From 1be7808c49a9153a369ba8b914a6c4dcbc7a5fde Mon Sep 17 00:00:00 2001
From: Timothée Ravier <tim@siosm.fr>
Date: Apr 13 2026 21:37:49 +0000
Subject: [PATCH 1/8] justfile: Remove lorax recipe (replaced by image-builder)


See: https://fedoraproject.org/wiki/Changes/BuildAtomicDesktopsWithImageBuilder

---

diff --git a/justfile b/justfile
index 57e3379..d58c849 100644
--- a/justfile
+++ b/justfile
@@ -279,101 +279,6 @@ clean-repo:
 clean-cache:
     rm -rf ./cache
 
-# Build an ISO
-lorax variant=default_variant:
-    #!/bin/bash
-    set -euxo pipefail
-
-    rm -rf iso
-    # Do not create the iso directory or lorax will fail
-    mkdir -p tmp cache/lorax
-
-    declare -A pretty_names={{pretty_names}}
-    declare -A volume_id_substitutions={{volume_id_substitutions}}
-    variant={{variant}}
-    variant_pretty=${pretty_names[$variant]-}
-    volid_sub=${volume_id_substitutions[$variant]-}
-    if [[ -z $variant_pretty ]] || [[ -z $volid_sub ]]; then
-        echo "Unknown variant"
-        exit 1
-    fi
-
-    if [[ ! -d fedora-lorax-templates ]]; then
-        git clone https://pagure.io/fedora-lorax-templates.git
-    else
-        pushd fedora-lorax-templates > /dev/null || exit 1
-        git fetch
-        git reset --hard origin/main
-        popd > /dev/null || exit 1
-    fi
-
-    version_number="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')"
-    if [[ "$(git rev-parse --abbrev-ref HEAD)" == "main" ]] || [[ -f "fedora-rawhide.repo" ]]; then
-        version_pretty="Rawhide"
-        version="rawhide"
-    else
-        version_pretty="${version_number}"
-        version="${version_number}"
-    fi
-    source_url="https://kojipkgs.fedoraproject.org/compose/${version}/latest-Fedora-${version_pretty}/compose/Everything/x86_64/os/"
-    volid="Fedora-${volid_sub}-x86_64-${version_pretty}"
-
-    buildid=""
-    if [[ -f ".buildid" ]]; then
-        buildid="$(< .buildid)"
-    else
-        buildid="$(date '+%Y%m%d.0')"
-        echo "${buildid}" > .buildid
-    fi
-
-    # Stick to the latest stable runtime available here
-    # Only include a subset of Flatpaks here
-    # Exhaustive list in https://pagure.io/pungi-fedora/blob/main/f/fedora.conf
-    # flatpak_remote_refs="runtime/org.fedoraproject.Platform/x86_64/f39"
-    # flatpak_apps=(
-    #     "app/org.gnome.Calculator/x86_64/stable"
-    #     "app/org.gnome.Calendar/x86_64/stable"
-    #     "app/org.gnome.Extensions/x86_64/stable"
-    #     "app/org.gnome.TextEditor/x86_64/stable"
-    #     "app/org.gnome.clocks/x86_64/stable"
-    #     "app/org.gnome.eog/x86_64/stable"
-    # )
-    # for ref in ${flatpak_refs[@]}; do
-    #     flatpak_remote_refs+=" ${ref}"
-    # done
-    # FLATPAK_ARGS=""
-    # FLATPAK_ARGS+=" --add-template=${pwd}/fedora-lorax-templates/ostree-based-installer/lorax-embed-flatpaks.tmpl"
-    # FLATPAK_ARGS+=" --add-template-var=flatpak_remote_name=fedora"
-    # FLATPAK_ARGS+=" --add-template-var=flatpak_remote_url=oci+https://registry.fedoraproject.org"
-    # FLATPAK_ARGS+=" --add-template-var=flatpak_remote_refs=${flatpak_remote_refs}"
-
-    pwd="$(pwd)"
-
-    lorax \
-        --product=Fedora \
-        --version=${version_pretty} \
-        --release=${buildid} \
-        --source="${source_url}" \
-        --variant="${variant_pretty}" \
-        --nomacboot \
-        --isfinal \
-        --buildarch=x86_64 \
-        --volid="${volid}" \
-        --logfile=${pwd}/logs/lorax.log \
-        --tmp=${pwd}/tmp \
-        --cachedir=cache/lorax \
-        --rootfs-size=8 \
-        --add-template=${pwd}/fedora-lorax-templates/ostree-based-installer/lorax-configure-repo.tmpl \
-        --add-template=${pwd}/fedora-lorax-templates/ostree-based-installer/lorax-embed-repo.tmpl \
-        --add-template-var=ostree_install_repo=file://${pwd}/repo \
-        --add-template-var=ostree_update_repo=file://${pwd}/repo \
-        --add-template-var=ostree_osname=fedora \
-        --add-template-var=ostree_oskey=fedora-${version_number}-primary \
-        --add-template-var=ostree_contenturl=mirrorlist=https://ostree.fedoraproject.org/mirrorlist \
-        --add-template-var=ostree_install_ref=fedora/${version}/x86_64/${variant} \
-        --add-template-var=ostree_update_ref=fedora/${version}/x86_64/${variant} \
-        ${pwd}/iso/linux
-
 # Upload a container to a registry and sign it. Used in CI
 upload-container variant=default_variant arch=default_arch:
     #!/bin/bash

