# This manifest file defines things that should really only go# into "official" builds of Fedora CoreOS (such as including `fedora-release-coreos`)# or are very "opinionated" like disabling SSH passwords by default.# Be minimalrecommends: falsedocumentation: falseinclude:- shared-el.yamlconditional-include:# If not on a production stream then disable Zincati- if:- stream != "stable"- stream != "testing"- stream != "next"include:postprocess:- |#!/usr/bin/bashset -eux -o pipefailcat > /etc/zincati/config.d/90-disable-on-non-production-stream.toml << EOF# https://github.com/coreos/fedora-coreos-tracker/issues/163updates.enabled = falseEOF# TODO: There is no coreos-pool tag/repo for RISCV yet# https://github.com/coreos/fedora-coreos-tracker/issues/1931- if: basearch != "riscv64"include:# All Fedora CoreOS streams share the same pool for locked files.lockfile-repos:- fedora-coreos-pool- if: basearch == "aarch64"include:ostree-layers:- overlay.d/10aarch64# Hack to avoid running out of space on aarch64. This should save us a lot of space.# https://github.com/coreos/fedora-coreos-tracker/issues/2222- if: releasever >= 45include:postprocess:- |#!/usr/bin/env bashset -eux -o pipefailrm -vrf /usr/lib/modules/*aarch64/dtb/*# Dracut 111 has a bug, which causes our CI to fail. This bug has been fixed in Dracut 112, and is# in the process of being backported to 111. While we wait for the backport / release, we will manually# patch this file.## Tracker: https://github.com/coreos/fedora-coreos-tracker/issues/2206# Upsteam patch: https://github.com/dracut-ng/dracut/pull/2494- if: releasever >= 45include:postprocess:- |#!/usr/bin/env bashset -eux -o pipefailcrypt_generator_path="/usr/lib/dracut/modules.d/70crypt/crypt-generator.sh"expected_sha="e47fa3ecf60760b0613b175ed70b61d42bb9e15a211448668ba3cd53fdd4995f"if sha256sum "${crypt_generator_path}" | grep -q "^${expected_sha}"; thensed -i 's/return /exit /g' "${crypt_generator_path}"fi# WARN: Temporary workaround## The Fedora sshd@.service overrides AuthorizedKeysFile on the# ExecStart command line, excluding .ssh/authorized_keys.d/* where# Ignition and Afterburn place SSH keys. This breaks auth for# socket-activated sshd.## See:# - https://github.com/coreos/fedora-coreos-tracker/issues/2098# - https://bugzilla.mindrot.org/show_bug.cgi?id=3957# - https://bugzilla.redhat.com/show_bug.cgi?id=2503149## TODO: delete if openssh ever supports AuthorizedKeysFile+= (https://bugzilla.mindrot.org/show_bug.cgi?id=3957)- if: releasever <= 46include:ostree-layers:- overlay.d/16fcos-sshd-workaround# Backward compatibility: rescue/warn firstboot network config# coreos-installer placed in /boot. Drop when Fedora 46 lands.- if: releasever <= 45include:ostree-layers:- overlay.d/11legacy-copy-networkostree-layers:- overlay.d/09misc- overlay.d/10disk-images- overlay.d/15fcos- overlay.d/17fcos-container-signing# Packages listed here should be specific to Fedore CoreOS (as in not yet# available in RHCOS or not desired in RHCOS). All other packages should go# into one of the sub-manifests listed at the top.packages:# Security- polkit# Containers- systemd-container catatonit- fuse-overlayfs slirp4netns# Some host applications(i.e. NetworkManager) use dnsmasq# as the binary for some various utility operations.# https://github.com/coreos/fedora-coreos-tracker/issues/519- dnsmasq# For podman v4 netavark gets pulled in but it only recommends# aardvark-dns (which provides name resolution based on container# names). This functionality was previously provided by dnsname from# podman-plugins in the podman v3 stack.# See https://github.com/containers/netavark/pull/217- aardvark-dns# Since we need `containernetworking-plugins` installed to continue# to support CNI networks we need to also explicitly install# `netavark` so we get both of them installed since both of them# provide `container-network-stack`.