mirror of
https://github.com/optim-enterprises-bv/secureblue.git
synced 2025-11-02 19:38:10 +00:00
feat: nvidia-open images, major streamlining, bugfixes, and polish (#461)
This commit is contained in:
qoijjj
122
.github/workflows/build.yml
vendored
122
.github/workflows/build.yml
vendored
@@ -1,8 +1,7 @@
|
|||||||
name: build-secureblue
|
name: build-secureblue
|
||||||
on:
|
on:
|
||||||
schedule:
|
schedule:
|
||||||
- cron: "00 5 * * *" # build at 5:00 UTC every day
|
- cron: "00 6 * * *" # build at 6:00 UTC every day
|
||||||
# 80 minutes after the last uBlue images start building
|
|
||||||
# 60 minutes after last wayblue images start building
|
# 60 minutes after last wayblue images start building
|
||||||
push:
|
push:
|
||||||
paths-ignore: # don't rebuild if only documentation has changed
|
paths-ignore: # don't rebuild if only documentation has changed
|
||||||
@@ -23,95 +22,77 @@ jobs:
|
|||||||
recipe:
|
recipe:
|
||||||
# non-userns
|
# non-userns
|
||||||
# general
|
# general
|
||||||
- general/recipe-aurora-main.yml
|
|
||||||
- general/recipe-aurora-nvidia.yml
|
|
||||||
- general/recipe-aurora-surface.yml
|
|
||||||
- general/recipe-aurora-surface-nvidia.yml
|
|
||||||
- general/recipe-silverblue-main.yml
|
- general/recipe-silverblue-main.yml
|
||||||
- general/recipe-silverblue-nvidia.yml
|
- general/recipe-silverblue-nvidia.yml
|
||||||
|
- general/recipe-silverblue-nvidia-open.yml
|
||||||
- general/recipe-kinoite-main.yml
|
- general/recipe-kinoite-main.yml
|
||||||
- general/recipe-kinoite-nvidia.yml
|
- general/recipe-kinoite-nvidia.yml
|
||||||
- general/recipe-cinnamon-main.yml
|
- general/recipe-kinoite-nvidia-open.yml
|
||||||
- general/recipe-cinnamon-nvidia.yml
|
|
||||||
- general/recipe-bluefin-main.yml
|
|
||||||
- general/recipe-bluefin-nvidia.yml
|
|
||||||
- general/recipe-sericea-main.yml
|
- general/recipe-sericea-main.yml
|
||||||
- general/recipe-sericea-nvidia.yml
|
- general/recipe-sericea-nvidia.yml
|
||||||
|
- general/recipe-sericea-nvidia-open.yml
|
||||||
- general/recipe-wayblue-wayfire-main.yml
|
- general/recipe-wayblue-wayfire-main.yml
|
||||||
- general/recipe-wayblue-wayfire-nvidia.yml
|
- general/recipe-wayblue-wayfire-nvidia.yml
|
||||||
|
- general/recipe-wayblue-wayfire-nvidia-open.yml
|
||||||
- general/recipe-wayblue-hyprland-main.yml
|
- general/recipe-wayblue-hyprland-main.yml
|
||||||
- general/recipe-wayblue-hyprland-nvidia.yml
|
- general/recipe-wayblue-hyprland-nvidia.yml
|
||||||
|
- general/recipe-wayblue-hyprland-nvidia-open.yml
|
||||||
- general/recipe-wayblue-river-main.yml
|
- general/recipe-wayblue-river-main.yml
|
||||||
- general/recipe-wayblue-river-nvidia.yml
|
- general/recipe-wayblue-river-nvidia.yml
|
||||||
|
- general/recipe-wayblue-river-nvidia-open.yml
|
||||||
- general/recipe-wayblue-sway-main.yml
|
- general/recipe-wayblue-sway-main.yml
|
||||||
- general/recipe-wayblue-sway-nvidia.yml
|
- general/recipe-wayblue-sway-nvidia.yml
|
||||||
- general/recipe-cosmic-main.yml
|
- general/recipe-wayblue-sway-nvidia-open.yml
|
||||||
- general/recipe-cosmic-nvidia.yml
|
# - general/recipe-cosmic-main.yml
|
||||||
# asus
|
# - general/recipe-cosmic-nvidia.yml
|
||||||
- asus/recipe-silverblue-asus.yml
|
# - general/recipe-cosmic-nvidia-open.yml
|
||||||
- asus/recipe-silverblue-asus-nvidia.yml
|
|
||||||
- asus/recipe-kinoite-asus.yml
|
|
||||||
- asus/recipe-kinoite-asus-nvidia.yml
|
|
||||||
- asus/recipe-aurora-asus.yml
|
|
||||||
- asus/recipe-aurora-asus-nvidia.yml
|
|
||||||
# server
|
# server
|
||||||
- securecore/recipe-securecore-main.yml
|
- securecore/recipe-securecore-main.yml
|
||||||
- securecore/recipe-securecore-nvidia.yml
|
- securecore/recipe-securecore-nvidia.yml
|
||||||
|
- securecore/recipe-securecore-nvidia-open.yml
|
||||||
- securecore/recipe-securecore-zfs-main.yml
|
- securecore/recipe-securecore-zfs-main.yml
|
||||||
- securecore/recipe-securecore-zfs-nvidia.yml
|
- securecore/recipe-securecore-zfs-nvidia.yml
|
||||||
|
- securecore/recipe-securecore-zfs-nvidia-open.yml
|
||||||
# userns
|
# userns
|
||||||
# general
|
# general
|
||||||
- general/recipe-aurora-surface-userns.yml
|
|
||||||
- general/recipe-aurora-surface-nvidia-userns.yml
|
|
||||||
- general/recipe-aurora-dx-main-userns.yml
|
|
||||||
- general/recipe-aurora-dx-nvidia-userns.yml
|
|
||||||
- general/recipe-aurora-dx-surface-nvidia-userns.yml
|
|
||||||
- general/recipe-aurora-dx-surface-userns.yml
|
|
||||||
- general/recipe-aurora-main-userns.yml
|
|
||||||
- general/recipe-aurora-nvidia-userns.yml
|
|
||||||
- general/recipe-silverblue-main-userns.yml
|
- general/recipe-silverblue-main-userns.yml
|
||||||
- general/recipe-silverblue-nvidia-userns.yml
|
- general/recipe-silverblue-nvidia-userns.yml
|
||||||
|
- general/recipe-silverblue-nvidia-open-userns.yml
|
||||||
- general/recipe-kinoite-main-userns.yml
|
- general/recipe-kinoite-main-userns.yml
|
||||||
- general/recipe-kinoite-nvidia-userns.yml
|
- general/recipe-kinoite-nvidia-userns.yml
|
||||||
- general/recipe-cinnamon-main-userns.yml
|
- general/recipe-kinoite-nvidia-open-userns.yml
|
||||||
- general/recipe-cinnamon-nvidia-userns.yml
|
|
||||||
- general/recipe-bluefin-main-userns.yml
|
|
||||||
- general/recipe-bluefin-nvidia-userns.yml
|
|
||||||
- general/recipe-bluefin-dx-main-userns.yml
|
|
||||||
- general/recipe-bluefin-dx-nvidia-userns.yml
|
|
||||||
- general/recipe-sericea-main-userns.yml
|
- general/recipe-sericea-main-userns.yml
|
||||||
- general/recipe-sericea-nvidia-userns.yml
|
- general/recipe-sericea-nvidia-userns.yml
|
||||||
|
- general/recipe-sericea-nvidia-open-userns.yml
|
||||||
- general/recipe-wayblue-wayfire-main-userns.yml
|
- general/recipe-wayblue-wayfire-main-userns.yml
|
||||||
- general/recipe-wayblue-wayfire-nvidia-userns.yml
|
- general/recipe-wayblue-wayfire-nvidia-userns.yml
|
||||||
|
- general/recipe-wayblue-wayfire-nvidia-open-userns.yml
|
||||||
- general/recipe-wayblue-hyprland-main-userns.yml
|
- general/recipe-wayblue-hyprland-main-userns.yml
|
||||||
- general/recipe-wayblue-hyprland-nvidia-userns.yml
|
- general/recipe-wayblue-hyprland-nvidia-userns.yml
|
||||||
|
- general/recipe-wayblue-hyprland-nvidia-open-userns.yml
|
||||||
- general/recipe-wayblue-river-main-userns.yml
|
- general/recipe-wayblue-river-main-userns.yml
|
||||||
- general/recipe-wayblue-river-nvidia-userns.yml
|
- general/recipe-wayblue-river-nvidia-userns.yml
|
||||||
|
- general/recipe-wayblue-river-nvidia-open-userns.yml
|
||||||
- general/recipe-wayblue-sway-main-userns.yml
|
- general/recipe-wayblue-sway-main-userns.yml
|
||||||
- general/recipe-wayblue-sway-nvidia-userns.yml
|
- general/recipe-wayblue-sway-nvidia-userns.yml
|
||||||
- general/recipe-cosmic-main-userns.yml
|
- general/recipe-wayblue-sway-nvidia-open-userns.yml
|
||||||
- general/recipe-cosmic-nvidia-userns.yml
|
# - general/recipe-cosmic-main-userns.yml
|
||||||
# asus
|
# - general/recipe-cosmic-nvidia-userns.yml
|
||||||
- asus/recipe-silverblue-asus-userns.yml
|
# - general/recipe-cosmic-nvidia-open-userns.yml
|
||||||
- asus/recipe-silverblue-asus-nvidia-userns.yml
|
|
||||||
- asus/recipe-kinoite-asus-userns.yml
|
|
||||||
- asus/recipe-kinoite-asus-nvidia-userns.yml
|
|
||||||
- asus/recipe-aurora-asus-userns.yml
|
|
||||||
- asus/recipe-aurora-asus-nvidia-userns.yml
|
|
||||||
- asus/recipe-aurora-dx-asus-userns.yml
|
|
||||||
- asus/recipe-aurora-dx-asus-nvidia-userns.yml
|
|
||||||
# server
|
# server
|
||||||
- securecore/recipe-securecore-main-userns.yml
|
- securecore/recipe-securecore-main-userns.yml
|
||||||
- securecore/recipe-securecore-nvidia-userns.yml
|
- securecore/recipe-securecore-nvidia-userns.yml
|
||||||
|
- securecore/recipe-securecore-nvidia-open-userns.yml
|
||||||
- securecore/recipe-securecore-zfs-main-userns.yml
|
- securecore/recipe-securecore-zfs-main-userns.yml
|
||||||
- securecore/recipe-securecore-zfs-nvidia-userns.yml
|
- securecore/recipe-securecore-zfs-nvidia-userns.yml
|
||||||
|
- securecore/recipe-securecore-zfs-nvidia-open-userns.yml
|
||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout repo
|
- name: Checkout repo
|
||||||
uses: actions/checkout@v4
|
uses: actions/checkout@v4
|
||||||
|
|
||||||
- name: Add yq (for reading recipe.yml)
|
- name: Add yq (for reading recipe.yml)
|
||||||
uses: mikefarah/yq@v4.44.2
|
uses: mikefarah/yq@v4.44.3
|
||||||
