Skip to content

Commit bf87261

Browse files
inffyinffy
committed
feat: produce BETA ISOs
1 parent 421fd5b commit bf87261

5 files changed

Lines changed: 232 additions & 3 deletions

File tree

‎.github/workflows/build-iso-beta.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
name: Build Beta ISOs
3+
on:
4+
merge_group:
5+
pull_request:
6+
branches:
7+
- main
8+
paths:
9+
- ".github/workflows/build-iso-beta.yml"
10+
- ".github/workflows/reusable-build-iso-anaconda.yml"
11+
- "iso_files/**"
12+
workflow_call:
13+
workflow_dispatch:
14+
inputs:
15+
upload_artifacts:
16+
description: 'Upload ISOs as job artifacts'
17+
type: boolean
18+
default: false
19+
upload_r2:
20+
description: 'Upload ISOs to Cloudflare R2'
21+
type: boolean
22+
default: true
23+
24+
jobs:
25+
build-iso-beta:
26+
name: Build Beta ISOs
27+
uses: ./.github/workflows/reusable-build-iso-anaconda.yml
28+
secrets: inherit
29+
with:
30+
image_version: beta
31+
hook_script: iso_files/configure_iso_anaconda_beta.sh
32+
# Upload artifacts on PR checks or if manually requested
33+
upload_artifacts: ${{ github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && inputs.upload_artifacts) }}
34+
# Upload to R2 on merge_group, scheduled runs, or if manually requested
35+
upload_r2: ${{ github.event_name == 'merge_group' || github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.upload_r2) }}

‎.github/workflows/reusable-build-iso-anaconda.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,14 @@ on:
1111
description: 'Upload ISOs to Cloudflare R2'
1212
type: boolean
1313
default: true
14+
image_version:
15+
description: 'Image version/tag to build (e.g. stable, beta)'
16+
type: string
17+
default: stable
18+
hook_script:
19+
description: 'Path to the ISO post-rootfs hook script'
20+
type: string
21+
default: iso_files/configure_iso_anaconda.sh
1422

1523
env:
1624
IMAGE_REGISTRY: "ghcr.io/ublue-os"
@@ -29,7 +37,7 @@ jobs:
2937
matrix:
3038
platform: [amd64]
3139
flavor: ["main", "nvidia-open"]
32-
image_version: ["stable"]
40+
image_version: ["${{ inputs.image_version }}"]
3341
permissions:
3442
contents: read
3543
packages: read
@@ -83,7 +91,7 @@ jobs:
8391
with:
8492
image-ref: ${{ steps.image_ref.outputs.image_ref }}:${{ matrix.image_version }}
8593
flatpaks-list: ${{ steps.flatpak_list.outputs.file_list_path }}
86-
hook-post-rootfs: ${{ github.workspace }}/iso_files/configure_iso_anaconda.sh
94+
hook-post-rootfs: ${{ github.workspace }}/${{ inputs.hook_script }}
8795
kargs: ${{ steps.image_ref.outputs.kargs }}
8896

8997
- name: Rename ISO

‎Justfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ flavors := '(
1010
tags := '(
1111
[stable]=stable
1212
[latest]=latest
13+
[beta]=beta
1314
)'
1415
export SUDO_DISPLAY := if `if [ -n "${DISPLAY:-}" ] || [ -n "${WAYLAND_DISPLAY:-}" ]; then echo true; fi` == "true" { "true" } else { "false" }
1516
export SUDOIF := if `id -u` == "0" { "" } else if SUDO_DISPLAY == "true" { "sudo --askpass" } else { "sudo" }

‎iso_files/configure_iso_anaconda.sh‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@ rm -f fedora-logos*.rpm
3535

3636
# Configure Anaconda
3737

38-
# Install Anaconda WebUI
3938
SPECS=(
4039
"libblockdev-btrfs"
4140
"libblockdev-lvm"

