Skip to content

Commit 56cb23b

Browse files
castrojoCopilot
castrojo
and
Copilot
committed
feat: move base image to quay.io/fedora-ostree-desktops/silverblue
Drop ghcr.io/ublue-os/silverblue-main in favor of the upstream Fedora image directly from quay.io/fedora-ostree-desktops/silverblue. This removes the ublue-os/main dependency and unblocks ARM support. - Update Containerfile base image and bump to F43 - Update Justfile build recipe: remove base_image_name variable, update cosign verification to use Fedora's public key - Update renovate.json5 to track new image, disable major version bumps - Rename/reorder build scripts: packages (03) before kernel (04) - Add negativo17 fedora-multimedia repo + mesa overrides in 03-packages.sh - Add multimedia codecs (ffmpeg, libfdk-aac, etc.) from negativo17 - Add packages previously provided by ublue-os/main: alsa-firmware, flatpak-spawn, noto fonts, grub2-tools-extra, htop, nvtop, pam-u2f/yubico, smartmontools, vim, and more - Remove packages now in base or no longer needed: bash-color-prompt, bootc, hplip, mesa-libGLU, printer-driver-brlaser, pulseaudio-utils, switcheroo-control, usbmuxd, wireguard-tools, wl-clipboard - Add ublue-os/main features to 05-override-install.sh: rm chsh/lchsh footgun, sudoers brew path, noto-cjk symlink, coreos-sulogin-force-generator - Remove faces/desktop-entry workarounds (no longer needed) - Update kernel COPR handling: use dnf copr enable/disable - Add copr.vendor.conf to keep COPR plugin using 'fedora' distribution ID - Update 20-tests.sh: verify negativo packages and expand unwanted list Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Assisted-by: Claude Sonnet 4.6 via GitHub Copilot
1 parent e811c55 commit 56cb23b

11 files changed

Lines changed: 148 additions & 81 deletions

File tree

‎.github/renovate.json5‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,14 @@
6767
"automerge": true,
6868
"matchUpdateTypes": ["digest"],
6969
"matchDepNames": [
70-
"ghcr.io/ublue-os/silverblue-main"
70+
"quay.io/fedora-ostree-desktops/silverblue"
7171
]
7272
},
73+
{
74+
"matchDepNames": ["quay.io/fedora-ostree-desktops/silverblue"],
75+
"matchUpdateTypes": ["major"],
76+
"enabled": false
77+
},
7378
{
7479
"matchDepTypes": ["gnome-extension"],
7580
"matchPackageNames": ["micheleg/dash-to-dock"],

‎Containerfile‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
ARG BASE_IMAGE_NAME="silverblue"
2-
ARG FEDORA_MAJOR_VERSION="42"
3-
ARG SOURCE_IMAGE="${BASE_IMAGE_NAME}-main"
4-
ARG BASE_IMAGE="ghcr.io/ublue-os/${SOURCE_IMAGE}"
2+
ARG FEDORA_MAJOR_VERSION="43"
3+
ARG BASE_IMAGE="quay.io/fedora-ostree-desktops/silverblue"
54
ARG COMMON_IMAGE="ghcr.io/projectbluefin/common:latest"
65
ARG COMMON_IMAGE_SHA=""
76
ARG BREW_IMAGE="ghcr.io/ublue-os/brew:latest"

‎Justfile‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -108,10 +108,6 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin
108108
common_image_sha=$(yq -r '.images[] | select(.name == "common") | .digest' image-versions.yml)
109109
brew_image_sha=$(yq -r '.images[] | select(.name == "brew") | .digest' image-versions.yml)
110110

111-
# Base Image
112-
base_image_name="silverblue"
113-
114-
115111
# AKMODS Flavor and Kernel Version
116112
if [[ "${flavor}" =~ hwe ]]; then
117113
akmods_flavor="bazzite"
@@ -130,7 +126,7 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin
130126
fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}')
131127

