* feat(ci): introduce temporary compatibility tag for f44
Instead of having 2 workflows for building beta and latest, which will
produce functionally the same image, we have one workflow instead.
Latest workflow will tag beta images.
* trigger latest workflow on beta
We are dealing with less long-lived keys now and we are supposed to use
this more modern way of signing our artifacts anyway where we can.
Sister PR to: https://github.com/get-aurora-dev/common/pull/158
We are dealing with less long-lived keys now and we are supposed to use
this more modern way of signing our artifacts anyway where we can.
Sister PR to: https://github.com/get-aurora-dev/common/pull/158
Due to the nature of these caches being immutable (hihi) we can only
initially create caches with a certain key and can't update them with
fresh packages, this means they would get stale after a certain time. To
workaround this we restore from cache x and write and publish to cache
y, this has the drawback that this growth will never stop as we don't
delete old and unused packages residing inside the cache. This is not a
super big issue as the vast majority of packages don't change too often
but is still an annoyance.
As per the eviction policy [1], caches not accessed for 7 days will be
deleted automatically. This should result in a cycle where a scheduled
stable (or other manually triggered) workflows will create new cache
that will be used by all workflows until the next one is created again.
With this change, manual intervention should never be needed while
always having a fresh cache.
This also addresses that the aurora-dx-nvidia-open image got falsely
recognized as aurora-dx and attempted to write cache previously.
[1]: https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#usage-limits-and-eviction-policy
We need to check if the previous build was actually made with
rpm-ostree, otherwise this isn't going to do anything, implemented like
how upstream checks for this, see the comment.
Over time the layer plan due to reuse of the previous build's rechunking
plan might become undesirable/inefficient or due to bugs in rpm-ostree
itself that would trigger issues in the rechunker during the build might
force us to reset the layer plan where we do not consume our previous
build.
Currently we compose a fresh rechunked image every build. This is not
ideal for image layer difference reduction and thereforce update sizes
as we do not take the rechunking plan/package layout from the previous
build (that users will likely have downloaded) into account.
When we have a new release of rpm-ostree we can replace most of the
pulling logic here with the new `--previous-build` flag.
* chore(ci): remove akmods check for fedora version (#1966)
This is unnecessary and doesn't work all that well, caching is not super
well implemented anyway. Setting the fedora version per image tag
statically works just fine and if we were to set some version that is
not yet available then it will simply fail a couple seconds later on the
cosign verification or akmods image pull.
* chore(beta): adjust fedora version logic for beta in rechunker
This is unnecessary and doesn't work all that well, caching is not super
well implemented anyway. Setting the fedora version per image tag
statically works just fine and if we were to set some version that is
not yet available then it will simply fail a couple seconds later on the
cosign verification or akmods image pull.
We are writing cache to the proper location but not adjusting the
restore keys properly, i.e. aurora wants to look for cache at aurora
even tho we are purposefully only allowing aurora-dx cache to be
created.
Currently we are very inefficient with our cache usage as every image
has it's own cache where most of the packages are the same across
variants anyway. See 973333f.
This should fix a couple problems around this as we are now also
considering the Fedora version in the cache key and only allowing one
blessed image to create cache. Which is why I decided to implement this
into the Justfile even tho this is only needed when running from github
as it just makes things easier to troubleshoot.
aurora-dx makes the most sense here as that is the heaviest image. We
don't need a separate nvidia image cache as the biggest RPMs exclusive
to that variant are cached in akmods anyway and don't have to be
downloaded.
Only allowing cache to be created at all on workflow_dispatch and on
schedule happens to go hand in hand with the limitation/design of the
cache action as we only build images from the main branch in those two
cases, rest is merge queue, which also happens to address the
"infighting" across stable and latest builds when they kick off at the
same time.
This should make it easier going forward especially when we take future
possible ARM, testing images or any other reason for our matrix to get
bigger into consideration.
