Compare commits

..

1 commit

Author SHA1 Message Date
Philip Peterson
0f07b8cff5 Throwaway: upload a build's dnf cache to the forge's RPM registry, and time it
All checks were successful
RPM mirror test / upload (push) Successful in 1m33s
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-30 23:45:13 -08:00
12 changed files with 50 additions and 241 deletions

View file

@ -1,41 +0,0 @@
#!/usr/bin/env bash
# Stands in for ghcr.io/ublue-os/akmods on arm64, which upstream doesn't
# build: an image with the akmods image's layout (/kernel-rpms, /rpms/common,
# /rpms/kmods), holding Fedora's own aarch64 kernel from Koji and no extra
# kmods (so no xone or v4l2loopback on arm64). Pushed where the runner's
# registries.conf looks first for ghcr.io/ublue-os/akmods (the mirror), so
# Containerfile.in's `FROM ghcr.io/ublue-os/akmods:...` finds it.
#
# Usage: akmods-arm64.sh FLAVOR FEDORA KERNEL
# e.g. akmods-arm64.sh main 45 7.2.14-300.fc45.aarch64
# Needs a `podman login` to the forge first.
set -euo pipefail
flavor=$1 fedora=$2 kernel=$3
mirror=${MIRROR:-forge.quinefoundation.com/quine-global-labs/mirror}
ref="$mirror/ghcr.io/ublue-os/akmods:$flavor-$fedora-$kernel"
nvr=${kernel%.aarch64} # 7.2.14-300.fc45
version=${nvr%%-*} # 7.2.14
release=${nvr#*-} # 300.fc45
koji="https://kojipkgs.fedoraproject.org/packages/kernel/$version/$release/aarch64"
work=$(mktemp -d)
trap 'rm -rf "$work"' EXIT
mkdir -p "$work/kernel-rpms" "$work/rpms/common" "$work/rpms/kmods"
for pkg in kernel kernel-core kernel-modules kernel-modules-core kernel-modules-extra; do
curl -fsSL --retry 5 -o "$work/kernel-rpms/$pkg-$nvr.aarch64.rpm" "$koji/$pkg-$nvr.aarch64.rpm"
done
ls -l "$work/kernel-rpms"
# Empty directories, so the bind mounts of /rpms/* have something to mount.
touch "$work/rpms/common/.keep" "$work/rpms/kmods/.keep"
ctr=$(buildah from --arch arm64 --os linux scratch)
trap 'buildah rm "$ctr" >/dev/null; rm -rf "$work"' EXIT
buildah copy "$ctr" "$work/kernel-rpms" /kernel-rpms
buildah copy "$ctr" "$work/rpms" /rpms
buildah config --arch arm64 --os linux --label "ostree.linux=$kernel" "$ctr"
buildah commit --rm "$ctr" "$ref"
trap 'rm -rf "$work"' EXIT
podman push --retry 5 "$ref"
echo "pushed $ref"

View file

@ -1,10 +0,0 @@
#!/usr/bin/env bash
# `buildah`, but `buildah build` builds for linux/arm64: build-arm64.yml runs
# `just BUILDAH=.../buildah-arm64 build`, so the Justfile stays upstream's.
# A no-op on an arm64 runner; on an x86_64 one (runner-x86-linux) the arm64
# steps run under QEMU user emulation.
if [[ ${1:-} == build ]]; then
shift
exec buildah build --platform linux/arm64 "$@"
fi
exec buildah "$@"

View file

@ -15,18 +15,12 @@ set -uo pipefail
mirror=${MIRROR:-forge.quinefoundation.com/quine-global-labs/mirror}
# Read from upstream itself, not from the mirror registries.conf points at.
# The flag, not CONTAINERS_REGISTRIES_CONF: podman and buildah read that
# variable, but skopeo never has. Until 2026-11-03 this exported it, skopeo
# read the mirror, and every run copied the mirror onto itself, so tags
# stayed at their first copy. (runner-x86-linux's skopeo now honors the
# variable too; petersweb-infra, hosts/runner-x86-linux.)
skopeo() { command skopeo --registries-conf /dev/null "$@"; }
export CONTAINERS_REGISTRIES_CONF=/dev/null
for ref in "$@"; do
src="docker://$ref"
dest="docker://$mirror/$ref"
# Every architecture: build-arm64.yml pulls the arm64 halves.
opts=(--multi-arch all)
opts=(--multi-arch system)
if [[ $ref == *@sha256:* ]]; then
# Pinned by digest: copy the whole index unchanged, so the digest the
# build asks for exists on the mirror. skopeo refuses a reference with

