quine-global-labs/mirror-coreos-fedora-coreos-config
1
0
Fork 0
mirror of https://github.com/coreos/fedora-coreos-config.git synced 2026-11-03 22:59:47 -09:00
Code Issues Projects Releases Packages Wiki Activity

tree: promote changes from testing at 51b289b039

Browse source
This commit is contained in:
CoreOS Bot 2026-10-26 16:48:34 +00:00 committed by Aashish Radhakrishnan
parent 0bce60df9e
commit 9956ba80d9
50 changed files with 1056 additions and 516 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
.tekton/branched/on-pull-request-overrides/fedora-coreos-branched-on-pull-request-overrides.yaml
View file

@ -46,12 +46,27 @@ spec:
value: false
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
- name: image-expires-after
value: 5d
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/branched/on-pull-request/fedora-coreos-branched-on-pull-request.yaml
View file

@ -46,12 +46,27 @@ spec:
value: false
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
- name: image-expires-after
value: 5d
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/branched/on-push/fedora-coreos-branched-on-push.yaml
View file

@ -45,10 +45,25 @@ spec:
value: false
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/next-devel/on-pull-request-overrides/fedora-coreos-next-devel-on-pull-request-overrides.yaml
View file

@ -46,12 +46,27 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
- name: image-expires-after
value: 5d
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/next-devel/on-pull-request/fedora-coreos-next-devel-on-pull-request.yaml
View file

@ -46,12 +46,27 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
- name: image-expires-after
value: 5d
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/next-devel/on-push/fedora-coreos-next-devel-on-push.yaml
View file

@ -45,10 +45,25 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/next/on-pull-request-overrides/fedora-coreos-next-on-pull-request-overrides.yaml
View file

@ -46,12 +46,27 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
- name: image-expires-after
value: 5d
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/next/on-pull-request/fedora-coreos-next-on-pull-request.yaml
View file

@ -46,12 +46,27 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
- name: image-expires-after
value: 5d
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/next/on-push/fedora-coreos-next-on-push.yaml
View file

@ -45,10 +45,25 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/rawhide/on-pull-request-overrides/fedora-coreos-rawhide-on-pull-request-overrides.yaml
View file

@ -46,12 +46,27 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
- name: image-expires-after
value: 5d
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/rawhide/on-pull-request/fedora-coreos-rawhide-on-pull-request.yaml
View file

@ -46,12 +46,27 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
- name: image-expires-after
value: 5d
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/rawhide/on-push/fedora-coreos-rawhide-on-push.yaml
View file

@ -45,10 +45,25 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/stable/on-pull-request-overrides/fedora-coreos-stable-on-pull-request-overrides.yaml
View file

@ -46,12 +46,27 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
- name: image-expires-after
value: 5d
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/stable/on-pull-request/fedora-coreos-stable-on-pull-request.yaml
View file

@ -46,12 +46,27 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
- name: image-expires-after
value: 5d
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/stable/on-push/fedora-coreos-stable-on-push.yaml
View file

@ -45,10 +45,25 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

15
.tekton/templates/pipelinerun.yaml.j2
View file

@ -48,10 +48,25 @@ spec:
value: {{ hermetic | lower }}
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
{%- if image_expires_after %}
- name: image-expires-after
value: {{ image_expires_after }}
{%- endif %}
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle

2
.tekton/templates/streams.yaml
View file

@ -6,7 +6,7 @@
# Shared configuration
config:
pipeline_bundle: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
pipeline_bundle: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
# Stream definitions
#

17
.tekton/testing-devel/on-pull-request-overrides/fedora-coreos-testing-devel-on-pull-request-overrides.yaml
View file

@ -46,12 +46,27 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
- name: image-expires-after
value: 5d
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/testing-devel/on-pull-request/fedora-coreos-testing-devel-on-pull-request.yaml
View file

@ -46,12 +46,27 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
- name: image-expires-after
value: 5d
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/testing-devel/on-push/fedora-coreos-testing-devel-on-push.yaml
View file

@ -45,10 +45,25 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/testing/on-pull-request-overrides/fedora-coreos-testing-on-pull-request-overrides.yaml
View file

@ -46,12 +46,27 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
- name: image-expires-after
value: 5d
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/testing/on-pull-request/fedora-coreos-testing-on-pull-request.yaml
View file

@ -46,12 +46,27 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
- name: image-expires-after
value: 5d
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

17
.tekton/testing/on-push/fedora-coreos-testing-on-push.yaml
View file

@ -45,10 +45,25 @@ spec:
value: true
- name: prefetch-input
value: '[{"type": "rpm", "path": "."}]'
- name: skip-checks
value: true
# We have to override the default computeResources values
# See https://redhat.atlassian.net/browse/COS-5180
taskRunSpecs:
- pipelineTaskName: rpms-signature-scan
stepSpecs:
- name: rpms-signature-scan
computeResources:
limits:
cpu: 200m
memory: 512Mi
requests:
cpu: 200m
memory: 512Mi
pipelineRef:
params:
- name: bundle
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:18ba354c349148af8f588f008c7a0a96cb5b3290d690f99a370e4268a6b711dc
value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:1382a1e97400faf0bbec537ee1d0d101a02aa6391cb66ee80ba8810ceacdcd68
- name: name
value: buildah-build-bootc-multi-platform-oci-ta
- name: kind

2
.tekton/trigger
View file

@ -6,4 +6,4 @@
# on the pipeline.
# See https://github.com/coreos/fedora-coreos-tracker/issues/2038#issuecomment-3498258143
# The format is YYYYMMDD
20260928
20261012

17
Containerfile
View file

@ -87,6 +87,12 @@ ARG VERSION
ARG NAME=overridden
ARG STREAM=overridden
ARG DESCRIPTION=overridden
ARG MAINTAINER=overridden
ARG VENDOR=overridden
ARG URL=overridden
ARG DISTRIBUTION_SCOPE=overridden
ARG COMPONENT=overridden
ARG CPE_NAME=overridden
# Need to reference builder here to force ordering. But since we have to run
# something anyway, we might as well cleanup after ourselves.
RUN --mount=type=bind,from=builder,target=/var/tmp \
@ -97,8 +103,17 @@ LABEL containers.bootc=1 \
ostree.bootable=1 \
org.opencontainers.image.version=$VERSION \
com.coreos.osname=$NAME \
name=$NAME \
com.coreos.stream=$STREAM \
org.opencontainers.image.title=$DESCRIPTION \
org.opencontainers.image.description=$DESCRIPTION
org.opencontainers.image.description=$DESCRIPTION \
io.k8s.description=$DESCRIPTION \
description=$DESCRIPTION \
maintainer=$MAINTAINER \
vendor=$VENDOR \
url=$URL \
distribution-scope=$DISTRIBUTION_SCOPE \
com.redhat.component=$COMPONENT \
cpe=$CPE_NAME
STOPSIGNAL SIGRTMIN+3
CMD ["/sbin/init"]

2
build-args.conf
View file

@ -7,7 +7,7 @@ STREAM=stable
DESCRIPTION=Fedora CoreOS stable
VERSION=44
MUTATE_OS_RELEASE=44
BUILDER_IMG=quay.io/bootc-devel/fedora-bootc-44-standard@sha256:0558f335b0eff3102dc316578afc1cdbf4e2976b1e8549c08297479b8d326444
BUILDER_IMG=quay.io/bootc-devel/fedora-bootc-44-standard@sha256:733621c2c9748488645db5a54c88281bc759d3e61b7c1d85bf1f8c283518b860
MANIFEST=manifest.yaml
# XXX: see inject_passwd_group() in build-rootfs
PASSWD_GROUP_DIR=manifests

22
build-rootfs
View file

@ -75,6 +75,17 @@ def print_treefile(manifest_name, osid, stream, version, srcdir, **kwargs):
print(json.dumps(get_treefile(manifest_path, osid, stream, version)))
def get_lockfile_dir(srcdir, stream):
"""
Returns the directory containing lockfiles.
First looks in lockfiles/${stream}/, then falls back to srcdir root.
"""
stream_dir = os.path.join(srcdir, 'lockfiles', stream)
if os.path.isdir(stream_dir):
return stream_dir
return srcdir
def get_treefile(manifest_path, osid, stream, version):
with tempfile.NamedTemporaryFile(suffix='.json', mode='w') as tmp_manifest:
# Substitute in a few values from build-args into the treefile.
@ -156,7 +167,7 @@ def build_rootfs(target_rootfs, srcdir, manifest_name,
if local_overrides:
repos += ['overrides']
locked_nevras = get_locked_nevras(local_overrides, srcdir)
locked_nevras = get_locked_nevras(local_overrides, srcdir, stream)
if locked_nevras:
# Lockfile repos require special handling because we only want locked
# NEVRAs to appear there. For lack of a generic solution for any repo
@ -399,10 +410,11 @@ def bwrap(rootfs, args, env=dict(), capture=False):
subprocess.check_call(args)
def get_locked_nevras(local_overrides, srcdir):
lockfile_path = os.path.join(srcdir, f"manifest-lock.{ARCH}.json")
overrides_path = os.path.join(srcdir, "manifest-lock.overrides.yaml")
overrides_arch_path = os.path.join(srcdir, f"manifest-lock.overrides.{ARCH}.yaml")
def get_locked_nevras(local_overrides, srcdir, stream):
lockfile_dir = get_lockfile_dir(srcdir, stream)
lockfile_path = os.path.join(lockfile_dir, f"manifest-lock.{ARCH}.json")
overrides_path = os.path.join(lockfile_dir, "manifest-lock.overrides.yaml")
overrides_arch_path = os.path.join(lockfile_dir, f"manifest-lock.overrides.{ARCH}.yaml")
# we go from lowest priority to highest here: base lockfiles, overrides, local overrides
locks = {}

24
kola-denylist.yaml
View file

@ -47,27 +47,3 @@
- branched
arches:
- aarch64
- pattern: fcos.ignition.v3.noop
tracker: https://github.com/coreos/fedora-coreos-tracker/issues/2231
platforms:
- azure
streams:
- testing
- testing-devel
- stable
- next
- next-devel
- rawhide
- pattern: fcos.ignition.misc.empty
tracker: https://github.com/coreos/fedora-coreos-tracker/issues/2231
platforms:
- azure
streams:
- testing
- testing-devel
- stable
- next
- next-devel
- rawhide

