feat: move to timothee's ci-test silverblue image

.github/renovate.json5

@@ -42,7 +42,7 @@
       "automerge": true,
       "matchUpdateTypes": ["digest"],
       "matchDepNames": [
-        "ghcr.io/ublue-os/silverblue-main",
+        "quay.io/fedora-ostree-desktops/silverblue",
         "ghcr.io/projectbluefin/common"
       ]
     }

Containerfile

@@ -1,7 +1,6 @@
 ARG BASE_IMAGE_NAME="silverblue"
-ARG FEDORA_MAJOR_VERSION="42"
-ARG SOURCE_IMAGE="${BASE_IMAGE_NAME}-main"
-ARG BASE_IMAGE="ghcr.io/ublue-os/${SOURCE_IMAGE}"
+ARG FEDORA_MAJOR_VERSION="43"
+ARG BASE_IMAGE="quay.io/fedora-ostree-desktops/silverblue"
 ARG COMMON_IMAGE="ghcr.io/projectbluefin/common:latest"
 ARG COMMON_IMAGE_SHA=""
 ARG BREW_IMAGE="ghcr.io/ublue-os/brew:latest"

Justfile

@@ -109,10 +109,6 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin
     common_image_sha=$(yq -r '.images[] | select(.name == "common") | .digest' image-versions.yml)
     brew_image_sha=$(yq -r '.images[] | select(.name == "brew") | .digest' image-versions.yml)
 
-    # Base Image
-    base_image_name="silverblue"
-
-
     # AKMODS Flavor and Kernel Version
     if [[ "${flavor}" =~ hwe ]]; then
         akmods_flavor="bazzite"
@@ -131,7 +127,7 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin
     fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}')
 
     # Verify Base Image with cosign
-    {{ just }} verify-container "${base_image_name}-main:${fedora_version}"
+    {{ just }} verify-container silverblue:${fedora_version} quay.io/fedora-ostree-desktops "https://gitlab.com/fedora/ostree/ci-test/-/raw/main/quay.io-fedora-ostree-desktops.pub?ref_type=heads"
 
     # Kernel Release/Pin
     if [[ -z "${kernel_pin:-}" ]]; then
@@ -178,7 +174,6 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin
         target="dx"
     fi
     BUILD_ARGS+=("--build-arg" "AKMODS_FLAVOR=${akmods_flavor}")
-    BUILD_ARGS+=("--build-arg" "BASE_IMAGE_NAME=${base_image_name}")
     BUILD_ARGS+=("--build-arg" "COMMON_IMAGE={{ common_image }}")
     BUILD_ARGS+=("--build-arg" "COMMON_IMAGE_SHA=${common_image_sha}")
     BUILD_ARGS+=("--build-arg" "BREW_IMAGE={{ brew_image }}")
@@ -326,11 +321,10 @@ rechunk $image="bluefin" $tag="latest" $flavor="main" ghcr="0" pipeline="0":
 
     # Cleanup Space during Github Action
     if [[ "{{ ghcr }}" == "1" ]]; then
-        base_image_name=silverblue-main
         if [[ "${tag}" =~ stable ]]; then
             tag="stable-daily"
         fi
-        ID=$(${SUDOIF} ${PODMAN} images --filter reference=ghcr.io/{{ repo_organization }}/"${base_image_name}":${fedora_version} --format "{{ '{{.ID}}' }}")
+        ID=$(${SUDOIF} ${PODMAN} images --filter reference=quay.io/fedora-ostree-desktops/silverblue --format "{{ '{{.ID}}' }}")
         if [[ -n "$ID" ]]; then
             ${PODMAN} rmi "$ID"
         fi