|
|
||||||
- name: Gather image data from recipe
|
- name: Gather image data from recipe
|
||||||
run: |
|
run: |
|
||||||
@@ -120,12 +101,6 @@ jobs:
|
|||||||
BASE_IMAGE=$(yq '.base-image' ./recipes/${{ matrix.recipe }})
|
BASE_IMAGE=$(yq '.base-image' ./recipes/${{ matrix.recipe }})
|
||||||
echo "BASE_IMAGE_NAME=$(echo $BASE_IMAGE | sed 's/.*\/.*\///')" >> $GITHUB_ENV
|
echo "BASE_IMAGE_NAME=$(echo $BASE_IMAGE | sed 's/.*\/.*\///')" >> $GITHUB_ENV
|
||||||
|
|
||||||
- name: Verify base image
|
|
||||||
if: ${{ !contains(env.IMAGE_NAME, 'wayblue') && !contains(env.IMAGE_NAME, 'cinnamon') && !contains(env.IMAGE_NAME, 'securecore') }}
|
|
||||||
uses: EyeCantCU/cosign-action/verify@v0.3.0
|
|
||||||
with:
|
|
||||||
containers: ${{ env.BASE_IMAGE_NAME }}:${{ env.IMAGE_MAJOR_VERSION }}
|
|
||||||
|
|
||||||
- name: Verify base image
|
- name: Verify base image
|
||||||
if: ${{ contains(env.IMAGE_NAME, 'wayblue') }}
|
if: ${{ contains(env.IMAGE_NAME, 'wayblue') }}
|
||||||
uses: EyeCantCU/cosign-action/verify@v0.3.0
|
uses: EyeCantCU/cosign-action/verify@v0.3.0
|
||||||
@@ -134,26 +109,43 @@ jobs:
|
|||||||
registry: 'ghcr.io/wayblueorg'
|
registry: 'ghcr.io/wayblueorg'
|
||||||
pubkey: 'https://raw.githubusercontent.com/wayblueorg/wayblue/live/cosign.pub'
|
pubkey: 'https://raw.githubusercontent.com/wayblueorg/wayblue/live/cosign.pub'
|
||||||
|
|
||||||
- name: Verify base image
|
- name: Validate server kernel and kmod versions
|
||||||
if: ${{ contains(env.IMAGE_NAME, 'cinnamon') }}
|
|
||||||
uses: EyeCantCU/cosign-action/verify@v0.3.0
|
|
||||||
with:
|
|
||||||
containers: ${{ env.BASE_IMAGE_NAME }}:${{ env.IMAGE_MAJOR_VERSION }}
|
|
||||||
registry: 'ghcr.io/legacy-images'
|
|
||||||
pubkey: 'https://raw.githubusercontent.com/legacy-images/cinnamon/main/cosign.pub'
|
|
||||||
|
|
||||||
- name: Verify base image
|
|
||||||
if: ${{ contains(env.IMAGE_NAME, 'securecore') }}
|
if: ${{ contains(env.IMAGE_NAME, 'securecore') }}
|
||||||
uses: EyeCantCU/cosign-action/verify@v0.3.0
|
uses: Wandalen/wretry.action@v3.5.0
|
||||||
with:
|
with:
|
||||||
containers: ${{ env.BASE_IMAGE_NAME }}:${{ env.IMAGE_MAJOR_VERSION }}
|
attempt_limit: 3
|
||||||
registry: 'ghcr.io/secureblue'
|
attempt_delay: 15000
|
||||||
pubkey: 'https://raw.githubusercontent.com/secureblue/coreos/main/cosign.pub'
|
command: |
|
||||||
|
set -eo pipefail
|
||||||
|
linux=$(skopeo inspect docker://ghcr.io/ublue-os/coreos-testing-kernel:40 | jq -r '.Labels["ostree.linux"]')
|
||||||
|
AKMODS_KERNEL_VERSION=$(skopeo inspect docker://ghcr.io/ublue-os/akmods:coreos-testing-40 | jq -r '.Labels["ostree.linux"]')
|
||||||
|
if [[ "${linux}" != "${AKMODS_KERNEL_VERSION}" ]]; then
|
||||||
|
echo "Kernel Versions do not match between AKMODS and Cached-Kernel."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
echo "KERNEL_VERSION=$linux" >> $GITHUB_ENV
|
||||||
|
|
||||||
|
- name: Validate desktop kernel and kmod versions
|
||||||
|
if: ${{ !contains(env.IMAGE_NAME, 'securecore') }}
|
||||||
|
uses: Wandalen/wretry.action@v3.5.0
|
||||||
|
with:
|
||||||
|
attempt_limit: 3
|
||||||
|
attempt_delay: 15000
|
||||||
|
command: |
|
||||||
|
set -eo pipefail
|
||||||
|
linux=$(skopeo inspect docker://ghcr.io/ublue-os/main-kernel:40 | jq -r '.Labels["ostree.linux"]')
|
||||||
|
AKMODS_KERNEL_VERSION=$(skopeo inspect docker://ghcr.io/ublue-os/akmods:main-40 | jq -r '.Labels["ostree.linux"]')
|
||||||
|
if [[ "${linux}" != "${AKMODS_KERNEL_VERSION}" ]]; then
|
||||||
|
echo "Kernel Versions do not match between AKMODS and Cached-Kernel."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
echo "KERNEL_VERSION=$linux" >> $GITHUB_ENV
|
||||||
|
|
||||||
|
|
||||||
- name: Build secureblue
|
- name: Build secureblue
|
||||||
uses: blue-build/github-action@v1.6.1
|
uses: blue-build/github-action@v1.6.1
|
||||||
with:
|
with:
|
||||||
cli_version: v0.8.14
|
cli_version: v0.8.20
|
||||||
recipe: ${{ matrix.recipe }}
|
recipe: ${{ matrix.recipe }}
|
||||||
cosign_private_key: ${{ secrets.SIGNING_SECRET }}
|
cosign_private_key: ${{ secrets.SIGNING_SECRET }}
|
||||||
registry_token: ${{ github.token }}
|
registry_token: ${{ github.token }}
|
||||||
|
|||||||
@@ -13,7 +13,14 @@ If you are using an nvidia image, run this after installation:
|
|||||||
rpm-ostree kargs \
|
rpm-ostree kargs \
|
||||||
--append-if-missing=rd.driver.blacklist=nouveau \
|
--append-if-missing=rd.driver.blacklist=nouveau \
|
||||||
--append-if-missing=modprobe.blacklist=nouveau \
|
--append-if-missing=modprobe.blacklist=nouveau \
|
||||||
--append-if-missing=nvidia-drm.modeset=1
|
--append-if-missing=nvidia-drm.modeset=1 \
|
||||||
|
--append-if-missing=nvidia-drm.fbdev=1
|
||||||
|
```
|
||||||
|
|
||||||
|
You may also need this (solves flickering and luks issues on some nvidia hardware):
|
||||||
|
```
|
||||||
|
rpm-ostree kargs \
|
||||||
|
--append-if-missing=initcall_blacklist=simpledrm_platform_driver_init
|
||||||
```
|
```
|
||||||
|
|
||||||
### Nvidia optimus laptop
|
### Nvidia optimus laptop
|
||||||
@@ -120,6 +127,11 @@ To validate your secureblue setup, run:
|
|||||||
```
|
```
|
||||||
ujust audit-secureblue
|
ujust audit-secureblue
|
||||||
```
|
```
|
||||||
|
|
||||||
|
## Optional: `hardened-chromium` Flags
|
||||||
|
The included hardened-chromium browser has some additional settings in `chrome://flags` you *may* want to set for additional hardening, and convenience. (That can cause functionality issues in *some* cases)
|
||||||
|
You can read about these settings [here](https://github.com/secureblue/hardened-chromium?tab=readme-ov-file#post-install).
|
||||||
|
|
||||||
## Read the FAQ
|
## Read the FAQ
|
||||||
|
|
||||||
Lots of important stuff is covered in the [FAQ](https://github.com/secureblue/secureblue/blob/live/FAQ.md). AppImage toggles, GNOME extension toggles, Xwayland toggles, etc.
|
Lots of important stuff is covered in the [FAQ](https://github.com/secureblue/secureblue/blob/live/FAQ.md). AppImage toggles, GNOME extension toggles, Xwayland toggles, etc.
|
||||||
|
|||||||
@@ -4,6 +4,9 @@ The recommended method to install secureblue is to rebase from an upstream silve
|
|||||||
|
|
||||||
## Preinstall guide
|
## Preinstall guide
|
||||||
|
|
||||||
|
> [!TIP]
|
||||||
|
> If you don't yet have a Fedora Atomic installation medium, you should obtain an image from the official Fedora Project website, [here](https://fedoraproject.org/atomic-desktops/). Once you have downloaded an image, it is *highly reccomended* that you [verify](https://fedoraproject.org/security) it for security and integrity.
|
||||||
|
|
||||||
### Fedora Installation
|
### Fedora Installation
|
||||||
- Select the option to encrypt the drive you're installing to.
|
- Select the option to encrypt the drive you're installing to.
|
||||||
- Use a [strong password](https://security.harvard.edu/use-strong-passwords) when prompted.
|
- Use a [strong password](https://security.harvard.edu/use-strong-passwords) when prompted.
|
||||||
|
|||||||
169
README.md
169
README.md
@@ -11,14 +11,14 @@
|
|||||||
[](https://discord.com/invite/qMTv5cKfbF)
|
[](https://discord.com/invite/qMTv5cKfbF)
|
||||||
[](https://github.com/secureblue/secureblue/blob/live/DONATE.md)
|
[](https://github.com/secureblue/secureblue/blob/live/DONATE.md)
|
||||||
|
|
||||||
This repo uses [BlueBuild](https://blue-build.org/) to generate hardened operating system images, using [uBlue](https://universal-blue.org)'s [Fedora Atomic](https://fedoraproject.org/atomic-desktops/)-based [base images](https://github.com/orgs/ublue-os/packages?repo_name=main) as a starting point.
|
This repo uses [BlueBuild](https://blue-build.org/) to generate hardened operating system images, using [Fedora Atomic Desktop](https://fedoraproject.org/atomic-desktops/)'s [base images](https://pagure.io/workstation-ostree-config) as a starting point.
|
||||||
|
|
||||||
# Scope
|
# Scope
|
||||||
|
|
||||||
secureblue applies hardening with the following goals in mind:
|
secureblue applies hardening with the following goals in mind:
|
||||||
|
|
||||||
- Increase defenses against the exploitation of both known and unknown vulnerabilities.
|
- Increase defenses against the exploitation of both known and unknown vulnerabilities.
|
||||||
- Avoid sacrificing usability for most use cases where possible
|
- Avoid sacrificing usability for most use cases where possible.
