build-arm64.yml: run natively on runner-arm64-linux, daily

The new arm64 runner (a Tart VM on the Mac mini) builds it at native
speed, so it runs daily like build.yml, an hour after it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/akmods-arm64.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Stands in for ghcr.io/ublue-os/akmods on arm64, which upstream doesn't
+# build: an image with the akmods image's layout (/kernel-rpms, /rpms/common,
+# /rpms/kmods), holding Fedora's own aarch64 kernel from Koji and no extra
+# kmods (so no xone or v4l2loopback on arm64). Pushed where the runner's
+# registries.conf looks first for ghcr.io/ublue-os/akmods (the mirror), so
+# Containerfile.in's `FROM ghcr.io/ublue-os/akmods:...` finds it.
+#
+# Usage: akmods-arm64.sh FLAVOR FEDORA KERNEL
+#   e.g. akmods-arm64.sh main 45 7.2.14-300.fc45.aarch64
+# Needs a `podman login` to the forge first.
+set -euo pipefail
+
+flavor=$1 fedora=$2 kernel=$3
+mirror=${MIRROR:-forge.quinefoundation.com/quine-global-labs/mirror}
+ref="$mirror/ghcr.io/ublue-os/akmods:$flavor-$fedora-$kernel"
+
+nvr=${kernel%.aarch64}          # 7.2.14-300.fc45
+version=${nvr%%-*}              # 7.2.14
+release=${nvr#*-}               # 300.fc45
+koji="https://kojipkgs.fedoraproject.org/packages/kernel/$version/$release/aarch64"
+
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+mkdir -p "$work/kernel-rpms" "$work/rpms/common" "$work/rpms/kmods"
+for pkg in kernel kernel-core kernel-modules kernel-modules-core kernel-modules-extra; do
+  curl -fsSL --retry 5 -o "$work/kernel-rpms/$pkg-$nvr.aarch64.rpm" "$koji/$pkg-$nvr.aarch64.rpm"
+done
+ls -l "$work/kernel-rpms"
+# Empty directories, so the bind mounts of /rpms/* have something to mount.
+touch "$work/rpms/common/.keep" "$work/rpms/kmods/.keep"
+
+ctr=$(buildah from --arch arm64 --os linux scratch)
+trap 'buildah rm "$ctr" >/dev/null; rm -rf "$work"' EXIT
+buildah copy "$ctr" "$work/kernel-rpms" /kernel-rpms
+buildah copy "$ctr" "$work/rpms" /rpms
+buildah config --arch arm64 --os linux --label "ostree.linux=$kernel" "$ctr"
+buildah commit --rm "$ctr" "$ref"
+trap 'rm -rf "$work"' EXIT
+podman push --retry 5 "$ref"
+echo "pushed $ref"

.forgejo/buildah-arm64

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# `buildah`, but `buildah build` builds for linux/arm64: build-arm64.yml runs
+# `just BUILDAH=.../buildah-arm64 build`, so the Justfile stays upstream's.
+# A no-op on an arm64 runner; on an x86_64 one (runner-x86-linux) the arm64
+# steps run under QEMU user emulation.
+if [[ ${1:-} == build ]]; then
+  shift
+  exec buildah build --platform linux/arm64 "$@"
+fi
+exec buildah "$@"

