From 597796c53f30950d9edaa85b6d6a07ee1a829d5c Mon Sep 17 00:00:00 2001
From: Paul Whalen <pwhalen@fedoraproject.org>
Date: Sep 25 2024 12:57:05 +0000
Subject: Add iot base bootc image


Signed-off-by: Paul Whalen <pwhalen@fedoraproject.org>

---

diff --git a/fedora-bootc-base/autoupdates.yaml b/fedora-bootc-base/autoupdates.yaml
deleted file mode 100644
index a416699..0000000
--- a/fedora-bootc-base/autoupdates.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-# Enable automatic updates by default
-postprocess:
-  - |
-    #!/usr/bin/env bash
-    set -euo pipefail
-    target=/usr/lib/systemd/system/default.target.wants
-    mkdir -p $target
-    set -x
-    ln -s ../bootc-fetch-apply-updates.timer $target
diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml
index 4d4b24e..e69de29 100644
--- a/fedora-bootc-base/bootc-config.yaml
+++ b/fedora-bootc-base/bootc-config.yaml
@@ -1,10 +0,0 @@
-# Configuration for bootc
-postprocess:
-  # ext4 is our default filesystem in iot
-  - |
-    #!/usr/bin/env bash
-    mkdir -p /usr/lib/bootc/install/
-    cat > /usr/lib/bootc/install/20-default-root.toml << EOF
-    [install]
-    root-fs-type = "ext4"
-    EOF
diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml
index a862e6c..d44ee08 100644
--- a/fedora-bootc-base/bootc.yaml
+++ b/fedora-bootc-base/bootc.yaml
@@ -2,6 +2,10 @@
 packages:
  - systemd
  - bootc
+ # bootc pulls in podman, which pulls in containers-common, which wants
+ # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name
+ # iptables-nft instead to satisfy it.
+ - iptables-nft
  # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk
  - gdisk xfsprogs e2fsprogs dosfstools
 
diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml
index 7d3ebf3..cc83d20 100644
--- a/fedora-bootc-base/bootupd.yaml
+++ b/fedora-bootc-base/bootupd.yaml
@@ -13,7 +13,7 @@ packages-s390x:
   # provided by s390utils-base, but soon will be -core too.
   - /usr/sbin/zipl
 packages-x86_64:
-  - grub2 grub2-efi-x64 efibootmgr shim
+  - grub2-efi-x64 efibootmgr shim
   - microcode_ctl
 
