From 6b92bbcbbc38b5c50cebf01c1f78115376949789 Mon Sep 17 00:00:00 2001
From: Timothée Ravier <tim@siosm.fr>
Date: Mar 07 2025 12:50:10 +0000
Subject: [PATCH 1/4] Remove fedora-bootc-base


Now moved to https://github.com/fedora-iot/fedora-iot-bootc

---

diff --git a/fedora-bootc-base/basic-fixes.yaml b/fedora-bootc-base/basic-fixes.yaml
deleted file mode 100644
index d9fe059..0000000
--- a/fedora-bootc-base/basic-fixes.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-# Fix general bugs
-
-postprocess:
-  # See also https://github.com/openshift/os/blob/f6cde963ee140c02364674db378b2bc4ac42675b/common.yaml#L156
-  # This one is undoes the effect of
-  # # RHEL-only: Disable /tmp on tmpfs.
-  #Wants=tmp.mount
-  # in /usr/lib/systemd/system/basic.target
-  # We absolutely must have tmpfs-on-tmp for multiple reasons,
-  # but the biggest is that when we have composefs for / it's read-only,
-  # and for units with ProtectSystem=full systemd clones / but needs
-  # a writable place.
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    mkdir -p /usr/lib/systemd/system/local-fs.target.wants
-    if test '!' -f /usr/lib/systemd/system/local-fs.target.wants/tmp.mount; then
-      ln -sf ../tmp.mount /usr/lib/systemd/system/local-fs.target.wants
-    fi
-
-    # See https://github.com/containers/bootc/issues/358
-    # basically systemd-tmpfiles doesn't follow symlinks; ordinarily our
-    # tmpfiles.d unit for `/var/roothome` is fine, but this actually doesn't
-    # work if we want to use tmpfiles.d to write to `/root/.ssh` because
-    # tmpfiles gives up on that before getting to `/var/roothome`.
-    sed -ie 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf
-    # Because /var/roothome is also defined in rpm-ostree-0-integration.conf
-    # we need to delete /var/roothome
-    sed -ie '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf
diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml
deleted file mode 100644
index e69de29..0000000
--- a/fedora-bootc-base/bootc-config.yaml
+++ /dev/null
diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml
deleted file mode 100644
index d44ee08..0000000
--- a/fedora-bootc-base/bootc.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
-# The bootc components.
-packages:
- - systemd
- - bootc
- # bootc pulls in podman, which pulls in containers-common, which wants
- # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name
- # iptables-nft instead to satisfy it.
- - iptables-nft
- # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk
- - gdisk xfsprogs e2fsprogs dosfstools
-
-exclude-packages:
-  # Exclude kernel-debug-core to make sure that it doesn't somehow get
-  # chosen as the package to satisfy the `kernel-core` dependency from
-  # the kernel package.
-  - kernel-debug-core
diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml
deleted file mode 100644
index cc83d20..0000000
--- a/fedora-bootc-base/bootupd.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-# Integration with https://github.com/coreos/bootupd and bootloader logic
-# xref https://github.com/coreos/fedora-coreos-tracker/issues/510
-packages:
-  - bootupd
-
-# bootloader
-packages-aarch64:
-  - grub2-efi-aa64 efibootmgr shim
-packages-ppc64le:
-  - grub2 ostree-grub2
-packages-s390x:
-  # On Fedora, this is provided by s390utils-core. on RHEL, this is for now
-  # provided by s390utils-base, but soon will be -core too.
-  - /usr/sbin/zipl
-packages-x86_64:
-  - grub2-efi-x64 efibootmgr shim
-  - microcode_ctl
-
-conditional-include:
-  - if: basearch != "s390x"
-    # And remove some cruft from grub2
-    include: grub2-removals.yaml
-
-postprocess:
-  - |
-    #!/bin/bash
-    set -xeuo pipefail
-    # Until we have https://github.com/coreos/rpm-ostree/pull/2275
-    mkdir -p /run
-    # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload
-    /usr/bin/bootupctl backend generate-update-metadata
diff --git a/fedora-bootc-base/group b/fedora-bootc-base/group
deleted file mode 100644
index 2fd197c..0000000
--- a/fedora-bootc-base/group
+++ /dev/null
@@ -1,46 +0,0 @@
-root:x:0:
-bin:x:1:
-daemon:x:2:
-sys:x:3:
-adm:x:4:
-tty:x:5:
-disk:x:6:
-lp:x:7:
-mem:x:8:
-kmem:x:9:
-wheel:x:10:
-cdrom:x:11:
-mail:x:12:
-man:x:15:
-sudo:x:16:
-dialout:x:18:
-floppy:x:19:
-games:x:20:
-tape:x:33:
-video:x:39:
-ftp:x:50:
-lock:x:54:
-audio:x:63:
-nobody:x:99:
-users:x:100:
-ssh_keys:x:999:
-systemd-journal:x:190:
-polkitd:x:998:
-etcd:x:997:
