From d6631ead14e82e9db47e9bc108d180f2496e0567 Mon Sep 17 00:00:00 2001 From: Tulip Blossom Date: Sun, 11 Jan 2026 00:50:19 -0300 Subject: [PATCH 01/15] feat: move to timothee's `ci-test` silverblue image We don't really need anymore, this should trim down on a few packages over time. THIS ALSO UNBLOCKS ARM which is amazing Signed-off-by: Tulip Blossom --- .github/renovate.json5 | 2 +- Containerfile | 5 +- Justfile | 10 +--- build_files/base/03-install-kernel-akmods.sh | 10 ++-- build_files/base/04-packages.sh | 50 +++++++++++++++++++ build_files/base/05-override-install.sh | 29 ++++++----- build_files/base/17-cleanup.sh | 7 +-- build_files/dx/00-dx.sh | 2 +- build_files/shared/build.sh | 3 -- .../usr/share/dnf/plugins/copr.vendor.conf | 4 ++ 10 files changed, 85 insertions(+), 37 deletions(-) create mode 100644 system_files/shared/usr/share/dnf/plugins/copr.vendor.conf diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 3ac108bfc1c..85e17f5add2 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -42,7 +42,7 @@ "automerge": true, "matchUpdateTypes": ["digest"], "matchDepNames": [ - "ghcr.io/ublue-os/silverblue-main", + "quay.io/fedora-ostree-desktops/silverblue" "ghcr.io/projectbluefin/common" ] } diff --git a/Containerfile b/Containerfile index c5fd357aeff..bb54f2a613d 100644 --- a/Containerfile +++ b/Containerfile @@ -1,7 +1,6 @@ ARG BASE_IMAGE_NAME="silverblue" -ARG FEDORA_MAJOR_VERSION="42" -ARG SOURCE_IMAGE="${BASE_IMAGE_NAME}-main" -ARG BASE_IMAGE="ghcr.io/ublue-os/${SOURCE_IMAGE}" +ARG FEDORA_MAJOR_VERSION="43" +ARG BASE_IMAGE="quay.io/fedora-ostree-desktops/silverblue" ARG COMMON_IMAGE="ghcr.io/projectbluefin/common:latest" ARG COMMON_IMAGE_SHA="" ARG BREW_IMAGE="ghcr.io/ublue-os/brew:latest" diff --git a/Justfile b/Justfile index bdce64409a6..3ebae285768 100644 --- a/Justfile +++ b/Justfile @@ -109,10 +109,6 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin common_image_sha=$(yq -r '.images[] | select(.name == "common") | .digest' image-versions.yml) brew_image_sha=$(yq -r '.images[] | select(.name == "brew") | .digest' image-versions.yml) - # Base Image - base_image_name="silverblue" - - # AKMODS Flavor and Kernel Version if [[ "${flavor}" =~ hwe ]]; then akmods_flavor="bazzite" @@ -131,7 +127,7 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}') # Verify Base Image with cosign - {{ just }} verify-container "${base_image_name}-main:${fedora_version}" + {{ just }} verify-container silverblue:${fedora_version} quay.io/fedora-ostree-desktops "https://gitlab.com/fedora/ostree/ci-test/-/raw/main/quay.io-fedora-ostree-desktops.pub?ref_type=heads" # Kernel Release/Pin if [[ -z "${kernel_pin:-}" ]]; then @@ -178,7 +174,6 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin target="dx" fi BUILD_ARGS+=("--build-arg" "AKMODS_FLAVOR=${akmods_flavor}") - BUILD_ARGS+=("--build-arg" "BASE_IMAGE_NAME=${base_image_name}") BUILD_ARGS+=("--build-arg" "COMMON_IMAGE={{ common_image }}") BUILD_ARGS+=("--build-arg" "COMMON_IMAGE_SHA=${common_image_sha}") BUILD_ARGS+=("--build-arg" "BREW_IMAGE={{ brew_image }}") @@ -326,11 +321,10 @@ rechunk $image="bluefin" $tag="latest" $flavor="main" ghcr="0" pipeline="0": # Cleanup Space during Github Action if [[ "{{ ghcr }}" == "1" ]]; then - base_image_name=silverblue-main if [[ "${tag}" =~ stable ]]; then tag="stable-daily" fi - ID=$(${SUDOIF} ${PODMAN} images --filter reference=ghcr.io/{{ repo_organization }}/"${base_image_name}":${fedora_version} --format "{{ '{{.ID}}' }}") + ID=$(${SUDOIF} ${PODMAN} images --filter reference=quay.io/fedora-ostree-desktops/silverblue --format "{{ '{{.ID}}' }}") if [[ -n "$ID" ]]; then ${PODMAN} rmi "$ID" fi diff --git a/build_files/base/03-install-kernel-akmods.sh b/build_files/base/03-install-kernel-akmods.sh index 3c8e79c13bf..cd17f34c67e 100755 --- a/build_files/base/03-install-kernel-akmods.sh +++ b/build_files/base/03-install-kernel-akmods.sh @@ -33,9 +33,11 @@ dnf5 -y install \ dnf5 versionlock add kernel kernel-devel kernel-devel-matched kernel-core kernel-modules kernel-modules-core kernel-modules-extra -# Everyone -# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -sed -i 's@enabled=0@enabled=1@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo +dnf copr enable -y ublue-os/akmods + +mkdir -p /etc/pki/akmods/certs +ghcurl "https://github.com/ublue-os/akmods/raw/refs/heads/main/certs/public_key.der" --retry 3 -Lo /etc/pki/akmods/certs/akmods-ublue.der +grep -F -e "Universal Blue" /etc/pki/akmods/certs/akmods-ublue.der # RPMFUSION Dependent AKMODS if [[ "${UBLUE_IMAGE_TAG}" == "beta" ]]; then @@ -122,4 +124,6 @@ if [[ ${AKMODS_FLAVOR} =~ coreos ]]; then echo "zfs" >/usr/lib/modules-load.d/zfs.conf fi +dnf copr disable -y ublue-os/akmods + echo "::endgroup::" diff --git a/build_files/base/04-packages.sh b/build_files/base/04-packages.sh index 2a887934964..b3e60e45d9c 100755 --- a/build_files/base/04-packages.sh +++ b/build_files/base/04-packages.sh @@ -89,8 +89,48 @@ FEDORA_PACKAGES=( xprop zenity zsh + adw-gtk3-theme + gvfs-nfs + ibus-unikey + ibus-mozc + + alsa-firmware + alsa-tools-firmware + flatpak-spawn + pipewire-libs-extra + oversteer-udev + google-noto-sans-cjk-fonts + grub2-tools-extra + htop + intel-vaapi-driver + libcamera-gstreamer + libcamera-tools + libimobiledevice-utils + libva-utils + lshw + mtools + net-tools + ocl-icd + openrgb-udev-rules + oversteer-udev + pam-u2f + pam_yubico + pamu2fcfg + pipewire-libs-extra + smartmontools + solaar-udev + squashfs-tools + symlinks + tcpdump + traceroute + vim + yubikey-manager ) +if [[ "${IMAGE_NAME}" =~ nvidia ]]; then + dnf install -y nvtop +fi + # Version-specific Fedora package additions case "$FEDORA_MAJOR_VERSION" in 42) @@ -115,6 +155,12 @@ dnf config-manager addrepo --from-repofile=https://pkgs.tailscale.com/stable/fed dnf config-manager setopt tailscale-stable.enabled=0 dnf -y install --enablerepo='tailscale-stable' tailscale +dnf config-manager addrepo --from-repofile=https://negativo17.org/repos/fedora-multimedia.repo +dnf config-manager setopt fedora-multimedia.enabled=0 +dnf -y install --enablerepo=fedora-multimedia \ + -x PackageKit* \ + ffmpeg libavcodec @multimedia gstreamer1-plugins-{bad-free,bad-free-libs,good,base} lame{,-libs} libjxl ffmpegthumbnailer + # From che/nerd-fonts copr_install_isolated "che/nerd-fonts" "nerd-fonts" @@ -146,6 +192,10 @@ EXCLUDED_PACKAGES=( gnome-terminal-nautilus podman-docker yelp + totem-video-thumbnailer + gnome-software + google-noto-sans-cjk-vf-fonts + default-fonts-cjk-sans ) # Version-specific package exclusions diff --git a/build_files/base/05-override-install.sh b/build_files/base/05-override-install.sh index 238f8d37418..4f478557842 100755 --- a/build_files/base/05-override-install.sh +++ b/build_files/base/05-override-install.sh @@ -15,6 +15,23 @@ mkdir -p /usr/share/doc/bluefin ghcurl "https://github.com/ublue-os/bluefin-docs/releases/download/0.1/bluefin.pdf" --retry 3 -o /tmp/bluefin.pdf install -Dm0644 -t /usr/share/doc/bluefin/ /tmp/bluefin.pdf +# Footgun, See: https://github.com/ublue-os/main/issues/598 +rm -f /usr/bin/chsh /usr/bin/lchsh + +# Add linuxbrew to the list of paths usable by `sudo` +# not a sudoers.d override because we want to get updates from upstream and not break everything +sed -Ei "s/secure_path = (.