‎iso_files/configure_iso_anaconda_beta.sh‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
#!/usr/bin/env bash
2+
3+
set -eoux pipefail
4+
5+
IMAGE_INFO="$(cat /usr/share/ublue-os/image-info.json)"
6+
IMAGE_TAG="$(jq -c -r '."image-tag"' <<<"$IMAGE_INFO")"
7+
IMAGE_REF="$(jq -c -r '."image-ref"' <<<"$IMAGE_INFO")"
8+
IMAGE_REF="${IMAGE_REF##*://}"
9+
sbkey='https://github.com/ublue-os/akmods/raw/main/certs/public_key.der'
10+
11+
# Configure Live Environment
12+
glib-compile-schemas /usr/share/glib-2.0/schemas
13+
14+
systemctl disable rpm-ostree-countme.service
15+
systemctl disable tailscaled.service
16+
systemctl disable bootloader-update.service
17+
systemctl disable brew-upgrade.timer
18+
systemctl disable brew-update.timer
19+
systemctl disable brew-setup.service
20+
systemctl disable rpm-ostreed-automatic.timer
21+
systemctl disable uupd.timer
22+
systemctl disable ublue-system-setup.service
23+
systemctl disable flatpak-preinstall.service
24+
systemctl --global disable podman-auto-update.timer
25+
systemctl --global disable ublue-user-setup.service
26+
rm /usr/share/applications/dev.getaurora.system-update.desktop
27+
28+
systemctl --global disable bazaar.service
29+
30+
# HACK for https://bugzilla.redhat.com/show_bug.cgi?id=2433186
31+
rpm --erase --nodeps --justdb generic-logos
32+
dnf download fedora-logos
33+
rpm -i --justdb fedora-logos*.rpm
34+
rm -f fedora-logos*.rpm
35+
36+
# Configure Anaconda
37+
38+
SPECS=(
39+
"libblockdev-btrfs"
40+
"libblockdev-lvm"
41+
"libblockdev-dm"
42+
"anaconda-live"
43+
"anaconda-webui"
44+
)
45+
46+
dnf install -y "${SPECS[@]}"
47+
48+
rpm --erase --nodeps --justdb fedora-logos
49+
50+
# Anaconda Profile Detection
51+
52+
# Aurora Beta (includes additional hidden spokes for user account creation)
53+
tee /etc/anaconda/profile.d/aurora.conf <<'EOF'
54+
# Anaconda configuration file for Aurora Beta
55+
56+
[Profile]
57+
# Define the profile.
58+
profile_id = aurora
59+
60+
[Profile Detection]
61+
# Match os-release values
62+
os_id = aurora
63+
64+
[Network]
65+
default_on_boot = FIRST_WIRED_WITH_LINK
66+
67+
[Bootloader]
68+
efi_dir = fedora
69+
menu_auto_hide = True
70+
71+
[Storage]
72+
default_scheme = BTRFS
73+
btrfs_compression = zstd:1
74+
default_partitioning =
75+
/ (min 1 GiB, max 70 GiB)
76+
/home (min 500 MiB, free 50 GiB)
77+
/var (btrfs)
78+
79+
[User Interface]
80+
webui_web_engine = slitherer
81+
hidden_spokes =
82+
NetworkSpoke
83+
PasswordSpoke
84+
UserSpoke
85+
hidden_webui_pages =
86+
root-password
87+
network
88+
anaconda-screen-accounts
89+
EOF
90+
91+
# add intaller to kickoff
92+
sed -i '2s/$/;liveinst.desktop/' /usr/share/kde-settings/kde-profile/default/xdg/kicker-extra-favoritesrc
93+
94+
# Configure
95+
. /etc/os-release
96+
echo "Aurora release $VERSION_ID ($VERSION_CODENAME)" >/etc/system-release
97+
98+
sed -i 's/ANACONDA_PRODUCTVERSION=.*/ANACONDA_PRODUCTVERSION=""/' /usr/{,s}bin/liveinst || true
99+
100+
# Add StartupWMClass so the running window inherits the icon
101+
desktop-file-edit \
102+