105
manifest-lock.aarch64.json
View file

@ -112,7 +112,7 @@
"evra": "4.9-1.fc44.aarch64"
},
"cifs-utils": {
"evra": "7.7-1.fc44.aarch64"
"evra": "7.8-2.fc44.aarch64"
},
"clevis": {
"evra": "21-14.fc44.aarch64"
@ -154,7 +154,7 @@
"evra": "0.21.3-13.fc44.noarch"
},
"container-selinux": {
"evra": "4:2.247.0-1.fc44.noarch"
"evra": "4:2.250.0-1.fc44.noarch"
},
"containerd": {
"evra": "2.3.5-1.fc44.aarch64"
@ -166,10 +166,10 @@
"evra": "5:0.67.2-1.fc44.noarch"
},
"coreos-installer": {
"evra": "0.26.0-3.fc44.aarch64"
"evra": "0.27.0-1.fc44.aarch64"
},
"coreos-installer-bootinfra": {
"evra": "0.26.0-3.fc44.aarch64"
"evra": "0.27.0-1.fc44.aarch64"
},
"coreutils": {
"evra": "9.10-5.fc44.aarch64"
@ -205,7 +205,7 @@
"evra": "2.8.8-1.fc44.aarch64"
},
"curl": {
"evra": "8.18.0-10.fc44.aarch64"
"evra": "8.18.0-12.fc44.aarch64"
},
"cyrus-sasl-gssapi": {
"evra": "2.1.28-35.fc44.aarch64"
@ -256,7 +256,7 @@
"evra": "2.92rel2-9.fc44.aarch64"
},
"docker-cli": {
"evra": "29.7.2-1.fc44.aarch64"
"evra": "29.8.2-2.fc44.aarch64"
},
"dosfstools": {
"evra": "4.2-18.fc44.aarch64"
@ -301,7 +301,7 @@
"evra": "2:7.1-1.fc44.aarch64"
},
"expat": {
"evra": "2.8.3-1.fc44.aarch64"
"evra": "2.8.5-1.fc44.aarch64"
},
"fedora-gpg-keys": {
"evra": "44-2.noarch"
@ -334,7 +334,7 @@
"evra": "1:4.10.0-7.fc44.aarch64"
},
"flatpak-session-helper": {
"evra": "1.18.2-1.fc44.aarch64"
"evra": "1.18.4-1.fc44.aarch64"
},
"fmt": {
"evra": "11.2.0-4.fc44.aarch64"
@ -343,7 +343,7 @@
"evra": "0.6.1-14.fc44.aarch64"
},
"fuse-common": {
"evra": "3.18.2-1.fc44.aarch64"
"evra": "3.18.3-1.fc44.aarch64"
},
"fuse-overlayfs": {
"evra": "1.17-1.fc44.aarch64"
@ -352,10 +352,10 @@
"evra": "3.7.6-1.fc44.aarch64"
},
"fuse3": {
"evra": "3.18.2-1.fc44.aarch64"
"evra": "3.18.3-1.fc44.aarch64"
},
"fuse3-libs": {
"evra": "3.18.2-1.fc44.aarch64"
"evra": "3.18.3-1.fc44.aarch64"
},
"fwupd": {
"evra": "2.1.8-1.fc44.aarch64"
@ -382,22 +382,22 @@
"evra": "0.26-5.fc44.aarch64"
},
"git-core": {
"evra": "2.55.0-1.fc44.aarch64"
"evra": "2.56.0-1.fc44.aarch64"
},
"glib2": {
"evra": "2.88.3-1.fc44.aarch64"
"evra": "2.88.4-1.fc44.aarch64"
},
"glibc": {
"evra": "2.43-8.fc44.aarch64"
"evra": "2.43-9.fc44.aarch64"
},
"glibc-common": {
"evra": "2.43-8.fc44.aarch64"
"evra": "2.43-9.fc44.aarch64"
},
"glibc-gconv-extra": {
"evra": "2.43-8.fc44.aarch64"
"evra": "2.43-9.fc44.aarch64"
},
"glibc-minimal-langpack": {
"evra": "2.43-8.fc44.aarch64"
"evra": "2.43-9.fc44.aarch64"
},
"gmp": {
"evra": "1:6.3.0-5.fc44.aarch64"
@ -436,16 +436,16 @@
"evra": "3.12-3.fc44.aarch64"
},
"grub2-common": {
"evra": "1:2.12-64.fc44.noarch"
"evra": "1:2.12-66.fc44.noarch"
},
"grub2-efi-aa64": {
"evra": "1:2.12-64.fc44.aarch64"
"evra": "1:2.12-66.fc44.aarch64"
},
"grub2-tools": {
"evra": "1:2.12-64.fc44.aarch64"
"evra": "1:2.12-66.fc44.aarch64"
},
"grub2-tools-minimal": {
"evra": "1:2.12-64.fc44.aarch64"
"evra": "1:2.12-66.fc44.aarch64"
},
"gssproxy": {
"evra": "0.9.2-10.fc44.aarch64"
@ -457,7 +457,7 @@
"evra": "3.25-4.fc44.aarch64"
},
"hwdata": {
"evra": "0.411-1.fc44.noarch"
"evra": "0.412-1.fc44.noarch"
},
"ignition": {
"evra": "2.27.0-3.fc44.aarch64"
@ -472,7 +472,7 @@
"evra": "20260916-1.fc44.noarch"
},
"ipcalc": {
"evra": "1.0.3-13.fc44.aarch64"
"evra": "1.1.0-4.fc44.aarch64"
},
"iproute": {
"evra": "6.17.0-2.fc44.aarch64"
@ -535,16 +535,16 @@
"evra": "1.0.61-1.fc44.aarch64"
},
"kernel": {
"evra": "7.2.7-200.fc44.aarch64"
"evra": "7.2.9-201.fc44.aarch64"
},
"kernel-core": {
"evra": "7.2.7-200.fc44.aarch64"
"evra": "7.2.9-201.fc44.aarch64"
},
"kernel-modules": {
"evra": "7.2.7-200.fc44.aarch64"
"evra": "7.2.9-201.fc44.aarch64"
},
"kernel-modules-core": {
"evra": "7.2.7-200.fc44.aarch64"
"evra": "7.2.9-201.fc44.aarch64"
},
"kexec-tools": {
"evra": "2.0.32-3.fc44.aarch64"
@ -652,7 +652,7 @@
"evra": "1.47.3-4.fc44.aarch64"
},
"libcurl-minimal": {
"evra": "8.18.0-10.fc44.aarch64"
"evra": "8.18.0-12.fc44.aarch64"
},
"libdaemon": {
"evra": "0.14-33.fc44.aarch64"
@ -742,10 +742,10 @@
"evra": "10-2.fc44.aarch64"
},
"libmaxminddb": {
"evra": "1.14.0-1.fc44.aarch64"
"evra": "1.14.1-1.fc44.aarch64"
},
"libmd": {
"evra": "1.2.0-1.fc44.aarch64"
"evra": "1.3.0-1.fc44.aarch64"
},
"libmnl": {
"evra": "1.0.5-9.fc44.aarch64"
@ -792,6 +792,9 @@
"libpath_utils": {
"evra": "0.2.1-61.fc44.aarch64"
},
"libpathrs": {
"evra": "0.2.6-1.fc44.aarch64"
},
"libpcap": {
"evra": "14:1.10.7-1.fc44.aarch64"
},
@ -811,7 +814,7 @@
"evra": "0.1.5-61.fc44.aarch64"
},
"librepo": {
"evra": "1.21.0-2.fc44.aarch64"
"evra": "1.21.2-1.fc44.aarch64"
},
"libreport-filesystem": {
"evra": "2.17.15-10.fc44.noarch"
@ -841,7 +844,7 @@
"evra": "2:4.24.7-1.fc44.aarch64"
},
"libsolv": {
"evra": "0.7.39-1.fc44.aarch64"
"evra": "0.7.40-1.fc44.aarch64"
},
"libss": {
"evra": "1.47.3-4.fc44.aarch64"
@ -976,10 +979,10 @@
"evra": "4.3-11.fc44.aarch64"
},
"moby-engine": {
"evra": "29.7.2-1.fc44.aarch64"
"evra": "29.8.2-2.fc44.aarch64"
},
"moby-filesystem": {
"evra": "29.7.2-1.fc44.noarch"
"evra": "29.8.2-2.fc44.noarch"
},
"mokutil": {
"evra": "2:0.7.2-3.fc44.aarch64"
@ -1045,25 +1048,25 @@
"evra": "1.8-4.fc44.aarch64"
},
"nspr": {
"evra": "4.39.0-5.fc44.aarch64"
"evra": "4.39.0-6.fc44.aarch64"
},
"nss": {
"evra": "3.129.0-1.fc44.aarch64"
"evra": "3.130.0-1.fc44.aarch64"
},
"nss-altfiles": {
"evra": "2.23.0-9.fc44.aarch64"
},
"nss-softokn": {
"evra": "3.129.0-1.fc44.aarch64"
"evra": "3.130.0-1.fc44.aarch64"
},
"nss-softokn-freebl": {
"evra": "3.129.0-1.fc44.aarch64"
"evra": "3.130.0-1.fc44.aarch64"
},
"nss-sysinit": {
"evra": "3.129.0-1.fc44.aarch64"
"evra": "3.130.0-1.fc44.aarch64"
},
"nss-util": {
"evra": "3.129.0-1.fc44.aarch64"
"evra": "3.130.0-1.fc44.aarch64"
},
"numactl": {
"evra": "2.0.19-4.fc44.aarch64"
@ -1096,10 +1099,10 @@
"evra": "10.2p1-14.fc44.aarch64"
},
"openssl": {
"evra": "1:3.5.8-1.fc44.aarch64"
"evra": "1:3.5.9-1.fc44.aarch64"
},
"openssl-libs": {
"evra": "1:3.5.8-1.fc44.aarch64"
"evra": "1:3.5.9-1.fc44.aarch64"
},
"os-prober": {
"evra": "1.81-11.fc44.aarch64"
@ -1126,10 +1129,10 @@
"evra": "0.1.12-1.fc44.aarch64"
},
"passt": {
"evra": "0^20260728.gf8df3f1-2.fc44.aarch64"
"evra": "0^20261002.gcba3570-1.fc44.aarch64"
},
"passt-selinux": {
"evra": "0^20260728.gf8df3f1-2.fc44.noarch"
"evra": "0^20261002.gcba3570-1.fc44.noarch"
},
"pciutils": {
"evra": "3.15.0-1.fc44.aarch64"
@ -1219,10 +1222,10 @@
"evra": "1.10.3-1.fc44.aarch64"
},
"rsync": {
"evra": "3.5.0-2.fc44.aarch64"
"evra": "3.5.1-1.fc44.aarch64"
},
"runc": {
"evra": "2:1.5.1-1.fc44.aarch64"
"evra": "2:1.5.2-3.fc44.aarch64"
},
"samba-client-libs": {
"evra": "2:4.24.7-1.fc44.aarch64"
@ -1267,7 +1270,7 @@
"evra": "2.4-3.fc44.aarch64"
},
"shim-aa64": {
"evra": "16.1-5.aarch64"
"evra": "16.1-7.aarch64"
},
"skopeo": {
"evra": "1:1.22.3-1.fc44.aarch64"
@ -1324,7 +1327,7 @@
"evra": "1.28.1-1.fc44.aarch64"
},
"sudo": {
"evra": "1.9.17-8.p2.fc44.aarch64"
"evra": "1.9.17-10.p2.fc44.aarch64"
},
"systemd": {
"evra": "259.9-1.fc44.aarch64"
@ -1372,7 +1375,7 @@
"evra": "4.1.3-9.fc44.aarch64"
},
"tzdata": {
"evra": "2026c-2.fc44.noarch"
"evra": "2026e-1.fc44.noarch"
},
"udisks2": {
"evra": "2.11.2-1.fc44.aarch64"
@ -1411,7 +1414,7 @@
"evra": "2.47-1.fc44.noarch"
},
"xxhash-libs": {
"evra": "0.8.3-4.fc44.aarch64"
"evra": "0.8.4-1.fc44.aarch64"
},
"xz": {
"evra": "1:5.8.2-2.fc44.aarch64"
@ -1436,6 +1439,6 @@
}
},
"metadata": {
"generated": "2026-09-28T00:00:00Z"
"generated": "2026-10-12T00:00:00Z"
}
}

39
manifest-lock.overrides.yaml
View file

@ -9,21 +9,6 @@
# for FCOS-specific packages (ignition, afterburn, etc.).
packages:
afterburn:
evr: 5.11.0-1.fc44
metadata:
bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d9c90a27c
type: fast-track
afterburn-dracut:
evr: 5.11.0-1.fc44
metadata:
bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d9c90a27c
type: fast-track
bootupd:
evr: 0.3.2-1.fc44
metadata:
bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d4d1984a1b
type: fast-track
ca-certificates:
evra: 2026.2.92_v9.0.319-1.fc44.noarch
metadata:
@ -35,27 +20,15 @@ packages:
metadata:
reason: https://github.com/coreos/fedora-coreos-tracker/issues/2217
type: pin
ignition:
evr: 2.27.0-3.fc44
coreos-installer:
evr: 0.27.0-1.fc44
metadata:
bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2026-2d1e2ae051
bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2026-dcd141daac
type: fast-track
ignition-grub:
evr: 2.27.0-3.fc44
coreos-installer-bootinfra:
evr: 0.27.0-1.fc44
metadata:
bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2026-2d1e2ae051
type: fast-track
rpm-ostree:
evr: 2026.3-2.fc44
metadata:
bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d03472ee52
reason: https://github.com/coreos/fedora-coreos-tracker/issues/2226
type: fast-track
rpm-ostree-libs:
evr: 2026.3-2.fc44
metadata:
bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d03472ee52
reason: https://github.com/coreos/fedora-coreos-tracker/issues/2226
bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2026-dcd141daac
type: fast-track
selinux-policy:
evra: 44.6-1.fc44.noarch