.forgejo/upload-rpms.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Uploads the RPMs a build downloaded (its dnf cache, kept by
+# Containerfile.in's cache mounts) to this forge's RPM registry, one group
+# per upstream repository: fedora, updates, terra, copr-ublue-os-packages...
+# Each group is a dnf repository at
+# https://forge.quinefoundation.com/api/packages/quine-global-labs/rpm/<group>.
+#
+# Usage: upload-rpms.sh CACHE_DIR   (a libdnf5 cache: one directory per
+# repository, <repo id>-<hash>/packages/*.rpm)
+#
+# Needs REGISTRY_USER and REGISTRY_TOKEN (package write access). Packages
+# the registry already has are skipped (409). Best effort: a failed upload
+# is a warning, not a failure.
+set -euo pipefail
+
+cache=$1
+api=${RPM_API:-https://forge.quinefoundation.com/api/packages/quine-global-labs/rpm}
+
+# The token goes to curl in a file, not on its command line.
+netrc=$(mktemp)
+trap 'rm -f "$netrc"' EXIT
+chmod 600 "$netrc"
+printf 'machine %s login %s password %s\n' \
+  "$(sed -E 's|^https?://([^/]+).*|\1|' <<<"$api")" "$REGISTRY_USER" "$REGISTRY_TOKEN" >"$netrc"
+
+upload() { # group rpm
+  local code
+  code=$(curl -sS -o /dev/null -w '%{http_code}' --retry 3 --netrc-file "$netrc" \
+    --upload-file "$2" "$api/$1/upload") || code=000
+  case $code in
+    201) echo "new $1 ${2##*/}" ;;
+    409) echo "had $1 ${2##*/}" ;;
+    *) echo "::warning::$code uploading ${2##*/} to $1" ;;
+  esac
+}
+export -f upload
+export api netrc
+
+for dir in "$cache"/*/; do
+  id=$(basename "$dir")
+  id=${id%-*} # the hash libdnf5 appends
+  [[ $id == @* ]] && continue # @commandline: local files, not a repository
+  # copr:copr.fedorainfracloud.org:ublue-os:packages -> copr-ublue-os-packages
+  group=$(sed -E 's/^copr:[^:]+:/copr-/; s/:/-/g' <<<"$id")
+  find "$dir" -name '*.rpm' -printf "$group\0%p\0"
+done | xargs -0 -n 2 -P 4 bash -c 'upload "$@"' _ |
+  tee /dev/stderr | awk '{n[$1]++} END {for (k in n) printf "%s: %d\n", k, n[k]}'

.forgejo/vendor-images.sh

@@ -15,12 +15,18 @@ set -uo pipefail
 
 mirror=${MIRROR:-forge.quinefoundation.com/quine-global-labs/mirror}
 # Read from upstream itself, not from the mirror registries.conf points at.
-export CONTAINERS_REGISTRIES_CONF=/dev/null
+# The flag, not CONTAINERS_REGISTRIES_CONF: podman and buildah read that
+# variable, but skopeo never has. Until 2026-11-03 this exported it, skopeo
+# read the mirror, and every run copied the mirror onto itself, so tags
+# stayed at their first copy. (runner-x86-linux's skopeo now honors the
+# variable too; petersweb-infra, hosts/runner-x86-linux.)
+skopeo() { command skopeo --registries-conf /dev/null "$@"; }
 
 for ref in "$@"; do
   src="docker://$ref"
   dest="docker://$mirror/$ref"
-  opts=(--multi-arch system)
+  # Every architecture: build-arm64.yml pulls the arm64 halves.
+  opts=(--multi-arch all)
   if [[ $ref == *@sha256:* ]]; then
     # Pinned by digest: copy the whole index unchanged, so the digest the
     # build asks for exists on the mirror. skopeo refuses a reference with

