Misthios/fedora intune os version defender #2

Merged

Misthios merged 4 commits from misthios/fedora-intune-os-version-defender into main 2026-10-20 09:22:42 +00:00

Conversation 0 Commits 4 Files Changed 13

+391 -18

Misthios commented 2026-10-20 09:22:37 +00:00

Owner

Copy link

Copy source

No description provided.

Misthios added 4 commits 2026-10-20 09:22:37 +00:00

fedora-intune: report full image version to Intune, Defender compliance script ... 75c3b502d7

Himmelblau reports VERSION_ID from /etc/os-release as the device OS version,
so Intune showed "44". Give himmelblaud and himmelblaud-tasks their own
os-release (bind-mounted in their mount namespace only) with VERSION_ID set to
OSTREE_VERSION, e.g. 44.20261019.0. The rest of the system keeps the stock
VERSION_ID that toolbox, flatpak and dnf expect.

Add an Intune custom compliance discovery script and rules for Microsoft
Defender for Endpoint (installed, running, onboarded, licensed, healthy,
real-time protection, definitions up to date). These are uploaded to Intune,
not shipped in the image.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

fedora-intune: cron for Intune config scripts, Defender remediation script ... 6afa1d21e6

Himmelblau installs Intune Linux custom configuration scripts as
/etc/cron.d jobs, and the image had no cron, so a script policy failed to
apply. Add cronie and enable crond.

Add a custom configuration script that repairs Microsoft Defender on its
schedule: finishes first-boot setup, restarts a stopped daemon, onboards with
the tenant's mdatp_onboard.json (pasted into the script in Intune), and
re-enables real-time protection and updates definitions when needed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

fedora-intune: install Defender from Microsoft's Fedora 44 repo ... 2b78113124

The RHEL 10 repo was there for the Intune app, which only ships for RHEL;
that app is gone and the repo now only provides mdatp. Use Microsoft's
Fedora 44 repo instead: Fedora is a supported Defender distribution
(servers and the Linux desktop preview), and it carries a newer build
(101.26091.0003 vs 101.26081.0010 in the RHEL 10 repo). Same signing key
and signed metadata.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ci: only rebuild changed images ... 1dbe7f6895

The changes job ran on the bare runner, which has no git (the build jobs
install it before checkout). actions/checkout then fell back to a tarball
without history, `git diff` failed, `|| true` turned that into an empty
change list, and an empty list means "rebuild everything" - on every push
and PR.

Run the job in the buildroot container with git and nodejs, warn when the
diff fails instead of hiding it, treat a diff with no changes as "build
nothing", and let a manual run pick one image. The weekly scheduled run
still rebuilds all images for package updates.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Misthios merged commit f48a0ffaf6 into main 2026-10-20 09:22:42 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Misthios (Wesley)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Misthios/bootc-images#2