e62133a334
Wrap the LVM volume group in a LUKS container with the passphrase `osbuild` (yes, really, super secure). NB: the kernel command line is changed to include `luks.uuid` which is needed so that dracut will attempt to open the luks container. This corresponds to an crypttab entry `luks-uuid UUID`. We cannot use the /etc/crypttab for ostree based images because the initrd is created at commit time but they luks volume is created at deployment time, we have to use the kernel command line instead. See the man page for the systemd-cryptsetup-generator(8) for more information. The `cryptsetup` package is included in the build root since it is needed by the `org.osbuild.luks2.format` stage. All manifests that are using the `f34-build-v2` build root change as a result.
84 lines
4 KiB
JSON
84 lines
4 KiB
JSON
{
|
|
"version": "2",
|
|
"pipelines": [
|
|
{
|
|
"name": "build",
|
|
"stages": [
|
|
{
|
|
"type": "org.osbuild.rpm",
|
|
"inputs": {
|
|
"packages": {
|
|
"type": "org.osbuild.files",
|
|
"origin": "org.osbuild.source",
|
|
"mpp-depsolve": {
|
|
"architecture": "x86_64",
|
|
"module-platform-id": "f34",
|
|
"repos": [
|
|
{
|
|
"id": "default",
|
|
"baseurl": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/"
|
|
}
|
|
],
|
|
"packages": [
|
|
"btrfs-progs",
|
|
"cryptsetup",
|
|
"dnf",
|
|
"dosfstools",
|
|
"e2fsprogs",
|
|
"grub2-pc",
|
|
"policycoreutils",
|
|
"python3-iniparse",
|
|
"qemu-img",
|
|
"rpm-ostree",
|
|
"systemd",
|
|
"tar",
|
|
"xfsprogs",
|
|
"xz",
|
|
"lvm2",
|
|
"selinux-policy-targeted",
|
|
"genisoimage",
|
|
"isomd5sum",
|
|
"xorriso",
|
|
"syslinux",
|
|
"lorax-templates-generic",
|
|
"syslinux-nonlinux",
|
|
"squashfs-tools",
|
|
"grub2-pc-modules",
|
|
"grub2-tools",
|
|
"grub2-efi-x64",
|
|
"shim-x64",
|
|
"efibootmgr",
|
|
"grub2-tools-minimal",
|
|
"grub2-tools-extra",
|
|
"grub2-tools-efi",
|
|
"grub2-efi-x64",
|
|
"grub2-efi-x64-cdboot",
|
|
"shim-ia32",
|
|
"grub2-efi-ia32-cdboot"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"options": {
|
|
"gpgkeys": [
|
|
"-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBF1RVqsBEADWMBqYv/G1r4PwyiPQCfg5fXFGXV1FCZ32qMi9gLUTv1CX7rYy\nH4Inj93oic+lt1kQ0kQCkINOwQczOkm6XDkEekmMrHknJpFLwrTK4AS28bYF2RjL\nM+QJ/dGXDMPYsP0tkLvoxaHr9WTRq89A+AmONcUAQIMJg3JxXAAafBi2UszUUEPI\nU35MyufFt2ePd1k/6hVAO8S2VT72TxXSY7Ha4X2J0pGzbqQ6Dq3AVzogsnoIi09A\n7fYutYZPVVAEGRUqavl0th8LyuZShASZ38CdAHBMvWV4bVZghd/wDV5ev3LXUE0o\nitLAqNSeiDJ3grKWN6v0qdU0l3Ya60sugABd3xaE+ROe8kDCy3WmAaO51Q880ZA2\niXOTJFObqkBTP9j9+ZeQ+KNE8SBoiH1EybKtBU8HmygZvu8ZC1TKUyL5gwGUJt8v\nergy5Bw3Q7av520sNGD3cIWr4fBAVYwdBoZT8RcsnU1PP67NmOGFcwSFJ/LpiOMC\npZ1IBvjOC7KyKEZY2/63kjW73mB7OHOd18BHtGVkA3QAdVlcSule/z68VOAy6bih\nE6mdxP28D4INsts8w6yr4G+3aEIN8u0qRQq66Ri5mOXTyle+ONudtfGg3U9lgicg\nz6oVk17RT0jV9uL6K41sGZ1sH/6yTXQKagdAYr3w1ix2L46JgzC+/+6SSwARAQAB\ntDFGZWRvcmEgKDMyKSA8ZmVkb3JhLTMyLXByaW1hcnlAZmVkb3JhcHJvamVjdC5v\ncmc+iQI4BBMBAgAiBQJdUVarAhsPBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAK\nCRBsEwJtEslE0LdAD/wKdAMtfzr7O2y06/sOPnrb3D39Y2DXbB8y0iEmRdBL29Bq\n5btxwmAka7JZRJVFxPsOVqZ6KARjS0/oCBmJc0jCRANFCtM4UjVHTSsxrJfuPkel\nvrlNE9tcR6OCRpuj/PZgUa39iifF/FTUfDgh4Q91xiQoLqfBxOJzravQHoK9VzrM\nNTOu6J6l4zeGzY/ocj6DpT+5fdUO/3HgGFNiNYPC6GVzeiA3AAVR0sCyGENuqqdg\nwUxV3BIht05M5Wcdvxg1U9x5I3yjkLQw+idvX4pevTiCh9/0u+4g80cT/21Cxsdx\n7+DVHaewXbF87QQIcOAing0S5QE67r2uPVxmWy/56TKUqDoyP8SNsV62lT2jutsj\nLevNxUky011g5w3bc61UeaeKrrurFdRs+RwBVkXmtqm/i6g0ZTWZyWGO6gJd+HWA\nqY1NYiq4+cMvNLatmA2sOoCsRNmE9q6jM/ESVgaH8hSp8GcLuzt9/r4PZZGl5CvU\neldOiD221u8rzuHmLs4dsgwJJ9pgLT0cUAsOpbMPI0JpGIPQ2SG6yK7LmO6HFOxb\nAkz7IGUt0gy1MzPTyBvnB+WgD1I+IQXXsJbhP5+d+d3mOnqsd6oDM/grKBzrhoUe\noNadc9uzjqKlOrmrdIR3Bz38SSiWlde5fu6xPqJdmGZRNjXtcyJlbSPVDIloxw==\n=QWRO\n-----END PGP PUBLIC KEY BLOCK-----\n"
|
|
],
|
|
"exclude": {
|
|
"docs": true
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"type": "org.osbuild.selinux",
|
|
"options": {
|
|
"file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
|
|
"labels": {
|
|
"/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
|
|
"/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|