Skip to content

Commit 759763b

Browse files
inffyinffy
committed
feat: produce beta ISOs
1 parent 421fd5b commit 759763b

6 files changed

Lines changed: 232 additions & 4 deletions

File tree

‎.github/workflows/build-iso-beta.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
name: Build Beta ISOs
3+
on:
4+
merge_group:
5+
pull_request:
6+
branches:
7+
- main
8+
paths:
9+
- ".github/workflows/build-iso-beta.yml"
10+
- ".github/workflows/reusable-build-iso-anaconda.yml"
11+
- "iso_files/**"
12+
workflow_call:
13+
workflow_dispatch:
14+
inputs:
15+
upload_artifacts:
16+
description: 'Upload ISOs as job artifacts'
17+
type: boolean
18+
default: false
19+
upload_r2:
20+
description: 'Upload ISOs to Cloudflare R2'
21+
type: boolean
22+
default: true
23+
24+
jobs:
25+
build-iso-beta:
26+
name: Build Beta ISOs
27+
uses: ./.github/workflows/reusable-build-iso-anaconda.yml
28+
secrets: inherit
29+
with:
30+
image_version: beta
31+
hook_script: iso_files/configure_iso_anaconda_beta.sh
32+
# Upload artifacts on PR checks or if manually requested
33+
upload_artifacts: ${{ github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && inputs.upload_artifacts) }}
34+
# Upload to R2 on merge_group or if manually requested
35+
upload_r2: ${{ github.event_name == 'merge_group' || (github.event_name == 'workflow_dispatch' && inputs.upload_r2) }}

‎.github/workflows/promote-iso.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,10 @@ jobs:
3939
- name: List files in Test bucket
4040
run: |
4141
echo "Files in Test bucket:"
42-
/home/linuxbrew/.linuxbrew/bin/rclone ls R2_TEST:aurora-dl-test --include "*.iso" --include "*.iso-CHECKSUM"
42+
/home/linuxbrew/.linuxbrew/bin/rclone ls R2_TEST:aurora-dl-test \
43+
--include "*.iso" \
44+
--include "*.iso-CHECKSUM" \
45+
--exclude "aurora-beta-*"
4346
4447
- name: Promote ISOs (Dry Run)
4548
if: inputs.dry_run == true
@@ -48,6 +51,7 @@ jobs:
4851
/home/linuxbrew/.linuxbrew/bin/rclone sync R2_TEST:aurora-dl-test R2_PROD:aurora-dl \
4952
--include "*.iso" \
5053
--include "*.iso-CHECKSUM" \
54+
--exclude "aurora-beta-*" \
5155
--dry-run \
5256
--verbose
5357
@@ -58,6 +62,7 @@ jobs:
5862
/home/linuxbrew/.linuxbrew/bin/rclone sync R2_TEST:aurora-dl-test R2_PROD:aurora-dl \
5963
--include "*.iso" \
6064
--include "*.iso-CHECKSUM" \
65+
--exclude "aurora-beta-*" \
6166
--verbose \
6267
--progress
6368

‎.github/workflows/reusable-build-iso-anaconda.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,14 @@ on:
1111
description: 'Upload ISOs to Cloudflare R2'
1212
type: boolean
1313
default: true
14+
image_version:
15+
description: 'Image version/tag to build (e.g. stable, beta)'
16+
type: string
17+
default: stable
18+
hook_script:
19+
description: 'Path to the ISO post-rootfs hook script'
20+
type: string
21+
default: iso_files/configure_iso_anaconda.sh
1422

1523
env:
1624
IMAGE_REGISTRY: "ghcr.io/ublue-os"
@@ -29,7 +37,7 @@ jobs:
2937
matrix:
3038
platform: [amd64]
3139
flavor: ["main", "nvidia-open"]
32-
image_version: ["stable"]
40+
image_version: ["${{ inputs.image_version }}"]
3341
permissions:
3442
contents: read
3543
packages: read
@@ -83,7 +91,7 @@ jobs:
8391
with:
8492
image-ref: ${{ steps.image_ref.outputs.image_ref }}:${{ matrix.image_version }}
8593
flatpaks-list: ${{ steps.flatpak_list.outputs.file_list_path }}
86-
hook-post-rootfs: ${{ github.workspace }}/iso_files/configure_iso_anaconda.sh
94+
hook-post-rootfs: ${{ github.workspace }}/${{ inputs.hook_script }}
8795
kargs: ${{ steps.image_ref.outputs.kargs }}
8896