-dip:x:40:
-cgred:x:996:
-avahi-autoipd:x:170:
-sssd:x:993:
-dockerroot:x:986:
-rpcuser:x:29:
-nfsnobody:x:65534:
-kube:x:994:
-chrony:x:992:
-tcpdump:x:72:
-ceph:x:167:
-input:x:104:
-systemd-timesync:x:991:
-systemd-network:x:990:
-systemd-resolve:x:989:
-systemd-bus-proxy:x:988:
-cockpit-ws:x:987:
diff --git a/fedora-bootc-base/grub2-removals.yaml b/fedora-bootc-base/grub2-removals.yaml
deleted file mode 100644
index f4800dd..0000000
--- a/fedora-bootc-base/grub2-removals.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-remove-from-packages:
-  # The grub bits are mainly designed for desktops, and IMO haven't seen
-  # enough testing in concert with ostree. At some point we'll flesh out
-  # the full plan in https://github.com/coreos/fedora-coreos-tracker/issues/47
-  - [grub2-tools, /etc/grub.d/08_fallback_counting,
-                  /etc/grub.d/10_reset_boot_success,
-                  /etc/grub.d/12_menu_auto_hide,
-                  /usr/lib/systemd/.*]
diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml
deleted file mode 100644
index fe4bbeb..0000000
--- a/fedora-bootc-base/initramfs.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-# Configuration for the initramfs
-postprocess:
-  - |
-    #!/usr/bin/env bash
-    mkdir -p /usr/lib/dracut/dracut.conf.d
-    cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF'
-    # We want a generic image; hostonly makes no sense as part of a server side build
-    hostonly=no
-    add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree "
-    EOF
-    cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF'
-    # Extra modules that we want by default that are known to exist in the kernel
-    add_dracutmodules+=" virtiofs "
-    EOF
-    cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF'
-    # We want this for systemd-cryptsetup tpm2 locking
-    add_dracutmodules+=" tpm2-tss "
-    EOF
-    cat > /usr/lib/dracut/dracut.conf.d/59-altfiles.conf << 'EOF'
-    # https://issues.redhat.com/browse/RHEL-49590
-    # On image mode systems we use nss-altfiles for passwd and group,
-    # this makes sure dracut uses them which also fixes kdump writing to NFS.
-    install_items+=" /usr/lib/passwd /usr/lib/group "
-    EOF
diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml
deleted file mode 100644
index 611ff9a..0000000
--- a/fedora-bootc-base/iot.yaml
+++ /dev/null
@@ -1,100 +0,0 @@
-# Fedora IoT specific packages
-packages:
-  - fedora-release-iot
-  - aardvark-dns
-  - atheros-firmware
-  - attr
-  - authselect
-  - basesystem
-  - bash
-  - bash-completion
-  - brcmfmac-firmware
-  - chrony
-  - clevis
-  - clevis-dracut
-  - clevis-luks
-  - clevis-pin-tpm2
-  - containernetworking-plugins
-  - coreutils
-  - cracklib-dicts
-  - criu
-  - criu-libs
-  - cryptsetup
-  - curl
-  - dbus-parsec
-  - dnf5-plugins
-  - dracut-config-generic
-  - dracut-network
-  - efibootmgr
-  - fdo-client
-  - firewalld
-  - fwupd
-  - fwupd-efi
-  - fwupd-plugin-modem-manager
-  - fwupd-plugin-uefi-capsule-data
-  - glibc
-  - glibc-minimal-langpack
-  - gnupg2
-  - greenboot
-  - greenboot-default-health-checks
-  - gzip
-  - hostname
-  - ignition
-  - ima-evm-utils
-  - iproute
-  - iputils
-  - iwd
-  - iwlwifi-mvm-firmware
-  - kernel-tools
-  - keyutils
-  - less
-  - libsss_sudo
-  - linux-firmware
-  - lvm2
-  - netavark
-  - NetworkManager
-  - NetworkManager-wifi
-  - NetworkManager-wwan
-  - nss-altfiles
-  - openssl
-  - openssh-clients
-  - openssh-server
-  - passt
-  - passt-selinux
-  - parsec
-  - pinentry
-  - podman
-  - policycoreutils
-  - policycoreutils-python-utils
-  - polkit
-  - procps-ng
-  - realtek-firmware
-  - rootfiles
-  - rpm
-  - screen
-  - setools-console
-  - setup
-  - shadow-utils
-  - skopeo
-  - slirp4netns
-  - sssd-client
-  - sudo
-  - systemd-resolved
-  - tar
-  - tmux
-  - tpm2-pkcs11
-  - traceroute
-  - usbguard
-  - util-linux
-  - vim-minimal
-  - wpa_supplicant
-  - wireless-regdb
-  - xz
-  - zezere-ignition
-  - zram-generator
-  - zram-generator-defaults
-packages-aarch64:
-  - arm-image-installer
-  - bcm283x-firmware
-  - optee_client
-  - uboot-images-armv8
diff --git a/fedora-bootc-base/kernel.yaml b/fedora-bootc-base/kernel.yaml
deleted file mode 100644
index 0dd777d..0000000
--- a/fedora-bootc-base/kernel.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# Enable the Linux kernel; see also kernel-rt.
-packages:
- - kernel
-
-exclude-packages:
