From 597796c53f30950d9edaa85b6d6a07ee1a829d5c Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Sep 25 2024 12:57:05 +0000 Subject: Add iot base bootc image Signed-off-by: Paul Whalen --- diff --git a/fedora-bootc-base/autoupdates.yaml b/fedora-bootc-base/autoupdates.yaml deleted file mode 100644 index a416699..0000000 --- a/fedora-bootc-base/autoupdates.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# Enable automatic updates by default -postprocess: - - | - #!/usr/bin/env bash - set -euo pipefail - target=/usr/lib/systemd/system/default.target.wants - mkdir -p $target - set -x - ln -s ../bootc-fetch-apply-updates.timer $target diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml index 4d4b24e..e69de29 100644 --- a/fedora-bootc-base/bootc-config.yaml +++ b/fedora-bootc-base/bootc-config.yaml @@ -1,10 +0,0 @@ -# Configuration for bootc -postprocess: - # ext4 is our default filesystem in iot - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/bootc/install/ - cat > /usr/lib/bootc/install/20-default-root.toml << EOF - [install] - root-fs-type = "ext4" - EOF diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml index a862e6c..d44ee08 100644 --- a/fedora-bootc-base/bootc.yaml +++ b/fedora-bootc-base/bootc.yaml @@ -2,6 +2,10 @@ packages: - systemd - bootc + # bootc pulls in podman, which pulls in containers-common, which wants + # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name + # iptables-nft instead to satisfy it. + - iptables-nft # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk - gdisk xfsprogs e2fsprogs dosfstools diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml index 7d3ebf3..cc83d20 100644 --- a/fedora-bootc-base/bootupd.yaml +++ b/fedora-bootc-base/bootupd.yaml @@ -13,7 +13,7 @@ packages-s390x: # provided by s390utils-base, but soon will be -core too. - /usr/sbin/zipl packages-x86_64: - - grub2 grub2-efi-x64 efibootmgr shim + - grub2-efi-x64 efibootmgr shim - microcode_ctl conditional-include: diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml index de65333..fe4bbeb 100644 --- a/fedora-bootc-base/initramfs.yaml +++ b/fedora-bootc-base/initramfs.yaml @@ -6,13 +6,19 @@ postprocess: cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' # We want a generic image; hostonly makes no sense as part of a server side build hostonly=no - dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " + add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " EOF cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' # Extra modules that we want by default that are known to exist in the kernel - dracutmodules+=" virtiofs " + add_dracutmodules+=" virtiofs " EOF cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' # We want this for systemd-cryptsetup tpm2 locking - dracutmodules+=" tpm2-tss " + add_dracutmodules+=" tpm2-tss " + EOF + cat > /usr/lib/dracut/dracut.conf.d/59-altfiles.conf << 'EOF' + # https://issues.redhat.com/browse/RHEL-49590 + # On image mode systems we use nss-altfiles for passwd and group, + # this makes sure dracut uses them which also fixes kdump writing to NFS. + install_items+=" /usr/lib/passwd /usr/lib/group " EOF diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml new file mode 100644 index 0000000..611ff9a --- /dev/null +++ b/fedora-bootc-base/iot.yaml @@ -0,0 +1,100 @@ +# Fedora IoT specific packages +packages: + - fedora-release-iot + - aardvark-dns + - atheros-firmware + - attr + - authselect + - basesystem + - bash + - bash-completion + - brcmfmac-firmware + - chrony + - clevis + - clevis-dracut + - clevis-luks + - clevis-pin-tpm2 + - containernetworking-plugins + - coreutils + - cracklib-dicts + - criu + - criu-libs + - cryptsetup + - curl + - dbus-parsec + - dnf5-plugins + - dracut-config-generic + - dracut-network + - efibootmgr + - fdo-client + - firewalld + - fwupd + - fwupd-efi + - fwupd-plugin-modem-manager + - fwupd-plugin-uefi-capsule-data + - glibc + - glibc-minimal-langpack + - gnupg2 + - greenboot + - greenboot-default-health-checks + - gzip + - hostname + - ignition + - ima-evm-utils + - iproute + - iputils + - iwd + - iwlwifi-mvm-firmware + - kernel-tools + - keyutils + - less + - libsss_sudo + - linux-firmware + - lvm2 + - netavark + - NetworkManager + - NetworkManager-wifi + - NetworkManager-wwan + - nss-altfiles + - openssl + - openssh-clients + - openssh-server + - passt + - passt-selinux + - parsec + - pinentry + - podman + - policycoreutils + - policycoreutils-python-utils + - polkit + - procps-ng + - realtek-firmware + - rootfiles + - rpm + - screen + - setools-console + - setup + - shadow-utils + - skopeo + - slirp4netns + - sssd-client + - sudo + - systemd-resolved + - tar + - tmux + - tpm2-pkcs11 + - traceroute + - usbguard + - util-linux + - vim-minimal + - wpa_supplicant + - wireless-regdb + - xz + - zezere-ignition + - zram-generator + - zram-generator-defaults +packages-aarch64: + - arm-image-installer + - bcm283x-firmware + - optee_client + - uboot-images-armv8 diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml index 007f6d7..9a21ff3 100644 --- a/fedora-bootc-base/manifest.yaml +++ b/fedora-bootc-base/manifest.yaml @@ -44,19 +44,18 @@ remove-from-packages: # We don't want auto-generated mount units. See also # https://github.com/systemd/systemd/issues/13099 - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator] - # Drop some buggy sysusers fragments which do not match static IDs allocation: - # https://bugzilla.redhat.com/show_bug.cgi?id=2105177 - - [dbus-common, /usr/lib/sysusers.d/dbus.conf] include: - bootc.yaml + - bootupd.yaml - ostree.yaml - - bootc-config.yaml - initramfs.yaml - - autoupdates.yaml - basic-fixes.yaml + - iot.yaml packages: + # needed for building derived container images + - dnf5 # Even in tier-0, we have this. If you don't want SELinux today, you'll need # to build a custom image. - selinux-policy-targeted @@ -64,8 +63,3 @@ packages: - container-selinux # Needed for tpm2 bound luks - tpm2-tools - -# See https://github.com/coreos/bootupd -arch-include: - x86_64: bootupd.yaml - aarch64: bootupd.yaml diff --git a/fedora-bootc.yaml b/fedora-bootc.yaml deleted file mode 100644 index 7067275..0000000 --- a/fedora-bootc.yaml +++ /dev/null @@ -1,15 +0,0 @@ -releasever: rawhide -variables: - distro: "fedora" - -repos: - - fedora-rawhide - -metadata: - name: fedora-bootc - summary: Fedora base bootc image - -include: - - fedora-bootc-base/manifest.yaml - - fedora-bootc-base/kernel.yaml - diff --git a/fedora-iot-bootc.yaml b/fedora-iot-bootc.yaml new file mode 100644 index 0000000..6ae5882 --- /dev/null +++ b/fedora-iot-bootc.yaml @@ -0,0 +1,15 @@ +releasever: rawhide +variables: + distro: "fedora-iot" + +repos: + - fedora-rawhide + +metadata: + name: fedora-iot-bootc-base + summary: Fedora IoT bootc base image + +include: + - fedora-bootc-base/manifest.yaml + - fedora-bootc-base/kernel.yaml +