quine-global-labs/aurora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
aurora/Justfile
renner 50ba0fcd2d
fix(ci): be smarter about DNF package caching (#1952) 
Currently we are very inefficient with our cache usage as every image
has it's own cache where most of the packages are the same across
variants anyway. See 973333f.

This should fix a couple problems around this as we are now also
considering the Fedora version in the cache key and only allowing one
blessed image to create cache. Which is why I decided to implement this
into the Justfile even tho this is only needed when running from github
as it just makes things easier to troubleshoot.

aurora-dx makes the most sense here as that is the heaviest image. We
don't need a separate nvidia image cache as the biggest RPMs exclusive
to that variant are cached in akmods anyway and don't have to be
downloaded.

Only allowing cache to be created at all on workflow_dispatch and on
schedule happens to go hand in hand with the limitation/design of the
cache action as we only build images from the main branch in those two
cases, rest is merge queue, which also happens to address the
"infighting" across stable and latest builds when they kick off at the
same time.

This should make it easier going forward especially when we take future
possible ARM, testing images or any other reason for our matrix to get
bigger into consideration.
2026-03-23 17:26:57 +00:00

753 lines
27 KiB
Makefile
Raw Blame History

export repo_organization := env("GITHUB_REPOSITORY_OWNER", "ublue-os")
export base_image_org := env("BASE_IMAGE_ORG", "quay.io/fedora-ostree-desktops")
export base_image_name := env("BASE_IMAGE_NAME", "kinoite")
export common_image := env("COMMON_IMAGE", "ghcr.io/get-aurora-dev/common:latest")
export brew_image := env("BREW_IMAGE", "ghcr.io/ublue-os/brew:latest")
rechunker_image := "ghcr.io/ublue-os/legacy-rechunk:v1.0.1-x86_64@sha256:2627cbf92ca60ab7372070dcf93b40f457926f301509ffba47a04d6a9e1ddaf7"
stable_version := "43"
latest_version := "43"
beta_version := "44"
images := '(
[aurora]=aurora
[aurora-dx]=aurora-dx
)'
flavors := '(
[main]=main
[nvidia-open]=nvidia-open
)'
tags := '(
[stable]=stable
[latest]=latest
[beta]=beta
)'
export SUDO_DISPLAY := if `if [ -n "${DISPLAY:-}" ] || [ -n "${WAYLAND_DISPLAY:-}" ]; then echo true; fi` == "true" { "true" } else { "false" }
export SUDOIF := if `id -u` == "0" { "" } else { "sudo" }
export PODMAN := if path_exists("/usr/bin/podman") == "true" { env("PODMAN", "/usr/bin/podman") } else if path_exists("/usr/bin/docker") == "true" { env("PODMAN", "docker") } else { env("PODMAN", "exit 1 ; ") }
export PULL_POLICY := if PODMAN =~ "docker" { "missing" } else { "newer" }
just := just_executable()
[private]
default:
@{{ just }} --list
# Check Just Syntax
[group('Just')]
check:
#!/usr/bin/bash
find . -type f -name "*.just" | while read -r file; do
echo "Checking syntax: $file"
{{ just }} --unstable --fmt --check -f $file
done
echo "Checking syntax: Justfile"
{{ just }} --unstable --fmt --check -f Justfile
# Fix Just Syntax
[group('Just')]
fix:
#!/usr/bin/bash
find . -type f -name "*.just" | while read -r file; do
echo "Checking syntax: $file"
{{ just }} --unstable --fmt -f $file
done
echo "Checking syntax: Justfile"
{{ just }} --unstable --fmt -f Justfile || { exit 1; }
# Clean Repo
[group('Utility')]
clean:
#!/usr/bin/bash
set -eoux pipefail
touch _build
find *_build* -exec rm -rf {} \;
rm -f previous.manifest.json
rm -f changelog.md
rm -f output.env
# Check if valid combo
[group('Utility')]
[private]
validate $image $tag $flavor:
#!/usr/bin/bash
set -eou pipefail
declare -A images={{ images }}
declare -A tags={{ tags }}
declare -A flavors={{ flavors }}
# Handle Stable Daily
if [[ "${tag}" == "stable-daily" ]]; then
tag="stable"
fi
checkimage="${images[${image}]-}"
checktag="${tags[${tag}]-}"
checkflavor="${flavors[${flavor}]-}"
# Validity Checks
if [[ -z "$checkimage" ]]; then
echo "Invalid Image..."
