feat: move base image to quay.io/fedora-ostree-desktops/silverblue

Drop ghcr.io/ublue-os/silverblue-main in favor of the upstream
Fedora image directly from quay.io/fedora-ostree-desktops/silverblue.
This removes the ublue-os/main dependency and unblocks ARM support.

- Update Containerfile base image and bump to F43
- Update Justfile build recipe: remove base_image_name variable,
  update cosign verification to use Fedora's public key
- Update renovate.json5 to track new image, disable major version bumps
- Rename/reorder build scripts: packages (03) before kernel (04)
- Add negativo17 fedora-multimedia repo + mesa overrides in 03-packages.sh
- Add multimedia codecs (ffmpeg, libfdk-aac, etc.) from negativo17
- Add packages previously provided by ublue-os/main:
  alsa-firmware, flatpak-spawn, noto fonts, grub2-tools-extra,
  htop, nvtop, pam-u2f/yubico, smartmontools, vim, and more
- Remove packages now in base or no longer needed:
  bash-color-prompt, bootc, hplip, mesa-libGLU, printer-driver-brlaser,
  pulseaudio-utils, switcheroo-control, usbmuxd, wireguard-tools, wl-clipboard
- Add ublue-os/main features to 05-override-install.sh:
  rm chsh/lchsh footgun, sudoers brew path, noto-cjk symlink,
  coreos-sulogin-force-generator
- Remove faces/desktop-entry workarounds (no longer needed)
- Update kernel COPR handling: use dnf copr enable/disable
- Add copr.vendor.conf to keep COPR plugin using 'fedora' distribution ID
- Update 20-tests.sh: verify negativo packages and expand unwanted list

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: Claude Sonnet 4.6 via GitHub Copilot

Author: castrojo

.github/renovate.json5

@@ -67,9 +67,14 @@
       "automerge": true,
       "matchUpdateTypes": ["digest"],
       "matchDepNames": [
-        "ghcr.io/ublue-os/silverblue-main"
+        "quay.io/fedora-ostree-desktops/silverblue"
       ]
     },
+    {
+      "matchDepNames": ["quay.io/fedora-ostree-desktops/silverblue"],
+      "matchUpdateTypes": ["major"],
+      "enabled": false
+    },
     {
       "matchDepTypes": ["gnome-extension"],
       "matchPackageNames": ["micheleg/dash-to-dock"],

Containerfile

@@ -1,7 +1,6 @@
 ARG BASE_IMAGE_NAME="silverblue"
-ARG FEDORA_MAJOR_VERSION="42"
-ARG SOURCE_IMAGE="${BASE_IMAGE_NAME}-main"
-ARG BASE_IMAGE="ghcr.io/ublue-os/${SOURCE_IMAGE}"
+ARG FEDORA_MAJOR_VERSION="43"
+ARG BASE_IMAGE="quay.io/fedora-ostree-desktops/silverblue"
 ARG COMMON_IMAGE="ghcr.io/projectbluefin/common:latest"
 ARG COMMON_IMAGE_SHA=""
 ARG BREW_IMAGE="ghcr.io/ublue-os/brew:latest"

Justfile

@@ -108,10 +108,6 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin
     common_image_sha=$(yq -r '.images[] | select(.name == "common") | .digest' image-versions.yml)
     brew_image_sha=$(yq -r '.images[] | select(.name == "brew") | .digest' image-versions.yml)
 
-    # Base Image
-    base_image_name="silverblue"
-
-
     # AKMODS Flavor and Kernel Version
     if [[ "${flavor}" =~ hwe ]]; then
         akmods_flavor="bazzite"
@@ -130,7 +126,7 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin
     fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}')
 
     # Verify Base Image with cosign
-    {{ just }} verify-container "${base_image_name}-main:${fedora_version}"
+    {{ just }} verify-container silverblue:${fedora_version} quay.io/fedora-ostree-desktops "https://gitlab.com/fedora/ostree/ci-test/-/raw/main/quay.io-fedora-ostree-desktops.pub?ref_type=heads"
 
     # Kernel Release/Pin
     if [[ -z "${kernel_pin:-}" ]]; then
@@ -177,7 +173,6 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin
         target="dx"
     fi
     BUILD_ARGS+=("--build-arg" "AKMODS_FLAVOR=${akmods_flavor}")
-    BUILD_ARGS+=("--build-arg" "BASE_IMAGE_NAME=${base_image_name}")
     BUILD_ARGS+=("--build-arg" "COMMON_IMAGE={{ common_image }}")
     BUILD_ARGS+=("--build-arg" "COMMON_IMAGE_SHA=${common_image_sha}")
     BUILD_ARGS+=("--build-arg" "BREW_IMAGE={{ brew_image }}")

build_files/base/04-packages.sh build_files/base/03-packages.shbuild_files/base/04-packages.sh renamed to build_files/base/03-packages.sh

