build_files/base/04-nvidia.sh index d1f958e5..28dae8ed 100755 --- a/build_files/base/nvidia.sh +++ b/build_files/base/04-nvidia.sh @@ -14,4 +14,7 @@ tee /usr/lib/bootc/kargs.d/00-nvidia.toml < Date: Fri, 3 Apr 2026 15:34:39 -0400 Subject: [PATCH 38/82] chore: bump Fedora to 44 (#1994) * chore: bump Fedora to 44 * chore: simplify Containerfile.in ARG defaults --- Containerfile.in | 18 +++++++++--------- Justfile | 2 +- image-versions.yml | 4 ++-- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/Containerfile.in b/Containerfile.in index 9ee2b001..d5cbfcfd 100644 --- a/Containerfile.in +++ b/Containerfile.in @@ -1,13 +1,13 @@ -ARG BASE_IMAGE_ORG="${BASE_IMAGE_ORG}:-quay.io/fedora-ostree-desktops" -ARG BASE_IMAGE_NAME="${BASE_IMAGE_NAME}:-kinoite" +ARG BASE_IMAGE_ORG +ARG BASE_IMAGE_NAME ARG BASE_IMAGE="${BASE_IMAGE_ORG}/${BASE_IMAGE_NAME}" -ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION}:-43" -ARG AKMODS_FLAVOR="${AKMODS_FLAVOR}-${FEDORA_MAJOR_VERSION}:-coreos-stable-43" -ARG KERNEL="${KERNEL}:-6.17.12-300.fc43.x86_64" -ARG COMMON_IMAGE="${COMMON_IMAGE}:-ghcr.io/get-aurora-dev/common:latest" -ARG COMMON_IMAGE_SHA="" -ARG BREW_IMAGE="${BREW_IMAGE}:-ghcr.io/ublue-os/brew:latest" -ARG BREW_IMAGE_SHA="" +ARG FEDORA_MAJOR_VERSION +ARG AKMODS_FLAVOR +ARG KERNEL +ARG COMMON_IMAGE +ARG COMMON_IMAGE_SHA +ARG BREW_IMAGE +ARG BREW_IMAGE_SHA FROM ${COMMON_IMAGE}@${COMMON_IMAGE_SHA} AS common FROM ${BREW_IMAGE}@${BREW_IMAGE_SHA} AS brew diff --git a/Justfile b/Justfile index 9875b049..c7001e14 100644 --- a/Justfile +++ b/Justfile @@ -5,7 +5,7 @@ export common_image := env("COMMON_IMAGE", "ghcr.io/get-aurora-dev/common:latest export brew_image := env("BREW_IMAGE", "ghcr.io/ublue-os/brew:latest") rechunker_image := "ghcr.io/ublue-os/legacy-rechunk:v1.0.1-x86_64@sha256:2627cbf92ca60ab7372070dcf93b40f457926f301509ffba47a04d6a9e1ddaf7" stable_version := "43" -latest_version := "43" +latest_version := "44" beta_version := "44" images := '( [aurora]=aurora diff --git a/image-versions.yml b/image-versions.yml index e1e566c8..df9936de 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -1,8 +1,8 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite - tag: 43 - digest: sha256:a8240c31a848ff9da672e8223100787709d947e6dc9ee6433e76f426efb1652d + tag: 44 + digest: sha256:27e4c5c806e2f9259be549c87608ebbf18fa878ebd18da911fdd22de3d6a01e5 - name: common image: ghcr.io/get-aurora-dev/common tag: latest From cb8bbcc020fd66e03dae247203fcd4eb2bec152f Mon Sep 17 00:00:00 2001 From: renner Date: Fri, 3 Apr 2026 21:39:03 +0200 Subject: [PATCH 39/82] chore: remove things related to legacy-rechunk --- .github/renovate.json5 | 2 +- Justfile | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 260c3516..537a2d62 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -31,7 +31,7 @@ }, { "matchUpdateTypes": ["pin", "digest", "pinDigest"], - "matchPackageNames": ["ghcr.io/jasonn3/build-container-installer", "ghcr.io/hhd-dev/rechunk"], + "matchPackageNames": ["ghcr.io/jasonn3/build-container-installer"], "automerge": false }, { diff --git a/Justfile b/Justfile index c7001e14..429ea054 100644 --- a/Justfile +++ b/Justfile @@ -3,7 +3,6 @@ export base_image_org := env("BASE_IMAGE_ORG", "quay.io/fedora-ostree-desktops") export base_image_name := env("BASE_IMAGE_NAME", "kinoite") export common_image := env("COMMON_IMAGE", "ghcr.io/get-aurora-dev/common:latest") export brew_image := env("BREW_IMAGE", "ghcr.io/ublue-os/brew:latest") -rechunker_image := "ghcr.io/ublue-os/legacy-rechunk:v1.0.1-x86_64@sha256:2627cbf92ca60ab7372070dcf93b40f457926f301509ffba47a04d6a9e1ddaf7" stable_version := "43" latest_version := "44" beta_version := "44" @@ -59,7 +58,6 @@ clean: set -eoux pipefail touch _build find *_build* -exec rm -rf {} \; - rm -f previous.manifest.json rm -f changelog.md rm -f output.env From a9607a2e4f93a092fe94a1c4a8d8e1487e1e7518 Mon Sep 17 00:00:00 2001 From: renner Date: Tue, 31 Mar 2026 07:55:07 +0200 Subject: [PATCH 40/82] feat(ci): on rechunk consume previous build Currently we compose a fresh rechunked image every build. This is not ideal for image layer difference reduction and thereforce update sizes as we do not take the rechunking plan/package layout from the previous build (that users will likely have downloaded) into account. When we have a new release of rpm-ostree we can replace most of the pulling logic here with the new `--previous-build` flag. --- Justfile | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/Justfile b/Justfile index 429ea054..2af3a443 100644 --- a/Justfile +++ b/Justfile @@ -290,9 +290,12 @@ rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0": {{ just }} load-rootful "${image}" "${tag}" "${flavor}" fi - # In CI this will replace the unrechunked image if [[ "{{ ghcr }}" == "1" ]]; then - CHUNKED_IMAGE="localhost/"${image_name}":"${DEFAULT_TAG}"" + # TODO: Replace this with --previous-build in rpm-ostree 2026.1+ + # so we don't have to pull an old image anymore + PREVIOUS_BUILD=ghcr.io/{{ repo_organization }}/"${image_name}":"${DEFAULT_TAG}" + ${SUDOIF} ${PODMAN} pull ${PREVIOUS_BUILD} + CHUNKED_IMAGE="${PREVIOUS_BUILD}" else CHUNKED_IMAGE="localhost/"${image_name}":"${DEFAULT_TAG}"-chunked" fi @@ -315,6 +318,12 @@ rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0": --from "localhost/"${image_name}":"${tag}"" \ --output containers-storage:${CHUNKED_IMAGE} + # Rename image from ghcr... to localhost... and discard PREVIOUS_BUILD + if [[ "{{ ghcr }}" == "1" ]]; then + ${SUDOIF} ${PODMAN} tag ${CHUNKED_IMAGE} "localhost/"${image_name}":"${tag}"" + ${SUDOIF} ${PODMAN} image rm -f ${CHUNKED_IMAGE} + fi + # Pipeline Checks if [[ {{ pipeline }} == "1" && -n "${SUDO_USER:-}" ]]; then sudo -u "${SUDO_USER}" {{ just }} secureboot "${image}" "${tag}" "${flavor}" From bde32f5f3848a125571ec8d2dba18387106a255c Mon Sep 17 00:00:00 2001 From: renner Date: Tue, 31 Mar 2026 10:15:04 +0200 Subject: [PATCH 41/82] feat: add capability to manually trigger a fresh rechunking plan Over time the layer plan due to reuse of the previous