build_files/base/04-packages.sh → build_files/base/03-packages.sh

@@ -6,6 +6,43 @@ set -ouex pipefail
 
 # All DNF-related operations should be done here whenever possible
 
+# use negativo17 for 3rd party packages with higher priority than default
+# mitigate upstream packaging bug: https://bugzilla.redhat.com/show_bug.cgi?id=2332429
+# swap the incorrectly installed OpenCL-ICD-Loader for ocl-icd, the expected package
+# TODO: remove me when F42 dropped, F43 is not affected
+if [[ "$(rpm -E %fedora)" == "42" ]]; then
+dnf5 -y swap --repo='fedora' \
+    OpenCL-ICD-Loader ocl-icd
+fi
+
+if ! grep -q fedora-multimedia <(dnf5 repolist); then
+    # Enable or Install Repofile
+    dnf5 config-manager setopt fedora-multimedia.enabled=1 ||
+        dnf5 config-manager addrepo --from-repofile="https://negativo17.org/repos/fedora-multimedia.repo"
+fi
+# Set higher priority
+dnf5 config-manager setopt fedora-multimedia.priority=90
+
+# use override to replace mesa and others with less crippled versions
+OVERRIDES=(
+    "intel-gmmlib"
+    "intel-mediasdk"
+    "intel-vpl-gpu-rt"
+    "libheif"
+    "libva"
+    "libva-intel-media-driver"
+    "mesa-dri-drivers"
+    "mesa-filesystem"
+    "mesa-libEGL"
+    "mesa-libGL"
+    "mesa-libgbm"
+    "mesa-va-drivers"
+    "mesa-vulkan-drivers"
+)
+
+dnf5 distro-sync --skip-unavailable -y --repo='fedora-multimedia' "${OVERRIDES[@]}"
+dnf5 versionlock add "${OVERRIDES[@]}"
+
 # shellcheck source=build_files/shared/copr-helpers.sh
 source /ctx/build_files/shared/copr-helpers.sh
 
@@ -20,9 +57,9 @@ FEDORA_PACKAGES=(
     adcli
     adw-gtk3-theme
     adwaita-fonts-all
-    bash-color-prompt
+    alsa-firmware
+    alsa-tools-firmware
     bcache-tools
-    bootc
     borgbackup
     containerd
     cryfs
@@ -32,40 +69,58 @@ FEDORA_PACKAGES=(
     fastfetch
     firewall-config
     fish
+    flatpak-spawn
     foo2zjs
     fuse-encfs
     gcc
     git-credential-libsecret
     glow
     gnome-tweaks
+    google-noto-sans-balinese-fonts
+    google-noto-sans-cjk-fonts
+    google-noto-sans-javanese-fonts
+    google-noto-sans-sundanese-fonts
+    grub2-tools-extra
     gum
-    hplip
+    gvfs-nfs
+    htop
     ibus-mozc
+    ibus-unikey
     ifuse
     igt-gpu-tools
     input-remapper
+    intel-vaapi-driver
     iwd
     jetbrains-mono-fonts-all
     just
     krb5-workstation
+    libcamera-gstreamer
+    libcamera-tools
     libgda
     libgda-sqlite
-    libimobiledevice
+    libimobiledevice-utils
     libratbag-ratbagd
     libsss_autofs
+    libva-utils
     libxcrypt-compat
     lm_sensors
+    lshw
     make
-    mesa-libGLU
     mozc
+    mtools
     nautilus-gsconnect
+    net-tools
+    nvtop
     oddjob-mkhomedir
     opendyslexic-fonts
+    openrgb-udev-rules
     openssh-askpass
+    pam-u2f
+    pam_yubico
+    pamu2fcfg
+    pipewire-libs-extra
     powerstat
     powertop
-    printer-driver-brlaser
-    pulseaudio-utils
     python3-pip
     python3-pygit2
     rclone
@@ -76,18 +131,20 @@ FEDORA_PACKAGES=(
     samba-winbind-clients
     samba-winbind-modules
     setools-console
+    smartmontools
+    solaar-udev
+    squashfs-tools
     sssd-ad
     sssd-krb5
-    sssd-nfs-idmap
-    switcheroo-control
+    symlinks
+    tcpdump
     tmux
+    traceroute
     usbip
-    usbmuxd
+    vim
     waypipe
-    wireguard-tools
-    wl-clipboard
     xdg-terminal-exec
-    xprop
+    yubikey-manager 
     zenity
     zsh
 )
@@ -102,8 +159,6 @@ case "$FEDORA_MAJOR_VERSION" in
         ;;
     43)
         FEDORA_PACKAGES+=(
-            evolution-ews-core
-            gnupg2-scdaemon
         )
         ;;
 esac
@@ -116,11 +171,17 @@ dnf config-manager addrepo --from-repofile=https://pkgs.tailscale.com/stable/fed
 dnf config-manager setopt tailscale-stable.enabled=0
 dnf -y install --enablerepo='tailscale-stable' tailscale
 
