621fa47563
This fixes an issue where Fedora-38 hosts can not build CentOS-Stream-9 images due to an incompatible gpg key with the new default settings for rpm. On Fedora-38, rpm has changed to use a new backend for key verification and by default does not support SHA1 anymore, although the support for SHA1 can be re-enabled via a config file. The (current) CentOS-Stream-9 keys however still require SHA1 support in order to be importable. So they are now unusable on Fedora-38 unless SHA1 support is re-enabled. In OSBuild, the initial chroot does not contain the config files and so SHA1 support is disabled when rpmkeys from the host is called. It does not matter if the crypto-policies on the host machine is configured with the exception to support SHA1 because the chroot filters that out. This means it may not be possible to assemble CentOS-Stream-9 based images without disabling the key check. This patch adds an explicit conditional case for Fedora-38 to inject the needed configuration file into /etc/crypto-policies/back-ends to enable SHA1 support for rpm by default. It does this by copying the default policies from /usr/share/crypto-policies. The result is OSBuild behaving similar to the previous behaviour seen on Fedora-37 and earlier. |
||
|---|---|---|
| .devcontainer | ||
| .github | ||
| assemblers | ||
| data | ||
| devices | ||
| docs | ||
| inputs | ||
| mounts | ||
| osbuild | ||
| runners | ||
| schemas | ||
| schutzbot | ||
| selinux | ||
| sources | ||
| stages | ||
| test | ||
| tools | ||
| .bandit | ||
| .editorconfig | ||
| .git-blame-ignore-revs | ||
| .gitignore | ||
| .gitlab-ci.yml | ||
| .mypy.ini | ||
| .packit.yaml | ||
| LICENSE | ||
| Makefile | ||
| osbuild.spec | ||
| README.md | ||
| requirements.txt | ||
| samples | ||
| Schutzfile | ||
| setup.cfg | ||
| setup.py | ||
OSBuild
Build-Pipelines for Operating System Artifacts
OSBuild is a pipeline-based build system for operating system artifacts. It defines a universal pipeline description and a build system to execute them, producing artifacts like operating system images, working towards an image build pipeline that is more comprehensible, reproducible, and extendable.
See the osbuild(1) man-page for details on how to run osbuild, the definition
of the pipeline description, and more.
Project
- Website: https://www.osbuild.org
- Bug Tracker: https://github.com/osbuild/osbuild/issues
- IRC: #osbuild on Libera.Chat
- Changelog: https://github.com/osbuild/osbuild/releases
Contributing
Please refer to the developer guide to learn about our workflow, code style and more.
Requirements
The requirements for this project are:
bubblewrap >= 0.4.0python >= 3.6
Additionally, the built-in stages require:
bash >= 5.0coreutils >= 8.31curl >= 7.68qemu-img >= 4.2.0rpm >= 4.15tar >= 1.32util-linux >= 235skopeo
At build-time, the following software is required:
python-docutils >= 0.13pkg-config >= 0.29
Testing requires additional software:
pytest
Install
Installing osbuild requires to not only install the osbuild module, but also
additional artifacts such as tools (i.e: osbuild-mpp) sources, stages, schemas
and SELinux policies.
For this reason, doing an installation from source is not trivial and the easier way to install it is to create the set of RPMs that contain all these components.
This can be done with the rpm make target, i.e:
make rpm
A set of RPMs will be created in the ./rpmbuild/RPMS/noarch/ directory and can
be installed in the system using the distribution package manager, i.e:
sudo dnf install ./rpmbuild/RPMS/noarch/*.rpm
Repository:
- web: https://github.com/osbuild/osbuild
- https:
https://github.com/osbuild/osbuild.git - ssh:
git@github.com:osbuild/osbuild.git
License:
- Apache-2.0
- See LICENSE file for details.