*)/secure_path = \1:\/home\/linuxbrew\/.linuxbrew\/bin/" /etc/sudoers + +# https://github.com/ublue-os/main/pull/334 +ln -s "/usr/share/fonts/google-noto-sans-cjk-fonts" "/usr/share/fonts/noto-cjk" + + +# use CoreOS' generator for emergency/rescue boot +# see detail: https://github.com/ublue-os/main/issues/653 +mkdir -p /usr/lib/systemd/system-generators +ghcurl "https://raw.githubusercontent.com/coreos/fedora-coreos-config/refs/heads/stable/overlay.d/05core/usr/lib/systemd/system-generators/coreos-sulogin-force-generator" --retry 3 -Lo /usr/lib/systemd/system-generators/coreos-sulogin-force-generator +chmod +x /usr/lib/systemd/system-generators/coreos-sulogin-force-generator + # Starship Shell Prompt ghcurl "https://github.com/starship/starship/releases/latest/download/starship-x86_64-unknown-linux-gnu.tar.gz" --retry 3 -o /tmp/starship.tar.gz tar -xzf /tmp/starship.tar.gz -C /tmp @@ -28,18 +45,6 @@ sed -i "/picture-uri/ s/${HARDCODED_RPM_MONTH}/$(date +%m)/" "/usr/share/glib-2. rm /usr/share/glib-2.0/schemas/gschemas.compiled glib-compile-schemas /usr/share/glib-2.0/schemas -# Required for bluefin faces to work without conflicting with a ton of packages -rm -f /usr/share/pixmaps/faces/* || echo "Expected directory deletion to fail" -mv /usr/share/pixmaps/faces/bluefin/* /usr/share/pixmaps/faces -rm -rf /usr/share/pixmaps/faces/bluefin - -# Remove desktop entries -if [[ -f /usr/share/applications/gnome-system-monitor.desktop ]]; then - sed -i 's@\[Desktop Entry\]@\[Desktop Entry\]\nHidden=true@g' /usr/share/applications/gnome-system-monitor.desktop -fi -if [[ -f /usr/share/applications/org.gnome.SystemMonitor.desktop ]]; then - sed -i 's@\[Desktop Entry\]@\[Desktop Entry\]\nHidden=true@g' /usr/share/applications/org.gnome.SystemMonitor.desktop -fi # Add Mutter experimental-features if [[ "${IMAGE_NAME}" =~ nvidia ]]; then diff --git a/build_files/base/17-cleanup.sh b/build_files/base/17-cleanup.sh index c06c6114c2a..556c895843c 100755 --- a/build_files/base/17-cleanup.sh +++ b/build_files/base/17-cleanup.sh @@ -45,7 +45,7 @@ systemctl disable flatpak-add-fedora-repos.service # We only need to clean up repos that were enabled during the build process. # Disable third-party repos -for repo in negativo17-fedora-multimedia tailscale fedora-cisco-openh264; do +for repo in fedora-multimedia tailscale fedora-cisco-openh264; do if [[ -f "/etc/yum.repos.d/${repo}.repo" ]]; then sed -i 's@enabled=1@enabled=0@g' "/etc/yum.repos.d/${repo}.repo" fi @@ -58,11 +58,6 @@ for i in /etc/yum.repos.d/_copr:*.repo; do fi done -# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -if [[ -f "/etc/yum.repos.d/_copr_ublue-os-akmods.repo" ]]; then - sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo -fi - # Disable RPM Fusion repos for i in /etc/yum.repos.d/rpmfusion-*.repo; do if [[ -f "$i" ]]; then diff --git a/build_files/dx/00-dx.sh b/build_files/dx/00-dx.sh index 7e30f6a3c39..660388273b6 100755 --- a/build_files/dx/00-dx.sh +++ b/build_files/dx/00-dx.sh @@ -121,7 +121,7 @@ systemctl enable bluefin-dx-groups.service sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo # NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming -sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo +sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr:copr.fedorainfracloud.org:ublue-os:akmods.repo # Disable RPM Fusion repos for i in /etc/yum.repos.d/rpmfusion-*.repo; do diff --git a/build_files/shared/build.sh b/build_files/shared/build.sh index b2bdd5735cb..d6da353ec73 100755 --- a/build_files/shared/build.sh +++ b/build_files/shared/build.sh @@ -4,9 +4,6 @@ set -eoux pipefail echo "::group:: Copy Files" -# We need to remove this package here because lots of