+dnf -y install --enablerepo=fedora-multimedia \
+    -x PackageKit* \
+    ffmpeg libavcodec @multimedia gstreamer1-plugins-{bad-free,bad-free-libs,good,base} lame{,-libs} libjxl ffmpegthumbnailer
+
 # From che/nerd-fonts
 copr_install_isolated "che/nerd-fonts" "nerd-fonts"
 
 # From ublue-os/packages
-copr_install_isolated "ublue-os/packages" "uupd"
+copr_install_isolated "ublue-os/packages" \
+    "uupd" \
+    "oversteer-udev"
 
 # Version-specific COPR packages
 # case "$FEDORA_MAJOR_VERSION" in
@@ -136,26 +197,31 @@ copr_install_isolated "ublue-os/packages" "uupd"
 
 # Packages to exclude - common to all versions
 EXCLUDED_PACKAGES=(
+    default-fonts-cjk-sans
     fedora-bookmarks
     fedora-chromium-config
     fedora-chromium-config-gnome
+    fedora-third-party
     firefox
     firefox-langpacks
     gnome-extensions-app
     gnome-shell-extension-background-logo
+    gnome-software
     gnome-software-rpm-ostree
     gnome-terminal-nautilus
+    google-noto-sans-cjk-vf-fonts
     podman-docker
+    totem-video-thumbnailer
     yelp
 )
 
 # Version-specific package exclusions
 case "$FEDORA_MAJOR_VERSION" in
     42)
-        EXCLUDED_PACKAGES+=(gnome-software cosign)
+        EXCLUDED_PACKAGES+=()
         ;;
     43)
-        EXCLUDED_PACKAGES+=(gnome-software cosign)
+        EXCLUDED_PACKAGES+=()
         ;;
 esac
 

build_files/base/03-install-kernel-akmods.sh → build_files/base/04-install-kernel-akmods.sh

@@ -33,9 +33,11 @@ dnf5 -y install \
 
 dnf5 versionlock add kernel kernel-devel kernel-devel-matched kernel-core kernel-modules kernel-modules-core kernel-modules-extra
 
-# Everyone
-# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming
-sed -i 's@enabled=0@enabled=1@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo
+dnf copr enable -y ublue-os/akmods
+
+mkdir -p /etc/pki/akmods/certs
+ghcurl "https://github.com/ublue-os/akmods/raw/refs/heads/main/certs/public_key.der" --retry 3 -Lo /etc/pki/akmods/certs/akmods-ublue.der
+grep -F -e "Universal Blue" /etc/pki/akmods/certs/akmods-ublue.der
 
 # RPMFUSION Dependent AKMODS
 if [[ "${UBLUE_IMAGE_TAG}" == "beta" ]]; then
@@ -122,4 +124,6 @@ if [[ ${AKMODS_FLAVOR} =~ coreos ]]; then
     echo "zfs" >/usr/lib/modules-load.d/zfs.conf
 fi
 
+dnf copr disable -y ublue-os/akmods
+
 echo "::endgroup::"

build_files/base/05-override-install.sh

@@ -15,6 +15,23 @@ mkdir -p /usr/share/doc/bluefin
 ghcurl "https://github.com/ublue-os/bluefin-docs/releases/download/0.1/bluefin.pdf" --retry 3 -o /tmp/bluefin.pdf
 install -Dm0644 -t /usr/share/doc/bluefin/ /tmp/bluefin.pdf
 
+# Footgun, See: https://github.com/ublue-os/main/issues/598
+rm -f /usr/bin/chsh /usr/bin/lchsh
+
+# Add linuxbrew to the list of paths usable by `sudo`
+# not a sudoers.d override because we want to get updates from upstream and not break everything
+sed -Ei "s/secure_path = (.*)/secure_path = \1:\/home\/linuxbrew\/.linuxbrew\/bin/" /etc/sudoers
+
+# https://github.com/ublue-os/main/pull/334
+ln -s "/usr/share/fonts/google-noto-sans-cjk-fonts" "/usr/share/fonts/noto-cjk"
+
+
+# use CoreOS' generator for emergency/rescue boot
+# see detail: https://github.com/ublue-os/main/issues/653
+mkdir -p /usr/lib/systemd/system-generators
+ghcurl "https://raw.githubusercontent.com/coreos/fedora-coreos-config/refs/heads/stable/overlay.d/05core/usr/lib/systemd/system-generators/coreos-sulogin-force-generator" --retry 3 -Lo /usr/lib/systemd/system-generators/coreos-sulogin-force-generator
+chmod +x /usr/lib/systemd/system-generators/coreos-sulogin-force-generator
+
 # Starship Shell Prompt
 ghcurl "https://github.com/starship/starship/releases/latest/download/starship-x86_64-unknown-linux-gnu.tar.gz" --retry 3 -o /tmp/starship.tar.gz
 tar -xzf /tmp/starship.tar.gz -C /tmp
@@ -26,18 +43,6 @@ sed -i "/picture-uri/ s/${HARDCODED_RPM_MONTH}/$(date +%m)/" "/usr/share/glib-2.
 rm /usr/share/glib-2.0/schemas/gschemas.compiled
 glib-compile-schemas /usr/share/glib-2.0/schemas
 