build's rechunking plan might become undesirable/inefficient or due to bugs in rpm-ostree itself that would trigger issues in the rechunker during the build might force us to reset the layer plan where we do not consume our previous build. --- .github/workflows/build-image-beta.yml | 10 ++++++++ .github/workflows/build-image-latest-main.yml | 9 ++++++++ .github/workflows/build-image-stable.yml | 9 ++++++++ .github/workflows/reusable-build.yml | 8 ++++++- Justfile | 23 ++++++++++++------- 5 files changed, 50 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-image-beta.yml b/.github/workflows/build-image-beta.yml index ca4833b3..daedef60 100644 --- a/.github/workflows/build-image-beta.yml +++ b/.github/workflows/build-image-beta.yml @@ -17,6 +17,14 @@ on: - ".github/workflows/scorecard.yml" workflow_call: workflow_dispatch: + inputs: + previous_build: + description: 'Set to 0 to manually clear rechunking plan' + type: choice + default: '1' + options: + - '0' + - '1' permissions: contents: read @@ -38,3 +46,5 @@ jobs: image_flavors: '["main", "nvidia-open"]' brand_name: ${{ matrix.brand_name }} stream_name: beta + previous_build: ${{ inputs.previous_build }} + diff --git a/.github/workflows/build-image-latest-main.yml b/.github/workflows/build-image-latest-main.yml index 25a7400c..77e4a547 100644 --- a/.github/workflows/build-image-latest-main.yml +++ b/.github/workflows/build-image-latest-main.yml @@ -11,6 +11,14 @@ on: - ".github/workflows/scorecard.yml" workflow_call: workflow_dispatch: + inputs: + previous_build: + description: 'Set to 0 to manually clear rechunking plan' + type: choice + default: '1' + options: + - '0' + - '1' permissions: contents: read @@ -33,6 +41,7 @@ jobs: brand_name: ${{ matrix.brand_name }} stream_name: latest #kernel_pin: 6.12.15-200.fc41.x86_64 + previous_build: ${{ inputs.previous_build }} generate-release: name: Generate Release diff --git a/.github/workflows/build-image-stable.yml b/.github/workflows/build-image-stable.yml index fa80086b..bff298cc 100644 --- a/.github/workflows/build-image-stable.yml +++ b/.github/workflows/build-image-stable.yml @@ -13,6 +13,14 @@ on: - cron: "0 1 * * TUE" # Every Tuesday at 1:15 AM workflow_call: workflow_dispatch: + inputs: + previous_build: + description: 'Set to 0 to manually clear rechunking plan' + type: choice + default: '1' + options: + - '0' + - '1' permissions: contents: read @@ -34,6 +42,7 @@ jobs: #kernel_pin: 6.14.11-300.fc42.x86_64 ## This is where kernels get pinned. brand_name: ${{ matrix.brand_name }} stream_name: stable + previous_build: ${{ inputs.previous_build }} generate-release: name: Generate Release diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 9cdf6107..8b4c4187 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -18,6 +18,9 @@ on: kernel_pin: description: "The full kernel version to pin" type: string + previous_build: + description: 'Set a reference to a previous build to make updates smaller' + type: string env: IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }} @@ -184,11 +187,14 @@ jobs: MATRIX_STREAM_NAME: ${{ matrix.stream_name }} MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }} DEFAULT_TAG: ${{ env.DEFAULT_TAG }} + PREVIOUS_BUILD: ${{ github.event.inputs.previous_build || '1' }} run: | sudo -E $(command -v just) rechunk "${MATRIX_BASE_NAME}" \ "${MATRIX_STREAM_NAME}" \ "${MATRIX_IMAGE_FLAVOR}" \ - "1" + "1" \ + "0" \ + "${PREVIOUS_BUILD}" - name: Secureboot Check id: secureboot diff --git a/Justfile b/Justfile index 2af3a443..a5b7e9f2 100644 --- a/Justfile +++ b/Justfile @@ -273,7 +273,7 @@ build-pipeline image="aurora" tag="latest" flavor="main" kernel_pin="": # Rechunk Image [group('Image')] [private] -rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0": +rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0" previous_build="0": #!/usr/bin/bash set -eoux pipefail @@ -290,13 +290,20 @@ rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0": {{ just }} load-rootful "${image}" "${tag}" "${flavor}" fi + # TODO: Redo everything here with --previous-build in rpm-ostree 2026.1+ + # so we don't have to pull an old image + rename it + if [[ "{{ previous_build }}" == "1" ]]; then + PREVIOUS_IMAGE=ghcr.io/{{ repo_organization }}/"${image_name}":"${DEFAULT_TAG}" + ${SUDOIF} ${PODMAN} pull ${PREVIOUS_IMAGE} + fi + if [[ "{{ ghcr }}" == "1" ]]; then - # TODO: Replace this with --previous-build in rpm-ostree 2026.1+ - # so we don't have to pull an old image anymore - PREVIOUS_BUILD=ghcr.io/{{ repo_organization }}/"${image_name}":"${DEFAULT_TAG}" - ${SUDOIF} ${PODMAN} pull ${PREVIOUS_BUILD} - CHUNKED_IMAGE="${PREVIOUS_BUILD}" + CHUNKED_IMAGE="localhost/"${image_name}":"${DEFAULT_TAG}"" + if [[ "{{ previous_build }}" == "1" ]]; then + CHUNKED_IMAGE="${PREVIOUS_IMAGE}" + fi else + # keep the original unrechunked image for local builds CHUNKED_IMAGE="localhost/"${image_name}":"${DEFAULT_TAG}"-chunked" fi @@ -318,8 +325,8 @@ rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0": --from "localhost/"${image_name}":"${tag}"" \ --output containers-storage:${CHUNKED_IMAGE} - # Rename image from ghcr... to localhost... and discard PREVIOUS_BUILD - if [[ "{{ ghcr }}" == "1" ]]; then + # rename the image to localhost + if [[ "{{ ghcr }}" == "1" && "{{ previous_build }}" == "1" ]]; then ${SUDOIF} ${PODMAN} tag ${CHUNKED_IMAGE} "localhost/"${image_name}":"${tag}"" ${SUDOIF} ${PODMAN} image rm -f ${CHUNKED_IMAGE} fi From 33f59153957541955d74d55209c4a51c91f87b4a Mon Sep 17 00:00:00 2001 From: renner Date: Fri, 3 Apr 2026 22:49:54 +0200 Subject: [PATCH 42/82] feat: only pull when image actually exists We need to check if the previous build was actually made with rpm-ostree, otherwise this isn't going to do anything, implemented like how upstream checks for this, see the comment. --- Justfile | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/Justfile b/Justfile index a5b7e9f2..f907705b 100644 --- a/Justfile +++ b/Justfile @@ -293,8 +293,14 @@ rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0" previ # TODO: Redo everything here with --previous-build in rpm-ostree 2026.1+ # so we don't have to pull an old image + rename it if [[ "{{ previous_build }}" == "1" ]]; then - PREVIOUS_IMAGE=ghcr.io/{{ repo_organization }}/"${image_name}":"${DEFAULT_TAG}" - ${SUDOIF} ${PODMAN} pull ${PREVIOUS_IMAGE} + PREVIOUS_IMAGE=ghcr.io/{{ repo_organization }}/"${image_name}":"${DEFAULT_TAG}" + + # https://github.com/coreos/rpm-ostree/blob/7e2f2065a4aa4d5965b4537bb7d74e0b2898650e/rust/src/compose.rs#L522-L529 + if skopeo inspect docker://"${PREVIOUS_IMAGE}" | jq -e '.LayersData[1:] | all(.Annotations?