From f6873b9fd30f9c9e1ac75ab85e9d6a97d8cdf9ae Mon Sep 17 00:00:00 2001 From: "Jorge O. Castro" Date: Sat, 30 May 2026 17:13:53 -0400 Subject: [PATCH 1/4] feat: move base image to quay.io/fedora-ostree-desktops/silverblue Drop ghcr.io/ublue-os/silverblue-main in favor of the upstream Fedora image directly from quay.io/fedora-ostree-desktops/silverblue. This removes the ublue-os/main dependency and unblocks ARM support. - Update Containerfile base image and bump to F43 - Update Justfile build recipe: remove base_image_name variable, update cosign verification to use Fedora's public key - Update renovate.json5 to track new image, disable major version bumps - Rename/reorder build scripts: packages (03) before kernel (04) - Add negativo17 fedora-multimedia repo + mesa overrides in 03-packages.sh - Add multimedia codecs (ffmpeg, libfdk-aac, etc.) from negativo17 - Add packages previously provided by ublue-os/main: alsa-firmware, flatpak-spawn, noto fonts, grub2-tools-extra, htop, nvtop, pam-u2f/yubico, smartmontools, vim, and more - Remove packages now in base or no longer needed: bash-color-prompt, bootc, hplip, mesa-libGLU, printer-driver-brlaser, pulseaudio-utils, switcheroo-control, usbmuxd, wireguard-tools, wl-clipboard - Add ublue-os/main features to 05-override-install.sh: rm chsh/lchsh footgun, sudoers brew path, noto-cjk symlink, coreos-sulogin-force-generator - Remove faces/desktop-entry workarounds (no longer needed) - Update kernel COPR handling: use dnf copr enable/disable - Add copr.vendor.conf to keep COPR plugin using 'fedora' distribution ID - Update 20-tests.sh: verify negativo packages and expand unwanted list Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Assisted-by: Claude Sonnet 4.6 via GitHub Copilot --- .github/renovate.json5 | 7 +- Containerfile | 5 +- Justfile | 7 +- .../base/{04-packages.sh => 03-packages.sh} | 127 ++++++++++++------ ...-akmods.sh => 04-install-kernel-akmods.sh} | 10 +- build_files/base/05-override-install.sh | 37 +++-- build_files/base/17-cleanup.sh | 7 +- build_files/base/20-tests.sh | 19 +++ build_files/dx/00-dx.sh | 3 +- build_files/shared/build.sh | 11 +- .../usr/share/dnf/plugins/copr.vendor.conf | 4 + 11 files changed, 157 insertions(+), 80 deletions(-) rename build_files/base/{04-packages.sh => 03-packages.sh} (59%) rename build_files/base/{03-install-kernel-akmods.sh => 04-install-kernel-akmods.sh} (93%) create mode 100644 system_files/shared/usr/share/dnf/plugins/copr.vendor.conf diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 8fd44fc2..f559182c 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -67,9 +67,14 @@ "automerge": true, "matchUpdateTypes": ["digest"], "matchDepNames": [ - "ghcr.io/ublue-os/silverblue-main" + "quay.io/fedora-ostree-desktops/silverblue" ] }, + { + "matchDepNames": ["quay.io/fedora-ostree-desktops/silverblue"], + "matchUpdateTypes": ["major"], + "enabled": false + }, { "matchDepTypes": ["gnome-extension"], "matchPackageNames": ["micheleg/dash-to-dock"], diff --git a/Containerfile b/Containerfile index c5fd357a..bb54f2a6 100644 --- a/Containerfile +++ b/Containerfile @@ -1,7 +1,6 @@ ARG BASE_IMAGE_NAME="silverblue" -ARG FEDORA_MAJOR_VERSION="42" -ARG SOURCE_IMAGE="${BASE_IMAGE_NAME}-main" -ARG BASE_IMAGE="ghcr.io/ublue-os/${SOURCE_IMAGE}" +ARG FEDORA_MAJOR_VERSION="43" +ARG BASE_IMAGE="quay.io/fedora-ostree-desktops/silverblue" ARG COMMON_IMAGE="ghcr.io/projectbluefin/common:latest" ARG COMMON_IMAGE_SHA="" ARG BREW_IMAGE="ghcr.io/ublue-os/brew:latest" diff --git a/Justfile b/Justfile index f7ca7f2c..f615d849 100644 --- a/Justfile +++ b/Justfile @@ -108,10 +108,6 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin common_image_sha=$(yq -r '.images[] | select(.name == "common") | .digest' image-versions.yml) brew_image_sha=$(yq -r '.images[] | select(.name == "brew") | .digest' image-versions.yml) - # Base Image - base_image_name="silverblue" - - # AKMODS Flavor and Kernel Version if [[ "${flavor}" =~ hwe ]]; then akmods_flavor="bazzite" @@ -130,7 +126,7 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}') # Verify Base Image with cosign - {{ just }} verify-container "${base_image_name}-main:${fedora_version}" + {{ just }} verify-container silverblue:${fedora_version} quay.io/fedora-ostree-desktops "https://gitlab.com/fedora/ostree/ci-test/-/raw/main/quay.io-fedora-ostree-desktops.pub?ref_type=heads" # Kernel Release/Pin if [[ -z "${kernel_pin:-}" ]]; then @@ -177,7 +173,6 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin target="dx" fi BUILD_ARGS+=("--build-arg" "AKMODS_FLAVOR=${akmods_flavor}") - BUILD_ARGS+=("--build-arg" "BASE_IMAGE_NAME=${base_image_name}") BUILD_ARGS+=("--build-arg" "COMMON_IMAGE={{ common_image }}") BUILD_ARGS+=("--build-arg" "COMMON_IMAGE_SHA=${common_image_sha}") BUILD_ARGS+=("--build-arg" "BREW_IMAGE={{ brew_image }}") diff --git a/build_files/base/04-packages.sh b/build_files/base/03-packages.sh similarity index 59% rename from build_files/base/04-packages.sh rename to build_files/base/03-packages.sh index 755d55b0..e7af164f 100755 --- a/build_files/base/04-packages.sh +++ b/build_files/base/03-packages.sh @@ -6,6 +6,43 @@ set -ouex pipefail # All DNF-related operations should be done here whenever possible +# use negativo17 for 3rd party packages with higher priority than default +# mitigate upstream packaging bug: https://bugzilla.redhat.com/show_bug.cgi?id=2332429 +# swap the incorrectly installed OpenCL-ICD-Loader for ocl-icd, the expected package +# TODO: remove me when F42 dropped, F43 is not affected +if [[ "$(rpm -E %fedora)" == "42" ]]; then +dnf5 -y swap --repo='fedora' \ + OpenCL-ICD-Loader ocl-icd +fi + +if ! grep -q fedora-multimedia <(dnf5 repolist); then + # Enable or Install Repofile + dnf5 config-manager setopt fedora-multimedia.enabled=1 || + dnf5 config-manager addrepo --from-repofile="https://negativo17.org/repos/fedora-multimedia.repo" +fi +# Set higher priority +dnf5 config-manager setopt fedora-multimedia.priority=90 + +# use override to replace mesa and others with less crippled versions +OVERRIDES=( + "intel-gmmlib" + "intel-mediasdk" + "intel-vpl-gpu-rt" + "libheif" + "libva" + "libva-intel-media-driver" + "mesa-dri-drivers" + "mesa-filesystem" + "mesa-libEGL" + "mesa-libGL" + "mesa-libgbm" + "mesa-va-drivers" + "mesa-vulkan-drivers" +) + +dnf5 distro-sync --skip-unavailable -y --repo='fedora-multimedia' "${OVERRIDES[@]}" +dnf5 versionlock add "${OVERRIDES[@]}" + # shellcheck source=build_files/shared/copr-helpers.sh source /ctx/build_files/shared/copr-helpers.sh @@ -20,9 +57,10 @@ FEDORA_PACKAGES=( adcli adw-gtk3-theme adwaita-fonts-all + alsa-firmware + alsa-tools-firmware autofs - bash-color-prompt - bootc + bcache-tools borgbackup containerd cryfs @@ -32,6 +70,7 @@ FEDORA_PACKAGES=( fastfetch firewall-config fish + flatpak-spawn foo2zjs fuse-encfs gcc @@ -39,34 +78,53 @@ FEDORA_PACKAGES=( git-credential-libsecret glow gnome-tweaks + google-noto-sans-balinese-fonts + google-noto-sans-cjk-fonts + google-noto-sans-javanese-fonts + google-noto-sans-sundanese-fonts + grub2-tools-extra gum - hplip + gvfs-nfs + htop ibus-mozc + ibus-unikey ifuse igt-gpu-tools input-remapper + intel-vaapi-driver iwd jetbrains-mono-fonts-all just krb5-workstation libappindicator-gtk3 libayatana-appindicator-gtk3 + libcamera-gstreamer + libcamera-tools libgda libgda-sqlite - libimobiledevice + libimobiledevice-utils libratbag-ratbagd + libsss_autofs + libva-utils libxcrypt-compat lm_sensors + lshw make - mesa-libGLU mozc + mtools nautilus-gsconnect + net-tools + nvtop oddjob-mkhomedir opendyslexic-fonts + openrgb-udev-rules openssh-askpass + pam-u2f + pam_yubico + pamu2fcfg + pipewire-libs-extra + powerstat powertop - printer-driver-brlaser - pulseaudio-utils python3-pip python3-pygit2 