8997
- name: Rename ISO

‎Justfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ flavors := '(
1010
tags := '(
1111
[stable]=stable
1212
[latest]=latest
13+
[beta]=beta
1314
)'
1415
export SUDO_DISPLAY := if `if [ -n "${DISPLAY:-}" ] || [ -n "${WAYLAND_DISPLAY:-}" ]; then echo true; fi` == "true" { "true" } else { "false" }
1516
export SUDOIF := if `id -u` == "0" { "" } else if SUDO_DISPLAY == "true" { "sudo --askpass" } else { "sudo" }

‎iso_files/configure_iso_anaconda.sh‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@ rm -f fedora-logos*.rpm
3535

3636
# Configure Anaconda
3737

38-
# Install Anaconda WebUI
3938
SPECS=(
4039
"libblockdev-btrfs"
4140
"libblockdev-lvm"

‎iso_files/configure_iso_anaconda_beta.sh‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
#!/usr/bin/env bash
2+
3+
set -eoux pipefail
4+
5+
IMAGE_INFO="$(cat /usr/share/ublue-os/image-info.json)"
6+
IMAGE_TAG="$(jq -c -r '."image-tag"' <<<"$IMAGE_INFO")"
7+
IMAGE_REF="$(jq -c -r '."image-ref"' <<<"$IMAGE_INFO")"
8+
IMAGE_REF="${IMAGE_REF##*://}"
9+
sbkey='https://github.com/ublue-os/akmods/raw/main/certs/public_key.der'
10+
11+
# Configure Live Environment
12+
glib-compile-schemas /usr/share/glib-2.0/schemas
13+
14+
systemctl disable rpm-ostree-countme.service
15+
systemctl disable tailscaled.service
16+
systemctl disable bootloader-update.service
17+
systemctl disable brew-upgrade.timer
18+
systemctl disable brew-update.timer
19+
systemctl disable brew-setup.service
20+
systemctl disable rpm-ostreed-automatic.timer
21+
systemctl disable uupd.timer
22+
systemctl disable ublue-system-setup.service
23+
systemctl disable flatpak-preinstall.service
24+
systemctl --global disable podman-auto-update.timer
25+
systemctl --global disable ublue-user-setup.service
26+
rm /usr/share/applications/dev.getaurora.system-update.desktop
27+
28+
systemctl --global disable bazaar.service
29+
30+
31+
# Configure Anaconda
32+
33+
SPECS=(
34+
"libblockdev-btrfs"
35+
"libblockdev-lvm"
36+
"libblockdev-dm"
37+
"anaconda-live"
38+
"anaconda-webui"
39+
)
40+
41+
dnf install -y "${SPECS[@]}"
42+
43+
44+
# Anaconda Profile Detection
45+
46+
# Aurora Beta (includes additional hidden spokes for user account creation)
47+
tee /etc/anaconda/profile.d/aurora.conf <<'EOF'
48+
# Anaconda configuration file for Aurora Beta
49+
50+
[Profile]
51+
# Define the profile.
52+
profile_id = aurora
53+
54+
[Profile Detection]
55+
# Match os-release values
56+
os_id = aurora
57+
58+
[Network]
59+
default_on_boot = FIRST_WIRED_WITH_LINK
60+
61+
[Bootloader]
62+
efi_dir = fedora
63+
menu_auto_hide = True
64+
65+
[Storage]
66+
default_scheme = BTRFS
67+
btrfs_compression = zstd:1
68+
default_partitioning =
69+
/ (min 1 GiB, max 70 GiB)
70+
/home (min 500 MiB, free 50 GiB)
71+
/var (btrfs)
72+
73+
[User Interface]
74+
webui_web_engine = slitherer
75+
hidden_spokes =
76+
NetworkSpoke
77+
PasswordSpoke
78+
UserSpoke
79+
hidden_webui_pages =
80+
root-password
81+
network
82+
anaconda-screen-accounts
83+
EOF
84+
85+
# add installer to kickoff
86+
sed -i '2s/$/;liveinst.desktop/' /usr/share/kde-settings/kde-profile/default/xdg/kicker-extra-favoritesrc
87+
88+
# Configure
89+
. /etc/os-release
90+
echo "Aurora release $VERSION_ID ($VERSION_CODENAME)" >/etc/system-release
91+
92+