105
manifest-lock.ppc64le.json
View file

@ -109,7 +109,7 @@
"evra": "4.9-1.fc44.ppc64le"
},
"cifs-utils": {
"evra": "7.7-1.fc44.ppc64le"
"evra": "7.8-2.fc44.ppc64le"
},
"clevis": {
"evra": "21-14.fc44.ppc64le"
@ -151,7 +151,7 @@
"evra": "0.21.3-13.fc44.noarch"
},
"container-selinux": {
"evra": "4:2.247.0-1.fc44.noarch"
"evra": "4:2.250.0-1.fc44.noarch"
},
"containerd": {
"evra": "2.3.5-1.fc44.ppc64le"
@ -163,10 +163,10 @@
"evra": "5:0.67.2-1.fc44.noarch"
},
"coreos-installer": {
"evra": "0.26.0-3.fc44.ppc64le"
"evra": "0.27.0-1.fc44.ppc64le"
},
"coreos-installer-bootinfra": {
"evra": "0.26.0-3.fc44.ppc64le"
"evra": "0.27.0-1.fc44.ppc64le"
},
"coreutils": {
"evra": "9.10-5.fc44.ppc64le"
@ -199,7 +199,7 @@
"evra": "2.8.8-1.fc44.ppc64le"
},
"curl": {
"evra": "8.18.0-10.fc44.ppc64le"
"evra": "8.18.0-12.fc44.ppc64le"
},
"cyrus-sasl-gssapi": {
"evra": "2.1.28-35.fc44.ppc64le"
@ -250,7 +250,7 @@
"evra": "2.92rel2-9.fc44.ppc64le"
},
"docker-cli": {
"evra": "29.7.2-1.fc44.ppc64le"
"evra": "29.8.2-2.fc44.ppc64le"
},
"dosfstools": {
"evra": "4.2-18.fc44.ppc64le"
@ -286,7 +286,7 @@
"evra": "2:7.1-1.fc44.ppc64le"
},
"expat": {
"evra": "2.8.3-1.fc44.ppc64le"
"evra": "2.8.5-1.fc44.ppc64le"
},
"fedora-gpg-keys": {
"evra": "44-2.noarch"
@ -319,7 +319,7 @@
"evra": "1:4.10.0-7.fc44.ppc64le"
},
"flatpak-session-helper": {
"evra": "1.18.2-1.fc44.ppc64le"
"evra": "1.18.4-1.fc44.ppc64le"
},
"fmt": {
"evra": "11.2.0-4.fc44.ppc64le"
@ -328,7 +328,7 @@
"evra": "0.6.1-14.fc44.ppc64le"
},
"fuse-common": {
"evra": "3.18.2-1.fc44.ppc64le"
"evra": "3.18.3-1.fc44.ppc64le"
},
"fuse-overlayfs": {
"evra": "1.17-1.fc44.ppc64le"
@ -337,10 +337,10 @@
"evra": "3.7.6-1.fc44.ppc64le"
},
"fuse3": {
"evra": "3.18.2-1.fc44.ppc64le"
"evra": "3.18.3-1.fc44.ppc64le"
},
"fuse3-libs": {
"evra": "3.18.2-1.fc44.ppc64le"
"evra": "3.18.3-1.fc44.ppc64le"
},
"fwupd": {
"evra": "2.1.8-1.fc44.ppc64le"
@ -367,22 +367,22 @@
"evra": "0.26-5.fc44.ppc64le"
},
"git-core": {
"evra": "2.55.0-1.fc44.ppc64le"
"evra": "2.56.0-1.fc44.ppc64le"
},
"glib2": {
"evra": "2.88.3-1.fc44.ppc64le"
"evra": "2.88.4-1.fc44.ppc64le"
},
"glibc": {
"evra": "2.43-8.fc44.ppc64le"
"evra": "2.43-9.fc44.ppc64le"
},
"glibc-common": {
"evra": "2.43-8.fc44.ppc64le"
"evra": "2.43-9.fc44.ppc64le"
},
"glibc-gconv-extra": {
"evra": "2.43-8.fc44.ppc64le"
"evra": "2.43-9.fc44.ppc64le"
},
"glibc-minimal-langpack": {
"evra": "2.43-8.fc44.ppc64le"
"evra": "2.43-9.fc44.ppc64le"
},
"gmp": {
"evra": "1:6.3.0-5.fc44.ppc64le"
@ -418,19 +418,19 @@
"evra": "3.12-3.fc44.ppc64le"
},
"grub2-common": {
"evra": "1:2.12-64.fc44.noarch"
"evra": "1:2.12-66.fc44.noarch"
},
"grub2-ppc64le": {
"evra": "1:2.12-64.fc44.ppc64le"
"evra": "1:2.12-66.fc44.ppc64le"
},
"grub2-ppc64le-modules": {
"evra": "1:2.12-64.fc44.noarch"
"evra": "1:2.12-66.fc44.noarch"
},
"grub2-tools": {
"evra": "1:2.12-64.fc44.ppc64le"
"evra": "1:2.12-66.fc44.ppc64le"
},
"grub2-tools-minimal": {
"evra": "1:2.12-64.fc44.ppc64le"
"evra": "1:2.12-66.fc44.ppc64le"
},
"gssproxy": {
"evra": "0.9.2-10.fc44.ppc64le"
@ -442,7 +442,7 @@
"evra": "3.25-4.fc44.ppc64le"
},
"hwdata": {
"evra": "0.411-1.fc44.noarch"
"evra": "0.412-1.fc44.noarch"
},
"ignition": {
"evra": "2.27.0-3.fc44.ppc64le"
@ -457,7 +457,7 @@
"evra": "20260916-1.fc44.noarch"
},
"ipcalc": {
"evra": "1.0.3-13.fc44.ppc64le"
"evra": "1.1.0-4.fc44.ppc64le"
},
"iproute": {
"evra": "6.17.0-2.fc44.ppc64le"
@ -520,16 +520,16 @@
"evra": "1.0.61-1.fc44.ppc64le"
},
"kernel": {
"evra": "7.2.7-200.fc44.ppc64le"
"evra": "7.2.9-201.fc44.ppc64le"
},
"kernel-core": {
"evra": "7.2.7-200.fc44.ppc64le"
"evra": "7.2.9-201.fc44.ppc64le"
},
"kernel-modules": {
"evra": "7.2.7-200.fc44.ppc64le"
"evra": "7.2.9-201.fc44.ppc64le"
},
"kernel-modules-core": {
"evra": "7.2.7-200.fc44.ppc64le"
"evra": "7.2.9-201.fc44.ppc64le"
},
"kexec-tools": {
"evra": "2.0.32-3.fc44.ppc64le"
@ -637,7 +637,7 @@
"evra": "1.47.3-4.fc44.ppc64le"
},
"libcurl-minimal": {
"evra": "8.18.0-10.fc44.ppc64le"
"evra": "8.18.0-12.fc44.ppc64le"
},
"libdaemon": {
"evra": "0.14-33.fc44.ppc64le"
@ -727,10 +727,10 @@
"evra": "10-2.fc44.ppc64le"
},
"libmaxminddb": {
"evra": "1.14.0-1.fc44.ppc64le"
"evra": "1.14.1-1.fc44.ppc64le"
},
"libmd": {
"evra": "1.2.0-1.fc44.ppc64le"
"evra": "1.3.0-1.fc44.ppc64le"
},
"libmnl": {
"evra": "1.0.5-9.fc44.ppc64le"
@ -777,6 +777,9 @@
"libpath_utils": {
"evra": "0.2.1-61.fc44.ppc64le"
},
"libpathrs": {
"evra": "0.2.6-1.fc44.ppc64le"
},
"libpcap": {
"evra": "14:1.10.7-1.fc44.ppc64le"
},
@ -796,7 +799,7 @@
"evra": "0.1.5-61.fc44.ppc64le"
},
"librepo": {
"evra": "1.21.0-2.fc44.ppc64le"
"evra": "1.21.2-1.fc44.ppc64le"
},
"libreport-filesystem": {
"evra": "2.17.15-10.fc44.noarch"
@ -832,7 +835,7 @@
"evra": "2:4.24.7-1.fc44.ppc64le"
},
"libsolv": {
"evra": "0.7.39-1.fc44.ppc64le"
"evra": "0.7.40-1.fc44.ppc64le"
},
"libss": {
"evra": "1.47.3-4.fc44.ppc64le"
@ -961,10 +964,10 @@
"evra": "4.3-11.fc44.ppc64le"
},
"moby-engine": {
"evra": "29.7.2-1.fc44.ppc64le"
"evra": "29.8.2-2.fc44.ppc64le"
},
"moby-filesystem": {
"evra": "29.7.2-1.fc44.noarch"
"evra": "29.8.2-2.fc44.noarch"
},
"mpfr": {
"evra": "4.2.2-3.fc44.ppc64le"
@ -1027,25 +1030,25 @@
"evra": "1.8-4.fc44.ppc64le"
},
"nspr": {
"evra": "4.39.0-5.fc44.ppc64le"
"evra": "4.39.0-6.fc44.ppc64le"
},
"nss": {
"evra": "3.129.0-1.fc44.ppc64le"
"evra": "3.130.0-1.fc44.ppc64le"
},
"nss-altfiles": {
"evra": "2.23.0-9.fc44.ppc64le"
},
"nss-softokn": {
"evra": "3.129.0-1.fc44.ppc64le"
"evra": "3.130.0-1.fc44.ppc64le"
},
"nss-softokn-freebl": {
"evra": "3.129.0-1.fc44.ppc64le"
"evra": "3.130.0-1.fc44.ppc64le"
},
"nss-sysinit": {
"evra": "3.129.0-1.fc44.ppc64le"
"evra": "3.130.0-1.fc44.ppc64le"
},
"nss-util": {
"evra": "3.129.0-1.fc44.ppc64le"
"evra": "3.130.0-1.fc44.ppc64le"
},
"numactl": {
"evra": "2.0.19-4.fc44.ppc64le"
@ -1078,10 +1081,10 @@
"evra": "10.2p1-14.fc44.ppc64le"
},
"openssl": {
"evra": "1:3.5.8-1.fc44.ppc64le"
"evra": "1:3.5.9-1.fc44.ppc64le"
},
"openssl-libs": {
"evra": "1:3.5.8-1.fc44.ppc64le"
"evra": "1:3.5.9-1.fc44.ppc64le"
},
"os-prober": {
"evra": "1.81-11.fc44.ppc64le"
@ -1111,10 +1114,10 @@
"evra": "0.1.12-1.fc44.ppc64le"
},
"passt": {
"evra": "0^20260728.gf8df3f1-2.fc44.ppc64le"
"evra": "0^20261002.gcba3570-1.fc44.ppc64le"
},
"passt-selinux": {
"evra": "0^20260728.gf8df3f1-2.fc44.noarch"
"evra": "0^20261002.gcba3570-1.fc44.noarch"
},
"pciutils": {
"evra": "3.15.0-1.fc44.ppc64le"
@ -1210,10 +1213,10 @@
"evra": "1.10.3-1.fc44.ppc64le"
},
"rsync": {
"evra": "3.5.0-2.fc44.ppc64le"
"evra": "3.5.1-1.fc44.ppc64le"
},
"runc": {
"evra": "2:1.5.1-1.fc44.ppc64le"
"evra": "2:1.5.2-3.fc44.ppc64le"
},
"samba-client-libs": {
"evra": "2:4.24.7-1.fc44.ppc64le"
@ -1312,7 +1315,7 @@
"evra": "1.28.1-1.fc44.ppc64le"
},
"sudo": {
"evra": "1.9.17-8.p2.fc44.ppc64le"
"evra": "1.9.17-10.p2.fc44.ppc64le"
},
"systemd": {
"evra": "259.9-1.fc44.ppc64le"
@ -1360,7 +1363,7 @@
"evra": "4.1.3-9.fc44.ppc64le"
},
"tzdata": {
"evra": "2026c-2.fc44.noarch"
"evra": "2026e-1.fc44.noarch"
},
"udisks2": {
"evra": "2.11.2-1.fc44.ppc64le"
@ -1396,7 +1399,7 @@
"evra": "2.47-1.fc44.noarch"
},
"xxhash-libs": {
"evra": "0.8.3-4.fc44.ppc64le"
"evra": "0.8.4-1.fc44.ppc64le"
},
"xz": {
"evra": "1:5.8.2-2.fc44.ppc64le"
@ -1421,6 +1424,6 @@
}
},
"metadata": {
"generated": "2026-09-28T00:00:00Z"
"generated": "2026-10-12T00:00:00Z"
}
}

