fedora-intune: use Himmelblau instead of the Microsoft Intune app

Go with Entra ID sign-in through Himmelblau for fedora-intune and drop
the Microsoft Intune app (intune-portal, identity broker) variant. With
a single image, the workstation, Edge and Defender manifests move back
from images/shared into images/fedora-intune, and CI builds just that
image again. The Microsoft repo is now limited to mdatp and Edge.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.gitea/workflows/build.yaml

@@ -175,22 +175,17 @@ jobs:
     steps: *build_steps
 
   build-intune:
-    name: ${{ matrix.image }} (44)
+    name: fedora-intune (44)
     needs: changes
     if: needs.changes.outputs.intune == 'true'
     runs-on: job-v2
 
-    strategy:
-      fail-fast: false
-      matrix:
-        image: [fedora-intune, fedora-intune-himmelblau]
-
     container:
       image: "quay.io/fedora-ostree-desktops/buildroot:44"
       options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/fuse --volume /:/run/host:rw"
 
     env:
-      IMAGE: ${{ matrix.image }}
+      IMAGE: fedora-intune
       DISTRO: "44"
       ARCH: x86_64
       REGISTRY: git.plabble.org/misthios
@@ -220,7 +215,7 @@ jobs:
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         run: |
-          for image in fedora-cosmic fedora-remote fedora-intune fedora-intune-himmelblau; do
+          for image in fedora-cosmic fedora-remote fedora-intune; do
             ./prune-releases.sh "${image}"
           done
       - name: Prune old registry tags
@@ -232,6 +227,6 @@ jobs:
           authfile=/tmp/prune-auth.json
           echo "${REGISTRY_TOKEN}" | skopeo login -u "${REGISTRY_USERNAME}" \
             --password-stdin --authfile "${authfile}" git.plabble.org
-          for image in fedora-cosmic fedora-remote fedora-intune fedora-intune-himmelblau; do
+          for image in fedora-cosmic fedora-remote fedora-intune; do
             AUTHFILE="${authfile}" ./prune-registry.sh "${image}" Misthios 44 rawhide
           done

build.sh

@@ -201,10 +201,7 @@ case "${BUILD_MODE}" in
     if [[ -d "${IMAGE_DIR}/files" ]]; then
       cp -a "${IMAGE_DIR}/files/." "${BUILD_DIR}/upstream/"
     fi
-    # Shared overlay (manifests/files/repos used by multiple images).
+    # Shared overlay (files/repos used by multiple images).
-    if compgen -G "${REPO_ROOT}/images/shared/*.yaml" >/dev/null; then
-      cp "${REPO_ROOT}"/images/shared/*.yaml "${BUILD_DIR}/upstream/"
-    fi
     if [[ -d "${REPO_ROOT}/images/shared/files" ]]; then
       cp -a "${REPO_ROOT}/images/shared/files/." "${BUILD_DIR}/upstream/"
     fi

ci-changes.sh

@@ -22,8 +22,7 @@ if [[ "${all}" == 1 ]]; then
 fi
 grep -qE '^images/fedora-cosmic/' <<< "${changed}" && cosmic=true
 grep -qE '^images/fedora-remote/' <<< "${changed}" && remote=true
-# Both fedora-intune and fedora-intune-himmelblau.
+grep -qE '^images/fedora-intune/' <<< "${changed}" && intune=true
-grep -qE '^images/fedora-intune' <<< "${changed}" && intune=true
 
 echo "cosmic=${cosmic}"
 echo "remote=${remote}"

images/fedora-intune-himmelblau/build.conf

@@ -1,10 +0,0 @@
-# Build configuration for images/fedora-intune-himmelblau. Sourced by build.sh.
-
-BUILD_MODE=upstream
-
-UPSTREAM_REPO="https://gitlab.com/fedora/ostree/ci-test.git"
-
-# Stable only, like fedora-intune.
-declare -A UPSTREAM_REFS=(
-  [44]=f44
-)

