commit b3b3f60ec6fbf40d28dfe51af4717a0a5b32d76e Author: Louis Abel Date: Wed Feb 14 16:11:24 2024 -0700 add initial rocky 10 kickstarts diff --git a/README.md b/README.md new file mode 100644 index 0000000..e5841d4 --- /dev/null +++ b/README.md @@ -0,0 +1,79 @@ +# R9 specific kickstarts + +This branch has Rocky Linux 10 specific kickstarts. These kickstarts vary +between cloud images and live images provided in our repositories and +mirrors. + +## Structure + +In the root of the repository are the general kickstarts in use that any +user can pick up, use, or modify to their liking to make their own Rocky +Linux live images, cloud images, and so on. These kickstarts are generated +by templates that live in the various directories in this repository. + +* `cloud` -> Cloud image templates +* `live` -> Live image templates +* `container` -> Container image templates + +These kickstarts are generated using `ksflatten`. Changes made to the +kickstarts generally match between the templates and the full kickstarts +in the root. + +For SIG/Core's usage, we use the `live` area as a "working" directory, +where we use the split parts in our automation for the images and the +pre-flattened versions are there for the convenience of all users. This +is easier than using the pre-made ones in empanadas. + +## Building Live Images + +To build live images, you will need to use `livecd-creator` or +`livemedia-creator`. The former is simpler to use and generally works without +many issues. The latter can be a bit more tricky to work with and typically +runs the installer virtually. However, it can be used without a virtual machine +like in a mock shell. + +Optionally, it is possible to use `empanadas` found in the SIG/Core toolkit. + +### Automatic: Using empanadas + +To be filled. + +### Manual: Using livemedia-creator + +To use livemedia-creator without using virt, you can use a mock shell. To +setup a mock chroot for the purpose of building a live image, you would +set it up like so: + +``` +# Install mock if you haven't already +% dnf install epel-release -y +% dnf install mock -y + +# Add a user to the mock group +% usermod -a -G mock user + +# As the user, setup the mock environment +% mock -r rocky-10-x86_64 --init +% mock -r rocky-10-x86_64 --install lorax-lmc-novirt vim-minimal pykickstart git +# You may need to be in permissive mode temporarily if you have issues +% setenforce 0 +# Enter the shell +% mock -r rocky-10-x86_64 --shell --isolation=simple --enable-network + +# Clone the kickstarts and run an installation +% git clone https://github.com/rocky-linux/kickstarts -b r9 +% cd kickstarts +% livemedia-creator --ks Rocky-9-Workstation.ks \ + --no-virt \ + --resultdir /var/lmc \ + --project="Rocky Linux" \ + --make-iso \ + --volid Rocky-Workstation-9 \ + --iso-only \ + --iso-name Rocky-Workstation-9-x86_64.iso \ + --releasever=9 \ + --nomacboot # This option is important to set, mkfs.hfsplus is not available +``` + +With the example above, all of the results will appear in +`/var/lib/mock/rocky-10-x86_64/root/var/lmc`. diff --git a/Rocky-10-Azure-Base.ks b/Rocky-10-Azure-Base.ks new file mode 100644 index 0000000..287032a --- /dev/null +++ b/Rocky-10-Azure-Base.ks @@ -0,0 +1,274 @@ +#version=DEVEL +# Keyboard layouts +keyboard 'us' +# Root password +rootpw --iscrypted thereisnopasswordanditslocked +# System language +lang en_US.UTF-8 +# Shutdown after installation +shutdown +# System timezone +timezone UTC --isUtc +# Use text mode install +text +# Network information +network --bootproto=dhcp --device=link --activate +# Use network installation +url --url="https://download.rockylinux.org/stg/rocky/10/BaseOS/$basearch/os/" +# System authorization information +auth --enableshadow --passalgo=sha512 +# Firewall configuration +firewall --enabled --service=ssh +firstboot --disable +# SELinux configuration +selinux --enforcing + +# System services +services --disabled="kdump,rhsmcertd" --enabled="NetworkManager,sshd,rsyslog,chronyd,cloud-init,cloud-init-local,cloud-config,cloud-final,rngd" +# System bootloader configuration +bootloader --append="rootdelay=300 console=ttyS0 earlyprintk=ttyS0 no_timer_check crashkernel=auto net.ifnames=0" --location=mbr --timeout=1 + +# Disk partitioning information +# NOTE(neil): 2023-05-12 NONE of reqpart, clearpart, zerombr can be used. We +# are creating partitions manually in %pre to ensure proper ordering as +# Anaconda does NOT ensure the ordering `part` commands. +part /boot/efi --fstype="efi" --onpart=vda1 +part /boot --fstype="xfs" --label=boot --onpart=vda2 +part prepboot --fstype="prepboot" --onpart=vda3 +part biosboot --fstype="biosboot" --onpart=vda4 +part / --size=8000 --fstype="xfs" --mkfsoptions "-m bigtime=0,inobtcount=0" --grow --onpart=vda5 + +%pre +# Clear the Master Boot Record +dd if=/dev/zero of=/dev/vda bs=512 count=1 +# Create a new GPT partition table +parted /dev/vda mklabel gpt +# Create a partition for /boot/efi +parted /dev/vda mkpart primary fat32 1MiB 100MiB +parted /dev/vda set 1 boot on +# Create a partition for /boot +parted /dev/vda mkpart primary xfs 100MiB 1100MiB +# Create a partition for prep +parted /dev/vda mkpart primary 1100MiB 1104MiB +# Create a partition for bios_grub +parted /dev/vda mkpart primary 1104MiB 1105MiB +# Create a partition for LVM +parted /dev/vda mkpart primary xfs 1106MiB 10.7GB + +%end + +%post --erroronfail +passwd -d root +passwd -l root + +systemctl enable waagent + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# Common Cloud Tweaks +# setup systemd to boot to the right runlevel +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +# remove linux-firmware as we're virt and it's half a gig +dnf -C -y remove linux-firmware + +# Remove firewalld; it is required to be present for install/image building. +# but we dont ship it in cloud +dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1" +dnf -C -y remove avahi\* +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +echo "virtual-guest" > /etc/tuned/active_profile + +cat << EOF | tee -a /etc/NetworkManager/conf.d/dhcp-timeout.conf +# Configure dhcp timeout to 300s by default +[connection] +ipv4.dhcp-timeout=300 +EOF + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# Remove build-time resolvers to fix #16948 +truncate -s 0 /etc/resolv.conf + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + +# azure settings +# Configure waagent for cloud-init +sed -i 's/Provisioning.UseCloudInit=n/Provisioning.UseCloudInit=y/g' /etc/waagent.conf +sed -i 's/Provisioning.Enabled=y/Provisioning.Enabled=n/g' /etc/waagent.conf + +# Azure: handle sr-iov and networkmanaeger +cat << EOF | tee -a /etc/udev/rules.d/68-azure-sriov-nm-unmanaged.rules +# Accelerated Networking on Azure exposes a new SRIOV interface to the VM. +# This interface is transparently bonded to the synthetic interface, +# so NetworkManager should just ignore any SRIOV interfaces. +SUBSYSTEM=="net", DRIVERS=="hv_pci", ACTION=="add", ENV{NM_UNMANAGED}="1" +EOF + +# Azure: Time sync for linux +## Setup udev rule for ptp_hyperv +cat << EOF | tee -a /etc/udev/rules.d/98-hyperv-ptp.rules +## See: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync#check-for-ptp-clock-source +SUBSYSTEM=="ptp", ATTR{clock_name}=="hyperv", SYMLINK += "ptp_hyperv" +EOF + +# Configure chrony to use ptp_hyperv +cat << EOF | tee -a /etc/chrony.conf +# Setup hyperv PTP device as refclock +refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2 +EOF + +# Azure: Blacklist modules +cat << EOF | tee -a /etc/modprobe.d/azure-blacklist.conf +blacklist amdgpu +blacklist nouveau +blacklist radeon +EOF + +# Azure: cloud-init customizations for Hyperv +cat << EOF | tee /etc/cloud/cloud.cfg.d/10-azure-kvp.cfg +# Enable logging to the Hyper-V kvp in Azure +reporting: + logging: + type: log + telemetry: + type: hyperv +EOF + +# Kernel and Drivers +# Add drivers when building in VMWare, Vbox, or KVM (KVM) +cat << EOF | tee -a /etc/dracut.conf.d/80-azure.conf +add_drivers+=" hv_vmbus hv_netvsc hv_storvsc " +EOF + +dracut -f -v + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers + +# this shouldn't be the case, but we'll do it anyway +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/product-id.conf +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/subscription-manager.conf + +dnf clean all +truncate -c -s 0 /var/log/dnf.log + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'azure' > /etc/yum/vars/infra + +# Azure Cleanup +sudo rm -f /var/log/waagent.log +sudo cloud-init clean +waagent -force -deprovision+user + +# Common cleanup +rm -f ~/.bash_history +export HISTSIZE=0 + +rm -f /var/lib/systemd/random-seed +rm -rf /root/anaconda-ks.cfg +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf "/var/lib/yum/*" +rm -rf "/var/log/anaconda*" +rm -rf /var/log/yum.log + +# Wipe machineid +cat /dev/null > /etc/machine-id + +# Fix selinux +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +true + +%end + +%packages +@core +NetworkManager +WALinuxAgent +chrony +cloud-init +cloud-utils-growpart +dhcp-client +dnf-utils +dracut-config-generic +firewalld +gdisk +grub2 +hyperv-daemons +kernel +rng-tools +rocky-release +rsync +tar +yum-utils +-aic94xx-firmware +-alsa-firmware +-alsa-lib +-alsa-tools-firmware +-biosdevname +-iprutils +-ivtv-firmware +-iwl100-firmware +-iwl1000-firmware +-iwl105-firmware +-iwl135-firmware +-iwl2000-firmware +-iwl2030-firmware +-iwl3160-firmware +-iwl3945-firmware +-iwl4965-firmware +-iwl5000-firmware +-iwl5150-firmware +-iwl6000-firmware +-iwl6000g2a-firmware +-iwl6000g2b-firmware +-iwl6050-firmware +-iwl7260-firmware +-langpacks-* +-langpacks-en +-libertas-sd8686-firmware +-libertas-sd8787-firmware +-libertas-usb8388-firmware +-plymouth +-qemu-guest-agent + +%end diff --git a/Rocky-10-Azure-LVM.ks b/Rocky-10-Azure-LVM.ks new file mode 100644 index 0000000..0f6c3e8 --- /dev/null +++ b/Rocky-10-Azure-LVM.ks @@ -0,0 +1,280 @@ +#version=DEVEL +# Keyboard layouts +keyboard 'us' +# Root password +rootpw --iscrypted thereisnopasswordanditslocked +# System language +lang en_US.UTF-8 +# Shutdown after installation +shutdown +# System timezone +timezone UTC --isUtc +# Use text mode install +text +# Network information +network --bootproto=dhcp --device=link --activate +# Use network installation +url --url="https://download.rockylinux.org/stg/rocky/10/BaseOS/$basearch/os/" +# System authorization information +auth --enableshadow --passalgo=sha512 +# Firewall configuration +firewall --enabled --service=ssh +firstboot --disable +# SELinux configuration +selinux --enforcing + +# System services +services --disabled="kdump,rhsmcertd" --enabled="NetworkManager,sshd,rsyslog,chronyd,cloud-init,cloud-init-local,cloud-config,cloud-final,rngd" +# System bootloader configuration +bootloader --append="rootdelay=300 console=ttyS0 earlyprintk=ttyS0 no_timer_check crashkernel=auto net.ifnames=0" --location=mbr --timeout=1 +# Clear the Master Boot Record +#zerombr +# Partition clearing information +#clearpart --all --initlabel --disklabel=gpt +# Disk partitioning information +part /boot/efi --fstype="efi" --onpart=vda1 +part /boot --fstype="xfs" --label=boot --onpart=vda2 +part prepboot --fstype="prepboot" --onpart=vda3 +part biosboot --fstype="biosboot" --onpart=vda4 +part pv.01 --grow --ondisk=vda --onpart=vda5 +volgroup rocky pv.01 +logvol / --grow --size=8000 --mkfsoptions="-m bigtime=0,inobtcount=0" --name=root --vgname=rocky + +%pre +# Clear the Master Boot Record +dd if=/dev/zero of=/dev/vda bs=512 count=1 +# Create a new GPT partition table +parted /dev/vda mklabel gpt +# Create a partition for /boot/efi +parted /dev/vda mkpart primary fat32 1MiB 100MiB +parted /dev/vda set 1 boot on +# Create a partition for /boot +parted /dev/vda mkpart primary xfs 100MiB 1100MiB +# Create a partition for prep +parted /dev/vda mkpart primary 1100MiB 1104MiB +# Create a partition for bios_grub +parted /dev/vda mkpart primary 1104MiB 1105MiB +# Create a partition for LVM +parted /dev/vda mkpart primary ext2 1106MiB 10.7GB +parted /dev/vda set 5 lvm on + +%end + +%post --erroronfail +passwd -d root +passwd -l root + +systemctl enable waagent + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# Common Cloud Tweaks +# setup systemd to boot to the right runlevel +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +# remove linux-firmware as we're virt and it's half a gig +dnf -C -y remove linux-firmware + +# Remove firewalld; it is required to be present for install/image building. +# but we dont ship it in cloud +dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1" +dnf -C -y remove avahi\* +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +echo "virtual-guest" > /etc/tuned/active_profile + +cat << EOF | tee -a /etc/NetworkManager/conf.d/dhcp-timeout.conf +# Configure dhcp timeout to 300s by default +[connection] +ipv4.dhcp-timeout=300 +EOF + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# Remove build-time resolvers to fix #16948 +truncate -s 0 /etc/resolv.conf + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + +# azure settings +# Configure waagent for cloud-init +sed -i 's/Provisioning.UseCloudInit=n/Provisioning.UseCloudInit=y/g' /etc/waagent.conf +sed -i 's/Provisioning.Enabled=y/Provisioning.Enabled=n/g' /etc/waagent.conf + +# Azure: handle sr-iov and networkmanaeger +cat << EOF | tee -a /etc/udev/rules.d/68-azure-sriov-nm-unmanaged.rules +# Accelerated Networking on Azure exposes a new SRIOV interface to the VM. +# This interface is transparently bonded to the synthetic interface, +# so NetworkManager should just ignore any SRIOV interfaces. +SUBSYSTEM=="net", DRIVERS=="hv_pci", ACTION=="add", ENV{NM_UNMANAGED}="1" +EOF + +# Azure: Time sync for linux +## Setup udev rule for ptp_hyperv +cat << EOF | tee -a /etc/udev/rules.d/98-hyperv-ptp.rules +## See: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync#check-for-ptp-clock-source +SUBSYSTEM=="ptp", ATTR{clock_name}=="hyperv", SYMLINK += "ptp_hyperv" +EOF + +# Configure chrony to use ptp_hyperv +cat << EOF | tee -a /etc/chrony.conf +# Setup hyperv PTP device as refclock +refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2 +EOF + +# Azure: Blacklist modules +cat << EOF | tee -a /etc/modprobe.d/azure-blacklist.conf +blacklist amdgpu +blacklist nouveau +blacklist radeon +EOF + +# Azure: cloud-init customizations for Hyperv +cat << EOF | tee /etc/cloud/cloud.cfg.d/10-azure-kvp.cfg +# Enable logging to the Hyper-V kvp in Azure +reporting: + logging: + type: log + telemetry: + type: hyperv +EOF + +# Kernel and Drivers +# Add drivers when building in VMWare, Vbox, or KVM (KVM) +cat << EOF | tee -a /etc/dracut.conf.d/80-azure.conf +add_drivers+=" hv_vmbus hv_netvsc hv_storvsc " +EOF + +dracut -f -v + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers + +# this shouldn't be the case, but we'll do it anyway +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/product-id.conf +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/subscription-manager.conf + +dnf clean all +truncate -c -s 0 /var/log/dnf.log + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'azure' > /etc/yum/vars/infra + +# Azure Cleanup +sudo rm -f /var/log/waagent.log +sudo cloud-init clean +waagent -force -deprovision+user + +# Common cleanup +rm -f ~/.bash_history +export HISTSIZE=0 + +rm -f /var/lib/systemd/random-seed +rm -rf /root/anaconda-ks.cfg +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf "/var/lib/yum/*" +rm -rf "/var/log/anaconda*" +rm -rf /var/log/yum.log + +# Wipe machineid +cat /dev/null > /etc/machine-id + +# Fix selinux +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +# LVM Variant Fix, remove system.devices +rm -fv /etc/lvm/devices/system.devices + +true + +%end + +%packages +@core +NetworkManager +WALinuxAgent +chrony +cloud-init +cloud-utils-growpart +dhcp-client +dnf-utils +dracut-config-generic +firewalld +gdisk +grub2 +hyperv-daemons +kernel +rng-tools +rocky-release +rsync +tar +yum-utils +-aic94xx-firmware +-alsa-firmware +-alsa-lib +-alsa-tools-firmware +-biosdevname +-iprutils +-ivtv-firmware +-iwl100-firmware +-iwl1000-firmware +-iwl105-firmware +-iwl135-firmware +-iwl2000-firmware +-iwl2030-firmware +-iwl3160-firmware +-iwl3945-firmware +-iwl4965-firmware +-iwl5000-firmware +-iwl5150-firmware +-iwl6000-firmware +-iwl6000g2a-firmware +-iwl6000g2b-firmware +-iwl6050-firmware +-iwl7260-firmware +-langpacks-* +-langpacks-en +-libertas-sd8686-firmware +-libertas-sd8787-firmware +-libertas-usb8388-firmware +-plymouth +-qemu-guest-agent + +%end diff --git a/Rocky-10-Container-Base.ks b/Rocky-10-Container-Base.ks new file mode 100644 index 0000000..e7c5991 --- /dev/null +++ b/Rocky-10-Container-Base.ks @@ -0,0 +1,109 @@ +# This is a minimal Rocky kickstart designed for docker. +# It will not produce a bootable system +# To use this kickstart, run make + +# Basic setup information +url --url https://download.rockylinux.org/stg/rocky/10/BaseOS/$basearch/os/ + +text +bootloader --disable +firewall --disabled +network --bootproto=dhcp --device=link --activate --onboot=on +rootpw --lock --iscrypted locked +selinux --disabled +shutdown + +keyboard us +lang en_US.UTF-8 +timezone --utc --nontp UTC + +# Disk setup +zerombr +clearpart --all --initlabel +autopart --noboot --nohome --noswap --nolvm --fstype=ext4 + +# This breaks everything, apparently +%addon com_redhat_kdump --disable +%end + +# Package setup +%packages --excludedocs --inst-langs=en --nocore --exclude-weakdeps +bash +binutils +coreutils-single +crypto-policies-scripts +curl-minimal +findutils +glibc-minimal-langpack +gzip +hostname +libcurl-minimal +libusbx +less +rocky-release +rootfiles +tar +usermode +vim-minimal +yum + +-dosfstools +-kexec-tools +-e2fsprogs +-firewalld +-fuse-libs +-gettext* +-gnupg2-smime +-grub\* +-iptables +-kernel +-libss +-langpacks-* +-langpacks-en +-os-prober* +-pinentry +-qemu-guest-agent +-shared-mime-info +-trousers +-xfsprogs +-xkeyboard-config +%end + +%post --erroronfail --log=/root/anaconda-post.log +# container customizations inside the chroot + +# Stay compatible +echo 'container' > /etc/dnf/vars/infra + +#Generate installtime file record +/bin/date +%Y%m%d_%H%M > /etc/BUILDTIME + +# Limit languages to help reduce size. +LANG="en_US" +echo "%_install_langs $LANG" > /etc/rpm/macros.image-language-conf + +# https://bugzilla.redhat.com/show_bug.cgi?id=1727489 +echo 'LANG="C.UTF-8"' > /etc/locale.conf + +# systemd fixes +:> /etc/machine-id +umount /run +systemd-tmpfiles --create --boot + +# mask mounts and login bits +systemctl mask \ + console-getty.service \ + dev-hugepages.mount \ + getty.target \ + sys-fs-fuse-connections.mount \ + systemd-logind.service \ + systemd-remount-fs.service + +# Cleanup the image +rm -f /etc/udev/hwdb.bin +rm -rf /usr/lib/udev/hwdb.d/ \ + /boot /var/lib/dnf/history.