From 2396441d4ad1d4fc5eba38e129329b033e4f2fae Mon Sep 17 00:00:00 2001 From: Timothée Ravier Date: Jun 04 2024 20:45:21 +0000 Subject: [PATCH 1/7] *: Include DNF5 (Kinoite temporarily excluded) Stop excluding DNF5 and add it to all Atomic Desktops. See: https://fedoraproject.org/wiki/Changes/DNFAndBootcInImageModeFedora See: https://fedoraproject.org/wiki/Changes/SwitchToDnf5 See: https://pagure.io/fedora-comps/pull-request/960 Temporarily excluded from Kinoite. See: https://pagure.io/fedora-kde/SIG/issue/519 --- diff --git a/comps-sync-exclude-list.yml b/comps-sync-exclude-list.yml index 33fe3b3..9b4143d 100644 --- a/comps-sync-exclude-list.yml +++ b/comps-sync-exclude-list.yml @@ -19,9 +19,10 @@ exclude_list_all_regexp: # Common exclude list for all ostree desktop versions exclude_list: core: - # We use rpm-ostree for the host + # Make sure we only pull-in dnf5 and not dnf4 or yum - dnf - dnf-plugins-core + # We include dnf5 in a later manifest - dnf5 - dnf5-plugins - yum @@ -36,14 +37,15 @@ exclude_list: # Why? - ncurses workstation-product: - # We use rpm-ostree for the host + # Make sure we only pull-in dnf5 and not dnf4 or yum - dnf - dnf-plugins-core - - dnf5 - - dnf5-plugins - deltarpm - python3-dnf-plugin-system-upgrade - python3-dnf-plugins-core + # We include dnf5 in a later manifest + - dnf5 + - dnf5-plugins # We use fedora-release-silverblue instead - fedora-release-workstation # Really not worth listing explicitly @@ -58,7 +60,7 @@ exclude_list: # We removed cronie a while ago, should nuke these too - crontabs - at - # This drags in a huge dependency set of dnf bits + # See: https://gitlab.com/fedora/ostree/sig/-/issues/30 - abrt-cli - abrt-desktop - abrt-java-connector diff --git a/dnf5.yaml b/dnf5.yaml new file mode 100644 index 0000000..1534b7a --- /dev/null +++ b/dnf5.yaml @@ -0,0 +1,3 @@ +packages: + - dnf5 + - dnf5-plugins diff --git a/fedora-cinnamon.yaml b/fedora-cinnamon.yaml index b94e15d..d6ab66a 100644 --- a/fedora-cinnamon.yaml +++ b/fedora-cinnamon.yaml @@ -1,4 +1,7 @@ -include: cinnamon-desktop-pkgs.yaml +include: + - cinnamon-desktop-pkgs.yaml + - dnf5.yaml + ref: fedora/rawhide/${basearch}/cinnamon rojig: name: fedora-cinnamon diff --git a/fedora-common-ostree.yaml b/fedora-common-ostree.yaml index cb9e66f..ef3a775 100644 --- a/fedora-common-ostree.yaml +++ b/fedora-common-ostree.yaml @@ -95,11 +95,9 @@ exclude-packages: - gstreamer1-plugin-openh264 - mozilla-openh264 - openh264 - # Always exclude dnf when pulled in as a dependency + # Make sure we only pull-in dnf5 and not dnf4 - dnf - dnf-plugins-core - - dnf5 - - dnf5-plugins # https://github.com/fedora-silverblue/issue-tracker/issues/517 - grubby - sdubby diff --git a/fedora-deepin.yaml b/fedora-deepin.yaml index 2db7a5e..ee124b3 100644 --- a/fedora-deepin.yaml +++ b/fedora-deepin.yaml @@ -1,4 +1,7 @@ -include: deepin-desktop-pkgs.yaml +include: + - deepin-desktop-pkgs.yaml + - dnf5.yaml + ref: fedora/rawhide/${basearch}/deepin rojig: name: fedora-deepin diff --git a/fedora-kinoite.yaml b/fedora-kinoite.yaml index b3543b6..558b169 100644 --- a/fedora-kinoite.yaml +++ b/fedora-kinoite.yaml @@ -1,4 +1,6 @@ -include: kde-desktop-pkgs.yaml +include: + - kde-desktop-pkgs.yaml + ref: fedora/rawhide/${basearch}/kinoite rojig: name: fedora-kde @@ -21,7 +23,6 @@ packages: # Make sure that modem support is installed - NetworkManager-ppp # Install gdb to make getting backtraces work with DrKonqi - # The dnf dependency is excluded in the common manifest - gdb # Make sure the following are not pulled in when Recommended by other packages diff --git a/fedora-lazurite.yaml b/fedora-lazurite.yaml index d03a14c..57ed2a3 100644 --- a/fedora-lazurite.yaml +++ b/fedora-lazurite.yaml @@ -1,4 +1,7 @@ -include: lxqt-desktop-pkgs.yaml +include: + - lxqt-desktop-pkgs.yaml + - dnf5.yaml + ref: fedora/rawhide/${basearch}/lazurite rojig: name: fedora-lxqt diff --git a/fedora-mate.yaml b/fedora-mate.yaml index cdfd0f4..c4bfb62 100644 --- a/fedora-mate.yaml +++ b/fedora-mate.yaml @@ -1,4 +1,7 @@ -include: mate-desktop-pkgs.yaml +include: + - mate-desktop-pkgs.yaml + - dnf5.yaml + ref: fedora/rawhide/${basearch}/mate rojig: name: fedora-mate diff --git a/fedora-onyx.yaml b/fedora-onyx.yaml index 5f39a79..eba19d5 100644 --- a/fedora-onyx.yaml +++ b/fedora-onyx.yaml @@ -1,4 +1,7 @@ -include: budgie-desktop-pkgs.yaml +include: + - budgie-desktop-pkgs.yaml + - dnf5.yaml + ref: fedora/rawhide/${basearch}/onyx rojig: name: fedora-onyx diff --git a/fedora-sericea.yaml b/fedora-sericea.yaml index 653ca1c..d2412a1 100644 --- a/fedora-sericea.yaml +++ b/fedora-sericea.yaml @@ -1,4 +1,7 @@ -include: sway-desktop-pkgs.yaml +include: + - sway-desktop-pkgs.yaml + - dnf5.yaml + ref: fedora/rawhide/${basearch}/sericea rojig: name: fedora-sericea diff --git a/fedora-silverblue.yaml b/fedora-silverblue.yaml index 1dc0b8c..4afb4f2 100644 --- a/fedora-silverblue.yaml +++ b/fedora-silverblue.yaml @@ -1,4 +1,7 @@ -include: gnome-desktop-pkgs.yaml +include: + - gnome-desktop-pkgs.yaml + - dnf5.yaml + ref: fedora/rawhide/${basearch}/silverblue rojig: name: fedora-silverblue diff --git a/fedora-vauxite.yaml b/fedora-vauxite.yaml index 8858139..c311d53 100644 --- a/fedora-vauxite.yaml +++ b/fedora-vauxite.yaml @@ -1,4 +1,7 @@ -include: xfce-desktop-pkgs.yaml +include: + - xfce-desktop-pkgs.yaml + - dnf5.yaml + ref: fedora/rawhide/${basearch}/vauxite rojig: name: fedora-vauxite From bb292aa7af5f322852c2f1388ba8705b30361760 Mon Sep 17 00:00:00 2001 From: Timothée Ravier Date: Jun 04 2024 20:45:21 +0000 Subject: [PATCH 2/7] initramfs: Add dracut config for initramfs generation Add a default dracut configuration for initramfs generation. This is currently taken from: - https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/initramfs.yaml - https://github.com/coreos/fedora-coreos-config/tree/testing-devel/overlay.d/05core/usr/lib/dracut/dracut.conf.d This will ideally be unified once we complete the Bootable Containers Initiative roadmap. --- diff --git a/fedora-common-ostree.yaml b/fedora-common-ostree.yaml index ef3a775..1499e72 100644 --- a/fedora-common-ostree.yaml +++ b/fedora-common-ostree.yaml @@ -10,6 +10,7 @@ include: - fedora-common-ostree-pkgs.yaml # See: https://gitlab.com/fedora/ostree/sig/-/issues/1 # - bootupd.yaml + - initramfs.yaml packages: # Ensure that we have a kernel. Kernel packages are not in any comps group diff --git a/initramfs.yaml b/initramfs.yaml new file mode 100644 index 0000000..02925dd --- /dev/null +++ b/initramfs.yaml @@ -0,0 +1,29 @@ +# Set dracut configuration for the initramfs +# See: https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/initramfs.yaml +# See: https://github.com/coreos/fedora-coreos-config/tree/testing-devel/overlay.d/05core/usr/lib/dracut/dracut.conf.d +# +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + install -dm 0755 -o 0 -g 0 /usr/lib/dracut/dracut.conf.d + + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat > /usr/lib/dracut/dracut.conf.d/20-atomic-nohostonly.conf << 'EOF' + # Default model is server-side generated initramfs + hostonly=no + EOF + + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat > /usr/lib/dracut/dracut.conf.d/20-atomic-nostrip.conf << 'EOF' + # We don't ship `strip` or `eu-strip` today, and even if we did, it doesn't + # save much space. So let's disable it to avoid the error-looking message. + do_strip=no + EOF From d9f38e3bac8f1b6ef8eacc2144ac088b6c8e0257 Mon Sep 17 00:00:00 2001 From: Timothée Ravier Date: Jun 04 2024 20:45:21 +0000 Subject: [PATCH 3/7] initramfs: Add Live ISO (dracut-live) support --- diff --git a/initramfs.yaml b/initramfs.yaml index 02925dd..02d2ac2 100644 --- a/initramfs.yaml +++ b/initramfs.yaml @@ -2,6 +2,10 @@ # See: https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/initramfs.yaml # See: https://github.com/coreos/fedora-coreos-config/tree/testing-devel/overlay.d/05core/usr/lib/dracut/dracut.conf.d # +packages: + # For LiveISO support + - dracut-live + postprocess: - | #!