feat: move base image to quay.io/fedora-ostree-desktops/silverblue by castrojo · Pull Request #17 · projectbluefin/bluefin

castrojo · 2026-05-30T21:16:43Z

Summary

Drop ghcr.io/ublue-os/silverblue-main in favor of the upstream Fedora image directly from quay.io/fedora-ostree-desktops/silverblue. This removes the ublue-os/main dependency and unblocks ARM support.

Ported from upstream: ublue-os/bluefin#4030

Changes

Containerfile: Base image → quay.io/fedora-ostree-desktops/silverblue, bump to F43
Justfile: Remove base_image_name local variable, update cosign verification to use Fedora's public key
renovate.json5: Track new image, disable major version bumps
Build script order: packages (03) now runs before kernel (04) — required so negativo17 mesa overrides land before akmods
03-packages.sh (was 04): Add negativo17 fedora-multimedia repo + mesa overrides, multimedia codecs (ffmpeg/libfdk-aac/etc.), and packages previously in ublue-os/main (alsa-firmware, noto fonts, htop, nvtop, pam-u2f/yubico, smartmontools, vim, etc.)
04-install-kernel-akmods.sh (was 03): Use dnf copr enable/disable instead of sed-hacking the old-style repo file
05-override-install.sh: Add ublue-os/main features (rm chsh footgun, sudoers brew path, noto-cjk symlink, coreos-sulogin-force-generator). Remove faces/desktop-entry workarounds
17-cleanup.sh: Rename repo to fedora-multimedia, remove old COPR akmods sed workaround
20-tests.sh: Verify negativo packages, expand unwanted package list
dx/00-dx.sh: Update COPR repo filename to standard dnf copr naming
copr.vendor.conf (new): Keep COPR plugin using fedora distribution ID

Test plan

CI will build and validate. This is a significant base image change — watch for package availability differences between F42→F43 and between silverblue-main and the upstream Fedora image.

Drop ghcr.io/ublue-os/silverblue-main in favor of the upstream Fedora image directly from quay.io/fedora-ostree-desktops/silverblue. This removes the ublue-os/main dependency and unblocks ARM support. - Update Containerfile base image and bump to F43 - Update Justfile build recipe: remove base_image_name variable, update cosign verification to use Fedora's public key - Update renovate.json5 to track new image, disable major version bumps - Rename/reorder build scripts: packages (03) before kernel (04) - Add negativo17 fedora-multimedia repo + mesa overrides in 03-packages.sh - Add multimedia codecs (ffmpeg, libfdk-aac, etc.) from negativo17 - Add packages previously provided by ublue-os/main: alsa-firmware, flatpak-spawn, noto fonts, grub2-tools-extra, htop, nvtop, pam-u2f/yubico, smartmontools, vim, and more - Remove packages now in base or no longer needed: bash-color-prompt, bootc, hplip, mesa-libGLU, printer-driver-brlaser, pulseaudio-utils, switcheroo-control, usbmuxd, wireguard-tools, wl-clipboard - Add ublue-os/main features to 05-override-install.sh: rm chsh/lchsh footgun, sudoers brew path, noto-cjk symlink, coreos-sulogin-force-generator - Remove faces/desktop-entry workarounds (no longer needed) - Update kernel COPR handling: use dnf copr enable/disable - Add copr.vendor.conf to keep COPR plugin using 'fedora' distribution ID - Update 20-tests.sh: verify negativo packages and expand unwanted list Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Assisted-by: Claude Sonnet 4.6 via GitHub Copilot

mesa-va-drivers does not exist as a separate package in the negativo17 F44 repo — confirmed by versionlock emitting 'No package found' and 20-tests.sh failing with 'mesa-va-drivers not from negativo'. The VA-API drivers are provided through mesa-dri-drivers in the negativo17 fedora-multimedia repo. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI

- Update actionlint from v1.7.7 to v1.7.12 (adds artifact-metadata and models permission scopes) - Quote all $GITHUB_ENV, $GITHUB_OUTPUT, $GITHUB_STEP_SUMMARY redirects in reusable-build.yml - Quote all $(command -v just) command substitutions (SC2046) - Convert consecutive >> redirects to grouped { } >> form (SC2129) - Add # shellcheck disable=SC2086 where word-splitting is intentional (for tag loop over alias_tags) - Fix matrix.stream_name reference in check job name (not a matrix job) - Remove build-image-beta.yml reference from build-images.yml (file does not exist) - Quote SC2086 variables in validate-renovate.yml and generate-release.yml - Fix e2e-dispatch.yml SC2129 consecutive redirects Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI

baseBranches is deprecated in Renovate — renovate-config-validator --strict fails when the deprecated key is present. Rename to the current baseBranchPatterns key. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI

PR #17 moved the base image from ghcr.io/ublue-os/silverblue-main to quay.io/fedora-ostree-desktops/silverblue. The Justfile only reads 'common' and 'brew' entries from image-versions.yml, so the silverblue-main entry is dead config that may cause unnecessary Renovate PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

) * fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration (#18) When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk) to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci), the first boot fails with a black screen. Root cause: legacy-rechunk's 1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles, but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow from /etc/group, causing systemd-sysusers to fail on first boot: systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists. The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that rebuilds /etc/gshadow from /etc/group on every boot. The service is idempotent and harmless once gshadow is clean. Files added (verbatim from Aurora): - system_files/shared/usr/bin/rechunker-group-fix - system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service Service enabled in build_files/base/17-cleanup.sh. Without this fix, the first boot into projectbluefin/bluefin after switching from ublue-os/bluefin WILL produce a black screen. Second boot of the same image succeeds, but users will think the image is broken. Fixes: ublue-os/bluefin#3852 See also: - ublue-os/bluefin-lts#918 (renner0e test report) - bootc-dev/bootc#1179 - ublue-os/aurora#1468 - https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47 Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): update projectbluefin/testsuite digest to 12bd892 (#15) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * chore(deps): update system_files/shared/usr/share/gnome-shell/extensions/blur-my-shell@aunetx digest to fcd5d02 (#16) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * fix(ci): add packages:write to e2e reusable workflow callers The e2e.yml reusable workflow in projectbluefin/testsuite requires packages:write permission to push screenshots to GHCR. Without it, jobs fail with startup_failure before any steps run. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk) to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci), the first boot fails with a black screen. Root cause: legacy-rechunk's 1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles, but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow from /etc/group, causing systemd-sysusers to fail on first boot: systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists. The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that rebuilds /etc/gshadow from /etc/group on every boot. The service is idempotent and harmless once gshadow is clean. Files added (verbatim from Aurora): - system_files/shared/usr/bin/rechunker-group-fix - system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service Service enabled in build_files/base/17-cleanup.sh. Without this fix, the first boot into projectbluefin/bluefin after switching from ublue-os/bluefin WILL produce a black screen. Second boot of the same image succeeds, but users will think the image is broken. Fixes: ublue-os/bluefin#3852 See also: - ublue-os/bluefin-lts#918 (renner0e test report) - bootc-dev/bootc#1179 - ublue-os/aurora#1468 - https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47 Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update hardcoded testing branch references to main projectbluefin/bluefin uses main as default branch, not testing. Update build trigger, post-e2e filter, and weekly promotion workflow to reference main instead of the ublue-os/bluefin testing branch. Assisted-by: Claude via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): add packages:write to weekly-promotion e2e job The reusable testsuite e2e.yml requires packages:write to push screenshots to GHCR. Without it the job fails with startup_failure. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): pin quay.io/fedora-ostree-desktops/silverblue docker tag to d0ba53e (#22) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * chore(deps): update ghcr.io/projectbluefin/common:latest docker digest to a5e120b (#23) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * fix: resolve shellcheck warnings in rechunker-group-fix script (#25) Rewrite the /etc/gshadow sync loop to use while-read instead of for-in-cat (SC2013), properly quote variables (SC2086), and use printf instead of echo with unquoted command substitution (SC2046). Functionally identical — group names cannot contain spaces or glob characters, but the rewrite is safer and passes shellcheck cleanly. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: remove stale silverblue-main entry from image-versions.yml (#26) PR #17 moved the base image from ghcr.io/ublue-os/silverblue-main to quay.io/fedora-ostree-desktops/silverblue. The Justfile only reads 'common' and 'brew' entries from image-versions.yml, so the silverblue-main entry is dead config that may cause unnecessary Renovate PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: correct IMAGE_VENDOR default from ublue-os to projectbluefin (#27) The Containerfile ARG default for IMAGE_VENDOR was still set to 'ublue-os' from the upstream fork. The Justfile correctly overrides it to 'projectbluefin' via repo_organization, but a bare build without Just would produce images with the wrong vendor label and ostree ref: ghcr.io/ublue-os/bluefin (wrong) ghcr.io/projectbluefin/bluefin (correct) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update stale ublue-os org references to projectbluefin (#28) Update OCI labels and admin recipe that still pointed to the old upstream ublue-os/bluefin repository: - io.artifacthub.package.readme-url: ublue-os → projectbluefin - org.opencontainers.image.source: ublue-os → projectbluefin - retag-nvidia-on-ghcr recipe: copies from/to projectbluefin GHCR instead of ublue-os Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update CONTRIBUTING.md for main-branch workflow (#29) Replace all references to 'testing' branch with 'main' to reflect the projectbluefin/bluefin repo structure where PRs target main. Also update the promotion section to document the weekly automated promotion via weekly-testing-promotion.yml instead of the old pull-bot model. Stream reference table updated: latest builds from 'latest' branch, testing stream builds from 'main' branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update offline docs PDF URL to projectbluefin/documentation (#30) Update the bundled Bluefin documentation URL from the old ublue-os/bluefin-docs repo (now redirects) to the canonical projectbluefin/documentation location. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update LTS variant link to projectbluefin/bluefin-lts (#31) The LTS variant has moved to the projectbluefin GitHub org. Update the Copilot instructions to reference the correct location. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update README badges and links to projectbluefin org (#33) - OpenSSF Scorecard badge: ublue-os → projectbluefin - GitHub Actions CI badges: ublue-os → projectbluefin - User count badge link target: ublue-os → projectbluefin - DeepWiki link: ublue-os/bluefin-docs → projectbluefin/bluefin - Remove stale Codacy badge (not configured for projectbluefin) Star history, LFX, and ossinsight charts retained as-is (historical data from the original ublue-os/bluefin repo). Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update ublue-os org references in changelogs.py to projectbluefin (#32) Update the changelog generation script to reference the correct org: - REGISTRY: ghcr.io/ublue-os → ghcr.io/projectbluefin - Commit URL: github.com/ublue-os/bluefin → github.com/projectbluefin/bluefin - bootc switch commands: ghcr.io/ublue-os → ghcr.io/projectbluefin The image-info.json path (/usr/share/ublue-os/...) is a filesystem standard and intentionally kept as ublue-os. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: correct stale refs in github config files (#34) - ISSUE_TEMPLATE/config.yml: CONTRIBUTING.md URL pointed to blob/testing, now blob/main - copilot-setup-steps.yml: paths filter referenced non-existent workflows/ path, now correct Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update testsuite pin to include boot.1.1 ostree fix (#35) The pinned commit (12bd892e) predates the canonical boot.N symlink fix (7bcdf965) needed for Fedora 44 bootc images. The ostree-system-generator only accepts /ostree/boot.[01]/... paths; bootc 1.1.x installs deployments under boot.1.1 (versioned), causing the generator to fail → dbus-broker cascade failure → SSH never comes up. Updated to 97be5c76 (latest main) which includes all fixes. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update testsuite pin to include summary error_message fix Pins to e4dd0345 which fixes AttributeError when behave emits error_message as a list (multi-line step errors). Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to 74c86f1a (GNOME 50 smoke compat fixes) Pin projectbluefin/testsuite to 74c86f1a967f51cb0c7adf3732036ae2f7b89b4c which includes PR #138 — fixes all 17 failing e2e smoke scenarios: - conditional open() for Quick Settings / Date Menu panels - qecore key mapping patch (leftctrl/leftalt/leftshift) - multi-method app launch (gtk-launch / gio launch .desktop) - notification banner regex for GNOME 50 double-quoted results - TEXT_ROLES expansion for libadwaita 1.9 AT-SPI changes - DND gsettings fallback when Shell toggle is absent - bootloader-update.service in IGNORED_FAILED_UNITS_IN_VM - extensions window wait increased to 20s - Wi-Fi scenario skip when no wireless interface present Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com>