-# Required for bluefin faces to work without conflicting with a ton of packages
-rm -f /usr/share/pixmaps/faces/* || echo "Expected directory deletion to fail"
-mv /usr/share/pixmaps/faces/bluefin/* /usr/share/pixmaps/faces
-rm -rf /usr/share/pixmaps/faces/bluefin
-
-# Remove desktop entries
-if [[ -f /usr/share/applications/gnome-system-monitor.desktop ]]; then
-    sed -i 's@\[Desktop Entry\]@\[Desktop Entry\]\nHidden=true@g' /usr/share/applications/gnome-system-monitor.desktop
-fi
-if [[ -f /usr/share/applications/org.gnome.SystemMonitor.desktop ]]; then
-    sed -i 's@\[Desktop Entry\]@\[Desktop Entry\]\nHidden=true@g' /usr/share/applications/org.gnome.SystemMonitor.desktop
-fi
 
 # Add Mutter experimental-features
 if [[ "${IMAGE_NAME}" =~ nvidia ]]; then

build_files/base/17-cleanup.sh

@@ -45,7 +45,7 @@ systemctl disable flatpak-add-fedora-repos.service
 # We only need to clean up repos that were enabled during the build process.
 
 # Disable third-party repos
-for repo in negativo17-fedora-multimedia tailscale fedora-cisco-openh264; do
+for repo in fedora-multimedia tailscale fedora-cisco-openh264; do
     if [[ -f "/etc/yum.repos.d/${repo}.repo" ]]; then
         sed -i 's@enabled=1@enabled=0@g' "/etc/yum.repos.d/${repo}.repo"
     fi
@@ -58,11 +58,6 @@ for i in /etc/yum.repos.d/_copr:*.repo; do
     fi
 done
 
-# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming
-if [[ -f "/etc/yum.repos.d/_copr_ublue-os-akmods.repo" ]]; then
-    sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo
-fi
-
 # Disable RPM Fusion repos
 for i in /etc/yum.repos.d/rpmfusion-*.repo; do
     if [[ -f "$i" ]]; then

build_files/base/20-tests.sh

@@ -54,10 +54,28 @@ for package in "${IMPORTANT_PACKAGES[@]}"; do
     rpm -q "${package}" >/dev/null || { echo "Missing package: ${package}... Exiting"; exit 1 ; }
 done
 
+# these should be sourced from negativo's fedora-multimedia repo
+# as Fedora can't ship patent encumbered video codecs
+NEGATIVO=(
+    ffmpeg
+    libheif
+    libva
+    mesa-filesystem
+    mesa-va-drivers
+    pipewire-libs-extra
+    x264-libs
+    x265-libs
+)
+
+for package in "${NEGATIVO[@]}"; do
+  rpm -q --qf "%{NAME} %{VENDOR}" "${package}" | grep -q "negativo17\.org" || { echo "${package} not from negativo... Exiting"; exit 1 ; }
+done
 # these packages are supposed to be removed
 # and are considered footguns
 UNWANTED_PACKAGES=(
+    fedora-flathub-remote
     fedora-logos
+    fedora-third-party
     firefox
     gnome-software
     gnome-software-rpm-ostree

build_files/dx/00-dx.sh

@@ -121,7 +121,7 @@ systemctl enable bluefin-dx-groups.service
 sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo
 
 # NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming
-sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo
+sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr:copr.fedorainfracloud.org:ublue-os:akmods.repo
 
 # Disable RPM Fusion repos
 for i in /etc/yum.repos.d/rpmfusion-*.repo; do