95
manifest-lock.s390x.json
View file

@ -106,7 +106,7 @@
"evra": "4.9-1.fc44.s390x"
},
"cifs-utils": {
"evra": "7.7-1.fc44.s390x"
"evra": "7.8-2.fc44.s390x"
},
"clevis": {
"evra": "21-14.fc44.s390x"
@ -148,7 +148,7 @@
"evra": "0.21.3-13.fc44.noarch"
},
"container-selinux": {
"evra": "4:2.247.0-1.fc44.noarch"
"evra": "4:2.250.0-1.fc44.noarch"
},
"containerd": {
"evra": "2.3.5-1.fc44.s390x"
@ -160,10 +160,10 @@
"evra": "5:0.67.2-1.fc44.noarch"
},
"coreos-installer": {
"evra": "0.26.0-3.fc44.s390x"
"evra": "0.27.0-1.fc44.s390x"
},
"coreos-installer-bootinfra": {
"evra": "0.26.0-3.fc44.s390x"
"evra": "0.27.0-1.fc44.s390x"
},
"coreutils": {
"evra": "9.10-5.fc44.s390x"
@ -196,7 +196,7 @@
"evra": "2.8.8-1.fc44.s390x"
},
"curl": {
"evra": "8.18.0-10.fc44.s390x"
"evra": "8.18.0-12.fc44.s390x"
},
"cyrus-sasl-gssapi": {
"evra": "2.1.28-35.fc44.s390x"
@ -247,7 +247,7 @@
"evra": "2.92rel2-9.fc44.s390x"
},
"docker-cli": {
"evra": "29.7.2-1.fc44.s390x"
"evra": "29.8.2-2.fc44.s390x"
},
"dosfstools": {
"evra": "4.2-18.fc44.s390x"
@ -283,7 +283,7 @@
"evra": "2:7.1-1.fc44.s390x"
},
"expat": {
"evra": "2.8.3-1.fc44.s390x"
"evra": "2.8.5-1.fc44.s390x"
},
"fedora-gpg-keys": {
"evra": "44-2.noarch"
@ -316,7 +316,7 @@
"evra": "1:4.10.0-7.fc44.s390x"
},
"flatpak-session-helper": {
"evra": "1.18.2-1.fc44.s390x"
"evra": "1.18.4-1.fc44.s390x"
},
"fmt": {
"evra": "11.2.0-4.fc44.s390x"
@ -325,7 +325,7 @@
"evra": "0.6.1-14.fc44.s390x"
},
"fuse-common": {
"evra": "3.18.2-1.fc44.s390x"
"evra": "3.18.3-1.fc44.s390x"
},
"fuse-overlayfs": {
"evra": "1.17-1.fc44.s390x"
@ -334,10 +334,10 @@
"evra": "3.7.6-1.fc44.s390x"
},
"fuse3": {
"evra": "3.18.2-1.fc44.s390x"
"evra": "3.18.3-1.fc44.s390x"
},
"fuse3-libs": {
"evra": "3.18.2-1.fc44.s390x"
"evra": "3.18.3-1.fc44.s390x"
},
"fwupd": {
"evra": "2.1.8-1.fc44.s390x"
@ -355,22 +355,22 @@
"evra": "1.0.10-5.fc44.s390x"
},
"git-core": {
"evra": "2.55.0-1.fc44.s390x"
"evra": "2.56.0-1.fc44.s390x"
},
"glib2": {
"evra": "2.88.3-1.fc44.s390x"
"evra": "2.88.4-1.fc44.s390x"
},
"glibc": {
"evra": "2.43-8.fc44.s390x"
"evra": "2.43-9.fc44.s390x"
},
"glibc-common": {
"evra": "2.43-8.fc44.s390x"
"evra": "2.43-9.fc44.s390x"
},
"glibc-gconv-extra": {
"evra": "2.43-8.fc44.s390x"
"evra": "2.43-9.fc44.s390x"
},
"glibc-minimal-langpack": {
"evra": "2.43-8.fc44.s390x"
"evra": "2.43-9.fc44.s390x"
},
"gmp": {
"evra": "1:6.3.0-5.fc44.s390x"
@ -415,7 +415,7 @@
"evra": "3.25-4.fc44.s390x"
},
"hwdata": {
"evra": "0.411-1.fc44.noarch"
"evra": "0.412-1.fc44.noarch"
},
"ignition": {
"evra": "2.27.0-3.fc44.s390x"
@ -430,7 +430,7 @@
"evra": "20260916-1.fc44.noarch"
},
"ipcalc": {
"evra": "1.0.3-13.fc44.s390x"
"evra": "1.1.0-4.fc44.s390x"
},
"iproute": {
"evra": "6.17.0-2.fc44.s390x"
@ -490,16 +490,16 @@
"evra": "1.0.61-1.fc44.s390x"
},
"kernel": {
"evra": "7.2.7-200.fc44.s390x"
"evra": "7.2.9-201.fc44.s390x"
},
"kernel-core": {
"evra": "7.2.7-200.fc44.s390x"
"evra": "7.2.9-201.fc44.s390x"
},
"kernel-modules": {
"evra": "7.2.7-200.fc44.s390x"
"evra": "7.2.9-201.fc44.s390x"
},
"kernel-modules-core": {
"evra": "7.2.7-200.fc44.s390x"
"evra": "7.2.9-201.fc44.s390x"
},
"kexec-tools": {
"evra": "2.0.32-3.fc44.s390x"
@ -607,7 +607,7 @@
"evra": "1.47.3-4.fc44.s390x"
},
"libcurl-minimal": {
"evra": "8.18.0-10.fc44.s390x"
"evra": "8.18.0-12.fc44.s390x"
},
"libdaemon": {
"evra": "0.14-33.fc44.s390x"
@ -697,10 +697,10 @@
"evra": "10-2.fc44.s390x"
},
"libmaxminddb": {
"evra": "1.14.0-1.fc44.s390x"
"evra": "1.14.1-1.fc44.s390x"
},
"libmd": {
"evra": "1.2.0-1.fc44.s390x"
"evra": "1.3.0-1.fc44.s390x"
},
"libmnl": {
"evra": "1.0.5-9.fc44.s390x"
@ -747,6 +747,9 @@
"libpath_utils": {
"evra": "0.2.1-61.fc44.s390x"
},
"libpathrs": {
"evra": "0.2.6-1.fc44.s390x"
},
"libpcap": {
"evra": "14:1.10.7-1.fc44.s390x"
},
@ -766,7 +769,7 @@
"evra": "0.1.5-61.fc44.s390x"
},
"librepo": {
"evra": "1.21.0-2.fc44.s390x"
"evra": "1.21.2-1.fc44.s390x"
},
"libreport-filesystem": {
"evra": "2.17.15-10.fc44.noarch"
@ -796,7 +799,7 @@
"evra": "2:4.24.7-1.fc44.s390x"
},
"libsolv": {
"evra": "0.7.39-1.fc44.s390x"
"evra": "0.7.40-1.fc44.s390x"
},
"libss": {
"evra": "1.47.3-4.fc44.s390x"
@ -922,10 +925,10 @@
"evra": "4.3-11.fc44.s390x"
},
"moby-engine": {
"evra": "29.7.2-1.fc44.s390x"
"evra": "29.8.2-2.fc44.s390x"
},
"moby-filesystem": {
"evra": "29.7.2-1.fc44.noarch"
"evra": "29.8.2-2.fc44.noarch"
},
"mpfr": {
"evra": "4.2.2-3.fc44.s390x"
@ -988,25 +991,25 @@
"evra": "1.8-4.fc44.s390x"
},
"nspr": {
"evra": "4.39.0-5.fc44.s390x"
"evra": "4.39.0-6.fc44.s390x"
},
"nss": {
"evra": "3.129.0-1.fc44.s390x"
"evra": "3.130.0-1.fc44.s390x"
},
"nss-altfiles": {
"evra": "2.23.0-9.fc44.s390x"
},
"nss-softokn": {
"evra": "3.129.0-1.fc44.s390x"
"evra": "3.130.0-1.fc44.s390x"
},
"nss-softokn-freebl": {
"evra": "3.129.0-1.fc44.s390x"
"evra": "3.130.0-1.fc44.s390x"
},
"nss-sysinit": {
"evra": "3.129.0-1.fc44.s390x"
"evra": "3.130.0-1.fc44.s390x"
},
"nss-util": {
"evra": "3.129.0-1.fc44.s390x"
"evra": "3.130.0-1.fc44.s390x"
},
"nvidia-gpu-firmware": {
"evra": "20260916-1.fc44.noarch"
@ -1030,10 +1033,10 @@
"evra": "10.2p1-14.fc44.s390x"
},
"openssl": {
"evra": "1:3.5.8-1.fc44.s390x"
"evra": "1:3.5.9-1.fc44.s390x"
},
"openssl-libs": {
"evra": "1:3.5.8-1.fc44.s390x"
"evra": "1:3.5.9-1.fc44.s390x"
},
"ostree": {
"evra": "2026.4-1.fc44.s390x"
@ -1057,10 +1060,10 @@
"evra": "0.1.12-1.fc44.s390x"
},
"passt": {
"evra": "0^20260728.gf8df3f1-2.fc44.s390x"
"evra": "0^20261002.gcba3570-1.fc44.s390x"
},
"passt-selinux": {
"evra": "0^20260728.gf8df3f1-2.fc44.noarch"
"evra": "0^20261002.gcba3570-1.fc44.noarch"
},
"pciutils": {
"evra": "3.15.0-1.fc44.s390x"
@ -1150,10 +1153,10 @@
"evra": "1.10.3-1.fc44.s390x"
},
"rsync": {
"evra": "3.5.0-2.fc44.s390x"
"evra": "3.5.1-1.fc44.s390x"
},
"runc": {
"evra": "2:1.5.1-1.fc44.s390x"
"evra": "2:1.5.2-3.fc44.s390x"
},
"s390utils-core": {
"evra": "2:2.41.0-2.fc44.s390x"
@ -1252,7 +1255,7 @@
"evra": "1.28.1-1.fc44.s390x"
},
"sudo": {
"evra": "1.9.17-8.p2.fc44.s390x"
"evra": "1.9.17-10.p2.fc44.s390x"
},
"systemd": {
"evra": "259.9-1.fc44.s390x"
@ -1300,7 +1303,7 @@
"evra": "4.1.3-9.fc44.s390x"
},
"tzdata": {
"evra": "2026c-2.fc44.noarch"
"evra": "2026e-1.fc44.noarch"
},
"udisks2": {
"evra": "2.11.2-1.fc44.s390x"
@ -1339,7 +1342,7 @@
"evra": "2.47-1.fc44.noarch"
},
"xxhash-libs": {
"evra": "0.8.3-4.fc44.s390x"
"evra": "0.8.4-1.fc44.s390x"
},
"xz": {
"evra": "1:5.8.2-2.fc44.s390x"
@ -1364,6 +1367,6 @@
}
},
"metadata": {
"generated": "2026-09-28T00:00:00Z"
"generated": "2026-10-12T00:00:00Z"
}
}