|
||||||
|
|
||||||
The following are not in scope:
|
The following are not in scope:
|
||||||
- Anything that sacrifices security for "privacy". Fedora is already sufficiently private and "privacy" often serves as a euphemism for security theater. This is especially true when at odds with improving security.
|
- Anything that sacrifices security for "privacy". Fedora is already sufficiently private and "privacy" often serves as a euphemism for security theater. This is especially true when at odds with improving security.
|
||||||
@@ -59,7 +59,7 @@ The following are not in scope:
|
|||||||
Fedora is one of the few distributions that ships with selinux and associated tooling built-in and enabled by default. This makes it advantageous as a starting point for building a hardened system. However, out of the box it's lacking hardening in numerous other areas. This project's goal is to improve on that significantly.
|
Fedora is one of the few distributions that ships with selinux and associated tooling built-in and enabled by default. This makes it advantageous as a starting point for building a hardened system. However, out of the box it's lacking hardening in numerous other areas. This project's goal is to improve on that significantly.
|
||||||
|
|
||||||
|
|
||||||
For more info on uBlue and BlueBuild, check out the [uBlue homepage](https://universal-blue.org/) and the [BlueBuild homepage](https://blue-build.org/).
|
For more info on BlueBuild, check out the [BlueBuild homepage](https://blue-build.org/).
|
||||||
|
|
||||||
# Customization
|
# Customization
|
||||||
|
|
||||||
@@ -78,15 +78,17 @@ Sponsorship options are on the [Donate](DONATE.md) page. All donations are appre
|
|||||||
Have a look at [PREINSTALL-README](PREINSTALL-README.md) before proceeding.
|
Have a look at [PREINSTALL-README](PREINSTALL-README.md) before proceeding.
|
||||||
|
|
||||||
## Rebasing (Recommended)
|
## Rebasing (Recommended)
|
||||||
*Note: if you don't already have a Fedora Atomic installation, use a Fedora Atomic iso that matches your secureblue target image to install one. If you want to use a secureblue Silverblue image, start with the Fedora Silverblue iso, Kinoite for Kinoite, and Sericea (Sway Atomic) for Sericea and all the Wayblue images.*
|
> [!NOTE]
|
||||||
|
> If you don't already have a Fedora Atomic installation, use a Fedora Atomic ISO that matches your secureblue target image to install one. If you want to use a secureblue Silverblue image, start with the Fedora Silverblue ISO, Kinoite for Kinoite, and Sericea (Sway Atomic) for Sericea and all the Wayblue images.
|
||||||
|
|
||||||
To rebase a [Fedora Atomic](https://fedoraproject.org/atomic-desktops/) installation, choose an $IMAGE_NAME from the [list below](README.md#images-userns), then follow these steps:
|
To rebase a [Fedora Atomic](https://fedoraproject.org/atomic-desktops/) installation, follow these steps<sup>‡</sup>:
|
||||||
|
|
||||||
*(Important note: the **only** supported tag is `latest`)*
|
> [!IMPORTANT]
|
||||||
|
> The **only** supported tag is `latest`.
|
||||||
|
|
||||||
- First rebase to the unsigned image, to get the proper signing keys and policies installed:
|
- First rebase to the unsigned image, to get the proper signing keys and policies installed:
|
||||||
```
|
```
|
||||||
rpm-ostree rebase ostree-unverified-registry:ghcr.io/secureblue/$IMAGE_NAME:latest
|
rpm-ostree rebase ostree-unverified-registry:ghcr.io/secureblue/IMAGE_NAME:latest
|
||||||
```
|
```
|
||||||
- Reboot to complete the rebase:
|
- Reboot to complete the rebase:
|
||||||
```
|
```
|
||||||
@@ -94,72 +96,125 @@ To rebase a [Fedora Atomic](https://fedoraproject.org/atomic-desktops/) installa
|
|||||||
```
|
```
|
||||||
- Then rebase to the signed image, like so:
|
- Then rebase to the signed image, like so:
|
||||||
```
|
```
|
||||||
rpm-ostree rebase ostree-image-signed:docker://ghcr.io/secureblue/$IMAGE_NAME:latest
|
rpm-ostree rebase ostree-image-signed:docker://ghcr.io/secureblue/IMAGE_NAME:latest
|
||||||
```
|
```
|
||||||
- Reboot again to complete the installation
|
- Reboot again to complete the installation:
|
||||||
```
|
```
|
||||||
systemctl reboot
|
systemctl reboot
|
||||||
```
|
```
|
||||||
|
<sup>‡</sup> Replace `IMAGE_NAME` with the *full name* of your preferred image from the [list below](README.md#images).
|
||||||
|
|
||||||
## ISO
|
## ISO
|
||||||
|
|
||||||
While it's recommended to use a Fedora Atomic iso to install and then rebase that installation to secureblue, you can also generate an iso and install that directly using [this script](generate_secureblue_iso.sh). Please note you should still follow the [post-install steps](README.md#post-install) when installing from a generated iso:
|
While it's recommended to use a Fedora Atomic ISO to install and then rebase that installation to secureblue, you can also generate an ISO and install that directly using [this script](generate_secureblue_iso.sh). Please note you should still follow the [post-install steps](README.md#post-install) when installing from a generated ISO:
|
||||||
|
|
||||||
```
|
```
|
||||||
./generate_secureblue_iso.sh
|
./generate_secureblue_iso.sh
|
||||||
```
|
```
|
||||||
|
|
||||||
# Images <sup>[userns?](USERNS.md)</sup>
|
# Images
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> Learn about unprivileged user namespaces [here](USERNS.md).
|
||||||
|
|
||||||
## Desktop
|
## Desktop
|
||||||
|
|
||||||
|
*`nvidia-open` images are recommended for systems with Nvidia GPUs Turing or newer.*
|
||||||
|
|
||||||
|
*`nvidia` images are recommended for systems with Nvidia GPUs Pascal or older.*
|
||||||
|
|
||||||
### Recommended <sup>[why?](RECOMMENDED.md)</sup>
|
### Recommended <sup>[why?](RECOMMENDED.md)</sup>
|
||||||
- `silverblue-main-hardened`
|
#### Silverblue
|
||||||
- `silverblue-nvidia-hardened`
|
| Name | Base | Nvidia Support | Unpriv. Userns |
|
||||||
- `silverblue-main-userns-hardened`
|
|-------------------------------------------|-----------|-------------------------|------------------------------|
|
||||||
- `silverblue-nvidia-userns-hardened`
|
| `silverblue-main-hardened` | Silverblue| No | No |
|
||||||
|
| `silverblue-nvidia-hardened` | Silverblue| Yes, closed drivers | No |
|
||||||
|
| `silverblue-nvidia-open-hardened` | Silverblue| Yes, open drivers | No |
|
||||||
|
| `silverblue-main-userns-hardened` | Silverblue| No | Yes |
|
||||||
|
| `silverblue-nvidia-userns-hardened` | Silverblue| Yes, closed drivers | Yes |
|
||||||
|
| `silverblue-nvidia-open-userns-hardened` | Silverblue| Yes, open drivers | Yes |
|
||||||
|
|
||||||
### Stable
|
### Stable
|
||||||
- `kinoite-main-hardened`
|
#### Kinoite
|
||||||
- `kinoite-nvidia-hardened`
|
| Name | Base | Nvidia Support | Unpriv. Userns |
|
||||||
- `kinoite-main-userns-hardened`
|
|-------------------------------------------|-----------|-------------------------|------------------------------|
|
||||||
- `kinoite-nvidia-userns-hardened`
|
| `kinoite-main-hardened` | Kinoite | No | No |
|
||||||
- `sericea-main-hardened`
|
| `kinoite-nvidia-hardened` | Kinoite | Yes, closed drivers | No |
|
||||||
- `sericea-nvidia-hardened`
|
| `kinoite-nvidia-open-hardened` | Kinoite | Yes, open drivers | No |
|
||||||
- `sericea-main-userns-hardened`
|
| `kinoite-main-userns-hardened` | Kinoite | No | Yes |
|
||||||
- `sericea-nvidia-userns-hardened`
|
| `kinoite-nvidia-userns-hardened` | Kinoite | Yes, closed drivers | Yes |
|
||||||
### Beta <sup>[wayblue?](https://github.com/wayblueorg/wayblue)</sup>
|
| `kinoite-nvidia-open-userns-hardened` | Kinoite | Yes, open drivers | Yes |
|
||||||
- `wayblue-wayfire-main-hardened`
|
|
||||||
- `wayblue-wayfire-nvidia-hardened`
|
#### Sericea
|
||||||
- `wayblue-wayfire-main-userns-hardened`
|
| Name | Base | Nvidia Support | Unpriv. Userns |
|
||||||
- `wayblue-wayfire-nvidia-userns-hardened`
|
|-------------------------------------------|-----------|-------------------------|------------------------------|
|
||||||
- `wayblue-hyprland-main-hardened`
|
| `sericea-main-hardened` | Sericea | No | No |
|
||||||
- `wayblue-hyprland-nvidia-hardened`
|
| `sericea-nvidia-hardened` | Sericea | Yes, closed drivers | No |
|
||||||
- `wayblue-hyprland-main-userns-hardened`
|
| `sericea-nvidia-open-hardened` | Sericea | Yes, open drivers | No |
|
||||||
- `wayblue-hyprland-nvidia-userns-hardened`
|
| `sericea-main-userns-hardened` | Sericea | No | Yes |
|
||||||
- `wayblue-river-main-hardened`
|
| `sericea-nvidia-userns-hardened` | Sericea | Yes, closed drivers | Yes |
|
||||||
- `wayblue-river-nvidia-hardened`
|
| `sericea-nvidia-open-userns-hardened` | Sericea | Yes, open drivers | Yes |
|
||||||
- `wayblue-river-main-userns-hardened`
|
|
||||||
- `wayblue-river-nvidia-userns-hardened`
|
### Beta
|
||||||
- `wayblue-sway-main-hardened`
|
> [!NOTE]
|
||||||
- `wayblue-sway-nvidia-hardened`
|
> Learn about wayblue [here](https://github.com/wayblueorg/wayblue).