exit 1
fi
if [[ -z "$checktag" ]]; then
echo "Invalid tag..."
exit 1
fi
if [[ -z "$checkflavor" ]]; then
echo "Invalid flavor..."
exit 1
fi
# Build Image
[group('Image')]
build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline="0" $kernel_pin="":
#!/usr/bin/bash
echo "::group:: Build Prep"
set -eoux pipefail
# Validate
{{ just }} validate "${image}" "${tag}" "${flavor}"
# Image Name
image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }})
common_image_sha=$(yq -r '.images[] | select(.name == "common") | .digest' image-versions.yml)
brew_image_sha=$(yq -r '.images[] | select(.name == "brew") | .digest' image-versions.yml)
# AKMODS Flavor and Kernel Version
if [[ "${tag}" =~ stable ]]; then
akmods_flavor="coreos-stable"
elif [[ "${tag}" =~ beta ]]; then
akmods_flavor="main"
else
akmods_flavor="main"
fi
# Fedora Version
if [[ {{ ghcr }} == "0" ]]; then
rm -f /tmp/manifest.json
fi
fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}')
# Verify Base Image with cosign
{{ just }} verify-container quay.io-fedora-ostree-desktops.pub ${base_image_org}/${base_image_name}:${fedora_version}
# Kernel Release/Pin
if [[ -z "${kernel_pin:-}" ]]; then
kernel_release=$(skopeo inspect --retry-times 3 docker://ghcr.io/ublue-os/akmods:"${akmods_flavor}"-"${fedora_version}" | jq -r '.Labels["ostree.linux"]')
else
kernel_release="${kernel_pin}"
fi
# Verify Containers with Cosign
{{ just }} verify-container cosign.pub "ghcr.io/ublue-os/akmods:${akmods_flavor}-${fedora_version}-${kernel_release}"
if [[ "${akmods_flavor}" =~ coreos ]]; then
{{ just }} verify-container cosign.pub "ghcr.io/ublue-os/akmods-zfs:${akmods_flavor}-${fedora_version}-${kernel_release}"
fi
if [[ "${flavor}" =~ nvidia-open ]]; then
{{ just }} verify-container cosign.pub "ghcr.io/ublue-os/akmods-nvidia-open:${akmods_flavor}-${fedora_version}-${kernel_release}"
fi
{{ just }} verify-container ghcr.io-get-aurora-dev.pub "ghcr.io/get-aurora-dev/common:latest@${common_image_sha}"
{{ just }} verify-container cosign.pub "ghcr.io/ublue-os/brew:latest@${brew_image_sha}"
# Get Version
if [[ "${tag}" =~ stable ]]; then
ver="${fedora_version}.$(date +%Y%m%d)"
else
ver="${tag}-${fedora_version}.$(date +%Y%m%d)"
fi
skopeo list-tags docker://ghcr.io/{{ repo_organization }}/${image_name} > /tmp/repotags.json
if [[ $(jq "any(.Tags[]; contains(\"$ver\"))" < /tmp/repotags.json) == "true" ]]; then
POINT="1"
while $(jq -e "any(.Tags[]; contains(\"$ver.$POINT\"))" < /tmp/repotags.json)
do
(( POINT++ ))
done
fi
if [[ -n "${POINT:-}" ]]; then
ver="${ver}.$POINT"
fi
# Build Arguments
BUILD_ARGS=()
# Target
if [[ "${image}" =~ dx ]]; then
BUILD_ARGS+=("--build-arg" "IMAGE_FLAVOR=dx")
target="dx"
fi
BUILD_ARGS+=("--build-arg" "AKMODS_FLAVOR=${akmods_flavor}")
BUILD_ARGS+=("--build-arg" "BASE_IMAGE_ORG=${base_image_org}")
BUILD_ARGS+=("--build-arg" "BASE_IMAGE_NAME=${base_image_name}")
BUILD_ARGS+=("--build-arg" "FEDORA_MAJOR_VERSION=${fedora_version}")
BUILD_ARGS+=("--build-arg" "COMMON_IMAGE={{ common_image }}")
BUILD_ARGS+=("--build-arg" "COMMON_IMAGE_SHA=${common_image_sha}")
BUILD_ARGS+=("--build-arg" "BREW_IMAGE={{ brew_image }}")
BUILD_ARGS+=("--build-arg" "BREW_IMAGE_SHA=${brew_image_sha}")
BUILD_ARGS+=("--build-arg" "IMAGE_NAME=${image_name}")
BUILD_ARGS+=("--build-arg" "IMAGE_VENDOR={{ repo_organization }}")