We are writing cache to the proper location but not adjusting the
restore keys properly, i.e. aurora wants to look for cache at aurora
even tho we are purposefully only allowing aurora-dx cache to be
created.
Currently we are very inefficient with our cache usage as every image
has it's own cache where most of the packages are the same across
variants anyway. See 973333f.
This should fix a couple problems around this as we are now also
considering the Fedora version in the cache key and only allowing one
blessed image to create cache. Which is why I decided to implement this
into the Justfile even tho this is only needed when running from github
as it just makes things easier to troubleshoot.
aurora-dx makes the most sense here as that is the heaviest image. We
don't need a separate nvidia image cache as the biggest RPMs exclusive
to that variant are cached in akmods anyway and don't have to be
downloaded.
Only allowing cache to be created at all on workflow_dispatch and on
schedule happens to go hand in hand with the limitation/design of the
cache action as we only build images from the main branch in those two
cases, rest is merge queue, which also happens to address the
"infighting" across stable and latest builds when they kick off at the
same time.
This should make it easier going forward especially when we take future
possible ARM, testing images or any other reason for our matrix to get
bigger into consideration.
* feat(ci): enable zstd:chunked compression
https://github.com/projectbluefin/common/issues/239
* fix: only use zstd compression for artifacts
The old podman version we use on the 24.04 runners seems to be really
slow with pushing zstd:chunked compressed images (to tarballs), we are
only using the newer podman version from brew when we actually push
images to the registry. For testing PRs this is good enough.
This makes the Exporting to OCI Archive step take 1m30s again and 4m for
DX, with :chunked it took 4m and 7m respectively.
* feat: rechunk with rpm-ostree
The legacy rechunker is basically unmaintained, this is a much safer
option to reduce our (delta) image size.
https://coreos.github.io/rpm-ostree/build-chunked-oci/
We can further reduce the layer diff by utilizing --previous-build in
the next rpm-ostree release. It still has a couple problems in the
current release in combination with non-rpm layers.
https://github.com/coreos/chunkah is very early in development, don't
bother for now.
* fix: handle dance regarding stable, stable-daily
* chore: add horrible workaround because of hhd-dev/rechunk
* fix: for layer annotations not being pushed
We need a newer podman version than ubuntu 24.04 provides,
homebrew is the most elegant solution.
We need the layer annotations for the rpm-ostree rechunker so that
updates are more efficient.
workaround for:
https://github.com/containers/podman/issues/27796
* feat: assign layers to files we download
* chore: autostart rechunker-group-fix
* fix: don't do beta tag logic
* chore: only run when deployed with ostree
so this doesn't run on the ISO etc will need to be changed on composefs
native backend.
Previously we were fetching the public keys over the network, this method
was not resilient against bad actors who take over one of our
dependencies and publish malicious images with those keys.
* feat: enable KDE 6.6 Beta builds
latest kernel is nasty, so just going for the coreos-stable kernel now
on beta
The panel task manager widget config is not present in the beta packages
* fix: use latest kernel
ostree hotfix and sysext is fixed in 6.18.5
* fix firewall installation
* feat: FROM quay.io/fedora-ostree-desktops/kinoite
Instead of using the ublue-os/kinoite-main base image we would be using
the ones built by Timothée over at https://gitlab.com/fedora/ostree/ci-test
This is a good path forward for Aurora because:
- we no longer have to undo things we inherit from ublue-os/main
- less overall dependencies
- we can make more conscious decisions about what goes into the image
- it's easier now to build images on top of upcoming Fedora versions
(even KDE nightly ones) or to base on top of potential future images
that are more aligned with our goals and needs
This would come at the cost of maintaining most of what main did
previously ourselves.