# https://github.com/coreos/fedora-coreos-tracker/issues/1128#issuecomment-1071458717- netavark# Active Directory support- adcli# Additional firewall support; we aren't including these in RHCOS or they# don't exist in RHEL- iptables-nft iptables-services# WireGuard https://github.com/coreos/fedora-coreos-tracker/issues/362- wireguard-tools# Storage- btrfs-progs# Allow communication between sudo and SSSD# for caching sudo rules by SSSD.# https://github.com/coreos/fedora-coreos-tracker/issues/445- libsss_sudo# SSSD; we only ship a subset of the backends- sssd-client sssd-ad sssd-ipa sssd-krb5 sssd-ldap# Used by admins interactively- attr- openssl# Provides terminal tools like clear, reset, tput, and tset- ncurses# file-transfer: note fuse-sshfs is not in RHEL# so we can't put it in file-transfer.yaml- fuse-sshfs# Improved MOTD experience- console-login-helper-messages-motdgen# i18n- kbd# NIC firmware we've traditionally shipped but then were split out of linux-firmware in Fedora- qed-firmware # https://github.com/coreos/fedora-coreos-tracker/issues/1746# CoreOS release RPM- fedora-release-coreos# CL ships this.- moby-engine# Already pulled in by moby-engine, but let's be explicit. Typhoon uses it.- containerd# Updates- zincati# Include and set the default editor- nano nano-default-editor# Introduce a default colored prompt for Fedora's default shell bash.# https://github.com/coreos/fedora-coreos-tracker/issues/1567- bash-color-prompt# obsoletes nfs-utils-coreos- nfs-client-utils# Architecture specific packages:# - irqbalance# - This thing is crying out to be pulled into systemd, but that hasn't happened# yet. Also we may want to add to rpm-ostree something like arch negation;# basically right now it doesn't exist on s390x.# Anyways, it was requested by the Red Hat perf team for RHCOS, so we have it here.# https://serverfault.com/questions/513807/is-there-still-a-use-for-irqbalance-on-modern-hardware# https://access.redhat.com/solutions/41535# - qemu-user-static-x86# - Include this on non-x86_64 FCOS images to allow access to the large# inventory of containers only built for x86_64.# https://github.com/coreos/fedora-coreos-tracker/issues/1237# - google-compute-engine-guest-configs-udev# - Add this package on x86_64 and aarch64 (the two architectures# GCP supports. https://github.com/coreos/fedora-coreos-tracker/issues/1494# This should be moved to a shared manifest when RHEL has this package.# - crun-wasm wasmedge-rt# - Support for wasm runtime: https://github.com/coreos/fedora-coreos-tracker/issues/1375packages-x86_64:- irqbalance- google-compute-engine-guest-configs-udev- crun-wasm wasmedge-rt# Include AMD microcode updates, see https://github.com/coreos/fedora-coreos-tracker/issues/1618.# This normally should belong in bootable-rpm-ostree.yaml (alongside# `microcode_ctl`), but this change hasn't hit RHCOS yet.- amd-ucode-firmwarepackages-ppc64le:- irqbalance- librtas- powerpc-utils-core- ppc64-diag-rtas- qemu-user-static-x86packages-aarch64:- irqbalance- qemu-user-static-x86- google-compute-engine-guest-configs-udev- crun-wasm wasmedge-rtpackages-s390x:- qemu-user-static-x86# ⚠⚠⚠ ONLY TEMPORARY HACKS ALLOWED HERE; ALL ENTRIES NEED TRACKER LINKS ⚠⚠⚠# See also the version of this in fedora-coreos-base.yamlpostprocess:# Mask dnsmasq. We include dnsmasq for host services that use the dnsmasq# binary but intentionally mask the systemd service so users can't easily# use it as an external dns server. We prefer they use a container for that.# https://github.com/coreos/fedora-coreos-tracker/issues/519- |#!/usr/bin/bashset -eux -o pipefailsystemctl mask dnsmasq.service# Mask systemd's new IMDS subsystem (systemd >= 262, ENABLE_IMDS). On cloud# guests systemd-imds-generator pulls in systemd-imds-early-network.service,# which runs `systemd-imdsd --setup-network` in the init_t domain and is# denied by SELinux when writing net_conf_t / systemd_resolved_var_run_t,# so the unit fails and trips the boot health check. FCOS gets metadata via# afterburn and configures networking via NetworkManager, so it does not# need systemd's IMDS pre-networking. Mask the whole subsystem until (if# ever) it is wanted and selinux-policy grows rules for it.