|
||||||
- `wayblue-sway-main-userns-hardened`
|
|
||||||
- `wayblue-sway-nvidia-userns-hardened`
|
#### Wayfire
|
||||||
### Experimental
|
| Name | Base | Nvidia Support | Unpriv. Userns |
|
||||||
- `cinnamon-main-hardened`
|
|-------------------------------------------|-----------------------|-------------------------|------------------------------|
|
||||||
- `cinnamon-nvidia-hardened`
|
| `wayblue-wayfire-main-hardened` | Wayblue-Wayfire | No | No |
|
||||||
- `cinnamon-main-userns-hardened`
|
| `wayblue-wayfire-nvidia-hardened` | Wayblue-Wayfire | Yes, closed drivers | No |
|
||||||
- `cinnamon-nvidia-userns-hardened`
|
| `wayblue-wayfire-nvidia-open-hardened` | Wayblue-Wayfire | Yes, open drivers | No |
|
||||||
- `cosmic-main-hardened`
|
| `wayblue-wayfire-main-userns-hardened` | Wayblue-Wayfire | No | Yes |
|
||||||
- `cosmic-nvidia-hardened`
|
| `wayblue-wayfire-nvidia-userns-hardened` | Wayblue-Wayfire | Yes, closed drivers | Yes |
|
||||||
- `cosmic-main-userns-hardened`
|
| `wayblue-wayfire-nvidia-open-userns-hardened` | Wayblue-Wayfire | Yes, open drivers | Yes |
|
||||||
- `cosmic-nvidia-userns-hardened`
|
|
||||||
|
#### Hyprland
|
||||||
|
| Name | Base | Nvidia Support | Unpriv. Userns |
|
||||||
|
|-------------------------------------------|-----------------------|-------------------------|------------------------------|
|
||||||
|
| `wayblue-hyprland-main-hardened` | Wayblue-Hyprland | No | No |
|
||||||
|
| `wayblue-hyprland-nvidia-hardened` | Wayblue-Hyprland | Yes, closed drivers | No |
|
||||||
|
| `wayblue-hyprland-nvidia-open-hardened` | Wayblue-Hyprland | Yes, open drivers | No |
|
||||||
|
| `wayblue-hyprland-main-userns-hardened` | Wayblue-Hyprland | No | Yes |
|
||||||
|
| `wayblue-hyprland-nvidia-userns-hardened`| Wayblue-Hyprland | Yes, closed drivers | Yes |
|
||||||
|
| `wayblue-hyprland-nvidia-open-userns-hardened` | Wayblue-Hyprland | Yes, open drivers | Yes |
|
||||||
|
|
||||||
|
#### River
|
||||||
|
| Name | Base | Nvidia Support | Unpriv. Userns |
|
||||||
|
|-------------------------------------------|-----------------------|-------------------------|------------------------------|
|
||||||
|
| `wayblue-river-main-hardened` | Wayblue-River | No | No |
|
||||||
|
| `wayblue-river-nvidia-hardened` | Wayblue-River | Yes, closed drivers | No |
|
||||||
|
| `wayblue-river-nvidia-open-hardened` | Wayblue-River | Yes, open drivers | No |
|
||||||
|
| `wayblue-river-main-userns-hardened` | Wayblue-River | No | Yes |
|
||||||
|
| `wayblue-river-nvidia-userns-hardened` | Wayblue-River | Yes, closed drivers | Yes |
|
||||||
|
| `wayblue-river-nvidia-open-userns-hardened` | Wayblue-River | Yes, open drivers | Yes |
|
||||||
|
|
||||||
|
|
||||||
|
#### Sway
|
||||||
|
| Name | Base | Nvidia Support | Unpriv. Userns |
|
||||||
|
|-------------------------------------------|-----------------------|-------------------------|------------------------------|
|
||||||
|
| `wayblue-sway-main-hardened` | Wayblue-Sway | No | No |
|
||||||
|
| `wayblue-sway-nvidia-hardened` | Wayblue-Sway | Yes, closed drivers | No |
|
||||||
|
| `wayblue-sway-nvidia-open-hardened` | Wayblue-Sway | Yes, open drivers | No |
|
||||||
|
| `wayblue-sway-main-userns-hardened` | Wayblue-Sway | No | Yes |
|
||||||
|
| `wayblue-sway-nvidia-userns-hardened` | Wayblue-Sway | Yes, closed drivers | Yes |
|
||||||
|
| `wayblue-sway-nvidia-open-userns-hardened` | Wayblue-Sway | Yes, open drivers | Yes |
|
||||||
|
|
||||||
## Server
|
## Server
|
||||||
- `securecore-main-hardened`
|
| Name | Base | Nvidia Support | ZFS Support | Unpriv. Userns |
|
||||||
- `securecore-nvidia-hardened`
|
|-------------------------------------------|-----------|-------------------------|-------------|------------------------------|
|
||||||
- `securecore-main-userns-hardened`
|
| `securecore-main-hardened` | CoreOS | No | No | No |
|
||||||
- `securecore-nvidia-userns-hardened`
|
| `securecore-nvidia-hardened` | CoreOS | Yes, closed drivers | No | No |
|
||||||
- `securecore-zfs-main-hardened`
|
| `securecore-nvidia-open-hardened` | CoreOS | Yes, open drivers | No | No |
|
||||||
- `securecore-zfs-nvidia-hardened`
|
| `securecore-main-userns-hardened` | CoreOS | No | No | Yes |
|
||||||
- `securecore-zfs-main-userns-hardened`
|
| `securecore-nvidia-userns-hardened` | CoreOS | Yes, closed drivers | No | Yes |
|
||||||
- `securecore-zfs-nvidia-userns-hardened`
|
| `securecore-nvidia-open-userns-hardened` | CoreOS | Yes, open drivers | No | Yes |
|
||||||
|
| `securecore-zfs-main-hardened` | CoreOS | No | Yes | No |
|
||||||
|
| `securecore-zfs-nvidia-hardened` | CoreOS | Yes, closed drivers | Yes | No |
|
||||||
|
| `securecore-zfs-nvidia-open-hardened` | CoreOS | Yes, open drivers | Yes | No |
|
||||||
|
| `securecore-zfs-main-userns-hardened` | CoreOS | No | Yes | Yes |
|
||||||
|
| `securecore-zfs-nvidia-userns-hardened` | CoreOS | Yes, closed drivers | Yes | Yes |
|
||||||
|
| `securecore-zfs-nvidia-open-userns-hardened` | CoreOS | Yes, open drivers | Yes | Yes |
|
||||||
|
|
||||||
# Post-install
|
# Post-install
|
||||||
|
|
||||||
|
|||||||
@@ -4,4 +4,4 @@
|
|||||||
# Tell build process to exit if there are any errors.
|
# Tell build process to exit if there are any errors.
|
||||||
set -oue pipefail
|
set -oue pipefail
|
||||||
|
|
||||||
sed -i 's/firefox/chromium-browser/' /usr/share/wayfire/wf-shell.ini
|
sed -i 's/org.mozilla.firefox/chromium-browser/' /usr/share/wayfire/wf-shell.ini
|
||||||
|
|||||||
8
files/scripts/addtailscalerepo.sh
Normal file
8
files/scripts/addtailscalerepo.sh
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Tell this script to exit if there are any errors.
|
||||||
|
# You should have this in every custom script, to ensure that your completed
|
||||||
|
# builds actually ran successfully without any errors!
|
||||||
|
set -oue pipefail
|
||||||
|
|
||||||
|
curl -L https://pkgs.tailscale.com/stable/fedora/tailscale.repo -o /etc/yum.repos.d/tailscale.repo
|
||||||
@@ -42,7 +42,7 @@ chmod u+s /usr/bin/bwrap
|
|||||||
echo "
|
echo "
|
||||||
|
|
||||||
|
|
||||||
module chrome_sandbox 1.0;
|
module chrome_sandbox_secureblue 1.0;
|
||||||
|
|
||||||
require {
|
require {
|
||||||
type chrome_sandbox_home_t;
|
type chrome_sandbox_home_t;
|
||||||
@@ -54,12 +54,12 @@ require {
|
|||||||
|
|
||||||
allow chrome_sandbox_t chrome_sandbox_home_t:file map;
|
allow chrome_sandbox_t chrome_sandbox_home_t:file map;
|
||||||
|
|
||||||
" > chrome_sandbox.te
|
" > chrome_sandbox_secureblue.te
|
||||||
|
|
||||||
checkmodule -M -m -o chrome_sandbox.mod chrome_sandbox.te
|
checkmodule -M -m -o chrome_sandbox_secureblue.mod chrome_sandbox_secureblue.te
|
||||||
semodule_package -o chrome_sandbox.pp -m chrome_sandbox.mod
|
semodule_package -o chrome_sandbox_secureblue.pp -m chrome_sandbox_secureblue.mod
|
||||||
semodule -i chrome_sandbox.pp
|
semodule -i chrome_sandbox_secureblue.pp
|
||||||
|
|
||||||
rm chrome_sandbox.te
|
rm chrome_sandbox_secureblue.te
|
||||||
rm chrome_sandbox.mod
|
rm chrome_sandbox_secureblue.mod
|
||||||
rm chrome_sandbox.pp
|
rm chrome_sandbox_secureblue.pp
|
||||||
|
|||||||
6
files/scripts/excludepcsc.sh
Normal file
6
files/scripts/excludepcsc.sh
Normal file
@@ -0,0 +1,6 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Tell build process to exit if there are any errors.
|
||||||
|
set -oue pipefail
|
||||||
|
|
||||||
|
sed -i 's/add_dracutmodules+=" fido2 tpm2-tss pkcs11 pcsc "/add_dracutmodules+=" fido2 tpm2-tss pkcs11 "/' /usr/lib/dracut/dracut.conf.d/90-ublue-luks.conf
|
||||||
10
files/scripts/excludezfs.sh
Normal file
10
files/scripts/excludezfs.sh
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Tell build process to exit if there are any errors.
|
||||||
|
set -oue pipefail
|
||||||
|
|
||||||
|
echo '
|
||||||
|
|
||||||
|
omit_dracutmodules+=" zfs "
|
||||||
|
|
||||||
|
' > /usr/lib/dracut/dracut.conf.d/99-omit-zfs.conf
|
||||||
@@ -3,11 +3,16 @@
|
|||||||
# Tell build process to exit if there are any errors.
|
# Tell build process to exit if there are any errors.
|
||||||
set -oue pipefail
|
set -oue pipefail
|
||||||
|
|
||||||
sed -i 's/insecureAcceptAnything/reject/' /usr/etc/containers/policy.json
|
POLICY_FILE="/usr/etc/containers/policy.json"
|
||||||
|
|
||||||
|
if [[ ! -f "$POLICY_FILE" ]]; then
|
||||||
|
echo "Error: $POLICY_FILE does not exist."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
sed -i 's/insecureAcceptAnything/reject/' "$POLICY_FILE"
|
||||||
|
|
||||||
|
|
||||||
# Exception for build-container-installer to allow the ISO generation script to work
|
|
||||||
# https://github.com/JasonN3/build-container-installer/issues/123
|
|
||||||
yq -i -o=j '.transports.docker |=
|
yq -i -o=j '.transports.docker |=
|
||||||
{"ghcr.io/jasonn3": [
|
{"ghcr.io/jasonn3": [
|
||||||
{
|
{
|
||||||
@@ -19,7 +24,7 @@ yq -i -o=j '.transports.docker |=
|
|||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
+ .' /usr/etc/containers/policy.json
|
+ .' "$POLICY_FILE"
|
||||||
|
|
||||||
yq -i -o=j '.transports.docker |=
|
yq -i -o=j '.transports.docker |=
|
||||||
{"ghcr.io/zelikos": [
|
{"ghcr.io/zelikos": [
|
||||||
@@ -32,4 +37,17 @@ yq -i -o=j '.transports.docker |=
|
|||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
+ .' /usr/etc/containers/policy.json
|
+ .' "$POLICY_FILE"
|
||||||
|
|
||||||
|
yq -i -o=j '.transports.docker |=
|
||||||
|
{"ghcr.io/wayblueorg": [
|
||||||
|
{
|
||||||
|
"type": "sigstoreSigned",
|
||||||
|
"keyPath": "/usr/etc/pki/containers/wayblue.pub",
|
||||||
|
"signedIdentity": {
|
||||||
|
"type": "matchRepository"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
+ .' "$POLICY_FILE"
