diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 3ac108bfc1c..9661ad87157 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -42,9 +42,14 @@ "automerge": true, "matchUpdateTypes": ["digest"], "matchDepNames": [ - "ghcr.io/ublue-os/silverblue-main", + "quay.io/fedora-ostree-desktops/silverblue", "ghcr.io/projectbluefin/common" ] + }, + { + "matchDepNames": ["quay.io/fedora-ostree-desktops/silverblue"], + "matchUpdateTypes": ["major"], + "enabled": false } ] } diff --git a/Containerfile b/Containerfile index c5fd357aeff..bb54f2a613d 100644 --- a/Containerfile +++ b/Containerfile @@ -1,7 +1,6 @@ ARG BASE_IMAGE_NAME="silverblue" -ARG FEDORA_MAJOR_VERSION="42" -ARG SOURCE_IMAGE="${BASE_IMAGE_NAME}-main" -ARG BASE_IMAGE="ghcr.io/ublue-os/${SOURCE_IMAGE}" +ARG FEDORA_MAJOR_VERSION="43" +ARG BASE_IMAGE="quay.io/fedora-ostree-desktops/silverblue" ARG COMMON_IMAGE="ghcr.io/projectbluefin/common:latest" ARG COMMON_IMAGE_SHA="" ARG BREW_IMAGE="ghcr.io/ublue-os/brew:latest" diff --git a/Justfile b/Justfile index bdce64409a6..3ebae285768 100644 --- a/Justfile +++ b/Justfile @@ -109,10 +109,6 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin common_image_sha=$(yq -r '.images[] | select(.name == "common") | .digest' image-versions.yml) brew_image_sha=$(yq -r '.images[] | select(.name == "brew") | .digest' image-versions.yml) - # Base Image - base_image_name="silverblue" - - # AKMODS Flavor and Kernel Version if [[ "${flavor}" =~ hwe ]]; then akmods_flavor="bazzite" @@ -131,7 +127,7 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}') # Verify Base Image with cosign - {{ just }} verify-container "${base_image_name}-main:${fedora_version}" + {{ just }} verify-container silverblue:${fedora_version} quay.io/fedora-ostree-desktops "https://gitlab.com/fedora/ostree/ci-test/-/raw/main/quay.io-fedora-ostree-desktops.pub?ref_type=heads" # Kernel Release/Pin if [[ -z "${kernel_pin:-}" ]]; then @@ -178,7 +174,6 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin target="dx" fi BUILD_ARGS+=("--build-arg" "AKMODS_FLAVOR=${akmods_flavor}") - BUILD_ARGS+=("--build-arg" "BASE_IMAGE_NAME=${base_image_name}") BUILD_ARGS+=("--build-arg" "COMMON_IMAGE={{ common_image }}") BUILD_ARGS+=("--build-arg" "COMMON_IMAGE_SHA=${common_image_sha}") BUILD_ARGS+=("--build-arg" "BREW_IMAGE={{ brew_image }}") @@ -326,11 +321,10 @@ rechunk $image="bluefin" $tag="latest" $flavor="main" ghcr="0" pipeline="0": # Cleanup Space during Github Action if [[ "{{ ghcr }}" == "1" ]]; then - base_image_name=silverblue-main if [[ "${tag}" =~ stable ]]; then tag="stable-daily" fi - ID=$(${SUDOIF} ${PODMAN} images --filter reference=ghcr.io/{{ repo_organization }}/"${base_image_name}":${fedora_version} --format "{{ '{{.ID}}' }}") + ID=$(${SUDOIF} ${PODMAN} images --filter reference=quay.io/fedora-ostree-desktops/silverblue --format "{{ '{{.ID}}' }}") if [[ -n "$ID" ]]; then ${PODMAN} rmi "$ID" fi diff --git a/build_files/base/04-packages.sh b/build_files/base/03-packages.sh similarity index 66% rename from build_files/base/04-packages.sh rename to build_files/base/03-packages.sh index d88e2ce70f6..f63074ed2b4 100755 --- a/build_files/base/04-packages.sh +++ b/build_files/base/03-packages.sh @@ -6,6 +6,43 @@ set -ouex pipefail # All DNF-related operations should be done here whenever possible +# use negativo17 for 3rd party packages with higher priority than default +# mitigate upstream packaging bug: https://bugzilla.redhat.com/show_bug.cgi?id=2332429 +# swap the incorrectly installed OpenCL-ICD-Loader for ocl-icd, the expected package +# TODO: remove me when F42 dropped, F43 is not affected +if [[ "$(rpm -E %fedora)" == "42" ]]; then +dnf5 -y swap --repo='fedora' \ + OpenCL-ICD-Loader ocl-icd +fi + +if ! grep -q fedora-multimedia <(dnf5 repolist); then + # Enable or Install Repofile + dnf5 config-manager setopt fedora-multimedia.enabled=1 || + dnf5 