--set-key=Icon --set-value=/usr/share/icons/hicolor/scalable/apps/dev.getaurora.installer.svg \
103+
--set-key=StartupWMClass --set-value=slitherer \
104+
/usr/share/applications/liveinst.desktop
105+
106+
git clone https://github.com/get-aurora-dev/branding /tmp/branding
107+
cp -r /tmp/branding/iso_files/usr/* /usr/
108+
rm -rf /tmp/branding
109+
110+
# Users can mess with flatpaks on the live environment which will get
111+
# carried over to the installed system
112+
cp -a /var/lib/flatpak /var/lib/flatpak_original
113+
114+
tee -a /etc/xdg/kwalletrc <<EOF
115+
[Wallet]
116+
Enabled=false
117+
EOF
118+
119+
# Interactive Kickstart
120+
tee -a /usr/share/anaconda/interactive-defaults.ks <<EOF
121+
ostreecontainer --url=$IMAGE_REF:$IMAGE_TAG --transport=containers-storage --no-signature-verification
122+
%include /usr/share/anaconda/post-scripts/install-configure-upgrade.ks
123+
%include /usr/share/anaconda/post-scripts/disable-fedora-flatpak.ks
124+
%include /usr/share/anaconda/post-scripts/install-flatpaks.ks
125+
%include /usr/share/anaconda/post-scripts/secureboot-enroll-key.ks
126+
EOF
127+
128+
# Signed Images
129+
tee /usr/share/anaconda/post-scripts/install-configure-upgrade.ks <<EOF
130+
%post --erroronfail
131+
bootc switch --mutate-in-place --enforce-container-sigpolicy --transport registry $IMAGE_REF:$IMAGE_TAG
132+
%end
133+
EOF
134+
135+
# Disable Fedora Flatpak
136+
tee /usr/share/anaconda/post-scripts/disable-fedora-flatpak.ks <<'EOF'
137+
%post --erroronfail
138+
systemctl disable flatpak-add-fedora-repos.service
139+
%end
140+
EOF
141+
142+
# Install Flatpaks
143+
tee /usr/share/anaconda/post-scripts/install-flatpaks.ks <<'EOF'
144+
%post --erroronfail --nochroot
145+
deployment="$(ostree rev-parse --repo=/mnt/sysimage/ostree/repo ostree/0/1/0)"
146+
target="/mnt/sysimage/ostree/deploy/default/deploy/$deployment.0/var/lib/"
147+
mkdir -p "$target"
148+
rsync -aAXUHKP /var/lib/flatpak_original/ "$target/flatpak"
149+
sync
150+
%end
151+
EOF
152+
153+
# cleanup our leftovers
154+
rm -rf /flatpak-list
155+
156+
# Fetch the Secureboot Public Key
157+
curl --retry 15 -Lo /etc/sb_pubkey.der "$sbkey"
158+
159+
# Enroll Secureboot Key
160+
tee /usr/share/anaconda/post-scripts/secureboot-enroll-key.ks <<'EOF'
161+
%post --erroronfail --nochroot
162+
set -oue pipefail
163+
164+
readonly ENROLLMENT_PASSWORD="universalblue"
165+
readonly SECUREBOOT_KEY="/etc/sb_pubkey.der"
166+
167+
if [[ ! -d "/sys/firmware/efi" ]]; then
168+
echo "EFI mode not detected. Skipping key enrollment."
169+
exit 0
170+
fi
171+
172+
if [[ ! -f "$SECUREBOOT_KEY" ]]; then
173+
echo "Secure boot key not provided: $SECUREBOOT_KEY"
174+
exit 0
175+
fi
176+
177+
SYS_ID="$(cat /sys/devices/virtual/dmi/id/product_name)"
178+
if [[ ":Jupiter:Galileo:" =~ ":$SYS_ID:" ]]; then
179+
echo "Steam Deck hardware detected. Skipping key enrollment."
180+
exit 0
181+
fi
182+
183+
mokutil --timeout -1 || :
184+
echo -e "$ENROLLMENT_PASSWORD\n$ENROLLMENT_PASSWORD" | mokutil --import "$SECUREBOOT_KEY" || :
185+
%end
186+
EOF

0 commit comments

Comments
 (0)