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
|
|
||||||
# Tell build process to exit if there are any errors.
|
|
||||||
set -oue pipefail
|
|
||||||
|
|
||||||
sed -i 's/insecureAcceptAnything/reject/' /etc/containers/policy.json
|
|
||||||
|
|
||||||
|
|
||||||
# Exception for build-container-installer to allow the ISO generation script to work
|
|
||||||
# https://github.com/JasonN3/build-container-installer/issues/123
|
|
||||||
yq -i -o=j '.transports.docker |=
|
|
||||||
{"ghcr.io/jasonn3": [
|
|
||||||
{
|
|
||||||
"type": "sigstoreSigned",
|
|
||||||
"keyPath": "/etc/pki/containers/build-container-installer.pub",
|
|
||||||
"signedIdentity": {
|
|
||||||
"type": "matchRepository"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
+ .' /etc/containers/policy.json
|
|
||||||
|
|
||||||
yq -i -o=j '.transports.docker |=
|
|
||||||
{"ghcr.io/zelikos": [
|
|
||||||
{
|
|
||||||
"type": "sigstoreSigned",
|
|
||||||
"keyPath": "/etc/pki/containers/davincibox.pub",
|
|
||||||
"signedIdentity": {
|
|
||||||
"type": "matchRepository"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
+ .' /etc/containers/policy.json
|
|
||||||
8
files/scripts/installandroidudev.sh
Normal file
8
files/scripts/installandroidudev.sh
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Tell build process to exit if there are any errors.
|
||||||
|
set -oue pipefail
|
||||||
|
|
||||||
|
curl -Lo /etc/yum.repos.d/_copr_ublue-os_staging.repo https://copr.fedorainfracloud.org/coprs/ublue-os/staging/repo/fedora-"${OS_VERSION}"/ublue-os-staging-fedora-"${OS_VERSION}".repo
|
||||||
|
rpm-ostree install android-udev-rules
|
||||||
|
rm /etc/yum.repos.d/_copr_ublue-os_staging.repo
|
||||||
@@ -3,4 +3,4 @@
|
|||||||
# Tell build process to exit if there are any errors.
|
# Tell build process to exit if there are any errors.
|
||||||
set -oue pipefail
|
set -oue pipefail
|
||||||
|
|
||||||
rm /usr/share/xsessions/*
|
semodule --verbose --install /usr/share/selinux/packages/nvidia-container.pp
|
||||||
7
files/scripts/installrpmfusion.sh
Normal file
7
files/scripts/installrpmfusion.sh
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Tell build process to exit if there are any errors.
|
||||||
|
set -oue pipefail
|
||||||
|
|
||||||
|
rpm -q rpmfusion-free-release || rpm-ostree install https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-${OS_VERSION}.noarch.rpm
|
||||||
|
rpm -q rpmfusion-nonfree-release || rpm-ostree install https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-${OS_VERSION}.noarch.rpm
|
||||||
31
files/scripts/installsignedkernel.sh
Normal file
31
files/scripts/installsignedkernel.sh
Normal file
@@ -0,0 +1,31 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Tell build process to exit if there are any errors.
|
||||||
|
set -oue pipefail
|
||||||
|
|
||||||
|
find /tmp/rpms
|
||||||
|
|
||||||
|
rpm-ostree cliwrap install-to-root /
|
||||||
|
|
||||||
|
QUALIFIED_KERNEL="$(rpm -qa | grep -P 'kernel-(\d+\.\d+\.\d+)' | sed -E 's/kernel-//')"
|
||||||
|
INCOMING_KERNEL_VERSION="$(basename -s .rpm $(ls /tmp/rpms/kernel/kernel-[0-9]*.rpm 2>/dev/null | grep -P 'kernel-(\d+\.\d+\.\d+)' | sed -E 's/kernel-//'))"
|
||||||
|
|
||||||
|
echo "Qualified kernel: $QUALIFIED_KERNEL"
|
||||||
|
echo "Incoming kernel version: $INCOMING_KERNEL_VERSION"
|
||||||
|
|
||||||
|
|
||||||
|
if [[ "$INCOMING_KERNEL_VERSION" != "$QUALIFIED_KERNEL" ]]; then
|
||||||
|
echo "Installing kernel rpm from kernel-cache."
|
||||||
|
rpm-ostree override replace \
|
||||||
|
--experimental \
|
||||||
|
--install=zstd \
|
||||||
|
/tmp/rpms/kernel/kernel-[0-9]*.rpm \
|
||||||
|
/tmp/rpms/kernel/kernel-core-*.rpm \
|
||||||
|
/tmp/rpms/kernel/kernel-modules-*.rpm
|
||||||
|
else
|
||||||
|
echo "Installing kernel files from kernel-cache."
|
||||||
|
cd /tmp
|
||||||
|
rpm2cpio /tmp/rpms/kernel/kernel-core-*.rpm | cpio -idmv
|
||||||
|
cp ./lib/modules/*/vmlinuz /usr/lib/modules/*/vmlinuz
|
||||||
|
cd /
|
||||||
|
fi
|
||||||
11
files/scripts/regenerateinitramfs.sh
Normal file
11
files/scripts/regenerateinitramfs.sh
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Tell build process to exit if there are any errors.
|
||||||
|
set -oue pipefail
|
||||||
|
|
||||||
|
|
||||||
|
rpm-ostree cliwrap install-to-root /
|
||||||
|
|
||||||
|
QUALIFIED_KERNEL="$(rpm -qa | grep -P 'kernel-(\d+\.\d+\.\d+)' | sed -E 's/kernel-//')"
|
||||||
|
/usr/libexec/rpm-ostree/wrapped/dracut --no-hostonly --kver "$QUALIFIED_KERNEL" --reproducible -v --add ostree -f "/lib/modules/$QUALIFIED_KERNEL/initramfs.img"
|
||||||
|
chmod 0600 "/lib/modules/$QUALIFIED_KERNEL/initramfs.img"
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
|
|
||||||
# Tell build process to exit if there are any errors.
|
|
||||||
set -oue pipefail
|
|
||||||
|
|
||||||
rm /etc/skel/.config/autostart/bluefin-firstboot.desktop
|
|
||||||
rm /etc/profile.d/bluefin-firstboot.sh
|
|
||||||
10
files/scripts/removeunusedrepos.sh
Normal file
10
files/scripts/removeunusedrepos.sh
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Tell build process to exit if there are any errors.
|
||||||
|
set -oue pipefail
|
||||||
|
|
||||||
|
rm -f /etc/yum.repos.d/negativo17-fedora-nvidia.repo
|
||||||
|
rm -f /etc/yum.repos.d/negativo17-fedora-multimedia.repo
|
||||||
|
rm -f /etc/yum.repos.d/eyecantcu-supergfxctl.repo
|
||||||
|
rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo
|
||||||
|
rm -f /etc/yum.repos.d/nvidia-container-toolkit.repo
|
||||||
16
files/scripts/setdrmvariables.sh
Normal file
16
files/scripts/setdrmvariables.sh
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Tell build process to exit if there are any errors.
|
||||||
|
set -oue pipefail
|
||||||
|
|
||||||
|
|
||||||
|
echo '
|
||||||
|
|
||||||
|
# Nvidia modesetting support. Set to 0 or comment to disable kernel modesetting
|
||||||
|
# support. This must be disabled in case of SLI Mosaic.
|
||||||
|
|
||||||
|
options nvidia-drm modeset=1 fbdev=1
|
||||||
|
|
||||||
|
' > /usr/lib/modprobe.d/nvidia-modeset.conf
|
||||||
|
|
||||||
|
cp /usr/lib/modprobe.d/nvidia-modeset.conf /etc/modprobe.d/nvidia-modeset.conf
|
||||||
7
files/scripts/setearlyloading.sh
Normal file
7
files/scripts/setearlyloading.sh
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Tell build process to exit if there are any errors.
|
||||||
|
set -oue pipefail
|
||||||
|
|
||||||
|
sed -i 's@omit_drivers@force_drivers@g' /usr/lib/dracut/dracut.conf.d/99-nvidia-dracut.conf
|
||||||
|
sed -i 's@ nvidia @ i915 amdgpu nvidia @g' /usr/lib/dracut/dracut.conf.d/99-nvidia-dracut.conf
|
||||||
38
files/scripts/setswaynvidiaenvironment.sh
Normal file
38
files/scripts/setswaynvidiaenvironment.sh
Normal file
@@ -0,0 +1,38 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Tell build process to exit if there are any errors.
|
||||||
|
set -oue pipefail
|
||||||
|
|
||||||
|
rm /etc/sway/environment
|
||||||
|
|
||||||
|
echo '