View file

@ -1,125 +0,0 @@
name: Build Aurora (arm64)
# Builds Aurora for arm64 from this tree and pushes it as
# forge.quinefoundation.com/quine-global-labs/aurora:stable-arm64 (plus
# stable-arm64-<date>). quine-global-labs/quine-linux's arm64 build is FROM
# it. A separate tag, not part of `stable`: build.yml pushes `stable` (amd64)
# daily and would drop an arm64 half each time.
#
# Upstream doesn't ship arm64 Aurora yet, and has no arm64 akmods, which is
# also where Aurora's kernel comes from. So this build uses Fedora's own
# aarch64 kernel, the one Kinoite ships, from a stand-in akmods image
# (.forgejo/akmods-arm64.sh), with no extra kmods.
#
# Runs natively on runner-arm64-linux (petersweb-infra, a Tart VM on the Mac
# mini), daily, an hour after build.yml. It builds this repo's main as
# build.yml last merged it, without merging upstream itself. (Until
# 2026-11-04 it ran weekly under QEMU emulation on runner-x86-linux; it
# still works there, slowly, through buildah-arm64.)
#
# Secret: REGISTRY_TOKEN, as build.yml. Variable (optional): REGISTRY_USER.
on:
schedule:
- cron: '0 6 * * *'
workflow_dispatch:
concurrency:
group: aurora-arm64-${{ github.ref }}
cancel-in-progress: true
env:
REGISTRY: forge.quinefoundation.com
MIRRORS: https://forge.quinefoundation.com/quine-global-labs
IMAGE: forge.quinefoundation.com/quine-global-labs/aurora
TAG: stable
jobs:
build:
runs-on: runner-arm64-linux
timeout-minutes: 300
steps:
- uses: https://forge.quinefoundation.com/quine-global-labs/mirror-actions-checkout@v4
with:
fetch-depth: 0
- name: Build main as it is now
# A scheduled run checks out the commit its schedule was registered
# at, which can be behind main (see build.yml).
if: github.event_name == 'schedule'
run: |
git fetch --no-tags origin main
git checkout -B main FETCH_HEAD
- name: Point downloads at our mirrors
# As build.yml.
run: |
files=$(grep -rlE 'github(usercontent)?\.com/(ublue-os/(akmods|countme)|rcaloras/bash-preexec|coreos/fedora-coreos-config)/' build_scripts)
sed -i -E \
-e "s#https://github\.com/ublue-os/akmods/raw/refs/heads/([^/]+)/#$MIRRORS/mirror-ublue-os-akmods/raw/branch/\1/#g" \
-e "s#https://raw\.githubusercontent\.com/ublue-os/countme/([^/]+)/#$MIRRORS/mirror-ublue-os-countme/raw/branch/\1/#g" \
-e "s#https://raw\.githubusercontent\.com/rcaloras/bash-preexec/([0-9a-f]{40})/#$MIRRORS/mirror-rcaloras-bash-preexec/raw/commit/\1/#g" \
-e "s#https://raw\.githubusercontent\.com/coreos/fedora-coreos-config/refs/heads/([^/]+)/#$MIRRORS/mirror-coreos-fedora-coreos-config/raw/branch/\1/#g" \
$files
git update-index --skip-worktree $files
- name: Adapt the build scripts to arm64