109
manifest-lock.x86_64.json
View file

@ -115,7 +115,7 @@
"evra": "4.9-1.fc44.x86_64"
},
"cifs-utils": {
"evra": "7.7-1.fc44.x86_64"
"evra": "7.8-2.fc44.x86_64"
},
"clevis": {
"evra": "21-14.fc44.x86_64"
@ -157,7 +157,7 @@
"evra": "0.21.3-13.fc44.noarch"
},
"container-selinux": {
"evra": "4:2.247.0-1.fc44.noarch"
"evra": "4:2.250.0-1.fc44.noarch"
},
"containerd": {
"evra": "2.3.5-1.fc44.x86_64"
@ -169,10 +169,10 @@
"evra": "5:0.67.2-1.fc44.noarch"
},
"coreos-installer": {
"evra": "0.26.0-3.fc44.x86_64"
"evra": "0.27.0-1.fc44.x86_64"
},
"coreos-installer-bootinfra": {
"evra": "0.26.0-3.fc44.x86_64"
"evra": "0.27.0-1.fc44.x86_64"
},
"coreutils": {
"evra": "9.10-5.fc44.x86_64"
@ -208,7 +208,7 @@
"evra": "2.8.8-1.fc44.x86_64"
},
"curl": {
"evra": "8.18.0-10.fc44.x86_64"
"evra": "8.18.0-12.fc44.x86_64"
},
"cyrus-sasl-gssapi": {
"evra": "2.1.28-35.fc44.x86_64"
@ -259,7 +259,7 @@
"evra": "2.92rel2-9.fc44.x86_64"
},
"docker-cli": {
"evra": "29.7.2-1.fc44.x86_64"
"evra": "29.8.2-2.fc44.x86_64"
},
"dosfstools": {
"evra": "4.2-18.fc44.x86_64"
@ -304,7 +304,7 @@
"evra": "2:7.1-1.fc44.x86_64"
},
"expat": {
"evra": "2.8.3-1.fc44.x86_64"
"evra": "2.8.5-1.fc44.x86_64"
},
"fedora-gpg-keys": {
"evra": "44-2.noarch"
@ -337,7 +337,7 @@
"evra": "1:4.10.0-7.fc44.x86_64"
},
"flatpak-session-helper": {
"evra": "1.18.2-1.fc44.x86_64"
"evra": "1.18.4-1.fc44.x86_64"
},
"fmt": {
"evra": "11.2.0-4.fc44.x86_64"
@ -346,7 +346,7 @@
"evra": "0.6.1-14.fc44.x86_64"
},
"fuse-common": {
"evra": "3.18.2-1.fc44.x86_64"
"evra": "3.18.3-1.fc44.x86_64"
},
"fuse-overlayfs": {
"evra": "1.17-1.fc44.x86_64"
@ -355,10 +355,10 @@
"evra": "3.7.6-1.fc44.x86_64"
},
"fuse3": {
"evra": "3.18.2-1.fc44.x86_64"
"evra": "3.18.3-1.fc44.x86_64"
},
"fuse3-libs": {
"evra": "3.18.2-1.fc44.x86_64"
"evra": "3.18.3-1.fc44.x86_64"
},
"fwupd": {
"evra": "2.1.8-1.fc44.x86_64"
@ -385,22 +385,22 @@
"evra": "0.26-5.fc44.x86_64"
},
"git-core": {
"evra": "2.55.0-1.fc44.x86_64"
"evra": "2.56.0-1.fc44.x86_64"
},
"glib2": {
"evra": "2.88.3-1.fc44.x86_64"
"evra": "2.88.4-1.fc44.x86_64"
},
"glibc": {
"evra": "2.43-8.fc44.x86_64"
"evra": "2.43-9.fc44.x86_64"
},
"glibc-common": {
"evra": "2.43-8.fc44.x86_64"
"evra": "2.43-9.fc44.x86_64"
},
"glibc-gconv-extra": {
"evra": "2.43-8.fc44.x86_64"
"evra": "2.43-9.fc44.x86_64"
},
"glibc-minimal-langpack": {
"evra": "2.43-8.fc44.x86_64"
"evra": "2.43-9.fc44.x86_64"
},
"gmp": {
"evra": "1:6.3.0-5.fc44.x86_64"
@ -439,22 +439,22 @@
"evra": "3.12-3.fc44.x86_64"
},
"grub2-common": {
"evra": "1:2.12-64.fc44.noarch"
"evra": "1:2.12-66.fc44.noarch"
},
"grub2-efi-x64": {
"evra": "1:2.12-64.fc44.x86_64"
"evra": "1:2.12-66.fc44.x86_64"
},
"grub2-pc": {
"evra": "1:2.12-64.fc44.x86_64"
"evra": "1:2.12-66.fc44.x86_64"
},
"grub2-pc-modules": {
"evra": "1:2.12-64.fc44.noarch"
"evra": "1:2.12-66.fc44.noarch"
},
"grub2-tools": {
"evra": "1:2.12-64.fc44.x86_64"
"evra": "1:2.12-66.fc44.x86_64"
},
"grub2-tools-minimal": {
"evra": "1:2.12-64.fc44.x86_64"
"evra": "1:2.12-66.fc44.x86_64"
},
"gssproxy": {
"evra": "0.9.2-10.fc44.x86_64"
@ -466,7 +466,7 @@
"evra": "3.25-4.fc44.x86_64"
},
"hwdata": {
"evra": "0.411-1.fc44.noarch"
"evra": "0.412-1.fc44.noarch"
},
"ignition": {
"evra": "2.27.0-3.fc44.x86_64"
@ -481,7 +481,7 @@
"evra": "20260916-1.fc44.noarch"
},
"ipcalc": {
"evra": "1.0.3-13.fc44.x86_64"
"evra": "1.1.0-4.fc44.x86_64"
},
"iproute": {
"evra": "6.17.0-2.fc44.x86_64"
@ -544,16 +544,16 @@
"evra": "1.0.61-1.fc44.x86_64"
},
"kernel": {
"evra": "7.2.7-200.fc44.x86_64"
"evra": "7.2.9-201.fc44.x86_64"
},
"kernel-core": {
"evra": "7.2.7-200.fc44.x86_64"
"evra": "7.2.9-201.fc44.x86_64"
},
"kernel-modules": {
"evra": "7.2.7-200.fc44.x86_64"
"evra": "7.2.9-201.fc44.x86_64"
},
"kernel-modules-core": {
"evra": "7.2.7-200.fc44.x86_64"
"evra": "7.2.9-201.fc44.x86_64"
},
"kexec-tools": {
"evra": "2.0.32-3.fc44.x86_64"
@ -661,7 +661,7 @@
"evra": "1.47.3-4.fc44.x86_64"
},
"libcurl-minimal": {
"evra": "8.18.0-10.fc44.x86_64"
"evra": "8.18.0-12.fc44.x86_64"
},
"libdaemon": {
"evra": "0.14-33.fc44.x86_64"
@ -751,10 +751,10 @@
"evra": "10-2.fc44.x86_64"
},
"libmaxminddb": {
"evra": "1.14.0-1.fc44.x86_64"
"evra": "1.14.1-1.fc44.x86_64"
},
"libmd": {
"evra": "1.2.0-1.fc44.x86_64"
"evra": "1.3.0-1.fc44.x86_64"
},
"libmnl": {
"evra": "1.0.5-9.fc44.x86_64"
@ -801,6 +801,9 @@
"libpath_utils": {
"evra": "0.2.1-61.fc44.x86_64"
},
"libpathrs": {
"evra": "0.2.6-1.fc44.x86_64"
},
"libpcap": {
"evra": "14:1.10.7-1.fc44.x86_64"
},
@ -820,7 +823,7 @@
"evra": "0.1.5-61.fc44.x86_64"
},
"librepo": {
"evra": "1.21.0-2.fc44.x86_64"
"evra": "1.21.2-1.fc44.x86_64"
},
"libreport-filesystem": {
"evra": "2.17.15-10.fc44.noarch"
@ -850,7 +853,7 @@
"evra": "2:4.24.7-1.fc44.x86_64"
},
"libsolv": {
"evra": "0.7.39-1.fc44.x86_64"
"evra": "0.7.40-1.fc44.x86_64"
},
"libss": {
"evra": "1.47.3-4.fc44.x86_64"
@ -988,10 +991,10 @@
"evra": "2:2.1-74.fc44.x86_64"
},
"moby-engine": {
"evra": "29.7.2-1.fc44.x86_64"
"evra": "29.8.2-2.fc44.x86_64"
},
"moby-filesystem": {
"evra": "29.7.2-1.fc44.noarch"
"evra": "29.8.2-2.fc44.noarch"
},
"mokutil": {
"evra": "2:0.7.2-3.fc44.x86_64"
@ -1057,25 +1060,25 @@
"evra": "1.8-4.fc44.x86_64"
},
"nspr": {
"evra": "4.39.0-5.fc44.x86_64"
"evra": "4.39.0-6.fc44.x86_64"
},
"nss": {
"evra": "3.129.0-1.fc44.x86_64"
"evra": "3.130.0-1.fc44.x86_64"
},
"nss-altfiles": {
"evra": "2.23.0-9.fc44.x86_64"
},
"nss-softokn": {
"evra": "3.129.0-1.fc44.x86_64"
"evra": "3.130.0-1.fc44.x86_64"
},
"nss-softokn-freebl": {
"evra": "3.129.0-1.fc44.x86_64"
"evra": "3.130.0-1.fc44.x86_64"
},
"nss-sysinit": {
"evra": "3.129.0-1.fc44.x86_64"
"evra": "3.130.0-1.fc44.x86_64"
},
"nss-util": {
"evra": "3.129.0-1.fc44.x86_64"
"evra": "3.130.0-1.fc44.x86_64"
},
"numactl": {
"evra": "2.0.19-4.fc44.x86_64"
@ -1108,10 +1111,10 @@
"evra": "10.2p1-14.fc44.x86_64"
},
"openssl": {
"evra": "1:3.5.8-1.fc44.x86_64"
"evra": "1:3.5.9-1.fc44.x86_64"
},
"openssl-libs": {
"evra": "1:3.5.8-1.fc44.x86_64"
"evra": "1:3.5.9-1.fc44.x86_64"
},
"os-prober": {
"evra": "1.81-11.fc44.x86_64"
@ -1138,10 +1141,10 @@
"evra": "0.1.12-1.fc44.x86_64"
},
"passt": {
"evra": "0^20260728.gf8df3f1-2.fc44.x86_64"
"evra": "0^20261002.gcba3570-1.fc44.x86_64"
},
"passt-selinux": {
"evra": "0^20260728.gf8df3f1-2.fc44.noarch"
"evra": "0^20261002.gcba3570-1.fc44.noarch"
},
"pciutils": {
"evra": "3.15.0-1.fc44.x86_64"
@ -1228,10 +1231,10 @@
"evra": "1.10.3-1.fc44.x86_64"
},
"rsync": {
"evra": "3.5.0-2.fc44.x86_64"
"evra": "3.5.1-1.fc44.x86_64"
},
"runc": {
"evra": "2:1.5.1-1.fc44.x86_64"
"evra": "2:1.5.2-3.fc44.x86_64"
},
"samba-client-libs": {
"evra": "2:4.24.7-1.fc44.x86_64"
@ -1276,7 +1279,7 @@
"evra": "2.4-3.fc44.x86_64"
},
"shim-x64": {
"evra": "16.1-5.x86_64"
"evra": "16.1-7.x86_64"
},
"skopeo": {
"evra": "1:1.22.3-1.fc44.x86_64"
@ -1333,7 +1336,7 @@
"evra": "1.28.1-1.fc44.x86_64"
},
"sudo": {
"evra": "1.9.17-8.p2.fc44.x86_64"
"evra": "1.9.17-10.p2.fc44.x86_64"
},
"systemd": {
"evra": "259.9-1.fc44.x86_64"
@ -1381,7 +1384,7 @@
"evra": "4.1.3-9.fc44.x86_64"
},
"tzdata": {
"evra": "2026c-2.fc44.noarch"
"evra": "2026e-1.fc44.noarch"
},
"udisks2": {
"evra": "2.11.2-1.fc44.x86_64"
@ -1420,7 +1423,7 @@
"evra": "2.47-1.fc44.noarch"
},
"xxhash-libs": {
"evra": "0.8.3-4.fc44.x86_64"
"evra": "0.8.4-1.fc44.x86_64"
},
"xz": {
"evra": "1:5.8.2-2.fc44.x86_64"
@ -1445,6 +1448,6 @@
}
},
"metadata": {
"generated": "2026-09-28T00:00:00Z"
"generated": "2026-10-12T00:00:00Z"
}
}

62
manifests/fedora-coreos.yaml
View file

@ -35,24 +35,6 @@ conditional-include:
include:
ostree-layers:
- overlay.d/10aarch64
# Temporary workaround. containers-common moved policy.json from
# /etc/containers to /usr/share/containers. The rpm-ostreed bind mount
# could use CONTAINERS_POLICY_JSON env var instead, but bootc has a
# hardcoded path that prevents this approach.
# Copy the file until bootc supports the new config location.
#
# See:
# https://github.com/bootc-dev/bootc/issues/2258
# https://github.com/coreos/fedora-coreos-config/issues/4215
- if: releasever >= 45
include:
postprocess:
- |
#!/usr/bin/bash
set -eux -o pipefail
src=/usr/share/containers/policy.json
dest=/etc/containers/policy.json
cp "${src}" "${dest}"
# Hack to avoid running out of space on aarch64. This should save us a lot of space.
# https://github.com/coreos/fedora-coreos-tracker/issues/2222
@ -72,6 +54,25 @@ conditional-include:
#!/usr/bin/env bash
set -eux -o pipefail
rm -vrf /usr/lib/modules/*aarch64/dtb/qcom/
# Dracut 111 has a bug, which causes our CI to fail. This bug has been fixed in Dracut 112, and is
# in the process of being backported to 111. While we wait for the backport / release, we will manually
# patch this file.
#
# Tracker: https://github.com/coreos/fedora-coreos-tracker/issues/2206
# Upsteam patch: https://github.com/dracut-ng/dracut/pull/2494
- if: releasever >= 45
include:
postprocess:
- |
#!/usr/bin/env bash
set -eux -o pipefail
crypt_generator_path="/usr/lib/dracut/modules.d/70crypt/crypt-generator.sh"
expected_sha="e47fa3ecf60760b0613b175ed70b61d42bb9e15a211448668ba3cd53fdd4995f"
if sha256sum "${crypt_generator_path}" | grep -q "^${expected_sha}"; then
sed -i 's/return /exit /g' "${crypt_generator_path}"
fi
# WARN: Temporary workaround
#
@ -91,6 +92,13 @@ conditional-include:
ostree-layers:
- overlay.d/16fcos-sshd-workaround
# Backward compatibility: rescue/warn firstboot network config
# coreos-installer placed in /boot. Drop when Fedora 46 lands.
- if: releasever <= 45
include:
ostree-layers:
- overlay.d/11legacy-copy-network
ostree-layers:
- overlay.d/09misc
- overlay.d/10disk-images
@ -221,6 +229,24 @@ postprocess:
set -eux -o pipefail
systemctl mask dnsmasq.service
# Mask systemd's new IMDS subsystem (systemd >= 262, ENABLE_IMDS). On cloud
# guests systemd-imds-generator pulls in systemd-imds-early-network.service,
# which runs `systemd-imdsd --setup-network` in the init_t domain and is
# denied by SELinux when writing net_conf_t / systemd_resolved_var_run_t,
# so the unit fails and trips the boot health check. FCOS gets metadata via
# afterburn and configures networking via NetworkManager, so it does not
# need systemd's IMDS pre-networking. Mask the whole subsystem until (if
# ever) it is wanted and selinux-policy grows rules for it.
# https://github.com/coreos/fedora-coreos-tracker/issues/2232
- |
#!/usr/bin/bash
set -eux -o pipefail
systemctl mask systemd-imds-early-network.service \
systemd-imds-import.service \
systemd-imds-metrics.socket \
systemd-imdsd.socket \
systemd-imdsd@.service
# sudo prefers its config files to be mode 440, and some security scanners
# complain if /etc/sudoers.d files are world-readable.
# https://bugzilla.redhat.com/show_bug.cgi?id=1981979