* \ + "/tmp/*" "/tmp/.*" || true + + +%end diff --git a/Rocky-10-Container-Minimal.ks b/Rocky-10-Container-Minimal.ks new file mode 100644 index 0000000..37ba5fd --- /dev/null +++ b/Rocky-10-Container-Minimal.ks @@ -0,0 +1,103 @@ +# This is a minimal Rocky kickstart designed for docker. +# It will not produce a bootable system +# To use this kickstart, run make + +# Basic setup information + +text +bootloader --disable +firewall --disabled +network --bootproto=dhcp --device=link --activate --onboot=on +rootpw --lock --iscrypted locked +selinux --disabled +shutdown + +keyboard us +lang en_US.UTF-8 +timezone --utc --nontp UTC + +# Disk setup +zerombr +clearpart --all --initlabel +autopart --noboot --nohome --noswap --nolvm --fstype=ext4 + +# This breaks everything, apparently +%addon com_redhat_kdump --disable +%end + +# Package setup +%packages --excludedocs --inst-langs=en --nocore --exclude-weakdeps +bash +coreutils-single +glibc-minimal-langpack +microdnf +rocky-release +util-linux + +-brotli +-dosfstools +-e2fsprogs +-firewalld +-fuse-libs +-gettext* +-gnupg2-smime +-grub\* +-hostname +-iptables +-iputils +-kernel +-kexec-tools +-less +-libss +-os-prober* +-pinentry +-qemu-guest-agent +-rootfiles +-shared-mime-info +-tar +-trousers +-vim-minimal +-xfsprogs +-xkeyboard-config +-yum +%end + +%post --erroronfail --log=/root/anaconda-post.log +# container customizations inside the chroot + + +rpm --rebuilddb + +/bin/date +%Y-%m-%d_%H:%M:%S > /etc/BUILDTIME + +echo 'container' > /etc/dnf/vars/infra + +LANG="en_US" +echo '%_install_langs en_US.UTF-8' > /etc/rpm/macros.image-language-conf +echo 'LANG="C.UTF-8"' > /etc/locale.conf + +rm -f /var/lib/dnf/history.* +rm -fr "/var/log/*" "/tmp/*" "/tmp/.*" + +for dir in $(ls -d "/usr/share/{locale,i18n}/*" | grep -v 'en_US\|all_languages\|locale\.alias'); do rm -fr $dir; done + +# systemd fixes +umount /run +systemd-tmpfiles --create --boot + +# mask mounts and login bits +systemctl mask \ + console-getty.service \ + dev-hugepages.mount \ + getty.target \ + sys-fs-fuse-connections.mount \ + systemd-logind.service \ + systemd-remount-fs.service + +# Cleanup the image +rm -f /etc/udev/hwdb.bin +rm -rf /usr/lib/udev/hwdb.d/ \ + /boot /var/lib/dnf/history.* \ + "/tmp/*" "/tmp/.*" || true + +%end diff --git a/Rocky-10-Container-UBI.ks b/Rocky-10-Container-UBI.ks new file mode 100644 index 0000000..b8bb775 --- /dev/null +++ b/Rocky-10-Container-UBI.ks @@ -0,0 +1,112 @@ +# This is a minimal Rocky kickstart designed for docker. +# It will not produce a bootable system +# To use this kickstart, run make + +# Basic setup information +url --url https://download.rockylinux.org/stg/rocky/10/BaseOS/$basearch/os/ + +text +bootloader --disable +firewall --disabled +network --bootproto=dhcp --device=link --activate --onboot=on +rootpw --lock --iscrypted locked +selinux --disabled +shutdown + +keyboard us +lang en_US.UTF-8 +timezone --utc --nontp Etc/UTC + +# Disk setup +zerombr +clearpart --all --initlabel +autopart --noboot --nohome --noswap --nolvm --fstype=ext4 + +# This breaks everything, apparently +%addon com_redhat_kdump --disable +%end + +# Package setup +%packages --ignoremissing --excludedocs --inst-langs=en --nocore --exclude-weakdeps +bash +coreutils-single +crypto-policies-scripts +curl-minimal +findutils +gdb-gdbserver +glibc-minimal-langpack +gzip +libcurl-minimal +systemd +rocky-release +rootfiles +tar +util-linux +vim-minimal +which +yum + +-dosfstools +-kexec-tools +-e2fsprogs +-firewalld +-fuse-libs +-gettext* +-gnupg2-smime +-grub\* +-iptables +-kernel +-libss +-os-prober* +-pinentry +-qemu-guest-agent +-shared-mime-info +-trousers +-xfsprogs +-xkeyboard-config +%end + +%post --erroronfail --log=/root/anaconda-post.log +set -eux +# container customizations inside the chroot + +# Stay compatible +echo 'container' > /etc/dnf/vars/infra + +#Generate installtime file record +/bin/date +%Y%m%d_%H%M > /etc/BUILDTIME + +# Limit languages to help reduce size. +LANG="en_US" +echo "%_install_langs $LANG" > /etc/rpm/macros.image-language-conf + +# https://bugzilla.redhat.com/show_bug.cgi?id=1727489 +echo 'LANG="C.UTF-8"' > /etc/locale.conf + +# systemd fixes +:> /etc/machine-id +umount /run +systemd-tmpfiles --create --boot + +# mask mounts and login bits +systemctl mask \ + console-getty.service \ + dev-hugepages.mount \ + getty.target \ + sys-fs-fuse-connections.mount \ + systemd-logind.service \ + systemd-remount-fs.service + +# Remove network configuration files leftover from anaconda installation +# https://bugzilla.redhat.com/show_bug.cgi?id=1713089 +rm -f /etc/sysconfig/network-scripts/ifcfg-* + +# Cleanup the image +rm -f /etc/udev/hwdb.bin +rm -rf /usr/lib/udev/hwdb.d/ \ + /boot /var/lib/dnf/history.* \ + /var/cache/* /var/log/* \ + "/tmp/*" "/tmp/.*" || true + + +%end diff --git a/Rocky-10-EC2-Base.ks b/Rocky-10-EC2-Base.ks new file mode 100644 index 0000000..5c73879 --- /dev/null +++ b/Rocky-10-EC2-Base.ks @@ -0,0 +1,230 @@ +text +lang en_US.UTF-8 +keyboard us +timezone UTC --utc +# Disk +bootloader --append="console=ttyS0,115200n8 console=tty0 net.ifnames=0 rd.blacklist=nouveau nvme_core.io_timeout=4294967295" --location=mbr --timeout=1 +auth --enableshadow --passalgo=sha512 +selinux --enforcing +firewall --enabled --service=ssh +firstboot --disable +# Network information +network --bootproto=dhcp --device=link --activate --onboot=on +# Root password +services --disabled="kdump,rhsmcertd" --enabled="NetworkManager,sshd,rsyslog,chronyd,cloud-init,cloud-init-local,cloud-config,cloud-final,rngd" +rootpw --iscrypted thereisnopasswordanditslocked + +# Disk partitioning information +# NOTE(neil): 2023-05-12 NONE of reqpart, clearpart, zerombr can be used. We +# are creating partitions manually in %pre to ensure proper ordering as +# Anaconda does NOT ensure the ordering `part` commands. +part /boot/efi --fstype="efi" --onpart=vda1 +part /boot --fstype="xfs" --label=boot --onpart=vda2 +part prepboot --fstype="prepboot" --onpart=vda3 +part biosboot --fstype="biosboot" --onpart=vda4 +part / --size=8000 --fstype="xfs" --mkfsoptions "-m bigtime=0,inobtcount=0" --grow --onpart=vda5 + +shutdown + +%pre +# Clear the Master Boot Record +dd if=/dev/zero of=/dev/vda bs=512 count=1 +# Create a new GPT partition table +parted /dev/vda mklabel gpt +# Create a partition for /boot/efi +parted /dev/vda mkpart primary fat32 1MiB 100MiB +parted /dev/vda set 1 boot on +# Create a partition for /boot +parted /dev/vda mkpart primary xfs 100MiB 1100MiB +# Create a partition for prep +parted /dev/vda mkpart primary 1100MiB 1104MiB +# Create a partition for bios_grub +parted /dev/vda mkpart primary 1104MiB 1105MiB +# Create a partition for LVM +parted /dev/vda mkpart primary xfs 1106MiB 10.7GB + +%end + +%packages +@core +rocky-release +kernel +yum-utils +-aic94xx-firmware +-alsa-firmware +-alsa-lib +-alsa-tools-firmware +-ivtv-firmware +-iwl1000-firmware +-iwl100-firmware +-iwl105-firmware +-iwl135-firmware +-iwl2000-firmware +-iwl2030-firmware +-iwl3160-firmware +-iwl3945-firmware +-iwl4965-firmware +-iwl5000-firmware +-iwl5150-firmware +-iwl6000-firmware +-iwl6000g2a-firmware +-iwl6000g2b-firmware +-iwl6050-firmware +-iwl7260-firmware +-libertas-sd8686-firmware +-libertas-sd8787-firmware +-libertas-usb8388-firmware + +cloud-init +cloud-utils-growpart +gdisk +dracut-config-generic +grub2 +firewalld + +# some stuff that's missing from core or things we want +tar +rsync +dhcp-client +NetworkManager +rng-tools + +-biosdevname +-plymouth +-iprutils +-langpacks-* +-langpacks-en +%end + +%post --erroronfail +passwd -d root +passwd -l root + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# setup systemd to boot to the right runlevel +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +dnf -C -y remove linux-firmware + +# Remove firewalld; it is required to be present for install/image building. +# but we dont ship it in cloud +dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1" +dnf -C -y remove avahi\* +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# this should *really* be an empty file - gotta make anaconda happy +truncate -s 0 /etc/resolv.conf + +# For cloud images, 'eth0' _is_ the predictable device name, since +# we don't want to be tied to specific virtual (!) hardware +rm -f /etc/udev/rules.d/70* +ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules + +# simple eth0 config, again not hard-coded to the build hardware +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +USERCTL="yes" +PEERDNS="yes" +IPV6INIT="no" +PERSISTENT_DHCLIENT="1" +EOF + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +if ! grep -q growpart /etc/cloud/cloud.cfg; then + sed -i 's/ - resizefs/ - growpart\n - resizefs/' /etc/cloud/cloud.cfg +fi + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers + +# this shouldn't be the case, but we'll do it anyway +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/product-id.conf +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/subscription-manager.conf + +dnf clean all +truncate -c -s 0 /var/log/dnf.log + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'ec2' > /etc/yum/vars/infra + +rm -rf /var/log/yum.log +rm -rf "/var/lib/yum/*" +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf /root/anaconda-ks.cfg +rm -rf /var/log/anaconda* + +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +# remove these for ec2 debugging +sed -i -e 's/ rhgb quiet//' /boot/grub/grub.conf + +cat > /etc/modprobe.d/blacklist-nouveau.conf << EOL +blacklist nouveau +EOL + +# enable resizing on copied AMIs +echo 'install_items+=" sgdisk "' > /etc/dracut.conf.d/sgdisk.conf + +# Only x86 has xen support at this time +if [[ "$(arch)" == "x86_64" ]]; then + echo 'add_drivers+=" xen-netfront xen-blkfront "' > /etc/dracut.conf.d/xen.conf +fi + +# Rerun dracut for the installed kernel (not the running kernel): +KERNEL_VERSION=$(rpm -q kernel --qf '%{V}-%{R}.%{arch}\n') +dracut -f /boot/initramfs-$KERNEL_VERSION.img $KERNEL_VERSION + +cat /dev/null > /etc/machine-id + +cat >> /etc/chrony.conf << EOF + +# Amazon Time Sync Service +server 169.254.169.123 prefer iburst minpoll 4 maxpoll 4 +EOF + +%end + diff --git a/Rocky-10-EC2-LVM.ks b/Rocky-10-EC2-LVM.ks new file mode 100644 index 0000000..edfae9a --- /dev/null +++ b/Rocky-10-EC2-LVM.ks @@ -0,0 +1,235 @@ +text +lang en_US.UTF-8 +keyboard us +timezone UTC --utc +# Disk +bootloader --append="console=ttyS0,115200n8 console=tty0 net.ifnames=0 rd.blacklist=nouveau nvme_core.io_timeout=4294967295" --location=mbr --timeout=1 +auth --enableshadow --passalgo=sha512 +selinux --enforcing +firewall --enabled --service=ssh +firstboot --disable +# Network information +network --bootproto=dhcp --device=link --activate --onboot=on +# Root password +services --disabled="kdump,rhsmcertd" --enabled="NetworkManager,sshd,rsyslog,chronyd,cloud-init,cloud-init-local,cloud-config,cloud-final,rngd" +rootpw --iscrypted thereisnopasswordanditslocked + +# Partition stuff - Should work for x86 and aarch64 +#zerombr +#clearpart --all --initlabel --disklabel=gpt +#reqpart +part /boot/efi --fstype=efi --asprimary --onpart=vda1 +part /boot --fstype=xfs --label=boot --onpart=vda2 +part prepboot --fstype=prepboot --asprimary --onpart=vda3 +part biosboot --fstype=biosboot --asprimary --onpart=vda4 +part pv.01 --grow --onpart=vda5 +volgroup rocky pv.01 +logvol / --vgname=rocky --size=8000 --name=root --grow --mkfsoptions "-m bigtime=0,inobtcount=0" +shutdown + +%pre +# Clear the Master Boot Record +dd if=/dev/zero of=/dev/vda bs=512 count=1 +# Create a new GPT partition table +parted /dev/vda mklabel gpt +# Create a partition for /boot/efi +parted /dev/vda mkpart primary fat32 1MiB 100MiB +parted /dev/vda set 1 boot on +# Create a partition for /boot +parted /dev/vda mkpart primary xfs 100MiB 1100MiB +# Create a partition for prep +parted /dev/vda mkpart primary 1100MiB 1104MiB +# Create a partition for bios_grub +parted /dev/vda mkpart primary 1104MiB 1105MiB +# Create a partition for LVM +parted /dev/vda mkpart primary ext2 1106MiB 10.7GB +parted /dev/vda set 5 lvm on + +%end + +%packages +@core +rocky-release +kernel +yum-utils +-aic94xx-firmware +-alsa-firmware +-alsa-lib +-alsa-tools-firmware +-ivtv-firmware +-iwl1000-firmware +-iwl100-firmware +-iwl105-firmware +-iwl135-firmware +-iwl2000-firmware +-iwl2030-firmware +-iwl3160-firmware +-iwl3945-firmware +-iwl4965-firmware +-iwl5000-firmware +-iwl5150-firmware +-iwl6000-firmware +-iwl6000g2a-firmware +-iwl6000g2b-firmware +-iwl6050-firmware +-iwl7260-firmware +-libertas-sd8686-firmware +-libertas-sd8787-firmware +-libertas-usb8388-firmware + +cloud-init +cloud-utils-growpart +gdisk +dracut-config-generic +grub2 +firewalld + +# some stuff that's missing from core or things we want +tar +rsync +dhcp-client +NetworkManager +rng-tools + +-biosdevname +-plymouth +-iprutils +-langpacks-* +-langpacks-en +%end + +%post --erroronfail +passwd -d root +passwd -l root + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# setup systemd to boot to the right runlevel +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +dnf -C -y remove linux-firmware + +# Remove firewalld; it is required to be present for install/image building. +# but we dont ship it in cloud +dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1" +dnf -C -y remove avahi\* +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# this should *really* be an empty file - gotta make anaconda happy +truncate -s 0 /etc/resolv.conf + +# For cloud images, 'eth0' _is_ the predictable device name, since +# we don't want to be tied to specific virtual (!) hardware +rm -f /etc/udev/rules.d/70* +ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules + +# simple eth0 config, again not hard-coded to the build hardware +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +USERCTL="yes" +PEERDNS="yes" +IPV6INIT="no" +PERSISTENT_DHCLIENT="1" +EOF + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +if ! grep -q growpart /etc/cloud/cloud.cfg; then + sed -i 's/ - resizefs/ - growpart\n - resizefs/' /etc/cloud/cloud.cfg +fi + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers + +# this shouldn't be the case, but we'll do it anyway +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/product-id.conf +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/subscription-manager.conf + +dnf clean all +truncate -c -s 0 /var/log/dnf.log + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'ec2' > /etc/yum/vars/infra + +rm -rf /var/log/yum.log +rm -rf "/var/lib/yum/*" +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf /root/anaconda-ks.cfg +rm -rf /var/log/anaconda* + +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +# remove these for ec2 debugging +sed -i -e 's/ rhgb quiet//' /boot/grub/grub.conf + +cat > /etc/modprobe.d/blacklist-nouveau.conf << EOL +blacklist nouveau +EOL + +# enable resizing on copied AMIs +echo 'install_items+=" sgdisk "' > /etc/dracut.conf.d/sgdisk.conf + +# Only x86 has xen support at this time +if [[ "$(arch)" == "x86_64" ]]; then + echo 'add_drivers+=" xen-netfront xen-blkfront "' > /etc/dracut.conf.d/xen.conf +fi + +# Rerun dracut for the installed kernel (not the running kernel): +KERNEL_VERSION=$(rpm -q kernel --qf '%{V}-%{R}.