From 57e038ae1514e4153d85453b19641566dd5bdc2f Mon Sep 17 00:00:00 2001 From: Philip Peterson <1326208+philip-peterson@users.noreply.github.com> Date: Sat, 31 Oct 2026 03:59:29 -0800 Subject: [PATCH] Install layer-wizard, dnf-package-store and swap-watchdog From the forge's quine RPM group, where each repo's rpm.yml publishes them. dnf checks the forge's signed repository metadata; Forgejo doesn't sign the packages themselves. Co-Authored-By: Claude Opus 5.5 --- Containerfile | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/Containerfile b/Containerfile index 89a91a8..75537fb 100644 --- a/Containerfile +++ b/Containerfile @@ -55,6 +55,18 @@ RUN set -eux; \ mv /tmp/snd-hda-codec-cs8409.ko "/usr/lib/modules/${NVR}/extra/snd-hda-codec-cs8409.ko"; \ depmod -a "${NVR}" +# Our own apps, from the forge's `quine` RPM group: each repo's rpm.yml +# builds and uploads them (quine-global-labs/layer-wizard, dnf-package-store, +# swap-watchdog). The repo is only used here, not left configured: the apps +# update with the image. kdotool, which swap-watchdog drives, is Fedora's. +# Forgejo signs the repository metadata, not the packages, so dnf checks the +# metadata (repo_gpgcheck), which pins each package's checksum. +RUN dnf install -y \ + --repofrompath=quine,https://forge.quinefoundation.com/api/packages/quine-global-labs/rpm/quine \ + --setopt=quine.gpgcheck=0 --setopt=quine.repo_gpgcheck=1 \ + --setopt=quine.gpgkey=https://forge.quinefoundation.com/api/packages/quine-global-labs/rpm/repository.key \ + layer-wizard dnf-package-store swap-watchdog + # System-level units are enabled explicitly. User units are picked up # automatically via overlay/usr/lib/systemd/user-preset/. RUN systemctl enable rpm-ostree-cleanup.timer cs8409-intmike-power-fixup.service