* feat: timestamp all files with epoch 0
We have been using this chunkah feature [1] to put non-rpm content like
the brew tarball in dedicated layers, we didn't actually save any
bandwith on downloads with this as the copying sets the file
modification and access time. Which makes it non-reproducible and every
single update would re-download everything not in RPMs.
This should make updates smaller especially noticeable on daily/multiple
daily image builds. I'm not sure how much of a positive effect this is
gonna have on the stable weekly images as the brew tarball is refreshed
weekly. Things like the wallpapers should at least no longer be
downloaded when they haven't changed. There are still some files we
could do but I think it's mostly not worth it.
xref: https://github.com/ublue-os/aurora/issues/2579
[1] https://github.com/coreos/chunkah#customizing-the-layers
* typo
Co-authored-by: Adam Fidel <ledif@users.noreply.github.com>
---------
Co-authored-by: Adam Fidel <ledif@users.noreply.github.com>
This makes the initramfs reproducible, because currently the
kmod-v4l2loopback is the only thing that is not reproducible.
This is not the proper way to do this, it has to be fixed in
ublue-os/akmods and see what step introduces timestamps into the build.
xref: https://github.com/ublue-os/aurora/issues/2579
In the past we have moved away from doing big dnf transactions spanning
multiple rpm repositories [1] because of the associated risk of third
party repos injecting packages we expect to get from Fedora. With this
we explicitly set which packages are allowed to be installed from each
repo. This means we still get to do big transactions which are generally
faster.
The downside of this is that if subpackages or dependencies from a
3rd-party repo get introduced/change then our builds will break, I think
this is fine as the ones I'm changing here have been unchanging for a
while.
This should only touch repositories with a very specific purpose/single
projects.
This purposefully doesn't touch any ublue-os coprs or negativo (also
they are difficult to handle as we use them in the nvidia script [2]),
those are the only mono-repos so outright excluding the packages is not
an easy option as we would make custom image builds (and usr-overlays
for testing) more annoying.
[1] https://github.com/ublue-os/aurora/issues/1115
[2] 1e4d10b9ac/build_files/nvidia/nvidia-install.sh
If we are using the exact same ublue-os/akmods image and the same inputs
for the initramfs, then it should be stable between builds, make updates
smaller and allow soft-rebooting between deployments (as long as all the
requirements for soft-reboot are met of course).
Thanks secureblue!
xref: https://github.com/ublue-os/aurora/issues/2568
* refactor: simplify checking for enabled 3rd party repos
We are generally no longer doing the dnf enable/disable dance (except
for the nvidia install script) because we are vendoring the .repo files
which simplifies things a bit.
Also I think that the move to checking what is allowed instead of
checking what is not allowed makes more sense anyway.
resolves: https://github.com/ublue-os/aurora/issues/2854
[1] 1e4d10b9ac/build_files/nvidia/nvidia-install.sh
* get openh264 from negativo
Our base image [1] can't legally include this from fedora-cisco-openh264
repo. Comparing the spec files for Fedora [2] and Negativo [3], they
seem to be built with the same build flags, so they should not have any
differing functionality. The fedora-cisco-openh264 repo is currently
enabled (which is not the case for F44 images) because our repo
validation script broke due to the move to /usr [4].
We are already shipping various other codecs on the system, including
mesa, they get more irrelevant each day but we should have this.
I don't know why exactly but for some reason we now have a stray
/var/log/dnf5.log which makes bootc container lint fail.
[1] 54e811f17a/common.yaml (L144)
[2] cd15228484/f/openh264.spec
[3] dfac89f533/openh264.spec
[4] https://fedoraproject.org/wiki/Changes/RelocateRpmRepoConfigsToUsr
This is taken from [1]. We were for no good reason regenerating the initramfs
here. We can also install the kmods with the kernel in one step so I
don't see why we shouldn't just do that. It reduces the amount of time
needed to run this script (on my machine) from 49s to 28s.
I'm not sure if this is an oversight in rpm-ostree, we could technically
use the initramfs that is built during this stage, however, we lose
quite a bit of control, which we definitively want to have.
Also it should generally be noticable when the v4l2 and xone kmods fail
to install. There also haven't been problem regarding that in quite a
while.
[1] 5441c76f1f
We are currently getting this from Fedora anyway, also the negativo package is
unmaintained, Fedora ships a newer version.
It's packaged the same and doesn't actually include any more features
Fedora can't legally ship from the looks of it.
* chore: cleanup systemd services, move to presets
Preset files are cooler [1] and we should be able to get rid of a little
bit of complexity on the ISOs as we simply delete the preset file to
undo things we don't want to have on the ISO (uupd, tailscale ...)
instead of playing catch-up with the image [2].
