MisthiosandClaude Opus 5.5
4f71d350fa
Build containers / Compute changes (pull_request) Successful in 2s
Build containers / fedora-remote (44) (pull_request) Successful in 11m9s
Build containers / fedora-cosmic (rawhide) (pull_request) Successful in 12m8s
Build containers / fedora-cosmic (44) (pull_request) Successful in 14m20s
Build containers / fedora-intune (44) (pull_request) Canceled after 10m35s
Build containers / fedora-intune-himmelblau (44) (pull_request) Canceled after 9m41s
Build containers / Prune old releases and tags (pull_request) Skipped
Fixes found by building and inspecting the image: - Select the Intune authselect profile with-altfiles. Without it system users in /usr/lib/passwd (gdm, pipewire, mdatp) do not resolve and the login screen never starts. The build now fails if gdm does not resolve. - Ship /opt as a plain directory (opt-usrlocal: root). Defender installs to /opt/microsoft/mdatp and keeps state in /var/opt/microsoft/mdatp; with the default /opt -> /var/opt symlink those were the same read-only directory. rpm-ostree still relocates /opt content to /usr/lib/opt, so finalize.d/60-opt-links links it back (only for images where /opt is a directory; fedora-cosmic/remote are unaffected). - Run Defender's %post on first boot (mdatp-firstboot.service): in a compose /var is read-only and the machine GUID/state must not be shared. mdatp.service waits for it. New image fedora-intune-himmelblau: the same workstation with Entra ID sign-in through Himmelblau (Community Nightly packages), which joins the device at the first sign-in and enrolls it in Intune (apply_policy) instead of the Microsoft Intune app. Workstation, Edge and Defender manifests move to images/shared so both images use them; build.sh copies images/shared/*.yaml and CI builds both images in one matrix job. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
57 lines
1.7 KiB
YAML
57 lines
1.7 KiB
YAML
# Minimal GNOME workstation, shared by the fedora-intune images. Include it
|
|
# from a manifest that sets `opt-usrlocal: root` (finalize.d/60-opt-links).
|
|
|
|
packages:
|
|
# Fedora integration normally provided by the upstream fedora.yaml (which we
|
|
# opt out of to avoid the Firefox RPM).
|
|
- fedora-release
|
|
- fedora-release-ostree-desktop
|
|
- fedora-flathub-remote
|
|
|
|
# GNOME desktop: gdm pulls gnome-session, gnome-settings-daemon,
|
|
# accountsservice, dconf and gnome-keyring-pam. gnome-initial-setup creates
|
|
# the first local user on first boot.
|
|
- gdm
|
|
- gnome-shell
|
|
- gnome-control-center
|
|
- gnome-initial-setup
|
|
- nautilus
|
|
- ptyxis
|
|
- pipewire
|
|
- pipewire-pulseaudio
|
|
- wireplumber
|
|
- xdg-desktop-portal-gnome
|
|
- xdg-user-dirs-gtk
|
|
- flatpak
|
|
|
|
# Session infrastructure base-atomic lacks with recommends off; see
|
|
# fedora-remote/custom.yaml.
|
|
- dbus-daemon
|
|
- systemd-pam
|
|
- mesa-dri-drivers
|
|
- mesa-libEGL
|
|
|
|
# The upstream initramfs config adds dracut's tpm2-tss module, which needs the
|
|
# tpm2 binary. fedora-remote gets it through Kanidm; list it explicitly here.
|
|
- tpm2-tools
|
|
|
|
# Proxmox guest integration (agent, console clipboard and resizing).
|
|
- qemu-guest-agent
|
|
- spice-vdagent
|
|
|
|
# Microsoft Edge is the browser (Conditional Access needs it).
|
|
exclude-packages:
|
|
- firefox
|
|
|
|
add-files:
|
|
- ["50-workstation.preset", "/usr/lib/systemd/system-preset/50-workstation.preset"]
|
|
# Key-only SSH for local accounts.
|
|
- ["10-workstation-sshd.conf", "/etc/ssh/sshd_config.d/10-workstation-sshd.conf"]
|
|
|
|
postprocess:
|
|
# uresourced breaks the GDM greeter's user manager; see fedora-remote.
|
|
- |
|
|
#!/usr/bin/env bash
|
|
set -xeuo pipefail
|
|
ln -sf /dev/null /etc/systemd/system/uresourced.service
|