%{arch}\n') +dracut -f /boot/initramfs-$KERNEL_VERSION.img $KERNEL_VERSION + +cat /dev/null > /etc/machine-id + +cat >> /etc/chrony.conf << EOF + +# Amazon Time Sync Service +server 169.254.169.123 prefer iburst minpoll 4 maxpoll 4 +EOF + +# LVM Variant Fix, remove system.devices +rm -fv /etc/lvm/devices/system.devices + +%end + diff --git a/Rocky-10-GenericArm-Minimal.ks b/Rocky-10-GenericArm-Minimal.ks new file mode 100644 index 0000000..408f597 --- /dev/null +++ b/Rocky-10-GenericArm-Minimal.ks @@ -0,0 +1,188 @@ +# Generated by pykickstart v3.41 +#version=DEVEL +# Firewall configuration +firewall --enabled --port=22:tcp +# Keyboard layouts +# old format: keyboard us +# new format: +keyboard --vckeymap=us --xlayouts='us' +# System language +lang en_US.UTF-8 +# Network information +network --bootproto=dhcp --device=link --activate +# Shutdown after installation +shutdown +repo --name="rocky9-baseos" --baseurl=https://download.rockylinux.org/stg/rocky/10/BaseOS/aarch64/os/ +repo --name="rocky9-appstream" --baseurl=https://download.rockylinux.org/stg/rocky/10/AppStream/aarch64/os/ +repo --name="rocky9-powertools" --baseurl=https://download.rockylinux.org/stg/rocky/10/CRB/aarch64/os/ +repo --name="instKern" --baseurl=https://rockyrepos.gnulab.org/gen_aarch64_el9/ --cost=100 --install +#Root password +rootpw --lock +# SELinux configuration +selinux --enforcing +# System services +services --enabled="sshd,NetworkManager,chronyd" +# System timezone +timezone UTC --utc --nontp +# Use network installation +url --url="https://download.rockylinux.org/stg/rocky/10/BaseOS/aarch64/os/" +# System bootloader configuration +bootloader --location=mbr --driveorder="sda" +# Partition clearing information +clearpart --all --initlabel +# Disk partitioning information +part /boot/efi --asprimary --fstype="efi" --size=512 +part /boot --asprimary --fstype="ext4" --size=1024 --label=boot +part swap --asprimary --fstype="swap" --size=512 --label=swap +part / --asprimary --fstype="ext4" --size=3072 --label=rootfs + +%pre + +#End of Pre script for partitions +%end + +%post +# Mandatory README file +cat >/root/README << EOF +== Rocky Linux 9 == + +If you want to automatically resize your / partition, just type the following (as root user): +rootfs-expand + +EOF + +%end + +%post +# Setting correct yum variable to use raspberrypi kernel repo +#echo "generic" > /etc/dnf/vars/kvariant +# +# Creating rocky user and add to wheel group +/sbin/useradd -c "Rocky Linux default user" -G wheel -m -U rocky +echo "rockylinux" | passwd --stdin rocky +# Generic efi filename for VMs +mkdir -p /boot/efi/EFI/BOOT +if [ -d /boot/efi/EFI/rocky/ ] && [ -f /boot/efi/EFI/rocky/grubaa64.efi ];then + for j in grub.cfg grubenv;do + mv -f /boot/grub2/${j} /boot/efi/EFI/rocky/ + ln -s ../efi/EFI/rocky/${j} /boot/grub2/${j} + done + cp -f /boot/efi/EFI/rocky/grubaa64.efi /boot/efi/EFI/BOOT/BOOTAA64.EFI +fi + +cp -f /usr/share/uboot/rpi_3/u-boot.bin /boot/efi/rpi3-u-boot.bin +cp -f /usr/share/uboot/rpi_4/u-boot.bin /boot/efi/rpi4-u-boot.bin + +rpm -e dracut-config-generic + +#setup dtb link by running "creating 10-devicetree.install" +if [ -x /lib/kernel/install.d/10-devicetree.install ];then + /lib/kernel/install.d/10-devicetree.install remove +fi + +### Write /etc/sysconfig/kernel +cat << EOF > /etc/sysconfig/kernel +# Written by image installer +# UPDATEDEFAULT specifies if new-kernel-pkg should make new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel-core +EOF +chmod 644 /etc/sysconfig/kernel + +### Write grub defaults, turn off OS probing as it is always wrong for image creation +cat << EOF > /etc/default/grub +GRUB_TIMEOUT=5 +GRUB_DISTRIBUTOR="$(sed 's, release .*$,,g' /etc/system-release)" +GRUB_DEFAULT=saved +GRUB_DISABLE_SUBMENU=true +GRUB_TERMINAL_OUTPUT="console" +GRUB_CMDLINE_LINUX="" +GRUB_DISABLE_RECOVERY="true" +GRUB_DISABLE_OS_PROBER="true" +GRUB_ENABLE_BLSCFG="false" +EOF +chmod 644 /etc/default/grub +# fixing the rpmdb +rpm --rebuilddb +# remove /boot/dtb for some rpi to boot +rm -f /boot/dtb +%end + +%post +# Remove ifcfg-link on pre generated images +rm -f /etc/sysconfig/network-scripts/ifcfg-link + +# Remove machine-id on pre generated images +rm -f /etc/machine-id +touch /etc/machine-id + +%end + +%post +cat >/usr/local/bin/rootfs-expand << EOF + +#!/bin/bash +clear +part=\$(mount |grep '^/dev.* / ' |awk '{print \$1}') +if [ -z "\$part" ];then + echo "Error detecting rootfs" + exit -1 +fi +dev=\$(echo \$part|sed 's/[0-9]*\$//g') +devlen=\${#dev} +num=\${part:\$devlen} +if [[ "\$dev" =~ ^/dev/mmcblk[0-9]*p\$ ]];then + dev=\${dev:0:-1} +fi +if [ ! -x /usr/bin/growpart ];then + echo "Please install cloud-utils-growpart (sudo yum install cloud-utils-growpart)" + exit -2 +fi +if [ ! -x /usr/sbin/resize2fs ];then + echo "Please install e2fsprogs (sudo yum install e2fsprogs)" + exit -3 +fi +echo \$part \$dev \$num + +echo "Extending partition \$num to max size ...." +growpart \$dev \$num +echo "Resizing ext4 filesystem ..." +resize2fs \$part +echo "Done." +df -h |grep \$part +EOF + +chmod +x /usr/local/bin/rootfs-expand +%end + +%packages +@core +NetworkManager-wifi +bash-completion +bcm2711-firmware +bcm2835-firmware +bcm283x-firmware +bcm283x-overlays +chrony +cloud-utils-growpart +dracut-config-generic +efibootmgr +glibc-langpack-en +grub2-common +grub2-efi-aa64 +grub2-efi-aa64-modules +grubby +kernel +kernel-core +nano +net-tools +shim-aa64 +systemd-udev +uboot-images-armv8 +uboot-tools +-dracut-config-rescue +-java-11-* + +%end diff --git a/Rocky-10-GenericCloud-Base.ks b/Rocky-10-GenericCloud-Base.ks new file mode 100644 index 0000000..06e6c51 --- /dev/null +++ b/Rocky-10-GenericCloud-Base.ks @@ -0,0 +1,227 @@ +text +lang en_US.UTF-8 +keyboard us +timezone --utc UTC +# Disk +bootloader --append="console=ttyS0,115200n8 no_timer_check crashkernel=auto net.ifnames=0" --location=mbr --timeout=1 +auth --enableshadow --passalgo=sha512 +selinux --enforcing +firewall --enabled --service=ssh +firstboot --disable +# Network information +network --bootproto=dhcp --device=link --activate --onboot=on +# Root password +services --disabled="kdump,rhsmcertd" --enabled="NetworkManager,sshd,rsyslog,chronyd,cloud-init,cloud-init-local,cloud-config,cloud-final,rngd" +rootpw --iscrypted thereisnopasswordanditslocked + +# Disk partitioning information +# NOTE(neil): 2023-05-12 NONE of reqpart, clearpart, zerombr can be used. We +# are creating partitions manually in %pre to ensure proper ordering as +# Anaconda does NOT ensure the ordering `part` commands. +part /boot/efi --fstype="efi" --onpart=vda1 +part /boot --fstype="xfs" --label=boot --onpart=vda2 +part prepboot --fstype="prepboot" --onpart=vda3 +part biosboot --fstype="biosboot" --onpart=vda4 +part / --size=8000 --fstype="xfs" --mkfsoptions "-m bigtime=0,inobtcount=0" --grow --onpart=vda5 +shutdown + +%pre +# Clear the Master Boot Record +dd if=/dev/zero of=/dev/vda bs=512 count=1 +# Create a new GPT partition table +parted /dev/vda mklabel gpt +# Create a partition for /boot/efi +parted /dev/vda mkpart primary fat32 1MiB 100MiB +parted /dev/vda set 1 boot on +# Create a partition for /boot +parted /dev/vda mkpart primary xfs 100MiB 1100MiB +# Create a partition for prep +parted /dev/vda mkpart primary 1100MiB 1104MiB +# Create a partition for bios_grub +parted /dev/vda mkpart primary 1104MiB 1105MiB +# Create a partition for LVM +parted /dev/vda mkpart primary xfs 1106MiB 10.7GB + +%end + +%packages +@core +rocky-release +dnf +kernel +yum +nfs-utils +dnf-utils +hostname +-aic94xx-firmware +-alsa-firmware +-alsa-lib +-alsa-tools-firmware +-ivtv-firmware +-iwl1000-firmware +-iwl100-firmware +-iwl105-firmware +-iwl135-firmware +-iwl2000-firmware +-iwl2030-firmware +-iwl3160-firmware +-iwl3945-firmware +-iwl4965-firmware +-iwl5000-firmware +-iwl5150-firmware +-iwl6000-firmware +-iwl6000g2a-firmware +-iwl6000g2b-firmware +-iwl6050-firmware +-iwl7260-firmware +-libertas-sd8686-firmware +-libertas-sd8787-firmware +-libertas-usb8388-firmware + +cloud-init +cloud-utils-growpart +python3-jsonschema +dracut-config-generic +-dracut-config-rescue +firewalld + +# some stuff that's missing from core or things we want +tar +tcpdump +rsync +rng-tools +cockpit-ws +cockpit-system +qemu-guest-agent +virt-what + +-biosdevname +-plymouth +-iprutils +# Fixes an s390x issue +#-langpacks-* +-langpacks-en +%end + +%post --erroronfail +passwd -d root +passwd -l root + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# setup systemd to boot to the right runlevel +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +# we don't need this in virt +dnf -C -y remove linux-firmware + +# Remove firewalld; it is required to be present for install/image building. +# but we dont ship it in cloud +dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1" +dnf -C -y remove avahi\* +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# this should *really* be an empty file - gotta make anaconda happy +truncate -s 0 /etc/resolv.conf + +# For cloud images, 'eth0' _is_ the predictable device name, since +# we don't want to be tied to specific virtual (!) hardware +rm -f /etc/udev/rules.d/70* +ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules +rm -f /etc/sysconfig/network-scripts/ifcfg-* + +# simple eth0 config, again not hard-coded to the build hardware +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +BOOTPROTOv6="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +USERCTL="yes" +PEERDNS="yes" +IPV6INIT="yes" +PERSISTENT_DHCLIENT="1" +EOF + +echo "virtual-guest" > /etc/tuned/active_profile + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + +#systemctl mask tmp.mount + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +# just in case +if ! grep -q growpart /etc/cloud/cloud.cfg; then + sed -i 's/ - resizefs/ - growpart\n - resizefs/' /etc/cloud/cloud.cfg +fi +# temporary until 22.2 +sed -i 's/^system_info:/locale: C.UTF-8\nsystem_info:/' /etc/cloud/cloud.cfg + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg + +# these shouldn't be enabled, but just in case +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/product-id.conf +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/subscription-manager.conf + +dnf clean all + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'genclo' > /etc/yum/vars/infra + +rm -rf /var/log/yum.log +rm -rf /var/lib/yum/* +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf /root/anaconda-ks.cfg +rm -rf /var/log/anaconda* + +echo "Fixing SELinux contexts." +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +rm -f /var/lib/systemd/random-seed +cat /dev/null > /etc/machine-id + +# reorder console entries +#sed -i 's/console=tty0/console=tty0 console=ttyS0,115200n8/' /boot/grub2/grub.cfg + +true + +%end diff --git a/Rocky-10-GenericCloud-LVM.ks b/Rocky-10-GenericCloud-LVM.ks new file mode 100644 index 0000000..25095f3 --- /dev/null +++ b/Rocky-10-GenericCloud-LVM.ks @@ -0,0 +1,236 @@ +text +lang en_US.UTF-8 +keyboard us +timezone --utc UTC +# Disk +bootloader --append="console=ttyS0,115200n8 no_timer_check crashkernel=auto net.ifnames=0" --location=mbr --timeout=1 +auth --enableshadow --passalgo=sha512 +selinux --enforcing +firewall --enabled --service=ssh +firstboot --disable +# Network information +network --bootproto=dhcp --device=link --activate --onboot=on +# Root password +services --disabled="kdump,rhsmcertd" --enabled="NetworkManager,sshd,rsyslog,chronyd,cloud-init,cloud-init-local,cloud-config,cloud-final,rngd" +rootpw --iscrypted thereisnopasswordanditslocked + +# Partition stuff +#zerombr +#clearpart --all --initlabel --disklabel=gpt +#reqpart +# This should allow BIOS, UEFI, and PReP booting. Trying to be as universal as +# possible. This is a similar setup to Fedora without the btrfs. +part /boot/efi --fstype=efi --asprimary --onpart=vda1 +part /boot --fstype=xfs --label=boot --onpart=vda2 +part prepboot --fstype=prepboot --asprimary --onpart=vda3 +part biosboot --fstype=biosboot --asprimary --onpart=vda4 +part pv.01 --grow --onpart=vda5 + +volgroup rocky pv.01 +logvol / --vgname=rocky --size=8000 --name=root --grow --mkfsoptions "-m bigtime=0,inobtcount=0" +shutdown + +%pre +# Clear the Master Boot Record +dd if=/dev/zero of=/dev/vda bs=512 count=1 +# Create a new GPT partition table +parted /dev/vda mklabel gpt +# Create a partition for /boot/efi +parted /dev/vda mkpart primary fat32 1MiB 100MiB +parted /dev/vda set 1 boot on +# Create a partition for /boot +parted /dev/vda mkpart primary xfs 100MiB 1100MiB +# Create a partition for prep +parted /dev/vda mkpart primary 1100MiB 1104MiB +# Create a partition for bios_grub +parted /dev/vda mkpart primary 1104MiB 1105MiB +# Create a partition for LVM +parted /dev/vda mkpart primary ext2 1106MiB 10.7GB +parted /dev/vda set 5 lvm on + +%end + +%packages +@core +rocky-release +dnf +kernel +yum +nfs-utils +dnf-utils +hostname +-aic94xx-firmware +-alsa-firmware +-alsa-lib +-alsa-tools-firmware +-ivtv-firmware +-iwl1000-firmware +-iwl100-firmware +-iwl105-firmware +-iwl135-firmware +-iwl2000-firmware +-iwl2030-firmware +-iwl3160-firmware +-iwl3945-firmware +-iwl4965-firmware +-iwl5000-firmware +-iwl5150-firmware +-iwl6000-firmware +-iwl6000g2a-firmware +-iwl6000g2b-firmware +-iwl6050-firmware +-iwl7260-firmware +-libertas-sd8686-firmware +-libertas-sd8787-firmware +-libertas-usb8388-firmware + +cloud-init +cloud-utils-growpart +python3-jsonschema +dracut-config-generic +-dracut-config-rescue +firewalld + +# some stuff that's missing from core or things we want +tar +tcpdump +rsync +rng-tools +cockpit-ws +cockpit-system +qemu-guest-agent +virt-what + +-biosdevname +-plymouth +-iprutils +# Fixes an s390x issue +#-langpacks-* +-langpacks-en +%end + +%post --erroronfail +passwd -d root +passwd -l root + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# setup systemd to boot to the right runlevel +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +# we don't need this in virt +dnf -C -y remove linux-firmware + +# Remove firewalld; it is required to be present for install/image building. +# but we dont ship it in cloud +dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1" +dnf -C -y remove avahi\* +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# this should *really* be an empty file - gotta make anaconda happy +truncate -s 0 /etc/resolv.conf + +# For cloud images, 'eth0' _is_ the predictable device name, since +# we don't want to be tied to specific virtual (!) hardware +rm -f /etc/udev/rules.d/70* +ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules +rm -f /etc/sysconfig/network-scripts/ifcfg-* + +# simple eth0 config, again not hard-coded to the build hardware +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +BOOTPROTOv6="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +USERCTL="yes" +PEERDNS="yes" +IPV6INIT="yes" +PERSISTENT_DHCLIENT="1" +EOF + +echo "virtual-guest" > /etc/tuned/active_profile + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + +#systemctl mask tmp.mount + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +# just in case +if ! grep -q growpart /etc/cloud/cloud.cfg; then + sed -i 's/ - resizefs/ - growpart\n - resizefs/' /etc/cloud/cloud.cfg +fi +# temporary until 22.2 +sed -i 's/^system_info:/locale: C.UTF-8\nsystem_info:/' /etc/cloud/cloud.cfg + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg + +# these shouldn't be enabled, but just in case +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/product-id.conf +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/subscription-manager.conf + +dnf clean all + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'genclo' > /etc/yum/vars/infra + +rm -rf /var/log/yum.log +rm -rf /var/lib/yum/* +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf /root/anaconda-ks.cfg +rm -rf /var/log/anaconda* + +echo "Fixing SELinux contexts." +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +rm -f /var/lib/systemd/random-seed +cat /dev/null > /etc/machine-id + +# reorder console entries +#sed -i 's/console=tty0/console=tty0 console=ttyS0,115200n8/' /boot/grub2/grub.cfg + +# LVM Variant Fix, remove system.devices +rm -fv /etc/lvm/devices/system.devices + +true + +%end diff --git a/Rocky-10-OCP-Base.ks b/Rocky-10-OCP-Base.ks new file mode 100644 index 0000000..ad6b044 --- /dev/null +++ b/Rocky-10-OCP-Base.ks @@ -0,0 +1,500 @@ +#version=DEVEL +# Keyboard layouts +keyboard 'us' +# Root password +rootpw --iscrypted thereisnopasswordanditslocked +# System language +lang en_US.UTF-8 +# Shutdown after installation +shutdown +# System timezone +timezone UTC --isUtc +# Use text mode install +text +# Network information +network --bootproto=dhcp --device=link --activate +# Use network installation +url --url="https://download.rockylinux.org/stg/rocky/10/BaseOS/$basearch/os/" +repo --name "extras" --baseurl="https://dl.rockylinux.org/stg/rocky/10/extras/$basearch/os/" +repo --name "crb" --baseurl="https://dl.rockylinux.org/stg/rocky/10/CRB/$basearch/os/" +repo --name="oraclelinux-addons" --baseurl=http://yum.oracle.com/repo/OracleLinux/OL9/addons/$basearch/ --excludepkgs="kernel,WALinuxAgent" --install +repo --name "sig-cloud-common" --baseurl="https://yumrepofs.build.resf.org/v1/projects/15016370-1410-4459-a1a2-a1576041fd19/repo/cloud-common/$basearch/" --includepkgs="oci-utils,python3-circuitbreaker,python3-daemon,python3-sdnotify,python39-oci-sdk" --cost=100 +repo --name=epel --cost=200 --baseurl="https://dl.fedoraproject.org/pub/epel/10/Everything/$basearch/" --install +# System authorization information +auth --enableshadow --passalgo=sha512 +# Firewall configuration +firewall --enabled --service=ssh +firstboot --disable +# SELinux configuration +selinux --enforcing + +# System services +services --disabled="kdump,rhsmcertd" --enabled="NetworkManager,sshd,rsyslog,chronyd,cloud-init,cloud-init-local,cloud-config,cloud-final,rngd" +# System bootloader configuration +bootloader --append="console=ttyS0,115200n8 console=tty0 no_timer_check crashkernel=auto net.ifnames=0 LANG=en_US.UTF-8 transparent_hugepage=never rd.luks=0 rd.md=0 rd.dm=0 rd.lvm.vg=rocky rd.lvm.lv=rocky/root rd.net.timeout.dhcp=10 libiscsi.debug_libiscsi_eh=1 netroot=iscsi:169.254.0.2:::1:iqn.2015-02.oracle.boot:uefi ip=dhcp rd.iscsi.bypass rd.iscsi.param=node.session.timeo.replacement_timeout=6000" --location=mbr --timeout=1 --boot-drive=vda + +# Disk partitioning information +# NOTE(neil): 2023-05-12 NONE of reqpart, clearpart, zerombr can be used. We +# are creating partitions manually in %pre to ensure proper ordering as +# Anaconda does NOT ensure the ordering `part` commands. +part /boot/efi --fstype="efi" --onpart=vda1 +part /boot --fstype="xfs" --label=boot --onpart=vda2 +part prepboot --fstype="prepboot" --onpart=vda3 +part biosboot --fstype="biosboot" --onpart=vda4 +part pv.01 --grow --size=1 --onpart=vda5 +volgroup rocky pv.01 +logvol / --grow --size=8000 --mkfsoptions="-m bigtime=0,inobtcount=0" --name=root --vgname=rocky + + +%pre +# Clear the Master Boot Record +dd if=/dev/zero of=/dev/vda bs=512 count=1 +# Create a new GPT partition table +parted /dev/vda mklabel gpt +# Create a partition for /boot/efi +parted /dev/vda mkpart primary fat32 1MiB 100MiB +parted /dev/vda set 1 boot on +# Create a partition for /boot +parted /dev/vda mkpart primary xfs 100MiB 1100MiB +# Create a partition for prep +parted /dev/vda mkpart primary 1100MiB 1104MiB +# Create a partition for bios_grub +parted /dev/vda mkpart primary 1104MiB 1105MiB +# Create a partition for LVM +parted /dev/vda mkpart primary ext2 1106MiB 10.7GB +parted /dev/vda set 5 lvm on + +%end + +%post --erroronfail + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# setup systemd to boot to the right runlevel +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +dnf -C -y remove linux-firmware + +# Remove firewalld; it is required to be present for install/image building. +# but we dont ship it in cloud +dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1" +dnf -C -y remove avahi\* +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# Remove build-time resolvers to fix #16948 +echo > /etc/resolv.conf + +# For cloud images, 'eth0' _is_ the predictable device name, since +# we don't want to be tied to specific virtual (!) hardware +rm -f /etc/udev/rules.d/70* +ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules + +# simple eth0 config, again not hard-coded to the build hardware +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +USERCTL="yes" +PEERDNS="yes" +IPV6INIT="no" +PERSISTENT_DHCLIENT="1" +EOF + +echo "virtual-guest" > /etc/tuned/active_profile + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + +systemctl enable ocid +systemctl enable ovmd + +systemctl mask tmp.mount + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg + +# disable cloud kernel repo as it's not needed +sed -i 's/enabled=1/enabled=0/' /etc/yum.repos.d/Rocky-SIG-Cloud-Kernel.repo + +dnf clean all + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'oci' > /etc/yum/vars/infra + +# change dhcp client retry/timeouts to resolve #6866 +cat >> /etc/dhcp/dhclient.conf << EOF + +timeout 300; +retry 60; +EOF + +# OCI - Import repo GPG key +cat < /tmp/key +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGHncu8BEAC2dhocMZkdapnP9o/MvAnKOczaSpF4Cj9yqt49bxLPJCY57jz9 +2ZkJ5iGk6kpBt4rPTh18aAl30T+nPP8VMQjMhvHJKfZmBtaJJ5RpvvpK5mj1UgRJ +4DQX7gqAbT0s/uZZcouZsJzXo3c7GNMrim1C+ScfGG6BoB6GVBK74jFeJNMsxZ2Y +BwQhpE+KG+1zD94RZCySykJjNoKj+U4W5H2XdB/mNEc8icFqxjJGZ5BN0DA2Wqxn +mwELTO3Q2ne1y9+sPn2YKhRqyihuZYaUPR/Jpdki93mk61MdaoTTxFPZ8FWAYrAW +9KVdreT8K33SaTFFpmhbpndPEYesgCqDqiZG7Ywjgbf2nqSOzBr2ZX23PX7QUCvQ +ar58bNbWENLhC3B950TK+r23kkPa3GICE9WP5TftWJdbJMWRBX3YhdNooNGGCbeB +xM7B/UV9hSRx1S/US8HvDhJezZDuKrpPXrNWJTuW9Kty2WGwUkEDT2GBbcjx9ocJ +fqyNJKhaLoYKCVlsmhJUi4xCY0CDDapekWLZOzHB2zgT49uIjawV5ex6pA7oLaPI +hQGvTcCl7GFWOP/6feazzIpnsJ4V3B2DoLnAevpZlINo/bi3Hv/YmbvE6NyYzD6c +1y90pc0+Om1trLPCAZpaO1I369ZhLl6T/mCd92hrCG1y8K3PFiRIKpEMVwARAQAB +tDVPcmFjbGUgTGludXggKHJlbGVhc2Uga2V5IDEpIDxzZWNhbGVydF91c0BvcmFj +bGUuY29tPokCVAQTAQoAPhYhBD5tgm0/urOJwvOONLxNBqCNi3VvBQJinlnsAhsD +BQklmAYABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJELxNBqCNi3Vv3LEP/2au +kXzbdA/T/7i+4AbGFfYnTWqmZy58wfteDNy1sk6cPmfOUqZQXUrJcSGqqeIDjPvl +KNExpee/Ja4NGg2YfzkwH5IK5sXmEDKObXRCXGZh9/WyYpr4TBoDU2rSYBP4sbKm +PsnVoRalt2Zb0qbQF8GilytoRabjI0gLzwhmoHBZMMc3MIO14KQ5yFbekaJZKcxE +BxaDQ1NDZV1rOVbkg0yDLS9Nw89dDYWVn1wx0foRJcD277ExvmaB4vmC5yayo4ss +cFldYLu7W9FHmh46flXQGfduORCbDFfjn92eB0jdrkuoEhVRpljAtMO15GMpuVbv +HzbImI2f1MfydOa6dHbRAlzeV37fPz+1nO9IWdXqFeRG0nrH2gB02AfeoObMkK/a +XYT9sq1mC5DaK6fbOPWlY+c2hIq0BhUpe+OBdDfmm7L+si9Ffj2sUdn4sHLN6Tj7 +BrJuWmJEz42+rblDNBkrdBC6XXDaRYILKSuGD65PVV+/pVl1c2EOqcktW00iiehb +eLhj2sz6NaoO5Rhx0J3pMsaCaEBAm8P6UxQSx4iGhZ8Kh5O1SVVlqu3xOhSGOKRE +sS8gIjeV/Jl3frR4eZG/BpzdTjKZmQV7dvJ4gDuDE+X7rZBzUm7nggyE2pV6UbTD +5Qwy+ASQfYHfHK4lsHD4kbO/We6H1fEFPlzlr14UuQINBGHncu8BEADBG52gWRob +VEsQIzAfq2obFnwMroxMupXrDBka7i6cUJw8HsqyHs9maGxAuRDlAma2MBPUYcbm +DH3bmctaUR7CA1RouPkb6qbZXwSwpvgN4eh4naPX20/VEp/cd5DhKWjP9yC70weh +r4LmGWV41jBAMK0G1l6+FDw2ITgsamZP+tw0swCKqzpIY2waiygCtPHCCCFMuZ6S +7hzQpsKVFh8zqzRxMs6Mni9olk4+xwng0ahYfoe2esByR2M1kGX62Y6BOcIRX1cE +zYFCUww5GrjZdJoObBtffUSz+q2LNOBcqg5huRd8BoC+k5yrXUq8ypspfV1kNEI3 +/ebFew6A8sdf2c+sOdTxTu4MI5iXM1fhCC6X4lAN8w1Ga3ML+k/kgL75mH62Yyzr +OHXNkylTDfxz9qvq6qszVfWdzVaGXRfulW5nAbAXhuX1gmgZW+M7IQ22xyWC+I60 +UcaE2l9QtHFKuekdYnekTkSUA0ghVwuw+JCQZGQbq5LqbA5TkEYuibBOJD3MZYQ5 +C3DK4KHs/3wxf2aq+Pkf3mpSscC4B0Ba5tlpJawUWqnUmGd208sfUwD20MFfHM+1 +N+M6JYCv0tC0cyAV9Jq74bAUDXLMfkGKZyAWmlPaZBMMt4WaN0r2PAKp00T6PX6x +jTM6/aNDvNTpsaaUpMXRzH13AiJ/1SjfZwARAQABiQI8BBgBCgAmAhsMFiEEPm2C +bT+6s4nC8440vE0GoI2LdW8FAmKeWsgFCSRtulkACgkQvE0GoI2LdW/pig//Zi0a +bmFJKTxku0/LMI31ZaLn9gzXjv2ugmJumfXAce+nlaheCNBa+IMLQdAmrbislzLs +qXX2+6Eqh4Q/vqGLCkElIzT9ulkgwwEp0cVF6jnXqlWHa0a/T6oAq10jRneaQFCE +t6hweJ9KTUQufp5aAiZr/GVpBJLJ8kfOx+5eHvDj+VFlFUhpzzns/NfN5N+bthJ/ +Wbt49tzmWaWoEFA0tlwMBPO3zEh/mo5lys0GqENPs4Yb4tL82qg+SG7jHSuH2lZk +XLLyLQ6p63VZysL9+UTBtafs5jxnTopQFIXtzAOwdtQ8o7/6hhsUchRoUy23EIHT +J25yA2Qtb8Z/1m/G0e3lz46xHBPIs8FKSOPToCT6E1+9lomnzJPRBCCDTZO5imfX +4N4l7BodW9nb7zEMHCi2BUM+InpSsEkQkQFs0HIRI2KHSyY30uN0pVXJLOoVQIBr +WdUzLTTkN9w43fLpkcFXGbpU+pZvK2uksC3O+eBhIpZA9E7iZDwfEaZlUKO5kFvS +V5f8ZM1jbEb0sOZNNNEaEhTFTl8pQPc2GqgZ3rYt9mqH5OwhzKftV9PDYulIbY+Y +AN6eJhHj8Eu/IlxG6iYCDmF2hOVPs9aLo9zqdxbu8B6rUyVPOwfNbOR1U7WMRCYm +4QrtLe//99hXPcFVanIxgkdslnyYf4fjdbdlmNY= +=xpaH +-----END PGP PUBLIC KEY BLOCK----- +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGHndDkBEACieeO8U0kcUTDMLGXGKrJ3nScZ4LN5hHSzWC1zuLPpkB0YQdik +CrfSwodyp9LeEhaRsCSoGDc3cS5f5uGvsSUHMCZwEKjdT8LmZkF/dtvVDWawgaLS +KjoT+AJpss+ws0d/qmwkIHeYExdvZFNdKxvvxycCNy9fNwarT4aNySW6Ax7ERDl8 +k0QSK7uvL1AaWQKSz9rX//KcLv5OXVUX3ITcwprJPD3H2yTOy4pE9gxs/qKfnP+U +Pbb3pNaHP4PnCIQrjXhJxnH9cEJ7ef0kqBdliGPN7EObrP2uPg70WnVsXovYw/TF +PrA4H2lvJ58RVhh3ocrSnR+SIne7Lgf1FRSrsE2mmNZAWD6rOxOzO4kUrcfv/pqZ +f+sDs7KTFMO0noJ1Kt7JSV6xCQzeKGdOh9JxYI0/YIsquiHTF2xva3WHrpOG1sns +xXcnrLKONisg4gEK36fjsliG4jJhcNyJaAf4sfDiTKDOE5om+BZ7kMNSrMn20wg4 +AdZJm6x8Z0OfjxGOzMQ8re4Cf73H5odrpUel7HFGXiLWtk/f4P5EjxUTznlMbNED +gYi0H898Dz5Qfmtr97WQ8132fnKKtsPlXWNUNgJpYe+GvzmYOBAr4p5EZEWjB+q6 +EnfLDLpkaS+PbrpLCls5AnWnHjimBmlIMoO5GEsJdYLIQvVVvfKtEDJIBQARAQAB +tDRPcmFjbGUgTGludXggKGJhY2t1cCBrZXkgMSkgPHNlY2FsZXJ0X3VzQG9yYWNs +ZS5jb20+iQJUBBMBCgA+FiEEmCIxdZx0ZwZdDOmyp90HCItO++YFAmKewpICGwMF +CSWYBgAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQp90HCItO++bU+w//SFOe +RBqWoA5kP4BN9z716LpgkCllMRQsRZ0kZm8Enbe5S9ENn2T5/f6zZca3TNU6Wbit +ryToXuOlTsWy4BqAvQhQFeschg10Xgy6/VG3p5kCY4DIPOUjlb7/1r8k0xX6m/mH +BXBf2MCVRx/zkyeRDtD3lYHyz4cwoHEZ2NuB+CCe5WA2owVhgsRuVmjidDeOa7Q6 +61eLhAJ53OVqsUt5JpQS0KrVeYVJxCiiZnKgJMqHp26Jq0WIKtgBV3sakxhUpRUf +6ap7mnSAdh6Ae4r1+pTKd7trkxjIqLXH9RI0d7Xm+blRQVZJL9GLaLUaSvw4sfd/ +jfqENCBwAH7D488L1yvTqPfHC2+kRuUI3GU98RULCHveCISRGLVGwh1p88+9aok3 +DoV7/BUEIGbHzg3gcx8zFO2ZKKoJ7xS+vvNLAslPvHNDFH0XOwKBqlVztJprwWtA +H33e6fti7BMRw1vgljC8yVATBTiKXj5aw+25zi70o1fIFxpwsx5mwMmqHc634ai2 +hPWNZid0Lu3MYBd8pDCvMMMGimfecoyEZKJR2KbO+pNBn7suol5XS3pCmbF3ldMa +Atra+HvnxNBMxFVdxsqZhr/+ovQszYNIlWSYUDLbqk33HBmvbi3IuogAyxhLdw3T +uIjjf0acjOsSgy79ju2NpKPVtJw4BmvJRFX0Rh25Ag0EYed0OQEQAJRhf7/ZIWhZ +LpCX2vg8B4hjsEYeRvEAPUrUMHkqCuElmDaT7g76aPG0jvbMFVU/ykEt2mIi7EhW +s0SZknT5G8HoHJM2MirkyGB26yp4IlkPyNlc5H9nmMhY7iz/utxQps8jDS8dvxeG +1YAJGleGywGAet9vFfrLX9Xq9efTXozJfWOsRm+y2WklS+LblftaTUurStzLXRGT +AsBYOyVaRX/6AMu+fZt7mvoM+bOFNGxMSDIZi93wBiCKp0P2Se1YJoFHTOcQ0M6V +Fbl91ZcImPxAOX4DHfw4iuokiHCs//wV0DLZ3qtuqN2m/kV4JE9ak//BPVn4acH1 +Z6DQIzQpY66dIyLumGuCdPhl7MFHyAeKhBtLc7gp4+sli+zNUfYwwp55rTdZ9JDR +G2LD/P2eNnrUXEsvOzqqQy48BmzOmTdgc2vef85Z23GczwX1PyTaGnrQKkReajN0 +IxIuFpTgRQFBoPHTB1VVjSsOu7McWx4Gy2zccSrXKIskj4sOBIYBjxBAR0U4Gi5h +OAqplVGH3x3RoRb2swkc/LLb6WV6J7REmZ0+0dAE1ShBR8GmEb4wYc5BUgYXrhEn +hK3nmNx65jZXSAwJOZU8ETLaMoa/I/+QkgPvAJ8gyTLbMQ/xB2kMNRdisphz0jiy +PIXWlOf6I750VtbBNPHqfe0RHbBQJAl9ABEBAAGJAjwEGAEKACYCGwwWIQSYIjF1 +nHRnBl0M6bKn3QcIi0775gUCYp7C3AUJJG4hIwAKCRCn3QcIi0775nmYD/sEI0T4 ++MHIt5EzL+vBAzAbd23U2oF9KrJP49xmrLlm7qC6ghfuUVqoKwWyE24g8T4N3cxE +xQWTZ8drqvE2E2tyKqVMjJ5PfiZjK/3WOOIq9YZHpNKljv9KaAAf5alpvMxn6IBj +ZUhs775JcGWWngilBN9i3OEVFcQG9tFtfKqcYf8oRLPQlqhrH0pKOymFdqdL+NFX +G/M2LquGrvyDwnT2Cyy4p4sw639BUyA4k1hESgK9KVZTrmJPYU8hCD7kcSOY25UT +zDERLlXUsnGU9WHm/4aZ4TCs2h2qm29jHeWjfw0U/O8f4K5MV7WcJ0ZywdOk7SSf +jOKUetPH01l22I6JXiH0jLlBU5uA/zAxd8aPpvcYcWm2Ti+mkpIB6/XWbjnPoYHh +JmH8r9Pih1Z4dVR7qri/mdcsTZsKzLPuD6AITafJYuRCItCbMerhvGCwBaaR0oHS +AdpSzwKk8mrLd4BQUSM5a3E010dDeKGL4TA5ttfZJuSe7RXbi4RdDd98XHKEiU3n +N1ethSQNvEyrh0uA1U3FZvPMcbfYZa8zO85Nz9h/TGUNfmp5CyrZUHZLmvvGTOch +lUjaIhAGBVJQR/y7+4aC3zzkyzbKyLOL3hCk0xie4LLbfTQ5BtT4+GqEAtzwRQqZ +RgwnCPfIai7lLNx95bdwB8U2NpY11OXsoTLZAA== +=UWTf +-----END PGP PUBLIC KEY BLOCK----- +EOF + +rpm --import /tmp/key + +# Import EPEL Key +cat < /tmp/key +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGE3mOsBEACsU+XwJWDJVkItBaugXhXIIkb9oe+7aadELuVo0kBmc3HXt/Yp +CJW9hHEiGZ6z2jwgPqyJjZhCvcAWvgzKcvqE+9i0NItV1rzfxrBe2BtUtZmVcuE6 +2b+SPfxQ2Hr8llaawRjt8BCFX/ZzM4/1Qk+EzlfTcEcpkMf6wdO7kD6ulBk/tbsW +DHX2lNcxszTf+XP9HXHWJlA2xBfP+Dk4gl4DnO2Y1xR0OSywE/QtvEbN5cY94ieu +n7CBy29AleMhmbnx9pw3NyxcFIAsEZHJoU4ZW9ulAJ/ogttSyAWeacW7eJGW31/Z +39cS+I4KXJgeGRI20RmpqfH0tuT+X5Da59YpjYxkbhSK3HYBVnNPhoJFUc2j5iKy +XLgkapu1xRnEJhw05kr4LCbud0NTvfecqSqa+59kuVc+zWmfTnGTYc0PXZ6Oa3rK +44UOmE6eAT5zd/ToleDO0VesN+EO7CXfRsm7HWGpABF5wNK3vIEF2uRr2VJMvgqS +9eNwhJyOzoca4xFSwCkc6dACGGkV+CqhufdFBhmcAsUotSxe3zmrBjqA0B/nxIvH +DVgOAMnVCe+Lmv8T0mFgqZSJdIUdKjnOLu/GRFhjDKIak4jeMBMTYpVnU+HhMHLq +uDiZkNEvEEGhBQmZuI8J55F/a6UURnxUwT3piyi3Pmr2IFD7ahBxPzOBCQARAQAB +tCdGZWRvcmEgKGVwZWw5KSA8ZXBlbEBmZWRvcmFwcm9qZWN0Lm9yZz6JAk4EEwEI +ADgWIQT/itE0RZcQbs6BO5GKOHK/MihGfAUCYTeY6wIbDwULCQgHAgYVCgkICwIE +FgIDAQIeAQIXgAAKCRCKOHK/MihGfFX/EACBPWv20+ttYu1A5WvtHJPzwbj0U4yF +3zTQpBglQ2UfkRpYdipTlT3Ih6j5h2VmgRPtINCc/ZE28adrWpBoeFIS2YAKOCLC +nZYtHl2nCoLq1U7FSttUGsZ/t8uGCBgnugTfnIYcmlP1jKKA6RJAclK89evDQX5n +R9ZD+Cq3CBMlttvSTCht0qQVlwycedH8iWyYgP/mF0W35BIn7NuuZwWhgR00n/VG +4nbKPOzTWbsP45awcmivdrS74P6mL84WfkghipdmcoyVb1B8ZP4Y/Ke0RXOnLhNe +CfrXXvuW+Pvg2RTfwRDtehGQPAgXbmLmz2ZkV69RGIr54HJv84NDbqZovRTMr7gL +9k3ciCzXCiYQgM8yAyGHV0KEhFSQ1HV7gMnt9UmxbxBE2pGU7vu3CwjYga5DpwU7 +w5wu1TmM5KgZtZvuWOTDnqDLf0cKoIbW8FeeCOn24elcj32bnQDuF9DPey1mqcvT +/yEo/Ushyz6CVYxN8DGgcy2M9JOsnmjDx02h6qgWGWDuKgb9jZrvRedpAQCeemEd +fhEs6ihqVxRFl16HxC4EVijybhAL76SsM2nbtIqW1apBQJQpXWtQwwdvgTVpdEtE +r4ArVJYX5LrswnWEQMOelugUG6S3ZjMfcyOa/O0364iY73vyVgaYK+2XtT2usMux +VL469Kj5m13T6w== +=Mjs/ +-----END PGP PUBLIC KEY BLOCK----- +EOF + +rpm --import /tmp/key + + +rm -rf /var/log/yum.log +rm -rf "/var/lib/yum/*" +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf /root/anaconda-ks.cfg +rm -rf /var/log/anaconda* + +rm -f /var/lib/systemd/random-seed + +cat /dev/null > /etc/machine-id + +echo "Fixing SELinux contexts." +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +# remove these for debugging +sed -i -e 's/ rhgb quiet//' /boot/grub/grub.conf + +# enable resizing on copied AMIs +echo 'install_items+=" sgdisk "' > /etc/dracut.conf.d/sgdisk.conf + +# OCI - Need iscsi as a dracut module +echo 'add_dracutmodules+=" iscsi "' > /etc/dracut.conf.d/iscsi.conf + +# OCI - Virtio drivers +echo 'add_drivers+=" virtio virtio_blk virtio_net virtio_pci virtio_ring virtio_scsi virtio_console "' > /etc/dracut.conf.d/virtio.conf + +# OCI - YOLO +mkdir -p /usr/lib/dracut/modules.d/95oci +OCIDRACUT="H4sIAGtFHmMAA+2WWW/bOBCA/Vr+illZzQXoluPUhgMURYrmpS02fevuGpJIWYQVUiWpJoHr/15S +crLZZBs3QA8U5QfYosQ5NUNSrRRBTfMAi6xoVXDOcVsT6ePg2YgXNBh8C0LNeDTqrpq7124cpfF4 +nIzT8fhwEEaj+HA8gNE38b6FVqpMAAwE5+ohuW3zvyjtw/UnLMtr4lFZSOrlV00mpS+rR/rYUv84 +StJBlIx10ZNREscD/SRNkwGE3yXjO/zm9R/+EeSUBbJCQ/AOPNANQCYgK1LXniwEbdQUKMOEKU9l +ufT6eUbrqRby8kzSwuNlKYmaQDo1JrQhcjkBJWdHIC9mKUg9TIEoKGlN1FVDZtobGr7NVFFB11nm +3YLikNU1v4A8ozXwVgEtQVUEullM5RKKjGkZQTJ8BTmBkrcMo6Eg5QTeiCxvFxMYJmESxWGYImRc +wYLo8i7gOMDkY8Dauob4eCeCT5/Ah1uN7+mhbmx0+vrs5M93s10kZo67Mp6Hec2L5WTtIB1Oby3n +vIYQBPa76P1+XcDODrwHj4DjCgf+nprYGSDQlFwA69KgDNy93ooERpR5uD8FzDs5w3utv+qEnz6d +HKwdmIHTudE2TdgFZ4qyltwodGk2mZBk3snNO0dfTlh7vc722sQ9bcftInCMmiCqFQyiG+lN2HPC +ipm7J5WYC9LUWUH+VXMC/fsrLp39TgtzRuAe3RQpKr5JcAJnS9o0lC3AveXD930HjnfiR4lDl/7y +XC5uqUkjT7CZdgJ13gSdHbP+FcHebSNOr3VJFYSopGgXfWX1S21ZmgV109c3rYCuwzgxe6oJ+/Ts +xdkpbPR5oyhn15l+leR/kuw13L6BdeFAEgwehd3gn7fP372a+QdusBK9ilSYmniq9RTc1eU0MBKB +HnwI11P9n6x3/ycP3QsXme4E56VeoNr4g9GZt/az9zbLdrac//29p7f3tnn8wb9h2/dfchjdOf/D +OIns+f8j2Jz/+iD/4V8ARUWK5d4+rNCTzRkTojVCmDSEYXl/gjJdqrruJ8zNvOJ8CY0gXqt3NTg6 +0vufjg5T8YXvVkeb+dkv3GKxWCwWi8VisVgsFovFYrFYLBaLxWL5jnwGdMMrBgAoAAA=" + +base64 -d <<<"$OCIDRACUT" | tar -xz + +OCICLOUDCFG="IyBPQ0kgY2xvdWQtaW5pdCBjb25maWd1cmF0aW9uCmRhdGFzb3VyY2VfbGlzdDogWydPcmFjbGUn +LCAnT3BlblN0YWNrJ10KZGF0YXNvdXJjZToKICBPcGVuU3RhY2s6CiAgICBtZXRhZGF0YV91cmxz +OiBbJ2h0dHA6Ly8xNjkuMjU0LjE2OS4yNTQnXQogICAgdGltZW91dDogMTAKICAgIG1heF93YWl0 +OiAyMAoKIyBzd2FwIGZpbGUKc3dhcDoKICAgZmlsZW5hbWU6IC8uc3dhcGZpbGUKICAgc2l6ZTog +ImF1dG8iCgpjbG91ZF9pbml0X21vZHVsZXM6CiMgT0NJOiBkaXNrX3NldHVwIGlzIGRpc2FibGVk +CiMtIGRpc2tfc2V0dXAKIC0gbWlncmF0b3IKIC0gYm9vdGNtZAogLSB3cml0ZS1maWxlcwojIE9D +STogVGhlIGdyb3dwYXJ0IG1vZHVsZSBpcyBkaXNhYmxlZCBieSBkZWZhdWx0LiBUbyBlbmFibGUg +YXV0b21hdGljIGJvb3Qgdm9sdW1lIHJlc2l6aW5nLCB1bmNvbW1lbnQKIyB0aGUgYmVsb3cgZW50 +cnkgZm9yICctIGdyb3dwYXJ0JyBhbmQgcmVib290LiBBbGwgdGhlIGRlcGVuZGVudCBwYWNrYWdl +cyBmb3IgdGhlIGdyb3dwYXJ0CiMgbW9kdWxlIHRvIHdvcmsgc3VjaCBhcyBjbG91ZC11dGlscy1n +cm93cGFydCBhbmQgZ2Rpc2sgYXJlIGFscmVhZHkgaW5jbHVkZWQgaW4gdGhlIGltYWdlLgojLSBn +cm93cGFydAogLSByZXNpemVmcwojIE9DSTogc2V0X2hvc3RuYW1lLCB1cGRhdGVfaG9zdG5hbWUs +IHVwZGF0ZV9ldGNfaG9zdHMgYXJlIGRpc2FibGVkCiMtIHNldF9ob3N0bmFtZQojLSB1cGRhdGVf +aG9zdG5hbWUKIy0gdXBkYXRlX2V0Y19ob3N0cwogLSByc3lzbG9nCiAtIHVzZXJzLWdyb3Vwcwog +LSBzc2gKCmNsb3VkX2NvbmZpZ19tb2R1bGVzOgogLSBtb3VudHMKIC0gbG9jYWxlCiAtIHNldC1w +YXNzd29yZHMKIyBPQ0k6IHJoX3N1YnNjcmlwdGlvbiBpcyBkaXNhYmxlZAojLSByaF9zdWJzY3Jp +cHRpb24KIC0geXVtLWFkZC1yZXBvCiAtIHBhY2thZ2UtdXBkYXRlLXVwZ3JhZGUtaW5zdGFsbAog +LSB0aW1lem9uZQogLSBudHAKIC0gcHVwcGV0CiAtIGNoZWYKIC0gc2FsdC1taW5pb24KIC0gbWNv +bGxlY3RpdmUKIC0gZGlzYWJsZS1lYzItbWV0YWRhdGEKIC0gcnVuY21kCgpjbG91ZF9maW5hbF9t +b2R1bGVzOgogLSByaWdodHNjYWxlX3VzZXJkYXRhCiAtIHNjcmlwdHMtcGVyLW9uY2UKIC0gc2Ny +aXB0cy1wZXItYm9vdAogLSBzY3JpcHRzLXBlci1pbnN0YW5jZQogLSBzY3JpcHRzLXVzZXIKIC0g +c3NoLWF1dGhrZXktZmluZ2VycHJpbnRzCiAtIGtleXMtdG8tY29uc29sZQogLSBwaG9uZS1ob21l +CiAtIGZpbmFsLW1lc3NhZ2UKIyBPQ0k6IHBvd2VyLXN0YXRlLWNoYW5nZSBpcyBkaXNhYmxlZAoj +LSBwb3dlci1zdGF0ZS1jaGFuZ2UKCg==" + +base64 -d <<<"$OCICLOUDCFG" >> /etc/cloud/cloud.cfg.d/99_oci.cfg + +# Remove system.devices because Oracle does things. +rm -fv /etc/lvm/devices/system.devices + +# Start OCId +systemctl enable ocid + +# Rerun dracut for the installed kernel (not the running kernel): +KERNEL_VERSION=$(rpm -q kernel --qf '%%{V}-%%{R}.