132128
# Verify Base Image with cosign
133-
{{ just }} verify-container "${base_image_name}-main:${fedora_version}"
129+
{{ just }} verify-container silverblue:${fedora_version} quay.io/fedora-ostree-desktops "https://gitlab.com/fedora/ostree/ci-test/-/raw/main/quay.io-fedora-ostree-desktops.pub?ref_type=heads"
134130

135131
# Kernel Release/Pin
136132
if [[ -z "${kernel_pin:-}" ]]; then
@@ -177,7 +173,6 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin
177173
target="dx"
178174
fi
179175
BUILD_ARGS+=("--build-arg" "AKMODS_FLAVOR=${akmods_flavor}")
180-
BUILD_ARGS+=("--build-arg" "BASE_IMAGE_NAME=${base_image_name}")
181176
BUILD_ARGS+=("--build-arg" "COMMON_IMAGE={{ common_image }}")
182177
BUILD_ARGS+=("--build-arg" "COMMON_IMAGE_SHA=${common_image_sha}")
183178
BUILD_ARGS+=("--build-arg" "BREW_IMAGE={{ brew_image }}")

build_files/base/04-packages.sh renamed to build_files/base/03-packages.sh

Lines changed: 87 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,43 @@ set -ouex pipefail
66

77
# All DNF-related operations should be done here whenever possible
88

9+
# use negativo17 for 3rd party packages with higher priority than default
10+
# mitigate upstream packaging bug: https://bugzilla.redhat.com/show_bug.cgi?id=2332429
11+
# swap the incorrectly installed OpenCL-ICD-Loader for ocl-icd, the expected package
12+
# TODO: remove me when F42 dropped, F43 is not affected
13+
if [[ "$(rpm -E %fedora)" == "42" ]]; then
14+
dnf5 -y swap --repo='fedora' \
15+
OpenCL-ICD-Loader ocl-icd
16+
fi
17+
18+
if ! grep -q fedora-multimedia <(dnf5 repolist); then
19+
# Enable or Install Repofile
20+
dnf5 config-manager setopt fedora-multimedia.enabled=1 ||
21+
dnf5 config-manager addrepo --from-repofile="https://negativo17.org/repos/fedora-multimedia.repo"
22+
fi
23+
# Set higher priority
24+
dnf5 config-manager setopt fedora-multimedia.priority=90
25+
26+
# use override to replace mesa and others with less crippled versions
27+
OVERRIDES=(
28+
"intel-gmmlib"
29+
"intel-mediasdk"
30+
"intel-vpl-gpu-rt"
31+
"libheif"
32+
"libva"
33+
"libva-intel-media-driver"
34+
"mesa-dri-drivers"
35+
"mesa-filesystem"
36+
"mesa-libEGL"
37+
"mesa-libGL"
38+
"mesa-libgbm"
39+
"mesa-va-drivers"
40+
"mesa-vulkan-drivers"
41+
)
42+
43+
dnf5 distro-sync --skip-unavailable -y --repo='fedora-multimedia' "${OVERRIDES[@]}"
44+
dnf5 versionlock add "${OVERRIDES[@]}"
45+
946
# shellcheck source=build_files/shared/copr-helpers.sh
1047
source /ctx/build_files/shared/copr-helpers.sh
1148

