ci-test/fedora-common-ostree.yaml

ref: fedora/rawhide/${basearch}/ostree-base

automatic_version_prefix: "38"
mutate-os-release: "38"

include: fedora-common-ostree-pkgs.yaml

packages:
  - git-core
  - lvm2
  - rpm-ostree
  - bootupd
  # Container management
  - buildah
  - podman
  - skopeo
  - toolbox
  # Provides terminal tools like clear, reset, tput, and tset
  - ncurses
  # Flatpak support
  - flatpak
  - xdg-desktop-portal
  # HFS filesystem tools for Apple hardware
  # See https://github.com/projectatomic/rpm-ostree/issues/1380
  - hfsplus-tools
  # Contains default ostree remote config to be used on client's
  # system for fetching ostree update
  - fedora-repos-ostree
  # the archive repo for more reliable package layering
  # https://github.com/coreos/fedora-coreos-tracker/issues/400
  - fedora-repos-archive

selinux: true
documentation: true
boot-location: modules
etc-group-members:
  - wheel
tmp-is-dir: true

ignore-removed-users:
  - root
ignore-removed-groups:
  - root
check-passwd:
  type: file
  filename: passwd
check-groups:
  type: file
  filename: group

default_target: graphical.target

# Keep this in sync with fedora-atomic-host.json from fedora-atomic
packages-aarch64:
  - grub2-efi
  - ostree-grub2
  - efibootmgr
  - shim
packages-armhfp:
  - extlinux-bootloader
  - xorg-x11-drv-armada
packages-ppc64:
  - grub2
  - ostree-grub2
packages-ppc64le:
  - grub2
  - ostree-grub2
packages-x86_64:
  - grub2-efi-ia32
  - grub2-efi-x64
  - grub2-pc
  - ostree-grub2
  - efibootmgr
  - shim-ia32
  - shim-x64
  - microcode_ctl
  - mcelog
  - thermald
  - hyperv-daemons
  - open-vm-tools-desktop
  - virtualbox-guest-additions
  - xorg-x11-drv-intel
  - xorg-x11-drv-openchrome
  - xorg-x11-drv-vesa
  - xorg-x11-drv-vmware

# Make sure the following are not pulled in when Recommended by other packages
exclude-packages:
  - PackageKit
  # We can not include openh264. See https://fedoraproject.org/wiki/OpenH264
  - gstreamer1-plugin-openh264
  - mozilla-openh264
  - openh264

postprocess:
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail

    # Work around https://bugzilla.redhat.com/show_bug.cgi?id=1265295
    # From https://github.com/coreos/fedora-coreos-config/blob/testing-devel/overlay.d/05core/usr/lib/systemd/journald.conf.d/10-coreos-persistent.conf
    install -dm0755 /usr/lib/systemd/journald.conf.d/
    echo -e "[Journal]\nStorage=persistent" > /usr/lib/systemd/journald.conf.d/10-persistent.conf

    # See: https://src.fedoraproject.org/rpms/glibc/pull-request/4
    # Basically that program handles deleting old shared library directories
    # mid-transaction, which never applies to rpm-ostree. This is structured as a
    # loop/glob to avoid hardcoding (or trying to match) the architecture.
    for x in /usr/sbin/glibc_post_upgrade.*; do
        if test -f ${x}; then
            ln -srf /usr/bin/true ${x}
        fi
    done    
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail

    # Setup unit & script for readonly sysroot migration:
    # - https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot
    # - https://bugzilla.redhat.com/show_bug.cgi?id=2060976

    cat > /usr/lib/systemd/system/fedora-silverblue-readonly-sysroot.service <"EOF"    
[Unit]
Description=Fedora Silverblue Read-Only Sysroot Migration
Documentation=https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot
ConditionPathExists=!/var/lib/.fedora_silverblue_readonly_sysroot
RequiresMountsFor=/sysroot /boot
ConditionPathIsReadWrite=/sysroot

[Service]
Type=oneshot
ExecStart=/usr/libexec/fedora-silverblue-readonly-sysroot
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
"EOF"
    chmod 644 /usr/lib/systemd/system/fedora-silverblue-readonly-sysroot.service

    cat > /usr/libexec/fedora-silverblue-readonly-sysroot <"EOF"
#!/bin/bash

# Update an existing system to use a read only sysroot
# See https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot
# and https://bugzilla.redhat.com/show_bug.cgi?id=2060976

set -euo pipefail

main() {
    # Used to condition execution of this unit at the systemd level
    local -r stamp_file="/var/lib/.fedora_silverblue_readonly_sysroot

    if [[ -f "${stamp_file}" ]]; then
        exit 0
    fi

    local -r ostree_sysroot_readonly="$(ostree config --repo=/sysroot/ostree/repo get "sysroot.readonly" &> /dev/null || echo "false")"
    if [[ "${ostree_sysroot_readonly}" == "true" ]]; then
        # Nothing to do
        touch "${stamp_file}"
        exit 0
    fi

    local -r boot_entries="$(ls -A /boot/loader/entries/ | wc -l)"

    # Ensure that we can read BLS entries to avoid touching systems where /boot
    # is not mounted
    if [[ "${boot_entries}" -eq 0 ]]; then
        echo "No BLS entry found: Maybe /boot is not mounted?" 1>&2
        echo "This is unexpected thus no migration will be performed" 1>&2
        touch "${stamp_file}"
        exit 0
    fi

    # Check if any existing deployment is still missing the rw karg
    local rw_kargs_found=0
    local count=0
    for f in "/boot/loader/entries/"*; do
        count="$(grep -c "^options .* rw" "${f}" || true)"
        if [[ "${count}" -ge 1 ]]; then
            rw_kargs_found=$((rw_kargs_found + 1))
        fi
    done

    # Some deployments are still missing the rw karg. Let's try to update them
    if [[ "${boot_entries}" -ne "${rw_kargs_found}" ]]; then
        ostree admin kargs edit-in-place --append-if-missing=rw || \
            echo "Failed to edit kargs in place with ostree" 1>&2
    fi

    # Re-check if any existing deployment is still missing the rw karg
    rw_kargs_found=0
    count=0
    for f in "/boot/loader/entries/"*; do
        count="$(grep -c "^options .* rw" "${f}" || true)"
        if [[ "${count}" -ge 1 ]]; then
            rw_kargs_found=$((rw_kargs_found + 1))
        fi
    done
    unset count

    # If all deployments are good, then we can set the sysroot.readonly option
    # in the ostree repo config
    if [[ "${boot_entries}" -eq "${rw_kargs_found}" ]]; then
        echo "Setting up the sysroot.readonly option in the ostree repo config"
        ostree config --repo=/sysroot/ostree/repo set "sysroot.readonly" "true"
        touch "${stamp_file}"
        exit 0
    fi

    # If anything else before failed, we will retry on next boot
    echo "Will retry next boot" 1>&2
    exit 0
}

main "${@}"
EOF
    chmod 755 /usr/libexec/fedora-silverblue-readonly-sysroot

    # Enable the corresponding unit
    systemctl enable fedora-silverblue-readonly-sysroot.service