-  - kernel-debug
diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml
deleted file mode 100644
index 9a21ff3..0000000
--- a/fedora-bootc-base/manifest.yaml
+++ /dev/null
@@ -1,65 +0,0 @@
-
-# Modern defaults we want
-boot-location: modules
-tmp-is-dir: true
-# https://github.com/CentOS/centos-bootc/issues/167
-machineid-compat: true
-# Be minimal
-recommends: false
-
-ignore-removed-users:
-  - root
-ignore-removed-groups:
-  - root
-etc-group-members:
-  - wheel
-  - sudo
-  - systemd-journal
-  - adm
-
-# Default to `bash` in our container, the same as other containers we ship.
-container-cmd:
-  - /sbin/init
-
-# Note that the default for c9s+ is sqlite; we can't rely on rpm being
-# in the target (it isn't in tier-0!) so turn this to host here.  This
-# does break the "hermetic build" aspect a bit.  Maybe eventually
-# what we should do is special case this and actually install RPM temporarily
-# and then remove it...
-rpmdb: host
-
-check-passwd:
-  type: "file"
-  filename: "passwd"
-check-groups:
-  type: "file"
-  filename: "group"
-
-automatic-version-prefix: "${releasever}.<date:%Y%m%d>"
-mutate-os-release: "${releasever}"
-
-remove-from-packages:
-  # Generally we expect other tools to do this (e.g. Ignition or cloud-init)
-  - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service]
-  # We don't want auto-generated mount units. See also
-  # https://github.com/systemd/systemd/issues/13099
-  - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator]
-
-include:
-  - bootc.yaml
-  - bootupd.yaml
-  - ostree.yaml
-  - initramfs.yaml
-  - basic-fixes.yaml
-  - iot.yaml
-
-packages:
-  # needed for building derived container images
-  - dnf5
-  # Even in tier-0, we have this.  If you don't want SELinux today, you'll need
-  # to build a custom image.
-  - selinux-policy-targeted
-  # And we want container-selinux because trying to layer it on later currently causes issues.
-  - container-selinux
-  # Needed for tpm2 bound luks
-  - tpm2-tools
diff --git a/fedora-bootc-base/ostree.yaml b/fedora-bootc-base/ostree.yaml
deleted file mode 100644
index 6f30861..0000000
--- a/fedora-bootc-base/ostree.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-packages:
- - ostree nss-altfiles
-
-# We want content lifecycled with the image
-opt-usrlocal: "root"
-
-postprocess:
-  # Set up default root config
-  - |
-    #!/usr/bin/env bash
-    mkdir -p /usr/lib/ostree
-    cat > /usr/lib/ostree/prepare-root.conf << EOF
-    [composefs]
-    enabled = yes
-    [sysroot]
-    readonly = true
-    EOF
diff --git a/fedora-bootc-base/passwd b/fedora-bootc-base/passwd
deleted file mode 100644
index ea84802..0000000
--- a/fedora-bootc-base/passwd
+++ /dev/null
@@ -1,32 +0,0 @@
-adm:x:3:4:adm:/var/adm:/usr/sbin/nologin
-avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin
-bin:x:1:1:bin:/bin:/usr/sbin/nologin
-ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin
-chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin
-cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin
-daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin
-dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin
-dockerroot:x:997:986:Docker User:/var/lib/docker:/usr/sbin/nologin
-etcd:x:998:997:etcd user:/var/lib/etcd:/usr/sbin/nologin
-ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin
-games:x:12:100:games:/usr/games:/usr/sbin/nologin
-halt:x:7:0:halt:/sbin:/sbin/halt
-kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin
-lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin
-mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin
-nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin
-nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin
-operator:x:11:0:operator:/root:/usr/sbin/nologin
-polkitd:x:999:998:User for polkitd:/:/usr/sbin/nologin
-root:x:0:0:Super User:/root:/bin/bash
-rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin
-rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin
-shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
-sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin
-sssd:x:995:993:User for sssd:/:/usr/sbin/nologin
-sync:x:5:0:sync:/sbin:/bin/sync
-systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin
-systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin
-systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin
-systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin
-tcpdump:x:72:72::/:/usr/sbin/nologin

