Wesley van TilburgandClaude Opus 5.5
75c3b502d7
Himmelblau reports VERSION_ID from /etc/os-release as the device OS version, so Intune showed "44". Give himmelblaud and himmelblaud-tasks their own os-release (bind-mounted in their mount namespace only) with VERSION_ID set to OSTREE_VERSION, e.g. 44.20261019.0. The rest of the system keeps the stock VERSION_ID that toolbox, flatpak and dnf expect. Add an Intune custom compliance discovery script and rules for Microsoft Defender for Endpoint (installed, running, onboarded, licensed, healthy, real-time protection, definitions up to date). These are uploaded to Intune, not shipped in the image. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
24 lines
904 B
Bash
24 lines
904 B
Bash
#!/usr/bin/env bash
|
|
# Write the os-release that the Himmelblau daemons see (10-os-release.conf):
|
|
# the image's /usr/lib/os-release with VERSION_ID set to the full image version
|
|
# (OSTREE_VERSION, e.g. 44.20261019.0), so Intune shows the build and not just
|
|
# "44". Himmelblau reports VERSION_ID as the device's OS version and has no
|
|
# setting for it. The rest of the system keeps the stock VERSION_ID, which
|
|
# toolbox, flatpak and dnf expect to be the plain release.
|
|
set -euo pipefail
|
|
|
|
SRC=/usr/lib/os-release
|
|
DEST=/run/himmelblau-os-release
|
|
|
|
version="$(. "${SRC}" && echo "${OSTREE_VERSION:-${IMAGE_VERSION:-}}")"
|
|
|
|
tmp="$(mktemp "${DEST}.XXXXXX")"
|
|
if [[ -n "${version}" ]]; then
|
|
sed "s/^VERSION_ID=.*/VERSION_ID=${version}/" "${SRC}" > "${tmp}"
|
|
else
|
|
# No image version (not an ostree/bootc deployment): pass it through as-is.
|
|
cat "${SRC}" > "${tmp}"
|
|
fi
|
|
chmod 0644 "${tmp}"
|
|
mv -f "${tmp}" "${DEST}"
|