BUILD_ARGS+=("--build-arg" "KERNEL=${kernel_release}")
BUILD_ARGS+=("--build-arg" "VERSION=${ver}")
if [[ -z "$(git status -s)" ]]; then
BUILD_ARGS+=("--build-arg" "SHA_HEAD_SHORT=$(git rev-parse --short HEAD)")
fi
BUILD_ARGS+=("--build-arg" "UBLUE_IMAGE_TAG=${tag}")
if [[ "${PODMAN}" =~ docker && "${TERM}" == "dumb" ]]; then
BUILD_ARGS+=("--progress" "plain")
fi
# Pull in most recent upstream base image
# if building locally/not ghcr pull the new image
if [[ {{ ghcr }} == "0" ]]; then
${PODMAN} pull "${base_image_org}/${base_image_name}:${fedora_version}"
fi
# Labels
LABELS=()
LABELS+=("--label" "org.opencontainers.image.title=${image_name}")
LABELS+=("--label" "org.opencontainers.image.version=${ver}")
LABELS+=("--label" "ostree.linux=${kernel_release}")
LABELS+=("--label" "io.artifacthub.package.readme-url=https://raw.githubusercontent.com/ublue-os/aurora/refs/heads/main/README.md")
LABELS+=("--label" "io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4")
LABELS+=("--label" "org.opencontainers.image.description=The ultimate productivity workstation")
LABELS+=("--label" "containers.bootc=1")
LABELS+=("--label" "org.opencontainers.image.created=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)")
LABELS+=("--label" "org.opencontainers.image.source=https://raw.githubusercontent.com/ublue-os/aurora/refs/heads/main/Containerfile")
LABELS+=("--label" "org.opencontainers.image.url=https://getaurora.dev")
LABELS+=("--label" "org.opencontainers.image.vendor={{ repo_organization }}")
LABELS+=("--label" "io.artifacthub.package.deprecated=false")
LABELS+=("--label" "io.artifacthub.package.keywords=bootc,fedora,aurora,ublue,universal-blue")
LABELS+=("--label" "io.artifacthub.package.maintainers=[{\"name\": \"NiHaiden\", \"email\": \"me@nhaiden.io\"}]")
echo "::endgroup::"
case "${akmods_flavor}" in
"coreos-stable") BUILD_ARGS+=("--cpp-flag=-DZFS") ;;
esac
if [[ "${image_name}" =~ nvidia ]]; then
BUILD_ARGS+=("--cpp-flag=-DNVIDIA")
fi
PODMAN_BUILD_ARGS=("${BUILD_ARGS[@]}" "${LABELS[@]}" --tag localhost/"${image_name}:${tag}" --file Containerfile.in)
# Add GitHub token secret if available (for CI/CD)
if [[ -n "${GITHUB_TOKEN:-}" ]]; then
echo "Adding GitHub token as build secret"
PODMAN_BUILD_ARGS+=(--secret "id=GITHUB_TOKEN,env=GITHUB_TOKEN")
else
echo "No GitHub token found - build may hit rate limit"
fi
${PODMAN} build "${PODMAN_BUILD_ARGS[@]}" .
echo "::endgroup::"
# Rechunk the image if we are running inside ghcr or set the variable locally
if [[ "{{ rechunk }}" == "1" && "{{ ghcr }}" == "1" && "{{ pipeline }}" == "1" ]]; then
${SUDOIF} {{ just }} rechunk "${image}" "${tag}" "${flavor}" 1 1
elif [[ "{{ rechunk }}" == "1" && "{{ ghcr }}" == "1" ]]; then
${SUDOIF} {{ just }} rechunk "${image}" "${tag}" "${flavor}" 1
elif [[ "{{ rechunk }}" == "1" ]]; then
${SUDOIF} {{ just }} rechunk "${image}" "${tag}" "${flavor}"
fi
# Build Image and Rechunk
[group('Image')]
build-rechunk image="aurora" tag="latest" flavor="main" kernel_pin="":
@{{ just }} build {{ image }} {{ tag }} {{ flavor }} 1 0 0 {{ kernel_pin }}
# Build Image with GHCR Flag
[group('Image')]
build-ghcr image="aurora" tag="latest" flavor="main" kernel_pin="":
#!/usr/bin/bash
if [[ "${UID}" -gt "0" ]]; then
echo "Must Run with sudo or as root..."