["ostree.components"]?)'; then + ${SUDOIF} ${PODMAN} pull ${PREVIOUS_IMAGE} + else + echo "${PREVIOUS_IMAGE} doesn't exist. Making a fresh layer Plan instead." + fi fi if [[ "{{ ghcr }}" == "1" ]]; then From adafd144b2dfa5fca9e4f88d2148b0327625edd7 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 5 Apr 2026 17:01:00 +0200 Subject: [PATCH 43/82] chore: catchup beta with main (#2006) * feat(nvidia): add service to sync Flatpak driver version (#1983) Co-authored-by: inffy <10782843+inffy@users.noreply.github.com> * chore(ci): replace retry action (#1995) * ci: replace extractions/setup-just with brew install (#2000) * chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to 1a058eb (#2002) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> * fix: move dracut configs to files instead of flags (#2003) While this doesn't make a difference to our image build itself, it will make the life easier for derived images as they will inherit all the modules from us that we set anyway. This undoes some of the changes made in 32a66fc7191. These are specific to the things we install here so it doesn't make sense to go into common. --------- Co-authored-by: Adam Fidel Co-authored-by: inffy <10782843+inffy@users.noreply.github.com> Co-authored-by: Dylan M. Taylor Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/generate-release.yml | 6 ++++-- .github/workflows/reusable-build.yml | 19 +++++++++++-------- .github/workflows/validate-just.yml | 6 ++++-- build_files/base/19-initramfs.sh | 7 +++---- image-versions.yml | 2 +- .../30-aurora-bootc-ostree-backend.conf | 1 + .../dracut/dracut.conf.d/90-ublue-luks.conf | 1 + 7 files changed, 25 insertions(+), 17 deletions(-) create mode 100644 system_files/shared/usr/lib/dracut/dracut.conf.d/30-aurora-bootc-ostree-backend.conf create mode 100644 system_files/shared/usr/lib/dracut/dracut.conf.d/90-ublue-luks.conf diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml index 4c6f64de..66b991b7 100644 --- a/.github/workflows/generate-release.yml +++ b/.github/workflows/generate-release.yml @@ -35,8 +35,10 @@ jobs: with: fetch-depth: 500 - - name: Setup Just - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3 + - name: Install Just + run: | + /home/linuxbrew/.linuxbrew/bin/brew install just + echo "/home/linuxbrew/.linuxbrew/bin" >> $GITHUB_PATH - name: Check Just Syntax shell: bash diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 8b4c4187..633c0130 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -64,8 +64,10 @@ jobs: mount-opts: compress-force=zstd:2 loopback-free: '1' - - name: Setup Just - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3 + - name: Install Just + run: | + /home/linuxbrew/.linuxbrew/bin/brew install just + echo "/home/linuxbrew/.linuxbrew/bin" >> $GITHUB_PATH - name: Check Just Syntax shell: bash @@ -307,15 +309,16 @@ jobs: - name: Push to GHCR id: push if: github.event_name != 'pull_request' - uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0 + uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0 env: ALIAS_TAGS: ${{ steps.generate-tags.outputs.alias_tags }} IMAGE_NAME: ${{ env.IMAGE_NAME }} LOWERCASE: ${{ steps.registry_case.outputs.lowercase }} DEFAULT_TAG: ${{ env.DEFAULT_TAG }} with: - attempt_limit: 3 - attempt_delay: 15000 + max_attempts: 3 + retry_wait_seconds: 15 + timeout_minutes: 10 command: | set -euox pipefail # HACK: push a second time so layer annotations are pushed @@ -342,7 +345,7 @@ jobs: run: | cosign sign -y --key env://COSIGN_PRIVATE_KEY ${LOWERCASE}/${IMAGE_NAME}@${TAGS} env: - TAGS: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }} + TAGS: ${{ steps.push.outputs.digest }} COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} LOWERCASE: ${{ steps.registry_case.outputs.lowercase }} @@ -362,7 +365,7 @@ jobs: id: upload-sbom env: IMAGE: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }} - DIGEST: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }} + DIGEST: ${{ steps.push.outputs.digest }} SBOM: ${{ steps.generate-sbom.outputs.SBOM }} run: | cd "$(dirname "${SBOM}")" @@ -392,7 +395,7 @@ jobs: uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0 with: subject-name: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }} - subject-digest: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }} + subject-digest: ${{ steps.push.outputs.digest }} push-to-registry: true check: diff --git a/.github/workflows/validate-just.yml b/.github/workflows/validate-just.yml index eb7fb972..ccb22d12 100644 --- a/.github/workflows/validate-just.yml +++ b/.github/workflows/validate-just.yml @@ -21,8 +21,10 @@ jobs: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - name: Setup Just - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3 + - name: Install Just + run: | + /home/linuxbrew/.linuxbrew/bin/brew install just + echo "/home/linuxbrew/.linuxbrew/bin" >> $GITHUB_PATH - name: Check Just Syntax shell: bash diff --git a/build_files/base/19-initramfs.sh b/build_files/base/19-initramfs.sh index 498a5aaa..f4a9f57d 100755 --- a/build_files/base/19-initramfs.sh +++ b/build_files/base/19-initramfs.sh @@ -2,13 +2,12 @@ echo "::group:: ===$(basename "$0")===" -set -oue pipefail +set -ouex pipefail KERNEL_VERSION=$(rpm -q --queryformat="%{evr}.