* chore: remove ublue-os-akmods-addons
* chore: codecs from negativo
* feat: add flathub
* fix: fedora flatpak be gone
* feat: miscellaneous workarounds
* feat: CoreOS rescue boot generator
* feat: allow brew programs with sudo
* chore: re-add packages from main
* chore: remove packages we removed in main
* chore: renovate
there is no latest tag
* fix: remove explicit ublue akmods copr cleanup
already included with all the others
* chore: remove added fedora flatpak service
We don't need this
* fix(renovate): set proper tag
---------
Co-authored-by: inffy <10782843+inffy@users.noreply.github.com>
We have been using titanoboa for a while now and this won't be coming
back anytime soon.
Co-authored-by: inffy <10782843+inffy@users.noreply.github.com>
* chore: refactor where get-aurora-dev/common image is declared
* feat: build with common sha of image-versions.yml
* feat: verify common image with cosign
* fix: just dance
* chore: don't specifcy tag of common
This is not needed, it was not broken or anything.
The build pulls in the pinned version specified in image.yml
* chore: see previous commit
* fix: add common image tag + sha to verification step
---------
Co-authored-by: renner <renner0@posteo.de>
Co-authored-by: renner <80410025+renner0e@users.noreply.github.com>
Co-authored-by: inffy <10782843+inffy@users.noreply.github.com>
* chore: clean up repo
* chore: overrides and remove tailscale repo
* remove base image changes script
* refactor dx and build scripts
* add better way to install openrazer-daemon
* move the pinned packages to packages.sh
* fix typo
* sunshine is not excluded package anymore
* fix toolip
* update fedora version to 42
* fix: remove unnecessary bootc lint
we do that in the containerfile at the end
* remove /opt stuff
---------
Co-authored-by: renner <80410025+renner0e@users.noreply.github.com>
Co-authored-by: renner <renner0@posteo.de>
* feat: enable testing repo for beta
* chore: beta gates for akmods
* chore: rpmfusion beta
* chore: more enablements
* fix: beta should check the beta tag on main
* sunshine copr not avaialble for f43
* update packages and repo files
* chore(deps): update ghcr.io/ublue-os/kinoite-main:latest docker digest to 55277ae (#1092)
Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
* remove some packages from beta f43
* move special packages away from packages.json
* another if override for beta
* update
* cleanup for copr repos
* more cleanup
* revert akmods changes
* exclude mozilla fonts
* fix excluded packages
* Update build_files/base/03-install-kernel-akmods.sh
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* cleanup some packages
* scx-scheds be gone
---------
Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* feat(ci): consistently use rootful container storage
* feat(ci): add sleep before mounting container storage
would be funny if this worked
* chore: use default value for loopback-free
* chore: undo 5s wait
* revertme: use my testing branch for action
* Revert "revertme: use my testing branch for action"
This reverts commit 27b15386c3e5a9e88d8cb65dca7d0b8f46e0555a.
* chore: use newer version of the action
* fix(build): use GITHUB_TOKEN for curl when needed
* use /tmp instead of /usr/local
* missed one
* pass -E to sudo
---------
Co-authored-by: inffy <10782843+inffy@users.noreply.github.com>
* add aurora copr for anaconda live stuff
* fix(iso): Handle platform differences
* feat(iso): Live ISO using anaconda as the installer
* fix(iso): anaconda artifact name (#2539)
* fix: improve the live anaconda hook
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* add a pull request run if the configure script changes
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* set a funny name
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* fixups
* fixup! set a funny name
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* reorder
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* make our own profiles
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* desktop icon, don't constantly rebuild images
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* figure out how to get libblockdev-btrfs on lts
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
* fix: remove gts workflow
* add flatpaks for ISO
* small fixes
* remove the unneeded LTS workflow
* don't hide the parts of the installer
* few small fixes
* remove google fonts from live iso
* remove motd and brew from iso
* un-break building
* add -live notion to ISOs
* ignore image builds
---------
Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com>
Co-authored-by: m2 <69128853+m2Giles@users.noreply.github.com>
Co-authored-by: Niklas <40402114+NiHaiden@users.noreply.github.com>