|
||||||
|
|
||||||
|
# This file is a part of Fedora configuration for Sway and will be sourced
|
||||||
|
# from /usr/bin/start-sway script for all users of the system.
|
||||||
|
# User-specific variables should be placed in $XDG_CONFIG_HOME/sway/environment
|
||||||
|
#
|
||||||
|
# vim: set ft=sh:
|
||||||
|
|
||||||
|
## Pass extra arguments to the /usr/bin/sway executable
|
||||||
|
|
||||||
|
#SWAY_EXTRA_ARGS="$SWAY_EXTRA_ARGS --unsupported-gpu"
|
||||||
|
SWAY_EXTRA_ARGS="$SWAY_EXTRA_ARGS --unsupported-gpu -D noscanout"
|
||||||
|
#SWAY_EXTRA_ARGS="$SWAY_EXTRA_ARGS --debug"
|
||||||
|
|
||||||
|
## Set environment variables
|
||||||
|
|
||||||
|
# Useful variables for wlroots:
|
||||||
|
# https://gitlab.freedesktop.org/wlroots/wlroots/-/blob/master/docs/env_vars.md
|
||||||
|
WLR_NO_HARDWARE_CURSORS=1
|
||||||
|
# Setting renderer to Vulkan may fix flickering but needs the following extensions:
|
||||||
|
# - VK_EXT_image_drm_format_modifier
|
||||||
|
# - VK_EXT_physical_device_drm
|
||||||
|
#
|
||||||
|
# Source: https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/8e346922508aa3eaccd6e12f2917f6574f349843
|
||||||
|
WLR_RENDERER=vulkan
|
||||||
|
|
||||||
|
# Java Application compatibility
|
||||||
|
# Source: https://github.com/swaywm/wlroots/issues/1464
|
||||||
|
_JAVA_AWT_WM_NONREPARENTING=1
|
||||||
|
|
||||||
|
' > /etc/sway/environment
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
{
|
|
||||||
"window.titleBarStyle": "custom",
|
|
||||||
"editor.fontFamily": "'Cascadia Code', 'Droid Sans Mono', 'monospace', monospace",
|
|
||||||
"telemetry.telemetryLevel": "off",
|
|
||||||
"gitlens.telemetry.enabled": false
|
|
||||||
}
|
|
||||||
3
files/system/etc/containers/registries.d/wayblue.yaml
Normal file
3
files/system/etc/containers/registries.d/wayblue.yaml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
docker:
|
||||||
|
ghcr.io/wayblueorg:
|
||||||
|
use-sigstore-attachments: true
|
||||||
4
files/system/etc/pki/containers/wayblue.pub
Normal file
4
files/system/etc/pki/containers/wayblue.pub
Normal file
@@ -0,0 +1,4 @@
|
|||||||
|
-----BEGIN PUBLIC KEY-----
|
||||||
|
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE0HrfZIuVnc6fK0LjNHotudA7ym+c
|
||||||
|
xTbDVrZb1Y1SXsdbNOsVcCojMRylp9+IE0p/YSsfuGFF64juRx7ZoJ9PpA==
|
||||||
|
-----END PUBLIC KEY-----
|
||||||
@@ -23,6 +23,7 @@ set-kargs-hardening:
|
|||||||
--append-if-missing="spec_store_bypass_disable=on" \
|
--append-if-missing="spec_store_bypass_disable=on" \
|
||||||
--append-if-missing="l1d_flush=on" \
|
--append-if-missing="l1d_flush=on" \
|
||||||
--append-if-missing="gather_data_sampling=force"
|
--append-if-missing="gather_data_sampling=force"
|
||||||
|
--append-if-missing="ia32_emulation=0"
|
||||||
echo "Hardening kargs set."
|
echo "Hardening kargs set."
|
||||||
|
|
||||||
# Add additional (unstable) boot parameters for hardening (requires reboot)
|
# Add additional (unstable) boot parameters for hardening (requires reboot)
|
||||||
|
|||||||
@@ -1,23 +0,0 @@
|
|||||||
name: aurora-asus-nvidia-userns-hardened
|
|
||||||
|
|
||||||
description: "Aurora asus nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-asus-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: aurora-asus-nvidia-hardened
|
|
||||||
|
|
||||||
description: "Aurora asus nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-asus-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/disableuserns-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/disableuserns-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
name: aurora-asus-userns-hardened
|
|
||||||
|
|
||||||
description: "Aurora asus with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-asus
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: aurora-asus-hardened
|
|
||||||
|
|
||||||
description: "Aurora asus with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-asus
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/disableuserns-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/disableuserns-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: aurora-dx-asus-nvidia-userns-hardened
|
|
||||||
|
|
||||||
description: "Aurora asus dx nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-dx-asus-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/dx-packages.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/dx-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: aurora-dx-asus-userns-hardened
|
|
||||||
|
|
||||||
description: "Aurora asus dx with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-dx-asus
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/dx-packages.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/dx-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
name: kinoite-asus-nvidia-userns-hardened
|
|
||||||
|
|
||||||
description: "Kinoite asus nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/kinoite-asus-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/remove-firefox.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
name: kinoite-asus-nvidia-hardened
|
|
||||||
|
|
||||||
description: "Kinoite asus nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/kinoite-asus-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/disableuserns-packages.yml
|
|
||||||
- from-file: common/remove-firefox.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/disableuserns-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
name: kinoite-asus-userns-hardened
|
|
||||||
|
|
||||||
description: "Kinoite asus with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/kinoite-asus
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
# module configuration, executed in order
|
|
||||||
# you can include multiple instances of the same module
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/remove-firefox.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,26 +0,0 @@
|
|||||||
name: kinoite-asus-hardened
|
|
||||||
|
|
||||||
description: "Kinoite asus with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/kinoite-asus
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
# module configuration, executed in order
|
|
||||||
# you can include multiple instances of the same module
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/disableuserns-packages.yml
|
|
||||||
- from-file: common/remove-firefox.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/disableuserns-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
name: silverblue-asus-nvidia-userns-hardened
|
|
||||||
|
|
||||||
description: "Silverblue asus nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/silverblue-asus-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/gnome-packages.yml
|
|
||||||
- from-file: common/disable-gnome-extensions.yml
|
|
||||||
- from-file: common/silverblue-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/remove-firefox.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: silverblue-asus-nvidia-hardened
|
|
||||||
|
|
||||||
description: "Silverblue asus nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/silverblue-asus-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/gnome-packages.yml
|
|
||||||
- from-file: common/disable-gnome-extensions.yml
|
|
||||||
- from-file: common/silverblue-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/disableuserns-packages.yml
|
|
||||||
- from-file: common/remove-firefox.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/disableuserns-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: silverblue-asus-userns-hardened
|
|
||||||
|
|
||||||
description: "Silverblue asus with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/silverblue-asus
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
# module configuration, executed in order
|
|
||||||
# you can include multiple instances of the same module
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/gnome-packages.yml
|
|
||||||
- from-file: common/disable-gnome-extensions.yml
|
|
||||||
- from-file: common/silverblue-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/remove-firefox.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
name: silverblue-asus-hardened
|
|
||||||
|
|
||||||
description: "Silverblue asus with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/silverblue-asus
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
# module configuration, executed in order
|
|
||||||
# you can include multiple instances of the same module
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/gnome-packages.yml
|
|
||||||
- from-file: common/disable-gnome-extensions.yml
|
|
||||||
- from-file: common/silverblue-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/disableuserns-packages.yml
|
|
||||||
- from-file: common/remove-firefox.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/disableuserns-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
type: rpm-ostree
|
|
||||||
remove:
|
|
||||||
- samba-common-tools
|
|
||||||
- samba-dcerpc
|
|
||||||
- samba-ldb-ldap-modules
|
|
||||||
- samba-winbind
|
|
||||||
- samba-winbind-clients
|
|
||||||
- samba-winbind-modules
|
|
||||||
- samba
|
|
||||||
- samba-usershares
|
|
||||||
remove:
|
|
||||||
- ifuse
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
type: rpm-ostree
|
|
||||||
remove:
|
|
||||||
- gnome-shell-extension-gsconnect
|
|
||||||
- nautilus-gsconnect
|
|
||||||
- samba-common-tools
|
|
||||||
- samba-dcerpc
|
|
||||||
- samba-ldb-ldap-modules
|
|
||||||
- samba-winbind
|
|
||||||
- samba-winbind-clients
|
|
||||||
- samba-winbind-modules
|
|
||||||
- samba
|
|
||||||
remove:
|
|
||||||
- ifuse
|
|
||||||
- fuse-encfs
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
type: script
|
|
||||||
scripts:
|
|
||||||
- disabletailscale.sh
|
|
||||||
- removebluefinfirstboot.sh
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
type: script
|
|
||||||
scripts:
|
|
||||||
- removecinnamonxsessions.sh
|
|
||||||
@@ -1,2 +0,0 @@
|
|||||||
type: brew
|
|
||||||
brew-analytics: false
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
type: files
|
|
||||||
files:
|
|
||||||
- source: system/usr
|
|
||||||
destination: /usr
|
|
||||||
- source: system/etc
|
|
||||||
destination: /etc
|
|
||||||
31
recipes/common/common-modules.yml
Normal file
31
recipes/common/common-modules.yml
Normal file
@@ -0,0 +1,31 @@
|
|||||||
|
modules:
|
||||||
|
- type: script
|
||||||
|
scripts:
|
||||||
|
- createautostartdir.sh
|
||||||
|
- type: containerfile
|
||||||
|
snippets:
|
||||||
|
- RUN rpm-ostree install just powerstat
|
||||||
|
- COPY --from=ghcr.io/ublue-os/config:latest /rpms/ublue-os-udev-rules.noarch.rpm /
|
||||||
|
- COPY --from=ghcr.io/ublue-os/config:latest /rpms/ublue-os-update-services.noarch.rpm /
|
||||||
|
- COPY --from=ghcr.io/ublue-os/config:latest /rpms/ublue-os-signing.noarch.rpm /
|
||||||
|
- COPY --from=ghcr.io/ublue-os/config:latest /rpms/ublue-os-luks.noarch.rpm /
|
||||||
|
- COPY --from=ghcr.io/ublue-os/config:latest /rpms/ublue-os-just.noarch.rpm /
|
||||||
|
- RUN rpm -q ublue-os-udev-rules || rpm -ivh /ublue-os-udev-rules.noarch.rpm
