Aurora's Justfile lists its past tags at ghcr.io/$GITHUB_REPOSITORY_OWNER
and passes $GITHUB_TOKEN to GitHub's API. Forgejo Actions sets those to
quine-global-labs and a Forgejo token: the tag lookup failed with 403
(ghcr.io/quine-global-labs/aurora doesn't exist), and GitHub would refuse
the token. Pin the owner to ublue-os; pass the token only on GitHub.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
stage-0/ is a submodule holding our fork of Aurora (upstream for now),
built with Aurora's own `just build` by the new `task build-base` into
localhost/aurora:stable. The Containerfile (stage 1) now builds FROM
${BASE_IMAGE}, which defaults to that image, instead of a pinned upstream
digest; the pin is now the submodule commit. build-image builds stage 0
first when needed, and BASE_IMAGE=ghcr.io/ublue-os/aurora:stable skips it
(the only option on macOS).
CI checks out submodules, fetches just, yq and cosign, and gets a longer
timeout for the Aurora build.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
.forgejo/workflows/iso.yml runs `task build-installer-iso` on a runner
labelled iso-builder (x86_64, root podman) and uploads the ISO to MinIO
under installer/<commit>/ and installer/latest/.
For unattended runs, the Taskfile now only uses sudo when not already root
(CI runners often lack it), and OUTPUT_DIR is absolute so the bind mount
into bootc-image-builder doesn't depend on relative-path support.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bootc-image-builder's --target-arch cross build fails late on Apple Silicon
(its lsinitrd step runs the amd64 image, which needs qemu-user inside its
container). Check the host arch up front, before the long image builds, and
drop --target-arch since only native builds are supported now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replaces installing a patched anaconda-webui RPM from the forge's package
registry: installer/anaconda-webui/vendor/ is upstream release 86 verbatim
(see its PROVENANCE.md), and installer/Containerfile builds it with
upstream's own `make install` in a native-platform stage, then copies the
result over stock Fedora anaconda-webui. The produced file set matches
Fedora's anaconda-webui-86-1.fc46 exactly. Edits to the installer UI now
happen in vendor/ and ship on the next `task build-installer-iso`, with no
RPM, registry or CI in between.
Also follows bootc-image-builder's rename of --bootc-installer-payload-ref
to --installer-payload-ref.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The fork (quine/quine-anaconda-webui on forge.quinefoundation.com) now
builds its RPM with Forgejo Actions and publishes it to the quine org's
package registry. The installer image adds that repo with priority=10 so
it wins over Fedora's anaconda-webui, verifies Forgejo's signed repo
metadata (the RPMs themselves are unsigned), and the Taskfile passes the
repo metadata checksum as a build arg so a newly published RPM busts the
cached dnf layer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adds installer/Containerfile (a separate Anaconda-webui environment
container, distinct from the quine-linux OS image) plus
build-installer-image/build-installer-iso tasks that drive
bootc-image-builder's bootc-installer type against it. Lets a forked/
patched anaconda-webui (built via COPR) get baked into the install ISO
instead of stock Fedora's.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