sed -i 's/ANACONDA_PRODUCTVERSION=.*/ANACONDA_PRODUCTVERSION=""/' /usr/{,s}bin/liveinst || true
93+
94+
# Add StartupWMClass so the running window inherits the icon
95+
desktop-file-edit \
96+
--set-key=Icon --set-value=/usr/share/icons/hicolor/scalable/apps/dev.getaurora.installer.svg \
97+
--set-key=StartupWMClass --set-value=slitherer \
98+
/usr/share/applications/liveinst.desktop
99+
100+
git clone https://github.com/get-aurora-dev/branding /tmp/branding
101+
cp -r /tmp/branding/iso_files/usr/* /usr/
102+
rm -rf /tmp/branding
103+
104+
# Users can mess with flatpaks on the live environment which will get
105+
# carried over to the installed system
106+
cp -a /var/lib/flatpak /var/lib/flatpak_original
107+
108+
tee -a /etc/xdg/kwalletrc <<EOF
109+
[Wallet]
110+
Enabled=false
111+
EOF
112+
113+
# Interactive Kickstart
114+
tee -a /usr/share/anaconda/interactive-defaults.ks <<EOF
115+
ostreecontainer --url=$IMAGE_REF:$IMAGE_TAG --transport=containers-storage --no-signature-verification
116+
%include /usr/share/anaconda/post-scripts/install-configure-upgrade.ks
117+
%include /usr/share/anaconda/post-scripts/disable-fedora-flatpak.ks
118+
%include /usr/share/anaconda/post-scripts/install-flatpaks.ks
119+
%include /usr/share/anaconda/post-scripts/secureboot-enroll-key.ks
120+
EOF
121+
122+
# Signed Images
123+
tee /usr/share/anaconda/post-scripts/install-configure-upgrade.ks <<EOF
124+
%post --erroronfail
125+
bootc switch --mutate-in-place --enforce-container-sigpolicy --transport registry $IMAGE_REF:$IMAGE_TAG
126+
%end
127+
EOF
128+
129+
# Disable Fedora Flatpak
130+
tee /usr/share/anaconda/post-scripts/disable-fedora-flatpak.ks <<'EOF'
131+
%post --erroronfail
132+
systemctl disable flatpak-add-fedora-repos.service
133+
%end
134+
EOF
135+
136+
# Install Flatpaks
137+
tee /usr/share/anaconda/post-scripts/install-flatpaks.ks <<'EOF'
138+
%post --erroronfail --nochroot
139+
deployment="$(ostree rev-parse --repo=/mnt/sysimage/ostree/repo ostree/0/1/0)"
140+
target="/mnt/sysimage/ostree/deploy/default/deploy/$deployment.0/var/lib/"
141+
mkdir -p "$target"
142+
rsync -aAXUHKP /var/lib/flatpak_original/ "$target/flatpak"
143+
sync
144+
%end
145+
EOF
146+
147+
# cleanup our leftovers
148+
rm -rf /flatpak-list
149+
150+
# Fetch the Secureboot Public Key
151+
curl --retry 15 -Lo /etc/sb_pubkey.der "$sbkey"
152+
153+
# Enroll Secureboot Key
154+
tee /usr/share/anaconda/post-scripts/secureboot-enroll-key.ks <<'EOF'
155+
%post --erroronfail --nochroot
156+
set -oue pipefail
157+
158+
readonly ENROLLMENT_PASSWORD="universalblue"
159+
readonly SECUREBOOT_KEY="/etc/sb_pubkey.der"
160+
161+
if [[ ! -d "/sys/firmware/efi" ]]; then
162+
echo "EFI mode not detected. Skipping key enrollment."
163+
exit 0
164+
fi
165+
166+
if [[ ! -f "$SECUREBOOT_KEY" ]]; then
167+
echo "Secure boot key not provided: $SECUREBOOT_KEY"
168+
exit 0
169+
fi
170+
171+
SYS_ID="$(cat /sys/devices/virtual/dmi/id/product_name)"
172+
if [[ ":Jupiter:Galileo:" =~ ":$SYS_ID:" ]]; then
173+
echo "Steam Deck hardware detected. Skipping key enrollment."
174+
exit 0
175+
fi
176+
177+
mokutil --timeout -1 || :
178+
echo -e "$ENROLLMENT_PASSWORD\n$ENROLLMENT_PASSWORD" | mokutil --import "$SECUREBOOT_KEY" || :
179+
%end
180+
EOF

0 commit comments

Comments
 (0)