files we add from `projectbluefin/common` override the rpm files and they also go away when you do `dnf remove` -dnf remove -y ublue-os-luks ublue-os-just ublue-os-udev-rules ublue-os-signing ublue-os-update-services - # Conflicts with a ton of packages, has to be removed before we copy all the files as well rpm --erase --nodeps fedora-logos diff --git a/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf b/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf new file mode 100644 index 00000000000..b1683a8ed35 --- /dev/null +++ b/system_files/shared/usr/share/dnf/plugins/copr.vendor.conf @@ -0,0 +1,4 @@ +# Changing ID from `fedora` to anything thats not fedora/centos/rhel breaks the COPR plugin +# It'll try to load repositories for `bluefin-43` and fail +[main] +distribution = fedora From 2295b1b8d8c2f662dc8dbc83826b6fc36a5cf390 Mon Sep 17 00:00:00 2001 From: renner Date: Sat, 31 Jan 2026 20:31:23 +0100 Subject: [PATCH 02/15] feat: add codecs from negativo also removes additions from here that are already in the base image like bootc, wl-clipboard --- build_files/base/04-packages.sh | 123 +++++++++++++++++--------------- build_files/base/20-tests.sh | 2 + 2 files changed, 69 insertions(+), 56 deletions(-) diff --git a/build_files/base/04-packages.sh b/build_files/base/04-packages.sh index b3e60e45d9c..fd7cabfbc67 100755 --- a/build_files/base/04-packages.sh +++ b/build_files/base/04-packages.sh @@ -5,6 +5,35 @@ echo "::group:: ===$(basename "$0")===" set -ouex pipefail # All DNF-related operations should be done here whenever possible +# +# use negativo17 for 3rd party packages with higher priority than default +if ! grep -q fedora-multimedia <(dnf5 repolist); then + # Enable or Install Repofile + dnf5 config-manager setopt fedora-multimedia.enabled=1 || + dnf5 config-manager addrepo --from-repofile="https://negativo17.org/repos/fedora-multimedia.repo" +fi +# Set higher priority +dnf5 config-manager setopt fedora-multimedia.priority=90 + +# use override to replace mesa and others with less crippled versions +OVERRIDES=( + "intel-gmmlib" + "intel-mediasdk" + "intel-vpl-gpu-rt" + "libheif" + "libva" + "libva-intel-media-driver" + "mesa-dri-drivers" + "mesa-filesystem" + "mesa-libEGL" + "mesa-libGL" + "mesa-libgbm" + "mesa-va-drivers" + "mesa-vulkan-drivers" +) + +dnf5 distro-sync --skip-unavailable -y --repo='fedora-multimedia' "${OVERRIDES[@]}" +dnf5 versionlock add "${OVERRIDES[@]}" # shellcheck source=build_files/shared/copr-helpers.sh source /ctx/build_files/shared/copr-helpers.sh @@ -14,15 +43,14 @@ source /ctx/build_files/shared/copr-helpers.sh # malicious COPRs from injecting fake versions of Fedora packages. # Fedora packages are installed first in bulk (safe). # COPR packages are installed individually with isolated enablement. - # Base packages from Fedora repos - common to all versions FEDORA_PACKAGES=( adcli adw-gtk3-theme adwaita-fonts-all - bash-color-prompt + alsa-firmware + alsa-tools-firmware bcache-tools - bootc borgbackup containerd cryfs @@ -32,40 +60,55 @@ FEDORA_PACKAGES=( fastfetch firewall-config fish + flatpak-spawn foo2zjs fuse-encfs gcc git-credential-libsecret glow gnome-tweaks + google-noto-sans-cjk-fonts + grub2-tools-extra gum - hplip + gvfs-nfs + htop ibus-mozc + ibus-unikey ifuse igt-gpu-tools input-remapper + intel-vaapi-driver iwd jetbrains-mono-fonts-all just krb5-workstation + libcamera-gstreamer + libcamera-tools libgda libgda-sqlite - libimobiledevice + libimobiledevice-utils libratbag-ratbagd libsss_autofs + libva-utils libxcrypt-compat lm_sensors + lshw make - mesa-libGLU mozc + mtools nautilus-gsconnect + net-tools + ocl-icd oddjob-mkhomedir