exit 1
fi
{{ just }} build {{ image }} {{ tag }} {{ flavor }} 0 1 0 {{ kernel_pin }}
# Build Image for Pipeline:
[group('Image')]
build-pipeline image="aurora" tag="latest" flavor="main" kernel_pin="":
#!/usr/bin/bash
${SUDOIF} {{ just }} build {{ image }} {{ tag }} {{ flavor }} 1 1 1 {{ kernel_pin }}
# Rechunk Image
[group('Image')]
[private]
rechunk $image="aurora" $tag="latest" $flavor="main" ghcr="0" pipeline="0":
#!/usr/bin/bash
echo "::group:: Rechunk Prep"
set -eoux pipefail
# Validate
{{ just }} validate "${image}" "${tag}" "${flavor}"
# Image Name
image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }})
# Check if image is already built
ID=$(${PODMAN} images --filter reference=localhost/"${image_name}":"${tag}" --format "'{{ '{{.ID}}' }}'")
if [[ -z "$ID" ]]; then
{{ just }} build "${image}" "${tag}" "${flavor}"
fi
# Load into Rootful Podman
ID=$(${SUDOIF} ${PODMAN} images --filter reference=localhost/"${image_name}":"${tag}" --format "'{{ '{{.ID}}' }}'")
if [[ -z "$ID" && ! ${PODMAN} =~ docker ]]; then
COPYTMP=$(mktemp -p "${PWD}" -d -t podman_scp.XXXXXXXXXX)
${SUDOIF} TMPDIR=${COPYTMP} ${PODMAN} image scp ${UID}@localhost::localhost/"${image_name}":"${tag}" root@localhost::localhost/"${image_name}":"${tag}"
rm -rf "${COPYTMP}"
fi
# Prep Container
CREF=$(${SUDOIF} ${PODMAN} create localhost/"${image_name}":"${tag}" bash)
OLD_IMAGE=$(${SUDOIF} ${PODMAN} inspect $CREF | jq -r '.[].Image')
OUT_NAME="${image_name}_build"
MOUNT=$(${SUDOIF} ${PODMAN} mount "${CREF}")
# Fedora Version
fedora_version=$(${SUDOIF} ${PODMAN} inspect $CREF | jq -r '.[].Config.Labels["ostree.linux"]' | grep -oP 'fc\K[0-9]+')
# Label Version
VERSION=$(${SUDOIF} ${PODMAN} inspect $CREF | jq -r '.[].Config.Labels["org.opencontainers.image.version"]')
# Git SHA
SHA="dedbeef"
if [[ -z "$(git status -s)" ]]; then
SHA=$(git rev-parse HEAD)
fi
# Rest of Labels
LABELS="
io.artifacthub.package.deprecated=false
io.artifacthub.package.keywords=bootc,fedora,aurora,ublue,universal-blue
io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4
io.artifacthub.package.maintainers=[{\"name\": \"NiHaiden\", \"email\": \"me@nhaiden.io\"}]
io.artifacthub.package.readme-url=https://raw.githubusercontent.com/ublue-os/aurora/refs/heads/main/README.md
org.opencontainers.image.created=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)
org.opencontainers.image.license=Apache-2.0
org.opencontainers.image.source=https://raw.githubusercontent.com/ublue-os/aurora/refs/heads/main/Containerfile
org.opencontainers.image.title=${image_name}
org.opencontainers.image.url=https://getaurora.dev
org.opencontainers.image.vendor={{ repo_organization }}
ostree.linux=$(${SUDOIF} ${PODMAN} inspect $CREF | jq -r '.[].Config.Labels["ostree.linux"]')
containers.bootc=1
"
# Cleanup Space during Github Action
if [[ "{{ ghcr }}" == "1" ]]; then
base_image_name=kinoite
if [[ "${tag}" =~ stable ]]; then
tag="stable-daily"
fi
ID=$(${SUDOIF} ${PODMAN} images --filter reference=ghcr.io/{{ repo_organization }}/"${base_image_name}":${fedora_version} --format "{{ '{{.ID}}' }}")