rclone @@ -77,25 +135,24 @@ FEDORA_PACKAGES=( samba-winbind-clients samba-winbind-modules setools-console - sssd-nfs-idmap - switcheroo-control + smartmontools + solaar-udev + squashfs-tools + sssd-ad + sssd-krb5 + symlinks + tcpdump tmux + traceroute usbip - usbmuxd + vim waypipe - wireguard-tools - wl-clipboard xdg-terminal-exec - xprop + yubikey-manager zenity zsh ) -# x86_64-only Fedora packages -FEDORA_PACKAGES_AMD64=( - powerstat -) - # Version-specific Fedora package additions case "$FEDORA_MAJOR_VERSION" in 42) @@ -106,49 +163,37 @@ case "$FEDORA_MAJOR_VERSION" in ;; 43) FEDORA_PACKAGES+=( - evolution-ews-core - gnupg2-scdaemon ) ;; esac # Install all Fedora packages (bulk - safe from COPR injection) echo "Installing ${#FEDORA_PACKAGES[@]} packages from Fedora repos..." -PACKAGES=( "${FEDORA_PACKAGES[@]}" ) -# Add arch-specific packages -if [[ $(arch) == x86_64 ]]; then - PACKAGES+=( "${FEDORA_PACKAGES_AMD64[@]}" ) -fi -dnf -y install "${PACKAGES[@]}" +dnf -y install "${FEDORA_PACKAGES[@]}" dnf config-manager addrepo --from-repofile=https://pkgs.tailscale.com/stable/fedora/tailscale.repo dnf config-manager setopt tailscale-stable.enabled=0 dnf -y install --enablerepo='tailscale-stable' tailscale +dnf -y install --enablerepo=fedora-multimedia \ + -x PackageKit* \ + ffmpeg{,-libs} libavcodec @multimedia gstreamer1-plugins-{bad-free,bad-free-libs,good,base} lame{,-libs} libfdk-aac libjxl ffmpegthumbnailer + # From che/nerd-fonts copr_install_isolated "che/nerd-fonts" "nerd-fonts" # From ublue-os/packages -copr_install_isolated "ublue-os/packages" "uupd" - -# Version-specific COPR packages -# case "$FEDORA_MAJOR_VERSION" in -# 42) - # bazaar and uupd from ublue-os/packages - # copr_install_isolated "ublue-os/packages" "bazaar" "uupd" - # ;; - # 43) - # bazaar from ublue-os/packages - # copr_install_isolated "ublue-os/packages" "bazaar" - # ;; -# esac +copr_install_isolated "ublue-os/packages" \ + "uupd" \ + "oversteer-udev" # Packages to exclude - common to all versions EXCLUDED_PACKAGES=( - cosign + default-fonts-cjk-sans fedora-bookmarks fedora-chromium-config fedora-chromium-config-gnome + fedora-third-party firefox firefox-langpacks gnome-extensions-app @@ -156,7 +201,9 @@ EXCLUDED_PACKAGES=( gnome-software gnome-software-rpm-ostree gnome-terminal-nautilus + google-noto-sans-cjk-vf-fonts podman-docker + totem-video-thumbnailer yelp ) diff --git a/build_files/base/03-install-kernel-akmods.sh b/build_files/base/04-install-kernel-akmods.sh similarity index 93% rename from build_files/base/03-install-kernel-akmods.sh rename to build_files/base/04-install-kernel-akmods.sh index 91838234..b6a1aebe 100755 --- a/build_files/base/03-install-kernel-akmods.sh +++ b/build_files/base/04-install-kernel-akmods.sh @@ -33,9 +33,11 @@ dnf5 -y install \ dnf5 versionlock add kernel kernel-devel kernel-devel-matched kernel-core kernel-modules kernel-modules-core kernel-modules-extra -# Everyone -# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -sed -i 's@enabled=0@enabled=1@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo +dnf copr enable -y ublue-os/akmods + +mkdir -p /etc/pki/akmods/certs +ghcurl "https://github.com/ublue-os/akmods/raw/refs/heads/main/certs/public_key.der" --retry 3 -Lo /etc/pki/akmods/certs/akmods-ublue.der +grep -F -e "Universal Blue" /etc/pki/akmods/certs/akmods-ublue.der # RPMFUSION Dependent AKMODS if [[ "${UBLUE_IMAGE_TAG}" == "beta" ]]; then @@ -113,4 +115,6 @@ if [[ ${AKMODS_FLAVOR} =~ coreos ]]; then echo "zfs" >/usr/lib/modules-load.d/zfs.conf fi +dnf copr disable -y ublue-os/akmods + echo "::endgroup::" diff --git a/build_files/base/05-override-install.sh b/build_files/base/05-override-install.sh index 1b3652f5..2eb4b7f6 100755 --- a/build_files/base/05-override-install.sh +++ b/build_files/base/05-override-install.sh @@ -15,23 +15,33 @@ mkdir -p /usr/share/doc/bluefin ghcurl "https://github.com/ublue-os/bluefin-docs/releases/download/0.1/bluefin.pdf" --retry 3 -o /tmp/bluefin.pdf install -Dm0644 -t /usr/share/doc/bluefin/ /tmp/bluefin.pdf +# Footgun, See: https://github.com/ublue-os/main/issues/598 +rm -f /usr/bin/chsh /usr/bin/lchsh + +# Add linuxbrew to the list of paths usable by `sudo` +# not a sudoers.d override because we want to get updates from upstream and not break everything +sed -Ei "s/secure_path = (.