opendyslexic-fonts + openrgb-udev-rules openssh-askpass + pam-u2f + pam_yubico + pamu2fcfg + pipewire-libs-extra powerstat powertop - printer-driver-brlaser - pulseaudio-utils python3-pip python3-pygit2 rclone @@ -76,55 +119,22 @@ FEDORA_PACKAGES=( samba-winbind-clients samba-winbind-modules setools-console - sssd-ad - sssd-krb5 - sssd-nfs-idmap - switcheroo-control - tmux - usbip - usbmuxd - waypipe - wireguard-tools - wl-clipboard - xprop - zenity - zsh - adw-gtk3-theme - gvfs-nfs - ibus-unikey - ibus-mozc - - alsa-firmware - alsa-tools-firmware - flatpak-spawn - pipewire-libs-extra - oversteer-udev - google-noto-sans-cjk-fonts - grub2-tools-extra - htop - intel-vaapi-driver - libcamera-gstreamer - libcamera-tools - libimobiledevice-utils - libva-utils - lshw - mtools - net-tools - ocl-icd - openrgb-udev-rules - oversteer-udev - pam-u2f - pam_yubico - pamu2fcfg - pipewire-libs-extra smartmontools solaar-udev squashfs-tools + sssd-ad + sssd-krb5 symlinks tcpdump + tmux traceroute + usbip vim + waypipe + xdg-terminal-exec yubikey-manager + zenity + zsh ) if [[ "${IMAGE_NAME}" =~ nvidia ]]; then @@ -155,8 +165,6 @@ dnf config-manager addrepo --from-repofile=https://pkgs.tailscale.com/stable/fed dnf config-manager setopt tailscale-stable.enabled=0 dnf -y install --enablerepo='tailscale-stable' tailscale -dnf config-manager addrepo --from-repofile=https://negativo17.org/repos/fedora-multimedia.repo -dnf config-manager setopt fedora-multimedia.enabled=0 dnf -y install --enablerepo=fedora-multimedia \ -x PackageKit* \ ffmpeg libavcodec @multimedia gstreamer1-plugins-{bad-free,bad-free-libs,good,base} lame{,-libs} libjxl ffmpegthumbnailer @@ -165,7 +173,9 @@ dnf -y install --enablerepo=fedora-multimedia \ copr_install_isolated "che/nerd-fonts" "nerd-fonts" # From ublue-os/packages -copr_install_isolated "ublue-os/packages" "uupd" +copr_install_isolated "ublue-os/packages" \ + "uupd" \ + "oversteer-udev" # Version-specific COPR packages # case "$FEDORA_MAJOR_VERSION" in @@ -181,21 +191,22 @@ copr_install_isolated "ublue-os/packages" "uupd" # Packages to exclude - common to all versions EXCLUDED_PACKAGES=( + default-fonts-cjk-sans fedora-bookmarks fedora-chromium-config fedora-chromium-config-gnome + fedora-third-party firefox firefox-langpacks gnome-extensions-app gnome-shell-extension-background-logo + gnome-software gnome-software-rpm-ostree gnome-terminal-nautilus + google-noto-sans-cjk-vf-fonts podman-docker - yelp totem-video-thumbnailer - gnome-software - google-noto-sans-cjk-vf-fonts - default-fonts-cjk-sans + yelp ) # Version-specific package exclusions diff --git a/build_files/base/20-tests.sh b/build_files/base/20-tests.sh index 784f3fb1910..dca7bebfbd3 100755 --- a/build_files/base/20-tests.sh +++ b/build_files/base/20-tests.sh @@ -57,7 +57,9 @@ done # these packages are supposed to be removed # and are considered footguns UNWANTED_PACKAGES=( + fedora-flathub-remote fedora-logos + fedora-third-party firefox gnome-software gnome-software-rpm-ostree From b0d1950c830cee61dbd95bee8aaad9140853f48c Mon Sep 17 00:00:00 2001 From: renner Date: Sat, 31 Jan 2026 20:53:41 +0100 Subject: [PATCH 03/15] fix: renovate syntax --- .github/renovate.json5 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 85e17f5add2..a21bac19103 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -42,7 +42,7 @@ "automerge": true, "matchUpdateTypes": ["digest"], "matchDepNames": [ - "quay.io/fedora-ostree-desktops/silverblue" + "quay.io/fedora-ostree-desktops/silverblue", "ghcr.io/projectbluefin/common" ] } From c49ad7baad3079d5294cc39d78d289275abafa96 Mon Sep 17 00:00:00 2001 From: renner Date: Sat, 31 Jan 2026 21:28:37 +0100 Subject: [PATCH 04/15] feat: add opencl-icd-loader workaround for F42 --- build_files/base/04-packages.sh | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/build_files/base/04-packages.sh b/build_files/base/04-packages.sh index fd7cabfbc67..82bf4e4503e 100755 --- a/build_files/base/04-packages.sh +++ b/build_files/base/04-packages.sh @@ -5,8 +5,16 @@ echo "::group:: ===$(basename "$0")===" set -ouex pipefail # All DNF-related operations should be done here whenever possible -# + # use negativo17 for 3rd party packages with higher priority than default +# mitigate upstream packaging bug: https://bugzilla.redhat.com/show_bug.cgi?id=2332429 +# swap the incorrectly installed OpenCL-ICD-Loader for ocl-icd, the expected package +# TODO: remove me when F42 dropped, F43 is not affected +if [[ "$(rpm -E %fedora)" == "42" ]]; then +dnf5 -y swap --repo='fedora' \ + OpenCL-ICD-Loader ocl-icd +fi + if ! grep -q fedora-multimedia <(dnf5 repolist); then # Enable or Install Repofile dnf5 config-manager setopt fedora-multimedia.enabled=1 || From 0136249a14eeab18f8f2f92d7803c448666d6893 Mon Sep 17 00:00:00 2001 From: renner Date: Sat, 31 Jan 2026 21:31:02 +0100 Subject: [PATCH 05/15] fix: add nvtop back for all images --- build_files/base/04-packages.sh | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/build_files/base/04-packages.sh b/build_files/base/04-packages.sh index 82bf4e4503e..d1cf8fbcf44 100755 --- a/build_files/base/04-packages.sh +++ b/build_files/base/04-packages.sh @@ -51,6 +51,7 @@ source /ctx/build_files/shared/copr-helpers.sh # malicious COPRs from injecting fake versions of Fedora packages. # Fedora packages are installed first in bulk (safe). # COPR packages are installed individually with isolated enablement. + # Base packages from Fedora repos - common to all versions FEDORA_PACKAGES=( adcli @@ -118,6 +119,7 @@ FEDORA_PACKAGES=( powerstat powertop python3-pip + nvtop python3-pygit2 rclone restic @@ -145,10 +147,6 @@ FEDORA_PACKAGES=( zsh ) -if [[ "${IMAGE_NAME}" =~ nvidia ]]; then - dnf install -y nvtop -fi - # Version-specific Fedora package additions case "$FEDORA_MAJOR_VERSION" in 42) From adf571956c3d969870b02d32d793bcd701de4152 Mon Sep 17 00:00:00 2001 From: renner Date: Sat, 31 Jan 2026 21:34:04 +0100 Subject: [PATCH 06/15] chore: remove packages already in base image These are only in F43, they still need to be added in F42 --- build_files/base/04-packages.sh | 2 -- 1 file changed, 2 deletions(-) diff --git a/build_files/base/04-packages.sh b/build_files/base/04-packages.sh index d1cf8fbcf44..a6164333ed0 100755 --- a/build_files/base/04-packages.sh +++ b/build_files/base/04-packages.sh @@ -157,8 +157,6 @@ case "$FEDORA_MAJOR_VERSION" in ;; 43) FEDORA_PACKAGES+=( - evolution-ews-core - gnupg2-scdaemon ) ;; esac From 67f93b99fb2472c20349c9c9b207408d2dc81c4c Mon Sep 17 00:00:00 2001 From: renner Date: Sat, 31 Jan 2026 23:25:55 +0100 Subject: [PATCH 07/15] chore: remove cosign exclusion only ublue-os/main had cosign, the new base image doesn't --- build_files/base/04-packages.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build_files/base/04-packages.sh b/build_files/base/04-packages.sh index a6164333ed0..300c78a53d3 100755 --- a/build_files/base/04-packages.sh +++ b/build_files/base/04-packages.sh @@ -216,10 +216,10 @@ EXCLUDED_PACKAGES=( # Version-specific package exclusions case "$FEDORA_MAJOR_VERSION" in 42) - EXCLUDED_PACKAGES+=(gnome-software cosign) + EXCLUDED_PACKAGES+=(gnome-software) ;; 43) - EXCLUDED_PACKAGES+=(gnome-software cosign) + EXCLUDED_PACKAGES+=(gnome-software) ;; esac From 892d550ccb943b3d153a46a218a57c9e283e923e Mon Sep 17 00:00:00 2001 From: renner Date: Sat, 31 Jan 2026 23:27:47 +0100 Subject: [PATCH 08/15] chore: remove gnome-software exclusion This used to be needed when bazaar was not yet added to gts. F42 builds have bazaar now and all bluefin versions don't ship gnome-software anymore. --- build_files/base/04-packages.