if [[ -n "$ID" ]]; then
${PODMAN} rmi "$ID"
fi
fi
# Rechunk Container
rechunker="{{ rechunker_image }}"
echo "::endgroup::"
echo "::group:: Prune"
# Run Rechunker's Prune
${SUDOIF} ${PODMAN} run --rm \
--pull=${PULL_POLICY} \
--security-opt label=disable \
--volume "$MOUNT":/var/tree \
--env TREE=/var/tree \
--user 0:0 \
"${rechunker}" \
/sources/rechunk/1_prune.sh
echo "::endgroup::"
echo "::group:: Create ostree tree"
# Run Rechunker's Create
${SUDOIF} ${PODMAN} run --rm \
--security-opt label=disable \
--volume "$MOUNT":/var/tree \
--volume "cache_ostree:/var/ostree" \
--env TREE=/var/tree \
--env REPO=/var/ostree/repo \
--env RESET_TIMESTAMP=1 \
--user 0:0 \
"${rechunker}" \
/sources/rechunk/2_create.sh
# Cleanup Temp Container Reference
${SUDOIF} ${PODMAN} unmount "$CREF"
${SUDOIF} ${PODMAN} rm "$CREF"
${SUDOIF} ${PODMAN} rmi "$OLD_IMAGE"
echo "::endgroup::"
echo "::group:: Rechunker"
# Run Rechunker
${SUDOIF} ${PODMAN} run --rm \
--pull=${PULL_POLICY} \
--security-opt label=disable \
--volume "$PWD:/workspace" \
--volume "$PWD:/var/git" \
--volume cache_ostree:/var/ostree \
--env REPO=/var/ostree/repo \
--env PREV_REF=ghcr.io/ublue-os/"${image_name}":"${tag}" \
--env OUT_NAME="$OUT_NAME" \
--env LABELS="${LABELS}" \
--env "DESCRIPTION='The ultimate productivity workstation'" \
--env "VERSION=${VERSION}" \
--env VERSION_FN=/workspace/version.txt \
--env OUT_REF="oci:$OUT_NAME" \
--env GIT_DIR="/var/git" \
--env REVISION="$SHA" \
--user 0:0 \
"${rechunker}" \
/sources/rechunk/3_chunk.sh
# Fix Permissions of OCI
${SUDOIF} find ${OUT_NAME} -type d -exec chmod 0755 {} \; || true
${SUDOIF} find ${OUT_NAME}* -type f -exec chmod 0644 {} \; || true
if [[ "${UID}" -gt "0" ]]; then
${SUDOIF} chown "${UID}:${GROUPS}" -R "${PWD}"
elif [[ -n "${SUDO_UID:-}" ]]; then
chown "${SUDO_UID}":"${SUDO_GID}" -R "${PWD}"
fi
# Remove cache_ostree
${SUDOIF} ${PODMAN} volume rm cache_ostree
echo "::endgroup::"
# Pipeline Checks
if [[ {{ pipeline }} == "1" && -n "${SUDO_USER:-}" ]]; then
sudo -u "${SUDO_USER}" {{ just }} load-rechunk "${image}" "${tag}" "${flavor}"
sudo -u "${SUDO_USER}" {{ just }} secureboot "${image}" "${tag}" "${flavor}"
fi
# Load OCI into Podman Store
[group('Image')]
load-rechunk image="aurora" tag="latest" flavor="main":
#!/usr/bin/bash
set -eou pipefail
# Validate
{{ just }} validate {{ image }} {{ tag }} {{ flavor }}
# Image Name
image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }})
# Load Image
OUT_NAME="${image_name}_build"
IMAGE=$(${PODMAN} pull oci:"${PWD}"/"${OUT_NAME}")
${PODMAN} tag ${IMAGE} localhost/"${image_name}":{{ tag }}
# Cleanup
rm -rf "${OUT_NAME}*"
rm -f previous.manifest.json
# Run Container
[group('Image')]
run $image="aurora" $tag="latest" $flavor="main":
#!/usr/bin/bash
set -eoux pipefail
# Validate
{{ just }} validate "${image}" "${tag}" "${flavor}"
# Image Name
image_name=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }})