.forgejo/workflows/build-arm64.yml

@@ -0,0 +1,125 @@
+name: Build Aurora (arm64)
+
+# Builds Aurora for arm64 from this tree and pushes it as
+# forge.quinefoundation.com/quine-global-labs/aurora:stable-arm64 (plus
+# stable-arm64-<date>). quine-global-labs/quine-linux's arm64 build is FROM
+# it. A separate tag, not part of `stable`: build.yml pushes `stable` (amd64)
+# daily and would drop an arm64 half each time.
+#
+# Upstream doesn't ship arm64 Aurora yet, and has no arm64 akmods, which is
+# also where Aurora's kernel comes from. So this build uses Fedora's own
+# aarch64 kernel, the one Kinoite ships, from a stand-in akmods image
+# (.forgejo/akmods-arm64.sh), with no extra kmods.
+#
+# Runs natively on runner-arm64-linux (petersweb-infra, a Tart VM on the Mac
+# mini), daily, an hour after build.yml. It builds this repo's main as
+# build.yml last merged it, without merging upstream itself. (Until
+# 2026-11-04 it ran weekly under QEMU emulation on runner-x86-linux; it
+# still works there, slowly, through buildah-arm64.)
+#
+# Secret: REGISTRY_TOKEN, as build.yml. Variable (optional): REGISTRY_USER.
+on:
+  schedule:
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+
+concurrency:
+  group: aurora-arm64-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REGISTRY: forge.quinefoundation.com
+  MIRRORS: https://forge.quinefoundation.com/quine-global-labs
+  IMAGE: forge.quinefoundation.com/quine-global-labs/aurora
+  TAG: stable
+
+jobs:
+  build:
+    runs-on: runner-arm64-linux
+    timeout-minutes: 300
+    steps:
+      - uses: https://forge.quinefoundation.com/quine-global-labs/mirror-actions-checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Build main as it is now
+        # A scheduled run checks out the commit its schedule was registered
+        # at, which can be behind main (see build.yml).
+        if: github.event_name == 'schedule'
+        run: |
+          git fetch --no-tags origin main
+          git checkout -B main FETCH_HEAD
+
+      - name: Point downloads at our mirrors
+        # As build.yml.
+        run: |
+          files=$(grep -rlE 'github(usercontent)?\.com/(ublue-os/(akmods|countme)|rcaloras/bash-preexec|coreos/fedora-coreos-config)/' build_scripts)
+          sed -i -E \
+            -e "s#https://github\.com/ublue-os/akmods/raw/refs/heads/([^/]+)/#$MIRRORS/mirror-ublue-os-akmods/raw/branch/\1/#g" \
+            -e "s#https://raw\.githubusercontent\.com/ublue-os/countme/([^/]+)/#$MIRRORS/mirror-ublue-os-countme/raw/branch/\1/#g" \
+            -e "s#https://raw\.githubusercontent\.com/rcaloras/bash-preexec/([0-9a-f]{40})/#$MIRRORS/mirror-rcaloras-bash-preexec/raw/commit/\1/#g" \
+            -e "s#https://raw\.githubusercontent\.com/coreos/fedora-coreos-config/refs/heads/([^/]+)/#$MIRRORS/mirror-coreos-fedora-coreos-config/raw/branch/\1/#g" \
+            $files
+          git update-index --skip-worktree $files
+
+      - name: Adapt the build scripts to arm64
+        # 01-packages.sh: drop what Fedora builds for x86_64 only. Checked
+        # against Fedora 44 + negativo17's aarch64 repos (2026-11-04): just
+        # intel-compute-runtime.
+        # 19-initramfs.sh: it asks rpm for kmod-v4l2loopback's files, which
+        # fails without the package, and the stand-in akmods has no kmods.
+        # "none" keeps dracut's --remove argument in place, naming no module.
+        run: |
+          sed -i -E '/^[[:space:]]*intel-compute-runtime[[:space:]]*$/d' build_scripts/base/01-packages.sh
+          sed -i 's|^V4L2_PATH="$(rpm -ql kmod-v4l2loopback)"$|V4L2_PATH="$(rpm -q --quiet kmod-v4l2loopback \&\& rpm -ql kmod-v4l2loopback \|\| echo none)"|' build_scripts/base/19-initramfs.sh
+          grep -q 'echo none' build_scripts/base/19-initramfs.sh
+          git update-index --skip-worktree build_scripts/base/01-packages.sh build_scripts/base/19-initramfs.sh
+
+      - name: Log in to the registry
+        env:
+          REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: printf %s "$REGISTRY_TOKEN" | podman login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+
+      - name: Vendor upstream images, and the arm64 akmods stand-in
+        run: |
+          org=$(just --evaluate base_image_org)
+          name=$(just --evaluate base_image_name)
+          ver=$(just fedora_version --image aurora --tag "$TAG" --flavor main)
+          flavor=$(just akmods_flavor --tag "$TAG")
+          mapfile -t pinned < <(yq -r '.images[] | select(.name != "kinoite") | "\(.image):\(.tag)@\(.digest)"' image-versions.yml)
+          .forgejo/vendor-images.sh "$org/$name:$ver" "${pinned[@]}"
+          # The kernel Kinoite's arm64 image ships.
+          kernel=$(skopeo --registries-conf /dev/null inspect --override-arch arm64 --override-os linux \
+                     --no-tags --retry-times 3 "docker://$org/$name:$ver" | jq -er '.Labels["ostree.linux"]')
+          echo "kernel: $kernel"
+          # Quay's tag has been single-arch (amd64) for a while mid-publish.
+          [[ $kernel == *.aarch64 ]] || { echo "::error::$org/$name:$ver has no arm64 image right now (kernel $kernel); try again later"; exit 1; }
+          echo "KERNEL=$kernel" >>"$GITHUB_ENV"
+          .forgejo/akmods-arm64.sh "$flavor" "$ver" "$kernel"
+
+      - name: Build
+        # As build.yml, through a buildah that builds for linux/arm64, with
+        # the kernel pinned to the stand-in's.
+        run: >-
+          env -u GITHUB_TOKEN
+          GITHUB_REPOSITORY_OWNER=ublue-os
+          GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0='*'
+          just BUILDAH="$PWD/.forgejo/buildah-arm64"
+          build --image aurora --tag "$TAG" --flavor main --kernel-pin "$KERNEL"
+
+      - name: Push
+        run: |
+          podman image inspect --format '{{.Architecture}}' "localhost/aurora:$TAG"
+          for t in "$TAG-arm64" "$TAG-arm64-$(date -u +%Y%m%d)"; do
+            podman tag "localhost/aurora:$TAG" "$IMAGE:$t"
+            podman push --retry 5 "$IMAGE:$t"
+          done
+
+      - name: Clean up
+        if: always()
+        # The runner's hourly sweep keeps a day of images; this build's are
+        # done with now.
+        run: |
+          podman logout "$REGISTRY" || true
+          podman image prune -af >/dev/null || true