From a4cac9ac681c78e149ff5dadae9d13b572578be8 Mon Sep 17 00:00:00 2001
From: Timothée Ravier <tim@siosm.fr>
Date: Apr 13 2026 22:05:40 +0000
Subject: [PATCH 2/8] justfile: Use zstd compression by default for container images


Default for Fedora 43+ and F42 will soon be EOL.

---

diff --git a/justfile b/justfile
index d58c849..e227be7 100644
--- a/justfile
+++ b/justfile
@@ -339,17 +339,12 @@ upload-container variant=default_variant arch=default_arch:
         suffix="-${arch}"
     fi
 
+    # Support for the zstd:chunked format is not ready yet
     SKOPEO_ARGS=(
         "--retry-times" "3"
+        "--dest-compress-format" "zstd"
     )
 
-    # Support for the zstd:chunked format is not ready yet
-    SKOPEO_ARGS+=("--dest-compress-format")
-    if [[ ${version} == "rawhide" ]] || [[ ${version} == "43" ]]; then
-        SKOPEO_ARGS+=("zstd")
-    else
-        SKOPEO_ARGS+=("gzip")
-    fi
 
     # Push fully versioned tag (major version, build date/id, arch)
     retry 5 60 skopeo copy "${SKOPEO_ARGS[@]}" \
@@ -416,18 +411,13 @@ upload-container-local variant=default_variant arch=default_arch:
         suffix="-${arch}"
     fi
 
+    # Support for the zstd:chunked format is not ready yet
     SKOPEO_ARGS=(
         "--retry-times" "3"
         "--dest-tls-verify=false"
+        "--dest-compress-format" "zstd"
     )
 
-    # Support for the zstd:chunked format is not ready yet
-    SKOPEO_ARGS+=("--dest-compress-format")
-    if [[ ${version} == "rawhide" ]] || [[ ${version} == "43" ]]; then
-        SKOPEO_ARGS+=("zstd")
-    else
-        SKOPEO_ARGS+=("gzip")
-    fi
 
     # Push fully versioned tag (major version, build date/id, arch)
     retry 5 60 skopeo copy "${SKOPEO_ARGS[@]}" \

From 268aec653694cedb45403c9915f21856a3768185 Mon Sep 17 00:00:00 2001
From: Timothée Ravier <tim@siosm.fr>
Date: Apr 13 2026 22:18:25 +0000
Subject: [PATCH 3/8] justfile: Generalize version logic


Push container images for Rawhide under their own version.

