refactor: use dnf do for some 3rd-party repositories (#2983)

In the past we have moved away from doing big dnf transactions spanning
multiple rpm repositories [1] because of the associated risk of third
party repos injecting packages we expect to get from Fedora. With this
we explicitly set which packages are allowed to be installed from each
repo. This means we still get to do big transactions which are generally
faster.

The downside of this is that if subpackages or dependencies from a
3rd-party repo get introduced/change then our builds will break, I think
this is fine as the ones I'm changing here have been unchanging for a
while.

This should only touch repositories with a very specific purpose/single
projects.

This purposefully doesn't touch any ublue-os coprs or negativo (also
they are difficult to handle as we use them in the nvidia script [2]),
those are the only mono-repos so outright excluding the packages is not
an easy option as we would make custom image builds (and usr-overlays
for testing) more annoying.

[1] https://github.com/ublue-os/aurora/issues/1115
[2] 1e4d10b9ac/build_files/nvidia/nvidia-install.sh

build_files/dx/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:karmab:kcli.repo

@@ -8,3 +8,4 @@ gpgkey=https://download.copr.fedorainfracloud.org/results/karmab/kcli/pubkey.gpg
 repo_gpgcheck=0
 enabled=0
 enabled_metadata=1
+includepkgs=kcli

build_files/dx/usr/share/dnf5/repos.d/docker-ce.repo

@@ -1,9 +1,15 @@
+# update includepkgs, remove docker-model-plugin
+# podman run --rm -ti quay.io/fedora/fedora:45
+# dnf config-manager addrepo --from-repofile https://download.docker.com/linux/fedora/docker-ce.repo
+# dnf list --available --repo=docker-ce-stable | grep "docker-ce-stable" | grep -vE "(debug|devel|\.src)" | cut -f1 -d\ | sed 's/\.x86_64//' | sed 's/\.noarch//' | paste -sd " " -
+
 [docker-ce-stable]
 name=Docker CE Stable - $basearch
 baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/stable
 enabled=0
 gpgcheck=1
 gpgkey=https://download.docker.com/linux/fedora/gpg
+includepkgs=containerd.io docker-buildx-plugin docker-ce docker-ce-cli docker-ce-rootless-extras docker-compose-plugin
 
 [docker-ce-stable-source]
 name=Docker CE Stable - Sources

build_files/dx/usr/share/dnf5/repos.d/vscode.repo

@@ -4,3 +4,4 @@ baseurl=https://packages.microsoft.com/yumrepos/vscode
 enabled=0
 gpgcheck=1
 gpgkey=https://packages.microsoft.com/keys/microsoft.asc
+includepkgs=code

build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:ledif:kairpods.repo

@@ -8,3 +8,4 @@ gpgkey=https://download.copr.fedorainfracloud.org/results/ledif/kairpods/pubkey.
 repo_gpgcheck=0
 enabled=0
 enabled_metadata=1
+includepkgs=kairpods

build_files/shared/usr/share/dnf5/repos.d/_copr:copr.fedorainfracloud.org:lizardbyte:stable.repo

@@ -9,3 +9,4 @@ repo_gpgcheck=0
 enabled=0
 enabled_metadata=1
 priority=1
+includepkgs=Sunshine

build_files/shared/usr/share/dnf5/repos.d/tailscale.repo

@@ -6,3 +6,4 @@ type=rpm
 repo_gpgcheck=1
 gpgcheck=1
 gpgkey=https://pkgs.tailscale.com/stable/fedora/repo.gpg
+includepkgs=tailscale

build_scripts/base/01-packages.sh

@@ -128,9 +128,6 @@ fi
 
 dnf -y install --enablerepo='fedora-multimedia' "${PACKAGES[@]}"
 
-# Fedora Tailscale is usually behind
-dnf -y install --from-repo='tailscale-stable' tailscale
-
 COPR_UBLUE_OS_PACKAGES=(
     kcm_ublue
     krunner-bazaar
@@ -138,13 +135,22 @@ COPR_UBLUE_OS_PACKAGES=(
     # https://github.com/ublue-os/akmods/issues/537
     ublue-os-selinux-workarounds
     uupd
-  )
+)
 
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ublue-os:packages' "${COPR_UBLUE_OS_PACKAGES[@]}"
+# Fedora Tailscale is usually behind
+TAILSCALE=(tailscale)
 
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ledif:kairpods' kairpods
+COPR_PREFIX="copr:copr.fedorainfracloud.org"
 
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:lizardbyte:stable' sunshine
+dnf -y install --from-repo="${COPR_PREFIX}:ublue-os:packages" "${COPR_UBLUE_OS_PACKAGES[@]}"
+
+# TODO: figure something out that works well across DX, nvidia with the ublue-os coprs
+# so we can have less transactions, while still not being vulnerable to copr injections
+# shellcheck disable=SC1010
+dnf do -y \
+  --action install --from-repo='tailscale-stable' "${TAILSCALE[@]}" \
+  --action install --from-repo="${COPR_PREFIX}:ledif:kairpods" kairpods \
+  --action install --from-repo="${COPR_PREFIX}:lizardbyte:stable" Sunshine
 
 # Packages to exclude - common to all versions
 EXCLUDED_PACKAGES=(

build_scripts/dx/00-dx.sh

@@ -61,24 +61,26 @@ if [[ ! "${IMAGE_NAME}" =~ nvidia ]]; then
   FEDORA_PACKAGES+=("rocm-hip" "rocm-opencl" "rocm-smi")
 fi
 
-echo "Installing ${#FEDORA_PACKAGES[@]} DX packages from Fedora repos..."
 dnf5 -y install "${FEDORA_PACKAGES[@]}"
 
-# Docker packages from their repo
-dnf -y install --from-repo=docker-ce-stable \
-    containerd.io \
-    docker-buildx-plugin \
-    docker-ce \
-    docker-ce-cli \
-    docker-compose-plugin
+# We could use Fedora's moby packages, these are "official"
+DOCKER_CE=(
+  containerd.io
+  docker-buildx-plugin
+  docker-ce
+  docker-ce-cli
+  docker-compose-plugin
+)
 
-# VSCode package from Microsoft repo
-dnf -y install --from-repo=code \
-    code
+COPR_PREFIX="copr:copr.fedorainfracloud.org"
 
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:karmab:kcli' kcli
+# shellcheck disable=SC1010
+dnf do -y \
+  --action install --from-repo=code code \
+  --action install --from-repo=docker-ce-stable "${DOCKER_CE[@]}" \
+  --action install --from-repo="${COPR_PREFIX}:karmab:kcli" kcli
 
-dnf -y install --from-repo='copr:copr.fedorainfracloud.org:ublue-os:packages' ublue-os-libvirt-workarounds
+dnf -y install --from-repo="${COPR_PREFIX}:ublue-os:packages" ublue-os-libvirt-workarounds
 
 rsync -rvK /ctx/system_files/dx/ /