 conditional-include:
diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml
index de65333..fe4bbeb 100644
--- a/fedora-bootc-base/initramfs.yaml
+++ b/fedora-bootc-base/initramfs.yaml
@@ -6,13 +6,19 @@ postprocess:
     cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF'
     # We want a generic image; hostonly makes no sense as part of a server side build
     hostonly=no
-    dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree "
+    add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree "
     EOF
     cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF'
     # Extra modules that we want by default that are known to exist in the kernel
-    dracutmodules+=" virtiofs "
+    add_dracutmodules+=" virtiofs "
     EOF
     cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF'
     # We want this for systemd-cryptsetup tpm2 locking
-    dracutmodules+=" tpm2-tss "
+    add_dracutmodules+=" tpm2-tss "
+    EOF
+    cat > /usr/lib/dracut/dracut.conf.d/59-altfiles.conf << 'EOF'
+    # https://issues.redhat.com/browse/RHEL-49590
+    # On image mode systems we use nss-altfiles for passwd and group,
+    # this makes sure dracut uses them which also fixes kdump writing to NFS.
+    install_items+=" /usr/lib/passwd /usr/lib/group "
     EOF
diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml
new file mode 100644
index 0000000..611ff9a
--- /dev/null
+++ b/fedora-bootc-base/iot.yaml
@@ -0,0 +1,100 @@
+# Fedora IoT specific packages
+packages:
+  - fedora-release-iot
+  - aardvark-dns
+  - atheros-firmware
+  - attr
+  - authselect
+  - basesystem
+  - bash
+  - bash-completion
+  - brcmfmac-firmware
+  - chrony
+  - clevis
+  - clevis-dracut
+  - clevis-luks
+  - clevis-pin-tpm2
+  - containernetworking-plugins
+  - coreutils
+  - cracklib-dicts
+  - criu
+  - criu-libs
+  - cryptsetup
+  - curl
+  - dbus-parsec
+  - dnf5-plugins
+  - dracut-config-generic
+  - dracut-network
+  - efibootmgr
+  - fdo-client
+  - firewalld
+  - fwupd
+  - fwupd-efi
+  - fwupd-plugin-modem-manager
+  - fwupd-plugin-uefi-capsule-data
+  - glibc
+  - glibc-minimal-langpack
+  - gnupg2
+  - greenboot
+  - greenboot-default-health-checks
+  - gzip
+  - hostname
+  - ignition
+  - ima-evm-utils
+  - iproute
+  - iputils
+  - iwd
+  - iwlwifi-mvm-firmware
+  - kernel-tools
+  - keyutils
+  - less
+  - libsss_sudo
+  - linux-firmware
+  - lvm2
+  - netavark
+  - NetworkManager
+  - NetworkManager-wifi
+  - NetworkManager-wwan
+  - nss-altfiles
+  - openssl
+  - openssh-clients
+  - openssh-server
+  - passt
+  - passt-selinux
+  - parsec
+  - pinentry
+  - podman
+  - policycoreutils
+  - policycoreutils-python-utils
+  - polkit
+  - procps-ng
+  - realtek-firmware
+  - rootfiles
+  - rpm
+  - screen
+  - setools-console
+  - setup
+  - shadow-utils
+  - skopeo
+  - slirp4netns
+  - sssd-client
+  - sudo
+  - systemd-resolved
+  - tar
+  - tmux
+  - tpm2-pkcs11
+  - traceroute
+  - usbguard
+  - util-linux
+  - vim-minimal
+  - wpa_supplicant
+  - wireless-regdb
+  - xz
+  - zezere-ignition
+  - zram-generator
+  - zram-generator-defaults
+packages-aarch64:
+  - arm-image-installer
+  - bcm283x-firmware
+  - optee_client
+  - uboot-images-armv8
diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml
index 007f6d7..9a21ff3 100644
--- a/fedora-bootc-base/manifest.yaml
+++ b/fedora-bootc-base/manifest.yaml
@@ -44,19 +44,18 @@ remove-from-packages:
   # We don't want auto-generated mount units. See also
   # https://github.com/systemd/systemd/issues/13099
   - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator]
-  # Drop some buggy sysusers fragments which do not match static IDs allocation:
-  # https://bugzilla.redhat.com/show_bug.cgi?id=2105177
-  - [dbus-common, /usr/lib/sysusers.d/dbus.conf]
 
 include:
   - bootc.yaml
+  - bootupd.yaml
   - ostree.yaml
-  - bootc-config.yaml
   - initramfs.yaml
-  - autoupdates.yaml
   - basic-fixes.yaml
+  - iot.yaml
 
 packages:
+  # needed for building derived container images
+  - dnf5
   # Even in tier-0, we have this.  If you don't want SELinux today, you'll need
   # to build a custom image.
   - selinux-policy-targeted
@@ -64,8 +63,3 @@ packages:
   - container-selinux
   # Needed for tpm2 bound luks
   - tpm2-tools
-
-# See https://github.com/coreos/bootupd
-arch-include:
-  x86_64: bootupd.yaml
-  aarch64: bootupd.yaml
diff --git a/fedora-bootc.yaml b/fedora-bootc.yaml
deleted file mode 100644
index 7067275..0000000
--- a/fedora-bootc.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-releasever: rawhide
-variables:
-  distro: "fedora"
-
-repos:
-  - fedora-rawhide
-
-metadata:
-  name: fedora-bootc
-  summary: Fedora base bootc image
-
-include:
-  - fedora-bootc-base/manifest.yaml
-  - fedora-bootc-base/kernel.yaml
-
diff --git a/fedora-iot-bootc.yaml b/fedora-iot-bootc.yaml
new file mode 100644
index 0000000..6ae5882
--- /dev/null
+++ b/fedora-iot-bootc.yaml
@@ -0,0 +1,15 @@
+releasever: rawhide
+variables:
+  distro: "fedora-iot"
+
+repos:
+  - fedora-rawhide
+
+metadata:
+  name: fedora-iot-bootc-base
+  summary: Fedora IoT bootc base image
+
+include:
+  - fedora-bootc-base/manifest.yaml
+  - fedora-bootc-base/kernel.yaml
+