---

diff --git a/justfile b/justfile
index e227be7..dcafc76 100644
--- a/justfile
+++ b/justfile
@@ -41,6 +41,11 @@ volume_id_substitutions := '(
     [cosmic-atomic]="CSMCA"
 )'
 
+# Define a 'release_ver' shortcut for use in recipes
+release_ver := '''
+"$(rpm-ostree compose tree --print-only "silverblue.yaml" | jq -r '."mutate-os-release"')"
+'''
+
 # Define a retry function for use in recipes
 retry_function := '
 retry() {
@@ -76,9 +81,7 @@ branch:
 
     git checkout main
 
-    default_variant={{default_variant}}
-    version="$(rpm-ostree compose tree --print-only --repo=repo ${default_variant}.yaml | jq -r '."mutate-os-release"')"
-
+    version={{release_ver}}
     # recipe will exit if branching the repo fails, such as if branch already exists
     git branch f${version}
     sed -i "s/${version}/$(( version + 1 ))/g" comps-sync.py README.md
@@ -104,8 +107,7 @@ sync:
         git clone https://pagure.io/fedora-comps.git
     fi
 
-    default_variant={{default_variant}}
-    version="$(rpm-ostree compose tree --print-only --repo=repo ${default_variant}.yaml | jq -r '."mutate-os-release"')"
+    version={{release_ver}}
     ./comps-sync.py --save fedora-comps/comps-f${version}.xml.in
 
 # Sync the manifests with the content of the comps groups
@@ -122,8 +124,7 @@ comps-sync:
         popd > /dev/null || exit 1
     fi
 
-    default_variant={{default_variant}}
-    version="$(rpm-ostree compose tree --print-only --repo=repo ${default_variant}.yaml | jq -r '."mutate-os-release"')"
+    version={{release_ver}}
     ./comps-sync.py --save fedora-comps/comps-f${version}.xml.in
 
 # Check if the manifests are in sync with the content of the comps groups
@@ -140,8 +141,7 @@ comps-sync-check:
         popd > /dev/null || exit 1
     fi
 
-    default_variant={{default_variant}}
-    version="$(rpm-ostree compose tree --print-only --repo=repo ${default_variant}.yaml | jq -r '."mutate-os-release"')"
+    version={{release_ver}}
     ./comps-sync.py fedora-comps/comps-f${version}.xml.in
 
 # Output the processed manifest for a given variant (defaults to Silverblue)
@@ -196,7 +196,7 @@ compose-legacy variant=default_variant:
     timestamp="$(date --iso-8601=sec)"
     echo "${buildid}" > .buildid
 
-    version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')"
+    version={{release_ver}}
     echo "Composing ${variant_pretty} ${version}.${buildid} ..."
 
     ARGS=(
@@ -244,7 +244,7 @@ compose-image variant=default_variant:
     timestamp="$(date --iso-8601=sec)"
     echo "${buildid}" > .buildid
 
-    version="$(rpm-ostree compose tree --print-only ${variant}.yaml | jq -r '."mutate-os-release"')"
+    version={{release_ver}}
     echo "Composing ${variant_pretty} ${version}.${buildid} ..."
 
     ARGS=(
@@ -317,13 +317,6 @@ upload-container variant=default_variant arch=default_arch:
         exit 1
     fi
 
-    version=""
-    if [[ "$(git rev-parse --abbrev-ref HEAD)" == "main" ]] || [[ -f "fedora-rawhide.repo" ]]; then
-        version="rawhide"
-    else
-        version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')"
-    fi
-
     # Login to the registry
     retry 5 60 skopeo login --username "${CI_REGISTRY_USER}" --password "${CI_REGISTRY_PASSWORD}" "${REGISTRY}"
 
@@ -345,6 +338,7 @@ upload-container variant=default_variant arch=default_arch:
         "--dest-compress-format" "zstd"
     )
 
+    version={{release_ver}}
 
     # Push fully versioned tag (major version, build date/id, arch)
     retry 5 60 skopeo copy "${SKOPEO_ARGS[@]}" \
@@ -391,13 +385,6 @@ upload-container-local variant=default_variant arch=default_arch:
         exit 1
     fi
 