@@ -20,9 +57,10 @@ FEDORA_PACKAGES=(
2057
adcli
2158
adw-gtk3-theme
2259
adwaita-fonts-all
60+
alsa-firmware
61+
alsa-tools-firmware
2362
autofs
24-
bash-color-prompt
25-
bootc
63+
bcache-tools
2664
borgbackup
2765
containerd
2866
cryfs
@@ -32,41 +70,61 @@ FEDORA_PACKAGES=(
3270
fastfetch
3371
firewall-config
3472
fish
73+
flatpak-spawn
3574
foo2zjs
3675
fuse-encfs
3776
gcc
3877
gcc-c++
3978
git-credential-libsecret
4079
glow
4180
gnome-tweaks
81+
google-noto-sans-balinese-fonts
82+
google-noto-sans-cjk-fonts
83+
google-noto-sans-javanese-fonts
84+
google-noto-sans-sundanese-fonts
85+
grub2-tools-extra
4286
gum
43-
hplip
87+
gvfs-nfs
88+
htop
4489
ibus-mozc
90+
ibus-unikey
4591
ifuse
4692
igt-gpu-tools
4793
input-remapper
94+
intel-vaapi-driver
4895
iwd
4996
jetbrains-mono-fonts-all
5097
just
5198
krb5-workstation
5299
libappindicator-gtk3
53100
libayatana-appindicator-gtk3
101+
libcamera-gstreamer
102+
libcamera-tools
54103
libgda
55104
libgda-sqlite
56-
libimobiledevice
105+
libimobiledevice-utils
57106
libratbag-ratbagd
107+
libsss_autofs
108+
libva-utils
58109
libxcrypt-compat
59110
lm_sensors
111+
lshw
60112
make
61-
mesa-libGLU
62113
mozc
114+
mtools
63115
nautilus-gsconnect
116+
net-tools
117+
nvtop
64118
oddjob-mkhomedir
65119
opendyslexic-fonts
120+
openrgb-udev-rules
66121
openssh-askpass
122+
pam-u2f
123+
pam_yubico
124+
pamu2fcfg
125+
pipewire-libs-extra
126+
powerstat
67127
powertop
68-
printer-driver-brlaser
69-
pulseaudio-utils
70128
python3-pip
71129
python3-pygit2
72130
rclone
@@ -77,25 +135,24 @@ FEDORA_PACKAGES=(
77135
samba-winbind-clients
78136
samba-winbind-modules
79137
setools-console
80-
sssd-nfs-idmap
81-
switcheroo-control
138+
smartmontools
139+
solaar-udev
140+
squashfs-tools
141+
sssd-ad
142+
sssd-krb5
143+
symlinks
144+
tcpdump
82145
tmux
146+
traceroute
83147
usbip
84-
usbmuxd
148+
vim
85149
waypipe
86-
wireguard-tools
87-
wl-clipboard
88150
xdg-terminal-exec
89-
xprop
151+
yubikey-manager
90152
zenity
91153
zsh
92154
)
93155

94-
# x86_64-only Fedora packages
95-
FEDORA_PACKAGES_AMD64=(
96-
powerstat
97-
)
98-
99156
# Version-specific Fedora package additions
100157
case "$FEDORA_MAJOR_VERSION" in
101158
42)
@@ -106,57 +163,47 @@ case "$FEDORA_MAJOR_VERSION" in
106163
;;
107164
43)
108165
FEDORA_PACKAGES+=(
109-
evolution-ews-core
110-
gnupg2-scdaemon
111166
)
112167
;;
113168
esac
114169

115170
# Install all Fedora packages (bulk - safe from COPR injection)
116171
echo "Installing ${#FEDORA_PACKAGES[@]} packages from Fedora repos..."
117-
PACKAGES=( "${FEDORA_PACKAGES[@]}" )
118-
# Add arch-specific packages
119-
if [[ $(arch) == x86_64 ]]; then
120-
PACKAGES+=( "${FEDORA_PACKAGES_AMD64[@]}" )
121-
fi
122-
dnf -y install "${PACKAGES[@]}"
172+
dnf -y install "${FEDORA_PACKAGES[@]}"
123173

124174
dnf config-manager addrepo --from-repofile=https://pkgs.tailscale.com/stable/fedora/tailscale.repo
125175
dnf config-manager setopt tailscale-stable.enabled=0
126176
dnf -y install --enablerepo='tailscale-stable' tailscale
127177

178+
dnf -y install --enablerepo=fedora-multimedia \
179+
-x PackageKit* \
180+
ffmpeg{,-libs} libavcodec @multimedia gstreamer1-plugins-{bad-free,bad-free-libs,good,base} lame{,-libs} libfdk-aac libjxl ffmpegthumbnailer
181+
128182
# From che/nerd-fonts
129183
copr_install_isolated "che/nerd-fonts" "nerd-fonts"
130184