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build_files/base/04-packages.sh b/build_files/base/04-packages.sh index 300c78a53d3..fb49f4c1d2e 100755 --- a/build_files/base/04-packages.sh +++ b/build_files/base/04-packages.sh @@ -216,10 +216,10 @@ EXCLUDED_PACKAGES=( # Version-specific package exclusions case "$FEDORA_MAJOR_VERSION" in 42) - EXCLUDED_PACKAGES+=(gnome-software) + EXCLUDED_PACKAGES+=() ;; 43) - EXCLUDED_PACKAGES+=(gnome-software) + EXCLUDED_PACKAGES+=() ;; esac From 1e2e5068387c1f024b079cd372a4182c39cd7a68 Mon Sep 17 00:00:00 2001 From: renner Date: Sun, 1 Feb 2026 01:03:46 +0100 Subject: [PATCH 09/15] fix: add missing fonts --- build_files/base/04-packages.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/build_files/base/04-packages.sh b/build_files/base/04-packages.sh index fb49f4c1d2e..43b2f1bef72 100755 --- a/build_files/base/04-packages.sh +++ b/build_files/base/04-packages.sh @@ -76,7 +76,10 @@ FEDORA_PACKAGES=( git-credential-libsecret glow gnome-tweaks + google-noto-sans-balinese-fonts google-noto-sans-cjk-fonts + google-noto-sans-javanese-fonts + google-noto-sans-sundanese-fonts grub2-tools-extra gum gvfs-nfs From ddfc41ddc3a732052d6647e33751d3e8c9e1f9e8 Mon Sep 17 00:00:00 2001 From: renner Date: Sun, 1 Feb 2026 01:05:18 +0100 Subject: [PATCH 10/15] fix: remove ocl-icd the swap takes care of that --- build_files/base/04-packages.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/build_files/base/04-packages.sh b/build_files/base/04-packages.sh index 43b2f1bef72..6733995b225 100755 --- a/build_files/base/04-packages.sh +++ b/build_files/base/04-packages.sh @@ -110,7 +110,6 @@ FEDORA_PACKAGES=( mtools nautilus-gsconnect net-tools - ocl-icd oddjob-mkhomedir opendyslexic-fonts openrgb-udev-rules From 8337380ae3463efc1dd7776373ab63aea1dfb087 Mon Sep 17 00:00:00 2001 From: renner Date: Sun, 1 Feb 2026 01:08:16 +0100 Subject: [PATCH 11/15] sort nvtop --- build_files/base/04-packages.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build_files/base/04-packages.sh b/build_files/base/04-packages.sh index 6733995b225..98cd6527379 100755 --- a/build_files/base/04-packages.sh +++ b/build_files/base/04-packages.sh @@ -110,6 +110,7 @@ FEDORA_PACKAGES=( mtools nautilus-gsconnect net-tools + nvtop oddjob-mkhomedir opendyslexic-fonts openrgb-udev-rules @@ -121,7 +122,6 @@ FEDORA_PACKAGES=( powerstat powertop python3-pip - nvtop python3-pygit2 rclone restic From 326610f6758ec38b3a950be79d50f100266e8e9a Mon Sep 17 00:00:00 2001 From: renner Date: Mon, 2 Feb 2026 20:39:45 +0100 Subject: [PATCH 12/15] fix: nvidia mesa negativo mismatch We need this so packages like mesa-filesystem don't conflict because of the nvidia-install script, this causes them to get installed from fedora and not negativo related: https://github.com/ublue-os/aurora/pull/1693 --- build_files/base/{04-packages.sh => 03-packages.sh} | 0 ...stall-kernel-akmods.sh => 04-install-kernel-akmods.sh} | 0 build_files/shared/build.sh | 8 ++++---- 3 files changed, 4 insertions(+), 4 deletions(-) rename build_files/base/{04-packages.sh => 03-packages.sh} (100%) rename build_files/base/{03-install-kernel-akmods.sh => 04-install-kernel-akmods.sh} (100%) diff --git a/build_files/base/04-packages.sh b/build_files/base/03-packages.sh similarity index 100% rename from build_files/base/04-packages.sh rename to build_files/base/03-packages.sh