MisthiosandClaude Opus 5.5
4f71d350fa
Build containers / Compute changes (pull_request) Successful in 2s
Build containers / fedora-remote (44) (pull_request) Successful in 11m9s
Build containers / fedora-cosmic (rawhide) (pull_request) Successful in 12m8s
Build containers / fedora-cosmic (44) (pull_request) Successful in 14m20s
Build containers / fedora-intune (44) (pull_request) Canceled after 10m35s
Build containers / fedora-intune-himmelblau (44) (pull_request) Canceled after 9m41s
Build containers / Prune old releases and tags (pull_request) Skipped
Fixes found by building and inspecting the image: - Select the Intune authselect profile with-altfiles. Without it system users in /usr/lib/passwd (gdm, pipewire, mdatp) do not resolve and the login screen never starts. The build now fails if gdm does not resolve. - Ship /opt as a plain directory (opt-usrlocal: root). Defender installs to /opt/microsoft/mdatp and keeps state in /var/opt/microsoft/mdatp; with the default /opt -> /var/opt symlink those were the same read-only directory. rpm-ostree still relocates /opt content to /usr/lib/opt, so finalize.d/60-opt-links links it back (only for images where /opt is a directory; fedora-cosmic/remote are unaffected). - Run Defender's %post on first boot (mdatp-firstboot.service): in a compose /var is read-only and the machine GUID/state must not be shared. mdatp.service waits for it. New image fedora-intune-himmelblau: the same workstation with Entra ID sign-in through Himmelblau (Community Nightly packages), which joins the device at the first sign-in and enrolls it in Intune (apply_policy) instead of the Microsoft Intune app. Workstation, Edge and Defender manifests move to images/shared so both images use them; build.sh copies images/shared/*.yaml and CI builds both images in one matrix job. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
39 lines
1.2 KiB
YAML
39 lines
1.2 KiB
YAML
# Minimal GNOME workstation with the Microsoft Intune app, Microsoft Edge and
|
|
# Microsoft Defender for Endpoint, for testing Intune enrollment and Linux
|
|
# compliance policies. Local accounts only: no Kanidm, because the Intune app
|
|
# needs its own authselect profile (pam_intune) for the password checks.
|
|
|
|
metadata:
|
|
summary: Fedora minimal GNOME workstation with Microsoft Intune and Defender
|
|
|
|
variables:
|
|
# Opt out of the upstream fedora.yaml so we don't pull the Firefox RPM.
|
|
distro: "fedora-intune"
|
|
variant: "intune"
|
|
|
|
# Keep it small: no weak/optional dependencies.
|
|
recommends: false
|
|
|
|
default_target: graphical.target
|
|
|
|
ref: fedora-intune/${releasever_ref}/${basearch}/intune
|
|
|
|
# Ship /opt as a plain read-only directory instead of a symlink to /var/opt.
|
|
# Defender installs to /opt/microsoft/mdatp and keeps its state in
|
|
# /var/opt/microsoft/mdatp; with the default symlink those are the same,
|
|
# read-only directory. Needs composefs, which upstream enables.
|
|
opt-usrlocal: root
|
|
|
|
repos:
|
|
- microsoft-rhel10
|
|
- microsoft-edge
|
|
|
|
include:
|
|
- base-atomic.yaml
|
|
# Shared with fedora-intune-himmelblau (images/shared).
|
|
- workstation.yaml
|
|
- microsoft-edge.yaml
|
|
- defender.yaml
|
|
# Microsoft Intune app.
|
|
- intune.yaml
|