# 01-packages.sh: drop what Fedora builds for x86_64 only. Checked
# against Fedora 44 + negativo17's aarch64 repos (2026-11-04): just
# intel-compute-runtime.
# 19-initramfs.sh: it asks rpm for kmod-v4l2loopback's files, which
# fails without the package, and the stand-in akmods has no kmods.
# "none" keeps dracut's --remove argument in place, naming no module.
run: |
sed -i -E '/^[[:space:]]*intel-compute-runtime[[:space:]]*$/d' build_scripts/base/01-packages.sh
sed -i 's|^V4L2_PATH="$(rpm -ql kmod-v4l2loopback)"$|V4L2_PATH="$(rpm -q --quiet kmod-v4l2loopback \&\& rpm -ql kmod-v4l2loopback \|\| echo none)"|' build_scripts/base/19-initramfs.sh
grep -q 'echo none' build_scripts/base/19-initramfs.sh
git update-index --skip-worktree build_scripts/base/01-packages.sh build_scripts/base/19-initramfs.sh
- name: Log in to the registry
env:
REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
run: printf %s "$REGISTRY_TOKEN" | podman login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
- name: Vendor upstream images, and the arm64 akmods stand-in
run: |
org=$(just --evaluate base_image_org)
name=$(just --evaluate base_image_name)
ver=$(just fedora_version --image aurora --tag "$TAG" --flavor main)
flavor=$(just akmods_flavor --tag "$TAG")
mapfile -t pinned < <(yq -r '.images[] | select(.name != "kinoite") | "\(.image):\(.tag)@\(.digest)"' image-versions.yml)
.forgejo/vendor-images.sh "$org/$name:$ver" "${pinned[@]}"
# The kernel Kinoite's arm64 image ships.
kernel=$(skopeo --registries-conf /dev/null inspect --override-arch arm64 --override-os linux \
--no-tags --retry-times 3 "docker://$org/$name:$ver" | jq -er '.Labels["ostree.linux"]')
echo "kernel: $kernel"
# Quay's tag has been single-arch (amd64) for a while mid-publish.
[[ $kernel == *.aarch64 ]] || { echo "::error::$org/$name:$ver has no arm64 image right now (kernel $kernel); try again later"; exit 1; }
echo "KERNEL=$kernel" >>"$GITHUB_ENV"
.forgejo/akmods-arm64.sh "$flavor" "$ver" "$kernel"
- name: Build
# As build.yml, through a buildah that builds for linux/arm64, with
# the kernel pinned to the stand-in's.
run: >-
env -u GITHUB_TOKEN
GITHUB_REPOSITORY_OWNER=ublue-os
GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0='*'
just BUILDAH="$PWD/.forgejo/buildah-arm64"
build --image aurora --tag "$TAG" --flavor main --kernel-pin "$KERNEL"
- name: Push
run: |
podman image inspect --format '{{.Architecture}}' "localhost/aurora:$TAG"
for t in "$TAG-arm64" "$TAG-arm64-$(date -u +%Y%m%d)"; do
podman tag "localhost/aurora:$TAG" "$IMAGE:$t"
podman push --retry 5 "$IMAGE:$t"
done
- name: Clean up
if: always()
# The runner's hourly sweep keeps a day of images; this build's are
# done with now.
run: |
podman logout "$REGISTRY" || true
podman image prune -af >/dev/null || true

