Merge branch 'f41_tier0_cryptsetup' into 'f41'

[F41] cherry-picked fixes for dracut modules

See merge request fedora/bootc/base-images!38

Containerfile

@@ -23,7 +23,7 @@
 # Because it's generating a base image and uses containerbuildcontextization features itself.
 # In the future some of this can be lifted.
 
-FROM quay.io/fedora/fedora:40 as repos
+FROM quay.io/fedora/fedora:41 as repos
 
 FROM quay.io/centos-bootc/bootc-image-builder:latest as builder
 ARG MANIFEST=fedora-bootc.yaml

fedora-bootc-config.json

@@ -3,7 +3,7 @@
         "containers.bootc": "1",
         "bootc.diskimage-builder": "quay.io/centos-bootc/bootc-image-builder",
         "redhat.id": "fedora",
-        "redhat.version-id": "40"
+        "redhat.version-id": "41"
     },
     "StopSignal": "SIGRTMIN+3",
     "Env": [

fedora-bootc.yaml

@@ -1,15 +1,12 @@
-releasever: 40
+releasever: 41
-variables:
-  distro: "fedora"
-
 repos:
   - fedora
-  - updates
 
 metadata:
   name: fedora-boot-tier1
   summary: Fedora Bootable Tier 1
 
 include:
+  - fedora-generic.yaml
   - tier-1/manifest.yaml
   - tier-1/kernel.yaml

fedora-generic.yaml

@@ -0,0 +1,7 @@
+variables:
+  distro: "fedora"
+
+# Fedora-specific packages here
+packages:
+  # https://gitlab.com/fedora/bootc/base-images/-/issues/12
+  - fedora-repos-archive

fedora-tier-0.yaml

@@ -1,15 +1,12 @@
-releasever: 40
+releasever: 41
-variables:
-  distro: "fedora"
-
 repos:
-  - fedora-devel
+  - fedora
-  - fedora-updates
 
 metadata:
   name: fedora-boot-tier0
   summary: Fedora Bootable Tier 0
 
 include:
+  - fedora-generic.yaml
   - tier-0/manifest.yaml
   - tier-0/kernel.yaml

fedora.repo

@@ -3,8 +3,8 @@
 
 [fedora]
 name=Fedora $releasever - $basearch
-baseurl=https://dl.fedoraproject.org/pub/fedora/linux/releases/$releasever/Everything/$basearch/os/
+# using the Latest Fedora 41 repository from Koji until GA
-        https://dl.fedoraproject.org/pub/fedora-secondary/releases/$releasever/Everything/$basearch/os/
+baseurl=https://kojipkgs.fedoraproject.org/compose/branched/latest-Fedora-41/compose/Everything/$basearch/os/
 #metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
 enabled=1
 #metadata_expire=7d
@@ -37,66 +37,3 @@ gpgcheck=1
 metadata_expire=6h
 gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
 skip_if_unavailable=False
-
-[fedora-modular]
-name=Fedora Modular $releasever - $basearch
-baseurl=https://dl.fedoraproject.org/pub/fedora/linux/releases/$releasever/Modular/$basearch/os/
-        https://dl.fedoraproject.org/pub/fedora-secondary/releases/$releasever/Modular/$basearch/os/
-#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-modular-$releasever&arch=$basearch
-enabled=1
-#metadata_expire=7d
-repo_gpgcheck=0
-type=rpm
-gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
-skip_if_unavailable=False
-
-[fedora-updates-modular]
-name=Fedora Modular $releasever - $basearch - Updates
-baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Modular/$basearch/
-        https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Modular/$basearch/
-#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-modular-f$releasever&arch=$basearch
-enabled=1
-repo_gpgcheck=0
-type=rpm
-gpgcheck=1
-metadata_expire=6h
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
-skip_if_unavailable=False
-
-[fedora-updates-testing-modular]
-name=Fedora Modular $releasever - $basearch - Test Updates
-baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Modular/$basearch/
-        https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Modular/$basearch/
-#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
-enabled=1
-gpgcheck=1
-metadata_expire=6h
-gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
-skip_if_unavailable=False
-
-[rawhide]
-name=Fedora - Rawhide - Developmental packages for the next Fedora release
-baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/
-        https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/
-#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
-enabled=1
-#metadata_expire=7d
-repo_gpgcheck=0
-type=rpm
-gpgcheck=1
-gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
-skip_if_unavailable=False
-
-[fedora-devel]
-name=Fedora $releasever - $basearch
-baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/
-        https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/
-#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
-enabled=1
-#metadata_expire=7d
-repo_gpgcheck=0
-type=rpm
-gpgcheck=1
-gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
-skip_if_unavailable=False

renovate.json

@@ -3,10 +3,12 @@
   "extends": [
     "github>platform-engineering-org/.github"
   ],
+  "baseBranches": ["main", "f40"],
   "packageRules": [
     {
       "matchPackageNames": ["quay.io/fedora/fedora"],
-      "allowedVersions": "=40"
+      "allowedVersions": "=40",
+      "matchBaseBranches": ["f40"]
     }
   ]
 }

tier-0/initramfs.yaml

@@ -6,13 +6,13 @@ postprocess:
     cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF'
     # We want a generic image; hostonly makes no sense as part of a server side build
     hostonly=no
-    dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree "
+    add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree "
     EOF
     cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF'
     # Extra modules that we want by default that are known to exist in the kernel
-    dracutmodules+=" virtiofs "
+    add_dracutmodules+=" virtiofs "
     EOF
     cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF'
     # We want this for systemd-cryptsetup tpm2 locking
-    dracutmodules+=" tpm2-tss "
+    add_dracutmodules+=" systemd-cryptsetup tpm2-tss "
     EOF

tier-0/manifest.yaml

@@ -50,6 +50,7 @@ remove-from-packages:
 
 include:
   - bootc.yaml
+  - bootupd.yaml
   - ostree.yaml
   - initramfs.yaml
   - autoupdates.yaml
@@ -65,8 +66,3 @@ packages:
   - container-selinux
   # Needed for tpm2 bound luks
   - tpm2-tools
-
-# See https://github.com/coreos/bootupd
-arch-include:
-  x86_64: bootupd.yaml
-  aarch64: bootupd.yaml

tier-1/bootc-generic-growpart

@@ -3,15 +3,18 @@ set -eu
 
 backing_device=$(findmnt -vno SOURCE /sysroot)
 echo "Backing device: ${backing_device}"
+
+# Handling devicemapper targets is a whole other thing
+case $backing_device in
+    /dev/mapper/*) echo "Not growing $backing_device"; exit 0 ;;
+esac
+
 syspath=/sys/class/block/$(basename "${backing_device}")
 if ! test -d "${syspath}"; then
     echo "failed to find backing device ${syspath}"; exit 1
 fi
 
-# Handling devicemapper targets is a whole other thing
+
-case $backing_device in
-    /dev/mapper/*) "Not growing $backing_device"; exit 0 ;;
-esac
 
 # Note that we expect that the rootfs is on a partition
 partition=$(cat "${syspath}"/partition)

tier-1/initramfs-full.yaml

@@ -4,5 +4,5 @@ postprocess:
     #!/usr/bin/env bash
     mkdir -p /usr/lib/dracut/dracut.conf.d
     cat > /usr/lib/dracut/dracut.conf.d/30-bootc-tier-1.conf << 'EOF'
-    dracutmodules+=" lvm crypt "
+    add_dracutmodules+=" lvm crypt fips "
     EOF