.forgejo/workflows/build.yml

@@ -13,7 +13,9 @@ name: Build Aurora
 #
 # Upstream images (Kinoite, akmods, and image-versions.yml's) are vendored
 # into forge.quinefoundation.com/quine-global-labs/mirror/ first, and the
-# build pulls them from there (.forgejo/vendor-images.sh).
+# build pulls them from there (.forgejo/vendor-images.sh). After the push,
+# the RPMs the build downloaded go to the forge's RPM registry, a group per
+# upstream repository (.forgejo/upload-rpms.sh).
 #
 # Secret: REGISTRY_TOKEN, a Forgejo token with package write access.
 # Variable (optional): REGISTRY_USER, the token's owner (default: the actor).
@@ -57,6 +59,11 @@ jobs:
         run: |
           git config user.name "forgejo-actions"
           git config user.email "actions@forge.quinefoundation.com"
+          # A scheduled run checks out the commit its schedule was registered
+          # at, the last push without [skip ci], which can be behind main:
+          # merge onto main as it is now, or the push below is rejected.
+          git fetch --no-tags origin main
+          git checkout -B main FETCH_HEAD
           # Our pull mirror of github.com/ublue-os/aurora, synced hourly.
           git fetch --no-tags "$MIRRORS/mirror-ublue-os-aurora.git" main
           before=$(git rev-parse HEAD)
@@ -104,7 +111,7 @@ jobs:
           ver=$(just fedora_version --image aurora --tag "$TAG" --flavor main)
           akmods=ghcr.io/ublue-os/akmods:$(just akmods_flavor --tag "$TAG")-$ver
           refs=("$org/$name:$ver" "$akmods")
-          if kernel=$(CONTAINERS_REGISTRIES_CONF=/dev/null skopeo inspect --no-tags --retry-times 3 "docker://$akmods" | jq -er '.Labels["ostree.linux"]'); then
+          if kernel=$(skopeo --registries-conf /dev/null inspect --no-tags --retry-times 3 "docker://$akmods" | jq -er '.Labels["ostree.linux"]'); then
             refs+=("$akmods-$kernel")
           fi
           mapfile -t pinned < <(yq -r '.images[] | select(.name != "kinoite") | "\(.image):\(.tag)@\(.digest)"' image-versions.yml)
@@ -130,6 +137,25 @@ jobs:
             podman push --retry 5 "$IMAGE:$t"
           done
 
-      - name: Log out
+      - name: Upload the build's RPMs
+        # From the dnf cache Containerfile.in's cache mounts keep (buildah
+        # keeps it on the runner, under /var/tmp/buildah-cache-0), to
+        # https://forge.quinefoundation.com/api/packages/quine-global-labs/rpm/<group>.
+        # Packages already there are skipped. Never fails the build.
+        continue-on-error: true
+        env:
+          REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          fedora=$(ls -d /var/tmp/buildah-cache-0/*/fedora-*/ 2>/dev/null | head -1)
+          [ -n "$fedora" ] || { echo "::warning::no dnf cache under /var/tmp/buildah-cache-0"; exit 0; }
+          .forgejo/upload-rpms.sh "$(dirname "$fedora")"
+
+      - name: Clean up
         if: always()
-        run: podman logout "$REGISTRY" || true
+        # The runner's hourly sweep keeps a day of images; this build's are
+        # done with now (quine-linux pulls the pushed image from the forge).
+        # `image prune` leaves the dnf cache the RPM upload reads.
+        run: |
+          podman logout "$REGISTRY" || true
+          podman image prune -af >/dev/null || true