From e4bd292f1ab6ea63403b99efbe82e9c7fb47b602 Mon Sep 17 00:00:00 2001
From: Timothée Ravier <tim@siosm.fr>
Date: Mar 07 2025 12:50:19 +0000
Subject: [PATCH 2/4] Whitespace & indentation cleanup


---

diff --git a/bootupd.yaml b/bootupd.yaml
index 857de65..e15c48a 100644
--- a/bootupd.yaml
+++ b/bootupd.yaml
@@ -1,7 +1,7 @@
 # KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml
 # See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml
 #
-#Integration with https://github.com/coreos/bootupd
+# Integration with https://github.com/coreos/bootupd
 packages:
   - bootupd
 
@@ -12,7 +12,7 @@ postprocess:
 
     # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload
     /usr/bin/bootupctl backend generate-update-metadata
-  
+
     # Enable migration to a static GRUB config
     install -dm0755 /usr/lib/systemd/system/bootloader-update.service.d
     cat > /usr/lib/systemd/system/bootloader-update.service.d/migrate-static-grub-config.conf << 'EOF'
diff --git a/fedora-iot.yaml b/fedora-iot.yaml
index 2f1ddd3..7f39e3e 100644
--- a/fedora-iot.yaml
+++ b/fedora-iot.yaml
@@ -1,4 +1,5 @@
 include: fedora-iot-base.yaml
 ref: fedora/rawhide/${basearch}/iot
+
 repos:
 - fedora-43

From ce81f37ea5a7419a16eb03343c553129a96964c1 Mon Sep 17 00:00:00 2001
From: Timothée Ravier <tim@siosm.fr>
Date: Mar 07 2025 12:50:20 +0000
Subject: [PATCH 3/4] ci: Add a script to help validate manifest syntax


---

diff --git a/ci/validate b/ci/validate
new file mode 100755
index 0000000..c9e6a32
--- /dev/null
+++ b/ci/validate
@@ -0,0 +1,57 @@
+#!/usr/bin/python3
+# Validate basic syntax of shell script and yaml.
+
+import os
+import stat
+import subprocess
+import yaml
+
+validated=0
+
+def openat(dirfd, name, mode='r'):
+    def opener(path, flags):
+        return os.open(path, flags, dir_fd=dirfd)
+    return open(name, mode, opener=opener)
+
+
+def validate_shell(rootfd, name):
+    subprocess.check_call(['bash', '-n', name], preexec_fn=lambda: os.fchdir(rootfd))
+    global validated
+    validated +=1
+
+
+for root, dirs, files, rootfd in os.fwalk('.'):
+    # Skip folders that do not include content to validate
+    for d in ['.git', '.github', 'repo', 'cache', 'tmp', 'logs', 'fedora-comps']:
+        if d in dirs:
+            dirs.remove(d)
+    for f in ['.gitlab-ci.yml']:
+        if f in files:
+            files.remove(f)
+    for name in files:
+        if name.endswith(('.yaml', '.yml')):
+            print("Validating:", name)
+            with open(os.open(name, dir_fd=rootfd, flags=os.O_RDONLY)) as f:
+                yaml.safe_load(f)
+            result = subprocess.run(['grep', '-RniEv', '^(  )*[a-z#/-]|^(  )*\\[|^$|^#', name], encoding='UTF-8',
+                                    preexec_fn=lambda: os.fchdir(rootfd))
+            if result.returncode == 0:
+                raise Exception("Found likely invalid indentation in YAML file: {}".format(name))
+            validated +=1
+            continue
+        elif name.endswith('.sh'):
+            print("Validating:", name)
+            validate_shell(rootfd, name)
+            continue
+        stbuf = os.lstat(name, dir_fd=rootfd)
+        if not stat.S_ISREG(stbuf.st_mode):
+            continue
+        if not stbuf.st_mode & stat.S_IXUSR:
+            continue
+        mimetype = subprocess.check_output(['file', '-b', '--mime-type', name], encoding='UTF-8',
+                                           preexec_fn=lambda: os.fchdir(rootfd)).strip()
+        if mimetype == 'text/x-shellscript':
+            print("Validating:", name)
+            validate_shell(rootfd, name)
+
+print(f"Validated {validated} files")

From 465d88c040cc3f40e1967479f23aee90d84c0dde Mon Sep 17 00:00:00 2001
From: Timothée Ravier <tim@siosm.fr>
Date: Mar 07 2025 12:50:20 +0000
Subject: [PATCH 4/4] Add a justfile with common commands