…er digest to c9d2f9f (#48) * fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration (#18) When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk) to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci), the first boot fails with a black screen. Root cause: legacy-rechunk's 1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles, but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow from /etc/group, causing systemd-sysusers to fail on first boot: systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists. The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that rebuilds /etc/gshadow from /etc/group on every boot. The service is idempotent and harmless once gshadow is clean. Files added (verbatim from Aurora): - system_files/shared/usr/bin/rechunker-group-fix - system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service Service enabled in build_files/base/17-cleanup.sh. Without this fix, the first boot into projectbluefin/bluefin after switching from ublue-os/bluefin WILL produce a black screen. Second boot of the same image succeeds, but users will think the image is broken. Fixes: ublue-os/bluefin#3852 See also: - ublue-os/bluefin-lts#918 (renner0e test report) - bootc-dev/bootc#1179 - ublue-os/aurora#1468 - https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47 Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): update projectbluefin/testsuite digest to 12bd892 (#15) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * chore(deps): update system_files/shared/usr/share/gnome-shell/extensions/blur-my-shell@aunetx digest to fcd5d02 (#16) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * fix(ci): add packages:write to e2e reusable workflow callers The e2e.yml reusable workflow in projectbluefin/testsuite requires packages:write permission to push screenshots to GHCR. Without it, jobs fail with startup_failure before any steps run. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk) to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci), the first boot fails with a black screen. Root cause: legacy-rechunk's 1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles, but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow from /etc/group, causing systemd-sysusers to fail on first boot: systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists. The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that rebuilds /etc/gshadow from /etc/group on every boot. The service is idempotent and harmless once gshadow is clean. Files added (verbatim from Aurora): - system_files/shared/usr/bin/rechunker-group-fix - system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service Service enabled in build_files/base/17-cleanup.sh. Without this fix, the first boot into projectbluefin/bluefin after switching from ublue-os/bluefin WILL produce a black screen. Second boot of the same image succeeds, but users will think the image is broken. Fixes: ublue-os/bluefin#3852 See also: - ublue-os/bluefin-lts#918 (renner0e test report) - bootc-dev/bootc#1179 - ublue-os/aurora#1468 - https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47 Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update hardcoded testing branch references to main projectbluefin/bluefin uses main as default branch, not testing. Update build trigger, post-e2e filter, and weekly promotion workflow to reference main instead of the ublue-os/bluefin testing branch. Assisted-by: Claude via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): add packages:write to weekly-promotion e2e job The reusable testsuite e2e.yml requires packages:write to push screenshots to GHCR. Without it the job fails with startup_failure. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): pin quay.io/fedora-ostree-desktops/silverblue docker tag to d0ba53e (#22) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * chore(deps): update ghcr.io/projectbluefin/common:latest docker digest to a5e120b (#23) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * fix: resolve shellcheck warnings in rechunker-group-fix script (#25) Rewrite the /etc/gshadow sync loop to use while-read instead of for-in-cat (SC2013), properly quote variables (SC2086), and use printf instead of echo with unquoted command substitution (SC2046). Functionally identical — group names cannot contain spaces or glob characters, but the rewrite is safer and passes shellcheck cleanly. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: remove stale silverblue-main entry from image-versions.yml (#26) PR #17 moved the base image from ghcr.io/ublue-os/silverblue-main to quay.io/fedora-ostree-desktops/silverblue. The Justfile only reads 'common' and 'brew' entries from image-versions.yml, so the silverblue-main entry is dead config that may cause unnecessary Renovate PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: correct IMAGE_VENDOR default from ublue-os to projectbluefin (#27) The Containerfile ARG default for IMAGE_VENDOR was still set to 'ublue-os' from the upstream fork. The Justfile correctly overrides it to 'projectbluefin' via repo_organization, but a bare build without Just would produce images with the wrong vendor label and ostree ref: ghcr.io/ublue-os/bluefin (wrong) ghcr.io/projectbluefin/bluefin (correct) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update stale ublue-os org references to projectbluefin (#28) Update OCI labels and admin recipe that still pointed to the old upstream ublue-os/bluefin repository: - io.artifacthub.package.readme-url: ublue-os → projectbluefin - org.opencontainers.image.source: ublue-os → projectbluefin - retag-nvidia-on-ghcr recipe: copies from/to projectbluefin GHCR instead of ublue-os Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update CONTRIBUTING.md for main-branch workflow (#29) Replace all references to 'testing' branch with 'main' to reflect the projectbluefin/bluefin repo structure where PRs target main. Also update the promotion section to document the weekly automated promotion via weekly-testing-promotion.yml instead of the old pull-bot model. Stream reference table updated: latest builds from 'latest' branch, testing stream builds from 'main' branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update offline docs PDF URL to projectbluefin/documentation (#30) Update the bundled Bluefin documentation URL from the old ublue-os/bluefin-docs repo (now redirects) to the canonical projectbluefin/documentation location. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update LTS variant link to projectbluefin/bluefin-lts (#31) The LTS variant has moved to the projectbluefin GitHub org. Update the Copilot instructions to reference the correct location. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update README badges and links to projectbluefin org (#33) - OpenSSF Scorecard badge: ublue-os → projectbluefin - GitHub Actions CI badges: ublue-os → projectbluefin - User count badge link target: ublue-os → projectbluefin - DeepWiki link: ublue-os/bluefin-docs → projectbluefin/bluefin - Remove stale Codacy badge (not configured for projectbluefin) Star history, LFX, and ossinsight charts retained as-is (historical data from the original ublue-os/bluefin repo). Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update ublue-os org references in changelogs.py to projectbluefin (#32) Update the changelog generation script to reference the correct org: - REGISTRY: ghcr.io/ublue-os → ghcr.io/projectbluefin - Commit URL: github.com/ublue-os/bluefin → github.com/projectbluefin/bluefin - bootc switch commands: ghcr.io/ublue-os → ghcr.io/projectbluefin The image-info.json path (/usr/share/ublue-os/...) is a filesystem standard and intentionally kept as ublue-os. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: correct stale refs in github config files (#34) - ISSUE_TEMPLATE/config.yml: CONTRIBUTING.md URL pointed to blob/testing, now blob/main - copilot-setup-steps.yml: paths filter referenced non-existent workflows/ path, now correct Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update testsuite pin to include boot.1.1 ostree fix (#35) The pinned commit (12bd892e) predates the canonical boot.N symlink fix (7bcdf965) needed for Fedora 44 bootc images. The ostree-system-generator only accepts /ostree/boot.[01]/... paths; bootc 1.1.x installs deployments under boot.1.1 (versioned), causing the generator to fail → dbus-broker cascade failure → SSH never comes up. Updated to 97be5c76 (latest main) which includes all fixes. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update testsuite pin to include summary error_message fix (#36) Pins to e4dd0345 which fixes AttributeError when behave emits error_message as a list (multi-line step errors). Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to 6721f614 (GNOME 50 smoke fixes) (#40) Pin projectbluefin/testsuite to 6721f614cf98bc3949578c51cb9a08a2d6e3a8b9 which includes PR #138 + PR #139 — comprehensive GNOME 50 smoke fixes: - conditional open() for Quick Settings / Date Menu panels - qecore key mapping patch (leftctrl/leftalt/leftshift evdev names) - multi-method app launch (gtk-launch / gio launch .desktop) - Ptyxis window title 'Terminal' accepted (GNOME 50 renamed it) - nautilus --quit after Alt+F4 to close background daemon - Notification banner JS for GNOME 50 _bannerBin API; 10s timeout - Extensions app with GTK_A11Y=atk-bridge for AT-SPI registration - About page falls back to all-roles scan for system info text - DND gsettings fallback when Shell toggle is absent - bootloader-update.service in IGNORED_FAILED_UNITS_IN_VM - Wi-Fi scenario skip when no wireless interface present Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: bump testsuite pin to 7329430 (GNOME 50 round-3 smoke fixes) (#43) Picks up PR #141 from projectbluefin/testsuite: - nautilus AT-SPI alias (GNOME 50 name change fix) - Shell.Eval force-close for daemon apps (Ptyxis, Files, Settings) - notification banner explicit dismiss fallback - GNOME Extensions AT-SPI soft-pass for headless GNOME 50 - ujust --list tolerates just version parse errors Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to b542be5 (round-4 GNOME 50 fixes) (#45) Updates testsuite SHA from 7329430 to b542be5: - Sidebar navigation roles: list item → button (GNOME 50 Nautilus) - New custom step for breadcrumb location checks - Extensions: multi-pattern pgrep fallback - Notification banner: demote to warning in headless GNOME 50 QEMU Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to 051e8cc (round-5 GNOME 50 fixes) (#46) Updates testsuite SHA from b542be5 to 051e8cc: - Downloads sidebar: revert to list item role (GNOME 50 still list item) - Extensions: remove pgrep fallback, AT-SPI app presence is enough - New folder / search bar: soft warnings in headless GNOME 50 QEMU Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): update quay.io/fedora-ostree-desktops/silverblue:43 docker digest to c9d2f9f --------- Co-authored-by: Jorge O. Castro <jorge.castro@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com>

