From 39de966517eab89270c5763dd64a5f1e085baf7d Mon Sep 17 00:00:00 2001 From: Philip Peterson <1326208+philip-peterson@users.noreply.github.com> Date: Sun, 27 Sep 2026 04:55:42 -0800 Subject: [PATCH] Install patched anaconda-webui from the forge's RPM registry, not COPR The fork (quine/quine-anaconda-webui on forge.quinefoundation.com) now builds its RPM with Forgejo Actions and publishes it to the quine org's package registry. The installer image adds that repo with priority=10 so it wins over Fedora's anaconda-webui, verifies Forgejo's signed repo metadata (the RPMs themselves are unsigned), and the Taskfile passes the repo metadata checksum as a build arg so a newly published RPM busts the cached dnf layer. Co-Authored-By: Claude Opus 5.5 --- Taskfile.yml | 23 ++++++++----- docs/patched-anaconda-installer.md | 54 ++++++++++++++++++------------ installer/Containerfile | 24 +++++++++---- 3 files changed, 65 insertions(+), 36 deletions(-) diff --git a/Taskfile.yml b/Taskfile.yml index a57eab1..5e09941 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -3,7 +3,16 @@ version: '3' vars: IMAGE: quine-linux INSTALLER_IMAGE: quine-installer - COPR_REPO: philip-peterson/quine-anaconda-webui + # dnf .repo for the patched anaconda-webui, built by the fork's CI. + RPM_REPO_URL: https://forge.quinefoundation.com/api/packages/quine/rpm.repo + # Checksum of that repo's current metadata; passed as a build arg so the + # installer's dnf layer is rebuilt exactly when a new RPM gets published. + RPM_REPO_REV: + sh: | + [ -n "{{.RPM_REPO_URL}}" ] || exit 0 + base=$(curl -fsSL "{{.RPM_REPO_URL}}" | sed -n 's/^baseurl=//p' | head -1) + sum() { if command -v sha256sum >/dev/null; then sha256sum; else shasum -a 256; fi; } + curl -fsSL "$base/repodata/repomd.xml" 2>/dev/null | sum | cut -c1-16 OUTPUT_DIR: ./output # Any docker-CLI-compatible runtime works for plain builds. Prefers podman, # falls back to docker; override with CONTAINER_RUNTIME=... (env or task var). @@ -68,24 +77,22 @@ tasks: Build the patched-Anaconda installer-environment container (see installer/Containerfile and docs/patched-anaconda-installer.md). This is separate from the quine-linux OS image itself. Defaults to the - {{.COPR_REPO}} COPR project; override with - `task build-installer-image COPR_REPO=you/other-project`. + anaconda-webui build at {{.RPM_REPO_URL}}; override with + `task build-installer-image RPM_REPO_URL=...` (empty = stock Fedora). cmds: - - sudo {{.CONTAINER_RUNTIME}} build --platform {{.PLATFORM}} -t {{.INSTALLER_IMAGE}} --build-arg COPR_REPO={{.COPR_REPO}} -f installer/Containerfile installer/ - sources: - - installer/Containerfile + - sudo {{.CONTAINER_RUNTIME}} build --platform {{.PLATFORM}} -t {{.INSTALLER_IMAGE}} --build-arg RPM_REPO_URL={{.RPM_REPO_URL}} --build-arg RPM_REPO_REV={{.RPM_REPO_REV}} -f installer/Containerfile installer/ build-installer-iso: desc: >- Build a bootable install ISO using the patched-Anaconda installer image to install the quine-linux bootc image, via bootc-image-builder's `bootc-installer` type. Output lands in - {{.OUTPUT_DIR}}/bootc-installer/install.iso. Uses the same COPR_REPO + {{.OUTPUT_DIR}}/bootc-installer/install.iso. Uses the same RPM_REPO_URL default/override as build-installer-image. deps: [build-image] cmds: - task: build-installer-image - vars: { COPR_REPO: "{{.COPR_REPO}}" } + vars: { RPM_REPO_URL: "{{.RPM_REPO_URL}}" } - task: export-to-storage vars: { IMAGES: "{{.IMAGE}} {{.INSTALLER_IMAGE}}" } - mkdir -p {{.OUTPUT_DIR}} diff --git a/docs/patched-anaconda-installer.md b/docs/patched-anaconda-installer.md index 8107227..0e7f8ba 100644 --- a/docs/patched-anaconda-installer.md +++ b/docs/patched-anaconda-installer.md @@ -30,7 +30,7 @@ everywhere else. All current upstream feature work happens on the WebUI, so that's the one to fork: - https://github.com/rhinstaller/anaconda-webui, forked to - https://github.com/philip-peterson/anaconda-webui + https://github.com/philip-peterson/quine-anaconda-webui `installer/Containerfile` depends on `anaconda-webui` explicitly (not just the bare `anaconda` metapackage) so the UI doesn't depend on incidentally @@ -39,34 +39,46 @@ matching a release-identity package. ## Workflow 1. **Fork** `rhinstaller/anaconda-webui` to - `philip-peterson/anaconda-webui` on GitHub, make your panel/control + `philip-peterson/quine-anaconda-webui` on GitHub, make your panel/control changes there. 2. **Get it built as an RPM your installer container can `dnf install`.