images/fedora-intune-himmelblau/manifest.yaml

@@ -1,37 +0,0 @@
-# Minimal GNOME workstation where users sign in with their Entra ID account
-# (Himmelblau), with Microsoft Edge and Microsoft Defender for Endpoint.
-# Himmelblau joins the device to Entra ID at the first sign-in and, with
-# apply_policy, enrolls it in Intune and reports compliance itself, so the
-# Microsoft Intune app (fedora-intune) is not included.
-
-metadata:
-  summary: Fedora minimal GNOME workstation with Entra ID sign-in (Himmelblau)
-
-variables:
-  # Opt out of the upstream fedora.yaml so we don't pull the Firefox RPM.
-  distro: "fedora-intune-himmelblau"
-  variant: "intune-himmelblau"
-
-# Keep it small: no weak/optional dependencies.
-recommends: false
-
-default_target: graphical.target
-
-ref: fedora-intune-himmelblau/${releasever_ref}/${basearch}/intune-himmelblau
-
-# /opt as a plain directory; see fedora-intune/manifest.yaml.
-opt-usrlocal: root
-
-repos:
-  - himmelblau
-  - microsoft-rhel10
-  - microsoft-edge
-
-include:
-  - base-atomic.yaml
-  # Shared with fedora-intune (images/shared).
-  - workstation.yaml
-  - microsoft-edge.yaml
-  - defender.yaml
-  # Entra ID sign-in and Intune.
-  - himmelblau.yaml

images/fedora-intune/build.conf

@@ -4,7 +4,7 @@ BUILD_MODE=upstream
 
 UPSTREAM_REPO="https://gitlab.com/fedora/ostree/ci-test.git"
 
-# Stable only; Microsoft builds the Intune app against RHEL, not rawhide.
+# Stable only; Defender comes from Microsoft's RHEL 10 repo, not rawhide.
 declare -A UPSTREAM_REFS=(
   [44]=f44
 )

images/fedora-intune/custom.yaml

@@ -1,5 +1,4 @@
-# Minimal GNOME workstation, shared by the fedora-intune images. Include it
+# Minimal GNOME workstation.
-# from a manifest that sets `opt-usrlocal: root` (finalize.d/60-opt-links).
 
 packages:
   # Fedora integration normally provided by the upstream fedora.yaml (which we

images/fedora-intune/defender.yaml

@@ -1,5 +1,5 @@
 # Microsoft Defender for Endpoint on Linux (mdatp), RHEL 10 build, from the
-# microsoft-rhel10 repo (shared/repos/microsoft.repo).
+# microsoft-rhel10 repo (repos/microsoft.repo).
 #
 # mdatp's %post does the real install: units, SELinux module, and per-machine
 # state under /var/opt/microsoft/mdatp (machine GUID, definitions database,

images/fedora-intune/files/50-intune.preset

@@ -1,3 +0,0 @@
-# Intune daemon (socket-activated). The device identity broker is D-Bus
-# activated and has no [Install] section, so it needs no preset.
-enable intune-daemon.socket

images/fedora-intune/intune.yaml

@@ -1,71 +0,0 @@
-# Microsoft Intune app for Linux (intune-portal) and the Microsoft identity
-# broker, from the microsoft-rhel10 repo (shared/repos/microsoft.repo).
-#
-# Fedora is not a supported Intune distribution. The RHEL 10 builds are used
-# because they link against the same library generation as Fedora 44.
-
-repo-packages:
-  - repo: microsoft-rhel10
-    packages:
-      - intune-portal
-      - microsoft-identity-broker
-
-packages:
-  # intune-portal scriptlet dependencies (authselect profile + SELinux module)
-  # and the sssd base its authselect profile is derived from.
-  - authselect
-  - checkpolicy
-  - policycoreutils
-  - sssd-client
-  - nss-altfiles
-  # Secret storage for the identity broker tokens.
-  - gnome-keyring
-  - libsecret
-
-add-files:
-  - ["50-intune.preset", "/usr/lib/systemd/system-preset/50-intune.preset"]
-
-postprocess:
-  # The intune-portal %post builds an authselect profile with pam_intune.so and
-  # an SELinux module, but neither reliably survives a compose (no running
-  # SELinux, authselect state under /etc). Redo both here so the image is
-  # deterministic either way.
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    profile=/etc/authselect/custom/intune-profile
-    if [[ ! -d "${profile}" ]]; then
-      authselect create-profile intune-profile -b sssd --symlink-meta --symlink-pam
-    fi
-    for f in system-auth password-auth; do
-      grep -q pam_intune.so "${profile}/${f}" && continue
-      sed -i \
-        -e 's/^\(auth[[:space:]]\+\)sufficient\([[:space:]]\+pam_unix.so\)/\1required  \2/' \
-        -e 's/^\(password[[:space:]]\+\)sufficient\([[:space:]]\+pam_unix.so\)/\1required  \2/' \
-        "${profile}/${f}"
-      sed -i \
-        -e '/^auth[[:space:]]\+required[[:space:]]\+pam_unix.so/a auth        sufficient                                   pam_intune.so' \
-        -e '/^password[[:space:]]\+required[[:space:]]\+pam_unix.so/a password    sufficient                                   pam_intune.so' \
-        -e '/^session[[:space:]]\+required[[:space:]]\+pam_unix.so/a session     optional                                     pam_intune.so' \
-        "${profile}/${f}"
-    done
-    # with-altfiles: system users (gdm, pipewire, mdatp, ...) live in
-    # /usr/lib/passwd on rpm-ostree systems, not in /etc/passwd as on RHEL.
-    authselect select custom/intune-profile with-altfiles --force --nobackup
-    getent passwd gdm >/dev/null
-
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    cd /usr/share/selinux/packages/intune
-    tmp="$(mktemp -d)"
-    checkmodule -M -m -o "${tmp}/intune.mod" intune.te
-    semodule_package -o "${tmp}/intune.pp" -m "${tmp}/intune.mod"
-    semodule -n -i "${tmp}/intune.pp"
-    rm -rf "${tmp}"
-
-  # intune-agent (user timer) reports compliance; enable it for every user.
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    systemctl --user --global preset-all