%{arch}" kernel-core) -# Ensure Initramfs is generated export DRACUT_NO_XATTR=1 -/usr/bin/dracut --no-hostonly --kver "${KERNEL_VERSION}" --reproducible -v --add "ostree fido2 tpm2-tss pkcs11 pcsc" -f "/lib/modules/${KERNEL_VERSION}/initramfs.img" -chmod 0600 "/lib/modules/${KERNEL_VERSION}/initramfs.img" +/usr/bin/dracut --no-hostonly --kver "${KERNEL_VERSION}" --reproducible -v -f "/usr/lib/modules/${KERNEL_VERSION}/initramfs.img" +chmod 0600 "/usr/lib/modules/${KERNEL_VERSION}/initramfs.img" echo "::endgroup::" diff --git a/image-versions.yml b/image-versions.yml index df9936de..5f1bbe28 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -10,4 +10,4 @@ images: - name: brew image: ghcr.io/ublue-os/brew tag: latest - digest: sha256:74c4b1e39837d1c4a6f850c577492f2d2a5e1d987d44c64798d24fdb12ab05a8 + digest: sha256:1a058eb1184fd92c75ee14ee68820f1086df4f88b379749c877e18bf282c6827 diff --git a/system_files/shared/usr/lib/dracut/dracut.conf.d/30-aurora-bootc-ostree-backend.conf b/system_files/shared/usr/lib/dracut/dracut.conf.d/30-aurora-bootc-ostree-backend.conf new file mode 100644 index 00000000..486b2a08 --- /dev/null +++ b/system_files/shared/usr/lib/dracut/dracut.conf.d/30-aurora-bootc-ostree-backend.conf @@ -0,0 +1 @@ +add_dracutmodules+=" ostree " diff --git a/system_files/shared/usr/lib/dracut/dracut.conf.d/90-ublue-luks.conf b/system_files/shared/usr/lib/dracut/dracut.conf.d/90-ublue-luks.conf new file mode 100644 index 00000000..c1666eab --- /dev/null +++ b/system_files/shared/usr/lib/dracut/dracut.conf.d/90-ublue-luks.conf @@ -0,0 +1 @@ +add_dracutmodules+=" fido2 tpm2-tss pkcs11 pcsc " From 338734ae54541b962ff10cb7558267a4f9a0f467 Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Tue, 7 Apr 2026 18:10:16 +0300 Subject: [PATCH 44/82] chore(beta): update common image (#2014) --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 5f1bbe28..ed9b91ce 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -6,7 +6,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:e027b8becac12866aea893f00267b6c4b90f72c5882f6bf3dacc682469f2ec77 + digest: sha256:949534eb4f0a211f6bca0ec024797bba000337e2a8acc571bce947c301840ae0 - name: brew image: ghcr.io/ublue-os/brew tag: latest From 02b0fc1271a5ff45696f0660c3a97d39bc09ee77 Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Wed, 8 Apr 2026 06:53:34 +0300 Subject: [PATCH 45/82] chore(beta): update common again --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index ed9b91ce..a740a7e3 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -6,7 +6,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:949534eb4f0a211f6bca0ec024797bba000337e2a8acc571bce947c301840ae0 + digest: sha256:d153690518ba6ee460ccff7d09b61a0fd2dd59e758efaf68ba370fee88621097 - name: brew image: ghcr.io/ublue-os/brew tag: latest From 86f49f78e650a1897ed9da2189b232ea50569d10 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 12 Apr 2026 06:34:48 +0200 Subject: [PATCH 46/82] chore: don't do zstd:chunked compression for now (#2040) While it's nice that this doesn't break anything on modern systems, it also has no advantages *for now* as it's just falling back to zstd. Let's be more careful with this and only do zstd compression for the time being so we don't break older systems that may not have updated to a modern version of rpm-ostree that supports zstd:chunked because they haven't been turned on for quite a while for example. --- .github/workflows/reusable-build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 633c0130..4b34114a 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -325,11 +325,11 @@ jobs: # TODO: remove me when https://github.com/containers/podman/issues/27796 fixed for tag in ${ALIAS_TAGS}; do - sudo -E /home/linuxbrew/.linuxbrew/bin/podman push --compression-format=zstd:chunked --compression-level=3 ${IMAGE_NAME}:${tag} ${LOWERCASE}/${IMAGE_NAME}:${tag} + sudo -E /home/linuxbrew/.linuxbrew/bin/podman push --compression-format=zstd --compression-level=3 ${IMAGE_NAME}:${tag} ${LOWERCASE}/${IMAGE_NAME}:${tag} done for tag in ${ALIAS_TAGS}; do - sudo -E /home/linuxbrew/.linuxbrew/bin/podman push --compression-format=zstd:chunked --compression-level=3 ${IMAGE_NAME}:${tag} ${LOWERCASE}/${IMAGE_NAME}:${tag} + sudo -E /home/linuxbrew/.linuxbrew/bin/podman push --compression-format=zstd --compression-level=3 ${IMAGE_NAME}:${tag} ${LOWERCASE}/${IMAGE_NAME}:${tag} done digest=$(skopeo inspect docker://${LOWERCASE}/${IMAGE_NAME}:${DEFAULT_TAG} --format '{{.Digest}}') From 10804b8632ee96c9583eb867ec5be38ae5c165c7 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 12 Apr 2026 11:53:44 +0200 Subject: [PATCH 47/82] chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 19f2295 (#2044) (#2046) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index a740a7e3..bfc0e439 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -6,7 +6,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:d153690518ba6ee460ccff7d09b61a0fd2dd59e758efaf68ba370fee88621097 + digest: sha256:19f2295a0596898f1563958d5a20721953b07b7849632097042a40f8b3e42c4e - name: brew image: ghcr.io/ublue-os/brew tag: latest From 1dcfe10856c99ecffdbe5519ff058d0e0b997e21 Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Sat, 18 Apr 2026 10:55:27 +0300 Subject: [PATCH 48/82] chore(beta): update common in beta (#2068) --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index bfc0e439..f31b2645 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -6,7 +6,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:19f2295a0596898f1563958d5a20721953b07b7849632097042a40f8b3e42c4e + digest: sha256:cad45bf8d280ba46e49fe19a339dfcb01d272ee2157dfe10915d3bc2b0775d32 - name: brew image: ghcr.io/ublue-os/brew tag: latest From c99dae3e9c6f3521315a2855d9cc2fd9852161f7 Mon Sep 17 00:00:00 2001 From: inffy <10782843+inffy@users.noreply.github.com> Date: Thu, 23 Apr 2026 08:32:20 +0300 Subject: [PATCH 49/82] Update digest for common image --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index f31b2645..8ccefd67 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -6,7 +6,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:cad45bf8d280ba46e49fe19a339dfcb01d272ee2157dfe10915d3bc2b0775d32 + digest: sha256:8f4e6f5396b904ac2f578561fc1cf44818d8273e2ffc362909a1dc1c23ee74f9 - name: brew image: ghcr.io/ublue-os/brew tag: latest From 1215fca6d11ad70f9e48db9fbd6c2d56249bedcc Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sun, 26 Apr 2026 16:55:40 +0200 Subject: [PATCH 50/82] feat(ci): keyless OIDC verification for get-aurora-dev/common (#2095) We are dealing with less long-lived keys now and we are supposed to use this more modern way of signing our artifacts anyway where we can. Sister PR to: https://github.com/get-aurora-dev/common/pull/158 --- Justfile | 5 ++++- ghcr.io-get-aurora-dev.pub | 4 ---- image-versions.yml | 2 +- 3 files changed, 5 insertions(+), 6 deletions(-) delete mode 100644 ghcr.io-get-aurora-dev.pub diff --git a/Justfile b/Justfile index f907705b..39ed7caa 100644 --- a/Justfile +++ b/Justfile @@ -145,7 +145,10 @@ build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline {{ just }} verify-container cosign.pub "ghcr.io/ublue-os/akmods-nvidia-open:${akmods_flavor}-${fedora_version}-${kernel_release}" fi - {{ just }} verify-container ghcr.io-get-aurora-dev.pub "ghcr.io/get-aurora-dev/common:latest@${common_image_sha}" + cosign verify \ + --certificate-oidc-issuer https://token.actions.githubusercontent.com \ + --certificate-identity-regexp="github.com/get-aurora-dev/common/.github/workflows/*" \ + "ghcr.io/get-aurora-dev/common:latest@${common_image_sha}" {{ just }} verify-container cosign.pub "ghcr.io/ublue-os/brew:latest@${brew_image_sha}" diff --git a/ghcr.io-get-aurora-dev.pub b/ghcr.io-get-aurora-dev.pub deleted file mode 100644 index 18f9d87e..00000000 --- a/ghcr.io-get-aurora-dev.pub +++ /dev/null @@ -1,4 +0,0 @@ ------BEGIN PUBLIC KEY----- -MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAELIik8ZM9ytEYEy1OWPs17Af7OEFH -+WE9xOdw+1Bk04RudI7qGgbfp6FIFZSZ1qUzmvN2yRsJ911+eBxOtu+MNw== ------END PUBLIC KEY----- diff --git a/image-versions.yml b/image-versions.yml index 8ccefd67..f8e3f30a 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -6,7 +6,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:8f4e6f5396b904ac2f578561fc1cf44818d8273e2ffc362909a1dc1c23ee74f9 + digest: sha256:b8bd705aa118bccf8f6a4a8ad8e3ad87f4bfee89a8db1f427f310714f7e40ee7 - name: brew image: ghcr.io/ublue-os/brew tag: latest From 037fe6533fcaa4905015470877ec405e514c5456 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Tue, 28 Apr 2026 10:07:02 +0200 Subject: [PATCH 51/82] feat(ci): introduce temporary compatibility tag for f44 (#2107) * feat(ci): introduce temporary compatibility tag for f44 Instead of having 2 workflows for building beta and latest, which will produce functionally the same image, we have one workflow instead. Latest workflow will tag beta images. * trigger latest workflow on beta --- .github/workflows/build-image-latest-main.yml | 5 ++--- Justfile | 2 ++ 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-image-latest-main.yml b/.github/workflows/build-image-latest-main.yml index 77e4a547..d9aafed4 100644 --- a/.github/workflows/build-image-latest-main.yml +++ b/.github/workflows/build-image-latest-main.yml @@ -1,10 +1,9 @@ name: Latest Images on: - merge_group: + #merge_group: pull_request: branches: - - main - - testing + - beta paths-ignore: - "**.md" - ".github/workflows/moderator.yml" diff --git a/Justfile b/Justfile index 39ed7caa..96e861bc 100644 --- a/Justfile +++ b/Justfile @@ -567,6 +567,8 @@ generate-build-tags image="aurora" tag="latest" flavor="main" kernel_pin="" ghcr BUILD_TAGS+=("stable" "stable-${version}" "stable-${version:3}") elif [[ ! "{{ tag }}" =~ stable|beta ]]; then BUILD_TAGS+=("${FEDORA_VERSION}" "${FEDORA_VERSION}-${version}" "${FEDORA_VERSION}-${version:3}") + # compatiblity for f44, TODO: remove me when we merge beta branch into main + BUILD_TAGS+=("beta" "beta-${version}" "beta-${version:3}") fi if [[ "${github_event}" == "pull_request" ]]; then From 8cdb5a3c8ca5d971549bf530d50abb5464008fd0 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Tue, 28 Apr 2026 11:36:39 +0200 Subject: [PATCH 52/82] chore(ci): enable merge_group for latest (#2111) We can probably use renovate this way --- .github/workflows/build-image-latest-main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-image-latest-main.yml b/.github/workflows/build-image-latest-main.yml index d9aafed4..8f93c5dc 100644 --- a/.github/workflows/build-image-latest-main.yml +++ b/.github/workflows/build-image-latest-main.yml @@ -1,6 +1,6 @@ name: Latest Images on: - #merge_group: + merge_group: pull_request: branches: - beta From 9d8e8eb911ce7ded64f174e3e1ce2546ed94f939 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 10:10:39 +0000 Subject: [PATCH 53/82] chore(deps): update actions/setup-node digest to 48b55a0 (#2113) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/validate-renovate.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/validate-renovate.yml b/.github/workflows/validate-renovate.yml index 611baafd..309b6de9 100644 --- a/.github/workflows/validate-renovate.yml +++ b/.github/workflows/validate-renovate.yml @@ -22,7 +22,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: latest From 9765a511efb8d59cde8189c2ef90140e4a6ba140 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Tue, 28 Apr 2026 13:10:48 +0200 Subject: [PATCH 54/82] fix(ci): turn off stable builds for merge_queue in beta branch (#2118) This is broken anyway and isn't supposed to happen. --- .github/workflows/build-image-stable.