# Check if image exists
ID=$(${PODMAN} images --filter reference=localhost/"${image_name}":"${tag}" --format "'{{ '{{.ID}}' }}'")
if [[ -z "$ID" ]]; then
{{ just }} build "$image" "$tag" "$flavor"
fi
# Run Container
${PODMAN} run -it --rm localhost/"${image_name}":"${tag}" bash
# Test Changelogs
[group('Changelogs')]
changelogs branch="stable" handwritten="":
#!/usr/bin/bash
set -eou pipefail
python3 ./.github/changelogs.py "{{ branch }}" ./output.env ./changelog.md --workdir . --handwritten "{{ handwritten }}"
# Verify Container with Cosign
[group('Utility')]
verify-container key="" container="":
#!/usr/bin/bash
set -eou pipefail
# Get Cosign if Needed
if [[ ! $(command -v cosign) ]]; then
COSIGN_CONTAINER_ID=$(${SUDOIF} ${PODMAN} create cgr.dev/chainguard/cosign:latest bash)
${SUDOIF} ${PODMAN} cp "${COSIGN_CONTAINER_ID}":/usr/bin/cosign /usr/local/bin/cosign
${SUDOIF} ${PODMAN} rm -f "${COSIGN_CONTAINER_ID}"
fi
# Verify Cosign Image Signatures if needed
if [[ -n "${COSIGN_CONTAINER_ID:-}" ]]; then
if ! cosign verify --certificate-oidc-issuer=https://token.actions.githubusercontent.com --certificate-identity=https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main cgr.dev/chainguard/cosign >/dev/null; then
echo "NOTICE: Failed to verify cosign image signatures."
exit 1
fi
fi
# Verify Container using cosign public key
if ! cosign verify --key "{{ key }}" "{{ container }}" >/dev/null; then
echo "NOTICE: Verification failed. Please ensure your public key is correct."
exit 1
fi
# Secureboot Check
[group('Utility')]
secureboot $image="aurora" $tag="latest" $flavor="main":
#!/usr/bin/bash
set -eou pipefail
# Validate
{{ just }} validate "${image}" "${tag}" "${flavor}"
# Image Name
image_name=$({{ just }} image_name ${image} ${tag} ${flavor})
# Get the vmlinuz to check
kernel_release=$(${PODMAN} inspect "${image_name}":"${tag}" | jq -r '.[].Config.Labels["ostree.linux"]')
TMP=$(${PODMAN} create "${image_name}":"${tag}" bash)
${PODMAN} cp "$TMP":/usr/lib/modules/"${kernel_release}"/vmlinuz /tmp/vmlinuz
${PODMAN} rm "$TMP"
# Get the Public Certificates
curl --retry 3 -Lo /tmp/kernel-sign.der https://github.com/ublue-os/akmods/raw/main/certs/public_key.der
curl --retry 3 -Lo /tmp/akmods.der https://github.com/ublue-os/akmods/raw/main/certs/public_key_2.der
openssl x509 -in /tmp/kernel-sign.der -out /tmp/kernel-sign.crt
openssl x509 -in /tmp/akmods.der -out /tmp/akmods.crt
# Make sure we have sbverify
CMD="$(command -v sbverify)"
if [[ -z "${CMD:-}" ]]; then
temp_name="sbverify-${RANDOM}"
${PODMAN} run -dt \
--entrypoint /bin/sh \
--volume /tmp/vmlinuz:/tmp/vmlinuz:z \
--volume /tmp/kernel-sign.crt:/tmp/kernel-sign.crt:z \
--volume /tmp/akmods.crt:/tmp/akmods.crt:z \
--name ${temp_name} \
alpine:edge
${PODMAN} exec ${temp_name} apk add sbsigntool
CMD="${PODMAN} exec ${temp_name} /usr/bin/sbverify"
fi
# Confirm that Signatures Are Good
$CMD --list /tmp/vmlinuz
returncode=0
if ! $CMD --cert /tmp/kernel-sign.crt /tmp/vmlinuz || ! $CMD --cert /tmp/akmods.crt /tmp/vmlinuz; then
echo "Secureboot Signature Failed...."
