57c82a00d0
Require "checksum" option for each repository, which contains the checksum of the `repodata/repomd.xml` file. This file (indirectly) contains checksums for all packages. Verify that the metadata dnf downloaded to install packages matches that checksum. This way, this stage will give an error when a reposiory changed between putting together the pipeline and running it.
47 lines
1.2 KiB
JSON
47 lines
1.2 KiB
JSON
{
|
|
"name": "base",
|
|
"build": {
|
|
"name": "build",
|
|
"stages": [
|
|
{
|
|
"name": "org.osbuild.yum",
|
|
"options": {
|
|
"releasever": "27",
|
|
"basearch": "x86_64",
|
|
"repos": {
|
|
"fedora": {
|
|
"baseurl": "https://archives.fedoraproject.org/pub/archive/fedora/linux/releases/$releasever/Everything/$basearch/os/",
|
|
"gpgkey": "860E 19B0 AFA8 00A1 7518 81A6 F55E 7430 F528 2EE4"
|
|
}
|
|
},
|
|
"packages": [
|
|
"dnf",
|
|
"systemd",
|
|
"gnupg"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"stages": [
|
|
{
|
|
"name": "org.osbuild.dnf",
|
|
"options": {
|
|
"releasever": "30",
|
|
"basearch": "x86_64",
|
|
"repos": {
|
|
"fedora": {
|
|
"metalink": "https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch",
|
|
"gpgkey": "F1D8 EC98 F241 AAF2 0DF6 9420 EF3C 111F CFC6 59B9",
|
|
"checksum": "sha256:9f596e18f585bee30ac41c11fb11a83ed6b11d5b341c1cb56ca4015d7717cb97"
|
|
}
|
|
},
|
|
"packages": [
|
|
"@Core",
|
|
"selinux-policy-targeted",
|
|
"grub2-pc"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|