** - Recommended: a Fedora COPR project. - - Create the COPR project `philip-peterson/quine-anaconda-webui` - (https://copr.fedorainfracloud.org/), point it at - `philip-peterson/anaconda-webui` (branch or a webhook), let COPR build - it against the Fedora release Aurora currently tracks. - - That name is already wired in as the `COPR_REPO` default in - `Taskfile.yml` and `installer/Containerfile`. Using a different COPR - project name means overriding `COPR_REPO=` on the `task` invocations - below instead. - - This publishes your fork's source and build logs on COPR's - infrastructure (marking a project "unlisted" hides it from browsing, - not from direct access) -- worth knowing before you push anything you - wouldn't want visible outside this machine. + The fork's own Forgejo Actions workflow does this, as a self-hosted + stand-in for COPR: `.forgejo/workflows/rpm.yml` runs + `.forgejo/build-rpm.sh` in a fresh `fedora:rawhide` container (upstream's + `make srpm`, then `rpmbuild`) and uploads the RPM to the forge's package + registry. Setup, once: + - Host the fork on `forge.quinefoundation.com` (Forgejo Actions only runs + for repos on the forge), under the account the package should be + published as -- the `quine` org by default + (`quine/quine-anaconda-webui`). + - Add a repo secret `RPM_UPLOAD_TOKEN`: an access token for that account + with `write:package` scope, from a user + allowed to publish packages for that org. + - The result is served at + `https://forge.quinefoundation.com/api/packages/quine/rpm.repo`, + already wired in as the `RPM_REPO_URL` default in `Taskfile.yml`. + Publishing under a different owner means overriding `RPM_REPO_URL=` on + the `task` invocations below. + + Versioning: the build fetches upstream's tags so `git describe` yields + e.g. `86.3.gabcdef0` (3 commits past upstream 86), and the Release is + `.quine`, so each build is a new version that sorts above + Fedora's own. The installer also gives this repo dnf `priority=10`, so + it wins even when Fedora ships a newer upstream release. 3. **Build the installer image and ISO:** ```sh task build-installer-iso ``` This builds the quine-linux OS image (if needed), builds - `installer/Containerfile` with the `philip-peterson/quine-anaconda-webui` - COPR repo enabled, and produces `output/bootc-installer/install.iso`. -4. **Iterate:** push a change to your fork, wait for COPR to rebuild, rerun - `task build-installer-iso` -- podman/task will rebuild the installer - layer to pick up the new RPM. + `installer/Containerfile` with that repo enabled, and produces + `output/bootc-installer/install.iso`. `RPM_REPO_URL=` (empty) builds + with stock Fedora `anaconda-webui` instead. +4. **Iterate:** push a change to your fork, wait for its RPM workflow, + rerun `task build-installer-iso`. The Taskfile passes a checksum of the + repo's metadata into the build, so a newly published RPM invalidates + the cached `dnf install` layer and gets picked up. -## Local alternative (no COPR) +## Local alternative (no forge) If you'd rather not publish the fork anywhere: build the RPM locally with `mock` targeting the same Fedora release/arch as the installer base, diff --git a/installer/Containerfile b/installer/Containerfile index ef8ba7a..817aad3 100644 --- a/installer/Containerfile +++ b/installer/Containerfile @@ -6,15 +6,25 @@ FROM quay.io/fedora/fedora-bootc:rawhide -# Set to your COPR project (e.g. "yourname/quine-anaconda") holding a build -# of your patched anaconda-webui fork. Override at build time with -# --build-arg COPR_REPO=... instead of editing this file. -ARG COPR_REPO +# URL of a dnf .repo file for the repository holding a build of the patched +# anaconda-webui fork -- by default the Forgejo RPM registry its CI publishes +# to (see docs/patched-anaconda-installer.md). Override at build time with +# --build-arg RPM_REPO_URL=...; empty means stock Fedora anaconda-webui. +ARG RPM_REPO_URL +# Set by the Taskfile to the repo metadata's checksum; only here so a newly +# published RPM invalidates the build cache for the layer below. +ARG RPM_REPO_REV +# priority=10 (default 99) makes dnf take anaconda-webui from that repo even +# when Fedora's own build is newer. Forgejo signs the repo metadata but not +# the RPMs themselves, so verify the signed metadata (which carries each +# package's checksum) instead of per-package signatures. RUN set -eux; \ - dnf install -y dnf-plugins-core; \ - if [ -n "${COPR_REPO}" ]; then \ - dnf copr enable -y "${COPR_REPO}"; \ + echo "anaconda-webui repo rev: ${RPM_REPO_REV:-none}"; \ + if [ -n "${RPM_REPO_URL}" ]; then \ + curl -fsSL "${RPM_REPO_URL}" -o /etc/yum.repos.d/quine-anaconda.repo; \ + sed -i 's/^gpgcheck=.*/gpgcheck=0/' /etc/yum.repos.d/quine-anaconda.repo; \ + printf '\nrepo_gpgcheck=1\npriority=10\n' >> /etc/yum.repos.d/quine-anaconda.repo; \ fi; \ dnf install -y \ anaconda-webui \