images/fedora-intune/manifest.yaml

@@ -1,10 +1,10 @@
-# Minimal GNOME workstation with the Microsoft Intune app, Microsoft Edge and
+# Minimal GNOME workstation where users sign in with their Entra ID account
-# Microsoft Defender for Endpoint, for testing Intune enrollment and Linux
+# (Himmelblau), with Microsoft Edge and Microsoft Defender for Endpoint.
-# compliance policies. Local accounts only: no Kanidm, because the Intune app
+# Himmelblau joins the device to Entra ID at the first sign-in and, with
-# needs its own authselect profile (pam_intune) for the password checks.
+# apply_policy, enrolls it in Intune and reports compliance.
 
 metadata:
-  summary: Fedora minimal GNOME workstation with Microsoft Intune and Defender
+  summary: Fedora minimal GNOME workstation with Entra ID sign-in and Intune
 
 variables:
   # Opt out of the upstream fedora.yaml so we don't pull the Firefox RPM.
@@ -21,18 +21,19 @@ ref: fedora-intune/${releasever_ref}/${basearch}/intune
 # Ship /opt as a plain read-only directory instead of a symlink to /var/opt.
 # Defender installs to /opt/microsoft/mdatp and keeps its state in
 # /var/opt/microsoft/mdatp; with the default symlink those are the same,
-# read-only directory. Needs composefs, which upstream enables.
+# read-only directory. Needs composefs, which upstream enables. The vendor
+# directories are linked into /opt by finalize.d/60-opt-links.
 opt-usrlocal: root
 
 repos:
+  - himmelblau
   - microsoft-rhel10
   - microsoft-edge
 
 include:
   - base-atomic.yaml
-  # Shared with fedora-intune-himmelblau (images/shared).
+  - custom.yaml
-  - workstation.yaml
+  # Entra ID sign-in and Intune.
+  - himmelblau.yaml
   - microsoft-edge.yaml
   - defender.yaml
-  # Microsoft Intune app.
-  - intune.yaml

images/fedora-intune/microsoft-edge.yaml

@@ -1,4 +1,4 @@
-# Microsoft Edge, from the microsoft-edge repo (shared/repos/microsoft.repo).
+# Microsoft Edge, from the microsoft-edge repo (repos/microsoft.repo).
 # Conditional Access to Microsoft 365 web apps on Linux requires Edge.
 
 repo-packages:

images/fedora-intune/repos/microsoft.repo

@@ -1,5 +1,5 @@
-# packages.microsoft.com, limited with includepkgs to the packages the images
+# packages.microsoft.com, limited with includepkgs to the packages the image
-# use, so nothing else from the RHEL repo can replace a Fedora package.
+# uses, so nothing else from the RHEL repo can replace a Fedora package.
 
 [microsoft-rhel10]
 name=Microsoft Production (RHEL 10)
@@ -8,7 +8,7 @@ enabled=1
 gpgcheck=1
 repo_gpgcheck=1
 gpgkey=https://packages.microsoft.com/keys/microsoft-2025.asc
-includepkgs=intune-portal microsoft-identity-broker mdatp
+includepkgs=mdatp
 
 [microsoft-edge]
 name=Microsoft Edge