/usr/bin/env bash @@ -27,3 +31,12 @@ postprocess: # save much space. So let's disable it to avoid the error-looking message. do_strip=no EOF + + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat > /usr/lib/dracut/dracut.conf.d/20-atomic-liveiso.conf << 'EOF' + # Add Live ISO (squashfs image) support + add_dracutmodules+=" dmsquash-live " + EOF From 9a6d323e12b92956e3d42df4f91b7bc6489f0fc6 Mon Sep 17 00:00:00 2001 From: Timothée Ravier Date: Jun 04 2024 20:45:21 +0000 Subject: [PATCH 4/7] initramfs: Add tpm2-tss & systemd-pcrphase for LUKS unlocking --- diff --git a/initramfs.yaml b/initramfs.yaml index 02d2ac2..96976dd 100644 --- a/initramfs.yaml +++ b/initramfs.yaml @@ -40,3 +40,12 @@ postprocess: # Add Live ISO (squashfs image) support add_dracutmodules+=" dmsquash-live " EOF + + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat > /usr/lib/dracut/dracut.conf.d/20-atomic-tpm-luks.conf << 'EOF' + # Add support for systemd-cryptsetup and tpm2-tss LUKS locking + add_dracutmodules+=" tpm2-tss systemd-pcrphase " + EOF From 77c6cf83ef6c9e8b73c8244bcedac27dda259a8b Mon Sep 17 00:00:00 2001 From: Timothée Ravier Date: Jun 04 2024 20:45:21 +0000 Subject: [PATCH 5/7] initramfs: Compress with zstd --- diff --git a/initramfs.yaml b/initramfs.yaml index 96976dd..04c4fda 100644 --- a/initramfs.yaml +++ b/initramfs.yaml @@ -5,6 +5,8 @@ packages: # For LiveISO support - dracut-live + # For initramfs compression + - zstd postprocess: - | @@ -49,3 +51,14 @@ postprocess: # Add support for systemd-cryptsetup and tpm2-tss LUKS locking add_dracutmodules+=" tpm2-tss systemd-pcrphase " EOF + + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat > /usr/lib/dracut/dracut.conf.d/20-atomic-zstd.conf << 'EOF' + # Compress initrd with zstd. dracut defaults to -15, but we want the + # maximum reasonable compression, so override the command line to use + # dracut's defaults along with -19. + compress="zstd -19 -q -T0" + EOF From a90f61394162552c8bd09ab124a8d2295d0a7813 Mon Sep 17 00:00:00 2001 From: Timothée Ravier Date: Jun 04 2024 20:45:21 +0000 Subject: [PATCH 6/7] common: Setup read only sysroot via ostree config --- diff --git a/fedora-common-ostree.yaml b/fedora-common-ostree.yaml index 1499e72..5318c2b 100644 --- a/fedora-common-ostree.yaml +++ b/fedora-common-ostree.yaml @@ -138,4 +138,17 @@ postprocess: # https://github.com/fedora-silverblue/issue-tracker/issues/532 ln -snf /usr/libexec/samba/cups_backend_smb /usr/lib/cups/backend/smb + - | + #!/usr/bin/env bash + set -xeuo pipefail + + # Set up default root config to mount sysroot as read only + # https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot + # See: https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml + install -dm 0755 -o 0 -g 0 /usr/lib/ostree + cat > /usr/lib/ostree/prepare-root.conf << 'EOF' + [sysroot] + readonly = true + EOF + postprocess-script: "postprocess.sh" diff --git a/postprocess.sh b/postprocess.sh index c788ada..d871a85 100755 --- a/postprocess.sh +++ b/postprocess.sh @@ -1,115 +1,6 @@ #!/usr/bin/env bash set -xeuo pipefail -# Setup unit & script for readonly sysroot migration: -# - https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot -# - https://bugzilla.redhat.com/show_bug.cgi?id=2060976 - -cat > /usr/lib/systemd/system/fedora-silverblue-readonly-sysroot.service <<'EOF' -[Unit] -Description=Fedora Silverblue Read-Only Sysroot Migration -Documentation=https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot -ConditionPathExists=!