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-image-stable.yml b/.github/workflows/build-image-stable.yml index bff298cc..c678d19f 100644 --- a/.github/workflows/build-image-stable.yml +++ b/.github/workflows/build-image-stable.yml @@ -1,6 +1,6 @@ name: Stable Images on: - merge_group: # Make Stable-Daily run on merge groups + # merge_group: # Make Stable-Daily run on merge groups pull_request: branches: - main From 6383a7f63e9d4b89a1774e9231eae4d53de1b21d Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 10:29:04 +0000 Subject: [PATCH 55/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to a2e3691 (#2115) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index f8e3f30a..f38ce991 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 44 - digest: sha256:27e4c5c806e2f9259be549c87608ebbf18fa878ebd18da911fdd22de3d6a01e5 + digest: sha256:a2e3691b181948d9139aa793afcae8475f0e0e105a709f1abd8331d1d6edf8bb - name: common image: ghcr.io/get-aurora-dev/common tag: latest From 6445bfcd7b666b6cb457decdf5feefc7345ba08d Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 10:36:07 +0000 Subject: [PATCH 56/82] chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to d8fa2c2 (#2114) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index f38ce991..a75d6ba0 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -6,7 +6,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:b8bd705aa118bccf8f6a4a8ad8e3ad87f4bfee89a8db1f427f310714f7e40ee7 + digest: sha256:d8fa2c210e02d8a9f7a2279039d88ad2dfd39b232804e511ad59e9a197e6a73c - name: brew image: ghcr.io/ublue-os/brew tag: latest From 6fa55fc6c3df946b480d2c16b6aeadb6616033de Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 11:56:05 +0000 Subject: [PATCH 57/82] chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to ab758cf (#2117) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index a75d6ba0..19a01400 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -10,4 +10,4 @@ images: - name: brew image: ghcr.io/ublue-os/brew tag: latest - digest: sha256:1a058eb1184fd92c75ee14ee68820f1086df4f88b379749c877e18bf282c6827 + digest: sha256:ab758cf15c0ae7a09fc2fc10e6a3e91e76bb0c569bde7628ee51126dc214df56 From 05e90121267dc0a78a5682215d43ca4a1114b6cd Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 11:56:12 +0000 Subject: [PATCH 58/82] chore(deps): update actions/upload-artifact digest to 043fb46 (#2116) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/reusable-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 4b34114a..00ea2954 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -224,7 +224,7 @@ jobs: - name: Upload OCI dir as Artifact if: github.event_name == 'pull_request' - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: ${{ env.IMAGE_NAME }}.oci path: ${{ env.IMAGE_NAME }}.oci From d7baba0fa7e25f839d9bfb79265073b783f6e0fa Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 15:46:55 +0300 Subject: [PATCH 59/82] chore(deps): update actions/upload-artifact action to v7.0.1 (beta) (#2123) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 29f4e211..64cc506c 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -62,7 +62,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: SARIF file path: results.sarif From 3429fa28be39cb466af783df86c32f2cf7550ad4 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 15:47:20 +0300 Subject: [PATCH 60/82] chore(deps): update github/codeql-action digest to 95e58e9 (beta) (#2119) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 64cc506c..9315ebc4 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -71,6 +71,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard (optional). # Commenting out will disable upload of results to your repo's Code Scanning dashboard - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4 + uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4 with: sarif_file: results.sarif From 032274744552eb10db223811a9c38952414f8391 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 16:35:38 +0300 Subject: [PATCH 61/82] chore(deps): update softprops/action-gh-release digest to 3bb1273 (beta) (#2120) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/generate-release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml index 66b991b7..557dc528 100644 --- a/.github/workflows/generate-release.yml +++ b/.github/workflows/generate-release.yml @@ -58,7 +58,7 @@ jobs: echo "tag=${TAG}" >> $GITHUB_OUTPUT - name: Create Release - uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 if: contains(fromJson('["stable"]'), matrix.version) && (github.event.schedule == '0 1 * * TUE' || contains(fromJson('["workflow_dispatch", "workflow_call"]'), github.event_name)) with: name: ${{ steps.generate-release-text.outputs.title }} From 64e5430253a0f317bf0bba7f5ef11559eef0f188 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 16:35:57 +0300 Subject: [PATCH 62/82] chore(deps): update actions/cache action to v5.0.5 (beta) (#2122) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/reusable-build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 00ea2954..eb05afb8 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -115,7 +115,7 @@ jobs: echo "allow_cache_write=${ALLOW_CACHE_WRITE}" >> "$GITHUB_OUTPUT" - name: Restore DNF package cache - uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 + uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 env: CACHE_NAME: ${{ steps.setup-cache.outputs.cache_name }} with: @@ -147,7 +147,7 @@ jobs: - name: Write new DNF package cache if: steps.setup-cache.outputs.allow_cache_write == 'true' - uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 + uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 env: CACHE_NAME: ${{ steps.setup-cache.outputs.cache_name }} with: From e35dcf690cb37f4c9c8027e302f7fc4500fea2b0 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 13:45:57 +0000 Subject: [PATCH 63/82] chore(deps): update oras-project/setup-oras action to v2 (#2124) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/generate-release.yml | 2 +- .github/workflows/reusable-build.