coreos-stable ZFS builds have failed since CoreOS moved to kernel 7.1,
holding back kernel CVE fixes and nvidia driver updates from ucore and
other downstream consumers.
The 7.1 code compat (openzfs/zfs#18471) already shipped in 2.4.3 — only
META's Linux-Maximum gates it. Raising that ceiling (openzfs/zfs#18682)
unblocks the build without --enable-linux-experimental, which would
otherwise flood dmesg with EXPERIMENTAL warnings and mask real errors.
Also carry openzfs/zfs#18715, which replaces a compiled-out ASSERT3U in
zfs_fillpage() with a real bounds check. Without it an mmap read racing a
truncate underflows io_len and zero-fills forward across physical memory.
This is not 7.1-specific and already affects the 7.0.x builds we ship.
Neither commit is on zfs-2.4-release, so patching is gated to exactly
2.4.3 and stops once upstream ships a release carrying them.
coreos-testing no longer needs the experimental switch now that META
covers 7.1.
* fix(nvidia): order CDI generation before nvidia-persistenced to fix boot race
nvidia-persistenced and nvidia-powerd only start if /dev/nvidia* already
exists, but those device nodes aren't created until CDI generation runs.
Without any ordering between the two, persistenced would sometimes lose
that race and stay stopped for the rest of the boot (ublue-os/ucore#419).
nvidia-container-toolkit-base now ships its own nvidia-cdi-refresh
service, which is better than our old ublue-nvctk-cdi.service: it forces
device creation explicitly, retries on failure, and re-runs on driver
upgrades. Switch to it and add a drop-in ordering it before
nvidia-persistenced and nvidia-powerd, so the race can't happen.
Verified on real NVIDIA hardware across multiple reboots.
* chore: Add missing service to nvidia-install.sh
---------
Co-authored-by: Kyle Gospodnetich <me@kylegospodneti.ch>
* Readd vhba to support CDEmu again in Bazzite
* Also add vhba-kmod-common in cache manually, to allow to build it correctly.
* Fix wrong changelog date
---------
Co-authored-by: RodoMa92 <marco.rodolfi.1992@gmail.com>
Store build provenance in GitHub's attestations API without attaching it to GHCR. Add post-publication verification for Podman signatures, containers/image policy enforcement, and manifest provenance.
Default all ZFS akmod builds to the 2.4 release line through a per-kernel-flavor policy in images.yaml. Keep an explicit CoreOS testing override and enable OpenZFS's experimental Linux-kernel support there.
chore: move longterm to F44 and update to 6.18
longterm-6.12 is not being built for F44, but our
coreos longterm builds are based on coreos stable, which is
now based on F44. So we need to bump the longterm-6.12
to longterm-6.18
Also, this removes coreos-testing from F43 since that is
not used by downstreams.
This makes our patch a bit safer by ensuring that only the currently
known problematic lines are modified, that is, those which refer to
the Update Vector Registers.
This addresses the addresses the build failure on aarch64 due to
GCC 16 being used in Fedora 44.
It also adds some explicit raidz testing execution around the area
being patched, and cleans up some timestamp related warnings.
We can consider upstreaming the fix, but also need to validate it.
Allow extra kmod builds to fail without blocking the entire image.
Enables best-effort akmods-extra for new Fedora releases where
some upstream packages aren't available yet.