*)/secure_path = \1:\/home\/linuxbrew\/.linuxbrew\/bin/" /etc/sudoers + +# https://github.com/ublue-os/main/pull/334 +ln -s "/usr/share/fonts/google-noto-sans-cjk-fonts" "/usr/share/fonts/noto-cjk" + +# use CoreOS' generator for emergency/rescue boot +# see detail: https://github.com/ublue-os/main/issues/653 +mkdir -p /usr/lib/systemd/system-generators +ghcurl "https://raw.githubusercontent.com/coreos/fedora-coreos-config/refs/heads/stable/overlay.d/05core/usr/lib/systemd/system-generators/coreos-sulogin-force-generator" --retry 3 -Lo /usr/lib/systemd/system-generators/coreos-sulogin-force-generator +chmod +x /usr/lib/systemd/system-generators/coreos-sulogin-force-generator + # Starship Shell Prompt ghcurl "https://github.com/starship/starship/releases/latest/download/starship-x86_64-unknown-linux-gnu.tar.gz" --retry 3 -o /tmp/starship.tar.gz tar -xzf /tmp/starship.tar.gz -C /tmp install -c -m 0755 /tmp/starship /usr/bin -# Required for bluefin faces to work without conflicting with a ton of packages -rm -f /usr/share/pixmaps/faces/* || echo "Expected directory deletion to fail" -mv /usr/share/pixmaps/faces/bluefin/* /usr/share/pixmaps/faces -rm -rf /usr/share/pixmaps/faces/bluefin - -# Remove desktop entries -if [[ -f /usr/share/applications/gnome-system-monitor.desktop ]]; then - sed -i 's@\[Desktop Entry\]@\[Desktop Entry\]\nHidden=true@g' /usr/share/applications/gnome-system-monitor.desktop -fi -if [[ -f /usr/share/applications/org.gnome.SystemMonitor.desktop ]]; then - sed -i 's@\[Desktop Entry\]@\[Desktop Entry\]\nHidden=true@g' /usr/share/applications/org.gnome.SystemMonitor.desktop -fi +# Configure firewalld with Fedora Workstation defaults +# https://src.fedoraproject.org/rpms/firewalld/blob/rawhide/f/firewalld.spec +ghcurl "https://src.fedoraproject.org/rpms/firewalld/raw/rawhide/f/FedoraWorkstation.xml" --retry 3 -Lo /usr/lib/firewalld/zones/FedoraWorkstation.xml +grep -F -e '' /usr/lib/firewalld/zones/FedoraWorkstation.xml +sed -i 's|^DefaultZone=.*|DefaultZone=FedoraWorkstation|g' /etc/firewalld/firewalld.conf +sed -i 's|^IPv6_rpfilter=.*|IPv6_rpfilter=loose|g' /etc/firewalld/firewalld.conf # Add Mutter experimental-features if [[ "${IMAGE_NAME}" =~ nvidia ]]; then @@ -40,4 +50,7 @@ if [[ "${IMAGE_NAME}" =~ nvidia ]]; then glib-compile-schemas /usr/share/glib-2.0/schemas fi +# Rebuild gdk-pixbuf loader cache so all installed loaders are registered +gdk-pixbuf-query-loaders-64 --update-cache + echo "::endgroup::" diff --git a/build_files/base/17-cleanup.sh b/build_files/base/17-cleanup.sh index 45e4178a..b35a026d 100755 --- a/build_files/base/17-cleanup.sh +++ b/build_files/base/17-cleanup.sh @@ -39,7 +39,7 @@ systemctl disable flatpak-add-fedora-repos.service # We only need to clean up repos that were enabled during the build process. # Disable third-party repos -for repo in negativo17-fedora-multimedia tailscale fedora-cisco-openh264; do +for repo in fedora-multimedia tailscale fedora-cisco-openh264; do if [[ -f "/etc/yum.repos.d/${repo}.repo" ]]; then sed -i 's@enabled=1@enabled=0@g' "/etc/yum.repos.d/${repo}.repo" fi @@ -52,11 +52,6 @@ for i in /etc/yum.repos.d/_copr:*.repo; do fi done -# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -if [[ -f "/etc/yum.repos.d/_copr_ublue-os-akmods.repo" ]]; then - sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo -fi - # Disable RPM Fusion repos for i in /etc/yum.repos.d/rpmfusion-*.repo; do if [[ -f "$i" ]]; then diff --git a/build_files/base/20-tests.sh b/build_files/base/20-tests.sh index 3110d4c4..2b9b6a66 100755 --- a/build_files/base/20-tests.sh +++ b/build_files/base/20-tests.sh @@ -51,10 +51,29 @@ for package in "${IMPORTANT_PACKAGES[@]}"; do rpm -q "${package}" >/dev/null || { echo "Missing package: ${package}... Exiting"; exit 1 ; } done +# these should be sourced from negativo's fedora-multimedia repo +# as Fedora can't ship patent encumbered video codecs +NEGATIVO=( + ffmpeg + libheif + libva + mesa-filesystem + mesa-va-drivers + pipewire-libs-extra + x264-libs + x265-libs +) + +for package in "${NEGATIVO[@]}"; do + rpm -q --qf "%{NAME} %{VENDOR}" "${package}" | grep -q "negativo17\.org" || { echo "${package} not from negativo... Exiting"; exit 1 ; } +done + # these packages are supposed to be removed # and are considered footguns UNWANTED_PACKAGES=( + fedora-flathub-remote fedora-logos + fedora-third-party firefox gnome-software gnome-software-rpm-ostree diff --git a/build_files/dx/00-dx.sh b/build_files/dx/00-dx.sh index 9ef4068a..7b0e3f3b 100755 --- a/build_files/dx/00-dx.sh +++ b/build_files/dx/00-dx.sh @@ -126,8 +126,7 @@ systemctl enable bluefin-dx-groups.service sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo -# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo +sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr:copr.fedorainfracloud.org:ublue-os:akmods.repo # Disable RPM Fusion repos for i in /etc/yum.repos.d/rpmfusion-*.repo; do diff --git a/build_files/shared/build.sh b/build_files/shared/build.sh index 5ed24b81..c328f957 100755 --- a/build_files/shared/build.sh +++ b/build_files/shared/build.sh @@ -7,9 +7,6 @@ echo "::group:: Copy Files" # Speeds up local builds dnf config-manager setopt keepcache=1 -# We need to remove this package here because lots of files we add from `projectbluefin/common` override the rpm files and they also go away when you do `dnf remove` -dnf remove -y ublue-os-luks ublue-os-just ublue-os-udev-rules ublue-os-signing ublue-os-update-services - # Keep *-logos in RPM DB for downstream package installations # We are not allowed to ship an empty fedora-logos package dnf -y swap fedora-logos generic-logos @@ -27,11 +24,11 @@ echo "::endgroup::" # Generate image-info.json /ctx/build_files/base/00-image-info.sh -# Install Kernel and Akmods -/ctx/build_files/base/03-install-kernel-akmods.sh - # Install Additional Packages -/ctx/build_files/base/04-packages.sh +/ctx/build_files/base/03-packages.sh + +# Install Kernel and Akmods +/ctx/build_files/base/04-install-kernel-akmods.sh # Install Overrides and Fetch Install /ctx/build_files/base/05-override-install.sh diff --git a/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf b/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf new file mode 100644 index 00000000..b1683a8e --- /dev/null +++ b/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf @@ -0,0 +1,4 @@ +# Changing ID from `fedora` to anything thats not fedora/centos/rhel breaks the COPR plugin +# It'll try to load repositories for `bluefin-43` and fail +[main] +distribution = fedora From 0c6fa7510733fbaba402d4ee9980af9200c7690e Mon Sep 17 00:00:00 2001 From: "Jorge O. Castro" Date: Sat, 30 May 2026 17:52:03 -0400 Subject: [PATCH 2/4] fix(build): remove mesa-va-drivers from negativo versionlock and test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit mesa-va-drivers does not exist as a separate package in the negativo17 F44 repo — confirmed by versionlock emitting 'No package found' and 20-tests.sh failing with 'mesa-va-drivers not from negativo'. The VA-API drivers are provided through mesa-dri-drivers in the negativo17 fedora-multimedia repo. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI --- build_files/base/03-packages.sh | 1 - build_files/base/20-tests.sh | 1 - 2 files changed, 2 deletions(-) diff --git a/build_files/base/03-packages.sh b/build_files/base/03-packages.sh index e7af164f..10cbfab7 100755 --- a/build_files/base/03-packages.sh +++ b/build_files/base/03-packages.sh @@ -36,7 +36,6 @@ OVERRIDES=( "mesa-libEGL" "mesa-libGL" "mesa-libgbm" - "mesa-va-drivers" "mesa-vulkan-drivers" ) diff --git a/build_files/base/20-tests.sh b/build_files/base/20-tests.sh index 2b9b6a66..7c9461ed 100755 --- a/build_files/base/20-tests.sh +++ b/build_files/base/20-tests.sh @@ -58,7 +58,6 @@ NEGATIVO=( libheif libva mesa-filesystem - mesa-va-drivers pipewire-libs-extra x264-libs x265-libs From 2d8a6f44c6ae03cac3a400bd12748c6b237451a6 Mon Sep 17 00:00:00 2001 From: "Jorge O. Castro" Date: Sat, 30 May 2026 18:18:22 -0400 Subject: [PATCH 3/4] fix(ci): fix all pre-commit actionlint and shellcheck issues - Update actionlint from v1.7.7 to v1.7.12 (adds artifact-metadata and models permission scopes) - Quote all $GITHUB_ENV, $GITHUB_OUTPUT, $GITHUB_STEP_SUMMARY redirects in reusable-build.yml - Quote all $(command -v just) command substitutions (SC2046) - Convert consecutive >> redirects to grouped { } >> form (SC2129) - Add # shellcheck disable=SC2086 where word-splitting is intentional (for tag loop over alias_tags) - Fix matrix.stream_name reference in check job name (not a matrix job) - Remove build-image-beta.yml reference from build-images.yml (file does not exist) - Quote SC2086 variables in validate-renovate.yml and generate-release.yml - Fix e2e-dispatch.yml SC2129 consecutive redirects Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI --- .github/workflows/build-images.yml | 3 -- .github/workflows/e2e-dispatch.yml | 8 +-- .github/workflows/generate-release.yml | 6 ++- .github/workflows/reusable-build.yml | 66 +++++++++++++------------ .github/workflows/validate-renovate.yml | 2 +- .pre-commit-config.yaml | 2 +- 6 files changed, 46 insertions(+), 41 deletions(-) diff --git a/.github/workflows/build-images.yml b/.github/workflows/build-images.yml index 14508605..dcb04c05 100644 --- a/.github/workflows/build-images.yml +++ b/.github/workflows/build-images.yml @@ -16,6 +16,3 @@ jobs: build-image-latest-main: uses: ./.github/workflows/build-image-latest-main.yml secrets: inherit - build-image-beta: - uses: ./.github/workflows/build-image-beta.yml - secrets: inherit diff --git a/.github/workflows/e2e-dispatch.yml b/.github/workflows/e2e-dispatch.yml index 61127643..3c928887 100644 --- a/.github/workflows/e2e-dispatch.yml +++ b/.github/workflows/e2e-dispatch.yml @@ -71,9 +71,11 @@ jobs: SHA=$(echo "$PR_DATA" | jq -r '.sha') BRANCH=$(echo "$PR_DATA" | jq -r '.branch') SHORT_SHA="${SHA:0:7}" - echo "sha=${SHA}" >> "$GITHUB_OUTPUT" - echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT" - echo "branch=${BRANCH}" >> "$GITHUB_OUTPUT" + { + echo "sha=${SHA}" + echo "short_sha=${SHORT_SHA}" + echo "branch=${BRANCH}" + } >> "$GITHUB_OUTPUT" - name: Trigger PR build if: steps.permission.outputs.authorized == 'true' diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml index 15ce5d6c..2123e303 100644 --- a/.github/workflows/generate-release.yml +++ b/.github/workflows/generate-release.yml @@ -55,8 +55,10 @@ jobs: run: | just changelogs "${{ matrix.version }}" "${{ inputs.handwritten }}" source ./output.env - echo "title=${TITLE}" >> $GITHUB_OUTPUT - echo "tag=${TAG}" >> $GITHUB_OUTPUT + { + echo "title=${TITLE}" + echo "tag=${TAG}" + } >> "$GITHUB_OUTPUT" - name: Download SBOM release assets if: contains(fromJson('["stable"]'), matrix.version) && (github.event.schedule == '0 1 * * TUE' || contains(fromJson('["workflow_dispatch", "workflow_call"]'), github.event_name)) diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 7ac99391..795c851c 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -12,7 +12,6 @@ on: type: string brand_name: description: "The Brand Name: bluefin" - required: true default: bluefin type: string stream_name: @@ -84,7 +83,7 @@ jobs: shell: