57c82a00d0
Require "checksum" option for each repository, which contains the checksum of the `repodata/repomd.xml` file. This file (indirectly) contains checksums for all packages. Verify that the metadata dnf downloaded to install packages matches that checksum. This way, this stage will give an error when a reposiory changed between putting together the pipeline and running it.
32 lines
767 B
JSON
32 lines
767 B
JSON
{
|
|
"name": "Example Image",
|
|
"stages": [
|
|
{
|
|
"name": "org.osbuild.dnf",
|
|
"options": {
|
|
"releasever": "30",
|
|
"basearch": "x86_64",
|
|
"repos": {
|
|
"fedora": {
|
|
"metalink": "https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch",
|
|
"gpgkey": "F1D8 EC98 F241 AAF2 0DF6 9420 EF3C 111F CFC6 59B9",
|
|
"checksum": "sha256:9f596e18f585bee30ac41c11fb11a83ed6b11d5b341c1cb56ca4015d7717cb97"
|
|
}
|
|
},
|
|
"packages": ["@Core"]
|
|
}
|
|
},
|
|
{
|
|
"name": "org.osbuild.locale",
|
|
"options": {
|
|
"language": "nn_NO.utf8"
|
|
}
|
|
}
|
|
],
|
|
"assembler": {
|
|
"name": "org.osbuild.tar",
|
|
"options": {
|
|
"filename": "locale.tar"
|
|
}
|
|
}
|
|
}
|