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml index 557dc528..9663169e 100644 --- a/.github/workflows/generate-release.yml +++ b/.github/workflows/generate-release.yml @@ -46,7 +46,7 @@ jobs: just check - name: Install ORAS - uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4 + uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2 - name: Generate Release Text id: generate-release-text diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index eb05afb8..cde8d362 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -353,7 +353,7 @@ jobs: - name: Install ORAS if: github.event_name != 'pull_request' - uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4 + uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2 - name: Login to GitHub Container Registry with ORAS if: github.event_name != 'pull_request' From b54be320c8f69e57e9be239d4a0c199aec278fa6 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 18:25:59 +0300 Subject: [PATCH 64/82] chore(deps): update softprops/action-gh-release action to v3 (beta) (#2126) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/generate-release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml index 9663169e..de225fba 100644 --- a/.github/workflows/generate-release.yml +++ b/.github/workflows/generate-release.yml @@ -58,7 +58,7 @@ jobs: echo "tag=${TAG}" >> $GITHUB_OUTPUT - name: Create Release - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3 if: contains(fromJson('["stable"]'), matrix.version) && (github.event.schedule == '0 1 * * TUE' || contains(fromJson('["workflow_dispatch", "workflow_call"]'), github.event_name)) with: name: ${{ steps.generate-release-text.outputs.title }} From 452194711d82a3ff50d429c1c0104dec2403f99c Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 16:58:59 +0000 Subject: [PATCH 65/82] chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to a64a21e (#2129) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 19a01400..ecdda342 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -6,7 +6,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:d8fa2c210e02d8a9f7a2279039d88ad2dfd39b232804e511ad59e9a197e6a73c + digest: sha256:a64a21e0fe5d5cc174a4a938d23ee75d61f27eb48b97d50e3658b1857badf1cf - name: brew image: ghcr.io/ublue-os/brew tag: latest From d2d7d872a59284e4a491ab46ce3336ac98af5c8f Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 29 Apr 2026 04:18:58 +0000 Subject: [PATCH 66/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 22a9214 (#2130) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index ecdda342..42634e57 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 44 - digest: sha256:a2e3691b181948d9139aa793afcae8475f0e0e105a709f1abd8331d1d6edf8bb + digest: sha256:22a9214fbb72d5a13255d6103a140a973be3924f0b70a85c3064e8291e15a33d - name: common image: ghcr.io/get-aurora-dev/common tag: latest From c23947d328387ffc082cc87e824525aec7da1f55 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 29 Apr 2026 10:55:45 +0000 Subject: [PATCH 67/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 91d44aa (#2132) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 42634e57..09607a5f 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 44 - digest: sha256:22a9214fbb72d5a13255d6103a140a973be3924f0b70a85c3064e8291e15a33d + digest: sha256:91d44aa9ba8a2fca57f8b02a0d21951ebfa34604fc6b5f1b1a0baf438a889718 - name: common image: ghcr.io/get-aurora-dev/common tag: latest From 8069428dc1282096bb6360e62fb619c30d08bbfa Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Thu, 30 Apr 2026 04:02:37 +0000 Subject: [PATCH 68/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 57e2911 (#2137) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 09607a5f..d328c60b 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 44 - digest: sha256:91d44aa9ba8a2fca57f8b02a0d21951ebfa34604fc6b5f1b1a0baf438a889718 + digest: sha256:57e2911c448f764d9509e7b9c74201e4b636a2c54416c020e098d79ff2184134 - name: common image: ghcr.io/get-aurora-dev/common tag: latest From 9519ef66ed299aec39eeac84f600a86ec2632b24 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 1 May 2026 04:25:54 +0000 Subject: [PATCH 69/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to df1d8ed (#2140) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index d328c60b..c6dbc7d9 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 44 - digest: sha256:57e2911c448f764d9509e7b9c74201e4b636a2c54416c020e098d79ff2184134 + digest: sha256:df1d8ed84c04ddbe4effd3c8d6bfc5f630e92e676096a5e9f17fd5988a2dcc5e - name: common image: ghcr.io/get-aurora-dev/common tag: latest From 92fa228dd05161493c8396c257ccb3de88ed6b46 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 1 May 2026 19:06:56 +0300 Subject: [PATCH 70/82] chore(deps): update github/codeql-action digest to e46ed2c (beta) (#2143) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 9315ebc4..86241723 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -71,6 +71,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard (optional). # Commenting out will disable upload of results to your repo's Code Scanning dashboard - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4 + uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4 with: sarif_file: results.sarif From 0dd8781162025414c825027f9b105b993513f598 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sat, 2 May 2026 03:52:11 +0000 Subject: [PATCH 71/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 6b713b6 (#2144) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index c6dbc7d9..bb413bb5 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 44 - digest: sha256:df1d8ed84c04ddbe4effd3c8d6bfc5f630e92e676096a5e9f17fd5988a2dcc5e + digest: sha256:6b713b6c5cacef837d593f4d3e908d6a80f396adb12bed4443dcca7f447143b2 - name: common image: ghcr.io/get-aurora-dev/common tag: latest From 9922f422740117059cff61d9406f133353259a30 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 3 May 2026 02:53:13 +0000 Subject: [PATCH 72/82] chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to 37a2834 (#2147) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index bb413bb5..a794e9dd 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -10,4 +10,4 @@ images: - name: brew image: ghcr.io/ublue-os/brew tag: latest - digest: sha256:ab758cf15c0ae7a09fc2fc10e6a3e91e76bb0c569bde7628ee51126dc214df56 + digest: sha256:37a2834b32cd091a189b8663a7f27939d745a465f718d6c3f6c726ba845d8101 From 98d534f000fb8b1ee898748329a1573d9a12a884 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 3 May 2026 04:29:20 +0000 Subject: [PATCH 73/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 2b592c1 (#2148) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index a794e9dd..0111d7ed 