…ons/custom-command-list@storageb.github.com digest to 20a5f24 (#53) * fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration (#18) When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk) to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci), the first boot fails with a black screen. Root cause: legacy-rechunk's 1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles, but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow from /etc/group, causing systemd-sysusers to fail on first boot: systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists. The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that rebuilds /etc/gshadow from /etc/group on every boot. The service is idempotent and harmless once gshadow is clean. Files added (verbatim from Aurora): - system_files/shared/usr/bin/rechunker-group-fix - system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service Service enabled in build_files/base/17-cleanup.sh. Without this fix, the first boot into projectbluefin/bluefin after switching from ublue-os/bluefin WILL produce a black screen. Second boot of the same image succeeds, but users will think the image is broken. Fixes: ublue-os/bluefin#3852 See also: - ublue-os/bluefin-lts#918 (renner0e test report) - bootc-dev/bootc#1179 - ublue-os/aurora#1468 - https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47 Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): update projectbluefin/testsuite digest to 12bd892 (#15) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * chore(deps): update system_files/shared/usr/share/gnome-shell/extensions/blur-my-shell@aunetx digest to fcd5d02 (#16) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * fix(ci): add packages:write to e2e reusable workflow callers The e2e.yml reusable workflow in projectbluefin/testsuite requires packages:write permission to push screenshots to GHCR. Without it, jobs fail with startup_failure before any steps run. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk) to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci), the first boot fails with a black screen. Root cause: legacy-rechunk's 1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles, but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow from /etc/group, causing systemd-sysusers to fail on first boot: systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists. The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that rebuilds /etc/gshadow from /etc/group on every boot. The service is idempotent and harmless once gshadow is clean. Files added (verbatim from Aurora): - system_files/shared/usr/bin/rechunker-group-fix - system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service Service enabled in build_files/base/17-cleanup.sh. Without this fix, the first boot into projectbluefin/bluefin after switching from ublue-os/bluefin WILL produce a black screen. Second boot of the same image succeeds, but users will think the image is broken. Fixes: ublue-os/bluefin#3852 See also: - ublue-os/bluefin-lts#918 (renner0e test report) - bootc-dev/bootc#1179 - ublue-os/aurora#1468 - https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47 Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update hardcoded testing branch references to main projectbluefin/bluefin uses main as default branch, not testing. Update build trigger, post-e2e filter, and weekly promotion workflow to reference main instead of the ublue-os/bluefin testing branch. Assisted-by: Claude via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): add packages:write to weekly-promotion e2e job The reusable testsuite e2e.yml requires packages:write to push screenshots to GHCR. Without it the job fails with startup_failure. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): pin quay.io/fedora-ostree-desktops/silverblue docker tag to d0ba53e (#22) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * chore(deps): update ghcr.io/projectbluefin/common:latest docker digest to a5e120b (#23) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * fix: resolve shellcheck warnings in rechunker-group-fix script (#25) Rewrite the /etc/gshadow sync loop to use while-read instead of for-in-cat (SC2013), properly quote variables (SC2086), and use printf instead of echo with unquoted command substitution (SC2046). Functionally identical — group names cannot contain spaces or glob characters, but the rewrite is safer and passes shellcheck cleanly. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: remove stale silverblue-main entry from image-versions.yml (#26) PR #17 moved the base image from ghcr.io/ublue-os/silverblue-main to quay.io/fedora-ostree-desktops/silverblue. The Justfile only reads 'common' and 'brew' entries from image-versions.yml, so the silverblue-main entry is dead config that may cause unnecessary Renovate PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: correct IMAGE_VENDOR default from ublue-os to projectbluefin (#27) The Containerfile ARG default for IMAGE_VENDOR was still set to 'ublue-os' from the upstream fork. The Justfile correctly overrides it to 'projectbluefin' via repo_organization, but a bare build without Just would produce images with the wrong vendor label and ostree ref: ghcr.io/ublue-os/bluefin (wrong) ghcr.io/projectbluefin/bluefin (correct) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update stale ublue-os org references to projectbluefin (#28) Update OCI labels and admin recipe that still pointed to the old upstream ublue-os/bluefin repository: - io.artifacthub.package.readme-url: ublue-os → projectbluefin - org.opencontainers.image.source: ublue-os → projectbluefin - retag-nvidia-on-ghcr recipe: copies from/to projectbluefin GHCR instead of ublue-os Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update CONTRIBUTING.md for main-branch workflow (#29) Replace all references to 'testing' branch with 'main' to reflect the projectbluefin/bluefin repo structure where PRs target main. Also update the promotion section to document the weekly automated promotion via weekly-testing-promotion.yml instead of the old pull-bot model. Stream reference table updated: latest builds from 'latest' branch, testing stream builds from 'main' branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update offline docs PDF URL to projectbluefin/documentation (#30) Update the bundled Bluefin documentation URL from the old ublue-os/bluefin-docs repo (now redirects) to the canonical projectbluefin/documentation location. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update LTS variant link to projectbluefin/bluefin-lts (#31) The LTS variant has moved to the projectbluefin GitHub org. Update the Copilot instructions to reference the correct location. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update README badges and links to projectbluefin org (#33) - OpenSSF Scorecard badge: ublue-os → projectbluefin - GitHub Actions CI badges: ublue-os → projectbluefin - User count badge link target: ublue-os → projectbluefin - DeepWiki link: ublue-os/bluefin-docs → projectbluefin/bluefin - Remove stale Codacy badge (not configured for projectbluefin) Star history, LFX, and ossinsight charts retained as-is (historical data from the original ublue-os/bluefin repo). Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update ublue-os org references in changelogs.py to projectbluefin (#32) Update the changelog generation script to reference the correct org: - REGISTRY: ghcr.io/ublue-os → ghcr.io/projectbluefin - Commit URL: github.com/ublue-os/bluefin → github.com/projectbluefin/bluefin - bootc switch commands: ghcr.io/ublue-os → ghcr.io/projectbluefin The image-info.json path (/usr/share/ublue-os/...) is a filesystem standard and intentionally kept as ublue-os. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: correct stale refs in github config files (#34) - ISSUE_TEMPLATE/config.yml: CONTRIBUTING.md URL pointed to blob/testing, now blob/main - copilot-setup-steps.yml: paths filter referenced non-existent workflows/ path, now correct Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update testsuite pin to include boot.1.1 ostree fix (#35) The pinned commit (12bd892e) predates the canonical boot.N symlink fix (7bcdf965) needed for Fedora 44 bootc images. The ostree-system-generator only accepts /ostree/boot.[01]/... paths; bootc 1.1.x installs deployments under boot.1.1 (versioned), causing the generator to fail → dbus-broker cascade failure → SSH never comes up. Updated to 97be5c76 (latest main) which includes all fixes. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update testsuite pin to include summary error_message fix (#36) Pins to e4dd0345 which fixes AttributeError when behave emits error_message as a list (multi-line step errors). Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to 6721f614 (GNOME 50 smoke fixes) (#40) Pin projectbluefin/testsuite to 6721f614cf98bc3949578c51cb9a08a2d6e3a8b9 which includes PR #138 + PR #139 — comprehensive GNOME 50 smoke fixes: - conditional open() for Quick Settings / Date Menu panels - qecore key mapping patch (leftctrl/leftalt/leftshift evdev names) - multi-method app launch (gtk-launch / gio launch .desktop) - Ptyxis window title 'Terminal' accepted (GNOME 50 renamed it) - nautilus --quit after Alt+F4 to close background daemon - Notification banner JS for GNOME 50 _bannerBin API; 10s timeout - Extensions app with GTK_A11Y=atk-bridge for AT-SPI registration - About page falls back to all-roles scan for system info text - DND gsettings fallback when Shell toggle is absent - bootloader-update.service in IGNORED_FAILED_UNITS_IN_VM - Wi-Fi scenario skip when no wireless interface present Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: bump testsuite pin to 7329430 (GNOME 50 round-3 smoke fixes) (#43) Picks up PR #141 from projectbluefin/testsuite: - nautilus AT-SPI alias (GNOME 50 name change fix) - Shell.Eval force-close for daemon apps (Ptyxis, Files, Settings) - notification banner explicit dismiss fallback - GNOME Extensions AT-SPI soft-pass for headless GNOME 50 - ujust --list tolerates just version parse errors Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to b542be5 (round-4 GNOME 50 fixes) (#45) Updates testsuite SHA from 7329430 to b542be5: - Sidebar navigation roles: list item → button (GNOME 50 Nautilus) - New custom step for breadcrumb location checks - Extensions: multi-pattern pgrep fallback - Notification banner: demote to warning in headless GNOME 50 QEMU Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to 051e8cc (round-5 GNOME 50 fixes) (#46) Updates testsuite SHA from b542be5 to 051e8cc: - Downloads sidebar: revert to list item role (GNOME 50 still list item) - Extensions: remove pgrep fallback, AT-SPI app presence is enough - New folder / search bar: soft warnings in headless GNOME 50 QEMU Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): extend automerge to cover app/mergeraptor PRs (#51) The renovate-automerge workflow only matched author.login == "renovate[bot]" but mergeraptor PRs use "app/mergeraptor". This meant all mergeraptor dependency-update PRs were silently skipped even when CI passed. Update the jq filter to accept both bot logins. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): update system_files/shared/usr/share/gnome-shell/extensions/custom-command-list@storageb.github.com digest to 20a5f24 --------- Co-authored-by: Jorge O. Castro <jorge.castro@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com>

* fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration (#18) When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk) to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci), the first boot fails with a black screen. Root cause: legacy-rechunk's 1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles, but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow from /etc/group, causing systemd-sysusers to fail on first boot: systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists. The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that rebuilds /etc/gshadow from /etc/group on every boot. The service is idempotent and harmless once gshadow is clean. Files added (verbatim from Aurora): - system_files/shared/usr/bin/rechunker-group-fix - system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service Service enabled in build_files/base/17-cleanup.sh. Without this fix, the first boot into projectbluefin/bluefin after switching from ublue-os/bluefin WILL produce a black screen. Second boot of the same image succeeds, but users will think the image is broken. Fixes: ublue-os/bluefin#3852 See also: - ublue-os/bluefin-lts#918 (renner0e test report) - bootc-dev/bootc#1179 - ublue-os/aurora#1468 - https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47 Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): update projectbluefin/testsuite digest to 12bd892 (#15) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * chore(deps): update system_files/shared/usr/share/gnome-shell/extensions/blur-my-shell@aunetx digest to fcd5d02 (#16) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * fix(ci): add packages:write to e2e reusable workflow callers The e2e.yml reusable workflow in projectbluefin/testsuite requires packages:write permission to push screenshots to GHCR. Without it, jobs fail with startup_failure before any steps run. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk) to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci), the first boot fails with a black screen. Root cause: legacy-rechunk's 1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles, but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow from /etc/group, causing systemd-sysusers to fail on first boot: systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists. The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that rebuilds /etc/gshadow from /etc/group on every boot. The service is idempotent and harmless once gshadow is clean. Files added (verbatim from Aurora): - system_files/shared/usr/bin/rechunker-group-fix - system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service Service enabled in build_files/base/17-cleanup.sh. Without this fix, the first boot into projectbluefin/bluefin after switching from ublue-os/bluefin WILL produce a black screen. Second boot of the same image succeeds, but users will think the image is broken. Fixes: ublue-os/bluefin#3852 See also: - ublue-os/bluefin-lts#918 (renner0e test report) - bootc-dev/bootc#1179 - ublue-os/aurora#1468 - https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47 Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update hardcoded testing branch references to main projectbluefin/bluefin uses main as default branch, not testing. Update build trigger, post-e2e filter, and weekly promotion workflow to reference main instead of the ublue-os/bluefin testing branch. Assisted-by: Claude via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): add packages:write to weekly-promotion e2e job The reusable testsuite e2e.yml requires packages:write to push screenshots to GHCR. Without it the job fails with startup_failure. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): pin quay.io/fedora-ostree-desktops/silverblue docker tag to d0ba53e (#22) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * chore(deps): update ghcr.io/projectbluefin/common:latest docker digest to a5e120b (#23) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * fix: resolve shellcheck warnings in rechunker-group-fix script (#25) Rewrite the /etc/gshadow sync loop to use while-read instead of for-in-cat (SC2013), properly quote variables (SC2086), and use printf instead of echo with unquoted command substitution (SC2046). Functionally identical — group names cannot contain spaces or glob characters, but the rewrite is safer and passes shellcheck cleanly. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: remove stale silverblue-main entry from image-versions.yml (#26) PR #17 moved the base image from ghcr.io/ublue-os/silverblue-main to quay.io/fedora-ostree-desktops/silverblue. The Justfile only reads 'common' and 'brew' entries from image-versions.yml, so the silverblue-main entry is dead config that may cause unnecessary Renovate PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: correct IMAGE_VENDOR default from ublue-os to projectbluefin (#27) The Containerfile ARG default for IMAGE_VENDOR was still set to 'ublue-os' from the upstream fork. The Justfile correctly overrides it to 'projectbluefin' via repo_organization, but a bare build without Just would produce images with the wrong vendor label and ostree ref: ghcr.io/ublue-os/bluefin (wrong) ghcr.io/projectbluefin/bluefin (correct) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update stale ublue-os org references to projectbluefin (#28) Update OCI labels and admin recipe that still pointed to the old upstream ublue-os/bluefin repository: - io.artifacthub.package.readme-url: ublue-os → projectbluefin - org.opencontainers.image.source: ublue-os → projectbluefin - retag-nvidia-on-ghcr recipe: copies from/to projectbluefin GHCR instead of ublue-os Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update CONTRIBUTING.md for main-branch workflow (#29) Replace all references to 'testing' branch with 'main' to reflect the projectbluefin/bluefin repo structure where PRs target main. Also update the promotion section to document the weekly automated promotion via weekly-testing-promotion.yml instead of the old pull-bot model. Stream reference table updated: latest builds from 'latest' branch, testing stream builds from 'main' branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update offline docs PDF URL to projectbluefin/documentation (#30) Update the bundled Bluefin documentation URL from the old ublue-os/bluefin-docs repo (now redirects) to the canonical projectbluefin/documentation location. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update LTS variant link to projectbluefin/bluefin-lts (#31) The LTS variant has moved to the projectbluefin GitHub org. Update the Copilot instructions to reference the correct location. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update README badges and links to projectbluefin org (#33) - OpenSSF Scorecard badge: ublue-os → projectbluefin - GitHub Actions CI badges: ublue-os → projectbluefin - User count badge link target: ublue-os → projectbluefin - DeepWiki link: ublue-os/bluefin-docs → projectbluefin/bluefin - Remove stale Codacy badge (not configured for projectbluefin) Star history, LFX, and ossinsight charts retained as-is (historical data from the original ublue-os/bluefin repo). Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update ublue-os org references in changelogs.py to projectbluefin (#32) Update the changelog generation script to reference the correct org: - REGISTRY: ghcr.io/ublue-os → ghcr.io/projectbluefin - Commit URL: github.com/ublue-os/bluefin → github.com/projectbluefin/bluefin - bootc switch commands: ghcr.io/ublue-os → ghcr.io/projectbluefin The image-info.json path (/usr/share/ublue-os/...) is a filesystem standard and intentionally kept as ublue-os. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: correct stale refs in github config files (#34) - ISSUE_TEMPLATE/config.yml: CONTRIBUTING.md URL pointed to blob/testing, now blob/main - copilot-setup-steps.yml: paths filter referenced non-existent workflows/ path, now correct Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update testsuite pin to include boot.1.1 ostree fix (#35) The pinned commit (12bd892e) predates the canonical boot.N symlink fix (7bcdf965) needed for Fedora 44 bootc images. The ostree-system-generator only accepts /ostree/boot.[01]/... paths; bootc 1.1.x installs deployments under boot.1.1 (versioned), causing the generator to fail → dbus-broker cascade failure → SSH never comes up. Updated to 97be5c76 (latest main) which includes all fixes. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update testsuite pin to include summary error_message fix (#36) Pins to e4dd0345 which fixes AttributeError when behave emits error_message as a list (multi-line step errors). Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to 6721f614 (GNOME 50 smoke fixes) (#40) Pin projectbluefin/testsuite to 6721f614cf98bc3949578c51cb9a08a2d6e3a8b9 which includes PR #138 + PR #139 — comprehensive GNOME 50 smoke fixes: - conditional open() for Quick Settings / Date Menu panels - qecore key mapping patch (leftctrl/leftalt/leftshift evdev names) - multi-method app launch (gtk-launch / gio launch .desktop) - Ptyxis window title 'Terminal' accepted (GNOME 50 renamed it) - nautilus --quit after Alt+F4 to close background daemon - Notification banner JS for GNOME 50 _bannerBin API; 10s timeout - Extensions app with GTK_A11Y=atk-bridge for AT-SPI registration - About page falls back to all-roles scan for system info text - DND gsettings fallback when Shell toggle is absent - bootloader-update.service in IGNORED_FAILED_UNITS_IN_VM - Wi-Fi scenario skip when no wireless interface present Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: bump testsuite pin to 7329430 (GNOME 50 round-3 smoke fixes) (#43) Picks up PR #141 from projectbluefin/testsuite: - nautilus AT-SPI alias (GNOME 50 name change fix) - Shell.Eval force-close for daemon apps (Ptyxis, Files, Settings) - notification banner explicit dismiss fallback - GNOME Extensions AT-SPI soft-pass for headless GNOME 50 - ujust --list tolerates just version parse errors Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to b542be5 (round-4 GNOME 50 fixes) (#45) Updates testsuite SHA from 7329430 to b542be5: - Sidebar navigation roles: list item → button (GNOME 50 Nautilus) - New custom step for breadcrumb location checks - Extensions: multi-pattern pgrep fallback - Notification banner: demote to warning in headless GNOME 50 QEMU Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to 051e8cc (round-5 GNOME 50 fixes) (#46) Updates testsuite SHA from b542be5 to 051e8cc: - Downloads sidebar: revert to list item role (GNOME 50 still list item) - Extensions: remove pgrep fallback, AT-SPI app presence is enough - New folder / search bar: soft warnings in headless GNOME 50 QEMU Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): extend automerge to cover app/mergeraptor PRs (#51) The renovate-automerge workflow only matched author.login == "renovate[bot]" but mergeraptor PRs use "app/mergeraptor". This meant all mergeraptor dependency-update PRs were silently skipped even when CI passed. Update the jq filter to accept both bot logins. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): update taiki-e/install-action digest to 35e522e --------- Co-authored-by: Jorge O. Castro <jorge.castro@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com>