-    version=""
-    if [[ "$(git rev-parse --abbrev-ref HEAD)" == "main" ]] || [[ -f "fedora-rawhide.repo" ]]; then
-        version="rawhide"
-    else
-        version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')"
-    fi
-
     if [[ -n ${CI_REGISTRY_USER+x} ]] || [[ -n ${CI_REGISTRY_PASSWORD+x} ]]; then
         # Login to the registry
         retry 5 60 skopeo login --username "${CI_REGISTRY_USER}" --password "${CI_REGISTRY_PASSWORD}" "${REGISTRY}"
@@ -418,6 +405,7 @@ upload-container-local variant=default_variant arch=default_arch:
         "--dest-compress-format" "zstd"
     )
 
+    version={{release_ver}}
 
     # Push fully versioned tag (major version, build date/id, arch)
     retry 5 60 skopeo copy "${SKOPEO_ARGS[@]}" \
@@ -461,13 +449,6 @@ multi-arch-manifest variant=default_variant:
         exit 1
     fi
 
-    version=""
-    if [[ "$(git rev-parse --abbrev-ref HEAD)" == "main" ]] || [[ -f "fedora-rawhide.repo" ]]; then
-        version="rawhide"
-    else
-        version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')"
-    fi
-
     # Login to the registry
     retry 5 60 skopeo login --username "${CI_REGISTRY_USER}" --password "${CI_REGISTRY_PASSWORD}" "${REGISTRY}"
 
@@ -477,6 +458,8 @@ multi-arch-manifest variant=default_variant:
 
     image="${REGISTRY}/${RELEASE_REPO}/${variant}"
 
+    version={{release_ver}}
+
     # Create manifest with full version tags
     buildah manifest create "${image}:${version}.${buildid}" \
             "${image}:${version}.${buildid}-x86_64" \

From 52bd512265d4c9c9114bca5f32ef47c13d3c4c44 Mon Sep 17 00:00:00 2001
From: Timothée Ravier <tim@siosm.fr>
Date: Apr 13 2026 22:18:25 +0000
Subject: [PATCH 4/8] justfile: Also push rawhide images under the rawhide tag


---

diff --git a/justfile b/justfile
index dcafc76..014973e 100644
--- a/justfile
+++ b/justfile
@@ -46,6 +46,11 @@ release_ver := '''
 "$(rpm-ostree compose tree --print-only "silverblue.yaml" | jq -r '."mutate-os-release"')"
 '''
 
+# Define a 'is_rawhide' shortcut for use in recipes
+is_rawhide := '''
+"$(rpm-ostree compose tree --print-only "silverblue.yaml" | jq -r '.repos[]')" == "fedora-rawhide"
+'''
+
 # Define a retry function for use in recipes
 retry_function := '
 retry() {
@@ -412,6 +417,13 @@ upload-container-local variant=default_variant arch=default_arch:
         "oci-archive:${variant}.ociarchive" \
         "docker://${image}:${version}.${buildid}${suffix}"
 
+    # Push under the rawhide name as needed
+    if [[ {{is_rawhide}} ]]; then
+        retry 5 60 skopeo copy "${SKOPEO_ARGS[@]}" \
+            "oci-archive:${variant}.ociarchive" \
+            "docker://${image}:rawhide.${buildid}${suffix}"
+    fi
+
 # Create a multi-arch manifest for a given variant, push it to a registry and sign it
 multi-arch-manifest variant=default_variant:
     #!/bin/bash
@@ -474,6 +486,13 @@ multi-arch-manifest variant=default_variant:
         "${image}:${version}.${buildid}" \
         "docker://${image}:${version}.${buildid}"
 
+    # Push under the rawhide name as needed
+    if [[ {{is_rawhide}} ]]; then
+        retry 5 60 buildah manifest push \
+            "${image}:${version}.${buildid}" \
+            "docker://${image}:rawhide.${buildid}"
+    fi
+
     # Sign manifest
     retry 5 60 cosign sign -y --key private.key ${image}:${version}.${buildid}
 