|
||||||
|
- RUN rpm -q ublue-os-update-services || rpm -ivh /ublue-os-update-services.noarch.rpm
|
||||||
|
- RUN rpm -q ublue-os-signing || rpm -ivh /ublue-os-signing.noarch.rpm
|
||||||
|
- RUN rpm -q ublue-os-luks || rpm -ivh /ublue-os-luks.noarch.rpm
|
||||||
|
- RUN rpm -q ublue-os-just || rpm -ivh /ublue-os-just.noarch.rpm
|
||||||
|
- type: script
|
||||||
|
scripts:
|
||||||
|
- installrpmfusion.sh
|
||||||
|
- from-file: common/common-packages.yml
|
||||||
|
- type: files
|
||||||
|
files:
|
||||||
|
- source: system/usr
|
||||||
|
destination: /usr
|
||||||
|
- source: system/etc
|
||||||
|
destination: /etc
|
||||||
|
- from-file: common/common-scripts.yml
|
||||||
|
- type: brew
|
||||||
|
brew-analytics: false
|
||||||
|
- type: secureblue-signing
|
||||||
@@ -3,7 +3,10 @@ repos:
|
|||||||
- https://copr.fedorainfracloud.org/coprs/secureblue/hardened_malloc/repo/fedora-%OS_VERSION%/secureblue-hardened_malloc-fedora-%OS_VERSION%.repo
|
- https://copr.fedorainfracloud.org/coprs/secureblue/hardened_malloc/repo/fedora-%OS_VERSION%/secureblue-hardened_malloc-fedora-%OS_VERSION%.repo
|
||||||
install:
|
install:
|
||||||
- hardened_malloc
|
- hardened_malloc
|
||||||
# needed for some scripts
|
|
||||||
- patch
|
|
||||||
# missing upstream
|
# missing upstream
|
||||||
- rar
|
- openssl
|
||||||
|
- just
|
||||||
|
- patch
|
||||||
|
- p7zip
|
||||||
|
- unrar
|
||||||
|
|||||||
@@ -9,3 +9,4 @@ scripts:
|
|||||||
- disablegeoclue.sh
|
- disablegeoclue.sh
|
||||||
- addjustconfig.sh
|
- addjustconfig.sh
|
||||||
- addbrewjustimport.sh
|
- addbrewjustimport.sh
|
||||||
|
- hardencontainerpolicy.sh
|
||||||
|
|||||||
9
recipes/common/cosmic-modules.yml
Normal file
9
recipes/common/cosmic-modules.yml
Normal file
@@ -0,0 +1,9 @@
|
|||||||
|
modules:
|
||||||
|
- type: rpm-ostree
|
||||||
|
install:
|
||||||
|
- NetworkManager-tui
|
||||||
|
- NetworkManager-openvpn
|
||||||
|
- type: systemd
|
||||||
|
system:
|
||||||
|
enabled:
|
||||||
|
- cosmic-greeter
|
||||||
15
recipes/common/desktop-modules.yml
Normal file
15
recipes/common/desktop-modules.yml
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
modules:
|
||||||
|
- type: containerfile
|
||||||
|
snippets:
|
||||||
|
- COPY --from=ghcr.io/ublue-os/akmods:main-40 /rpms /tmp/rpms
|
||||||
|
- RUN find /tmp/rpms
|
||||||
|
- RUN rpm -q ublue-os-akmods-addons || rpm-ostree install /tmp/rpms/ublue-os/ublue-os-akmods-addons*.rpm
|
||||||
|
- type: containerfile
|
||||||
|
snippets:
|
||||||
|
- COPY --from=ghcr.io/ublue-os/main-kernel:40 /tmp/rpms /tmp/rpms/kernel
|
||||||
|
- type: script
|
||||||
|
scripts:
|
||||||
|
- installsignedkernel.sh
|
||||||
|
- from-file: common/desktop-packages.yml
|
||||||
|
- from-file: common/desktop-scripts.yml
|
||||||
|
- type: yafti
|
||||||
@@ -12,7 +12,19 @@ install:
|
|||||||
- usbguard
|
- usbguard
|
||||||
- setroubleshoot
|
- setroubleshoot
|
||||||
- setools
|
- setools
|
||||||
|
- fscrypt
|
||||||
|
- heif-pixbuf-loader
|
||||||
|
- vim
|
||||||
|
- alsa-firmware
|
||||||
|
|
||||||
|
# yubikey enablement
|
||||||
|
- pam-u2f
|
||||||
|
- pam_yubico
|
||||||
|
- pamu2fcfg
|
||||||
|
- yubikey-manager
|
||||||
remove:
|
remove:
|
||||||
|
- firefox
|
||||||
|
- firefox-langpacks
|
||||||
- fuse
|
- fuse
|
||||||
- fedora-chromium-config
|
- fedora-chromium-config
|
||||||
- fedora-flathub-remote
|
- fedora-flathub-remote
|
||||||
@@ -1,5 +1,6 @@
|
|||||||
type: script
|
type: script
|
||||||
scripts:
|
scripts:
|
||||||
|
- installandroidudev.sh
|
||||||
- disablecups.sh
|
- disablecups.sh
|
||||||
- disablesshd.sh
|
- disablesshd.sh
|
||||||
- disableavahidaemon.sh
|
- disableavahidaemon.sh
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
type: gschema-overrides
|
|
||||||
include:
|
|
||||||
- zz1-secureblue.gschema.override
|
|
||||||
7
recipes/common/disableuserns-modules.yml
Normal file
7
recipes/common/disableuserns-modules.yml
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
modules:
|
||||||
|
- type: rpm-ostree
|
||||||
|
remove:
|
||||||
|
- toolbox
|
||||||
|
- type: script
|
||||||
|
scripts:
|
||||||
|
- disableuserns.sh
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
type: rpm-ostree
|
|
||||||
remove:
|
|
||||||
- toolbox
|
|
||||||
- distrobox
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
type: script
|
|
||||||
scripts:
|
|
||||||
- disableuserns.sh
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
type: files
|
|
||||||
files:
|
|
||||||
- source: system/dx
|
|
||||||
destination: /
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
type: rpm-ostree
|
|
||||||
remove:
|
|
||||||
- zfs-fuse
|
|
||||||
- libvirt-daemon-driver-storage-zfs
|
|
||||||
- libvirt-daemon-kvm
|
|
||||||
- libvirt-daemon-driver-storage
|
|
||||||
- libvirt
|
|
||||||
- libvirt-nss
|
|
||||||
- libguestfs
|
|
||||||
- libguestfs-xfs
|
|
||||||
- guestfs-tools
|
|
||||||
- virt-v2v
|
|
||||||
5
recipes/common/final-modules.yml
Normal file
5
recipes/common/final-modules.yml
Normal file
@@ -0,0 +1,5 @@
|
|||||||
|
modules:
|
||||||
|
- type: script
|
||||||
|
scripts:
|
||||||
|
- removeunusedrepos.sh
|
||||||
|
- regenerateinitramfs.sh
|
||||||
@@ -1,17 +0,0 @@
|
|||||||
type: rpm-ostree
|
|
||||||
install:
|
|
||||||
- firewall-config
|
|
||||||
- gnome-disk-utility
|
|
||||||
remove:
|
|
||||||
- yelp
|
|
||||||
- gnome-user-share
|
|
||||||
- mod_lua
|
|
||||||
- httpd
|
|
||||||
- httpd-core
|
|
||||||
- mod_http2
|
|
||||||
- mod_dnssd
|
|
||||||
- gnome-remote-desktop
|
|
||||||
- libvncserver
|
|
||||||
- malcontent-ui-libs
|
|
||||||
- malcontent-control
|
|
||||||
- fedora-chromium-config-gnome
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
type: script
|
|
||||||
scripts:
|
|
||||||
- createautostartdir.sh
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
type: files
|
|
||||||
files:
|
|
||||||
- source: system/kinoite
|
|
||||||
destination: /
|
|
||||||
12
recipes/common/kinoite-modules.yml
Normal file
12
recipes/common/kinoite-modules.yml
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
modules:
|
||||||
|
- type: rpm-ostree
|
||||||
|
remove:
|
||||||
|
- kde-connect
|
||||||
|
- kde-connect-libs
|
||||||
|
- kdeconnectd
|
||||||
|
- fedora-chromium-config-kde
|
||||||
|
- fuse-encfs
|
||||||
|
- type: files
|
||||||
|
files:
|
||||||
|
- source: system/kinoite
|
||||||
|
destination: /
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
type: rpm-ostree
|
|
||||||
remove:
|
|
||||||
- kde-connect
|
|
||||||
- kde-connect-libs
|
|
||||||
- kdeconnectd
|
|
||||||
- fedora-chromium-config-kde
|
|
||||||
- fuse-encfs
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
type: script
|
|
||||||
scripts:
|
|
||||||
- hardencontainerpolicy.sh
|
|
||||||
13
recipes/common/nvidia-modules.yml
Normal file
13
recipes/common/nvidia-modules.yml
Normal file
@@ -0,0 +1,13 @@
|
|||||||
|
modules:
|
||||||
|
- type: containerfile
|
||||||
|
snippets:
|
||||||
|
- COPY --from=ghcr.io/ublue-os/akmods-nvidia:main-40 /rpms /tmp/rpms
|
||||||
|
- RUN find /tmp/rpms
|
||||||
|
- RUN rpm-ostree install /tmp/rpms/ublue-os/ublue-os-nvidia*.rpm
|
||||||
|
- RUN sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/nvidia-container-toolkit.repo
|
||||||
|
- RUN rpm-ostree install /tmp/rpms/kmods/kmod-nvidia*.rpm nvidia-container-toolkit xorg-x11-drv-nvidia xorg-x11-drv-nvidia-cuda nvidia-vaapi-driver
|
||||||
|
- type: script
|
||||||
|
scripts:
|
||||||
|
- installnvidiatoolkitpolicy.sh
|
||||||
|
- setearlyloading.sh
|
||||||
|
- setdrmvariables.sh
|
||||||
13
recipes/common/nvidia-open-modules.yml
Normal file
13
recipes/common/nvidia-open-modules.yml
Normal file
@@ -0,0 +1,13 @@
|
|||||||
|
modules:
|
||||||
|
- type: containerfile
|
||||||
|
snippets:
|
||||||
|
- COPY --from=ghcr.io/ublue-os/akmods-nvidia-open:main-40 /rpms /tmp/rpms
|
||||||
|
- RUN find /tmp/rpms
|
||||||
|
- RUN rpm-ostree install /tmp/rpms/ublue-os/ublue-os-nvidia*.rpm
|
||||||
|
- RUN sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/nvidia-container-toolkit.repo
|
||||||
|
- RUN rpm-ostree install /tmp/rpms/kmods/kmod-nvidia*.rpm nvidia-container-toolkit xorg-x11-drv-nvidia xorg-x11-drv-nvidia-cuda nvidia-vaapi-driver
|
||||||
|
- type: script
|
||||||
|
scripts:
|
||||||
|
- installnvidiatoolkitpolicy.sh
|
||||||
|
- setearlyloading.sh
|
||||||
|
- setdrmvariables.sh
|
||||||
13
recipes/common/nvidia-open-server-modules.yml
Normal file
13
recipes/common/nvidia-open-server-modules.yml
Normal file
@@ -0,0 +1,13 @@
|
|||||||
|
modules:
|
||||||
|
- type: containerfile
|
||||||
|
snippets:
|
||||||
|
- COPY --from=ghcr.io/ublue-os/akmods-nvidia-open:coreos-testing-40 /rpms /tmp/rpms
|
||||||
|
- RUN find /tmp/rpms
|
||||||
|
- RUN rpm-ostree install /tmp/rpms/ucore/ublue-os-ucore-nvidia*.rpm
|
||||||
|
- RUN sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/nvidia-container-toolkit.repo
|
||||||
|
- RUN rpm-ostree install /tmp/rpms/kmods/kmod-nvidia*.rpm nvidia-container-toolkit
|
||||||
|
- type: script
|
||||||
|
scripts:
|
||||||
|
- installnvidiatoolkitpolicy.sh
|
||||||
|
- setearlyloading.sh
|
||||||
|
- setdrmvariables.sh
|
||||||
13
recipes/common/nvidia-server-modules.yml
Normal file
13
recipes/common/nvidia-server-modules.yml
Normal file
@@ -0,0 +1,13 @@
|
|||||||
|
modules:
|
||||||
|
- type: containerfile
|
||||||
|
snippets:
|
||||||
|
- COPY --from=ghcr.io/ublue-os/akmods-nvidia:coreos-testing-40 /rpms /tmp/rpms
|
||||||
|
- RUN find /tmp/rpms
|
||||||
|
- RUN rpm-ostree install /tmp/rpms/ucore/ublue-os-ucore-nvidia*.rpm
|
||||||
|
- RUN sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/nvidia-container-toolkit.repo
|
||||||
|
- RUN rpm-ostree install /tmp/rpms/kmods/kmod-nvidia*.rpm nvidia-container-toolkit
|
||||||
|
- type: script
|
||||||
|
scripts:
|
||||||
|
- installnvidiatoolkitpolicy.sh
|
||||||
|
- setearlyloading.sh
|
||||||
|
- setdrmvariables.sh
|
||||||
28
recipes/common/proprietary-packages.yml
Normal file
28
recipes/common/proprietary-packages.yml
Normal file
@@ -0,0 +1,28 @@
|
|||||||
|
type: rpm-ostree
|
||||||
|
install:
|
||||||
|
- libheif-freeworld
|
||||||
|
- libheif-tools
|
||||||
|
- intel-media-driver
|
||||||
|
- gstreamer1-plugin-libav
|
||||||
|
- gstreamer1-plugins-bad-free-extras
|
||||||
|
- gstreamer1-plugins-bad-freeworld
|
||||||
|
- gstreamer1-plugins-ugly
|
||||||
|
- gstreamer1-vaapi
|
||||||
|
- ffmpeg
|
||||||
|
- ffmpeg-libs
|
||||||
|
- ffmpegthumbnailer
|
||||||
|
- pipewire-codec-aptx
|
||||||
|
- mesa-va-drivers-freeworld
|
||||||
|
- fdk-aac
|
||||||
|
remove:
|
||||||
|
- fdk-aac-free
|
||||||
|
- mesa-va-drivers
|
||||||
|
- ffmpeg-free
|
||||||
|
- libavcodec-free
|
||||||
|
- libavdevice-free
|
||||||
|
- libavfilter-free
|
||||||
|
- libavformat-free
|
||||||
|
- libavutil-free
|
||||||
|
- libpostproc-free
|
||||||
|
- libswresample-free
|
||||||
|
- libswscale-free
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
type: script
|
|
||||||
scripts:
|
|
||||||
- hardenrechunkedcontainerpolicy.sh
|
|
||||||
- usehardenedmalloclight.sh
