MisthiosandClaude Opus 5.5
fadf549b5d
Build containers / Compute changes (pull_request) Successful in 2s
Build containers / fedora-cosmic (44) (pull_request) Failing after 26s
Build containers / fedora-cosmic (rawhide) (pull_request) Failing after 28s
Build containers / fedora-remote (44) (pull_request) Failing after 34s
Build containers / fedora-intune (44) (pull_request) Failing after 27s
Build containers / Prune old releases and tags (pull_request) Skipped
New image for testing Microsoft Intune enrollment and Linux compliance policies: a minimal GNOME workstation (gnome-initial-setup, Ptyxis, Files) with the Intune app, the Microsoft identity broker, Edge and Defender for Endpoint (mdatp) from packages.microsoft.com (RHEL 10 builds, limited to those packages with includepkgs). No Kanidm: the Intune app installs its own authselect profile with pam_intune for the password compliance checks. Its %post cannot select the profile or load the SELinux module during a compose, so both are redone in postprocess. build.sh now copies every *.yaml of an image, so manifests can be split into more files than manifest.yaml and custom.yaml. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
56 lines
1.6 KiB
YAML
56 lines
1.6 KiB
YAML
# Minimal GNOME workstation.
|
|
|
|
packages:
|
|
# Fedora integration normally provided by the upstream fedora.yaml (which we
|
|
# opt out of to avoid the Firefox RPM).
|
|
- fedora-release
|
|
- fedora-release-ostree-desktop
|
|
- fedora-flathub-remote
|
|
|
|
# GNOME desktop: gdm pulls gnome-session, gnome-settings-daemon,
|
|
# accountsservice, dconf and gnome-keyring-pam. gnome-initial-setup creates
|
|
# the first local user on first boot.
|
|
- gdm
|
|
- gnome-shell
|
|
- gnome-control-center
|
|
- gnome-initial-setup
|
|
- nautilus
|
|
- ptyxis
|
|
- pipewire
|
|
- pipewire-pulseaudio
|
|
- wireplumber
|
|
- xdg-desktop-portal-gnome
|
|
- xdg-user-dirs-gtk
|
|
- flatpak
|
|
|
|
# Session infrastructure base-atomic lacks with recommends off; see
|
|
# fedora-remote/custom.yaml.
|
|
- dbus-daemon
|
|
- systemd-pam
|
|
- mesa-dri-drivers
|
|
- mesa-libEGL
|
|
|
|
# The upstream initramfs config adds dracut's tpm2-tss module, which needs the
|
|
# tpm2 binary. fedora-remote gets it through Kanidm; list it explicitly here.
|
|
- tpm2-tools
|
|
|
|
# Proxmox guest integration (agent, console clipboard and resizing).
|
|
- qemu-guest-agent
|
|
- spice-vdagent
|
|
|
|
# Microsoft Edge is the browser (Conditional Access needs it).
|
|
exclude-packages:
|
|
- firefox
|
|
|
|
add-files:
|
|
- ["50-workstation.preset", "/usr/lib/systemd/system-preset/50-workstation.preset"]
|
|
# Key-only SSH for local accounts.
|
|
- ["10-intune-sshd.conf", "/etc/ssh/sshd_config.d/10-intune-sshd.conf"]
|
|
|
|
postprocess:
|
|
# uresourced breaks the GDM greeter's user manager; see fedora-remote.
|
|
- |
|
|
#!/usr/bin/env bash
|
|
set -xeuo pipefail
|
|
ln -sf /dev/null /etc/systemd/system/uresourced.service
|