…d storage (#56) * fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration (#18) When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk) to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci), the first boot fails with a black screen. Root cause: legacy-rechunk's 1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles, but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow from /etc/group, causing systemd-sysusers to fail on first boot: systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists. The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that rebuilds /etc/gshadow from /etc/group on every boot. The service is idempotent and harmless once gshadow is clean. Files added (verbatim from Aurora): - system_files/shared/usr/bin/rechunker-group-fix - system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service Service enabled in build_files/base/17-cleanup.sh. Without this fix, the first boot into projectbluefin/bluefin after switching from ublue-os/bluefin WILL produce a black screen. Second boot of the same image succeeds, but users will think the image is broken. Fixes: ublue-os/bluefin#3852 See also: - ublue-os/bluefin-lts#918 (renner0e test report) - bootc-dev/bootc#1179 - ublue-os/aurora#1468 - https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47 Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): update projectbluefin/testsuite digest to 12bd892 (#15) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * chore(deps): update system_files/shared/usr/share/gnome-shell/extensions/blur-my-shell@aunetx digest to fcd5d02 (#16) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * fix(ci): add packages:write to e2e reusable workflow callers The e2e.yml reusable workflow in projectbluefin/testsuite requires packages:write permission to push screenshots to GHCR. Without it, jobs fail with startup_failure before any steps run. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk) to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci), the first boot fails with a black screen. Root cause: legacy-rechunk's 1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles, but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow from /etc/group, causing systemd-sysusers to fail on first boot: systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists. The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that rebuilds /etc/gshadow from /etc/group on every boot. The service is idempotent and harmless once gshadow is clean. Files added (verbatim from Aurora): - system_files/shared/usr/bin/rechunker-group-fix - system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service Service enabled in build_files/base/17-cleanup.sh. Without this fix, the first boot into projectbluefin/bluefin after switching from ublue-os/bluefin WILL produce a black screen. Second boot of the same image succeeds, but users will think the image is broken. Fixes: ublue-os/bluefin#3852 See also: - ublue-os/bluefin-lts#918 (renner0e test report) - bootc-dev/bootc#1179 - ublue-os/aurora#1468 - https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47 Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update hardcoded testing branch references to main projectbluefin/bluefin uses main as default branch, not testing. Update build trigger, post-e2e filter, and weekly promotion workflow to reference main instead of the ublue-os/bluefin testing branch. Assisted-by: Claude via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): add packages:write to weekly-promotion e2e job The reusable testsuite e2e.yml requires packages:write to push screenshots to GHCR. Without it the job fails with startup_failure. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): pin quay.io/fedora-ostree-desktops/silverblue docker tag to d0ba53e (#22) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * chore(deps): update ghcr.io/projectbluefin/common:latest docker digest to a5e120b (#23) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * fix: resolve shellcheck warnings in rechunker-group-fix script (#25) Rewrite the /etc/gshadow sync loop to use while-read instead of for-in-cat (SC2013), properly quote variables (SC2086), and use printf instead of echo with unquoted command substitution (SC2046). Functionally identical — group names cannot contain spaces or glob characters, but the rewrite is safer and passes shellcheck cleanly. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: remove stale silverblue-main entry from image-versions.yml (#26) PR #17 moved the base image from ghcr.io/ublue-os/silverblue-main to quay.io/fedora-ostree-desktops/silverblue. The Justfile only reads 'common' and 'brew' entries from image-versions.yml, so the silverblue-main entry is dead config that may cause unnecessary Renovate PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: correct IMAGE_VENDOR default from ublue-os to projectbluefin (#27) The Containerfile ARG default for IMAGE_VENDOR was still set to 'ublue-os' from the upstream fork. The Justfile correctly overrides it to 'projectbluefin' via repo_organization, but a bare build without Just would produce images with the wrong vendor label and ostree ref: ghcr.io/ublue-os/bluefin (wrong) ghcr.io/projectbluefin/bluefin (correct) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update stale ublue-os org references to projectbluefin (#28) Update OCI labels and admin recipe that still pointed to the old upstream ublue-os/bluefin repository: - io.artifacthub.package.readme-url: ublue-os → projectbluefin - org.opencontainers.image.source: ublue-os → projectbluefin - retag-nvidia-on-ghcr recipe: copies from/to projectbluefin GHCR instead of ublue-os Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update CONTRIBUTING.md for main-branch workflow (#29) Replace all references to 'testing' branch with 'main' to reflect the projectbluefin/bluefin repo structure where PRs target main. Also update the promotion section to document the weekly automated promotion via weekly-testing-promotion.yml instead of the old pull-bot model. Stream reference table updated: latest builds from 'latest' branch, testing stream builds from 'main' branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update offline docs PDF URL to projectbluefin/documentation (#30) Update the bundled Bluefin documentation URL from the old ublue-os/bluefin-docs repo (now redirects) to the canonical projectbluefin/documentation location. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update LTS variant link to projectbluefin/bluefin-lts (#31) The LTS variant has moved to the projectbluefin GitHub org. Update the Copilot instructions to reference the correct location. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update README badges and links to projectbluefin org (#33) - OpenSSF Scorecard badge: ublue-os → projectbluefin - GitHub Actions CI badges: ublue-os → projectbluefin - User count badge link target: ublue-os → projectbluefin - DeepWiki link: ublue-os/bluefin-docs → projectbluefin/bluefin - Remove stale Codacy badge (not configured for projectbluefin) Star history, LFX, and ossinsight charts retained as-is (historical data from the original ublue-os/bluefin repo). Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update ublue-os org references in changelogs.py to projectbluefin (#32) Update the changelog generation script to reference the correct org: - REGISTRY: ghcr.io/ublue-os → ghcr.io/projectbluefin - Commit URL: github.com/ublue-os/bluefin → github.com/projectbluefin/bluefin - bootc switch commands: ghcr.io/ublue-os → ghcr.io/projectbluefin The image-info.json path (/usr/share/ublue-os/...) is a filesystem standard and intentionally kept as ublue-os. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: correct stale refs in github config files (#34) - ISSUE_TEMPLATE/config.yml: CONTRIBUTING.md URL pointed to blob/testing, now blob/main - copilot-setup-steps.yml: paths filter referenced non-existent workflows/ path, now correct Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update testsuite pin to include boot.1.1 ostree fix (#35) The pinned commit (12bd892e) predates the canonical boot.N symlink fix (7bcdf965) needed for Fedora 44 bootc images. The ostree-system-generator only accepts /ostree/boot.[01]/... paths; bootc 1.1.x installs deployments under boot.1.1 (versioned), causing the generator to fail → dbus-broker cascade failure → SSH never comes up. Updated to 97be5c76 (latest main) which includes all fixes. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update testsuite pin to include summary error_message fix (#36) Pins to e4dd0345 which fixes AttributeError when behave emits error_message as a list (multi-line step errors). Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to 6721f614 (GNOME 50 smoke fixes) (#40) Pin projectbluefin/testsuite to 6721f614cf98bc3949578c51cb9a08a2d6e3a8b9 which includes PR #138 + PR #139 — comprehensive GNOME 50 smoke fixes: - conditional open() for Quick Settings / Date Menu panels - qecore key mapping patch (leftctrl/leftalt/leftshift evdev names) - multi-method app launch (gtk-launch / gio launch .desktop) - Ptyxis window title 'Terminal' accepted (GNOME 50 renamed it) - nautilus --quit after Alt+F4 to close background daemon - Notification banner JS for GNOME 50 _bannerBin API; 10s timeout - Extensions app with GTK_A11Y=atk-bridge for AT-SPI registration - About page falls back to all-roles scan for system info text - DND gsettings fallback when Shell toggle is absent - bootloader-update.service in IGNORED_FAILED_UNITS_IN_VM - Wi-Fi scenario skip when no wireless interface present Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: bump testsuite pin to 7329430 (GNOME 50 round-3 smoke fixes) (#43) Picks up PR #141 from projectbluefin/testsuite: - nautilus AT-SPI alias (GNOME 50 name change fix) - Shell.Eval force-close for daemon apps (Ptyxis, Files, Settings) - notification banner explicit dismiss fallback - GNOME Extensions AT-SPI soft-pass for headless GNOME 50 - ujust --list tolerates just version parse errors Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to b542be5 (round-4 GNOME 50 fixes) (#45) Updates testsuite SHA from 7329430 to b542be5: - Sidebar navigation roles: list item → button (GNOME 50 Nautilus) - New custom step for breadcrumb location checks - Extensions: multi-pattern pgrep fallback - Notification banner: demote to warning in headless GNOME 50 QEMU Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to 051e8cc (round-5 GNOME 50 fixes) (#46) Updates testsuite SHA from b542be5 to 051e8cc: - Downloads sidebar: revert to list item role (GNOME 50 still list item) - Extensions: remove pgrep fallback, AT-SPI app presence is enough - New folder / search bar: soft warnings in headless GNOME 50 QEMU Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): extend automerge to cover app/mergeraptor PRs (#51) The renovate-automerge workflow only matched author.login == "renovate[bot]" but mergeraptor PRs use "app/mergeraptor". This meant all mergeraptor dependency-update PRs were silently skipped even when CI passed. Update the jq filter to accept both bot logins. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat(ci): push images with zstd:chunked compression Switch podman push from default gzip to zstd:chunked compression format. This enables seekable/chunked pulls where clients only download the file content that actually changed between updates. Changes: - Add 'Update Podman' step: upgrades podman/buildah/crun/skopeo from Ubuntu resolute (25.04) repo because old Ubuntu 24.04 podman does not correctly push ostree.components layer annotations required by the rpm-ostree rechunker - Add --compression-format zstd:chunked --compression-level 3 to all podman push commands - Push each tag twice to ensure stable manifest digest and annotations (workaround for podman-container-tools/podman#27796) - Add --retry 5 --retry-delay 30s for per-layer network resilience Mirrored from Aurora's approach in ublue-os/aurora reusable-build.yml. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat(ci): add --force-compression and bootc unified storage - Add --force-compression to all zstd:chunked push calls so that unchanged layers are re-compressed from gzip to zstd:chunked (without this flag podman reuses existing gzip blobs, breaking partial pull annotations) - Add bootc-unified-storage.service: runs once on first boot to migrate the system to bootc-owned containers-storage via `bootc image set-unified` enabling zstd:chunked partial chunk pulls on future upgrades - Enable the service in build_files/base/17-cleanup.sh The service uses ConditionPathExists=!/var/lib/.bootc-unified-storage as a one-shot sentinel and Restart=on-failure to retry if bootc isn't ready yet. Feature is experimental in bootc upstream (tracking issue #20). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI * ci: trigger PR validation --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com>

