| Age | Commit message (Collapse) | Author |
|---|
|
See https://src.fedoraproject.org/rpms/mesa/c/f747343d109d2b691d3abcf4649cd10ad42d6578?branch=rawhide .
Signed-off-by: Adam Williamson <awilliam@redhat.com>
|
|
The discussion
in https://discussion.fedoraproject.org/t/f44-change-proposal-containerimageslabels-selfcontained/179010
and opinions in https://pagure.io/fesco/issue/3543
suggested making a clear cut and removing the legacy labels as well.
Reference: https://fedoraproject.org/wiki/Changes/ContainerImagesLabels
|
|
Match the org.opencontainers.image.* labels to the
https://specs.opencontainers.org/image-spec/annotations/.
Reference: https://fedoraproject.org/wiki/Changes/ContainerImagesLabels
Fixes https://pagure.io/fedora-kiwi-descriptions/issue/250.
|
|
This lets us free up the space allocated for the partition and gives
us dynamically allocated space for boot data like we have with the
rest of the operating system.
We do not do this for s390x because zipl does not support it.
Reference: https://fedoraproject.org/wiki/Changes/BtrfsBootForCloud
|
|
Since`rootfiles` now uses systemd-tmpfiles to install dotfiles under
root folder instead of copying.
|
|
With the increase in content in initramfs, a long-overdue raise
of the default size for /boot is warranted.
Reference: https://fedoraproject.org/wiki/Changes/2GbootPartition
|
|
WSL does not support SELinux, so at best it's pointless to install. This
also actively breaks WSL 1 users, although I don't think we should
suggest that we support that, and if the policy on the builder doesn't
match the target things break during the build.
It also reduced the build time from ~80 seconds to ~70 seconds for me,
so that's nice.
Signed-off-by: Jeremy Cline <jeremycline@linux.microsoft.com>
|
|
Fixes https://github.com/fedora-cloud/docker-brew-fedora/issues/119
Signed-off-by: Clement Verna <cverna@tutatnota.com>
|
|
The serial device name on Arm is ttyAMA, not ttyS. This splits the
configuration for Cloud images based on the architecture and adjusts the
kernel command line.
Note that prior to this change, aarch64 would still output kernel logs
to the ttyAMA0 console (on Azure, at least) due to the ACPI SPCR table.
On aarch64 the console in this table, if it's present, is _always_
configured as the kernel's default console. However, systemd logs would
not be sent to the serial console because it seems it was honoring the
kernel command line configuration which had ttyS0 as the default.
Also see: https://pagure.io/cloud-sig/issue/394
Also see: https://bugzilla.redhat.com/show_bug.cgi?id=1661288
Signed-off-by: Jeremy Cline <jeremycline@linux.microsoft.com>
|
|
This introduces extra validation for WSL image creation to ensure
the result is usable.
|
|
This will be used by toolbox(1) to ensure that the certificates from
certificate authorities (or CAs) that are available inside a Toolbx
container are kept synchronized with the host operating system [1]. Any
program that uses PKCS #11 to access CA certificates should see the same
ones both inside the container and on the host.
This is the same approach taken by Flatpak [2].
[1] https://github.com/containers/toolbox/issues/626
[2] Flatpak commit 66b2ff40f7caf3a7
https://github.com/flatpak/flatpak/commit/66b2ff40f7caf3a7
https://github.com/flatpak/flatpak/pull/1757
https://github.com/p11-glue/p11-kit/issues/68
https://pagure.io/fedora-kiwi-descriptions/pull-request/189
|
|
The p11-kit RPM is neither explicitly mentioned in the list of default
RPMs on Fedora Silverblue and Workstation [1], nor was it explicitly
installed by the Container/Dockerfile equivalent of the fedora-toolbox
OCI images [2].
The Container/Dockerfile listed p11-kit as one of the RPMs that had to
be reinstalled, because it was inherited from the fedora base image, and
had its documentation and translations stripped out. The reinstallation
would be skipped if for some reason it was no longer part of the fedora
base image.
This was misinterpreted when creating the Kickstart equivalent of the
fedora-toolbox OCI images [3] and that's how it ended up in the KIWI
description.
In reality, p11-kit gets pulled in as a dependency of ca-certificates,
gnutls, etc. and that's sufficient.
Fallout from d27e4c3f6c3e13bcefe9d1d904386794140d8a91
[1] https://pagure.io/fedora-comps/
[2] https://src.fedoraproject.org/container/fedora-toolbox
[3] fedora-kickstarts commit 48e2c3b5598de32f
https://pagure.io/fedora-kickstarts/c/48e2c3b5598de32f
https://pagure.io/fedora-kickstarts/pull-request/964
https://pagure.io/releng/issue/11399
https://pagure.io/fedora-kiwi-descriptions/pull-request/189
|
|
Although we include curl, some folks expect wget. Also, one of the more
common uses of WSL is in combination with VS Code, and its setup script
on remote hosts uses wget.
Signed-off-by: Jeremy Cline <jeremycline@linux.microsoft.com>
|
|
This became necessary with 10.0.13 / after merging
https://github.com/OSInside/kiwi/pull/2535 but doesn't seem to
noticeable effects besides miisin "GRUB_ENABLE_BLSCFG=true" in
/etc/default/grub.
|
|
Fixes https://pagure.io/fedora-kiwi-descriptions/issue/169,
https://bugzilla.redhat.com/show_bug.cgi?id=2355948.
|
|
It can be useful to have access to `setfiles` inside a `toolbx`
container. Especially when using them as bootstrap roots to setup
other trees.
Signed-off-by: Simon de Vlieger <supakeen@redhat.com>
|
|
If $PATH is not set, we get the default from crun [1]:
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
This is not useful, because in the image, /bin, /sbin, /usr/sbin are all
symlinks. /usr/local/sbin does not exist.
When /usr/sbin is a symlink to /usr/bin, and we use have a $PATH with
/usr/sbin before /usr/bin, various tools will discover /usr/sbin/foo when
looking for 'foo' [2], which is confusing and ugly.
[1] https://github.com/containers/crun/blob/a980c89665bb488ff206e47e9083f75b48528714/src/libcrun/container.c#L183
[2] https://src.fedoraproject.org/rpms/setup/pull-request/18#comment-253719
Co-authored-by: Simon de Vlieger <cmdr@supakeen.com>
|
|
Most of the changes are self-explanatory and just follow what's
already happening for existing architectures.
Two things are worth pointing out:
* we need to use shim-unsigned instead of shim-signed because
riscv64 is not fully integrated into Fedora yet and so we
can't do Secure Boot signing for the time being;
* we use ext4 as bootfilesystem since in most cases the
underlying firmware is going to be U-Boot, which needs to be
able to load the board's DTB from /boot and doesn't support
XFS.
Signed-off-by: David Abdurachmanov <davidlt@rivosinc.com>
|
|
This introduces the beginnings of an image definition for Windows
Subsystem for Linux (WSL).
The package list is based on the core and standard grouplists. Some
packages, like the kernel, dracut, and so on, are omitted as they are
unnecessary. Others, like audit, don't work in the environment. Finally,
many packages are omitted since I thought "people probably won't want
that", so the package list is completely up for debate. This is just a
reasonable starting point that works.
Build/test instructions:
To build the tarball:
$ ./kiwi-build --image-profile=WSL-Base --image-type=tbz --output-dir=./build/
Get it to a Windows host with WSL installed. To boot it with cgroupsv2,
add the following to `.wslconfig` in the Windows host home folder:
[wsl2]
kernelCommandLine=systemd.unified_cgroup_hierarchhy=1 cgroup_no_v1=all
This assumes the latest WSL release is installed, at least version 2.4.4:
$ wsl --install --from-file .\path\to\the\fedora.tar.xz
Alternatively, if you're using something prior to version 2.4.4:
$ wsl --import --version=2 Fedora C:\path\to\storage\Fedora\ .\path\to\the\fedora.tar.xz
Finally, run it with:
$ wsl -d Fedora
If you are using 2.4.4+, you will be prompted for a username and then
dropped into an interactive shell with that user and passwordless sudo
access.
If you're using an older version, you need to do:
$ wsl -d Fedora -u root
# /usr/libexec/wsl/oobe.sh
Signed-off-by: Jeremy Cline <jeremycline@linux.microsoft.com>
|
|
This avoids a dependency on the full systemd package for non-init
containers.
|
|
This package is intended to be the place for Azure utilities along with
the various udev rules that currently live in the WALinuxAgent package.
At the moment it just contains the `azure-nvme-id` binary and udev rules
for providing symlinks in /dev/disk/azure/ for local, data, and
OS disks.
|
|
This is similar to "ubi-init" on UBI/RHEL side.
Fixes BZ 2278884.
|
|
[root@ba1ab1388008 /]# dnf5 install dnf5-plugins --setopt=install_weak_deps=False
...
Total size of inbound packages is 2 MiB. Need to download 2 MiB.
After this operation 13 MiB will be used (install 13 MiB, remove 0 B).
...
Fixes: https://pagure.io/releng/issue/12105
Fixes: https://pagure.io/releng/issue/12106
|
|
updates for "virtual image" usable under KVM
- don't use 4k block size
- don't use CDL partitioning
- don't use DASD related kernel parameters
|
|
|
|
systemd 256 added a new feature which wants to create users on
boot if none exist yet:
https://github.com/systemd/systemd/commit/3ccadbce3358ba1db7ce5fa3f8dd17c627ffd93b
We don't want that, cloud-init handles this situation. So let's
disable it.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
|
|
The amazon-ec2-utils package includes udev rules that make it easier to
identify block storage devices and sets some configuration for other
storage devices.
Users can run awscli2 to manage their AWS cloud resources.
The ec2-instance-connect package allows one click console access to a
Fedora instance from the AWS console (website).
Signed-off-by: Major Hayden <major@redhat.com>
|
|
dnf5 (in obsoleting-dnf mode) provides /usr/bin/yum and obsoletes
yum, so we should drop the 'dnf-yum' entries (which installed
yum). dnf5 also appears to provide and obsolete microdnf, so we
should replace microdnf with dnf5 in the minimal image, I guess.
dnf5-plugins seems the logical replacement for dnf-plugins-core
(which is not removed yet, but is specific to dnf4).
Signed-off-by: Adam Williamson <awilliam@redhat.com>
|
|
This variable was dropped when switching to kiwi.
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=2278652
Signed-off-by: Clement Verna <cverna@tutanota.com>
|
|
It was previously being pulled in via weak dependencies of fwupd,
but we removed fwupd in #47 and now it's not there any more. It
is needed for the first boot resize by cloud-init to work, since
we use a btrfs filesystem.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
|
|
The F39 minimal and generic container both had util-linux-core in
them. If this wasn't an intentional change, let's add it back.
Also note that util-linux wasn't actually removed in the change linked
in https://bugzilla.redhat.com/show_bug.cgi?id=1951111#c1
|
|
|
|
Use consistent network device names for network devices instead of
forcing the old "ethX" names from pre-2017. This ensures that
specialized network devices, such as SR-IOV devices, are easy to
recognize and configure inside a Fedora instance on a public cloud or
OpenStack cloud.
FESCo ticket: https://pagure.io/fesco/issue/3190
Change proposal: https://fedoraproject.org/wiki/Changes/EnableConsistentDeviceNamingCloud
Signed-off-by: Major Hayden <major@redhat.com>
|
|
Fixes booting the Generic image on systems without any video device.
ref. https://github.com/teemtee/tmt/issues/2771
|
|
The dracut package contains tools to create bootable initramfses for the
Linux kernel. Historically, neither the Container/Dockerfile nor the
Kickstart equivalents of the fedora-toolbox OCI images contained dracut.
The KIWI description of the image was including dracut because it's
listed as a Requires(pre) of the grub2-tools package [1].
Unless someone comes forward and says that they are using Toolbx to hack
on the boot stack, it's better to retain the status quo for the sake of
a smaller image.
Since an RPM's %pre scriptlet is run before a package is installed [2],
it should be safe to remove dracut after the grub2-tools package has
been installed.
[1] https://src.fedoraproject.org/rpms/grub2
[2] https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/
https://pagure.io/fedora-kiwi-descriptions/pull-request/40
|
|
They are currently being pulled in as dependencies of dracut and
grub2-tools respectively. However, since they are explicitly mentioned
in the list of default RPMs on Fedora Silverblue and Workstation [1],
they should be mentioned here too, especially since packages like dracut
and grub2-tools are related to booting the host operating system and
might not be useful in a container.
[1] https://pagure.io/fedora-comps/
https://pagure.io/fedora-kiwi-descriptions/pull-request/40
|
|
Fedora Silverblue and Workstation, and so the Kickstart equivalent of
the fedora-toolbox OCI image, contain langpacks-en by default. It's
absence leads to a significant difference in the list of RPMs, which is
better to avoid so close to the Fedora 40 final release:
-abattis-cantarell-vf-fonts-0.301-12.fc40.noarch
-default-fonts-core-sans-4.0-12.fc40.noarch
-fonts-filesystem-2.0.5-14.fc40.noarch
-google-noto-fonts-common-20240301-3.fc41.noarch
-google-noto-sans-mono-vf-fonts-20240301-3.fc41.noarch
-google-noto-sans-vf-fonts-20240301-3.fc41.noarch
-google-noto-serif-vf-fonts-20240301-3.fc41.noarch
-hunspell-1.7.2-7.fc40.x86_64
-hunspell-en-0.20201207-9.fc40.noarch
-hunspell-en-GB-0.20201207-9.fc40.noarch
-hunspell-en-US-0.20201207-9.fc40.noarch
-hunspell-filesystem-1.7.2-7.fc40.x86_64
-langpacks-core-en-4.0-12.fc40.noarch
-langpacks-fonts-en-4.0-12.fc40.noarch
-liberation-fonts-common-2.1.5-9.fc40.noarch
-liberation-mono-fonts-2.1.5-9.fc40.noarch
-liberation-sans-fonts-2.1.5-9.fc40.noarch
-liberation-serif-fonts-2.1.5-9.fc40.noarch
-sil-mingzat-fonts-1.100-5.fc40.noarch
The plan is to investigate if Toolbx containers can use some of these
packages from the host. However, that needs to be co-ordinated with the
toolbox(1) binary, and has to be a done in a way that works across a
wide variety of container and host combinations.
Until then, it's safer to retain the status quo.
https://pagure.io/fedora-kiwi-descriptions/pull-request/37
|
|
passwd was retired, it's function was replaced by shadow-utils,
which is already included
see https://fedoraproject.org/wiki/Changes/LibuserDeprecation
|
|
It's the *Google* image that's required to have a 10 GB root
for performance reasons, not the EC2 image, as the comment says,
but the change was inadvertently applied to the EC2 image not
the Google one. This means our Google image is slow and our EC2
images are failing to be published as AMIs.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
|
|
Gary Buhrmaster noticed gzip was missing from the Fedora 40 container.
An extremely quick and gross diff produced by doing:
podman run -it --rm --entrypoint /usr/bin/rpm fedora:39 -qa \
| sort | uniq | awk '{ split($0,a,"-[0-9]"); print a[1] }' > f39.txt
shows the following for Fedora Minimal 39 -> 40:
-abattis-cantarell-vf-fonts
+audit-libs
-default-fonts-core-sans
-fonts-filesystem
-google-noto-fonts-common
-google-noto-sans-mono-vf-fonts
-google-noto-sans-vf-fonts
-google-noto-serif-vf-fonts
-gpg-pubkey
+gpg-pubkey-a15b79cc
+json-c
-langpacks-core-en
-langpacks-en
-langpacks-fonts-en
+libcap-ng
+libeconf
-libsigsegv
+libtool-ltdl
+pam-libs
-systemd-libs
-util-linux-core
-zlib
+zlib-ng-compat
For Fedora 39 -> 40:
-authselect
-authselect-libs
-cracklib
-gpg-pubkey
+gpg-pubkey-a15b79cc
-gzip
-libdb
-libpwquality
-libsigsegv
+libtool-ltdl
-pam
-sudo
-systemd-libs
-util-linux-core
-zlib
+zlib-ng-compat
This adds gzip and sudo back to the non-minimal container, as well as
bzip2, xz, and zstd to round out the set of [de]compression tools.
|
|
On ppc64le, power-utils is pulled in by being default in Core group.
This in turn pulls in power-utils-core, which pulls in systemd-udev.
When kiwi goes to remove kbd-misc on ppc64le only, it fails because
systemd-udev is a protected package. On other arches since it's not
installed, it works.
So, we are going to just drop this for now and revisit solutions after
Beta is out the door.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
|
|
These were accidentally omitted when they were ported over.
|
|
VA-API does not exist in s390x, so we need this filtered out for
that architecture.
|
|
This allows building cloud images for Z systems.
|
|
Fedora Silverblue and Workstation [1], and so the Container/Dockerfile
and Kickstart [2] equivalents of the fedora-toolbox OCI images, contain
vim-minimal by default, not vim-enhanced. This is because the default
editor is GNU nano, not Vim [3].
[1] https://pagure.io/fedora-comps/
[2] fedora-kickstarts commit d6aac886a01ae625
https://pagure.io/fedora-kickstarts/c/d6aac886a01ae625
https://pagure.io/fedora-kickstarts/pull-request/1003
[3] https://fedoraproject.org/wiki/Changes/UseNanoByDefault
https://pagure.io/fedora-kiwi-descriptions/pull-request/24
|
|
The same change was made to the Kickstart equivalent of the
fedora-toolbox:41 OCI image recently [1].
This is meant to distinguish OCI containers and images that are designed
specifically for Toolbx from others. Toolbx containers are long-lasting
pet containers for interactive command line use, which makes them
substantially different from short-lived containers running services.
Therefore, it can be useful to be able to identify Toolbx containers and
images when generating statistics about Fedora usage.