---

diff --git a/justfile b/justfile
new file mode 100644
index 0000000..313ea6c
--- /dev/null
+++ b/justfile
@@ -0,0 +1,156 @@
+# This is a justfile. See https://github.com/casey/just
+# This is only used for local development. The builds made on the Fedora
+# infrastructure are run via Pungi in a Koji runroot.
+
+# Set a default for some recipes
+default_variant := "fedora-iot"
+default_arch := "default"
+# Current default in Pungi
+force_nocache := "true"
+
+# Just doesn't have a native dict type, but quoted bash dictionary works fine
+pretty_names := '(
+    [fedora-iot]="IoT"
+)'
+
+# Default is to only validate the manifests
+all: validate
+
+# Basic validation to make sure the manifests are not completely broken
+validate:
+    ./ci/validate
+
+# Output the processed manifest for a given variant (defaults to Silverblue)
+manifest variant=default_variant:
+    #!/bin/bash
+    set -euo pipefail
+
+    rpm-ostree compose tree --print-only --repo=repo {{variant}}.yaml
+
+# Perform dependency resolution for a given variant (defaults to Silverblue)
+compose-dry-run variant=default_variant:
+    #!/bin/bash
+    set -euxo pipefail
+
+    mkdir -p repo cache logs
+    if [[ ! -f "repo/config" ]]; then
+        pushd repo > /dev/null || exit 1
+        ostree init --repo . --mode=bare-user
+        popd > /dev/null || exit 1
+    fi
+
+    rpm-ostree compose tree --unified-core --repo=repo --dry-run {{variant}}.yaml
+
+# Alias/shortcut for compose-image command
+compose variant=default_variant: (compose-image variant)
+
+# Compose a variant using the legacy non container path (defaults to Silverblue)
+compose-legacy variant=default_variant:
+    #!/bin/bash
+    set -euxo pipefail
+
+    declare -A pretty_names={{pretty_names}}
+    variant={{variant}}
+    variant_pretty=${pretty_names[$variant]-}
+    if [[ -z $variant_pretty ]]; then
+        echo "Unknown variant"
+        exit 1
+    fi
+
+    ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1)
+
+    mkdir -p repo cache logs
+    if [[ ! -f "repo/config" ]]; then
+        pushd repo > /dev/null || exit 1
+        ostree init --repo . --mode=bare-user
+        popd > /dev/null || exit 1
+    fi
+    # Set option to reduce fsync for transient builds
+    ostree --repo=repo config set 'core.fsync' 'false'
+
+    buildid="$(date '+%Y%m%d.0')"
+    timestamp="$(date --iso-8601=sec)"
+    echo "${buildid}" > .buildid
+
+    version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')"
+    echo "Composing ${variant_pretty} ${version}.${buildid} ..."
+
+    ARGS="--repo=repo --cachedir=cache"
+    ARGS+=" --unified-core"
+    if [[ {{force_nocache}} == "true" ]]; then
+        ARGS+=" --force-nocache"
+    fi
+    CMD="rpm-ostree"
+    if [[ ${EUID} -ne 0 ]]; then
+        CMD="sudo rpm-ostree"
+    fi
+
+    ${CMD} compose tree ${ARGS} \
+        --add-metadata-string="version=${variant_pretty} ${version}.${buildid}" \
+        "${variant}-ostree.yaml" \
+            |& tee "logs/${variant}_${version}_${buildid}.${timestamp}.log"
+
+    if [[ ${EUID} -ne 0 ]]; then
+        sudo chown --recursive "$(id --user --name):$(id --group --name)" repo cache
+    fi
+
+    ostree summary --repo=repo --update
+
+# Compose an Ostree Native Container OCI image
+compose-image variant=default_variant:
+    #!/bin/bash
+    set -euxo pipefail
+
+    declare -A pretty_names={{pretty_names}}
+    variant={{variant}}
+    variant_pretty=${pretty_names[$variant]-}
+    if [[ -z $variant_pretty ]]; then
+        echo "Unknown variant"
+        exit 1
+    fi
+
+    ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1)
+
+    mkdir -p repo cache
+    if [[ ! -f "repo/config" ]]; then
+        pushd repo > /dev/null || exit 1
+        ostree init --repo . --mode=bare-user
+        popd > /dev/null || exit 1
+    fi
+    # Set option to reduce fsync for transient builds
+    ostree --repo=repo config set 'core.fsync' 'false'
+
+    buildid="$(date '+%Y%m%d.0')"
+    timestamp="$(date --iso-8601=sec)"
+    echo "${buildid}" > .buildid
+
+    version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')"
+    echo "Composing ${variant_pretty} ${version}.${buildid} ..."
+
+    ARGS="--cachedir=cache --initialize"
+    if [[ {{force_nocache}} == "true" ]]; then
+        ARGS+=" --force-nocache"
+    fi
+    # To debug with gdb, use: gdb --args ...
+    CMD="rpm-ostree"
+    if [[ ${EUID} -ne 0 ]]; then
+        CMD="sudo rpm-ostree"
+    fi
+
+    ${CMD} compose image ${ARGS} \
+         --label="quay.expires-after=4w" \
+        "${variant}.yaml" \
+        "${variant}.ociarchive"
+
+# Clean up everything
+clean-all:
+    just clean-repo
+    just clean-cache
+
+# Only clean the ostree repo
+clean-repo:
+    rm -rf ./repo
+
+# Only clean the package and repo caches
+clean-cache:
+    rm -rf ./cache