%%{arch}\n') +dracut -f /boot/initramfs-$KERNEL_VERSION.img $KERNEL_VERSION + +passwd -d root +passwd -l root + +# Copyright (C) 2020 Oracle Corp., Inc. All rights reserved. +# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl +# +# /usr/lib/oci-linux-config/cloud/scripts/initramfs-mod/net.sh +# + +echo "$(date) - OCI initramfs network modification script started." + +# Symlink network config files where cloud-init >= 19.4 expects them +DRACUT_CFG=/run/initramfs/state/etc/sysconfig/network-scripts +CI_DIR=/run +if [ -d $DRACUT_CFG ]; then + FILE_COUNT=`ls $DRACUT_CFG | wc -l` + if [ $FILE_COUNT -eq 0 ]; then + # Create dummy file if dracut did not create network device config + dummycfg=$CI_DIR/net-dummy.conf + echo "DEVICE=\"dummy\"" > $dummycfg + echo "BOOTPROTO=dhcp" >> $dummycfg + echo "$(date) - Creating dummy config $dummycfg." + else + for dcfg in $DRACUT_CFG/*; do + filename=${dcfg##*/} + devname=${filename##ifcfg-} + cicfg=$CI_DIR/net-$devname.conf + if [ ! -e $cicfg ]; then + echo "$(date) - Creating symlink from $dcfg to $cicfg." + ln -s $dcfg $cicfg + fi + done + fi +fi + +echo "$(date) - OCI initramfs network modification script done." + + +true + +%end + +%packages +@core +NetworkManager +chrony +cloud-init +cloud-utils-growpart +cockpit-system +cockpit-ws +dhcp-client +dnf +dnf-utils +dracut-config-generic +firewalld +epel-release +gdisk +grub2 +iscsi-initiator-utils +kernel +nfs-utils +oci-utils +ovmd +python3-jsonschema +qemu-guest-agent +rng-tools +rocky-release +rocky-release-cloud +rsync +tar +yum +yum-utils +-aic94xx-firmware +-alsa-firmware +-alsa-lib +-alsa-tools-firmware +-biosdevname +-iprutils +-ivtv-firmware +-iwl100-firmware +-iwl1000-firmware +-iwl105-firmware +-iwl135-firmware +-iwl2000-firmware +-iwl2030-firmware +-iwl3160-firmware +-iwl3945-firmware +-iwl4965-firmware +-iwl5000-firmware +-iwl5150-firmware +-iwl6000-firmware +-iwl6000g2a-firmware +-iwl6000g2b-firmware +-iwl6050-firmware +-iwl7260-firmware +-langpacks-* +-langpacks-en +-libertas-sd8686-firmware +-libertas-sd8787-firmware +-libertas-usb8388-firmware +-plymouth + +%end diff --git a/Rocky-10-RPI-Base.ks b/Rocky-10-RPI-Base.ks new file mode 100644 index 0000000..612d752 --- /dev/null +++ b/Rocky-10-RPI-Base.ks @@ -0,0 +1,168 @@ +# Kickstart to build Rocky 10 image for Raspberry Pi 4 hardware (aarch64) +# + +# Disk setup +clearpart --initlabel --all +part /boot --asprimary --fstype=vfat --size=300 --label=boot +part swap --asprimary --fstype=swap --size=512 --label=swap +part / --asprimary --fstype=ext4 --size=2800 --label=RPIROOT + +# Repos setup: +url --url http://download.rockylinux.org/stg/rocky/10/BaseOS/aarch64/os/ +repo --name="BaseOS" --baseurl=http://download.rockylinux.org/stg/rocky/10/BaseOS/aarch64/os/ --cost=100 +repo --name="AppStream" --baseurl=http://download.rockylinux.org/stg/rocky/10/AppStream/aarch64/os/ --cost=200 --install +repo --name="CRB" --baseurl=http://download.rockylinux.org/stg/rocky/10/CRB/aarch64/os/ --cost=300 --install +# Rocky Rpi kernel repo, we need a more permanent place for this: +repo --name="rockyrpi" --baseurl=https://download.rockylinux.org/stg/sig/9/altarch/aarch64/altarch-rockyrpi/ --cost=20 +repo --name="rockyextras" --baseurl=https://download.rockylinux.org/stg/rocky/10/extras/aarch64/os/ --cost=20 + +# Install process: +#text +keyboard us --xlayouts=us --vckeymap=us +rootpw --lock +# FIXME user creation here does not work ? +# user --name="rocky" --password="rockylinux" --plaintext --gecos="Rocky default user" --groups=wheel --uid=1000 +timezone --isUtc --nontp UTC +selinux --enforcing +firewall --enabled --port=22:tcp +network --bootproto=dhcp --device=link --activate --onboot=on +services --enabled=sshd,NetworkManager,chronyd,cpupower +shutdown +bootloader --location=none +lang en_US.UTF-8 +skipx + +# Package selection: +%packages +@core +#-grub2-tools-minimal +#-grub2-tools +#-grubby +#-grub2-common +chrony +cloud-utils-growpart +net-tools +NetworkManager-wifi +vim +bash-completion +nano +kernel-tools + +# Need these for setting default locale of en-US: +langpacks-en +glibc-all-langpacks + +# will enable rocky-release-rpi after full 9 release (and we have it in the -extras repo) +rocky-release-rpi +raspberrypi2-firmware +raspberrypi2-kernel4 + +%end + +# Post install scripts: +%post + +# Write initial boot line to cmdline.txt (we will update the root partuuid further down) +cat > /boot/cmdline.txt << EOF +console=ttyAMA0,115200 console=tty1 root= rootfstype=ext4 elevator=deadline rootwait +EOF + +# Apparently kickstart user was not working, attempt to do it here? +/sbin/useradd -c "Rocky Linux default user" -G wheel -m -U rocky +echo "rockylinux" | passwd --stdin rocky + +# Need to write several files to help with various things here. +# First, the all-important README : + +cat >/home/rocky/README << EOF +== Rocky 10 Raspberry Pi Image == + +This is a Rocky 10 install intended for Raspberry Pi 3b and 4 devices (architecture is aarch64). + +This image WILL NOT WORK on a Raspberry Pi 1 or 2 (1.1 or earlier), we are 64-bit only, and have no support for 32-bit ARM processors. Sorry :-/. + +The newer Pi Zero devices should be supported, as well as the Raspberry Pi 2 version 1.2 boards, which are 64-bit + + +IMAGE NOTES / DIFFERENCES FROM STOCK ROCKY 8: + + - Based on Rocky Linux 10, points to production Rocky 10 aarch64 repositories + - Includes script that fixes the wifi. Simple edit of a txt firmware settings file. Will need to be run whenever linux-firmware gets upgraded + - Includes @minimal-install , plus a few quality of life packages like vim, bash-completion, etc. + - Initial User "rocky" (default password: "rockylinux"). Root password disabled, rocky user is a sudoer + - Partitions are 300 MB /boot , 512 MB swap, 2800 MB rootfs. Requires a 4 GB or larger storage device to serve as your disk + +GROW YOUR PARTITION: + +If you want to automatically resize your root (/ ) partition, just type the following (as root user): +sudo rootfs-expand + +It should fill your main rootfs partition to the end of the disk. + +Thanks for your interest on Rocky-on-Rpi, feel free to share your experience or contribute in our chat channel at: https://chat.rockylinux.org/rocky-linux/channels/altarch ! + +-The Rocky Linux Team + +EOF + +# Run the fix-wifi script (extracts the .xz firmware) - should be installed via the rocky-release-rpi package +# (shouldn't be needed anymore - fixed in newer rpi kernel builds) +#fix-wifi-rpi.sh + +# Cleanup before shipping an image + +# Remove ifcfg-link on pre generated images +rm -f /etc/sysconfig/network-scripts/ifcfg-link + +# Remove machine-id on pre generated images +rm -f /etc/machine-id +touch /etc/machine-id + +# Ensure no ssh keys are present +rm -f "/etc/ssh/*_key*" + +# Clean yum cache +yum clean all + +# Fix weird sssd bug, where it gets its folder owned by the unbound user: +chown -R sssd:sssd /var/lib/sss/{db,pipes,mc,pubconf,gpo_cache} + +# Setting tuned profile to powersave by default -> sets the CPU governor to "ondemand". This prevents overheating issues +cat > /etc/sysconfig/cpupower << EOF +# See 'cpupower help' and cpupower(1) for more info +CPUPOWER_START_OPTS="frequency-set -g ondemand" +CPUPOWER_STOP_OPTS="frequency-set -g ondemand" +EOF + +%end + +# Add the PARTUUID of the rootfs partition to the kernel command line +# We must do this *outside* of the chroot, by grabbing the UUID of the loopmounted rootfs +%post --nochroot + +# Extract the UUID of the rootfs partition from /etc/fstab +UUID_ROOTFS="$(/bin/cat $INSTALL_ROOT/etc/fstab | \ +/bin/awk -F'[ =]' '/\/ / {print $2}')" + +# Get the PARTUUID of the rootfs partition +PART_UUID_ROOTFS="$(/sbin/blkid "$(/sbin/blkid --uuid $UUID_ROOTFS)" | \ +/bin/awk '{print $NF}' | /bin/tr -d '"' )" + +# Configure the kernel commandline +/bin/sed -i "s/root= /root=${PART_UUID_ROOTFS} /" $INSTALL_ROOT/boot/cmdline.txt +echo "cmdline.txt looks like this, please review:" +/bin/cat $INSTALL_ROOT/boot/cmdline.txt + +# Extract UUID of swap partition: +UUID_SWAP=$(/bin/grep 'swap' $INSTALL_ROOT/etc/fstab | awk '{print $1}' | awk -F '=' '{print $2}') + +# Fix swap partition: ensure page size is 4096 (differs on the aarch64 AWS build host) +/usr/sbin/mkswap -L "_swap" -p 4096 -U "${UUID_SWAP}" /dev/disk/by-uuid/${UUID_SWAP} + +%end +%post +# WiFi fix on Pi 3 Model B(image wont boot on Pi 3B w/o this fix) +cd /lib/firmware/brcm +xz -d -k brcmfmac43430-sdio.raspberrypi,3-model-b.txt.xz +%end + diff --git a/Rocky-10-Vagrant-Libvirt.ks b/Rocky-10-Vagrant-Libvirt.ks new file mode 100644 index 0000000..38057cf --- /dev/null +++ b/Rocky-10-Vagrant-Libvirt.ks @@ -0,0 +1,175 @@ +#version=DEVEL +# Keyboard layouts +keyboard --vckeymap=us +# Root password +rootpw --plaintext vagrant +# System language +lang en_US +# Shutdown after installation +shutdown +user --name=vagrant --password=vagrant +# System timezone +timezone UTC --isUtc +# Use text mode install +text +# Network information +network --bootproto=dhcp --device=link --activate +# Use network installation +url --url="https://download.rockylinux.org/stg/rocky/10/BaseOS/$basearch/os/" +# Firewall configuration +firewall --disabled +# Do not configure the X Window System +skipx + +# System services +services --enabled="vmtoolsd" +# System bootloader configuration +bootloader --append="no_timer_check console=tty0 console=ttyS0,115200n8 net.ifnames=0 biosdevname=0 elevator=noop" --location=mbr --timeout=1 + +# Partition stuff +zerombr +clearpart --all --initlabel --disklabel=gpt +#reqpart +# This should allow BIOS, UEFI, and PReP booting. Trying to be as universal as +# possible. This is a similar setup to Fedora without the btrfs. +part prepboot --size=4 --fstype=prepboot --asprimary +part biosboot --size=1 --fstype=biosboot --asprimary +part /boot/efi --size=100 --fstype=efi --asprimary +part /boot --size=1000 --fstype=xfs --label=boot +part / --size=8000 --fstype="xfs" --mkfsoptions "-m bigtime=0,inobtcount=0" + +%post + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# configure swap to a file +fallocate -l 2G /swapfile +chmod 600 /swapfile +mkswap /swapfile +echo "/swapfile none swap defaults 0 0" >> /etc/fstab + +# sudo +echo "%vagrant ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/vagrant +chmod 0440 /etc/sudoers.d/vagrant + +# Fix for https://github.com/CentOS/sig-cloud-instance-build/issues/38 +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +PERSISTENT_DHCLIENT="yes" +EOF + +# sshd: disable password authentication and DNS checks +ex -s /etc/ssh/sshd_config <>/etc/sysconfig/sshd <> /home/vagrant/.ssh/authorized_keys +chmod 600 /home/vagrant/.ssh/authorized_keys +chown -R vagrant:vagrant /home/vagrant/.ssh + +# Fix for issue #76, regular users can gain admin privileges via su +ex -s /etc/pam.d/su <<'EOF' +# allow vagrant to use su, but prevent others from becoming root or vagrant +/^account\s\+sufficient\s\+pam_succeed_if.so uid = 0 use_uid quiet$/ +:append +account [success=1 default=ignore] \\ + pam_succeed_if.so user = vagrant use_uid quiet +account required pam_succeed_if.so user notin root:vagrant +. +:update +:quit +EOF + +# systemd should generate a new machine id during the first boot, to +# avoid having multiple Vagrant instances with the same id in the local +# network. /etc/machine-id should be empty, but it must exist to prevent +# boot errors (e.g. systemd-journald failing to start). +:>/etc/machine-id + +echo 'vag' > /etc/yum/vars/infra + +# Blacklist the floppy module to avoid probing timeouts +echo blacklist floppy > /etc/modprobe.d/nofloppy.conf +chcon -u system_u -r object_r -t modules_conf_t /etc/modprobe.d/nofloppy.conf + +# Customize the initramfs +pushd /etc/dracut.conf.d +# Enable VMware PVSCSI support for VMware Fusion guests. +echo 'add_drivers+=" vmw_pvscsi "' > vmware-fusion-drivers.conf +echo 'add_drivers+=" hv_netvsc hv_storvsc hv_utils hv_vmbus hid-hyperv "' > hyperv-drivers.conf +# There's no floppy controller, but probing for it generates timeouts +echo 'omit_drivers+=" floppy "' > nofloppy.conf +popd +# Fix the SELinux context of the new files +restorecon -f - <> /etc/fstab + +# sudo +echo "%vagrant ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/vagrant +chmod 0440 /etc/sudoers.d/vagrant + +# sshd: disable password authentication and DNS checks +ex -s /etc/ssh/sshd_config <>/etc/sysconfig/sshd <> /home/vagrant/.ssh/authorized_keys +chmod 600 /home/vagrant/.ssh/authorized_keys +chown -R vagrant:vagrant /home/vagrant/.ssh + +# Fix for issue #76, regular users can gain admin privileges via su +ex -s /etc/pam.d/su <<'EOF' +# allow vagrant to use su, but prevent others from becoming root or vagrant +/^account\s\+sufficient\s\+pam_succeed_if.so uid = 0 use_uid quiet$/ +:append +account [success=1 default=ignore] \\ + pam_succeed_if.so user = vagrant use_uid quiet +account required pam_succeed_if.so user notin root:vagrant +. +:update +:quit +EOF + +# systemd should generate a new machine id during the first boot, to +# avoid having multiple Vagrant instances with the same id in the local +# network. /etc/machine-id should be empty, but it must exist to prevent +# boot errors (e.g. systemd-journald failing to start). +:>/etc/machine-id + +echo 'vag' > /etc/yum/vars/infra + +# Blacklist the floppy module to avoid probing timeouts +echo blacklist floppy > /etc/modprobe.d/nofloppy.conf +chcon -u system_u -r object_r -t modules_conf_t /etc/modprobe.d/nofloppy.conf + +# Customize the initramfs +pushd /etc/dracut.conf.d +# Enable VMware PVSCSI support for VMware Fusion guests. +echo 'add_drivers+=" vmw_pvscsi "' > vmware-fusion-drivers.conf +echo 'add_drivers+=" hv_netvsc hv_storvsc hv_utils hv_vmbus hid-hyperv "' > hyperv-drivers.conf +# There's no floppy controller, but probing for it generates timeouts +echo 'omit_drivers+=" floppy "' > nofloppy.conf +popd +# Fix the SELinux context of the new files +restorecon -f - <> /etc/fstab + +# sudo +echo "%vagrant ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/vagrant +chmod 0440 /etc/sudoers.d/vagrant + +# Fix for https://github.com/CentOS/sig-cloud-instance-build/issues/38 +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +PERSISTENT_DHCLIENT="yes" +EOF + +# sshd: disable password authentication and DNS checks +# for virtualbox we're disabling it after provisioning +cat >>/etc/sysconfig/sshd <> /home/vagrant/.ssh/authorized_keys +chmod 600 /home/vagrant/.ssh/authorized_keys +chown -R vagrant:vagrant /home/vagrant/.ssh + +# Fix for issue #76, regular users can gain admin privileges via su +ex -s /etc/pam.d/su <<'EOF' +# allow vagrant to use su, but prevent others from becoming root or vagrant +/^account\s\+sufficient\s\+pam_succeed_if.so uid = 0 use_uid quiet$/ +:append +account [success=1 default=ignore] \\ + pam_succeed_if.so user = vagrant use_uid quiet +account required pam_succeed_if.so user notin root:vagrant +. +:update +:quit +EOF + +# Install VBoxGuestAdditions for installed kernel +kver=$(rpm -q --queryformat="%{VERSION}-%{RELEASE}.