@@ -6,6 +6,43 @@ set -ouex pipefail
 
 # All DNF-related operations should be done here whenever possible
 
+# use negativo17 for 3rd party packages with higher priority than default
+# mitigate upstream packaging bug: https://bugzilla.redhat.com/show_bug.cgi?id=2332429
+# swap the incorrectly installed OpenCL-ICD-Loader for ocl-icd, the expected package
+# TODO: remove me when F42 dropped, F43 is not affected
+if [[ "$(rpm -E %fedora)" == "42" ]]; then
+dnf5 -y swap --repo='fedora' \
+    OpenCL-ICD-Loader ocl-icd
+fi
+
+if ! grep -q fedora-multimedia <(dnf5 repolist); then
+    # Enable or Install Repofile
+    dnf5 config-manager setopt fedora-multimedia.enabled=1 ||
+        dnf5 config-manager addrepo --from-repofile="https://negativo17.org/repos/fedora-multimedia.repo"
+fi
+# Set higher priority
+dnf5 config-manager setopt fedora-multimedia.priority=90
+
+# use override to replace mesa and others with less crippled versions
+OVERRIDES=(
+    "intel-gmmlib"
+    "intel-mediasdk"
+    "intel-vpl-gpu-rt"
+    "libheif"
+    "libva"
+    "libva-intel-media-driver"
+    "mesa-dri-drivers"
+    "mesa-filesystem"
+    "mesa-libEGL"
+    "mesa-libGL"
+    "mesa-libgbm"
+    "mesa-va-drivers"
+    "mesa-vulkan-drivers"
+)
+
+dnf5 distro-sync --skip-unavailable -y --repo='fedora-multimedia' "${OVERRIDES[@]}"
+dnf5 versionlock add "${OVERRIDES[@]}"
+
 # shellcheck source=build_files/shared/copr-helpers.sh
 source /ctx/build_files/shared/copr-helpers.sh
 
@@ -20,9 +57,10 @@ FEDORA_PACKAGES=(
     adcli
     adw-gtk3-theme
     adwaita-fonts-all
+    alsa-firmware
+    alsa-tools-firmware
     autofs
-    bash-color-prompt
-    bootc
+    bcache-tools
     borgbackup
     containerd
     cryfs
@@ -32,41 +70,61 @@ FEDORA_PACKAGES=(
     fastfetch
     firewall-config
     fish
+    flatpak-spawn
     foo2zjs
     fuse-encfs
     gcc
     gcc-c++
     git-credential-libsecret
     glow
     gnome-tweaks
+    google-noto-sans-balinese-fonts
+    google-noto-sans-cjk-fonts
+    google-noto-sans-javanese-fonts
+    google-noto-sans-sundanese-fonts
+    grub2-tools-extra
     gum
-    hplip
+    gvfs-nfs
+    htop
     ibus-mozc
+    ibus-unikey
     ifuse
     igt-gpu-tools
     input-remapper
+    intel-vaapi-driver
     iwd
     jetbrains-mono-fonts-all
     just
     krb5-workstation
     libappindicator-gtk3
     libayatana-appindicator-gtk3
+    libcamera-gstreamer
+    libcamera-tools
     libgda
     libgda-sqlite
-    libimobiledevice
+    libimobiledevice-utils
     libratbag-ratbagd
+    libsss_autofs
+    libva-utils
     libxcrypt-compat
     lm_sensors
+    lshw
     make
-    mesa-libGLU
     mozc
+    mtools
     nautilus-gsconnect
+    net-tools
+    nvtop
     oddjob-mkhomedir
     opendyslexic-fonts
+    openrgb-udev-rules
     openssh-askpass
+    pam-u2f
+    pam_yubico
+    pamu2fcfg
+    pipewire-libs-extra
+    powerstat
     powertop
-    printer-driver-brlaser
-    pulseaudio-utils
     python3-pip
     python3-pygit2
     rclone
@@ -77,25 +135,24 @@ FEDORA_PACKAGES=(
     samba-winbind-clients
     samba-winbind-modules
     setools-console
-    sssd-nfs-idmap
-    switcheroo-control
+    smartmontools
+    solaar-udev
+    squashfs-tools
+    sssd-ad
+    sssd-krb5
+    symlinks
+    tcpdump
     tmux
+    traceroute
     usbip
-    usbmuxd
+    vim
     waypipe
-    wireguard-tools
-    wl-clipboard
     xdg-terminal-exec
-    xprop
+    yubikey-manager
     zenity
     zsh
 )
 