View file

@ -13,9 +13,7 @@ name: Build Aurora
#
# Upstream images (Kinoite, akmods, and image-versions.yml's) are vendored
# into forge.quinefoundation.com/quine-global-labs/mirror/ first, and the
# build pulls them from there (.forgejo/vendor-images.sh). After the push,
# the RPMs the build downloaded go to the forge's RPM registry, a group per
# upstream repository (.forgejo/upload-rpms.sh).
# build pulls them from there (.forgejo/vendor-images.sh).
#
# Secret: REGISTRY_TOKEN, a Forgejo token with package write access.
# Variable (optional): REGISTRY_USER, the token's owner (default: the actor).
@ -59,11 +57,6 @@ jobs:
run: |
git config user.name "forgejo-actions"
git config user.email "actions@forge.quinefoundation.com"
# A scheduled run checks out the commit its schedule was registered
# at, the last push without [skip ci], which can be behind main:
# merge onto main as it is now, or the push below is rejected.
git fetch --no-tags origin main
git checkout -B main FETCH_HEAD
# Our pull mirror of github.com/ublue-os/aurora, synced hourly.
git fetch --no-tags "$MIRRORS/mirror-ublue-os-aurora.git" main
before=$(git rev-parse HEAD)
@ -111,7 +104,7 @@ jobs:
ver=$(just fedora_version --image aurora --tag "$TAG" --flavor main)
akmods=ghcr.io/ublue-os/akmods:$(just akmods_flavor --tag "$TAG")-$ver
refs=("$org/$name:$ver" "$akmods")
if kernel=$(skopeo --registries-conf /dev/null inspect --no-tags --retry-times 3 "docker://$akmods" | jq -er '.Labels["ostree.linux"]'); then
if kernel=$(CONTAINERS_REGISTRIES_CONF=/dev/null skopeo inspect --no-tags --retry-times 3 "docker://$akmods" | jq -er '.Labels["ostree.linux"]'); then
refs+=("$akmods-$kernel")
fi
mapfile -t pinned < <(yq -r '.images[] | select(.name != "kinoite") | "\(.image):\(.tag)@\(.digest)"' image-versions.yml)
@ -137,25 +130,6 @@ jobs:
podman push --retry 5 "$IMAGE:$t"
done
- name: Upload the build's RPMs
# From the dnf cache Containerfile.in's cache mounts keep (buildah
# keeps it on the runner, under /var/tmp/buildah-cache-0), to
# https://forge.quinefoundation.com/api/packages/quine-global-labs/rpm/<group>.
# Packages already there are skipped. Never fails the build.
continue-on-error: true
env:
REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
run: |
fedora=$(ls -d /var/tmp/buildah-cache-0/*/fedora-*/ 2>/dev/null | head -1)
[ -n "$fedora" ] || { echo "::warning::no dnf cache under /var/tmp/buildah-cache-0"; exit 0; }
.forgejo/upload-rpms.sh "$(dirname "$fedora")"
- name: Clean up
- name: Log out
if: always()
# The runner's hourly sweep keeps a day of images; this build's are
# done with now (quine-linux pulls the pushed image from the forge).
# `image prune` leaves the dnf cache the RPM upload reads.
run: |
podman logout "$REGISTRY" || true
podman image prune -af >/dev/null || true
run: podman logout "$REGISTRY" || true

View file

@ -0,0 +1,36 @@
name: RPM mirror test
# Throwaway (branch rpm-mirror-test): uploads the last build's dnf cache to
# the forge's RPM registry and times it, then checks dnf can read a group.
on:
push:
branches: [rpm-mirror-test]
jobs:
upload:
runs-on: runner-x86-linux
steps:
- uses: https://forge.quinefoundation.com/quine-global-labs/mirror-actions-checkout@v4
- name: Upload the dnf cache
env:
REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
run: |
cache=$(dirname "$(ls -d /var/tmp/buildah-cache-0/*/fedora-* | head -1)")
echo "cache: $cache ($(du -sh "$cache" | cut -f1))"
start=$(date +%s)
.forgejo/upload-rpms.sh "$cache"
echo "took $(( $(date +%s) - start ))s"
- name: dnf reads the groups
run: |
api=https://forge.quinefoundation.com/api/packages/quine-global-labs/rpm
sleep 30 # the registry rebuilds repodata after uploads
for g in fedora updates terra; do
curl -fsS -o /dev/null -w "$g repomd: %{http_code}\n" "$api/$g/repodata/repomd.xml"
done
podman run --rm registry.fedoraproject.org/fedora:latest \
dnf -q repoquery --disablerepo='*' --repofrompath="f,$api/fedora" \
--repofrompath="u,$api/updates" --setopt=f.gpgcheck=0 --setopt=u.gpgcheck=0 \
--available | wc -l

View file

@ -29,6 +29,6 @@ jobs:
persist-credentials: false
- name: Run zizmor
uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1
uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
with:
persona: auditor