%{ARCH}" kernel) +echo "stg/rocky" > /etc/dnf/vars/contentdir +sed -i 's/^#baseurl/baseurl/g;s/^mirrorlist/#mirrorlist/g' /etc/yum.repos.d/rocky*repo +dnf -y install kernel-headers-$kver kernel-devel gcc make perl elfutils-libelf-devel +sed -i 's/^baseurl/#baseurl/g;s/^#mirrorlist/mirrorlist/g' /etc/yum.repos.d/rocky*repo +echo "pub/rocky" > /etc/dnf/vars/contentdir +curl -L -o /tmp/vboxadditions.iso https://download.virtualbox.org/virtualbox/6.1.40/VBoxGuestAdditions_6.1.40.iso +mkdir -p /media/VBoxGuestAdditions +mount -o loop,ro /tmp/vboxadditions.iso /media/VBoxGuestAdditions +mkdir -p /tmp/VBoxGuestAdditions +sh /media/VBoxGuestAdditions/VBoxLinuxAdditions.run --nox11 --noexec --keep --target /tmp/VBoxGuestAdditions +pushd /tmp/VBoxGuestAdditions +./install.sh +/sbin/rcvboxadd quicksetup all +popd +ls "/lib/modules/${kver}/misc/" +modinfo "/lib/modules/${kver}/misc/vboxsf.ko" +rm -rf /tmp/VBoxGuestAdditions +umount /media/VBoxGuestAdditions +rm -f /tmp/vboxadditions.iso +rmdir /media/VBoxGuestAdditions +dnf -y remove kernel-devel gcc make perl elfutils-libelf-devel + +# systemd should generate a new machine id during the first boot, to +# avoid having multiple Vagrant instances with the same id in the local +# network. /etc/machine-id should be empty, but it must exist to prevent +# boot errors (e.g. systemd-journald failing to start). +:>/etc/machine-id + +echo 'vag' > /etc/yum/vars/infra + +# Blacklist the floppy module to avoid probing timeouts +echo blacklist floppy > /etc/modprobe.d/nofloppy.conf +chcon -u system_u -r object_r -t modules_conf_t /etc/modprobe.d/nofloppy.conf + +# Customize the initramfs +pushd /etc/dracut.conf.d +# Enable VMware PVSCSI support for VMware Fusion guests. +echo 'add_drivers+=" vmw_pvscsi "' > vmware-fusion-drivers.conf +echo 'add_drivers+=" hv_netvsc hv_storvsc hv_utils hv_vmbus hid-hyperv "' > hyperv-drivers.conf +# There's no floppy controller, but probing for it generates timeouts +echo 'omit_drivers+=" floppy "' > nofloppy.conf +popd +# Fix the SELinux context of the new files +restorecon -f - < /etc/tuned/active_profile + +cat << EOF | tee -a /etc/NetworkManager/conf.d/dhcp-timeout.conf +# Configure dhcp timeout to 300s by default +[connection] +ipv4.dhcp-timeout=300 +EOF + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# Remove build-time resolvers to fix #16948 +truncate -s 0 /etc/resolv.conf + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + +# azure settings +# Configure waagent for cloud-init +sed -i 's/Provisioning.UseCloudInit=n/Provisioning.UseCloudInit=y/g' /etc/waagent.conf +sed -i 's/Provisioning.Enabled=y/Provisioning.Enabled=n/g' /etc/waagent.conf + +# Azure: handle sr-iov and networkmanaeger +cat << EOF | tee -a /etc/udev/rules.d/68-azure-sriov-nm-unmanaged.rules +# Accelerated Networking on Azure exposes a new SRIOV interface to the VM. +# This interface is transparently bonded to the synthetic interface, +# so NetworkManager should just ignore any SRIOV interfaces. +SUBSYSTEM=="net", DRIVERS=="hv_pci", ACTION=="add", ENV{NM_UNMANAGED}="1" +EOF + +# Azure: Time sync for linux +## Setup udev rule for ptp_hyperv +cat << EOF | tee -a /etc/udev/rules.d/98-hyperv-ptp.rules +## See: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync#check-for-ptp-clock-source +SUBSYSTEM=="ptp", ATTR{clock_name}=="hyperv", SYMLINK += "ptp_hyperv" +EOF + +# Configure chrony to use ptp_hyperv +cat << EOF | tee -a /etc/chrony.conf +# Setup hyperv PTP device as refclock +refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2 +EOF + +# Azure: Blacklist modules +cat << EOF | tee -a /etc/modprobe.d/azure-blacklist.conf +blacklist amdgpu +blacklist nouveau +blacklist radeon +EOF + +# Azure: cloud-init customizations for Hyperv +cat << EOF | tee /etc/cloud/cloud.cfg.d/10-azure-kvp.cfg +# Enable logging to the Hyper-V kvp in Azure +reporting: + logging: + type: log + telemetry: + type: hyperv +EOF + +# Kernel and Drivers +# Add drivers when building in VMWare, Vbox, or KVM (KVM) +cat << EOF | tee -a /etc/dracut.conf.d/80-azure.conf +add_drivers+=" hv_vmbus hv_netvsc hv_storvsc " +EOF + +dracut -f -v + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers + +# this shouldn't be the case, but we'll do it anyway +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/product-id.conf +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/subscription-manager.conf + +dnf clean all +truncate -c -s 0 /var/log/dnf.log + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'azure' > /etc/yum/vars/infra + +# Azure Cleanup +sudo rm -f /var/log/waagent.log +sudo cloud-init clean +waagent -force -deprovision+user + +# Common cleanup +rm -f ~/.bash_history +export HISTSIZE=0 + +rm -f /var/lib/systemd/random-seed +rm -rf /root/anaconda-ks.cfg +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf "/var/lib/yum/*" +rm -rf "/var/log/anaconda*" +rm -rf /var/log/yum.log + +# Wipe machineid +cat /dev/null > /etc/machine-id + +# Fix selinux +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +true + +%end diff --git a/cloud/rocky-azure-lvm.ks b/cloud/rocky-azure-lvm.ks new file mode 100644 index 0000000..2966d10 --- /dev/null +++ b/cloud/rocky-azure-lvm.ks @@ -0,0 +1,171 @@ +%include rocky-cloud-base.ks +%include rocky-cloud-parts-lvm.ks +%include rocky-cloud-azure-packages.ks + +bootloader --append="rootdelay=300 console=ttyS0 earlyprintk=ttyS0 no_timer_check crashkernel=auto net.ifnames=0" --location=mbr --timeout=1 + +%post --erroronfail +passwd -d root +passwd -l root + +systemctl enable waagent + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# Common Cloud Tweaks +# setup systemd to boot to the right runlevel +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +# remove linux-firmware as we're virt and it's half a gig +dnf -C -y remove linux-firmware + +# Remove firewalld; it is required to be present for install/image building. +# but we dont ship it in cloud +dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1" +dnf -C -y remove avahi\* +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +echo "virtual-guest" > /etc/tuned/active_profile + +cat << EOF | tee -a /etc/NetworkManager/conf.d/dhcp-timeout.conf +# Configure dhcp timeout to 300s by default +[connection] +ipv4.dhcp-timeout=300 +EOF + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# Remove build-time resolvers to fix #16948 +truncate -s 0 /etc/resolv.conf + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + +# azure settings +# Configure waagent for cloud-init +sed -i 's/Provisioning.UseCloudInit=n/Provisioning.UseCloudInit=y/g' /etc/waagent.conf +sed -i 's/Provisioning.Enabled=y/Provisioning.Enabled=n/g' /etc/waagent.conf + +# Azure: handle sr-iov and networkmanaeger +cat << EOF | tee -a /etc/udev/rules.d/68-azure-sriov-nm-unmanaged.rules +# Accelerated Networking on Azure exposes a new SRIOV interface to the VM. +# This interface is transparently bonded to the synthetic interface, +# so NetworkManager should just ignore any SRIOV interfaces. +SUBSYSTEM=="net", DRIVERS=="hv_pci", ACTION=="add", ENV{NM_UNMANAGED}="1" +EOF + +# Azure: Time sync for linux +## Setup udev rule for ptp_hyperv +cat << EOF | tee -a /etc/udev/rules.d/98-hyperv-ptp.rules +## See: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync#check-for-ptp-clock-source +SUBSYSTEM=="ptp", ATTR{clock_name}=="hyperv", SYMLINK += "ptp_hyperv" +EOF + +# Configure chrony to use ptp_hyperv +cat << EOF | tee -a /etc/chrony.conf +# Setup hyperv PTP device as refclock +refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2 +EOF + +# Azure: Blacklist modules +cat << EOF | tee -a /etc/modprobe.d/azure-blacklist.conf +blacklist amdgpu +blacklist nouveau +blacklist radeon +EOF + +# Azure: cloud-init customizations for Hyperv +cat << EOF | tee /etc/cloud/cloud.cfg.d/10-azure-kvp.cfg +# Enable logging to the Hyper-V kvp in Azure +reporting: + logging: + type: log + telemetry: + type: hyperv +EOF + +# Kernel and Drivers +# Add drivers when building in VMWare, Vbox, or KVM (KVM) +cat << EOF | tee -a /etc/dracut.conf.d/80-azure.conf +add_drivers+=" hv_vmbus hv_netvsc hv_storvsc " +EOF + +dracut -f -v + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers + +# this shouldn't be the case, but we'll do it anyway +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/product-id.conf +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/subscription-manager.conf + +dnf clean all +truncate -c -s 0 /var/log/dnf.log + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'azure' > /etc/yum/vars/infra + +# Azure Cleanup +sudo rm -f /var/log/waagent.log +sudo cloud-init clean +waagent -force -deprovision+user + +# Common cleanup +rm -f ~/.bash_history +export HISTSIZE=0 + +rm -f /var/lib/systemd/random-seed +rm -rf /root/anaconda-ks.cfg +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf "/var/lib/yum/*" +rm -rf "/var/log/anaconda*" +rm -rf /var/log/yum.log + +# Wipe machineid +cat /dev/null > /etc/machine-id + +# Fix selinux +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +# LVM Variant Fix, remove system.devices +rm -fv /etc/lvm/devices/system.devices + +true + +%end diff --git a/cloud/rocky-cloud-azure-packages.ks b/cloud/rocky-cloud-azure-packages.ks new file mode 100644 index 0000000..07201ee --- /dev/null +++ b/cloud/rocky-cloud-azure-packages.ks @@ -0,0 +1,55 @@ +%packages +@core +rocky-release +kernel +yum-utils +-aic94xx-firmware +-alsa-firmware +-alsa-lib +-alsa-tools-firmware +-ivtv-firmware +-iwl1000-firmware +-iwl100-firmware +-iwl105-firmware +-iwl135-firmware +-iwl2000-firmware +-iwl2030-firmware +-iwl3160-firmware +-iwl3945-firmware +-iwl4965-firmware +-iwl5000-firmware +-iwl5150-firmware +-iwl6000-firmware +-iwl6000g2a-firmware +-iwl6000g2b-firmware +-iwl6050-firmware +-iwl7260-firmware +-libertas-sd8686-firmware +-libertas-sd8787-firmware +-libertas-usb8388-firmware + +cloud-init +cloud-utils-growpart +gdisk +dracut-config-generic +grub2 +firewalld + +# some stuff that's missing from core or explicitly setting +tar +rsync +dhcp-client +NetworkManager +rng-tools +dnf-utils +chrony +WALinuxAgent +hyperv-daemons + +-biosdevname +-plymouth +-iprutils +-langpacks-* +-langpacks-en +-qemu-guest-agent +%end diff --git a/cloud/rocky-cloud-base-packages.ks b/cloud/rocky-cloud-base-packages.ks new file mode 100644 index 0000000..ba7c186 --- /dev/null +++ b/cloud/rocky-cloud-base-packages.ks @@ -0,0 +1,58 @@ +%packages +@core +rocky-release +dnf +kernel +yum +nfs-utils +dnf-utils +hostname +-aic94xx-firmware +-alsa-firmware +-alsa-lib +-alsa-tools-firmware +-ivtv-firmware +-iwl1000-firmware +-iwl100-firmware +-iwl105-firmware +-iwl135-firmware +-iwl2000-firmware +-iwl2030-firmware +-iwl3160-firmware +-iwl3945-firmware +-iwl4965-firmware +-iwl5000-firmware +-iwl5150-firmware +-iwl6000-firmware +-iwl6000g2a-firmware +-iwl6000g2b-firmware +-iwl6050-firmware +-iwl7260-firmware +-libertas-sd8686-firmware +-libertas-sd8787-firmware +-libertas-usb8388-firmware + +cloud-init +cloud-utils-growpart +python3-jsonschema +dracut-config-generic +-dracut-config-rescue +firewalld + +# some stuff that's missing from core or things we want +tar +tcpdump +rsync +rng-tools +cockpit-ws +cockpit-system +qemu-guest-agent +virt-what + +-biosdevname +-plymouth +-iprutils +# Fixes an s390x issue +#-langpacks-* +-langpacks-en +%end diff --git a/cloud/rocky-cloud-base.ks b/cloud/rocky-cloud-base.ks new file mode 100644 index 0000000..f0b6a58 --- /dev/null +++ b/cloud/rocky-cloud-base.ks @@ -0,0 +1,16 @@ +text +lang en_US.UTF-8 +keyboard us +timezone --utc UTC +# Disk +auth --enableshadow --passalgo=sha512 +selinux --enforcing +firewall --enabled --service=ssh +firstboot --disable +# Network information +network --bootproto=dhcp --device=link --activate --onboot=on +# Root password +services --disabled="kdump,rhsmcertd" --enabled="NetworkManager,sshd,rsyslog,chronyd,cloud-init,cloud-init-local,cloud-config,cloud-final,rngd" +rootpw --iscrypted thereisnopasswordanditslocked +url --url https://download.rockylinux.org/stg/rocky/10/BaseOS/$basearch/os/ +shutdown diff --git a/cloud/rocky-cloud-ocp-packages.ks b/cloud/rocky-cloud-ocp-packages.ks new file mode 100644 index 0000000..da845ae --- /dev/null +++ b/cloud/rocky-cloud-ocp-packages.ks @@ -0,0 +1,64 @@ +%packages +@core +chrony +dnf +yum +cloud-init +cloud-utils-growpart +NetworkManager +dracut-config-generic +epel-release +firewalld +gdisk +grub2 +kernel +nfs-utils +oci-utils +ovmd +rsync +tar +dnf-utils +yum-utils +-aic94xx-firmware +-alsa-firmware +-alsa-lib +-alsa-tools-firmware +-ivtv-firmware +-iwl100-firmware +-iwl1000-firmware +-iwl105-firmware +-iwl135-firmware +-iwl2000-firmware +-iwl2030-firmware +-iwl3160-firmware +-iwl3945-firmware +-iwl4965-firmware +-iwl5000-firmware +-iwl5150-firmware +-iwl6000-firmware +-iwl6000g2a-firmware +-iwl6000g2b-firmware +-iwl6050-firmware +-iwl7260-firmware +-libertas-sd8686-firmware +-libertas-sd8787-firmware +-libertas-usb8388-firmware +-biosdevname +-iprutils +-plymouth + +python3-jsonschema +qemu-guest-agent +dhcp-client +cockpit-ws +cockpit-system +-langpacks-* +-langpacks-en + + +iscsi-initiator-utils + +rocky-release +rocky-release-cloud +rng-tools +%end diff --git a/cloud/rocky-cloud-parts-base.ks b/cloud/rocky-cloud-parts-base.ks new file mode 100644 index 0000000..c7532c8 --- /dev/null +++ b/cloud/rocky-cloud-parts-base.ks @@ -0,0 +1,29 @@ +#zerombr +#clearpart --all --initlabel --disklabel=gpt +#reqpart +# This should allow BIOS, UEFI, and PReP booting. Trying to be as universal as +# possible. This is a similar setup to Fedora without the btrfs. +part /boot/efi --size=100 --fstype=efi --asprimary +part /boot --size=1000 --fstype=xfs --label=boot +part prepboot --size=4 --fstype=prepboot --asprimary +part biosboot --size=1 --fstype=biosboot --asprimary +part / --size=8000 --fstype="xfs" --mkfsoptions "-m bigtime=0,inobtcount=0" + +%pre +# Clear the Master Boot Record +dd if=/dev/zero of=/dev/vda bs=512 count=1 +# Create a new GPT partition table +parted /dev/vda mklabel gpt +# Create a partition for /boot/efi +parted /dev/vda mkpart primary fat32 1MiB 100MiB +parted /dev/vda set 1 boot on +# Create a partition for /boot +parted /dev/vda mkpart primary xfs 100MiB 1100MiB +# Create a partition for prep +parted /dev/vda mkpart primary 1100MiB 1104MiB +# Create a partition for bios_grub +parted /dev/vda mkpart primary 1104MiB 1105MiB +# Create a partition for LVM +parted /dev/vda mkpart primary xfs 1106MiB 10.7GB + +%end diff --git a/cloud/rocky-cloud-parts-lvm.ks b/cloud/rocky-cloud-parts-lvm.ks new file mode 100644 index 0000000..8d765b6 --- /dev/null +++ b/cloud/rocky-cloud-parts-lvm.ks @@ -0,0 +1,33 @@ +#zerombr +#clearpart --all --initlabel --disklabel=gpt +#reqpart +# This should allow BIOS, UEFI, and PReP booting. Trying to be as universal as +# possible. This is a similar setup to Fedora without the btrfs. +part /boot/efi --fstype=efi --asprimary --onpart=vda1 +part /boot --fstype=xfs --label=boot --onpart=vda2 +part prepboot --fstype=prepboot --asprimary --onpart=vda3 +part biosboot --fstype=biosboot --asprimary --onpart=vda4 +part pv.01 --grow --onpart=vda5 + +volgroup rocky pv.01 +logvol / --vgname=rocky --size=8000 --name=root --grow --mkfsoptions "-m bigtime=0,inobtcount=0" + +%pre +# Clear the Master Boot Record +dd if=/dev/zero of=/dev/vda bs=512 count=1 +# Create a new GPT partition table +parted /dev/vda mklabel gpt +# Create a partition for /boot/efi +parted /dev/vda mkpart primary fat32 1MiB 100MiB +parted /dev/vda set 1 boot on +# Create a partition for /boot +parted /dev/vda mkpart primary xfs 100MiB 1100MiB +# Create a partition for prep +parted /dev/vda mkpart primary 1100MiB 1104MiB +# Create a partition for bios_grub +parted /dev/vda mkpart primary 1104MiB 1105MiB +# Create a partition for LVM +parted /dev/vda mkpart primary ext2 1106MiB 10.7GB +parted /dev/vda set 5 lvm on + +%end diff --git a/cloud/rocky-ec2-base.ks b/cloud/rocky-ec2-base.ks new file mode 100644 index 0000000..ef84f93 --- /dev/null +++ b/cloud/rocky-ec2-base.ks @@ -0,0 +1,137 @@ +%include rocky-cloud-base.ks +%include rocky-cloud-parts-base.ks +%include rocky-cloud-base-packages.ks + +bootloader --append="console=ttyS0,115200n8 console=tty0 net.ifnames=0 rd.blacklist=nouveau nvme_core.io_timeout=4294967295" --location=mbr --timeout=1 + +%post --erroronfail +passwd -d root +passwd -l root + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# setup systemd to boot to the right runlevel +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +dnf -C -y remove linux-firmware + +# Remove firewalld; it is required to be present for install/image building. +# but we dont ship it in cloud +dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1" +dnf -C -y remove avahi\* +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# this should *really* be an empty file - gotta make anaconda happy +truncate -s 0 /etc/resolv.conf + +# For cloud images, 'eth0' _is_ the predictable device name, since +# we don't want to be tied to specific virtual (!) hardware +rm -f /etc/udev/rules.d/70* +ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules + +# simple eth0 config, again not hard-coded to the build hardware +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +USERCTL="yes" +PEERDNS="yes" +IPV6INIT="no" +PERSISTENT_DHCLIENT="1" +EOF + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +if ! grep -q growpart /etc/cloud/cloud.cfg; then + sed -i 's/ - resizefs/ - growpart\n - resizefs/' /etc/cloud/cloud.cfg +fi + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers + +# this shouldn't be the case, but we'll do it anyway +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/product-id.conf +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/subscription-manager.conf + +dnf clean all +truncate -c -s 0 /var/log/dnf.log + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'ec2' > /etc/yum/vars/infra + +rm -rf /var/log/yum.log +rm -rf "/var/lib/yum/*" +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf /root/anaconda-ks.cfg +rm -rf /var/log/anaconda* + +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +# remove these for ec2 debugging +sed -i -e 's/ rhgb quiet//' /boot/grub/grub.conf + +cat > /etc/modprobe.d/blacklist-nouveau.conf << EOL +blacklist nouveau +EOL + +# enable resizing on copied AMIs +echo 'install_items+=" sgdisk "' > /etc/dracut.conf.d/sgdisk.conf + +# Only x86 has xen support at this time +if [[ "$(arch)" == "x86_64" ]]; then + echo 'add_drivers+=" xen-netfront xen-blkfront "' > /etc/dracut.conf.d/xen.conf +fi + +# Rerun dracut for the installed kernel (not the running kernel): +KERNEL_VERSION=$(rpm -q kernel --qf '%{V}-%{R}.