config-manager addrepo --from-repofile="https://negativo17.org/repos/fedora-multimedia.repo" +fi +# Set higher priority +dnf5 config-manager setopt fedora-multimedia.priority=90 + +# use override to replace mesa and others with less crippled versions +OVERRIDES=( + "intel-gmmlib" + "intel-mediasdk" + "intel-vpl-gpu-rt" + "libheif" + "libva" + "libva-intel-media-driver" + "mesa-dri-drivers" + "mesa-filesystem" + "mesa-libEGL" + "mesa-libGL" + "mesa-libgbm" + "mesa-va-drivers" + "mesa-vulkan-drivers" +) + +dnf5 distro-sync --skip-unavailable -y --repo='fedora-multimedia' "${OVERRIDES[@]}" +dnf5 versionlock add "${OVERRIDES[@]}" + # shellcheck source=build_files/shared/copr-helpers.sh source /ctx/build_files/shared/copr-helpers.sh @@ -20,9 +57,9 @@ FEDORA_PACKAGES=( adcli adw-gtk3-theme adwaita-fonts-all - bash-color-prompt + alsa-firmware + alsa-tools-firmware bcache-tools - bootc borgbackup containerd cryfs @@ -32,40 +69,58 @@ FEDORA_PACKAGES=( fastfetch firewall-config fish + flatpak-spawn foo2zjs fuse-encfs gcc git-credential-libsecret glow gnome-tweaks + google-noto-sans-balinese-fonts + google-noto-sans-cjk-fonts + google-noto-sans-javanese-fonts + google-noto-sans-sundanese-fonts + grub2-tools-extra gum - hplip + gvfs-nfs + htop ibus-mozc + ibus-unikey ifuse igt-gpu-tools input-remapper + intel-vaapi-driver iwd jetbrains-mono-fonts-all just krb5-workstation + libcamera-gstreamer + libcamera-tools libgda libgda-sqlite - libimobiledevice + libimobiledevice-utils libratbag-ratbagd libsss_autofs + libva-utils libxcrypt-compat lm_sensors + lshw make - mesa-libGLU mozc + mtools nautilus-gsconnect + net-tools + nvtop oddjob-mkhomedir opendyslexic-fonts + openrgb-udev-rules openssh-askpass + pam-u2f + pam_yubico + pamu2fcfg + pipewire-libs-extra powerstat powertop - printer-driver-brlaser - pulseaudio-utils python3-pip python3-pygit2 rclone @@ -76,18 +131,20 @@ FEDORA_PACKAGES=( samba-winbind-clients samba-winbind-modules setools-console + smartmontools + solaar-udev + squashfs-tools sssd-ad sssd-krb5 - sssd-nfs-idmap - switcheroo-control + symlinks + tcpdump tmux + traceroute usbip - usbmuxd + vim waypipe - wireguard-tools - wl-clipboard xdg-terminal-exec - xprop + yubikey-manager zenity zsh ) @@ -102,8 +159,6 @@ case "$FEDORA_MAJOR_VERSION" in ;; 43) FEDORA_PACKAGES+=( - evolution-ews-core - gnupg2-scdaemon ) ;; esac @@ -116,11 +171,17 @@ dnf config-manager addrepo --from-repofile=https://pkgs.tailscale.com/stable/fed dnf config-manager setopt tailscale-stable.enabled=0 dnf -y install --enablerepo='tailscale-stable' tailscale +dnf -y install --enablerepo=fedora-multimedia \ + -x PackageKit* \ + ffmpeg{,-libs} libavcodec @multimedia gstreamer1-plugins-{bad-free,bad-free-libs,good,base} lame{,-libs} libfdk-aac libjxl ffmpegthumbnailer + # From che/nerd-fonts copr_install_isolated "che/nerd-fonts" "nerd-fonts" # From ublue-os/packages -copr_install_isolated "ublue-os/packages" "uupd" +copr_install_isolated "ublue-os/packages" \ + "uupd" \ + "oversteer-udev" # Version-specific COPR packages # case "$FEDORA_MAJOR_VERSION" in @@ -136,26 +197,31 @@ copr_install_isolated "ublue-os/packages" "uupd" # Packages to exclude - common to all versions EXCLUDED_PACKAGES=( + default-fonts-cjk-sans fedora-bookmarks fedora-chromium-config fedora-chromium-config-gnome + fedora-third-party firefox firefox-langpacks gnome-extensions-app gnome-shell-extension-background-logo + gnome-software gnome-software-rpm-ostree gnome-terminal-nautilus + google-noto-sans-cjk-vf-fonts podman-docker + totem-video-thumbnailer yelp ) # Version-specific package exclusions case "$FEDORA_MAJOR_VERSION" in 42) - EXCLUDED_PACKAGES+=(gnome-software cosign) + EXCLUDED_PACKAGES+=() ;; 43) - EXCLUDED_PACKAGES+=(gnome-software cosign) + EXCLUDED_PACKAGES+=() ;; esac diff --git a/build_files/base/03-install-kernel-akmods.sh b/build_files/base/04-install-kernel-akmods.sh