This works around two issues:
- First, rpm switched to reading users/groups directly for
its implementation of systemd-sysusers, which meant
it no longer reads via nss, which breaks nss-altfiles.
xref: https://github.com/rpm-software-management/rpm/pull/2503#issuecomment-1536435351
and below.
- Second, even if that was fixed, `keylime` wants to add
its user to the group, which can't be done when it's a system
uid.
Since nothing in the OS content is owned by this group, we can
move underneath `/etc` by default.
Signed-off-by: Colin Walters <walters@verbum.org>
The versioning here was originally inherited from the Fedora CoreOS
configuration. However...the version numbering was always
overridden by coreos-assembler, so it wasn't actually used there!
Conceptually there are two things here:
- OS version
- Arbitrary date stamp
For the "OS version"...well, the closest thing we have actually
to "version of set of RPMs" is a compose today, which is expressed
in a distinct label already - at least for CentOS and RHEL.
For Fedora of course post-branching there are no "composes"
as such but just a set of floating RPMs post-release.
We have the "arbitrary date stamp" in the container image build
time already - and tooling like bootc and rpm-ostree show
both the version and the build time.
Let's significantly simplify our version numbers by just going
to "OS version".
This especially fixes the bug that we weren't setting
`releasever` anymore which just broke the version anyways.
Closes: https://gitlab.com/fedora/bootc/base-images/-/issues/40
Signed-off-by: Colin Walters <walters@verbum.org>
I just saw the sqlite-shm corruption in
https://gitlab.com/redhat/centos-stream/containers/bootc/-/merge_requests/437#note_2372766792
so let's just go ahead and turn on rpmdb_normalize which
also aids the reproducibility of the rpmdb.
While we're here let's also add a long overdue "unit test" for
the rootfs. This operates as a container build that mounts
the container-under-test as part of a multi-stage build.
Signed-off-by: Colin Walters <walters@verbum.org>
The "tiers" nomenclature ended up being unhelpful since
we introduced "tier-x" which is between tier-0 and tier-1.
We also never exposed the tier naming outside of our source
code. In preparation for doing so, rename to tier-0 to
"minimal" which is a bit more descriptive.
Renaming the other images will follow.
Signed-off-by: Colin Walters <walters@verbum.org>
2025-02-25 08:27:19 -05:00
Renamed from tier-0/postprocess-conf.yaml (Browse further)