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
type: rpm-ostree
|
|
||||||
remove:
|
|
||||||
- firefox
|
|
||||||
- firefox-langpacks
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
type: files
|
|
||||||
files:
|
|
||||||
- source: system/server
|
|
||||||
destination: /
|
|
||||||
29
recipes/common/server-modules.yml
Normal file
29
recipes/common/server-modules.yml
Normal file
@@ -0,0 +1,29 @@
|
|||||||
|
modules:
|
||||||
|
- type: containerfile
|
||||||
|
snippets:
|
||||||
|
- COPY --from=ghcr.io/ublue-os/akmods:coreos-testing-40 /rpms /tmp/rpms
|
||||||
|
- RUN find /tmp/rpms
|
||||||
|
- RUN rpm-ostree install /tmp/rpms/ucore/ublue-os-ucore-addons*.rpm
|
||||||
|
- type: containerfile
|
||||||
|
snippets:
|
||||||
|
- COPY --from=ghcr.io/ublue-os/coreos-testing-kernel:40 /tmp/rpms /tmp/rpms/kernel
|
||||||
|
- type: script
|
||||||
|
scripts:
|
||||||
|
- installsignedkernel.sh
|
||||||
|
- type: rpm-ostree
|
||||||
|
install:
|
||||||
|
- setools-console
|
||||||
|
- usbguard
|
||||||
|
- firewalld
|
||||||
|
- policycoreutils-python-utils
|
||||||
|
|
||||||
|
- type: files
|
||||||
|
files:
|
||||||
|
- source: system/server
|
||||||
|
destination: /
|
||||||
|
- type: script
|
||||||
|
scripts:
|
||||||
|
- addtailscalerepo.sh
|
||||||
|
- type: script
|
||||||
|
scripts:
|
||||||
|
- excludepcsc.sh
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
type: rpm-ostree
|
|
||||||
install:
|
|
||||||
- setools-console
|
|
||||||
- usbguard
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
25
recipes/common/silverblue-modules.yml
Normal file
25
recipes/common/silverblue-modules.yml
Normal file
@@ -0,0 +1,25 @@
|
|||||||
|
modules:
|
||||||
|
- type: rpm-ostree
|
||||||
|
install:
|
||||||
|
- firewall-config
|
||||||
|
- gnome-disk-utility
|
||||||
|
- adw-gtk3-theme
|
||||||
|
- gnome-epub-thumbnailer
|
||||||
|
- gnome-tweaks
|
||||||
|
remove:
|
||||||
|
- gnome-tour
|
||||||
|
- yelp
|
||||||
|
- gnome-user-share
|
||||||
|
- mod_lua
|
||||||
|
- httpd
|
||||||
|
- httpd-core
|
||||||
|
- mod_http2
|
||||||
|
- mod_dnssd
|
||||||
|
- gnome-remote-desktop
|
||||||
|
- libvncserver
|
||||||
|
- malcontent-ui-libs
|
||||||
|
- malcontent-control
|
||||||
|
- fedora-chromium-config-gnome
|
||||||
|
- type: gschema-overrides
|
||||||
|
include:
|
||||||
|
- zz1-secureblue.gschema.override
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
type: rpm-ostree
|
|
||||||
remove:
|
|
||||||
- gnome-tour
|
|
||||||
3
recipes/common/userns-packages.yml
Normal file
3
recipes/common/userns-packages.yml
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
type: rpm-ostree
|
||||||
|
install:
|
||||||
|
- distrobox
|
||||||
9
recipes/common/zfs-modules.yml
Normal file
9
recipes/common/zfs-modules.yml
Normal file
@@ -0,0 +1,9 @@
|
|||||||
|
modules:
|
||||||
|
- type: containerfile
|
||||||
|
snippets:
|
||||||
|
- COPY --from=ghcr.io/ublue-os/akmods-zfs:coreos-testing-40 /rpms /tmp/rpms
|
||||||
|
- RUN find /tmp/rpms
|
||||||
|
- RUN rpm-ostree install pv /tmp/rpms/kmods/zfs/*.rpm /tmp/rpms/kmods/zfs/other/zfs-dracut-*.rpm
|
||||||
|
- type: script
|
||||||
|
scripts:
|
||||||
|
- excludezfs.sh
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: aurora-dx-main-userns-hardened
|
|
||||||
|
|
||||||
description: "Aurora-dx main with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-dx
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/dx-packages.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/dx-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: aurora-dx-nvidia-userns-hardened
|
|
||||||
|
|
||||||
description: "Aurora-dx nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-dx-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/dx-packages.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/dx-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: aurora-dx-surface-nvidia-userns-hardened
|
|
||||||
|
|
||||||
description: "Aurora-dx surface nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-dx-surface-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/dx-packages.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/dx-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: aurora-dx-surface-userns-hardened
|
|
||||||
|
|
||||||
description: "Aurora-dx surface with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-dx-surface
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/dx-packages.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/dx-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
name: aurora-main-userns-hardened
|
|
||||||
|
|
||||||
description: "Aurora main with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: aurora-main-hardened
|
|
||||||
|
|
||||||
description: "Aurora main with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/disableuserns-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/disableuserns-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
name: aurora-nvidia-userns-hardened
|
|
||||||
|
|
||||||
description: "Aurora nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: aurora-nvidia-hardened
|
|
||||||
|
|
||||||
description: "Aurora nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/disableuserns-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/disableuserns-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
name: aurora-surface-nvidia-userns-hardened
|
|
||||||
|
|
||||||
description: "Aurora surface nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-surface-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: aurora-surface-nvidia-hardened
|
|
||||||
|
|
||||||
description: "Aurora surface nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-surface-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/disableuserns-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/disableuserns-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
name: aurora-surface-userns-hardened
|
|
||||||
|
|
||||||
description: "Aurora surface with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-surface
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: aurora-surface-hardened
|
|
||||||
|
|
||||||
description: "Aurora surface with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/aurora-surface
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/kinoite-packages.yml
|
|
||||||
- from-file: common/aurora-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/disableuserns-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/kinoite-files.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/disableuserns-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: bluefin-dx-main-userns-hardened
|
|
||||||
|
|
||||||
description: "Bluefin-dx main with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/bluefin-dx
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/dx-packages.yml
|
|
||||||
- from-file: common/gnome-packages.yml
|
|
||||||
- from-file: common/disable-gnome-extensions.yml
|
|
||||||
- from-file: common/bluefin-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/dx-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: bluefin-dx-nvidia-userns-hardened
|
|
||||||
|
|
||||||
description: "Bluefin-dx nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/bluefin-dx-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/dx-packages.yml
|
|
||||||
- from-file: common/gnome-packages.yml
|
|
||||||
- from-file: common/disable-gnome-extensions.yml
|
|
||||||
- from-file: common/bluefin-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/dx-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
name: bluefin-main-userns-hardened
|
|
||||||
|
|
||||||
description: "Bluefin main with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/bluefin
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/gnome-packages.yml
|
|
||||||
- from-file: common/disable-gnome-extensions.yml
|
|
||||||
- from-file: common/bluefin-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: bluefin-main-hardened
|
|
||||||
|
|
||||||
description: "Bluefin main with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/bluefin
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/gnome-packages.yml
|
|
||||||
- from-file: common/disable-gnome-extensions.yml
|
|
||||||
- from-file: common/bluefin-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/disableuserns-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/disableuserns-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
name: bluefin-nvidia-userns-hardened
|
|
||||||
|
|
||||||
description: "Bluefin nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/bluefin-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/gnome-packages.yml
|
|
||||||
- from-file: common/disable-gnome-extensions.yml
|
|
||||||
- from-file: common/bluefin-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
name: bluefin-nvidia-hardened
|
|
||||||
|
|
||||||
description: "Bluefin nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/ublue-os/bluefin-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/gnome-packages.yml
|
|
||||||
- from-file: common/disable-gnome-extensions.yml
|
|
||||||
- from-file: common/bluefin-packages.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/disableuserns-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/bluefin-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/disableuserns-scripts.yml
|
|
||||||
- from-file: common/rechunked-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,20 +0,0 @@
|
|||||||
name: cinnamon-main-userns-hardened
|
|
||||||
|
|
||||||
description: "Cinnamon main with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/legacy-images/cinnamon-main
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/cinnamon-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
name: cinnamon-main-hardened
|
|
||||||
|
|
||||||
description: "Cinnamon main with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/legacy-images/cinnamon-main
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/disableuserns-packages.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/cinnamon-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- from-file: common/disableuserns-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
@@ -1,20 +0,0 @@
|
|||||||
name: cinnamon-nvidia-userns-hardened
|
|
||||||
|
|
||||||
description: "Cinnamon nvidia with some hardening applied"
|
|
||||||
|
|
||||||
base-image: ghcr.io/legacy-images/cinnamon-nvidia
|
|
||||||
|
|
||||||
image-version: 40
|
|
||||||
|
|
||||||
modules:
|
|
||||||
- from-file: common/initialization-scripts.yml
|
|
||||||
- from-file: common/gui-packages.yml
|
|
||||||
- from-file: common/common-packages.yml
|
|
||||||
- from-file: common/non-rechunked-scripts.yml
|
|
||||||
- from-file: common/gui-scripts.yml
|
|
||||||
- from-file: common/cinnamon-scripts.yml
|
|
||||||
- from-file: common/common-files.yml
|
|
||||||
- from-file: common/common-scripts.yml
|
|
||||||
- type: secureblue-signing
|
|
||||||
- type: yafti
|
|
||||||
- from-file: common/common-brew.yml
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user