@@ -482,6 +501,13 @@ multi-arch-manifest variant=default_variant:
         "${image}:${version}.${buildid}" \
         "docker://${image}:${version}"
 
+    # Push under the rawhide name as needed
+    if [[ {{is_rawhide}} ]]; then
+        retry 5 60 buildah manifest push \
+            "${image}:${version}.${buildid}" \
+            "docker://${image}:rawhide"
+    fi
+
     # Sign manifest
     retry 5 60 cosign sign -y --key private.key ${image}:${version}
 

From bfd03fc91a179a37e151d2668a991cbbab85f30c Mon Sep 17 00:00:00 2001
From: Timothée Ravier <tim@siosm.fr>
Date: Apr 13 2026 22:18:25 +0000
Subject: [PATCH 5/8] justfile: Inline default variant name


---

diff --git a/justfile b/justfile
index 014973e..d39aab9 100644
--- a/justfile
+++ b/justfile
@@ -5,8 +5,6 @@
 # This is only used for local development. The builds made on the Fedora
 # infrastructure are run via Pungi in a Koji runroot.
 
-# Set a default for some recipes
-default_variant := "silverblue"
 default_arch := "default"
 # Current default in Pungi
 force_nocache := "true"
@@ -150,14 +148,14 @@ comps-sync-check:
     ./comps-sync.py fedora-comps/comps-f${version}.xml.in
 
 # Output the processed manifest for a given variant (defaults to Silverblue)
-manifest variant=default_variant:
+manifest variant="silverblue":
     #!/bin/bash
     set -euo pipefail
 
     rpm-ostree compose tree --print-only --repo=repo {{variant}}.yaml
 
 # Perform dependency resolution for a given variant (defaults to Silverblue)
-compose-dry-run variant=default_variant:
+compose-dry-run variant="silverblue":
     #!/bin/bash
     set -euxo pipefail
 
@@ -171,10 +169,10 @@ compose-dry-run variant=default_variant:
     rpm-ostree compose tree --unified-core --repo=repo --dry-run {{variant}}.yaml
 
 # Alias/shortcut for compose-image command
-compose variant=default_variant: (compose-image variant)
+compose variant="silverblue": (compose-image variant)
 
 # Compose a variant using the legacy non container path (defaults to Silverblue)
-compose-legacy variant=default_variant:
+compose-legacy variant="silverblue":
     #!/bin/bash
     set -euxo pipefail
 
@@ -229,7 +227,7 @@ compose-legacy variant=default_variant:
     ostree summary --repo=repo --update
 
 # Compose an Ostree Native Container OCI image
-compose-image variant=default_variant:
+compose-image variant="silverblue":
     #!/bin/bash
     set -euxo pipefail
 
@@ -285,7 +283,7 @@ clean-cache:
     rm -rf ./cache
 
 # Upload a container to a registry and sign it. Used in CI
-upload-container variant=default_variant arch=default_arch:
+upload-container variant="silverblue" arch=default_arch:
     #!/bin/bash
     set -euxo pipefail
 
@@ -361,7 +359,7 @@ upload-container variant=default_variant arch=default_arch:
     rm private.key.b64 private.key
 
 # Upload a container to an anonymous registry. Useful for local builds
-upload-container-local variant=default_variant arch=default_arch:
+upload-container-local variant="silverblue" arch=default_arch:
     #!/bin/bash
     set -euxo pipefail
 
@@ -425,7 +423,7 @@ upload-container-local variant=default_variant arch=default_arch:
     fi
 
 # Create a multi-arch manifest for a given variant, push it to a registry and sign it
-multi-arch-manifest variant=default_variant:
+multi-arch-manifest variant="silverblue":
     #!/bin/bash
     set -euxo pipefail
 

From 46370b419520ff278f62683e19272e409fe00ff0 Mon Sep 17 00:00:00 2001
From: Timothée Ravier <tim@siosm.fr>
Date: Apr 13 2026 22:23:38 +0000
Subject: [PATCH 6/8] justfile: Inline "default" arch value


---

diff --git a/justfile b/justfile
index d39aab9..ebd968e 100644
--- a/justfile
+++ b/justfile
@@ -5,7 +5,6 @@
 # This is only used for local development. The builds made on the Fedora
 # infrastructure are run via Pungi in a Koji runroot.
 