131185
# From ublue-os/packages
132-
copr_install_isolated "ublue-os/packages" "uupd"
133-
134-
# Version-specific COPR packages
135-
# case "$FEDORA_MAJOR_VERSION" in
136-
# 42)
137-
# bazaar and uupd from ublue-os/packages
138-
# copr_install_isolated "ublue-os/packages" "bazaar" "uupd"
139-
# ;;
140-
# 43)
141-
# bazaar from ublue-os/packages
142-
# copr_install_isolated "ublue-os/packages" "bazaar"
143-
# ;;
144-
# esac
186+
copr_install_isolated "ublue-os/packages" \
187+
"uupd" \
188+
"oversteer-udev"
145189

146190
# Packages to exclude - common to all versions
147191
EXCLUDED_PACKAGES=(
148-
cosign
192+
default-fonts-cjk-sans
149193
fedora-bookmarks
150194
fedora-chromium-config
151195
fedora-chromium-config-gnome
196+
fedora-third-party
152197
firefox
153198
firefox-langpacks
154199
gnome-extensions-app
155200
gnome-shell-extension-background-logo
156201
gnome-software
157202
gnome-software-rpm-ostree
158203
gnome-terminal-nautilus
204+
google-noto-sans-cjk-vf-fonts
159205
podman-docker
206+
totem-video-thumbnailer
160207
yelp
161208
)
162209

build_files/base/03-install-kernel-akmods.sh renamed to build_files/base/04-install-kernel-akmods.sh

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,11 @@ dnf5 -y install \
3333

3434
dnf5 versionlock add kernel kernel-devel kernel-devel-matched kernel-core kernel-modules kernel-modules-core kernel-modules-extra
3535

36-
# Everyone
37-
# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming
38-
sed -i 's@enabled=0@enabled=1@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo
36+
dnf copr enable -y ublue-os/akmods
37+
38+
mkdir -p /etc/pki/akmods/certs
39+
ghcurl "https://github.com/ublue-os/akmods/raw/refs/heads/main/certs/public_key.der" --retry 3 -Lo /etc/pki/akmods/certs/akmods-ublue.der
40+
grep -F -e "Universal Blue" /etc/pki/akmods/certs/akmods-ublue.der
3941

4042
# RPMFUSION Dependent AKMODS
4143
if [[ "${UBLUE_IMAGE_TAG}" == "beta" ]]; then
@@ -113,4 +115,6 @@ if [[ ${AKMODS_FLAVOR} =~ coreos ]]; then
113115
echo "zfs" >/usr/lib/modules-load.d/zfs.conf
114116
fi
115117

118+
dnf copr disable -y ublue-os/akmods
119+
116120
echo "::endgroup::"

‎build_files/base/05-override-install.sh‎

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,24 +15,27 @@ mkdir -p /usr/share/doc/bluefin
1515
ghcurl "https://github.com/ublue-os/bluefin-docs/releases/download/0.1/bluefin.pdf" --retry 3 -o /tmp/bluefin.pdf
1616
install -Dm0644 -t /usr/share/doc/bluefin/ /tmp/bluefin.pdf
1717

18+
# Footgun, See: https://github.com/ublue-os/main/issues/598
19+
rm -f /usr/bin/chsh /usr/bin/lchsh
20+
21+
# Add linuxbrew to the list of paths usable by `sudo`
22+
# not a sudoers.d override because we want to get updates from upstream and not break everything
23+
sed -Ei "s/secure_path = (.*)/secure_path = \1:\/home\/linuxbrew\/.linuxbrew\/bin/" /etc/sudoers
24+
25+
# https://github.com/ublue-os/main/pull/334
26+
ln -s "/usr/share/fonts/google-noto-sans-cjk-fonts" "/usr/share/fonts/noto-cjk"
27+
28+
# use CoreOS' generator for emergency/rescue boot
29+
# see detail: https://github.com/ublue-os/main/issues/653
30+
mkdir -p /usr/lib/systemd/system-generators
31+
ghcurl "https://raw.githubusercontent.com/coreos/fedora-coreos-config/refs/heads/stable/overlay.d/05core/usr/lib/systemd/system-generators/coreos-sulogin-force-generator" --retry 3 -Lo /usr/lib/systemd/system-generators/coreos-sulogin-force-generator
32+
chmod +x /usr/lib/systemd/system-generators/coreos-sulogin-force-generator
33+
1834
# Starship Shell Prompt
1935
ghcurl "https://github.com/starship/starship/releases/latest/download/starship-x86_64-unknown-linux-gnu.tar.gz" --retry 3 -o /tmp/starship.tar.gz
2036
tar -xzf /tmp/starship.tar.gz -C /tmp
2137
install -c -m 0755 /tmp/starship /usr/bin
2238