Also we don't need to enable the *service* of rpm-ostree-countme, we
want to have the *timer* enabled, which is already done by default in
Fedora. The rpm-ostreed-automatic.timer is a leftover from ublue-os/main
days as we enable that for those images but disable it here as we use
uupd.
The Bazaar service got deleted and the need for that got completely
eliminated upstream recently.
[1] https://www.freedesktop.org/software/systemd/man/latest/systemd.preset.html
[2] https://github.com/get-aurora-dev/iso/issues/100
* chore: also do DX
* sunshine
we should make this a seperate thing as we want to still have this
disabled on the live iso
* deal with homebrew nonsense
* prefix with 89
so they can be overriden by others via preset files but still have more
priority over Fedora ones
* split fedora flatpak related services
so we can more easily keep this configuration active
* feat: bump testing to Fedora 45
We are using docker from their repo because it usually ships newer
versions faster than Fedora. In the meantime we can just ship Fedora's
docker version which is good enough.
xref: https://github.com/ublue-os/aurora/issues/2758
* renovate
* fix: cleanup hidden files in /tmp
Something specific to the DX build creates a bunch of socket files
(/tmp/.{ICE,X11,XIM,font}-unix) now. I have no idea what it is, it is
not the new docker package.
We can get rid of the copr-helper wrapper script as we are no longer
enabling and then disabling the repo, which is explained in [1] as we
are configuring them to be off by default and then very purposefully
enabling it for that one dnf transaction where we actually need it
enabled.
The files in yum.repos.d were copied from my local /usr/etc directory.
[1] https://github.com/ublue-os/aurora/issues/1115
This provides utilities to debug SELinux related things like with
sealert.
SELinux is already plenty fun on its own, let's make it easier to debug.
This has already been included in dx images due to being a dependency of
cockpit-selinux.
Seen in https://github.com/ublue-os/main/issues/2845.
Remove docker-model-plugin from the DX Docker package set.
llmman (https://github.com/llmmanorg/llmman) covers the same local
model runner use case and is available via Homebrew from the shared
ai-tools Brewfile (`ujust bbrew` -> ai), so the Docker plugin is no
longer needed in the image.
* feat: make compatible with unsealed composefs
The bootc package ships a dracut configuration that adds the bootc
module (which is needed for the installation of the composefs backend)
to the initramfs which we currently don't have and ostree is also set
there.
I want this because bootc install is significantly faster when used with
the composefs backend, because it does some magic zeor-copy reflink
things. It is wired up with `just disk-image --backend composefs`.
For a long time systemd-boot was the only supported bootloader on
composefs backend, but grub works now. So we don't have to unnecessarily
add systemd-boot to the image.
* use grub for composefs
fixup of e93c41edd7.
The previous iteration has worked but only when calling via the desktop
file, something else during first boot calls /usr/bin/plasma-welcome
directly.
xref: https://github.com/ublue-os/aurora/issues/2624
This is a very common shortcut and I've been using this for years. To my
knowledge we can't make a standalone config for this so this will sadly
have to be done this way.
* chore: remove check for already installed packages before removing
There is very little point to doing this, if the package isn't installed
that we are trying to remove, then it should simply fail.
* chore: also remove removal check for dx
We don't currently (and probably also won't in the future) remove things
from the base. DX should be an addition.
Union is still in development but I think we should preinstall it so
people can try it if they want to. This will be pre-installed in Fedora
at some point and be made an upstream default anyway.
I actually wanted to preinstall this when 6.7 initially came out but I
forgot add this.
More info here https://kde.org/announcements/plasma/6/6.6.91/
We need to do it this way because editing with sed/echo is nasty because
we may end up with multiple keys of the same category/filetype.
No idea when this broke or this ever worked, but it should now.
fixes: https://github.com/ublue-os/aurora/issues/2658
* refactor: repurpose build.sh as build preparation
It currently does too many things, let's split it up. This needs to be
done as we want to move away from a system that copies (also overrides)
files from fedora RPMs and then may remove said rpms, resulting in
removing our changes, which of course defeats the entire point.
A disadvantage this has is that we need to be more mindful and
disciplined of when things are needed during the build. Currently we
actually do not need any system_files we copy in the stage where we are
installing packages/have network access.
If we do at some point we will probably either inline files in
build-prep.sh or have a 2nd directory with files strictly needed for the
build.
This is why we can copy all the files to the system after that, just
before systemd units get activated, initramfs gets generated, general
things we can do offline after we have installed packages are done.
Resolves: https://github.com/ublue-os/aurora/issues/2687
* remove useless comment
* same treatment for DX
* remove unused DX specific version logic
We don't use this, we have branches now.
* move sysctl before docker install
