From 2b7811312408349b35797d6c44e418d19e00b09a Mon Sep 17 00:00:00 2001 From: Wesley van Tilburg Date: Tue, 20 Oct 2026 09:19:16 +0000 Subject: [PATCH] fedora-intune: install Defender from Microsoft's Fedora 44 repo The RHEL 10 repo was there for the Intune app, which only ships for RHEL; that app is gone and the repo now only provides mdatp. Use Microsoft's Fedora 44 repo instead: Fedora is a supported Defender distribution (servers and the Linux desktop preview), and it carries a newer build (101.26091.0003 vs 101.26081.0010 in the RHEL 10 repo). Same signing key and signed metadata. Co-Authored-By: Claude Opus 5.5 (1M context) --- images/fedora-intune/build.conf | 2 +- images/fedora-intune/defender.yaml | 6 +++--- images/fedora-intune/manifest.yaml | 2 +- images/fedora-intune/repos/microsoft.repo | 12 ++++++++---- 4 files changed, 13 insertions(+), 9 deletions(-) diff --git a/images/fedora-intune/build.conf b/images/fedora-intune/build.conf index 967992b..a3bd73a 100644 --- a/images/fedora-intune/build.conf +++ b/images/fedora-intune/build.conf @@ -4,7 +4,7 @@ BUILD_MODE=upstream UPSTREAM_REPO="https://gitlab.com/fedora/ostree/ci-test.git" -# Stable only; Defender comes from Microsoft's RHEL 10 repo, not rawhide. +# Stable only; Microsoft's Defender repo (fedora/44) has no rawhide build. declare -A UPSTREAM_REFS=( [44]=f44 ) diff --git a/images/fedora-intune/defender.yaml b/images/fedora-intune/defender.yaml index 801d529..435b6a5 100644 --- a/images/fedora-intune/defender.yaml +++ b/images/fedora-intune/defender.yaml @@ -1,5 +1,5 @@ -# Microsoft Defender for Endpoint on Linux (mdatp), RHEL 10 build, from the -# microsoft-rhel10 repo (repos/microsoft.repo). +# Microsoft Defender for Endpoint on Linux (mdatp), Fedora 44 build, from the +# microsoft-fedora44 repo (repos/microsoft.repo). # # mdatp's %post does the real install: units, SELinux module, and per-machine # state under /var/opt/microsoft/mdatp (machine GUID, definitions database, @@ -11,7 +11,7 @@ # from the Defender portal on the device. repo-packages: - - repo: microsoft-rhel10 + - repo: microsoft-fedora44 packages: - mdatp diff --git a/images/fedora-intune/manifest.yaml b/images/fedora-intune/manifest.yaml index 84107b0..5d7e413 100644 --- a/images/fedora-intune/manifest.yaml +++ b/images/fedora-intune/manifest.yaml @@ -27,7 +27,7 @@ opt-usrlocal: root repos: - himmelblau - - microsoft-rhel10 + - microsoft-fedora44 - microsoft-edge include: diff --git a/images/fedora-intune/repos/microsoft.repo b/images/fedora-intune/repos/microsoft.repo index 3c6438f..723f7ea 100644 --- a/images/fedora-intune/repos/microsoft.repo +++ b/images/fedora-intune/repos/microsoft.repo @@ -1,9 +1,13 @@ # packages.microsoft.com, limited with includepkgs to the packages the image -# uses, so nothing else from the RHEL repo can replace a Fedora package. +# uses, so nothing else from the Microsoft repo can replace a Fedora package. +# +# Fedora 44 build of Defender (mdatp): Fedora is a supported Defender +# distribution, servers and desktops. Pinned to 44 rather than $releasever so a +# new Fedora release doesn't fail the build before Microsoft publishes its repo. -[microsoft-rhel10] -name=Microsoft Production (RHEL 10) -baseurl=https://packages.microsoft.com/rhel/10/prod/ +[microsoft-fedora44] +name=Microsoft Production (Fedora 44) +baseurl=https://packages.microsoft.com/fedora/44/prod/ enabled=1 gpgcheck=1 repo_gpgcheck=1