23-
# Required for bluefin faces to work without conflicting with a ton of packages
24-
rm -f /usr/share/pixmaps/faces/* || echo "Expected directory deletion to fail"
25-
mv /usr/share/pixmaps/faces/bluefin/* /usr/share/pixmaps/faces
26-
rm -rf /usr/share/pixmaps/faces/bluefin
27-
28-
# Remove desktop entries
29-
if [[ -f /usr/share/applications/gnome-system-monitor.desktop ]]; then
30-
sed -i 's@\[Desktop Entry\]@\[Desktop Entry\]\nHidden=true@g' /usr/share/applications/gnome-system-monitor.desktop
31-
fi
32-
if [[ -f /usr/share/applications/org.gnome.SystemMonitor.desktop ]]; then
33-
sed -i 's@\[Desktop Entry\]@\[Desktop Entry\]\nHidden=true@g' /usr/share/applications/org.gnome.SystemMonitor.desktop
34-
fi
35-
3639
# Add Mutter experimental-features
3740
if [[ "${IMAGE_NAME}" =~ nvidia ]]; then
3841
sed -i "/experimental-features/ s/\]/, 'kms-modifiers'&/" /usr/share/glib-2.0/schemas/zz0-bluefin-modifications.gschema.override

‎build_files/base/17-cleanup.sh‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ systemctl disable flatpak-add-fedora-repos.service
3939
# We only need to clean up repos that were enabled during the build process.
4040

4141
# Disable third-party repos
42-
for repo in negativo17-fedora-multimedia tailscale fedora-cisco-openh264; do
42+
for repo in fedora-multimedia tailscale fedora-cisco-openh264; do
4343
if [[ -f "/etc/yum.repos.d/${repo}.repo" ]]; then
4444
sed -i 's@enabled=1@enabled=0@g' "/etc/yum.repos.d/${repo}.repo"
4545
fi
@@ -52,11 +52,6 @@ for i in /etc/yum.repos.d/_copr:*.repo; do
5252
fi
5353
done
5454

55-
# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming
56-
if [[ -f "/etc/yum.repos.d/_copr_ublue-os-akmods.repo" ]]; then
57-
sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo
58-
fi
59-
6055
# Disable RPM Fusion repos
6156
for i in /etc/yum.repos.d/rpmfusion-*.repo; do
6257
if [[ -f "$i" ]]; then

‎build_files/base/20-tests.sh‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,10 +51,29 @@ for package in "${IMPORTANT_PACKAGES[@]}"; do
5151
rpm -q "${package}" >/dev/null || { echo "Missing package: ${package}... Exiting"; exit 1 ; }
5252
done
5353

54+
# these should be sourced from negativo's fedora-multimedia repo
55+
# as Fedora can't ship patent encumbered video codecs
56+
NEGATIVO=(
57+
ffmpeg
58+
libheif
59+
libva
60+
mesa-filesystem
61+
mesa-va-drivers
62+
pipewire-libs-extra
63+
x264-libs
64+
x265-libs
65+
)
66+
67+
for package in "${NEGATIVO[@]}"; do
68+
rpm -q --qf "%{NAME} %{VENDOR}" "${package}" | grep -q "negativo17\.org" || { echo "${package} not from negativo... Exiting"; exit 1 ; }
69+
done
70+
5471
# these packages are supposed to be removed
5572
# and are considered footguns
5673
UNWANTED_PACKAGES=(
74+
fedora-flathub-remote
5775
fedora-logos
76+
fedora-third-party
5877
firefox
5978
gnome-software
6079
gnome-software-rpm-ostree

0 commit comments

Comments
 (0)