9
manifests/shared-el10.yaml
View file

@ -1,4 +1,13 @@
# Shared with EL 10 (CentOS Stream 10 and RHCOS 10) only
# Backward compatibility: rescue/warn firstboot network config
# coreos-installer placed in /boot. This will drop out in EL11+.
conditional-include:
- if: id != "fedora"
include:
ostree-layers:
- fedora-coreos-config/overlay.d/11legacy-copy-network
packages:
# GPU Firmware files (not broken out into subpackage of linux-firmware in RHEL yet)
- amd-gpu-firmware intel-gpu-firmware nvidia-gpu-firmware

9
manifests/shared-el9.yaml
View file

@ -1,4 +1,13 @@
# Shared with EL 9 (CentOS Stream 9 and RHCOS 9) only
# Backward compatibility: rescue/warn firstboot network config
# coreos-installer placed in /boot. This will drop out in EL11+..
conditional-include:
- if: id != "fedora"
include:
ostree-layers:
- fedora-coreos-config/overlay.d/11legacy-copy-network
packages:
# Teaming https://github.com/coreos/fedora-coreos-config/pull/289
# and http://bugzilla.redhat.com/1758162

32
overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-diskful-generator
View file

@ -103,36 +103,34 @@ if ! cmdline_bool 'ignition.firstboot'; then
exit 0
fi
# coreos-ignition-setup-user.service and `coreos-copy-firstboot-network.service`
# coreos-ignition-setup-user.service
# should depend on the boot device node only on diskful boots
mkdir -p "${UNIT_DIR}/coreos-ignition-setup-user.service.d"
mkdir -p "${UNIT_DIR}/coreos-copy-firstboot-network.service.d"
cat > "${UNIT_DIR}/coreos-ignition-setup-user.service.d/diskful.conf" <<EOF
[Unit]
Requires=dev-disk-by\x2dlabel-boot.device
After=dev-disk-by\x2dlabel-boot.device
EOF
cp "${UNIT_DIR}/coreos-ignition-setup-user.service.d/diskful.conf" \
"${UNIT_DIR}/coreos-copy-firstboot-network.service.d/diskful.conf"
# If booting from iSCSI, then we need networking first before we
# can see the bootfs. This has some implications.
# If booting from iSCSI, the boot device (where the Ignition config lives)
# is only reachable after networking is up. Note: this is about the Ignition
# config, not the network config — network config is already in the initramfs
# (placed there by coreos-installer) and handled by
# coreos-copy-firstboot-network.service without needing the boot device.
#
# Since `ignition-fetch-offline.service` tries to read the Ignition config
# from the boot device immediately (before networking), it would fail on
# iSCSI. We neuter it and let `ignition-fetch.service` (which runs after
# networking is up) fetch the Ignition config instead.
if test -n "$(cmdline_arg rd.iscsi.firmware)" || test -n "$(cmdline_arg netroot)"; then
mkdir -p "${EARLY_DIR}/ignition-complete.target.requires"
# In the injected Ignition config case, `coreos-ignition-setup-user.service`
# can't "pass" the config to `ignition-fetch-offline.service`. So we neuter
# the latter so that `ignition-fetch.service` (which runs after networking
# comes up) can pick it up instead.
ln -sf /dev/null "${EARLY_DIR}/ignition-complete.target.requires/ignition-fetch-offline.service"
# activate ignition-fetch.service
# The boot device is behind the network on iSCSI; neuter the legacy
# rescue service to avoid a deadlock with its
# After=dev-disk-by\x2dlabel-boot.device ordering.
ln -sf /dev/null "${EARLY_DIR}/ignition-complete.target.requires/coreos-rescue-misplaced-network.service"
mkdir -p /run/ignition
touch /run/ignition/neednet
# With iSCSI, configuring networking via kargs is a hard requirement
# since it can't be picked up from the bootfs (i.e. injected via
# `--copy-network`). So neuter `coreos-copy-firstboot-network.service`.
ln -sf /dev/null "${EARLY_DIR}/ignition-complete.target.requires/coreos-copy-firstboot-network.service"
fi
# create symlink for udev rule

26
overlay.d/05core/usr/lib/dracut/modules.d/35coreos-network/coreos-copy-firstboot-network.service
View file

@ -1,17 +1,11 @@
# This unit will run early in boot and detect if:
# - In the diskful case, the user copied in firstboot networking config files
# into `/boot` (most likely by using `coreos-installer install
# - user embedded firstboot networking config files
# into the initramfs `/etc` (by using `coreos-installer install
# --copy-network`).
# - In the live case, the user provided firstboot networking config files in
# `/etc` (most likely by using `coreos-installer iso network embed`).
#
# Since this unit is modifying network configuration there are some
# dependencies that we have:
#
# - In the diskful case, we need to look for networking configuration on the
# /boot partition
# - i.e. after /dev/disk/by-label/boot is available
# - which is injected via coreos-diskful-generator
# - Need to run before networking is brought up.
# - This is done in nm-initrd.service [1]
# - i.e. Before=nm-initrd.service
@ -23,8 +17,7 @@
# - Another is to run *after* nm-config.sh [2] in dracut-cmdline [3]
# and just delete all the files created by nm-initrd-generator.
# - i.e. After=dracut-cmdline.service, but Before=nm-initrd.service
# - We'll go with the second option here because the need for the /boot
# device (mentioned above) means we can't start before dracut-cmdline.service
# - We'll go with the second option here.
#
# [1] https://github.com/dracutdevs/dracut/blob/master/modules.d/35network-manager/nm-initrd.service
# [2] https://github.com/dracutdevs/dracut/blob/master/modules.d/35network-manager/nm-config.sh
@ -33,30 +26,19 @@
[Unit]
Description=Copy CoreOS Firstboot Networking Config
ConditionPathExists=/usr/lib/initrd-release
ConditionPathExists=/etc/coreos-firstboot-network
DefaultDependencies=false
# We're pulled in by ignition-complete.target; as good practice, add a matching
# Before to be explicit about it gating on this unit passing.
Before=ignition-complete.target
Before=nm-initrd.service
# compat: remove when everyone is on dracut 054+
Before=dracut-initqueue.service
After=dracut-cmdline.service
# And since the boot device may be on multipath; optionally wait for it to
# appear via the dynamic target.
After=coreos-multipath-wait.target
# Need to run after coreos-enable-network since it may re-run the NM cmdline
# hook which will generate NM configs from the network kargs, but we want to
# have precedence.
After=coreos-enable-network.service
# We've seen races with ignition-kargs.service, which accesses /boot rw.
# Let's introduce some ordering here. Need to use `Before` because otherwise
# we get a systemd ordering cycle. https://github.com/coreos/fedora-coreos-tracker/issues/883
Before=ignition-kargs.service
[Service]
Type=oneshot
RemainAfterExit=yes
# The MountFlags=slave is so the umount of /boot is guaranteed to happen
# /boot will only be mounted for the lifetime of the unit.
MountFlags=slave
ExecStart=/usr/sbin/coreos-copy-firstboot-network

29
overlay.d/05core/usr/lib/dracut/modules.d/35coreos-network/coreos-copy-firstboot-network.sh
View file

@ -3,10 +3,7 @@ set -euo pipefail
# For a description of how this is used see coreos-copy-firstboot-network.service
bootmnt=/mnt/boot_partition
bootdev=/dev/disk/by-label/boot
firstboot_network_dir_basename="coreos-firstboot-network"
boot_firstboot_network_dir="${bootmnt}/${firstboot_network_dir_basename}"
etc_firstboot_network_dir="/etc/${firstboot_network_dir_basename}"
initramfs_network_dir="/run/NetworkManager/system-connections/"
@ -23,27 +20,9 @@ copy_firstboot_network() {
cp -v ${src}/* ${initramfs_network_dir}/
}
if ! is-live-image; then
# Mount /boot. Note that we mount /boot but we don't unmount boot because we
# are run in a systemd unit with MountFlags=slave so it is unmounted for us.
# Mount as read-only since we don't strictly need write access and we may be
# running alongside other code that also has it mounted ro
mkdir -p ${bootmnt}
mount -o ro ${bootdev} ${bootmnt}
if [ -n "$(ls -A ${boot_firstboot_network_dir} 2>/dev/null)" ]; then
# Likely placed there by coreos-installer, see:
# https://github.com/coreos/coreos-installer/pull/212
copy_firstboot_network "${boot_firstboot_network_dir}"
else
echo "info: no files to copy from ${boot_firstboot_network_dir}; skipping"
fi
if [ -n "$(ls -A ${etc_firstboot_network_dir} 2>/dev/null)" ]; then
# coreos-installer always copies to /etc/coreos-firstboot-network
copy_firstboot_network "${etc_firstboot_network_dir}"
else
if [ -n "$(ls -A ${etc_firstboot_network_dir} 2>/dev/null)" ]; then
# Also placed there by coreos-installer but in a different flow, see:
# https://github.com/coreos/coreos-installer/pull/713
copy_firstboot_network "${etc_firstboot_network_dir}"
else
echo "info: no files to copy from ${etc_firstboot_network_dir}; skipping"
fi
echo "info: no files to copy from ${etc_firstboot_network_dir}; skipping"
fi

14
overlay.d/05core/usr/lib/dracut/modules.d/35coreos-network/coreos-enable-network.sh
View file

@ -21,7 +21,15 @@ if ! dracut_func getargbool 0 'rd.neednet'; then
# dracut-cmdline.service because we need udev. We should be able to move
# away from this once we run NM as a systemd unit. See also:
# https://github.com/coreos/fedora-coreos-config/pull/346#discussion_r409843428
set +euo pipefail
. /usr/lib/dracut/hooks/cmdline/99-nm-config.sh
set -euo pipefail
#
# See supported locations for hooks:
# https://github.com/dracut-ng/dracut/commit/04d5e2944e1b1a85a945910995cb8df00d983a7c
for hook_path in /var/lib/dracut/hooks /usr/lib/dracut/hooks; do
hook_file="${hook_path}/cmdline/99-nm-config.sh"
if [ -f "${hook_file}" ]; then
set +euo pipefail
. "${hook_file}"
set -euo pipefail
fi
done
fi

30
overlay.d/11legacy-copy-network/usr/lib/dracut/modules.d/36legacy-copy-network/coreos-rescue-misplaced-network.service Normal file
View file

@ -0,0 +1,30 @@
# If an older coreos-installer wrote firstboot network config to
# /boot/coreos-firstboot-network, copy it directly to the NetworkManager
# connections directory. Mutually exclusive with
# coreos-copy-firstboot-network.service via ConditionPathExists.
[Unit]
Description=Rescue Misplaced Firstboot Network Config From /boot
ConditionPathExists=/usr/lib/initrd-release
ConditionPathExists=!/etc/coreos-firstboot-network
ConditionPathExists=/dev/disk/by-label/boot
# We're pulled in by ignition-complete.target; as good practice, add a matching
# Before to be explicit about it gating on this unit passing.
Before=ignition-complete.target
Before=nm-initrd.service
After=dracut-cmdline.service
After=coreos-enable-network.service
# Wait for the boot device so ConditionPathExists is evaluated reliably.
# On iSCSI, coreos-diskful-generator neuters this unit to avoid a
# deadlock (the boot device is behind the network there).
After=dev-disk-by\x2dlabel-boot.device
# The boot device may be on multipath; optionally wait for it to
# appear via the dynamic target.
After=coreos-multipath-wait.target
# Avoid races with ignition-kargs.service which accesses /boot rw.
Before=ignition-kargs.service
[Service]
Type=oneshot
RemainAfterExit=yes
MountFlags=slave
ExecStart=/usr/sbin/coreos-rescue-misplaced-network