-default_arch := "default"
 # Current default in Pungi
 force_nocache := "true"
 
@@ -283,7 +282,7 @@ clean-cache:
     rm -rf ./cache
 
 # Upload a container to a registry and sign it. Used in CI
-upload-container variant="silverblue" arch=default_arch:
+upload-container variant="silverblue" arch="default":
     #!/bin/bash
     set -euxo pipefail
 
@@ -359,7 +358,7 @@ upload-container variant="silverblue" arch=default_arch:
     rm private.key.b64 private.key
 
 # Upload a container to an anonymous registry. Useful for local builds
-upload-container-local variant="silverblue" arch=default_arch:
+upload-container-local variant="silverblue" arch="default":
     #!/bin/bash
     set -euxo pipefail
 

From 831630e8b7d3795c93fd8fe87157a0c9db7a63f1 Mon Sep 17 00:00:00 2001
From: Timothée Ravier <tim@siosm.fr>
Date: Apr 13 2026 22:23:38 +0000
Subject: [PATCH 7/8] justfile: Inline the --force-nocache option


---

diff --git a/justfile b/justfile
index ebd968e..5e94abd 100644
--- a/justfile
+++ b/justfile
@@ -5,9 +5,6 @@
 # This is only used for local development. The builds made on the Fedora
 # infrastructure are run via Pungi in a Koji runroot.
 
-# Current default in Pungi
-force_nocache := "true"
-
 # Just doesn't have a native dict type, but quoted bash dictionary works fine
 pretty_names := '(
     [silverblue]="Silverblue"
@@ -205,10 +202,8 @@ compose-legacy variant="silverblue":
         "--repo=repo"
         "--cachedir=cache"
         "--unified-core"
+        "--force-nocache"
     )
-    if [[ {{force_nocache}} == "true" ]]; then
-        ARGS+=("--force-nocache")
-    fi
     CMD="rpm-ostree"
     if [[ ${EUID} -ne 0 ]]; then
         CMD="sudo rpm-ostree"
@@ -254,10 +249,8 @@ compose-image variant="silverblue":
         "--initialize"
         "--label=quay.expires-after=4w"
         "--max-layers=96"
+        "--force-nocache"
     )
-    if [[ {{force_nocache}} == "true" ]]; then
-        ARGS+=("--force-nocache")
-    fi
     # To debug with gdb, use: gdb --args ...
     CMD="rpm-ostree"
     if [[ ${EUID} -ne 0 ]]; then

From 13a0d948a68121707a1d9f896587561f0ca05060 Mon Sep 17 00:00:00 2001
From: Timothée Ravier <tim@siosm.fr>
Date: Apr 13 2026 22:23:38 +0000
Subject: [PATCH 8/8] generate-gitlab-ci: Update rawhide detection logic


---

diff --git a/generate-gitlab-ci.sh b/generate-gitlab-ci.sh
index 90da804..c5e3f3b 100755
--- a/generate-gitlab-ci.sh
+++ b/generate-gitlab-ci.sh
@@ -17,11 +17,9 @@ variants=(
 )
 
 branch="$(git rev-parse --abbrev-ref HEAD)"
-release=""
-if [[ "${branch}" == "main" ]] || [[ -f "fedora-rawhide.repo" ]]; then
+release="$(rpm-ostree compose tree --print-only "silverblue.yaml" | jq -r '."mutate-os-release"')"
+if [[ "$(rpm-ostree compose tree --print-only "silverblue.yaml" | jq -r '.repos[]')" == "fedora-rawhide" ]]; then
     release="rawhide"
-else
-    release="$(rpm-ostree compose tree --print-only --repo=repo silverblue.yaml | jq -r '."mutate-os-release"')"
 fi
 
 {