Merge branch 'main' into timothee-image

Author: renner0e

.github/workflows/reusable-build.yml

@@ -96,25 +96,31 @@ jobs:
 
       - name: Setup Syft
         id: setup-syft
-        if: false
-        uses: anchore/sbom-action/download-syft@a930d0ac434e3182448fe678398ba5713717112a # v0
+        if: github.event_name != 'pull_request'
+        uses: anchore/sbom-action/download-syft@62ad5284b8ced813296287a0b63906cb364b73ee # v0
         with:
-          syft-version: v1.20.0
+          syft-version: v1.39.0
 
       - name: Generate SBOM
-        if: false
+        if: github.event_name != 'pull_request'
         id: generate-sbom
         env:
           IMAGE: ${{ env.IMAGE_NAME }}
           STREAM_NAME: ${{ matrix.stream_name }}
           SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }}
+          OCI_DIR: "/tmp/image-oci-dir"
         run: |
-          sudo systemctl start podman.socket
+          mkdir -p ${OCI_DIR}/rootfs
+          sudo podman container create --replace --name bluefin-tmp "localhost/${IMAGE}:${STREAM_NAME}"
+          sudo podman export bluefin-tmp | sudo tar -C ${OCI_DIR}/rootfs -xf -
+          sudo podman container rm bluefin-tmp
 
           OUTPUT_PATH="$(mktemp -d)/sbom.json"
           export SYFT_PARALLELISM=$(($(nproc)*2))
-          sudo $SYFT_CMD ${IMAGE}:${STREAM_NAME} -o spdx-json=${OUTPUT_PATH}
+          sudo $SYFT_CMD --source-name "${IMAGE}"-"${STREAM_NAME}" ${OCI_DIR} -o syft-json=${OUTPUT_PATH}
+          du -sh ${OUTPUT_PATH}
           echo "OUTPUT_PATH=${OUTPUT_PATH}" >> $GITHUB_OUTPUT
+          sudo rm -rf ${OCI_DIR}
 
       - name: Rechunk Image
         id: rechunk-image
@@ -226,7 +232,7 @@ jobs:
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
 
       - name: Add SBOM Attestation
-        if: false
+        if: github.event_name != 'pull_request'
         env:
           IMAGE: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
           DIGEST: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }}

.github/workflows/validate-renovate.yml

@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
         with:
           node-version: latest
 

build_files/shared/build.sh

@@ -4,8 +4,10 @@ set -eoux pipefail
 
 echo "::group:: Copy Files"
 
-# Conflicts with a ton of packages, has to be removed before we copy all the files as well
-rpm --erase --nodeps fedora-logos
+# Keep *-logos in RPM DB for downstream package installations
+# We are not allowed to ship an empty fedora-logos package
+dnf -y swap fedora-logos generic-logos
+rpm --erase --nodeps --nodb generic-logos
 
 # Copy Files to Container
 rsync -rvK /ctx/system_files/shared/ /

image-versions.yml

@@ -2,12 +2,12 @@ images:
   - name: silverblue-main
     image: ghcr.io/ublue-os/silverblue-main
     tag: latest
-    digest: sha256:d01f844f21e1255fb0e44a85f218f26f3108d2c97d5f12c8fcbfb2ce69b86504
+    digest: sha256:a05cd4283ba00d9be13b124b44f5eaef05f048733c099b61922c921ccf75f5eb
   - name: common
     image: ghcr.io/projectbluefin/common
     tag: latest
-    digest: sha256:233b4705313d3a208fed25cee630fbc414f8b72b8def89a4f195a862e320e127
+    digest: sha256:7c2058a1ab0bd915c822e80df40e961d00877ac02c1e89edbfef5148301e4d2c
   - name: brew
     image: ghcr.io/ublue-os/brew
     tag: latest
-    digest: sha256:f9637549a24a7e02315c28db04cc0827dfc04bb74cea3be5c187f10c262c30d2
+    digest: sha256:9021d14310509308f3cb8cc7cab98e5868212b2a744e044e998798d2eec26722