/var/lib/.fedora_silverblue_readonly_sysroot -RequiresMountsFor=/sysroot /boot -ConditionPathIsReadWrite=/sysroot - -[Service] -Type=oneshot -ExecStart=/usr/libexec/fedora-silverblue-readonly-sysroot -RemainAfterExit=yes - -[Install] -WantedBy=multi-user.target -EOF - -chmod 644 /usr/lib/systemd/system/fedora-silverblue-readonly-sysroot.service - -cat > /usr/libexec/fedora-silverblue-readonly-sysroot <<'EOF' -#!/bin/bash - -# Update an existing system to use a read only sysroot -# See https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot -# and https://bugzilla.redhat.com/show_bug.cgi?id=2060976 - -set -euo pipefail - -main() { - # Used to condition execution of this unit at the systemd level - local -r stamp_file="/var/lib/.fedora_silverblue_readonly_sysroot" - - if [[ -f "${stamp_file}" ]]; then - exit 0 - fi - - local -r ostree_sysroot_readonly="$(ostree config --repo=/sysroot/ostree/repo get "sysroot.readonly" &> /dev/null || echo "false")" - if [[ "${ostree_sysroot_readonly}" == "true" ]]; then - # Nothing to do - touch "${stamp_file}" - exit 0 - fi - - local -r boot_entries="$(ls -A /boot/loader/entries/ | wc -l)" - - # Ensure that we can read BLS entries to avoid touching systems where /boot - # is not mounted - if [[ "${boot_entries}" -eq 0 ]]; then - echo "No BLS entry found: Maybe /boot is not mounted?" 1>&2 - echo "This is unexpected thus no migration will be performed" 1>&2 - touch "${stamp_file}" - exit 0 - fi - - # Check if any existing deployment is still missing the rw karg - local rw_kargs_found=0 - local count=0 - for f in "/boot/loader/entries/"*; do - count="$(grep -c "^options .* rw" "${f}" || true)" - if [[ "${count}" -ge 1 ]]; then - rw_kargs_found=$((rw_kargs_found + 1)) - fi - done - - # Some deployments are still missing the rw karg. Let's try to update them - if [[ "${boot_entries}" -ne "${rw_kargs_found}" ]]; then - ostree admin kargs edit-in-place --append-if-missing=rw || \ - echo "Failed to edit kargs in place with ostree" 1>&2 - fi - - # Re-check if any existing deployment is still missing the rw karg - rw_kargs_found=0 - count=0 - for f in "/boot/loader/entries/"*; do - count="$(grep -c "^options .* rw" "${f}" || true)" - if [[ "${count}" -ge 1 ]]; then - rw_kargs_found=$((rw_kargs_found + 1)) - fi - done - unset count - - # If all deployments are good, then we can set the sysroot.readonly option - # in the ostree repo config - if [[ "${boot_entries}" -eq "${rw_kargs_found}" ]]; then - echo "Setting up the sysroot.readonly option in the ostree repo config" - ostree config --repo=/sysroot/ostree/repo set "sysroot.readonly" "true" - touch "${stamp_file}" - exit 0 - fi - - # If anything else before failed, we will retry on next boot - echo "Will retry next boot" 1>&2 - exit 0 -} - -main "${@}" -EOF - -chmod 755 /usr/libexec/fedora-silverblue-readonly-sysroot - -# Enable the corresponding unit -systemctl enable fedora-silverblue-readonly-sysroot.service - -### - # Workaround for Python timestamp mismatch # See: https://github.com/ostreedev/ostree/issues/1469 From c3940fbdd818b28476c4f7f379d2cace0b0452ac Mon Sep 17 00:00:00 2001 From: Timothée Ravier Date: Jun 04 2024 20:45:21 +0000 Subject: [PATCH 7/7] ci/validate: Ignore correctly indented lines starting with [ --- diff --git a/ci/validate b/ci/validate index d9b90af..6f21443 100755 --- a/ci/validate +++ b/ci/validate @@ -30,7 +30,7 @@ for root, dirs, files, rootfd in os.fwalk('.'): print("Validating:", name) with open(os.open(name, dir_fd=rootfd, flags=os.O_RDONLY)) as f: yaml.safe_load(f) - result = subprocess.run(['grep', '-RniEv', '^( )*[a-z#/-]|^$|^#', name], encoding='UTF-8', + result = subprocess.run(['grep', '-RniEv', '^( )*[a-z#/-]|^( )*\\[|^$|^#', name], encoding='UTF-8', preexec_fn=lambda: os.fchdir(rootfd)) if result.returncode == 0: raise Exception("Found likely invalid indentation in YAML file: {}".format(name))