Misthios/bootc-images
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Misthios/fedora intune os version defender #2

Merged
Misthios merged 4 commits from misthios/fedora-intune-os-version-defender into main 2026-10-20 09:22:42 +00:00
Conversation 0 Commits 4 Files Changed 13
+391 -18
4 Commits
Author SHA1 Message Date
Wesley van TilburgandClaude Opus 5.5 1dbe7f6895 ci: only rebuild changed images
Build containers / fedora-cosmic (44) (pull_request) Canceled after 0s
Details
Build containers / fedora-cosmic (rawhide) (pull_request) Canceled after 0s
Details
Build containers / fedora-remote (44) (pull_request) Canceled after 0s
Details
Build containers / fedora-intune (44) (pull_request) Canceled after 0s
Details
Build containers / Compute changes (pull_request) Canceled after 9s
Details
Build containers / Prune old releases and tags (pull_request) Skipped
Details 
The changes job ran on the bare runner, which has no git (the build jobs
install it before checkout). actions/checkout then fell back to a tarball
without history, `git diff` failed, `|| true` turned that into an empty
change list, and an empty list means "rebuild everything" - on every push
and PR.

Run the job in the buildroot container with git and nodejs, warn when the
diff fails instead of hiding it, treat a diff with no changes as "build
nothing", and let a manual run pick one image. The weekly scheduled run
still rebuilds all images for package updates.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
 2026-10-20 09:21:08 +00:00
Wesley van TilburgandClaude Opus 5.5 2b78113124 fedora-intune: install Defender from Microsoft's Fedora 44 repo 
The RHEL 10 repo was there for the Intune app, which only ships for RHEL;
that app is gone and the repo now only provides mdatp. Use Microsoft's
Fedora 44 repo instead: Fedora is a supported Defender distribution
(servers and the Linux desktop preview), and it carries a newer build
(101.26091.0003 vs 101.26081.0010 in the RHEL 10 repo). Same signing key
and signed metadata.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
 2026-10-20 09:19:16 +00:00
Wesley van TilburgandClaude Opus 5.5 6afa1d21e6 fedora-intune: cron for Intune config scripts, Defender remediation script 
Himmelblau installs Intune Linux custom configuration scripts as
/etc/cron.d jobs, and the image had no cron, so a script policy failed to
apply. Add cronie and enable crond.

Add a custom configuration script that repairs Microsoft Defender on its
schedule: finishes first-boot setup, restarts a stopped daemon, onboards with
the tenant's mdatp_onboard.json (pasted into the script in Intune), and
re-enables real-time protection and updates definitions when needed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
 2026-10-20 09:15:28 +00:00
Wesley van TilburgandClaude Opus 5.5 75c3b502d7 fedora-intune: report full image version to Intune, Defender compliance script 
Himmelblau reports VERSION_ID from /etc/os-release as the device OS version,
so Intune showed "44". Give himmelblaud and himmelblaud-tasks their own
os-release (bind-mounted in their mount namespace only) with VERSION_ID set to
OSTREE_VERSION, e.g. 44.20261019.0. The rest of the system keeps the stock
VERSION_ID that toolbox, flatpak and dnf expect.

Add an Intune custom compliance discovery script and rules for Microsoft
Defender for Endpoint (installed, running, onboarded, licensed, healthy,
real-time protection, definitions up to date). These are uploaded to Intune,
not shipped in the image.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
 2026-10-20 09:13:03 +00:00