-# x86_64-only Fedora packages
-FEDORA_PACKAGES_AMD64=(
-    powerstat
-)
-
 # Version-specific Fedora package additions
 case "$FEDORA_MAJOR_VERSION" in
     42)
@@ -106,57 +163,47 @@ case "$FEDORA_MAJOR_VERSION" in
         ;;
     43)
         FEDORA_PACKAGES+=(
-            evolution-ews-core
-            gnupg2-scdaemon
         )
         ;;
 esac
 
 # Install all Fedora packages (bulk - safe from COPR injection)
 echo "Installing ${#FEDORA_PACKAGES[@]} packages from Fedora repos..."
-PACKAGES=( "${FEDORA_PACKAGES[@]}" )
-# Add arch-specific packages
-if [[ $(arch) == x86_64 ]]; then
-    PACKAGES+=( "${FEDORA_PACKAGES_AMD64[@]}" )
-fi
-dnf -y install "${PACKAGES[@]}"
+dnf -y install "${FEDORA_PACKAGES[@]}"
 
 dnf config-manager addrepo --from-repofile=https://pkgs.tailscale.com/stable/fedora/tailscale.repo
 dnf config-manager setopt tailscale-stable.enabled=0
 dnf -y install --enablerepo='tailscale-stable' tailscale
 
+dnf -y install --enablerepo=fedora-multimedia \
+    -x PackageKit* \
+    ffmpeg{,-libs} libavcodec @multimedia gstreamer1-plugins-{bad-free,bad-free-libs,good,base} lame{,-libs} libfdk-aac libjxl ffmpegthumbnailer
+
 # From che/nerd-fonts
 copr_install_isolated "che/nerd-fonts" "nerd-fonts"
 
 # From ublue-os/packages
-copr_install_isolated "ublue-os/packages" "uupd"
-
-# Version-specific COPR packages
-# case "$FEDORA_MAJOR_VERSION" in
-#    42)
-        # bazaar and uupd from ublue-os/packages
-        # copr_install_isolated "ublue-os/packages" "bazaar" "uupd"
-        # ;;
-    # 43)
-        # bazaar from ublue-os/packages
-        # copr_install_isolated "ublue-os/packages" "bazaar"
-        # ;;
-# esac
+copr_install_isolated "ublue-os/packages" \
+    "uupd" \
+    "oversteer-udev"
 
 # Packages to exclude - common to all versions
 EXCLUDED_PACKAGES=(
-    cosign
+    default-fonts-cjk-sans
     fedora-bookmarks
     fedora-chromium-config
     fedora-chromium-config-gnome
+    fedora-third-party
     firefox
     firefox-langpacks
     gnome-extensions-app
     gnome-shell-extension-background-logo
     gnome-software
     gnome-software-rpm-ostree
     gnome-terminal-nautilus
+    google-noto-sans-cjk-vf-fonts
     podman-docker
+    totem-video-thumbnailer
     yelp
 )
 

…d_files/base/03-install-kernel-akmods.sh …d_files/base/04-install-kernel-akmods.shbuild_files/base/03-install-kernel-akmods.sh renamed to build_files/base/04-install-kernel-akmods.sh build_files/base/03-install-kernel-akmods.sh renamed to build_files/base/04-install-kernel-akmods.sh

@@ -33,9 +33,11 @@ dnf5 -y install \
 
 dnf5 versionlock add kernel kernel-devel kernel-devel-matched kernel-core kernel-modules kernel-modules-core kernel-modules-extra
 
-# Everyone
-# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming
-sed -i 's@enabled=0@enabled=1@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo
+dnf copr enable -y ublue-os/akmods
+
+mkdir -p /etc/pki/akmods/certs
+ghcurl "https://github.com/ublue-os/akmods/raw/refs/heads/main/certs/public_key.der" --retry 3 -Lo /etc/pki/akmods/certs/akmods-ublue.der
+grep -F -e "Universal Blue" /etc/pki/akmods/certs/akmods-ublue.der
 
 # RPMFUSION Dependent AKMODS
 if [[ "${UBLUE_IMAGE_TAG}" == "beta" ]]; then
@@ -113,4 +115,6 @@ if [[ ${AKMODS_FLAVOR} =~ coreos ]]; then
     echo "zfs" >/usr/lib/modules-load.d/zfs.conf
 fi
 
+dnf copr disable -y ublue-os/akmods
+
 echo "::endgroup::"

build_files/base/05-override-install.sh

@@ -15,23 +15,33 @@ mkdir -p /usr/share/doc/bluefin
 ghcurl "https://github.com/ublue-os/bluefin-docs/releases/download/0.1/bluefin.pdf" --retry 3 -o /tmp/bluefin.pdf
 install -Dm0644 -t /usr/share/doc/bluefin/ /tmp/bluefin.pdf
 
+# Footgun, See: https://github.com/ublue-os/main/issues/598
+rm -f /usr/bin/chsh /usr/bin/lchsh
+
+# Add linuxbrew to the list of paths usable by `sudo`
+# not a sudoers.d override because we want to get updates from upstream and not break everything
+sed -Ei "s/secure_path = (.*)/secure_path = \1:\/home\/linuxbrew\/.linuxbrew\/bin/" /etc/sudoers
+
+# https://github.com/ublue-os/main/pull/334
+ln -s "/usr/share/fonts/google-noto-sans-cjk-fonts" "/usr/share/fonts/noto-cjk"
+
+# use CoreOS' generator for emergency/rescue boot
+# see detail: https://github.com/ublue-os/main/issues/653
+mkdir -p /usr/lib/systemd/system-generators
+ghcurl "https://raw.githubusercontent.com/coreos/fedora-coreos-config/refs/heads/stable/overlay.d/05core/usr/lib/systemd/system-generators/coreos-sulogin-force-generator" --retry 3 -Lo /usr/lib/systemd/system-generators/coreos-sulogin-force-generator
+chmod +x /usr/lib/systemd/system-generators/coreos-sulogin-force-generator
+
 # Starship Shell Prompt
 ghcurl "https://github.com/starship/starship/releases/latest/download/starship-x86_64-unknown-linux-gnu.tar.gz" --retry 3 -o /tmp/starship.tar.gz
 tar -xzf /tmp/starship.tar.gz -C /tmp
 install -c -m 0755 /tmp/starship /usr/bin
 
-# Required for bluefin faces to work without conflicting with a ton of packages
-rm -f /usr/share/pixmaps/faces/* || echo "Expected directory deletion to fail"
-mv /usr/share/pixmaps/faces/bluefin/* /usr/share/pixmaps/faces
-rm -rf /usr/share/pixmaps/faces/bluefin
-
-# Remove desktop entries
-if [[ -f /usr/share/applications/gnome-system-monitor.desktop ]]; then
-    sed -i 's@\[Desktop Entry\]@\[Desktop Entry\]\nHidden=true@g' /usr/share/applications/gnome-system-monitor.desktop
-fi
-if [[ -f /usr/share/applications/org.gnome.SystemMonitor.desktop ]]; then
-    sed -i 's@\[Desktop Entry\]@\[Desktop Entry\]\nHidden=true@g' /usr/share/applications/org.gnome.SystemMonitor.desktop
-fi
+# Configure firewalld with Fedora Workstation defaults
+# https://src.fedoraproject.org/rpms/firewalld/blob/rawhide/f/firewalld.spec
+ghcurl "https://src.fedoraproject.org/rpms/firewalld/raw/rawhide/f/FedoraWorkstation.xml" --retry 3 -Lo /usr/lib/firewalld/zones/FedoraWorkstation.xml
+grep -F -e '<port protocol="udp" port="1025-65535"/>' /usr/lib/firewalld/zones/FedoraWorkstation.xml
+sed -i 's|^DefaultZone=.*|DefaultZone=FedoraWorkstation|g' /etc/firewalld/firewalld.conf
+sed -i 's|^IPv6_rpfilter=.*|IPv6_rpfilter=loose|g' /etc/firewalld/firewalld.conf
 
 # Add Mutter experimental-features
 if [[ "${IMAGE_NAME}" =~ nvidia ]]; then
@@ -40,4 +50,7 @@ if [[ "${IMAGE_NAME}" =~ nvidia ]]; then
     glib-compile-schemas /usr/share/glib-2.0/schemas
 fi
 
+# Rebuild gdk-pixbuf loader cache so all installed loaders are registered
+gdk-pixbuf-query-loaders-64 --update-cache
+
 echo "::endgroup::"

build_files/base/17-cleanup.sh

@@ -39,7 +39,7 @@ systemctl disable flatpak-add-fedora-repos.service
 # We only need to clean up repos that were enabled during the build process.
 
 # Disable third-party repos
-for repo in negativo17-fedora-multimedia tailscale fedora-cisco-openh264; do
+for repo in fedora-multimedia tailscale fedora-cisco-openh264; do
     if [[ -f "/etc/yum.repos.d/${repo}.repo" ]]; then
         sed -i 's@enabled=1@enabled=0@g' "/etc/yum.repos.d/${repo}.repo"
     fi
@@ -52,11 +52,6 @@ for i in /etc/yum.repos.d/_copr:*.repo; do
     fi
 done
 
-# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming
-if [[ -f "/etc/yum.repos.d/_copr_ublue-os-akmods.repo" ]]; then
-    sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo
-fi
-
 # Disable RPM Fusion repos
 for i in /etc/yum.repos.d/rpmfusion-*.repo; do
     if [[ -f "$i" ]]; then