.github/workflows/zizmor.yml

@@ -29,6 +29,6 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
+        uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1
         with:
           persona: auditor

build_scripts/base/01-packages.sh

@@ -4,6 +4,8 @@ echo "::group:: ===$(basename "$0")==="
 
 set -ouex pipefail
 
+dnf makecache --refresh
+
 # Prevent partial upgrading, major kde version updates black screened
 # https://github.com/ublue-os/aurora/issues/1227
 dnf versionlock add "qt6-*" "plasma-desktop"
@@ -39,7 +41,6 @@ FEDORA_PACKAGES=(
     distrobox
     evtest
     fastfetch
-    fcitx5-{chewing,chinese-addons,configtool,gtk,hangul,libthai,m17n,mozc,qt,sayura,unikey}
     fish
     flatpak-spawn
     foo2zjs
@@ -65,7 +66,6 @@ FEDORA_PACKAGES=(
     iwd
     just
     kate{-krunner-plugin,-plugins}
-    kcm-fcitx5
     fzf # for just
     krb5-workstation
     ksystemlog
@@ -84,7 +84,6 @@ FEDORA_PACKAGES=(
     pamu2fcfg
     plasma-firewall-"${PLASMA_VERS}"
     plasma-oxygen
-    plasma-union-"${PLASMA_VERS}"
     # TODO: look into removing this, plasma supports the transition feature of this natively
     plasma-wallpapers-dynamic-builder
     plasma-wallpapers-dynamic-builder{-bash,-fish,-zsh}-completion
@@ -154,7 +153,7 @@ TERRA_PACKAGES=(
 # Fedora Tailscale is usually behind
 TAILSCALE=(tailscale)
 
-dnf -y install --from-repo="terra" "${TERRA_PACKAGES[@]}"
+dnf-retry -y install --from-repo="terra" "${TERRA_PACKAGES[@]}"
 
 COPR_PREFIX="copr:copr.fedorainfracloud.org"
 

build_scripts/base/02-install-common-kernel-akmods.sh

@@ -20,6 +20,9 @@ KERNEL_PKGS=(
   /tmp/kernel-rpms/kernel-modules-*.rpm
 )
 
+# Quine: arm64's stand-in akmods image (.forgejo/akmods-arm64.sh) has no
+# kmods; without nullglob an unmatched pattern stays literal and fails dnf.
+shopt -s nullglob
 KMODS=(
   /tmp/rpms/{common,kmods}/*xone*.rpm
   /tmp/rpms/{common,kmods}/*v4l2loopback*.rpm

build_scripts/shared/build-prep.sh

@@ -27,5 +27,6 @@ dnf config-manager disable fedora-cisco-openh264
 
 mkdir -p /tmp/scripts/helpers
 install -Dm0755 /ctx/build_scripts/shared/utils/ghcurl /tmp/scripts/helpers/ghcurl
+install -Dm0755 /ctx/build_scripts/shared/utils/dnf-retry /tmp/scripts/helpers/dnf-retry
 
 echo "::endgroup::"

build_scripts/shared/utils/dnf-retry

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+tries=5
+sleep=60
+
+for i in $(seq 1 "${tries}"); do
+    if [[ ${i} -gt 1 ]]; then
+        # echo "[+] Command failed. Waiting for ${sleep} seconds"
+        sleep "${sleep}"
+    fi
+    # echo "[+] Running (try: ${i}): dnf ${*}"
+    dnf "${@}" && r=0 && break || r=$?
+done
+exit "$r"
+

image-versions.yml

@@ -3,19 +3,19 @@ images:
   - name: kinoite
     image: quay.io/fedora-ostree-desktops/kinoite
     tag: 45
-    digest: sha256:2a1fea9adbd27dd87935508115d88ab5c7b335114e32994e7c2c615545ea5cac
+    digest: sha256:45c510bf901b9f01fd7f5c4f48837156987c37ac968cc19b2d382ea13b318906
 
   # https://github.com/get-aurora-dev/common
   - name: common
     image: ghcr.io/get-aurora-dev/common
     tag: latest
-    digest: sha256:2888e957bd72e1656c8de374bbfa3a933c19aad82dccd0994bd1766e03973ff1
+    digest: sha256:df4929bb819cef47653dd7dd2386a926f9dd3e63bf451c183be4adb893db44e9
 
   # https://github.com/ublue-os/brew
   - name: brew
     image: ghcr.io/ublue-os/brew
     tag: latest
-    digest: sha256:0c9703f1a49faa89a44d9458a68c0ca03270e8bdd32018285dad8b14ddd7cdc3
+    digest: sha256:130848582eed433e85af6fa8c829ddec12ddaa6b18bc037a610b4b8da3c97458
 
   # https://github.com/coreos/chunkah
   - name: chunkah