# https://github.com/coreos/fedora-coreos-tracker/issues/2232- |#!/usr/bin/bashset -eux -o pipefailsystemctl mask systemd-imds-early-network.service \systemd-imds-import.service \systemd-imds-metrics.socket \systemd-imdsd.socket \systemd-imdsd@.service# sudo prefers its config files to be mode 440, and some security scanners# complain if /etc/sudoers.d files are world-readable.# https://bugzilla.redhat.com/show_bug.cgi?id=1981979# This is added by the 05core overlay listed above.- |#!/usr/bin/env bashset -xeuo pipefailchmod 440 /etc/sudoers.d/coreos-sudo-group# Set the default systemd target to `multi-user.target`.- |#!/usr/bin/env bashset -xeuo pipefailln -sf multi-user.target /usr/lib/systemd/system/default.target# Add the sudo group to /etc/group in container-native flow.- |#!/usr/bin/env bashset -xeuo pipefailif [ -f /run/.containerenv ]; thengrep sudo /usr/lib/group >> /etc/groupfi# Inject the ostree stateroot name from the NAME build-arg.# This is done in postprocess rather than an overlay so that the# value is sourced from build-args and shared across FCOS/RHCOS/SCOS.- |#!/usr/bin/bashset -eux -o pipefailcat > /usr/lib/bootc/install/20-ostree-stateroot.toml << EOF[install]stateroot = "${NAME}"EOF# Disable Zincati on non-release builds# https://github.com/coreos/fedora-coreos-tracker/issues/212- |#!/usr/bin/env bashset -euxo pipefailsource /etc/os-releaseif [[ $OSTREE_VERSION = *.dev* ]]; thenmkdir -p /etc/zincati/config.decho -e '# https://github.com/coreos/fedora-coreos-tracker/issues/212\nupdates.enabled = false' > /etc/zincati/config.d/95-disable-on-dev.tomlfi# Users shouldn't be configuring `rpm-ostreed.conf`# https://github.com/coreos/fedora-coreos-tracker/issues/271- |#!/usr/bin/env bashset -xeuo pipefailcat > /tmp/rpm-ostreed.conf << 'EOF'# By default, this system has its OS updates managed by# `zincati.service`. Changes made to this file may# conflict with the configuation of `zincati.service`.# See https://github.com/coreos/zincati for additional# information.EOFconf_file=/usr/etc/rpm-ostreed.conf# if we're deriving, then the config is in /etc alreadyif [ -f /run/.containerenv ]; thenconf_file=/etc/rpm-ostreed.confficat "${conf_file}" >> /tmp/rpm-ostreed.confcp /tmp/rpm-ostreed.conf "${conf_file}"rm /tmp/rpm-ostreed.conf# Add the docker group to /etc/group# https://github.com/coreos/fedora-coreos-tracker/issues/2# This will be no longer needed when systemd-sysusers has been implemented:# https://github.com/projectatomic/rpm-ostree/issues/49- |#!/usr/bin/env bashset -xeuo pipefailif [ -f /run/.containerenv ]; thengrep ^docker: /usr/lib/group >> /etc/groupfi# Implement exclude-packages: in a postprocess because when building# via container we don't have exclude-packages functionality.## These are things we don't expect to ship on the host. We currently# have recommends: false so these could only come in via hard requirement,# in which case the build will fail.- |#!/usr/bin/env bashset -xexcludes=(perlperl-interpreterpythonpython3python3-libsnodejsgrubbycowsay # Just in case# Let's make sure initscripts doesn't get pulled back in# https://github.com/coreos/fedora-coreos-tracker/issues/220#issuecomment-611566254initscripts# nor /usr/sbin/serviceinitscripts-service# For (datacenter/cloud oriented) servers, we want to see the details by default.# https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/HSMISZ3ETWQ4ETVLWZQJ55ARZT27AAV3/plymouth# Do not use legacy ifcfg config format in NetworkManager# See https://github.com/coreos/fedora-coreos-config/pull/1991NetworkManager-initscripts-ifcfg-rh)# Determine if anything that isn't allowed is actually provided.actuals="$(rpm -q --whatprovides ${excludes[@]} | grep -v 'no package provides')"if [ ! -z "${actuals}" ]; thenecho "Something is providing excluded RPM functionality!" 1>&2echo "${actuals}" 1>&2exit 1fi