similarity index 94% rename from build_files/base/03-install-kernel-akmods.sh rename to build_files/base/04-install-kernel-akmods.sh index 3c8e79c13bf..cd17f34c67e 100755 --- a/build_files/base/03-install-kernel-akmods.sh +++ b/build_files/base/04-install-kernel-akmods.sh @@ -33,9 +33,11 @@ dnf5 -y install \ dnf5 versionlock add kernel kernel-devel kernel-devel-matched kernel-core kernel-modules kernel-modules-core kernel-modules-extra -# Everyone -# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -sed -i 's@enabled=0@enabled=1@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo +dnf copr enable -y ublue-os/akmods + +mkdir -p /etc/pki/akmods/certs +ghcurl "https://github.com/ublue-os/akmods/raw/refs/heads/main/certs/public_key.der" --retry 3 -Lo /etc/pki/akmods/certs/akmods-ublue.der +grep -F -e "Universal Blue" /etc/pki/akmods/certs/akmods-ublue.der # RPMFUSION Dependent AKMODS if [[ "${UBLUE_IMAGE_TAG}" == "beta" ]]; then @@ -122,4 +124,6 @@ if [[ ${AKMODS_FLAVOR} =~ coreos ]]; then echo "zfs" >/usr/lib/modules-load.d/zfs.conf fi +dnf copr disable -y ublue-os/akmods + echo "::endgroup::" diff --git a/build_files/base/05-override-install.sh b/build_files/base/05-override-install.sh index cc4613dc861..dea854a37a1 100755 --- a/build_files/base/05-override-install.sh +++ b/build_files/base/05-override-install.sh @@ -15,6 +15,23 @@ mkdir -p /usr/share/doc/bluefin ghcurl "https://github.com/ublue-os/bluefin-docs/releases/download/0.1/bluefin.pdf" --retry 3 -o /tmp/bluefin.pdf install -Dm0644 -t /usr/share/doc/bluefin/ /tmp/bluefin.pdf +# Footgun, See: https://github.com/ublue-os/main/issues/598 +rm -f /usr/bin/chsh /usr/bin/lchsh + +# Add linuxbrew to the list of paths usable by `sudo` +# not a sudoers.d override because we want to get updates from upstream and not break everything +sed -Ei "s/secure_path = (.*)/secure_path = \1:\/home\/linuxbrew\/.linuxbrew\/bin/" /etc/sudoers + +# https://github.com/ublue-os/main/pull/334 +ln -s "/usr/share/fonts/google-noto-sans-cjk-fonts" "/usr/share/fonts/noto-cjk" + + +# use CoreOS' generator for emergency/rescue boot +# see detail: https://github.com/ublue-os/main/issues/653 +mkdir -p /usr/lib/systemd/system-generators +ghcurl "https://raw.githubusercontent.com/coreos/fedora-coreos-config/refs/heads/stable/overlay.d/05core/usr/lib/systemd/system-generators/coreos-sulogin-force-generator" --retry 3 -Lo /usr/lib/systemd/system-generators/coreos-sulogin-force-generator +chmod +x /usr/lib/systemd/system-generators/coreos-sulogin-force-generator + # Starship Shell Prompt ghcurl "https://github.com/starship/starship/releases/latest/download/starship-x86_64-unknown-linux-gnu.tar.gz" --retry 3 -o /tmp/starship.tar.gz tar -xzf /tmp/starship.tar.gz -C /tmp @@ -26,18 +43,6 @@ sed -i "/picture-uri/ s/${HARDCODED_RPM_MONTH}/$(date +%m)/" "/usr/share/glib-2. rm /usr/share/glib-2.0/schemas/gschemas.compiled glib-compile-schemas /usr/share/glib-2.0/schemas -# Required for bluefin faces to work without conflicting with a ton of packages -rm -f /usr/share/pixmaps/faces/* || echo "Expected directory deletion to fail" -mv /usr/share/pixmaps/faces/bluefin/* /usr/share/pixmaps/faces -rm -rf /usr/share/pixmaps/faces/bluefin - -# Remove desktop entries -if [[ -f /usr/share/applications/gnome-system-monitor.desktop ]]; then - sed -i 's@\[Desktop Entry\]@\[Desktop Entry\]\nHidden=true@g' /usr/share/applications/gnome-system-monitor.desktop -fi -if [[ -f /usr/share/applications/org.gnome.SystemMonitor.desktop ]]; then - sed -i 's@\[Desktop Entry\]@\[Desktop Entry\]\nHidden=true@g' /usr/share/applications/org.gnome.SystemMonitor.desktop -fi # Add Mutter experimental-features if [[ "${IMAGE_NAME}" =~ nvidia ]]; then diff --git a/build_files/base/17-cleanup.sh b/build_files/base/17-cleanup.sh index c06c6114c2a..556c895843c 100755 --- a/build_files/base/17-cleanup.sh +++ b/build_files/base/17-cleanup.sh @@ -45,7 +45,7 @@ systemctl disable flatpak-add-fedora-repos.service # We only need to clean up repos that were enabled during the build process. # Disable third-party repos -for repo in negativo17-fedora-multimedia tailscale fedora-cisco-openh264; do +for repo in fedora-multimedia tailscale fedora-cisco-openh264; do if [[ -f "/etc/yum.repos.d/${repo}.repo" ]]; then sed -i 's@enabled=1@enabled=0@g' "/etc/yum.repos.d/${repo}.repo" fi @@ -58,11 +58,6 @@ for i in /etc/yum.repos.d/_copr:*.repo; do fi done -# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -if [[ -f "/etc/yum.repos.d/_copr_ublue-os-akmods.repo" ]]; then - sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo -fi - # Disable RPM Fusion repos for i in /etc/yum.repos.d/rpmfusion-*.repo; do if [[ -f "$i" ]]; then diff --git a/build_files/base/20-tests.sh b/build_files/base/20-tests.sh index 784f3fb1910..f9ecdc56a41 100755 --- a/build_files/base/20-tests.sh +++ b/build_files/base/20-tests.sh @@ -54,10 +54,28 @@ for package in "${IMPORTANT_PACKAGES[@]}"; do rpm -q "${package}" >/dev/null || { echo "Missing package: ${package}... Exiting"; exit 1 ; } done +# these should be sourced from negativo's fedora-multimedia repo +# as Fedora can't ship patent encumbered video codecs +NEGATIVO=( + ffmpeg + libheif + libva + mesa-filesystem + mesa-va-drivers + pipewire-libs-extra + x264-libs + x265-libs +) + +for package in "${NEGATIVO[@]}"; do + rpm -q --qf "%{NAME} %{VENDOR}" "${package}" | grep -q "negativo17\.org" || { echo "${package} not from negativo... Exiting"; exit 1 ; } +done # these packages are supposed to be removed # and are considered footguns UNWANTED_PACKAGES=( + fedora-flathub-remote fedora-logos + fedora-third-party firefox gnome-software gnome-software-rpm-ostree diff --git a/build_files/dx/00-dx.sh b/build_files/dx/00-dx.sh index 7e30f6a3c39..660388273b6 100755 --- a/build_files/dx/00-dx.sh +++ b/build_files/dx/00-dx.sh @@ -121,7 +121,7 @@ systemctl enable bluefin-dx-groups.service sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo # NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo +sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr:copr.fedorainfracloud.org:ublue-os:akmods.repo # Disable RPM Fusion repos for i in /etc/yum.repos.d/rpmfusion-*.repo; do diff --git a/build_files/shared/build.sh b/build_files/shared/build.sh index dfa14e4c750..4e9152d794f 100755 --- a/build_files/shared/build.sh +++ b/build_files/shared/build.sh @@ -4,9 +4,6 @@ set -eoux pipefail echo "::group:: Copy Files" -# We need to remove this package here because lots of files we add from `projectbluefin/common` override the rpm files and they also go away when you do `dnf remove` -dnf remove -y ublue-os-luks ublue-os-just ublue-os-udev-rules ublue-os-signing ublue-os-update-services - # Keep *-logos in RPM DB for downstream package installations # We are not allowed to ship an empty fedora-logos package dnf -y swap fedora-logos generic-logos @@ -24,11 +21,11 @@ echo "::endgroup::" # Generate image-info.json /ctx/build_files/base/00-image-info.sh -# Install Kernel and Akmods -/ctx/build_files/base/03-install-kernel-akmods.sh - # Install Additional Packages -/ctx/build_files/base/04-packages.sh +/ctx/build_files/base/03-packages.sh + +# Install Kernel and Akmods +/ctx/build_files/base/04-install-kernel-akmods.sh # Install Overrides and Fetch Install /ctx/build_files/base/05-override-install.sh diff --git a/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf b/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf new file mode 100644 index 00000000000..b1683a8ed35 --- /dev/null +++ b/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf @@ -0,0 +1,4 @@ +# Changing ID from `fedora` to anything thats not fedora/centos/rhel breaks the COPR plugin +# It'll try to load repositories for `bluefin-43` and fail +[main] +distribution = fedora