View file

@ -4,8 +4,6 @@ echo "::group:: ===$(basename "$0")==="
set -ouex pipefail
dnf makecache --refresh
# Prevent partial upgrading, major kde version updates black screened
# https://github.com/ublue-os/aurora/issues/1227
dnf versionlock add "qt6-*" "plasma-desktop"
@ -41,6 +39,7 @@ FEDORA_PACKAGES=(
distrobox
evtest
fastfetch
fcitx5-{chewing,chinese-addons,configtool,gtk,hangul,libthai,m17n,mozc,qt,sayura,unikey}
fish
flatpak-spawn
foo2zjs
@ -66,6 +65,7 @@ FEDORA_PACKAGES=(
iwd
just
kate{-krunner-plugin,-plugins}
kcm-fcitx5
fzf # for just
krb5-workstation
ksystemlog
@ -84,6 +84,7 @@ FEDORA_PACKAGES=(
pamu2fcfg
plasma-firewall-"${PLASMA_VERS}"
plasma-oxygen
plasma-union-"${PLASMA_VERS}"
# TODO: look into removing this, plasma supports the transition feature of this natively
plasma-wallpapers-dynamic-builder
plasma-wallpapers-dynamic-builder{-bash,-fish,-zsh}-completion
@ -153,7 +154,7 @@ TERRA_PACKAGES=(
# Fedora Tailscale is usually behind
TAILSCALE=(tailscale)
dnf-retry -y install --from-repo="terra" "${TERRA_PACKAGES[@]}"
dnf -y install --from-repo="terra" "${TERRA_PACKAGES[@]}"
COPR_PREFIX="copr:copr.fedorainfracloud.org"

View file

@ -20,9 +20,6 @@ KERNEL_PKGS=(
/tmp/kernel-rpms/kernel-modules-*.rpm
)
# Quine: arm64's stand-in akmods image (.forgejo/akmods-arm64.sh) has no
# kmods; without nullglob an unmatched pattern stays literal and fails dnf.
shopt -s nullglob
KMODS=(
/tmp/rpms/{common,kmods}/*xone*.rpm
/tmp/rpms/{common,kmods}/*v4l2loopback*.rpm

View file

@ -27,6 +27,5 @@ dnf config-manager disable fedora-cisco-openh264
mkdir -p /tmp/scripts/helpers
install -Dm0755 /ctx/build_scripts/shared/utils/ghcurl /tmp/scripts/helpers/ghcurl
install -Dm0755 /ctx/build_scripts/shared/utils/dnf-retry /tmp/scripts/helpers/dnf-retry
echo "::endgroup::"

View file

@ -1,16 +0,0 @@
#!/usr/bin/env bash
set -euo pipefail
tries=5
sleep=60
for i in $(seq 1 "${tries}"); do
if [[ ${i} -gt 1 ]]; then
# echo "[+] Command failed. Waiting for ${sleep} seconds"
sleep "${sleep}"
fi
# echo "[+] Running (try: ${i}): dnf ${*}"
dnf "${@}" && r=0 && break || r=$?
done
exit "$r"

View file

@ -3,19 +3,19 @@ images:
- name: kinoite
image: quay.io/fedora-ostree-desktops/kinoite
tag: 45
digest: sha256:45c510bf901b9f01fd7f5c4f48837156987c37ac968cc19b2d382ea13b318906
digest: sha256:2a1fea9adbd27dd87935508115d88ab5c7b335114e32994e7c2c615545ea5cac
# https://github.com/get-aurora-dev/common
- name: common
image: ghcr.io/get-aurora-dev/common
tag: latest
digest: sha256:df4929bb819cef47653dd7dd2386a926f9dd3e63bf451c183be4adb893db44e9
digest: sha256:2888e957bd72e1656c8de374bbfa3a933c19aad82dccd0994bd1766e03973ff1
# https://github.com/ublue-os/brew
- name: brew
image: ghcr.io/ublue-os/brew
tag: latest
digest: sha256:130848582eed433e85af6fa8c829ddec12ddaa6b18bc037a610b4b8da3c97458
digest: sha256:0c9703f1a49faa89a44d9458a68c0ca03270e8bdd32018285dad8b14ddd7cdc3
# https://github.com/coreos/chunkah
- name: chunkah