…52) * fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration (#18) When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk) to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci), the first boot fails with a black screen. Root cause: legacy-rechunk's 1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles, but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow from /etc/group, causing systemd-sysusers to fail on first boot: systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists. The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that rebuilds /etc/gshadow from /etc/group on every boot. The service is idempotent and harmless once gshadow is clean. Files added (verbatim from Aurora): - system_files/shared/usr/bin/rechunker-group-fix - system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service Service enabled in build_files/base/17-cleanup.sh. Without this fix, the first boot into projectbluefin/bluefin after switching from ublue-os/bluefin WILL produce a black screen. Second boot of the same image succeeds, but users will think the image is broken. Fixes: ublue-os/bluefin#3852 See also: - ublue-os/bluefin-lts#918 (renner0e test report) - bootc-dev/bootc#1179 - ublue-os/aurora#1468 - https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47 Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): update projectbluefin/testsuite digest to 12bd892 (#15) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * chore(deps): update system_files/shared/usr/share/gnome-shell/extensions/blur-my-shell@aunetx digest to fcd5d02 (#16) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * fix(ci): add packages:write to e2e reusable workflow callers The e2e.yml reusable workflow in projectbluefin/testsuite requires packages:write permission to push screenshots to GHCR. Without it, jobs fail with startup_failure before any steps run. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: ship rechunker-group-fix service for legacy-rechunk→chunkah migration When users bootc switch from ghcr.io/ublue-os/bluefin (legacy-rechunk) to ghcr.io/projectbluefin/bluefin (chunkah/rpm-ostree build-chunked-oci), the first boot fails with a black screen. Root cause: legacy-rechunk's 1_prune.sh moves /etc/group entries into /usr/lib/group for nss-altfiles, but chunkah images don't use nss-altfiles. This desyncs /etc/gshadow from /etc/group, causing systemd-sysusers to fail on first boot: systemd-sysusers[1022]: /etc/gshadow: Group "plocate" already exists. The fix (from ublue-os/aurora, Dec 2025): a oneshot systemd service that rebuilds /etc/gshadow from /etc/group on every boot. The service is idempotent and harmless once gshadow is clean. Files added (verbatim from Aurora): - system_files/shared/usr/bin/rechunker-group-fix - system_files/shared/usr/lib/systemd/system/rechunker-group-fix.service Service enabled in build_files/base/17-cleanup.sh. Without this fix, the first boot into projectbluefin/bluefin after switching from ublue-os/bluefin WILL produce a black screen. Second boot of the same image succeeds, but users will think the image is broken. Fixes: ublue-os/bluefin#3852 See also: - ublue-os/bluefin-lts#918 (renner0e test report) - bootc-dev/bootc#1179 - ublue-os/aurora#1468 - https://github.com/ublue-os/legacy-rechunk/blob/1d2b0c2e/1_prune.sh#L41-L47 Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update hardcoded testing branch references to main projectbluefin/bluefin uses main as default branch, not testing. Update build trigger, post-e2e filter, and weekly promotion workflow to reference main instead of the ublue-os/bluefin testing branch. Assisted-by: Claude via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): add packages:write to weekly-promotion e2e job The reusable testsuite e2e.yml requires packages:write to push screenshots to GHCR. Without it the job fails with startup_failure. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(deps): pin quay.io/fedora-ostree-desktops/silverblue docker tag to d0ba53e (#22) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * chore(deps): update ghcr.io/projectbluefin/common:latest docker digest to a5e120b (#23) Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com> * fix: resolve shellcheck warnings in rechunker-group-fix script (#25) Rewrite the /etc/gshadow sync loop to use while-read instead of for-in-cat (SC2013), properly quote variables (SC2086), and use printf instead of echo with unquoted command substitution (SC2046). Functionally identical — group names cannot contain spaces or glob characters, but the rewrite is safer and passes shellcheck cleanly. Assisted-by: Claude Sonnet 4.5 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: remove stale silverblue-main entry from image-versions.yml (#26) PR #17 moved the base image from ghcr.io/ublue-os/silverblue-main to quay.io/fedora-ostree-desktops/silverblue. The Justfile only reads 'common' and 'brew' entries from image-versions.yml, so the silverblue-main entry is dead config that may cause unnecessary Renovate PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: correct IMAGE_VENDOR default from ublue-os to projectbluefin (#27) The Containerfile ARG default for IMAGE_VENDOR was still set to 'ublue-os' from the upstream fork. The Justfile correctly overrides it to 'projectbluefin' via repo_organization, but a bare build without Just would produce images with the wrong vendor label and ostree ref: ghcr.io/ublue-os/bluefin (wrong) ghcr.io/projectbluefin/bluefin (correct) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update stale ublue-os org references to projectbluefin (#28) Update OCI labels and admin recipe that still pointed to the old upstream ublue-os/bluefin repository: - io.artifacthub.package.readme-url: ublue-os → projectbluefin - org.opencontainers.image.source: ublue-os → projectbluefin - retag-nvidia-on-ghcr recipe: copies from/to projectbluefin GHCR instead of ublue-os Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update CONTRIBUTING.md for main-branch workflow (#29) Replace all references to 'testing' branch with 'main' to reflect the projectbluefin/bluefin repo structure where PRs target main. Also update the promotion section to document the weekly automated promotion via weekly-testing-promotion.yml instead of the old pull-bot model. Stream reference table updated: latest builds from 'latest' branch, testing stream builds from 'main' branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update offline docs PDF URL to projectbluefin/documentation (#30) Update the bundled Bluefin documentation URL from the old ublue-os/bluefin-docs repo (now redirects) to the canonical projectbluefin/documentation location. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update LTS variant link to projectbluefin/bluefin-lts (#31) The LTS variant has moved to the projectbluefin GitHub org. Update the Copilot instructions to reference the correct location. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update README badges and links to projectbluefin org (#33) - OpenSSF Scorecard badge: ublue-os → projectbluefin - GitHub Actions CI badges: ublue-os → projectbluefin - User count badge link target: ublue-os → projectbluefin - DeepWiki link: ublue-os/bluefin-docs → projectbluefin/bluefin - Remove stale Codacy badge (not configured for projectbluefin) Star history, LFX, and ossinsight charts retained as-is (historical data from the original ublue-os/bluefin repo). Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update ublue-os org references in changelogs.py to projectbluefin (#32) Update the changelog generation script to reference the correct org: - REGISTRY: ghcr.io/ublue-os → ghcr.io/projectbluefin - Commit URL: github.com/ublue-os/bluefin → github.com/projectbluefin/bluefin - bootc switch commands: ghcr.io/ublue-os → ghcr.io/projectbluefin The image-info.json path (/usr/share/ublue-os/...) is a filesystem standard and intentionally kept as ublue-os. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: correct stale refs in github config files (#34) - ISSUE_TEMPLATE/config.yml: CONTRIBUTING.md URL pointed to blob/testing, now blob/main - copilot-setup-steps.yml: paths filter referenced non-existent workflows/ path, now correct Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update testsuite pin to include boot.1.1 ostree fix (#35) The pinned commit (12bd892e) predates the canonical boot.N symlink fix (7bcdf965) needed for Fedora 44 bootc images. The ostree-system-generator only accepts /ostree/boot.[01]/... paths; bootc 1.1.x installs deployments under boot.1.1 (versioned), causing the generator to fail → dbus-broker cascade failure → SSH never comes up. Updated to 97be5c76 (latest main) which includes all fixes. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): update testsuite pin to include summary error_message fix (#36) Pins to e4dd0345 which fixes AttributeError when behave emits error_message as a list (multi-line step errors). Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to 6721f614 (GNOME 50 smoke fixes) (#40) Pin projectbluefin/testsuite to 6721f614cf98bc3949578c51cb9a08a2d6e3a8b9 which includes PR #138 + PR #139 — comprehensive GNOME 50 smoke fixes: - conditional open() for Quick Settings / Date Menu panels - qecore key mapping patch (leftctrl/leftalt/leftshift evdev names) - multi-method app launch (gtk-launch / gio launch .desktop) - Ptyxis window title 'Terminal' accepted (GNOME 50 renamed it) - nautilus --quit after Alt+F4 to close background daemon - Notification banner JS for GNOME 50 _bannerBin API; 10s timeout - Extensions app with GTK_A11Y=atk-bridge for AT-SPI registration - About page falls back to all-roles scan for system info text - DND gsettings fallback when Shell toggle is absent - bootloader-update.service in IGNORED_FAILED_UNITS_IN_VM - Wi-Fi scenario skip when no wireless interface present Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: bump testsuite pin to 7329430 (GNOME 50 round-3 smoke fixes) (#43) Picks up PR #141 from projectbluefin/testsuite: - nautilus AT-SPI alias (GNOME 50 name change fix) - Shell.Eval force-close for daemon apps (Ptyxis, Files, Settings) - notification banner explicit dismiss fallback - GNOME Extensions AT-SPI soft-pass for headless GNOME 50 - ujust --list tolerates just version parse errors Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to b542be5 (round-4 GNOME 50 fixes) (#45) Updates testsuite SHA from 7329430 to b542be5: - Sidebar navigation roles: list item → button (GNOME 50 Nautilus) - New custom step for breadcrumb location checks - Extensions: multi-pattern pgrep fallback - Notification banner: demote to warning in headless GNOME 50 QEMU Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ci): update testsuite pin to 051e8cc (round-5 GNOME 50 fixes) (#46) Updates testsuite SHA from b542be5 to 051e8cc: - Downloads sidebar: revert to list item role (GNOME 50 still list item) - Extensions: remove pgrep fallback, AT-SPI app presence is enough - New folder / search bar: soft warnings in headless GNOME 50 QEMU Assisted-by: Claude Sonnet 4.6 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): extend automerge to cover app/mergeraptor PRs The renovate-automerge workflow only matched author.login == "renovate[bot]" but mergeraptor PRs use "app/mergeraptor". This meant all mergeraptor dependency-update PRs were silently skipped even when CI passed. Update the jq filter to accept both bot logins. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Assisted-by: Claude Sonnet 4.6 via GitHub Copilot * feat(ci): add self-hosted Renovate workflow with workflow_dispatch Adds renovate.yml with: - workflow_dispatch for manual runs (with optional dry-run flag) - schedule every 6 hours - concurrency group to prevent parallel runs Also adds e2e smoke gate to pr-validation.yml so automerge only triggers after tests pass, not just lint. Requires RENOVATE_TOKEN secret (GitHub PAT with repo scope). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Assisted-by: Claude Sonnet 4.6 via GitHub Copilot * revert: remove renovate.yml (handled by projectbluefin/renovate-config) --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com>

castrojo requested review from p5 and tulilirockz as code owners May 30, 2026 21:16

castrojo force-pushed the feat/move-off-silverblue-main branch from 56cb23b to f6873b9 Compare May 30, 2026 21:23

castrojo and others added 3 commits May 30, 2026 17:52

castrojo enabled auto-merge May 30, 2026 22:39

castrojo merged commit ec6a12a into main May 30, 2026
2 checks passed

castrojo deleted the feat/move-off-silverblue-main branch May 30, 2026 22:40

This was referenced May 30, 2026

chore(config): migrate Renovate config #8

Closed

chore: remove stale silverblue-main entry from image-versions.yml #26

Merged

castrojo added the 4-review A pull request is awaiting review. label Jul 28, 2026

Navigation Menu

Uh oh!

feat: move base image to quay.io/fedora-ostree-desktops/silverblue - #17

feat: move base image to quay.io/fedora-ostree-desktops/silverblue#17
castrojo merged 4 commits into
mainfrom
feat/move-off-silverblue-main

castrojo commented May 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

castrojo commented May 30, 2026

Summary

Changes

Test plan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant