3dea4b934c
If instructed, the rpm stage checks all digests and signatures of a package explicitly using `rpmkeys` tool. The default stage behavior is that no package signatures are checked when installed by the stage (not even explicitly). For these reasons, the package signature checking is supposed to be disabled when installing rpm packages. This was achieved by passing the `--define "_pkgverify_level none"` option to rpm. However this option specifies only requirements for a package to be installed and `none` means that packages without any signature are accepted by rpm. If the package signature is deemed BAD, the package installation fails even though this option has been passed to rpm. There are valid cases when even packages which signature marked as BAD should be installed. It may happen, that the GPG key used to sign a package uses an algorithm not allowed by the system crypto policy, e.g. SHA1. If such GPG key is imported on the system and a package signed using it is being installed, its installation would fail when the package is read by rpm. This is because its signatures are by default checked if they exist in the package. The desired behavior to not check any package signatures when installing a package is instead achieved by using `--nosignature` rpm option. It turns off the whole signature checking mechanism. Use the `--nosignature` rpm option instead of `--define "_pkgverify_level none"`, when installing packages using rpm. Fix https://github.com/osbuild/osbuild/issues/991 |
||
|---|---|---|
| .devcontainer | ||
| .github | ||
| assemblers | ||
| data | ||
| devices | ||
| docs | ||
| inputs | ||
| mounts | ||
| osbuild | ||
| runners | ||
| schemas | ||
| schutzbot | ||
| selinux | ||
| sources | ||
| stages | ||
| test | ||
| tools | ||
| .editorconfig | ||
| .gitignore | ||
| .gitlab-ci.yml | ||
| .packit.yaml | ||
| .travis.yml | ||
| LICENSE | ||
| Makefile | ||
| osbuild.spec | ||
| README.md | ||
| requirements.txt | ||
| samples | ||
| setup.cfg | ||
| setup.py | ||
OSBuild
Build-Pipelines for Operating System Artifacts
OSBuild is a pipeline-based build system for operating system artifacts. It defines a universal pipeline description and a build system to execute them, producing artifacts like operating system images, working towards an image build pipeline that is more comprehensible, reproducible, and extendable.
See the osbuild(1) man-page for details on how to run osbuild, the definition
of the pipeline description, and more.
Project
- Website: https://www.osbuild.org
- Bug Tracker: https://github.com/osbuild/osbuild/issues
- IRC: #osbuild on Libera.Chat
- Changelog: https://github.com/osbuild/osbuild/releases
Contributing
Please refer to the developer guide to learn about our workflow, code style and more.
Requirements
The requirements for this project are:
bubblewrap >= 0.4.0python >= 3.7
Additionally, the built-in stages require:
bash >= 5.0coreutils >= 8.31curl >= 7.68qemu-img >= 4.2.0rpm >= 4.15tar >= 1.32util-linux >= 235skopeo
At build-time, the following software is required:
python-docutils >= 0.13pkg-config >= 0.29
Testing requires additional software:
pytest
Install
Installing osbuild requires to not only install the osbuild module, but also
additional artifacts such as tools (i.e: osbuild-mpp) sources, stages, schemas
and SELinux policies.
For this reason, doing an installation from source is not trivial and the easier way to install it is to create the set of RPMs that contain all these components.
This can be done with the rpm make target, i.e:
make rpm
A set of RPMs will be created in the ./rpmbuild/RPMS/noarch/ directory and can
be installed in the system using the distribution package manager, i.e:
sudo dnf install ./rpmbuild/RPMS/noarch/*.rpm
Repository:
- web: https://github.com/osbuild/osbuild
- https:
https://github.com/osbuild/osbuild.git - ssh:
git@github.com:osbuild/osbuild.git
License:
- Apache-2.0
- See LICENSE file for details.