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 44 - digest: sha256:6b713b6c5cacef837d593f4d3e908d6a80f396adb12bed4443dcca7f447143b2 + digest: sha256:2b592c16493cabe2bd161ecb568a751c980f6529f96cea04a407b4907ae29b3f - name: common image: ghcr.io/get-aurora-dev/common tag: latest From f8368d1a15a7b11298beca4159b8852e7fcfc7ce Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Sun, 3 May 2026 14:09:55 +0000 Subject: [PATCH 74/82] chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 6a28036 (#2151) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 0111d7ed..eeb4fb1f 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -6,7 +6,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:a64a21e0fe5d5cc174a4a938d23ee75d61f27eb48b97d50e3658b1857badf1cf + digest: sha256:6a280361414ba3290b8a4187e9b952d535b78e3aed7f5c3d45ecf0ed9bff088c - name: brew image: ghcr.io/ublue-os/brew tag: latest From 254f122a80e2ebf728d502777d363365ac7b7576 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Mon, 4 May 2026 03:56:36 +0000 Subject: [PATCH 75/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 6a3ed2a (#2153) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index eeb4fb1f..f6455bc0 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 44 - digest: sha256:2b592c16493cabe2bd161ecb568a751c980f6529f96cea04a407b4907ae29b3f + digest: sha256:6a3ed2a184b83f4f2f8d62c6f41eff0c9cd6cbabc42cb068c81e4d3a8fbfa033 - name: common image: ghcr.io/get-aurora-dev/common tag: latest From 4f965ac658f741ed3d02c4d751b855425a0adee8 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Tue, 5 May 2026 03:54:53 +0000 Subject: [PATCH 76/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 55bca96 (#2155) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index f6455bc0..fffddee6 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 44 - digest: sha256:6a3ed2a184b83f4f2f8d62c6f41eff0c9cd6cbabc42cb068c81e4d3a8fbfa033 + digest: sha256:55bca9684f2590d6e2d196b9dc9dbe1ca4acb2c93358056fabccf6ee97b31475 - name: common image: ghcr.io/get-aurora-dev/common tag: latest From 0e161fe1ad402467fa9f9eb63065ab0e1e9b96d3 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 6 May 2026 07:15:58 +0300 Subject: [PATCH 77/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 8ad0c06 (beta) (#2159) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index fffddee6..1dddf6b2 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 44 - digest: sha256:55bca9684f2590d6e2d196b9dc9dbe1ca4acb2c93358056fabccf6ee97b31475 + digest: sha256:8ad0c061e6e3d7b6e7c5aa33662068791068e96362476ea8de9b374631b67672 - name: common image: ghcr.io/get-aurora-dev/common tag: latest From 552611229350aab6980b1731b29f0bacc54cad05 Mon Sep 17 00:00:00 2001 From: Alex Meyer Date: Wed, 6 May 2026 01:12:10 -0400 Subject: [PATCH 78/82] fix(beta): make sbverify check not fail if missing (#2157) --- Justfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Justfile b/Justfile index 96e861bc..8dd87657 100644 --- a/Justfile +++ b/Justfile @@ -459,7 +459,7 @@ secureboot $image="aurora" $tag="latest" $flavor="main": openssl x509 -in /tmp/akmods.der -out /tmp/akmods.crt # Make sure we have sbverify - CMD="$(command -v sbverify)" + CMD="$(command -v sbverify || true)" if [[ -z "${CMD:-}" ]]; then temp_name="sbverify-${RANDOM}" ${PODMAN} run -dt \ From 78217b0285ff7ca0b4c1022d6fd53dae00d19108 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Wed, 6 May 2026 13:41:15 +0000 Subject: [PATCH 79/82] chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to ee8f5bb (#2162) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 1dddf6b2..f0cd6c46 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -6,7 +6,7 @@ images: - name: common image: ghcr.io/get-aurora-dev/common tag: latest - digest: sha256:6a280361414ba3290b8a4187e9b952d535b78e3aed7f5c3d45ecf0ed9bff088c + digest: sha256:ee8f5bb500fdb446829982e55484c32f0c3fc2b68954f6f872faa258e90003ea - name: brew image: ghcr.io/ublue-os/brew tag: latest From f2023f21b16246500666aeb6474522db0ff07ce3 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Thu, 7 May 2026 03:58:09 +0000 Subject: [PATCH 80/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to d01d05c (#2164) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index f0cd6c46..2c07a1bb 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 44 - digest: sha256:8ad0c061e6e3d7b6e7c5aa33662068791068e96362476ea8de9b374631b67672 + digest: sha256:d01d05c80d5697939e767670d67f35e5350814282819418fecbe4448dbbdd788 - name: common image: ghcr.io/get-aurora-dev/common tag: latest From d9f93e82a1a6a9d66387a02eecd06cc7d4b1a5f5 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 8 May 2026 06:44:09 +0300 Subject: [PATCH 81/82] chore(deps): update github/codeql-action digest to 68bde55 (beta) (#2168) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 86241723..bb128606 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -71,6 +71,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard (optional). # Commenting out will disable upload of results to your repo's Code Scanning dashboard - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4 + uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 with: sarif_file: results.sarif From 5a00ee80238464fbbac1199648db638d3c000533 Mon Sep 17 00:00:00 2001 From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com> Date: Fri, 8 May 2026 03:48:28 +0000 Subject: [PATCH 82/82] chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to d73a04a (#2169) Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com> --- image-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image-versions.yml b/image-versions.yml index 2c07a1bb..f0306263 100644 --- a/image-versions.yml +++ b/image-versions.yml @@ -2,7 +2,7 @@ images: - name: kinoite image: quay.io/fedora-ostree-desktops/kinoite tag: 44 - digest: sha256:d01d05c80d5697939e767670d67f35e5350814282819418fecbe4448dbbdd788 + digest: sha256:d73a04a449fd8184427302545e557006507941ae3805c04140cfedd7dc146a0f - name: common image: ghcr.io/get-aurora-dev/common tag: latest