returncode=1
fi
if [[ -n "${temp_name:-}" ]]; then
${PODMAN} rm -f "${temp_name}"
fi
exit "$returncode"
# Get Fedora Version of an image
[group('Utility')]
[private]
fedora_version image="aurora" tag="latest" flavor="main" $kernel_pin="":
#!/usr/bin/bash
set -eou pipefail
{{ just }} validate {{ image }} {{ tag }} {{ flavor }}
if [[ ! -f /tmp/manifest.json ]]; then
# Determine Version
if [[ "{{ tag }}" =~ stable ]]; then
VERSION="{{ stable_version }}"
elif [[ "{{ tag }}" =~ beta ]]; then
VERSION="{{ beta_version }}"
else
VERSION="{{ latest_version }}"
fi
# Determine Akmods Flavor
if [[ "{{ tag }}" =~ stable ]]; then
AKMODS_FLAVOR="coreos-stable"
else
AKMODS_FLAVOR="main"
fi
# Verify akmods existence
echo "Checking for akmods: ghcr.io/ublue-os/akmods:${AKMODS_FLAVOR}-${VERSION}" >&2
if ! skopeo inspect --retry-times 3 "docker://ghcr.io/ublue-os/akmods:${AKMODS_FLAVOR}-${VERSION}" > /dev/null; then
echo "Error: Akmods not found for flavor ${AKMODS_FLAVOR} and version ${VERSION}" >&2
exit 1
fi
# Write cache
echo "{\"Labels\": {\"org.opencontainers.image.version\": \"${VERSION}\"}}" > /tmp/manifest.json
fi
fedora_version=$(jq -r '.Labels["org.opencontainers.image.version"]' < /tmp/manifest.json | grep -oP '^[0-9]+')
if [[ -n "${kernel_pin:-}" ]]; then
fedora_version=$(echo "${kernel_pin}" | grep -oP 'fc\K[0-9]+')
fi
echo "${fedora_version}"
# Image Name
[group('Utility')]
[private]
image_name image="aurora" tag="latest" flavor="main":
#!/usr/bin/bash
set -eou pipefail
{{ just }} validate {{ image }} {{ tag }} {{ flavor }}
if [[ "{{ flavor }}" =~ main ]]; then
image_name={{ image }}
else
image_name="{{ image }}-{{ flavor }}"
fi
echo "${image_name}"
# Generate Tags
[group('Utility')]
generate-build-tags image="aurora" tag="latest" flavor="main" kernel_pin="" ghcr="0" $version="" github_event="" github_number="":
#!/usr/bin/bash
set -eou pipefail
TODAY="$(date +%A)"
WEEKLY="Tuesday"
if [[ {{ ghcr }} == "0" ]]; then
rm -f /tmp/manifest.json
fi
FEDORA_VERSION="$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}')"
DEFAULT_TAG=$({{ just }} generate-default-tag {{ tag }} {{ ghcr }})
IMAGE_NAME=$({{ just }} image_name {{ image }} {{ tag }} {{ flavor }})
# Use Build Version from Rechunk
if [[ -z "${version:-}" ]]; then
version="{{ tag }}-${FEDORA_VERSION}.$(date +%Y%m%d)"
fi
version=${version#{{ tag }}-}
# Arrays for Tags
BUILD_TAGS=()
COMMIT_TAGS=()
# Commit Tags
github_number="{{ github_number }}"
SHA_SHORT="$(git rev-parse --short HEAD)"
if [[ "{{ ghcr }}" == "1" ]]; then
COMMIT_TAGS+=(pr-${github_number:-}-{{ tag }}-${version})
COMMIT_TAGS+=(${SHA_SHORT}-{{ tag }}-${version})
fi
# Convenience Tags
if [[ "{{ tag }}" =~ stable ]]; then
BUILD_TAGS+=("stable-daily" "${version}" "stable-daily-${version}" "stable-daily-${version:3}")
else
BUILD_TAGS+=("{{ tag }}" "{{ tag }}-${version}" "{{ tag }}-${version:3}")
fi
# Weekly Stable / Rebuild Stable on workflow_dispatch
github_event="{{ github_event }}"
if [[ "{{ tag }}" =~ "stable" && "${WEEKLY}" == "${TODAY}" && "${github_event}" =~ schedule ]]; then