50
overlay.d/11legacy-copy-network/usr/lib/dracut/modules.d/36legacy-copy-network/coreos-rescue-misplaced-network.sh Executable file
View file

@ -0,0 +1,50 @@
#!/bin/bash
set -euo pipefail
# Rescue firstboot network config that an older coreos-installer placed
# in /boot/coreos-firstboot-network. Copy it directly to the
# NetworkManager connections directory so it is applied for this boot.
# This service is mutually exclusive with coreos-copy-firstboot-network:
# either the config is in the initramfs /etc (new installer) or in
# /boot (old installer), but not both.
bootmnt=/mnt/boot_partition
bootdev=/dev/disk/by-label/boot
boot_firstboot_network_dir="${bootmnt}/coreos-firstboot-network"
initramfs_network_dir="/run/NetworkManager/system-connections/"
if [ ! -b "${bootdev}" ]; then
echo "info: boot device ${bootdev} not found; skipping legacy network rescue"
exit 0
fi
mkdir -p "${bootmnt}"
if ! mount -o ro "${bootdev}" "${bootmnt}"; then
echo "warning: failed to mount ${bootdev}; skipping legacy network rescue"
exit 0
fi
warn() {
echo "$@"
echo "$@" > /dev/kmsg || true
}
if [ -n "$(ls -A "${boot_firstboot_network_dir}" 2>/dev/null)" ]; then
warn "warning: found legacy firstboot network config in ${boot_firstboot_network_dir}"
warn "warning: an older coreos-installer placed network config in /boot instead of the initramfs"
warn "warning: rescuing config — copying to ${initramfs_network_dir}"
warn "warning: re-install using an updated coreos-installer to avoid this in the future"
# Clear any configs auto-generated by nm-initrd-generator from
# kernel command line args so the --copy-network config takes priority.
rm -vf ${initramfs_network_dir}/*
mkdir -p ${initramfs_network_dir}
cp -v "${boot_firstboot_network_dir}"/* ${initramfs_network_dir}/
# Drop a flag so coreos-warn-misplaced-network.service on the
# real system can detect that legacy config was rescued and show
# a persistent MOTD warning. /run survives pivot_root into the
# real rootfs but /etc from the initramfs does not.
mkdir -p /run/coreos
touch /run/coreos/legacy-network-rescued
else
echo "info: no legacy network config in ${boot_firstboot_network_dir}; skipping"
fi

25
overlay.d/11legacy-copy-network/usr/lib/dracut/modules.d/36legacy-copy-network/module-setup.sh Normal file
View file

@ -0,0 +1,25 @@
check() {
if [[ $IN_KDUMP == 1 ]]; then
return 1
fi
}
depends() {
echo coreos-network
}
install_and_enable_unit() {
unit="$1"; shift
target="$1"; shift
inst_simple "$moddir/$unit" "$systemdsystemunitdir/$unit"
# note we `|| exit 1` here so we error out if e.g. the units are missing
# see https://github.com/coreos/fedora-coreos-config/issues/799
systemctl -q --root="$initdir" add-requires "$target" "$unit" || exit 1
}
install() {
inst_simple "$moddir/coreos-rescue-misplaced-network.sh" \
"/usr/sbin/coreos-rescue-misplaced-network"
install_and_enable_unit "coreos-rescue-misplaced-network.service" \
"ignition-complete.target"
}

1
overlay.d/11legacy-copy-network/usr/lib/systemd/system-preset/45-coreos-warn-misplaced-network.preset Normal file
View file

@ -0,0 +1 @@
enable coreos-warn-misplaced-network.service

12
overlay.d/11legacy-copy-network/usr/lib/systemd/system/coreos-warn-misplaced-network.service Normal file
View file

@ -0,0 +1,12 @@
[Unit]
Description=Warn if firstboot network config was placed in /boot by older coreos-installer
ConditionFirstBoot=true
ConditionPathExists=/run/coreos/legacy-network-rescued
[Service]
Type=oneshot
ExecStart=/usr/libexec/coreos-warn-misplaced-network
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target

27
overlay.d/11legacy-copy-network/usr/libexec/coreos-warn-misplaced-network Executable file
View file

@ -0,0 +1,27 @@
#!/bin/bash
set -euo pipefail
MOTD_FILE="/etc/motd.d/coreos-warn-misplaced-network.motd"
YELLOW=$(echo -e '\033[0;33m')
RESET=$(echo -e '\033[0m')
mkdir -p /etc/motd.d
cat > "${MOTD_FILE}" <<EOF
${YELLOW}
##########################################################################
WARNING: MISPLACED FIRSTBOOT NETWORK CONFIGURATION DETECTED
During first boot, network configuration was found in
/boot/coreos-firstboot-network. This was placed there by an older
version of coreos-installer. The configuration was automatically
rescued and applied, but this compatibility workaround will be
removed in a future release.
ACTION REQUIRED: Re-install using an updated coreos-installer that
embeds network config in the initramfs instead of /boot.
See https://docs.fedoraproject.org/en-US/fedora-coreos/faq/#_why_am_i_getting_a_warning_about_misplaced_firstboot_network_configuration
To dismiss this warning, delete /etc/motd.d/coreos-warn-misplaced-network.motd
##########################################################################
${RESET}
EOF

6
overlay.d/17fcos-container-signing/usr/lib/systemd/system/rpm-ostreed.service.d/coreos-containers-policy.conf
View file

@ -1,7 +1,7 @@
# Bind mount in our containers policy.json that configures
# how to do signature verification for quay.io/fedora/fedora-coreos
# Point rpm-ostree at our containers policy.json that configures
# container image signature verification
# Remove this override with:
# mkdir /etc/systemd/system/rpm-ostreed.service.d
# ln -s /dev/null /etc/systemd/system/rpm-ostreed.service.d/coreos-containers-policy.conf
[Service]
BindReadOnlyPaths=/usr/lib/coreos/coreos-containers-policy.json:/etc/containers/policy.json
Environment=CONTAINERS_POLICY_JSON=/usr/lib/coreos/coreos-containers-policy.json

3
tests/kola/podman/remote-ssh/config.bu
View file

@ -9,6 +9,9 @@ passwd:
- name: root
ssh_authorized_keys:
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdRYc7DLXX6EJX6sZsr3LDEqn/1W9SGhcleXRdmSczL core@test
- name: core
ssh_authorized_keys:
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdRYc7DLXX6EJX6sZsr3LDEqn/1W9SGhcleXRdmSczL core@test
storage:
files:
- path: /home/core/.ssh/test_key

28
tests/kola/podman/remote-ssh/test.sh
View file

@ -2,7 +2,7 @@
## kola:
## tags: platform-independent
## exclusive: true
## creationDate: 2026-09-02
## creationDate: 2026-09-29
## description: Verify that podman-remote can connect to the podman
## socket via SSH.
#
@ -12,16 +12,32 @@
# See:
# - https://github.com/coreos/fedora-coreos-tracker/issues/2217
# - https://github.com/fedora-selinux/selinux-policy/issues/3392
#
# Private key, authorized_keys, and podman.socket for both rootless and rootful checks
# are provisioned via config.bu.
set -xeuo pipefail
# shellcheck disable=SC1091
. "$KOLA_EXT_DATA/commonlib.sh"
# Private key, root authorized_keys, and podman.socket are provisioned via config.bu
run_as_core_user podman system connection add --identity /home/core/.ssh/test_key con1 root@localhost
if ! run_as_core_user podman --connection con1 info; then
# ROOTLESS
run_as_core_user systemctl --user enable --now podman.socket
run_as_core_user podman system connection add --identity /home/core/.ssh/test_key con-rootless core@localhost
if ! run_as_core_user podman --connection con-rootless info; then
ausearch -m avc -ts recent || true
fatal "podman-remote SSH connection to localhost failed"
fatal "podman-remote SSH connection to localhost as core failed"
fi
ok "podman-remote SSH connection to localhost as core succeeded"
# ROOTFUL (FCOS only)
# On RHCOS/SCOS, sshd refuses root login by default:
# https://github.com/coreos/rhel-coreos-config/blob/main/overlay.d/05rhcos/etc/ssh/sshd_config.d/40-rhcos-defaults.conf
if is_fcos; then
run_as_core_user podman system connection add --identity /home/core/.ssh/test_key con-root root@localhost
if ! run_as_core_user podman --connection con-root info; then
ausearch -m avc -ts recent || true
fatal "podman-remote SSH connection to localhost as root failed"
fi
ok "podman-remote SSH connection to localhost as root succeeded"
fi
ok "podman-remote SSH connection to localhost succeeded"