diff --git a/build_files/base/03-install-kernel-akmods.sh b/build_files/base/04-install-kernel-akmods.sh similarity index 100% rename from build_files/base/03-install-kernel-akmods.sh rename to build_files/base/04-install-kernel-akmods.sh diff --git a/build_files/shared/build.sh b/build_files/shared/build.sh index be1749d3a4b..4e9152d794f 100755 --- a/build_files/shared/build.sh +++ b/build_files/shared/build.sh @@ -21,11 +21,11 @@ echo "::endgroup::" # Generate image-info.json /ctx/build_files/base/00-image-info.sh -# Install Kernel and Akmods -/ctx/build_files/base/03-install-kernel-akmods.sh - # Install Additional Packages -/ctx/build_files/base/04-packages.sh +/ctx/build_files/base/03-packages.sh + +# Install Kernel and Akmods +/ctx/build_files/base/04-install-kernel-akmods.sh # Install Overrides and Fetch Install /ctx/build_files/base/05-override-install.sh From 0042f890ebe045ee50e0f2fc31bc96892b5e6e3d Mon Sep 17 00:00:00 2001 From: renner Date: Mon, 2 Feb 2026 21:10:15 +0100 Subject: [PATCH 13/15] test: make sure negativo packages are from negativo --- build_files/base/20-tests.sh | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/build_files/base/20-tests.sh b/build_files/base/20-tests.sh index dca7bebfbd3..f9ecdc56a41 100755 --- a/build_files/base/20-tests.sh +++ b/build_files/base/20-tests.sh @@ -54,6 +54,22 @@ for package in "${IMPORTANT_PACKAGES[@]}"; do rpm -q "${package}" >/dev/null || { echo "Missing package: ${package}... Exiting"; exit 1 ; } done +# these should be sourced from negativo's fedora-multimedia repo +# as Fedora can't ship patent encumbered video codecs +NEGATIVO=( + ffmpeg + libheif + libva + mesa-filesystem + mesa-va-drivers + pipewire-libs-extra + x264-libs + x265-libs +) + +for package in "${NEGATIVO[@]}"; do + rpm -q --qf "%{NAME} %{VENDOR}" "${package}" | grep -q "negativo17\.org" || { echo "${package} not from negativo... Exiting"; exit 1 ; } +done # these packages are supposed to be removed # and are considered footguns UNWANTED_PACKAGES=( From 3e81bbefd166ee09e59a407ab67d9658ac0dc172 Mon Sep 17 00:00:00 2001 From: renner Date: Fri, 6 Feb 2026 21:37:00 +0100 Subject: [PATCH 14/15] fix(renovate): do not upgrade major Fedora versions Renovate is not supposed to make major Fedora version upgrades See: https://github.com/ublue-os/aurora/pull/1724 --- .github/renovate.json5 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index a21bac19103..9661ad87157 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -45,6 +45,11 @@ "quay.io/fedora-ostree-desktops/silverblue", "ghcr.io/projectbluefin/common" ] + }, + { + "matchDepNames": ["quay.io/fedora-ostree-desktops/silverblue"], + "matchUpdateTypes": ["major"], + "enabled": false } ] } From 3824d83ab640db13080267348eae9420a6000652 Mon Sep 17 00:00:00 2001 From: renner Date: Sat, 7 Feb 2026 16:36:22 +0100 Subject: [PATCH 15/15] fix: add missing ffmpeg-libs and libfdk-aac --- build_files/base/03-packages.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build_files/base/03-packages.sh b/build_files/base/03-packages.sh index 98cd6527379..f63074ed2b4 100755 --- a/build_files/base/03-packages.sh +++ b/build_files/base/03-packages.sh @@ -173,7 +173,7 @@ dnf -y install --enablerepo='tailscale-stable' tailscale dnf -y install --enablerepo=fedora-multimedia \ -x PackageKit* \ - ffmpeg libavcodec @multimedia gstreamer1-plugins-{bad-free,bad-free-libs,good,base} lame{,-libs} libjxl ffmpegthumbnailer + ffmpeg{,-libs} libavcodec @multimedia gstreamer1-plugins-{bad-free,bad-free-libs,good,base} lame{,-libs} libfdk-aac libjxl ffmpegthumbnailer # From che/nerd-fonts copr_install_isolated "che/nerd-fonts" "nerd-fonts"