bash run: | IMAGE_NAME="$(just image_name ${{ matrix.base_name }} ${{ matrix.stream_name }} ${{ matrix.image_flavor }})" - echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV + echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV" - name: Default Tag shell: bash @@ -93,7 +92,7 @@ jobs: ${{ matrix.stream_name }} \ "1")" echo "Default Tag: ${DEFAULT_TAG}" - echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV + echo "DEFAULT_TAG=${DEFAULT_TAG}" >> "$GITHUB_ENV" - name: DNF Package Cache Setup shell: bash @@ -128,7 +127,7 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | - sudo -E $(command -v just) repo_organization="${{ github.repository_owner }}" \ + sudo -E "$(command -v just)" repo_organization="${{ github.repository_owner }}" \ build-ghcr "${{ matrix.base_name }}" \ "${{ matrix.stream_name }}" \ "${{ matrix.image_flavor }}" \ @@ -166,7 +165,7 @@ jobs: MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }} SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }} run: | - sudo -E $(command -v just) gen-sbom "${MATRIX_BASE_NAME}" \ + sudo -E "$(command -v just)" gen-sbom "${MATRIX_BASE_NAME}" \ "${MATRIX_STREAM_NAME}" \ "${MATRIX_IMAGE_FLAVOR}" \ "${SYFT_CMD}" @@ -177,7 +176,7 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | - sudo -E $(command -v just) rechunk "${{ matrix.base_name }}" \ + sudo -E "$(command -v just)" rechunk "${{ matrix.base_name }}" \ "${{ matrix.stream_name }}" \ "${{ matrix.image_flavor }}" \ "1" @@ -186,7 +185,7 @@ jobs: id: load-rechunk shell: bash run: | - sudo -E $(command -v just) load-rechunk "${{ matrix.base_name }}" \ + sudo -E "$(command -v just)" load-rechunk "${{ matrix.base_name }}" \ "${{ env.DEFAULT_TAG }}" \ "${{ matrix.image_flavor }}" @@ -194,7 +193,7 @@ jobs: id: secureboot shell: bash run: | - sudo -E $(command -v just) secureboot "${{ matrix.base_name }}" \ + sudo -E "$(command -v just)" secureboot "${{ matrix.base_name }}" \ "${{ env.DEFAULT_TAG }}" \ "${{ matrix.image_flavor }}" @@ -214,14 +213,14 @@ jobs: echo "Tags for this Action..." echo "$alias_tags" - echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT + echo "alias_tags=${alias_tags}" >> "$GITHUB_OUTPUT" # Tag Images - name: Tag Images shell: bash run: | set -eoux pipefail - sudo -E $(command -v just) tag-images "${{ env.IMAGE_NAME }}" \ + sudo -E "$(command -v just)" tag-images "${{ env.IMAGE_NAME }}" \ "${{ env.DEFAULT_TAG }}" \ "${{ steps.generate-tags.outputs.alias_tags }}" @@ -251,6 +250,7 @@ jobs: set -euox pipefail rm -f "${{ env.DIGEST_FILE }}" + # shellcheck disable=SC2086 - word splitting on alias_tags is intentional for tag in ${{ steps.generate-tags.outputs.alias_tags }}; do dest=${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}:${tag} if [[ "${tag}" == "${{ env.DEFAULT_TAG }}" ]]; then @@ -272,16 +272,18 @@ jobs: - name: PR Testing Instructions if: github.event_name == 'pull_request' run: | - echo "### 🫐 Test this PR build" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "Download the \`.oci\` artifact, unzip it, then:" >> $GITHUB_STEP_SUMMARY - echo '```bash' >> $GITHUB_STEP_SUMMARY - echo "sudo bootc switch --transport oci /absolute/path/to/${{ env.IMAGE_NAME }}_build" >> $GITHUB_STEP_SUMMARY - echo '```' >> $GITHUB_STEP_SUMMARY - echo "To go back:" >> $GITHUB_STEP_SUMMARY - echo '```bash' >> $GITHUB_STEP_SUMMARY - echo "sudo bootc switch --enforce-container-sigpolicy ghcr.io/projectbluefin/${{ env.IMAGE_NAME }}" >> $GITHUB_STEP_SUMMARY - echo '```' >> $GITHUB_STEP_SUMMARY + { + echo "### 🫐 Test this PR build" + echo "" + echo "Download the \`.oci\` artifact, unzip it, then:" + echo '```bash' + echo "sudo bootc switch --transport oci /absolute/path/to/${{ env.IMAGE_NAME }}_build" + echo '```' + echo "To go back:" + echo '```bash' + echo "sudo bootc switch --enforce-container-sigpolicy ghcr.io/projectbluefin/${{ env.IMAGE_NAME }}" + echo '```' + } >> "$GITHUB_STEP_SUMMARY" - name: Export digest id: digest @@ -315,7 +317,7 @@ jobs: - name: Sign container image if: github.event_name != 'pull_request' run: | - cosign sign -y ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS} + cosign sign -y "${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}" env: TAGS: ${{ steps.digest.outputs.digest }} @@ -341,13 +343,13 @@ jobs: cd "$(dirname "${SBOM}")" oras attach \ --artifact-type application/vnd.spdx+json \ - --annotation filename=$(basename "$SBOM") \ + --annotation "filename=$(basename "$SBOM")" \ "${IMAGE}@${DIGEST}" \ - "$(basename ${SBOM})" + "$(basename "$SBOM")" sbom_digest=$(oras discover --format json "${IMAGE}@${DIGEST}" | jq -r '.referrers[] | select(.artifactType == "application/vnd.spdx+json") | .digest') - echo "sbom_digest=${sbom_digest}" >> $GITHUB_OUTPUT + echo "sbom_digest=${sbom_digest}" >> "$GITHUB_OUTPUT" - name: Sign SBOM OCI Artifact if: github.event_name != 'pull_request' @@ -356,7 +358,7 @@ jobs: IMAGE_NAME: ${{ env.IMAGE_NAME }} SBOM_DIGEST: ${{ steps.upload-sbom.outputs.sbom_digest }} run: | - cosign sign -y ${LOWERCASE}/${IMAGE_NAME}@${SBOM_DIGEST} + cosign sign -y "${LOWERCASE}/${IMAGE_NAME}@${SBOM_DIGEST}" - name: Attestation if: github.event_name != 'pull_request' @@ -367,7 +369,7 @@ jobs: push-to-registry: true check: - name: Check all ${{ matrix.stream_name }} builds successful + name: Check all ${{ inputs.stream_name }} builds successful if: always() runs-on: ubuntu-latest needs: [build_container] @@ -377,9 +379,9 @@ jobs: JOBS: ${{ toJson(needs) }} run: | echo "Job status:" - echo $JOBS | jq -r 'to_entries[] | " - \(.key): \(.value.result)"' + echo "$JOBS" | jq -r 'to_entries[] | " - \(.key): \(.value.result)"' - for i in $(echo $JOBS | jq -r 'to_entries[] | .value.result'); do + for i in $(echo "$JOBS" | jq -r 'to_entries[] | .value.result'); do if [ "$i" != "success" ] && [ "$i" != "skipped" ]; then echo "" echo "Status check not okay!" @@ -407,9 +409,11 @@ jobs: id: merge run: | DIGESTS=$(cat /tmp/digests/*.txt | jq -Rs 'split("\n") | map(select(length > 0)) | map(split("=")) | map({(.[0]): .[1]}) | add') - echo "digests<> "$GITHUB_OUTPUT" - echo "${DIGESTS}" >> "$GITHUB_OUTPUT" - echo "EOF" >> "$GITHUB_OUTPUT" + { + echo "digests<> "$GITHUB_OUTPUT" - name: Set empty digests if: github.event_name == 'pull_request' diff --git a/.github/workflows/validate-renovate.yml b/.github/workflows/validate-renovate.yml index 6056b3fe..dbb90b61 100644 --- a/.github/workflows/validate-renovate.yml +++ b/.github/workflows/validate-renovate.yml @@ -28,7 +28,7 @@ jobs: shell: bash env: RENOVATE_VERSION: latest - run: npm install -g renovate@${RENOVATE_VERSION} + run: npm install -g "renovate@${RENOVATE_VERSION}" - name: Validate Renovate config shell: bash diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index bf99b1c0..1fd5a828 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -14,6 +14,6 @@ repos: - id: detect-private-key - id: check-added-large-files - repo: https://github.com/rhysd/actionlint - rev: v1.7.7 + rev: v1.7.12 hooks: - id: actionlint From e7f63cc70818072f20bb3219b521f8bf6b9f27b8 Mon Sep 17 00:00:00 2001 From: "Jorge O. Castro" Date: Sat, 30 May 2026 18:38:50 -0400 Subject: [PATCH 4/4] fix(renovate): rename baseBranches to baseBranchPatterns MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit baseBranches is deprecated in Renovate — renovate-config-validator --strict fails when the deprecated key is present. Rename to the current baseBranchPatterns key. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI --- .github/renovate.json5 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index f559182c..a75af917 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -3,7 +3,7 @@ "extends": [ "config:best-practices", ], - "baseBranches": ["main"], + "baseBranchPatterns": ["main"], "git-submodules": { "enabled": true