315
tests/kola/upgrade/extended/test.sh
View file

@ -14,20 +14,63 @@ set -eux -o pipefail
# shellcheck disable=SC1091
. "$KOLA_EXT_DATA/commonlib.sh"
. /etc/os-release # for $VERSION_ID
# This test will attempt to test an upgrade from a given starting
# point (assumed by the caller passing in a specific
# `cosa kola run --build=x.y.z`) all the way to the latest build
# that is staged to be released. The test is basic in that it
# essentially tests 1) updates work 2) boot works.
# This test starts from a caller-selected build (`cosa kola run
# --build=x.y.z`) and verifies that it can update and boot. Only production
# streams have update graphs, so the test harness that is running this test
# (i.e. the one calling `cosa kola run`) will need to determine what stream
# makes the most sense to use as a starting point for the test.
#
# For example, the kola-upgrade test in the Fedora CoreOS pipeline uses this
# mapping to map each requested FCOS stream to a production stream for the
# graph-based update:
#
# stable -> stable
# testing -> testing
# next -> next
# testing-devel -> testing
# next-devel -> next
# branched -> next
# rawhide -> next
#
# Zincati follows that production stream's graph to its latest release. The
# test then upgrades to the latest build in the requested target stream and
# verifies that it boots. For example, a next-devel test first updates from
# next, then upgrades to the next-devel candidate build (the current build
# under test).
#
# `/etc/target_stream` selects a target stream different from the booted
# build's stream (this is only necessary if you are targeting a different
# stream than the starting build).
# An example invocation for this test would look like:
#
# ```
# cat > target_stream.bu <<'EOF'
# variant: fcos
# version: 1.0.0
# storage:
# files:
# - path: /etc/target_stream
# mode: 0644
# contents:
# inline: |
# next-devel
# EOF
#
# cosa buildfetch --artifact=qemu --stream=next --decompress --build=45.20260913.1.1
# cosa kola run --build=45.20260913.1.1 --debug --tag extended-upgrade \
# --append-butane target_stream.bu
# ```
# ```
# cosa buildfetch --stream=next --build=34.20210904.1.0 --artifact=qemu
# cosa decompress --build=34.20210904.1.0
# cosa kola run --build=34.20210904.1.0 --tag extended-upgrade
# ```
# The target image must also be published for the test architecture. Otherwise
# the final `skopeo inspect` fails and so does the test. For example, if
# next-devel has no arm64 image, `skopeo` reports:
# `no image found in image index for architecture "arm64", variant "v8", OS "linux"`
#
# More info:
# - https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/kola-upgrade.Jenkinsfile
# - https://github.com/coreos/fedora-coreos-pipeline/blob/main/utils.groovy#L672
#
# You can monitor the progress from the console and journal:
# - everything:
@ -53,121 +96,6 @@ set -eux -o pipefail
# - aarch64 34.20210904.1.0
# - s390x 36.20220618.1.1
. /etc/os-release # for $VERSION_ID
need_restart='false'
arch=$(arch)
# If there is an ostree repo archive tarball, let's extract/use it.
if [ -f "$KOLA_EXT_DATA/ostree-repo.tar" ]; then
tar -C /srv/ -xf "$KOLA_EXT_DATA/ostree-repo.tar"
rm -vf "$KOLA_EXT_DATA/ostree-repo.tar"
# Switch to pulling from local ostree repo
cat <<'EOF' > /etc/ostree/remotes.d/fedora.conf
[remote "fedora"]
url=file:///srv/
gpg-verify=true
gpgkeypath=/etc/pki/rpm-gpg/
EOF
# make writable by all so below zincati ExecStartPre copy over it
chmod 666 /etc/ostree/remotes.d/fedora.conf
# The oci migration script had a check for the URL to make sure we only
# migrated the people who were using the defaults so we need to switch
# it back when the oci migration happens.
# https://github.com/coreos/fedora-coreos-config/blob/d4c815329d88dd9dbaf1902a2b60a08df4b41c1a/overlay.d/35oci-migration/usr/libexec/coreos-oci-rebase#L43
mkdir -p /etc/systemd/system/zincati.service.d
cat <<'EOF' > /etc/systemd/system/zincati.service.d/005-fixup-remote-url.conf
[Service]
ExecStartPre=/bin/bash -c \
"test -f /usr/lib/systemd/system/zincati.service.d/010-oci-migration.conf && \
cp -v /usr/etc/ostree/remotes.d/fedora.conf /etc/ostree/remotes.d/fedora.conf || true"
EOF
need_restart='true'
fi
# delete the disabling of updates that was done by the test framework
if [ -f /etc/zincati/config.d/90-disable-auto-updates.toml ]; then
rm -f /etc/zincati/config.d/90-disable-auto-updates.toml
need_restart='true'
fi
# Early `next` releases before [1] had auto-updates disabled too. Let's
# drop that config if it exists.
# [1] https://github.com/coreos/fedora-coreos-config/commit/99eab318998441760cca224544fc713651f7a16d
if [ -f /etc/zincati/config.d/90-disable-on-non-production-stream.toml ]; then
rm -f /etc/zincati/config.d/90-disable-on-non-production-stream.toml
need_restart='true'
fi
booted_deployment_json=$(rpm-ostree status --json | \
jq -r '.deployments[] | select(.booted == true)')
version=$(jq -r '.version' <<< "${booted_deployment_json}")
# The stream info can come from one of 3 places depending on how old
# the build is.
#
# 1. <=41 the stream was just directly attached to base-commit-meta
stream=$(jq -r '.["base-commit-meta"]["fedora-coreos.stream"]' <<< "${booted_deployment_json}")
if [ "${stream}" == "null" ]; then
# 2. In 42 we switched to shipping updates as containers and the stream moved to
# an annotation in the ostree manifest.
ostree_manifest=$(jq -r '.["base-commit-meta"]["ostree.manifest"]' <<< "${booted_deployment_json}")
if [ "${ostree_manifest}" != "null" ]; then
stream=$(jq -r '.annotations | .["fedora-coreos.stream"]' <<< "${ostree_manifest}")
fi
fi
if [ "${stream}" == "null" ]; then
# 3. In 43+ we moved to building the OS via container tools and we
# moved to the com.coreos.stream label.
container_image_config=$(jq -r '.["base-commit-meta"]["ostree.container.image-config"]' <<< "${booted_deployment_json}")
if [ "${container_image_config}" != "null" ]; then
stream=$(jq -r '.config.Labels["com.coreos.stream"]' <<< "${container_image_config}")
fi
fi
if [ -z "${stream}" -o "${stream}" == "null" ]; then
fatal "Stream was not detected from booted deployment"
fi
# Pick up the last release for the current stream from the update server
test -f /srv/updateinfo.json || \
curl -L "https://updates.coreos.fedoraproject.org/v1/graph?basearch=${arch}&stream=${stream}&rollout_wariness=0&oci=true" > /srv/updateinfo.json
# Extract all destination indexes and select the newest one.
#
# Edges contain [source, destination] node indexes.
# [.edges[][1]] | max // empty means:
# [.edges[][1]]
# - Iterate over every edge in .edges.
# - Extract element 1, the edge’s destination node index.
# - Collect those indexes into an array.
# max
# - Select the largest destination index.
# - If there are no edges, the result is null.
# // empty
# - If the result is null, emit no output.
# - In Bash, command substitution then produces an empty string.
last_release_index=$(jq -r '[.edges[][1]] | max // empty' /srv/updateinfo.json)
if [ -z "${last_release_index}" ]; then
fatal "Update graph contains no usable edges"
fi
# Grab the actual version string from the index.
last_release=$(jq -r --argjson index "${last_release_index}" \
'.nodes[$index].version' /srv/updateinfo.json)
if [ -z "${last_release}" ] || [ "${last_release}" == "null" ]; then
fatal "Update graph edge points to a missing node"
fi
# If the user dropped down a /etc/target_stream file then we'll
# pick up the info from there.
target_stream=$stream
test -f /etc/target_stream && target_stream=$(< /etc/target_stream)
test -f /srv/builds.json || \
curl -L "https://builds.coreos.fedoraproject.org/prod/streams/${target_stream}/builds/builds.json" > /srv/builds.json
target_version=$(jq -r .builds[0].id /srv/builds.json)
grab-gpg-keys() {
# For older FCOS we had an issue where when we tried to pull the
# commits from the repo it would fail if we were on N-2 because
@ -181,8 +109,8 @@ grab-gpg-keys() {
if [ ! -e $file ]; then
need_restart='true'
curl -L "https://src.fedoraproject.org/rpms/fedora-repos/raw/rawhide/f/RPM-GPG-KEY-fedora-${ver}-primary" | \
sudo tee $file
sudo chcon -v --reference="/etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-${VERSION_ID}-primary" $file
tee $file
chcon -v --reference="/etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-${VERSION_ID}-primary" $file
fi
done
}
@ -297,15 +225,102 @@ selinux-sanity-check() {
ok "Selinux sanity checks passed"
}
ok "Reached version: $version"
need_restart='false'
arch=$(arch)
# If there is an ostree repo archive tarball, let's extract/use it.
if [ -f "$KOLA_EXT_DATA/ostree-repo.tar" ]; then
tar -C /srv/ -xf "$KOLA_EXT_DATA/ostree-repo.tar"
rm -vf "$KOLA_EXT_DATA/ostree-repo.tar"
# Switch to pulling from local ostree repo
cat <<'EOF' > /etc/ostree/remotes.d/fedora.conf
[remote "fedora"]
url=file:///srv/
gpg-verify=true
gpgkeypath=/etc/pki/rpm-gpg/
EOF
# make writable by all so below zincati ExecStartPre copy over it
chmod 666 /etc/ostree/remotes.d/fedora.conf
# The oci migration script had a check for the URL to make sure we only
# migrated the people who were using the defaults so we need to switch
# it back when the oci migration happens.
# https://github.com/coreos/fedora-coreos-config/blob/d4c815329d88dd9dbaf1902a2b60a08df4b41c1a/overlay.d/35oci-migration/usr/libexec/coreos-oci-rebase#L43
mkdir -p /etc/systemd/system/zincati.service.d
cat <<'EOF' > /etc/systemd/system/zincati.service.d/005-fixup-remote-url.conf
[Service]
ExecStartPre=/bin/bash -c \
"test -f /usr/lib/systemd/system/zincati.service.d/010-oci-migration.conf && \
cp -v /usr/etc/ostree/remotes.d/fedora.conf /etc/ostree/remotes.d/fedora.conf || true"
EOF
need_restart='true'
fi
# delete the disabling of updates that was done by the test framework
if [ -f /etc/zincati/config.d/90-disable-auto-updates.toml ]; then
rm -f /etc/zincati/config.d/90-disable-auto-updates.toml
need_restart='true'
fi
# Early `next` releases before [1] had auto-updates disabled too. Let's
# drop that config if it exists.
# [1] https://github.com/coreos/fedora-coreos-config/commit/99eab318998441760cca224544fc713651f7a16d
if [ -f /etc/zincati/config.d/90-disable-on-non-production-stream.toml ]; then
rm -f /etc/zincati/config.d/90-disable-on-non-production-stream.toml
need_restart='true'
fi
# Avoid xtrace expanding JSON variables into large, noisy log entries.
set +x
booted_deployment_json=$(rpm-ostree status --json | \
jq -r '.deployments[] | select(.booted == true)')
version=$(jq -r '.version' <<< "${booted_deployment_json}")
ok "Reached version: ${version}"
# The stream info can come from one of 3 places depending on how old
# the build is.
#
# 1. <=41 the stream was just directly attached to base-commit-meta
stream=$(jq -r '.["base-commit-meta"]["fedora-coreos.stream"]' <<< "${booted_deployment_json}")
if [ "${stream}" == "null" ]; then
# 2. In 42 we switched to shipping updates as containers and the stream moved to
# an annotation in the ostree manifest.
ostree_manifest=$(jq -r '.["base-commit-meta"]["ostree.manifest"]' <<< "${booted_deployment_json}")
if [ "${ostree_manifest}" != "null" ]; then
stream=$(jq -r '.annotations | .["fedora-coreos.stream"]' <<< "${ostree_manifest}")
fi
fi
if [ "${stream}" == "null" ]; then
# 3. In 43+ we moved to building the OS via container tools and we
# moved to the com.coreos.stream label.
container_image_config=$(jq -r '.["base-commit-meta"]["ostree.container.image-config"]' <<< "${booted_deployment_json}")
if [ "${container_image_config}" != "null" ]; then
stream=$(jq -r '.config.Labels["com.coreos.stream"]' <<< "${container_image_config}")
fi
fi
if [ -z "${stream}" ] || [ "${stream}" == "null" ]; then
fatal "Stream was not detected from booted deployment"
fi
ok "Reached stream: ${stream}"
# If the user dropped down a /etc/target_stream file then we'll
# pick up the info from there.
target_stream=$stream
test -f /etc/target_stream && target_stream=$(< /etc/target_stream)
test -f /srv/builds.json || \
curl -L "https://builds.coreos.fedoraproject.org/prod/streams/${target_stream}/builds/builds.json" > /srv/builds.json
target_version=$(jq -r .builds[0].id /srv/builds.json)
ok "Target version: ${target_version}"
ok "Target stream: ${target_stream}"
# Are we all the way at the desired target version?
# If so then we can exit with success!
if vereq $version $target_version; then
ok "Fully upgraded to $target_version"
# log bootupctl information for inspection and check the status output
# Verify bootupctl status includes aleph-version.
state=$(/usr/bin/bootupctl status --json 2>&1)
echo "$state" | jq
if ! echo "$state" | jq -e '."aleph-version"' > /dev/null; then
fatal "check bootupctl status --json output - should include 'aleph-version'"
fi
@ -313,6 +328,35 @@ if vereq $version $target_version; then
selinux-sanity-check
exit 0
fi
set -x
# Pick up the last release for the current stream from the update server
test -f /srv/updateinfo.json || \
curl -L "https://updates.coreos.fedoraproject.org/v1/graph?basearch=${arch}&stream=${stream}&rollout_wariness=0&oci=true" > /srv/updateinfo.json
# Extract all destination indexes and select the newest one.
#
# Edges contain [source, destination] node indexes.
# [.edges[][1]] | max // empty means:
# [.edges[][1]]
# - Iterate over every edge in .edges.
# - Extract element 1, the edge’s destination node index.
# - Collect those indexes into an array.
# max
# - Select the largest destination index.
# - If there are no edges, the result is null.
# // empty
# - If the result is null, emit no output.
# - In Bash, command substitution then produces an empty string.
last_release_index=$(jq -r '[.edges[][1]] | max // empty' /srv/updateinfo.json)
if [ -z "${last_release_index}" ]; then
fatal "Update graph contains no usable edges"
fi
# Grab the actual version string from the index.
last_release=$(jq -r --argjson index "${last_release_index}" \
'.nodes[$index].version' /srv/updateinfo.json)
if [ -z "${last_release}" ] || [ "${last_release}" == "null" ]; then
fatal "Update graph edge points to a missing node"
fi
# Apply workarounds based on the current version of the system.
#
@ -368,8 +412,11 @@ if vereq $version $last_release; then
# Since we'll be manually running `rpm-ostree` let's stop zincati
systemctl stop zincati
# Avoid xtrace expanding the image-inspection JSON into a large log entry.
set +x
inspect=$(skopeo inspect --retry-times=3 -n docker://quay.io/fedora/fedora-coreos:${target_stream})
registry_version=$(jq -r '.Labels."org.opencontainers.image.version"' <<< "${inspect}")
set -x
if [ "${registry_version}" == "${target_version}" ]; then
# If the container is already pushed to the registry we'll use the registry
if [ "${stream}" == "${target_stream}" ]; then
@ -457,9 +504,9 @@ while true; do
fi
if [ "${need_reset}" == "true" ]; then
sudo systemctl stop zincati
sudo rpm-ostree cancel
sudo systemctl stop rpm-ostreed
sudo systemctl start zincati
systemctl stop zincati
rpm-ostree cancel
systemctl stop rpm-ostreed
systemctl start zincati
fi
done