BUILD_TAGS+=("stable" "stable-${version}" "stable-${version:3}")
elif [[ "{{ tag }}" =~ "stable" && "${github_event}" =~ workflow_dispatch|workflow_call ]]; then
BUILD_TAGS+=("stable" "stable-${version}" "stable-${version:3}")
elif [[ "{{ tag }}" =~ "stable" && "{{ ghcr }}" == "0" ]]; then
BUILD_TAGS+=("stable" "stable-${version}" "stable-${version:3}")
elif [[ ! "{{ tag }}" =~ stable|beta ]]; then
BUILD_TAGS+=("${FEDORA_VERSION}" "${FEDORA_VERSION}-${version}" "${FEDORA_VERSION}-${version:3}")
fi
if [[ "${github_event}" == "pull_request" ]]; then
alias_tags=("${COMMIT_TAGS[@]}")
else
alias_tags=("${BUILD_TAGS[@]}")
fi
echo "${alias_tags[*]}"
# Generate Default Tag
[group('Utility')]
generate-default-tag tag="latest" ghcr="0":
#!/usr/bin/bash
set -eou pipefail
# Default Tag
if [[ "{{ tag }}" =~ stable && "{{ ghcr }}" == "1" ]]; then
DEFAULT_TAG="stable-daily"
elif [[ "{{ tag }}" =~ stable && "{{ ghcr }}" == "0" ]]; then
DEFAULT_TAG="stable"
else
DEFAULT_TAG="{{ tag }}"
fi
echo "${DEFAULT_TAG}"
# Tag Images
[group('Utility')]
tag-images image_name="" default_tag="" tags="":
#!/usr/bin/bash
set -eou pipefail
# Get Image, and untag
IMAGE=$(${PODMAN} inspect localhost/{{ image_name }}:{{ default_tag }} | jq -r .[].Id)
${PODMAN} untag localhost/{{ image_name }}:{{ default_tag }}
# Tag Image
for tag in {{ tags }}; do
${PODMAN} tag $IMAGE {{ image_name }}:${tag}
done
# Show Images
${PODMAN} images
# DNF CI package cache
[group('Utility')]
setup-cache $image="aurora" $ghcr="0" $github_event="0":
#!/usr/bin/bash
set -eou pipefail
image_name=$({{ just }} image_name '{{ image }}')
fedora_version=$({{ just }} fedora_version '{{ image }}')
ALLOW_CACHE_WRITE="false"
if [[ "${image_name}" == "aurora-dx" ]] && \
[[ "{{ ghcr }}" == "1" ]] && \
[[ "${github_event}" == "workflow_dispatch" || "${github_event}" == "schedule" ]]; then
ALLOW_CACHE_WRITE="true"
fi
CACHE_NAME="${image_name}"-"${fedora_version}"
echo "${CACHE_NAME}" "${ALLOW_CACHE_WRITE}"
# # Examples:
# > just retag-nvidia-on-ghcr stable-daily stable-daily-41.20250126.3 0
# > just retag-nvidia-on-ghcr latest latest-41.20250228.1 0
#
# working_tag: The tag of the most recent known good image (e.g., stable-daily-41.20250126.3)
# stream: One of latest, stable-daily, stable or gts
# dry_run: Only print the skopeo commands instead of running them
#
# First generate a PAT with package write access (https://github.com/settings/tokens)
# and set $GITHUB_USERNAME and $GITHUB_PAT environment variables
# Retag images on GHCR
[group('Admin')]
retag-nvidia-on-ghcr working_tag="" stream="" dry_run="1":
#!/bin/bash
set -euxo pipefail
skopeo="echo === skopeo"
if [[ "{{ dry_run }}" -ne 1 ]]; then
echo "$GITHUB_PAT" | podman login -u $GITHUB_USERNAME --password-stdin ghcr.io
skopeo="skopeo"
fi
for image in aurora-nvidia-open aurora-dx-nvidia-open; do
$skopeo copy docker://ghcr.io/ublue-os/${image}:{{ working_tag }} docker://ghcr.io/ublue-os/${image}:{{ stream }}
done
Reference in a new issue View git blame Copy permalink