[1] fedora-kickstarts commit 0d99c64eb2721c5b
https://pagure.io/fedora-kickstarts/c/0d99c64eb2721c5b
https://pagure.io/fedora-kickstarts/pull-request/1015
https://pagure.io/Fedora-Council/tickets/issue/449
|
|
The zstd RPM is neither part of the default Fedora Silverblue
and Workstation installation [1], nor the Container/Dockerfile and
Kickstart equivalents of the fedora-toolbox images [2,3]. Therefore,
there's no need to need to include it in the KIWI description.
Fallout from d27e4c3f6c3e13bcefe9d1d904386794140d8a91
[1] https://pagure.io/fedora-comps/
[2] https://src.fedoraproject.org/container/fedora-toolbox
https://github.com/containers/toolbox/tree/main/images/fedora
[3] https://pagure.io/fedora-kickstarts/blob/main/f/fedora-container-toolbox.ks
https://pagure.io/fedora-kiwi-descriptions/pull-request/21
|
|
The Container/Dockerfile and Kickstart equivalents of the fedora-toolbox
OCI images installed all locale definitions, translations, and weak
dependencies (barring exceptions) [1,2]. In fact, the Containerfile
tried very hard to restore any content that was stripped out by the
fedora base image. Hence, the KIWI descriptions should do the same.
Sometimes, like in the case of the gawk and gawk-all-langpacks RPMs,
skipping weak dependencies also strips out translations.
The Kickstart files did this by decoupling fedora-container-common.ks
from fedora-container-common.ks [3], and this is the KIWI equivalent of
the same change.
The separate 'packages' elements of types 'bootstrap' and 'image' [4]
are no longer needed and have been fused into one. This avoids the need
to specify the 'ignore' child elements separately.
This change has two workarounds that deserve mention.
First, enabling weak dependencies for the packages that used to come
from the ContainerCore profile pulls in systemd, and config.xml
specifies a keytable for all the KIWI descriptions. These two combined
makes KIWI try to set the keymap/keytable using systemd-firstboot(1),
and it fails the build with:
[ INFO ]: Setting up keytable:
[ DEBUG ]: EXEC: [chroot /path/to/image-root systemd-firstboot --help]
[ DEBUG ]: EXEC: [chroot /path/to/image-root systemd-firstboot --keymap=us]
[ DEBUG ]: EXEC: Failed with stderr: Keymap us is not installed.
, stdout: (no output on stdout)
[ ERROR ]: KiwiCommandError: chroot: stderr: Keymap us is not installed.
, stdout: (no output on stdout)
This has been worked around by making the keymaps available during the
image build through the kbd-misc RPM, which is later uninstalled.
Second, KIWI isn't passing the 'ignore' child elements to DNF [5], and
hence they currently have no effect. This has been worked around by
uninstalling the RPMs later.
Some noteworthy changes in the list of RPMs in the fedora-toolbox image
after this change:
...
+gawk-all-langpacks-5.3.0-3.fc40.x86_64
...
-glibc-2.39.9000-5.fc41.i686
-glibc-gconv-extra-2.39.9000-5.fc41.i686
-glibc-minimal-langpack-2.39.9000-5.fc41.x86_64
...
-libgcc-14.0.1-0.8.fc41.i686
...
+python-unversioned-command-3.12.2-2.fc41.noarch
They are all in line with the latest Kickstart equivalent of the image.
[1] https://src.fedoraproject.org/container/fedora-toolbox
https://github.com/containers/toolbox/tree/main/images/fedora
[2] https://pagure.io/fedora-kickstarts/blob/main/f/fedora-container-toolbox.ks
[3] fedora-kickstarts commit 30f76d387d9e7f5c
https://pagure.io/fedora-kickstarts/c/30f76d387d9e7f5c
https://pagure.io/fedora-kickstarts/pull-request/1002
[4] https://osinside.github.io/kiwi/concept_and_workflow/packages.html
[5] https://github.com/OSInside/kiwi/issues/2499
https://pagure.io/fedora-kiwi-descriptions/pull-request/21
|
|
This incorporates the labels that are expected for Fedora images.
|
|
Anything lower than that causes performance problems.
|
Adam Williamson
Jan Pazdziora
Neal Gompa
jackyzy823
Jeremy Cline
Clement Verna
Debarshi Ray
Janne Grunau
Simon de Vlieger
Zbigniew Jędrzejewski-Szmek
David Abdurachmanov
Jeremy Cline
Romain Geissler
Pavel Raiskup
Dan Horák
Major Hayden
Clement Verna
Dusty Mabe
Yanko Kaneti
František Zatloukal
Michal Hlavinka
Kevin Fenzi