%{arch}\n') +dracut -f /boot/initramfs-$KERNEL_VERSION.img $KERNEL_VERSION + +cat /dev/null > /etc/machine-id + +cat >> /etc/chrony.conf << EOF + +# Amazon Time Sync Service +server 169.254.169.123 prefer iburst minpoll 4 maxpoll 4 +EOF + +%end diff --git a/cloud/rocky-ec2-lvm.ks b/cloud/rocky-ec2-lvm.ks new file mode 100644 index 0000000..4c25aab --- /dev/null +++ b/cloud/rocky-ec2-lvm.ks @@ -0,0 +1,140 @@ +%include rocky-cloud-base.ks +%include rocky-cloud-parts-lvm.ks +%include rocky-cloud-base-packages.ks + +bootloader --append="console=ttyS0,115200n8 console=tty0 net.ifnames=0 rd.blacklist=nouveau nvme_core.io_timeout=4294967295" --location=mbr --timeout=1 + +%post --erroronfail +passwd -d root +passwd -l root + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# setup systemd to boot to the right runlevel +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +dnf -C -y remove linux-firmware + +# Remove firewalld; it is required to be present for install/image building. +# but we dont ship it in cloud +dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1" +dnf -C -y remove avahi\* +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# this should *really* be an empty file - gotta make anaconda happy +truncate -s 0 /etc/resolv.conf + +# For cloud images, 'eth0' _is_ the predictable device name, since +# we don't want to be tied to specific virtual (!) hardware +rm -f /etc/udev/rules.d/70* +ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules + +# simple eth0 config, again not hard-coded to the build hardware +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +USERCTL="yes" +PEERDNS="yes" +IPV6INIT="no" +PERSISTENT_DHCLIENT="1" +EOF + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +if ! grep -q growpart /etc/cloud/cloud.cfg; then + sed -i 's/ - resizefs/ - growpart\n - resizefs/' /etc/cloud/cloud.cfg +fi + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers + +# this shouldn't be the case, but we'll do it anyway +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/product-id.conf +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/subscription-manager.conf + +dnf clean all +truncate -c -s 0 /var/log/dnf.log + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'ec2' > /etc/yum/vars/infra + +rm -rf /var/log/yum.log +rm -rf "/var/lib/yum/*" +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf /root/anaconda-ks.cfg +rm -rf /var/log/anaconda* + +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +# remove these for ec2 debugging +sed -i -e 's/ rhgb quiet//' /boot/grub/grub.conf + +cat > /etc/modprobe.d/blacklist-nouveau.conf << EOL +blacklist nouveau +EOL + +# enable resizing on copied AMIs +echo 'install_items+=" sgdisk "' > /etc/dracut.conf.d/sgdisk.conf + +# Only x86 has xen support at this time +if [[ "$(arch)" == "x86_64" ]]; then + echo 'add_drivers+=" xen-netfront xen-blkfront "' > /etc/dracut.conf.d/xen.conf +fi + +# Rerun dracut for the installed kernel (not the running kernel): +KERNEL_VERSION=$(rpm -q kernel --qf '%{V}-%{R}.%{arch}\n') +dracut -f /boot/initramfs-$KERNEL_VERSION.img $KERNEL_VERSION + +cat /dev/null > /etc/machine-id + +cat >> /etc/chrony.conf << EOF + +# Amazon Time Sync Service +server 169.254.169.123 prefer iburst minpoll 4 maxpoll 4 +EOF + +# LVM Variant Fix, remove system.devices +rm -fv /etc/lvm/devices/system.devices + +%end diff --git a/cloud/rocky-genclo-base.ks b/cloud/rocky-genclo-base.ks new file mode 100644 index 0000000..bc876f4 --- /dev/null +++ b/cloud/rocky-genclo-base.ks @@ -0,0 +1,128 @@ +%include rocky-cloud-base.ks +%include rocky-cloud-parts-base.ks +%include rocky-cloud-base-packages.ks + +bootloader --append="console=ttyS0,115200n8 no_timer_check crashkernel=auto net.ifnames=0" --location=mbr --timeout=1 + +%post --erroronfail +passwd -d root +passwd -l root + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# setup systemd to boot to the right runlevel +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +# we don't need this in virt +dnf -C -y remove linux-firmware + +# Remove firewalld; it is required to be present for install/image building. +# but we dont ship it in cloud +dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1" +dnf -C -y remove avahi\* +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# this should *really* be an empty file - gotta make anaconda happy +truncate -s 0 /etc/resolv.conf + +# For cloud images, 'eth0' _is_ the predictable device name, since +# we don't want to be tied to specific virtual (!) hardware +rm -f /etc/udev/rules.d/70* +ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules +rm -f /etc/sysconfig/network-scripts/ifcfg-* + +# simple eth0 config, again not hard-coded to the build hardware +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +BOOTPROTOv6="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +USERCTL="yes" +PEERDNS="yes" +IPV6INIT="yes" +PERSISTENT_DHCLIENT="1" +EOF + +echo "virtual-guest" > /etc/tuned/active_profile + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + +#systemctl mask tmp.mount + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +# just in case +if ! grep -q growpart /etc/cloud/cloud.cfg; then + sed -i 's/ - resizefs/ - growpart\n - resizefs/' /etc/cloud/cloud.cfg +fi +# temporary until 22.2 +sed -i 's/^system_info:/locale: C.UTF-8\nsystem_info:/' /etc/cloud/cloud.cfg + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg + +# these shouldn't be enabled, but just in case +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/product-id.conf +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/subscription-manager.conf + +dnf clean all + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'genclo' > /etc/yum/vars/infra + +rm -rf /var/log/yum.log +rm -rf /var/lib/yum/* +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf /root/anaconda-ks.cfg +rm -rf /var/log/anaconda* + +echo "Fixing SELinux contexts." +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +rm -f /var/lib/systemd/random-seed +cat /dev/null > /etc/machine-id + +# reorder console entries +#sed -i 's/console=tty0/console=tty0 console=ttyS0,115200n8/' /boot/grub2/grub.cfg + +true + +%end diff --git a/cloud/rocky-genclo-lvm.ks b/cloud/rocky-genclo-lvm.ks new file mode 100644 index 0000000..1a6b160 --- /dev/null +++ b/cloud/rocky-genclo-lvm.ks @@ -0,0 +1,131 @@ +%include rocky-cloud-base.ks +%include rocky-cloud-parts-lvm.ks +%include rocky-cloud-base-packages.ks + +bootloader --append="console=ttyS0,115200n8 no_timer_check crashkernel=auto net.ifnames=0" --location=mbr --timeout=1 + +%post --erroronfail +passwd -d root +passwd -l root + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# setup systemd to boot to the right runlevel +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +# we don't need this in virt +dnf -C -y remove linux-firmware + +# Remove firewalld; it is required to be present for install/image building. +# but we dont ship it in cloud +dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1" +dnf -C -y remove avahi\* +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# this should *really* be an empty file - gotta make anaconda happy +truncate -s 0 /etc/resolv.conf + +# For cloud images, 'eth0' _is_ the predictable device name, since +# we don't want to be tied to specific virtual (!) hardware +rm -f /etc/udev/rules.d/70* +ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules +rm -f /etc/sysconfig/network-scripts/ifcfg-* + +# simple eth0 config, again not hard-coded to the build hardware +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +BOOTPROTOv6="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +USERCTL="yes" +PEERDNS="yes" +IPV6INIT="yes" +PERSISTENT_DHCLIENT="1" +EOF + +echo "virtual-guest" > /etc/tuned/active_profile + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + +#systemctl mask tmp.mount + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +# just in case +if ! grep -q growpart /etc/cloud/cloud.cfg; then + sed -i 's/ - resizefs/ - growpart\n - resizefs/' /etc/cloud/cloud.cfg +fi +# temporary until 22.2 +sed -i 's/^system_info:/locale: C.UTF-8\nsystem_info:/' /etc/cloud/cloud.cfg + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg + +# these shouldn't be enabled, but just in case +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/product-id.conf +sed -i 's|^enabled=1|enabled=0|' /etc/yum/pluginconf.d/subscription-manager.conf + +dnf clean all + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'genclo' > /etc/yum/vars/infra + +rm -rf /var/log/yum.log +rm -rf /var/lib/yum/* +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf /root/anaconda-ks.cfg +rm -rf /var/log/anaconda* + +echo "Fixing SELinux contexts." +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +rm -f /var/lib/systemd/random-seed +cat /dev/null > /etc/machine-id + +# reorder console entries +#sed -i 's/console=tty0/console=tty0 console=ttyS0,115200n8/' /boot/grub2/grub.cfg + +# LVM Variant Fix, remove system.devices +rm -fv /etc/lvm/devices/system.devices + +true + +%end diff --git a/cloud/rocky-ocp-base.ks b/cloud/rocky-ocp-base.ks new file mode 100644 index 0000000..03ac0f8 --- /dev/null +++ b/cloud/rocky-ocp-base.ks @@ -0,0 +1,345 @@ +%include rocky-cloud-base.ks +%include rocky-cloud-parts-lvm.ks +%include rocky-cloud-ocp-packages.ks + +repo --name "sig-cloud-common" --baseurl=http://dl.rockylinux.org/stg/sig/9/cloud/$basearch/cloud-common/ --includepkgs="oci-utils,python3-circuitbreaker,python3-daemon,python3-sdnotify,python39-oci-sdk" --cost=100 +repo --name "extras" --baseurl=http://dl.rockylinux.org/stg/rocky/10/extras/$basearch/os/ +repo --name=epel --cost=200 --baseurl=https://dl.fedoraproject.org/pub/epel/10/Everything/$basearch/ + +bootloader --append="console=ttyS0,115200n8 console=tty0 no_timer_check crashkernel=auto net.ifnames=0 LANG=en_US.UTF-8 transparent_hugepage=never rd.luks=0 rd.md=0 rd.dm=0 rd.lvm.vg=rocky rd.lvm.lv=rocky/root rd.net.timeout.dhcp=10" --location=mbr --timeout=1 --boot-drive=vda + +%post --erroronfail + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# setup systemd to boot to the right runlevel +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +dnf -C -y remove linux-firmware + +# Remove firewalld; it is required to be present for install/image building. +# but we dont ship it in cloud +dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1" +dnf -C -y remove avahi\* +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# Remove build-time resolvers to fix #16948 +echo > /etc/resolv.conf + +# For cloud images, 'eth0' _is_ the predictable device name, since +# we don't want to be tied to specific virtual (!) hardware +rm -f /etc/udev/rules.d/70* +ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules + +# simple eth0 config, again not hard-coded to the build hardware +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +USERCTL="yes" +PEERDNS="yes" +IPV6INIT="no" +PERSISTENT_DHCLIENT="1" +EOF + +echo "virtual-guest" > /etc/tuned/active_profile + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + +systemctl mask tmp.mount + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg + +# disable cloud kernel repo as it's not needed +sed -i 's/enabled=1/enabled=0/' /etc/yum.repos.d/Rocky-SIG-Cloud-Kernel.repo + +dnf clean all + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'oci' > /etc/yum/vars/infra + +# change dhcp client retry/timeouts to resolve #6866 +cat >> /etc/dhcp/dhclient.conf << EOF + +timeout 300; +retry 60; +EOF + +# OCI - Import repo GPG key +cat < /tmp/key +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGHncu8BEAC2dhocMZkdapnP9o/MvAnKOczaSpF4Cj9yqt49bxLPJCY57jz9 +2ZkJ5iGk6kpBt4rPTh18aAl30T+nPP8VMQjMhvHJKfZmBtaJJ5RpvvpK5mj1UgRJ +4DQX7gqAbT0s/uZZcouZsJzXo3c7GNMrim1C+ScfGG6BoB6GVBK74jFeJNMsxZ2Y +BwQhpE+KG+1zD94RZCySykJjNoKj+U4W5H2XdB/mNEc8icFqxjJGZ5BN0DA2Wqxn +mwELTO3Q2ne1y9+sPn2YKhRqyihuZYaUPR/Jpdki93mk61MdaoTTxFPZ8FWAYrAW +9KVdreT8K33SaTFFpmhbpndPEYesgCqDqiZG7Ywjgbf2nqSOzBr2ZX23PX7QUCvQ +ar58bNbWENLhC3B950TK+r23kkPa3GICE9WP5TftWJdbJMWRBX3YhdNooNGGCbeB +xM7B/UV9hSRx1S/US8HvDhJezZDuKrpPXrNWJTuW9Kty2WGwUkEDT2GBbcjx9ocJ +fqyNJKhaLoYKCVlsmhJUi4xCY0CDDapekWLZOzHB2zgT49uIjawV5ex6pA7oLaPI +hQGvTcCl7GFWOP/6feazzIpnsJ4V3B2DoLnAevpZlINo/bi3Hv/YmbvE6NyYzD6c +1y90pc0+Om1trLPCAZpaO1I369ZhLl6T/mCd92hrCG1y8K3PFiRIKpEMVwARAQAB +tDVPcmFjbGUgTGludXggKHJlbGVhc2Uga2V5IDEpIDxzZWNhbGVydF91c0BvcmFj +bGUuY29tPokCVAQTAQoAPhYhBD5tgm0/urOJwvOONLxNBqCNi3VvBQJinlnsAhsD +BQklmAYABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJELxNBqCNi3Vv3LEP/2au +kXzbdA/T/7i+4AbGFfYnTWqmZy58wfteDNy1sk6cPmfOUqZQXUrJcSGqqeIDjPvl +KNExpee/Ja4NGg2YfzkwH5IK5sXmEDKObXRCXGZh9/WyYpr4TBoDU2rSYBP4sbKm +PsnVoRalt2Zb0qbQF8GilytoRabjI0gLzwhmoHBZMMc3MIO14KQ5yFbekaJZKcxE +BxaDQ1NDZV1rOVbkg0yDLS9Nw89dDYWVn1wx0foRJcD277ExvmaB4vmC5yayo4ss +cFldYLu7W9FHmh46flXQGfduORCbDFfjn92eB0jdrkuoEhVRpljAtMO15GMpuVbv +HzbImI2f1MfydOa6dHbRAlzeV37fPz+1nO9IWdXqFeRG0nrH2gB02AfeoObMkK/a +XYT9sq1mC5DaK6fbOPWlY+c2hIq0BhUpe+OBdDfmm7L+si9Ffj2sUdn4sHLN6Tj7 +BrJuWmJEz42+rblDNBkrdBC6XXDaRYILKSuGD65PVV+/pVl1c2EOqcktW00iiehb +eLhj2sz6NaoO5Rhx0J3pMsaCaEBAm8P6UxQSx4iGhZ8Kh5O1SVVlqu3xOhSGOKRE +sS8gIjeV/Jl3frR4eZG/BpzdTjKZmQV7dvJ4gDuDE+X7rZBzUm7nggyE2pV6UbTD +5Qwy+ASQfYHfHK4lsHD4kbO/We6H1fEFPlzlr14UuQINBGHncu8BEADBG52gWRob +VEsQIzAfq2obFnwMroxMupXrDBka7i6cUJw8HsqyHs9maGxAuRDlAma2MBPUYcbm +DH3bmctaUR7CA1RouPkb6qbZXwSwpvgN4eh4naPX20/VEp/cd5DhKWjP9yC70weh +r4LmGWV41jBAMK0G1l6+FDw2ITgsamZP+tw0swCKqzpIY2waiygCtPHCCCFMuZ6S +7hzQpsKVFh8zqzRxMs6Mni9olk4+xwng0ahYfoe2esByR2M1kGX62Y6BOcIRX1cE +zYFCUww5GrjZdJoObBtffUSz+q2LNOBcqg5huRd8BoC+k5yrXUq8ypspfV1kNEI3 +/ebFew6A8sdf2c+sOdTxTu4MI5iXM1fhCC6X4lAN8w1Ga3ML+k/kgL75mH62Yyzr +OHXNkylTDfxz9qvq6qszVfWdzVaGXRfulW5nAbAXhuX1gmgZW+M7IQ22xyWC+I60 +UcaE2l9QtHFKuekdYnekTkSUA0ghVwuw+JCQZGQbq5LqbA5TkEYuibBOJD3MZYQ5 +C3DK4KHs/3wxf2aq+Pkf3mpSscC4B0Ba5tlpJawUWqnUmGd208sfUwD20MFfHM+1 +N+M6JYCv0tC0cyAV9Jq74bAUDXLMfkGKZyAWmlPaZBMMt4WaN0r2PAKp00T6PX6x +jTM6/aNDvNTpsaaUpMXRzH13AiJ/1SjfZwARAQABiQI8BBgBCgAmAhsMFiEEPm2C +bT+6s4nC8440vE0GoI2LdW8FAmKeWsgFCSRtulkACgkQvE0GoI2LdW/pig//Zi0a +bmFJKTxku0/LMI31ZaLn9gzXjv2ugmJumfXAce+nlaheCNBa+IMLQdAmrbislzLs +qXX2+6Eqh4Q/vqGLCkElIzT9ulkgwwEp0cVF6jnXqlWHa0a/T6oAq10jRneaQFCE +t6hweJ9KTUQufp5aAiZr/GVpBJLJ8kfOx+5eHvDj+VFlFUhpzzns/NfN5N+bthJ/ +Wbt49tzmWaWoEFA0tlwMBPO3zEh/mo5lys0GqENPs4Yb4tL82qg+SG7jHSuH2lZk +XLLyLQ6p63VZysL9+UTBtafs5jxnTopQFIXtzAOwdtQ8o7/6hhsUchRoUy23EIHT +J25yA2Qtb8Z/1m/G0e3lz46xHBPIs8FKSOPToCT6E1+9lomnzJPRBCCDTZO5imfX +4N4l7BodW9nb7zEMHCi2BUM+InpSsEkQkQFs0HIRI2KHSyY30uN0pVXJLOoVQIBr +WdUzLTTkN9w43fLpkcFXGbpU+pZvK2uksC3O+eBhIpZA9E7iZDwfEaZlUKO5kFvS +V5f8ZM1jbEb0sOZNNNEaEhTFTl8pQPc2GqgZ3rYt9mqH5OwhzKftV9PDYulIbY+Y +AN6eJhHj8Eu/IlxG6iYCDmF2hOVPs9aLo9zqdxbu8B6rUyVPOwfNbOR1U7WMRCYm +4QrtLe//99hXPcFVanIxgkdslnyYf4fjdbdlmNY= +=xpaH +-----END PGP PUBLIC KEY BLOCK----- +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGHndDkBEACieeO8U0kcUTDMLGXGKrJ3nScZ4LN5hHSzWC1zuLPpkB0YQdik +CrfSwodyp9LeEhaRsCSoGDc3cS5f5uGvsSUHMCZwEKjdT8LmZkF/dtvVDWawgaLS +KjoT+AJpss+ws0d/qmwkIHeYExdvZFNdKxvvxycCNy9fNwarT4aNySW6Ax7ERDl8 +k0QSK7uvL1AaWQKSz9rX//KcLv5OXVUX3ITcwprJPD3H2yTOy4pE9gxs/qKfnP+U +Pbb3pNaHP4PnCIQrjXhJxnH9cEJ7ef0kqBdliGPN7EObrP2uPg70WnVsXovYw/TF +PrA4H2lvJ58RVhh3ocrSnR+SIne7Lgf1FRSrsE2mmNZAWD6rOxOzO4kUrcfv/pqZ +f+sDs7KTFMO0noJ1Kt7JSV6xCQzeKGdOh9JxYI0/YIsquiHTF2xva3WHrpOG1sns +xXcnrLKONisg4gEK36fjsliG4jJhcNyJaAf4sfDiTKDOE5om+BZ7kMNSrMn20wg4 +AdZJm6x8Z0OfjxGOzMQ8re4Cf73H5odrpUel7HFGXiLWtk/f4P5EjxUTznlMbNED +gYi0H898Dz5Qfmtr97WQ8132fnKKtsPlXWNUNgJpYe+GvzmYOBAr4p5EZEWjB+q6 +EnfLDLpkaS+PbrpLCls5AnWnHjimBmlIMoO5GEsJdYLIQvVVvfKtEDJIBQARAQAB +tDRPcmFjbGUgTGludXggKGJhY2t1cCBrZXkgMSkgPHNlY2FsZXJ0X3VzQG9yYWNs +ZS5jb20+iQJUBBMBCgA+FiEEmCIxdZx0ZwZdDOmyp90HCItO++YFAmKewpICGwMF +CSWYBgAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQp90HCItO++bU+w//SFOe +RBqWoA5kP4BN9z716LpgkCllMRQsRZ0kZm8Enbe5S9ENn2T5/f6zZca3TNU6Wbit +ryToXuOlTsWy4BqAvQhQFeschg10Xgy6/VG3p5kCY4DIPOUjlb7/1r8k0xX6m/mH +BXBf2MCVRx/zkyeRDtD3lYHyz4cwoHEZ2NuB+CCe5WA2owVhgsRuVmjidDeOa7Q6 +61eLhAJ53OVqsUt5JpQS0KrVeYVJxCiiZnKgJMqHp26Jq0WIKtgBV3sakxhUpRUf +6ap7mnSAdh6Ae4r1+pTKd7trkxjIqLXH9RI0d7Xm+blRQVZJL9GLaLUaSvw4sfd/ +jfqENCBwAH7D488L1yvTqPfHC2+kRuUI3GU98RULCHveCISRGLVGwh1p88+9aok3 +DoV7/BUEIGbHzg3gcx8zFO2ZKKoJ7xS+vvNLAslPvHNDFH0XOwKBqlVztJprwWtA +H33e6fti7BMRw1vgljC8yVATBTiKXj5aw+25zi70o1fIFxpwsx5mwMmqHc634ai2 +hPWNZid0Lu3MYBd8pDCvMMMGimfecoyEZKJR2KbO+pNBn7suol5XS3pCmbF3ldMa +Atra+HvnxNBMxFVdxsqZhr/+ovQszYNIlWSYUDLbqk33HBmvbi3IuogAyxhLdw3T +uIjjf0acjOsSgy79ju2NpKPVtJw4BmvJRFX0Rh25Ag0EYed0OQEQAJRhf7/ZIWhZ +LpCX2vg8B4hjsEYeRvEAPUrUMHkqCuElmDaT7g76aPG0jvbMFVU/ykEt2mIi7EhW +s0SZknT5G8HoHJM2MirkyGB26yp4IlkPyNlc5H9nmMhY7iz/utxQps8jDS8dvxeG +1YAJGleGywGAet9vFfrLX9Xq9efTXozJfWOsRm+y2WklS+LblftaTUurStzLXRGT +AsBYOyVaRX/6AMu+fZt7mvoM+bOFNGxMSDIZi93wBiCKp0P2Se1YJoFHTOcQ0M6V +Fbl91ZcImPxAOX4DHfw4iuokiHCs//wV0DLZ3qtuqN2m/kV4JE9ak//BPVn4acH1 +Z6DQIzQpY66dIyLumGuCdPhl7MFHyAeKhBtLc7gp4+sli+zNUfYwwp55rTdZ9JDR +G2LD/P2eNnrUXEsvOzqqQy48BmzOmTdgc2vef85Z23GczwX1PyTaGnrQKkReajN0 +IxIuFpTgRQFBoPHTB1VVjSsOu7McWx4Gy2zccSrXKIskj4sOBIYBjxBAR0U4Gi5h +OAqplVGH3x3RoRb2swkc/LLb6WV6J7REmZ0+0dAE1ShBR8GmEb4wYc5BUgYXrhEn +hK3nmNx65jZXSAwJOZU8ETLaMoa/I/+QkgPvAJ8gyTLbMQ/xB2kMNRdisphz0jiy +PIXWlOf6I750VtbBNPHqfe0RHbBQJAl9ABEBAAGJAjwEGAEKACYCGwwWIQSYIjF1 +nHRnBl0M6bKn3QcIi0775gUCYp7C3AUJJG4hIwAKCRCn3QcIi0775nmYD/sEI0T4 ++MHIt5EzL+vBAzAbd23U2oF9KrJP49xmrLlm7qC6ghfuUVqoKwWyE24g8T4N3cxE +xQWTZ8drqvE2E2tyKqVMjJ5PfiZjK/3WOOIq9YZHpNKljv9KaAAf5alpvMxn6IBj +ZUhs775JcGWWngilBN9i3OEVFcQG9tFtfKqcYf8oRLPQlqhrH0pKOymFdqdL+NFX +G/M2LquGrvyDwnT2Cyy4p4sw639BUyA4k1hESgK9KVZTrmJPYU8hCD7kcSOY25UT +zDERLlXUsnGU9WHm/4aZ4TCs2h2qm29jHeWjfw0U/O8f4K5MV7WcJ0ZywdOk7SSf +jOKUetPH01l22I6JXiH0jLlBU5uA/zAxd8aPpvcYcWm2Ti+mkpIB6/XWbjnPoYHh +JmH8r9Pih1Z4dVR7qri/mdcsTZsKzLPuD6AITafJYuRCItCbMerhvGCwBaaR0oHS +AdpSzwKk8mrLd4BQUSM5a3E010dDeKGL4TA5ttfZJuSe7RXbi4RdDd98XHKEiU3n +N1ethSQNvEyrh0uA1U3FZvPMcbfYZa8zO85Nz9h/TGUNfmp5CyrZUHZLmvvGTOch +lUjaIhAGBVJQR/y7+4aC3zzkyzbKyLOL3hCk0xie4LLbfTQ5BtT4+GqEAtzwRQqZ +RgwnCPfIai7lLNx95bdwB8U2NpY11OXsoTLZAA== +=UWTf +-----END PGP PUBLIC KEY BLOCK----- +EOF + +rpm --import /tmp/key + + +rm -rf /var/log/yum.log +rm -rf "/var/lib/yum/*" +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf /root/anaconda-ks.cfg +rm -rf /var/log/anaconda* + +rm -f /var/lib/systemd/random-seed + +cat /dev/null > /etc/machine-id + +echo "Fixing SELinux contexts." +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +# remove these for debugging +sed -i -e 's/ rhgb quiet//' /boot/grub/grub.conf + +# enable resizing on copied AMIs +echo 'install_items+=" sgdisk "' > /etc/dracut.conf.d/sgdisk.conf + +# OCI - Need iscsi as a dracut module +echo 'add_dracutmodules+=" iscsi "' > /etc/dracut.conf.d/iscsi.conf + +# OCI - Virtio drivers +echo 'add_drivers+=" virtio virtio_blk virtio_net virtio_pci virtio_ring virtio_scsi virtio_console "' > /etc/dracut.conf.d/virtio.conf + +# OCI - YOLO +mkdir -p /usr/lib/dracut/modules.d/95oci +OCIDRACUT="H4sIAGtFHmMAA+2WWW/bOBCA/Vr+illZzQXoluPUhgMURYrmpS02fevuGpJIWYQVUiWpJoHr/15S +crLZZBs3QA8U5QfYosQ5NUNSrRRBTfMAi6xoVXDOcVsT6ePg2YgXNBh8C0LNeDTqrpq7124cpfF4 +nIzT8fhwEEaj+HA8gNE38b6FVqpMAAwE5+ohuW3zvyjtw/UnLMtr4lFZSOrlV00mpS+rR/rYUv84 +StJBlIx10ZNREscD/SRNkwGE3yXjO/zm9R/+EeSUBbJCQ/AOPNANQCYgK1LXniwEbdQUKMOEKU9l +ufT6eUbrqRby8kzSwuNlKYmaQDo1JrQhcjkBJWdHIC9mKUg9TIEoKGlN1FVDZtobGr7NVFFB11nm +3YLikNU1v4A8ozXwVgEtQVUEullM5RKKjGkZQTJ8BTmBkrcMo6Eg5QTeiCxvFxMYJmESxWGYImRc +wYLo8i7gOMDkY8Dauob4eCeCT5/Ah1uN7+mhbmx0+vrs5M93s10kZo67Mp6Hec2L5WTtIB1Oby3n +vIYQBPa76P1+XcDODrwHj4DjCgf+nprYGSDQlFwA69KgDNy93ooERpR5uD8FzDs5w3utv+qEnz6d +HKwdmIHTudE2TdgFZ4qyltwodGk2mZBk3snNO0dfTlh7vc722sQ9bcftInCMmiCqFQyiG+lN2HPC +ipm7J5WYC9LUWUH+VXMC/fsrLp39TgtzRuAe3RQpKr5JcAJnS9o0lC3AveXD930HjnfiR4lDl/7y +XC5uqUkjT7CZdgJ13gSdHbP+FcHebSNOr3VJFYSopGgXfWX1S21ZmgV109c3rYCuwzgxe6oJ+/Ts +xdkpbPR5oyhn15l+leR/kuw13L6BdeFAEgwehd3gn7fP372a+QdusBK9ilSYmniq9RTc1eU0MBKB +HnwI11P9n6x3/ycP3QsXme4E56VeoNr4g9GZt/az9zbLdrac//29p7f3tnn8wb9h2/dfchjdOf/D +OIns+f8j2Jz/+iD/4V8ARUWK5d4+rNCTzRkTojVCmDSEYXl/gjJdqrruJ8zNvOJ8CY0gXqt3NTg6 +0vufjg5T8YXvVkeb+dkv3GKxWCwWi8VisVgsFovFYrFYLBaLxWL5jnwGdMMrBgAoAAA=" + +base64 -d <<<"$OCIDRACUT" | tar -xz + +OCICLOUDCFG="IyBPQ0kgY2xvdWQtaW5pdCBjb25maWd1cmF0aW9uCmRhdGFzb3VyY2VfbGlzdDogWydPcmFjbGUn +LCAnT3BlblN0YWNrJ10KZGF0YXNvdXJjZToKICBPcGVuU3RhY2s6CiAgICBtZXRhZGF0YV91cmxz +OiBbJ2h0dHA6Ly8xNjkuMjU0LjE2OS4yNTQnXQogICAgdGltZW91dDogMTAKICAgIG1heF93YWl0 +OiAyMAoKIyBzd2FwIGZpbGUKc3dhcDoKICAgZmlsZW5hbWU6IC8uc3dhcGZpbGUKICAgc2l6ZTog +ImF1dG8iCgpjbG91ZF9pbml0X21vZHVsZXM6CiMgT0NJOiBkaXNrX3NldHVwIGlzIGRpc2FibGVk +CiMtIGRpc2tfc2V0dXAKIC0gbWlncmF0b3IKIC0gYm9vdGNtZAogLSB3cml0ZS1maWxlcwojIE9D +STogVGhlIGdyb3dwYXJ0IG1vZHVsZSBpcyBkaXNhYmxlZCBieSBkZWZhdWx0LiBUbyBlbmFibGUg +YXV0b21hdGljIGJvb3Qgdm9sdW1lIHJlc2l6aW5nLCB1bmNvbW1lbnQKIyB0aGUgYmVsb3cgZW50 +cnkgZm9yICctIGdyb3dwYXJ0JyBhbmQgcmVib290LiBBbGwgdGhlIGRlcGVuZGVudCBwYWNrYWdl +cyBmb3IgdGhlIGdyb3dwYXJ0CiMgbW9kdWxlIHRvIHdvcmsgc3VjaCBhcyBjbG91ZC11dGlscy1n +cm93cGFydCBhbmQgZ2Rpc2sgYXJlIGFscmVhZHkgaW5jbHVkZWQgaW4gdGhlIGltYWdlLgojLSBn +cm93cGFydAogLSByZXNpemVmcwojIE9DSTogc2V0X2hvc3RuYW1lLCB1cGRhdGVfaG9zdG5hbWUs +IHVwZGF0ZV9ldGNfaG9zdHMgYXJlIGRpc2FibGVkCiMtIHNldF9ob3N0bmFtZQojLSB1cGRhdGVf +aG9zdG5hbWUKIy0gdXBkYXRlX2V0Y19ob3N0cwogLSByc3lzbG9nCiAtIHVzZXJzLWdyb3Vwcwog +LSBzc2gKCmNsb3VkX2NvbmZpZ19tb2R1bGVzOgogLSBtb3VudHMKIC0gbG9jYWxlCiAtIHNldC1w +YXNzd29yZHMKIyBPQ0k6IHJoX3N1YnNjcmlwdGlvbiBpcyBkaXNhYmxlZAojLSByaF9zdWJzY3Jp +cHRpb24KIC0geXVtLWFkZC1yZXBvCiAtIHBhY2thZ2UtdXBkYXRlLXVwZ3JhZGUtaW5zdGFsbAog +LSB0aW1lem9uZQogLSBudHAKIC0gcHVwcGV0CiAtIGNoZWYKIC0gc2FsdC1taW5pb24KIC0gbWNv +bGxlY3RpdmUKIC0gZGlzYWJsZS1lYzItbWV0YWRhdGEKIC0gcnVuY21kCgpjbG91ZF9maW5hbF9t +b2R1bGVzOgogLSByaWdodHNjYWxlX3VzZXJkYXRhCiAtIHNjcmlwdHMtcGVyLW9uY2UKIC0gc2Ny +aXB0cy1wZXItYm9vdAogLSBzY3JpcHRzLXBlci1pbnN0YW5jZQogLSBzY3JpcHRzLXVzZXIKIC0g +c3NoLWF1dGhrZXktZmluZ2VycHJpbnRzCiAtIGtleXMtdG8tY29uc29sZQogLSBwaG9uZS1ob21l +CiAtIGZpbmFsLW1lc3NhZ2UKIyBPQ0k6IHBvd2VyLXN0YXRlLWNoYW5nZSBpcyBkaXNhYmxlZAoj +LSBwb3dlci1zdGF0ZS1jaGFuZ2UKCg==" + +base64 -d <<<"$OCICLOUDCFG" >> /etc/cloud/cloud.cfg.d/99_oci.cfg + +# Remove system.devices because Oracle does things. +rm -fv /etc/lvm/devices/system.devices + +# Start OCId +systemctl enable ocid + +# Rerun dracut for the installed kernel (not the running kernel): +KERNEL_VERSION=$(rpm -q kernel --qf '%%{V}-%%{R}.%%{arch}\n') +dracut -f /boot/initramfs-$KERNEL_VERSION.img $KERNEL_VERSION + +# OCI needs Iscsi +grubby --args="libiscsi.debug_libiscsi_eh=1 netroot=iscsi:169.254.0.2:::1:iqn.2015-02.oracle.boot:uefi ip=dhcp rd.iscsi.bypass rd.iscsi.param=node.session.timeo.replacement_timeout=6000" --update-kernel "/boot/vmlinuz-$KERNEL_VERSION" + +passwd -d root +passwd -l root + +# Copyright (C) 2020 Oracle Corp., Inc. All rights reserved. +# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl +# +# /usr/lib/oci-linux-config/cloud/scripts/initramfs-mod/net.sh +# + +echo "$(date) - OCI initramfs network modification script started." + +# Symlink network config files where cloud-init >= 19.4 expects them +DRACUT_CFG=/run/initramfs/state/etc/sysconfig/network-scripts +CI_DIR=/run +if [ -d $DRACUT_CFG ]; then + FILE_COUNT=`ls $DRACUT_CFG | wc -l` + if [ $FILE_COUNT -eq 0 ]; then + # Create dummy file if dracut did not create network device config + dummycfg=$CI_DIR/net-dummy.conf + echo "DEVICE=\"dummy\"" > $dummycfg + echo "BOOTPROTO=dhcp" >> $dummycfg + echo "$(date) - Creating dummy config $dummycfg." + else + for dcfg in $DRACUT_CFG/*; do + filename=${dcfg##*/} + devname=${filename##ifcfg-} + cicfg=$CI_DIR/net-$devname.conf + if [ ! -e $cicfg ]; then + echo "$(date) - Creating symlink from $dcfg to $cicfg." + ln -s $dcfg $cicfg + fi + done + fi +fi + +echo "$(date) - OCI initramfs network modification script done." + + +true + +%end diff --git a/cloud/rocky-ocp.ks b/cloud/rocky-ocp.ks new file mode 100644 index 0000000..adaeccb --- /dev/null +++ b/cloud/rocky-ocp.ks @@ -0,0 +1,379 @@ +%include rocky-cloud-base.ks +%include rocky-cloud-parts-lvm.ks +%include rocky-cloud-ocp-packages.ks + +repo --name "sig-cloud-common" --baseurl=http://dl.rockylinux.org/stg/sig/9/cloud/$basearch/cloud-common/ --includepkgs="oci-utils,python3-circuitbreaker,python3-daemon,python3-sdnotify,python39-oci-sdk" --cost=100 +repo --name "extras" --baseurl=http://dl.rockylinux.org/stg/rocky/10/extras/$basearch/os/ +repo --name="oraclelinux-addons" --baseurl=http://yum.oracle.com/repo/OracleLinux/OL10/addons/$basearch/ --excludepkgs="kernel,WALinuxAgent" --install +repo --name=epel --cost=200 --baseurl=https://dl.fedoraproject.org/pub/epel/10/Everything/$basearch/ --install + +bootloader --append="console=ttyS0,115200n8 console=tty0 no_timer_check crashkernel=auto net.ifnames=0 LANG=en_US.UTF-8 transparent_hugepage=never rd.luks=0 rd.md=0 rd.dm=0 rd.lvm.vg=rocky rd.lvm.lv=rocky/root rd.net.timeout.dhcp=10" --location=mbr --timeout=1 --boot-drive=vda + +%post --erroronfail + +# Attempting to force legacy BIOS boot if we boot from UEFI +if [ "$(arch)" = "x86_64" ]; then + dnf install grub2-pc-modules grub2-pc -y + grub2-install --target=i386-pc /dev/vda +fi + +# Ensure that the pmbr_boot flag is off +parted /dev/vda disk_set pmbr_boot off + +# setup systemd to boot to the right runlevel +rm -f /etc/systemd/system/default.target +ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target +echo . + +dnf -C -y remove linux-firmware + +# Remove firewalld; it is required to be present for install/image building. +# but we dont ship it in cloud +dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1" +dnf -C -y remove avahi\* +sed -i '/^#NAutoVTs=.*/ a\ +NAutoVTs=0' /etc/systemd/logind.conf + +cat > /etc/sysconfig/network << EOF +NETWORKING=yes +NOZEROCONF=yes +EOF + +# Remove build-time resolvers to fix #16948 +echo > /etc/resolv.conf + +# For cloud images, 'eth0' _is_ the predictable device name, since +# we don't want to be tied to specific virtual (!) hardware +rm -f /etc/udev/rules.d/70* +ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules + +# simple eth0 config, again not hard-coded to the build hardware +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +USERCTL="yes" +PEERDNS="yes" +IPV6INIT="no" +PERSISTENT_DHCLIENT="1" +EOF + +echo "virtual-guest" > /etc/tuned/active_profile + +# generic localhost names +cat > /etc/hosts << EOF +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 + +EOF +echo . + + +systemctl enable ocid +systemctl enable ovmd + +systemctl mask tmp.mount + +cat < /etc/sysconfig/kernel +# UPDATEDEFAULT specifies if new-kernel-pkg should make +# new kernels the default +UPDATEDEFAULT=yes + +# DEFAULTKERNEL specifies the default kernel package type +DEFAULTKERNEL=kernel +EOL + +# make sure firstboot doesn't start +echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot + +# rocky cloud user +sed -i '1i # Modified for cloud image' /etc/cloud/cloud.cfg +echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers +sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg + +# disable cloud kernel repo as it's not needed +sed -i 's/enabled=1/enabled=0/' /etc/yum.repos.d/Rocky-SIG-Cloud-Kernel.repo + +dnf clean all + +# XXX instance type markers - MUST match Rocky Infra expectation +echo 'oci' > /etc/yum/vars/infra + +# change dhcp client retry/timeouts to resolve #6866 +cat >> /etc/dhcp/dhclient.conf << EOF + +timeout 300; +retry 60; +EOF + +# OCI - Import repo GPG key +cat < /tmp/key +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGHncu8BEAC2dhocMZkdapnP9o/MvAnKOczaSpF4Cj9yqt49bxLPJCY57jz9 +2ZkJ5iGk6kpBt4rPTh18aAl30T+nPP8VMQjMhvHJKfZmBtaJJ5RpvvpK5mj1UgRJ +4DQX7gqAbT0s/uZZcouZsJzXo3c7GNMrim1C+ScfGG6BoB6GVBK74jFeJNMsxZ2Y +BwQhpE+KG+1zD94RZCySykJjNoKj+U4W5H2XdB/mNEc8icFqxjJGZ5BN0DA2Wqxn +mwELTO3Q2ne1y9+sPn2YKhRqyihuZYaUPR/Jpdki93mk61MdaoTTxFPZ8FWAYrAW +9KVdreT8K33SaTFFpmhbpndPEYesgCqDqiZG7Ywjgbf2nqSOzBr2ZX23PX7QUCvQ +ar58bNbWENLhC3B950TK+r23kkPa3GICE9WP5TftWJdbJMWRBX3YhdNooNGGCbeB +xM7B/UV9hSRx1S/US8HvDhJezZDuKrpPXrNWJTuW9Kty2WGwUkEDT2GBbcjx9ocJ +fqyNJKhaLoYKCVlsmhJUi4xCY0CDDapekWLZOzHB2zgT49uIjawV5ex6pA7oLaPI +hQGvTcCl7GFWOP/6feazzIpnsJ4V3B2DoLnAevpZlINo/bi3Hv/YmbvE6NyYzD6c +1y90pc0+Om1trLPCAZpaO1I369ZhLl6T/mCd92hrCG1y8K3PFiRIKpEMVwARAQAB +tDVPcmFjbGUgTGludXggKHJlbGVhc2Uga2V5IDEpIDxzZWNhbGVydF91c0BvcmFj +bGUuY29tPokCVAQTAQoAPhYhBD5tgm0/urOJwvOONLxNBqCNi3VvBQJinlnsAhsD +BQklmAYABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJELxNBqCNi3Vv3LEP/2au +kXzbdA/T/7i+4AbGFfYnTWqmZy58wfteDNy1sk6cPmfOUqZQXUrJcSGqqeIDjPvl +KNExpee/Ja4NGg2YfzkwH5IK5sXmEDKObXRCXGZh9/WyYpr4TBoDU2rSYBP4sbKm +PsnVoRalt2Zb0qbQF8GilytoRabjI0gLzwhmoHBZMMc3MIO14KQ5yFbekaJZKcxE +BxaDQ1NDZV1rOVbkg0yDLS9Nw89dDYWVn1wx0foRJcD277ExvmaB4vmC5yayo4ss +cFldYLu7W9FHmh46flXQGfduORCbDFfjn92eB0jdrkuoEhVRpljAtMO15GMpuVbv +HzbImI2f1MfydOa6dHbRAlzeV37fPz+1nO9IWdXqFeRG0nrH2gB02AfeoObMkK/a +XYT9sq1mC5DaK6fbOPWlY+c2hIq0BhUpe+OBdDfmm7L+si9Ffj2sUdn4sHLN6Tj7 +BrJuWmJEz42+rblDNBkrdBC6XXDaRYILKSuGD65PVV+/pVl1c2EOqcktW00iiehb +eLhj2sz6NaoO5Rhx0J3pMsaCaEBAm8P6UxQSx4iGhZ8Kh5O1SVVlqu3xOhSGOKRE +sS8gIjeV/Jl3frR4eZG/BpzdTjKZmQV7dvJ4gDuDE+X7rZBzUm7nggyE2pV6UbTD +5Qwy+ASQfYHfHK4lsHD4kbO/We6H1fEFPlzlr14UuQINBGHncu8BEADBG52gWRob +VEsQIzAfq2obFnwMroxMupXrDBka7i6cUJw8HsqyHs9maGxAuRDlAma2MBPUYcbm +DH3bmctaUR7CA1RouPkb6qbZXwSwpvgN4eh4naPX20/VEp/cd5DhKWjP9yC70weh +r4LmGWV41jBAMK0G1l6+FDw2ITgsamZP+tw0swCKqzpIY2waiygCtPHCCCFMuZ6S +7hzQpsKVFh8zqzRxMs6Mni9olk4+xwng0ahYfoe2esByR2M1kGX62Y6BOcIRX1cE +zYFCUww5GrjZdJoObBtffUSz+q2LNOBcqg5huRd8BoC+k5yrXUq8ypspfV1kNEI3 +/ebFew6A8sdf2c+sOdTxTu4MI5iXM1fhCC6X4lAN8w1Ga3ML+k/kgL75mH62Yyzr +OHXNkylTDfxz9qvq6qszVfWdzVaGXRfulW5nAbAXhuX1gmgZW+M7IQ22xyWC+I60 +UcaE2l9QtHFKuekdYnekTkSUA0ghVwuw+JCQZGQbq5LqbA5TkEYuibBOJD3MZYQ5 +C3DK4KHs/3wxf2aq+Pkf3mpSscC4B0Ba5tlpJawUWqnUmGd208sfUwD20MFfHM+1 +N+M6JYCv0tC0cyAV9Jq74bAUDXLMfkGKZyAWmlPaZBMMt4WaN0r2PAKp00T6PX6x +jTM6/aNDvNTpsaaUpMXRzH13AiJ/1SjfZwARAQABiQI8BBgBCgAmAhsMFiEEPm2C +bT+6s4nC8440vE0GoI2LdW8FAmKeWsgFCSRtulkACgkQvE0GoI2LdW/pig//Zi0a +bmFJKTxku0/LMI31ZaLn9gzXjv2ugmJumfXAce+nlaheCNBa+IMLQdAmrbislzLs +qXX2+6Eqh4Q/vqGLCkElIzT9ulkgwwEp0cVF6jnXqlWHa0a/T6oAq10jRneaQFCE +t6hweJ9KTUQufp5aAiZr/GVpBJLJ8kfOx+5eHvDj+VFlFUhpzzns/NfN5N+bthJ/ +Wbt49tzmWaWoEFA0tlwMBPO3zEh/mo5lys0GqENPs4Yb4tL82qg+SG7jHSuH2lZk +XLLyLQ6p63VZysL9+UTBtafs5jxnTopQFIXtzAOwdtQ8o7/6hhsUchRoUy23EIHT +J25yA2Qtb8Z/1m/G0e3lz46xHBPIs8FKSOPToCT6E1+9lomnzJPRBCCDTZO5imfX +4N4l7BodW9nb7zEMHCi2BUM+InpSsEkQkQFs0HIRI2KHSyY30uN0pVXJLOoVQIBr +WdUzLTTkN9w43fLpkcFXGbpU+pZvK2uksC3O+eBhIpZA9E7iZDwfEaZlUKO5kFvS +V5f8ZM1jbEb0sOZNNNEaEhTFTl8pQPc2GqgZ3rYt9mqH5OwhzKftV9PDYulIbY+Y +AN6eJhHj8Eu/IlxG6iYCDmF2hOVPs9aLo9zqdxbu8B6rUyVPOwfNbOR1U7WMRCYm +4QrtLe//99hXPcFVanIxgkdslnyYf4fjdbdlmNY= +=xpaH +-----END PGP PUBLIC KEY BLOCK----- +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGHndDkBEACieeO8U0kcUTDMLGXGKrJ3nScZ4LN5hHSzWC1zuLPpkB0YQdik +CrfSwodyp9LeEhaRsCSoGDc3cS5f5uGvsSUHMCZwEKjdT8LmZkF/dtvVDWawgaLS +KjoT+AJpss+ws0d/qmwkIHeYExdvZFNdKxvvxycCNy9fNwarT4aNySW6Ax7ERDl8 +k0QSK7uvL1AaWQKSz9rX//KcLv5OXVUX3ITcwprJPD3H2yTOy4pE9gxs/qKfnP+U +Pbb3pNaHP4PnCIQrjXhJxnH9cEJ7ef0kqBdliGPN7EObrP2uPg70WnVsXovYw/TF +PrA4H2lvJ58RVhh3ocrSnR+SIne7Lgf1FRSrsE2mmNZAWD6rOxOzO4kUrcfv/pqZ +f+sDs7KTFMO0noJ1Kt7JSV6xCQzeKGdOh9JxYI0/YIsquiHTF2xva3WHrpOG1sns +xXcnrLKONisg4gEK36fjsliG4jJhcNyJaAf4sfDiTKDOE5om+BZ7kMNSrMn20wg4 +AdZJm6x8Z0OfjxGOzMQ8re4Cf73H5odrpUel7HFGXiLWtk/f4P5EjxUTznlMbNED +gYi0H898Dz5Qfmtr97WQ8132fnKKtsPlXWNUNgJpYe+GvzmYOBAr4p5EZEWjB+q6 +EnfLDLpkaS+PbrpLCls5AnWnHjimBmlIMoO5GEsJdYLIQvVVvfKtEDJIBQARAQAB +tDRPcmFjbGUgTGludXggKGJhY2t1cCBrZXkgMSkgPHNlY2FsZXJ0X3VzQG9yYWNs +ZS5jb20+iQJUBBMBCgA+FiEEmCIxdZx0ZwZdDOmyp90HCItO++YFAmKewpICGwMF +CSWYBgAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQp90HCItO++bU+w//SFOe +RBqWoA5kP4BN9z716LpgkCllMRQsRZ0kZm8Enbe5S9ENn2T5/f6zZca3TNU6Wbit +ryToXuOlTsWy4BqAvQhQFeschg10Xgy6/VG3p5kCY4DIPOUjlb7/1r8k0xX6m/mH +BXBf2MCVRx/zkyeRDtD3lYHyz4cwoHEZ2NuB+CCe5WA2owVhgsRuVmjidDeOa7Q6 +61eLhAJ53OVqsUt5JpQS0KrVeYVJxCiiZnKgJMqHp26Jq0WIKtgBV3sakxhUpRUf +6ap7mnSAdh6Ae4r1+pTKd7trkxjIqLXH9RI0d7Xm+blRQVZJL9GLaLUaSvw4sfd/ +jfqENCBwAH7D488L1yvTqPfHC2+kRuUI3GU98RULCHveCISRGLVGwh1p88+9aok3 +DoV7/BUEIGbHzg3gcx8zFO2ZKKoJ7xS+vvNLAslPvHNDFH0XOwKBqlVztJprwWtA +H33e6fti7BMRw1vgljC8yVATBTiKXj5aw+25zi70o1fIFxpwsx5mwMmqHc634ai2 +hPWNZid0Lu3MYBd8pDCvMMMGimfecoyEZKJR2KbO+pNBn7suol5XS3pCmbF3ldMa +Atra+HvnxNBMxFVdxsqZhr/+ovQszYNIlWSYUDLbqk33HBmvbi3IuogAyxhLdw3T +uIjjf0acjOsSgy79ju2NpKPVtJw4BmvJRFX0Rh25Ag0EYed0OQEQAJRhf7/ZIWhZ +LpCX2vg8B4hjsEYeRvEAPUrUMHkqCuElmDaT7g76aPG0jvbMFVU/ykEt2mIi7EhW +s0SZknT5G8HoHJM2MirkyGB26yp4IlkPyNlc5H9nmMhY7iz/utxQps8jDS8dvxeG +1YAJGleGywGAet9vFfrLX9Xq9efTXozJfWOsRm+y2WklS+LblftaTUurStzLXRGT +AsBYOyVaRX/6AMu+fZt7mvoM+bOFNGxMSDIZi93wBiCKp0P2Se1YJoFHTOcQ0M6V +Fbl91ZcImPxAOX4DHfw4iuokiHCs//wV0DLZ3qtuqN2m/kV4JE9ak//BPVn4acH1 +Z6DQIzQpY66dIyLumGuCdPhl7MFHyAeKhBtLc7gp4+sli+zNUfYwwp55rTdZ9JDR +G2LD/P2eNnrUXEsvOzqqQy48BmzOmTdgc2vef85Z23GczwX1PyTaGnrQKkReajN0 +IxIuFpTgRQFBoPHTB1VVjSsOu7McWx4Gy2zccSrXKIskj4sOBIYBjxBAR0U4Gi5h +OAqplVGH3x3RoRb2swkc/LLb6WV6J7REmZ0+0dAE1ShBR8GmEb4wYc5BUgYXrhEn +hK3nmNx65jZXSAwJOZU8ETLaMoa/I/+QkgPvAJ8gyTLbMQ/xB2kMNRdisphz0jiy +PIXWlOf6I750VtbBNPHqfe0RHbBQJAl9ABEBAAGJAjwEGAEKACYCGwwWIQSYIjF1 +nHRnBl0M6bKn3QcIi0775gUCYp7C3AUJJG4hIwAKCRCn3QcIi0775nmYD/sEI0T4 ++MHIt5EzL+vBAzAbd23U2oF9KrJP49xmrLlm7qC6ghfuUVqoKwWyE24g8T4N3cxE +xQWTZ8drqvE2E2tyKqVMjJ5PfiZjK/3WOOIq9YZHpNKljv9KaAAf5alpvMxn6IBj +ZUhs775JcGWWngilBN9i3OEVFcQG9tFtfKqcYf8oRLPQlqhrH0pKOymFdqdL+NFX +G/M2LquGrvyDwnT2Cyy4p4sw639BUyA4k1hESgK9KVZTrmJPYU8hCD7kcSOY25UT +zDERLlXUsnGU9WHm/4aZ4TCs2h2qm29jHeWjfw0U/O8f4K5MV7WcJ0ZywdOk7SSf +jOKUetPH01l22I6JXiH0jLlBU5uA/zAxd8aPpvcYcWm2Ti+mkpIB6/XWbjnPoYHh +JmH8r9Pih1Z4dVR7qri/mdcsTZsKzLPuD6AITafJYuRCItCbMerhvGCwBaaR0oHS +AdpSzwKk8mrLd4BQUSM5a3E010dDeKGL4TA5ttfZJuSe7RXbi4RdDd98XHKEiU3n +N1ethSQNvEyrh0uA1U3FZvPMcbfYZa8zO85Nz9h/TGUNfmp5CyrZUHZLmvvGTOch +lUjaIhAGBVJQR/y7+4aC3zzkyzbKyLOL3hCk0xie4LLbfTQ5BtT4+GqEAtzwRQqZ +RgwnCPfIai7lLNx95bdwB8U2NpY11OXsoTLZAA== +=UWTf +-----END PGP PUBLIC KEY BLOCK----- +EOF + +rpm --import /tmp/key + +# Import EPEL Key +cat < /tmp/key +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGE3mOsBEACsU+XwJWDJVkItBaugXhXIIkb9oe+7aadELuVo0kBmc3HXt/Yp +CJW9hHEiGZ6z2jwgPqyJjZhCvcAWvgzKcvqE+9i0NItV1rzfxrBe2BtUtZmVcuE6 +2b+SPfxQ2Hr8llaawRjt8BCFX/ZzM4/1Qk+EzlfTcEcpkMf6wdO7kD6ulBk/tbsW +DHX2lNcxszTf+XP9HXHWJlA2xBfP+Dk4gl4DnO2Y1xR0OSywE/QtvEbN5cY94ieu +n7CBy29AleMhmbnx9pw3NyxcFIAsEZHJoU4ZW9ulAJ/ogttSyAWeacW7eJGW31/Z +39cS+I4KXJgeGRI20RmpqfH0tuT+X5Da59YpjYxkbhSK3HYBVnNPhoJFUc2j5iKy +XLgkapu1xRnEJhw05kr4LCbud0NTvfecqSqa+59kuVc+zWmfTnGTYc0PXZ6Oa3rK +44UOmE6eAT5zd/ToleDO0VesN+EO7CXfRsm7HWGpABF5wNK3vIEF2uRr2VJMvgqS +9eNwhJyOzoca4xFSwCkc6dACGGkV+CqhufdFBhmcAsUotSxe3zmrBjqA0B/nxIvH +DVgOAMnVCe+Lmv8T0mFgqZSJdIUdKjnOLu/GRFhjDKIak4jeMBMTYpVnU+HhMHLq +uDiZkNEvEEGhBQmZuI8J55F/a6UURnxUwT3piyi3Pmr2IFD7ahBxPzOBCQARAQAB +tCdGZWRvcmEgKGVwZWw5KSA8ZXBlbEBmZWRvcmFwcm9qZWN0Lm9yZz6JAk4EEwEI +ADgWIQT/itE0RZcQbs6BO5GKOHK/MihGfAUCYTeY6wIbDwULCQgHAgYVCgkICwIE +FgIDAQIeAQIXgAAKCRCKOHK/MihGfFX/EACBPWv20+ttYu1A5WvtHJPzwbj0U4yF +3zTQpBglQ2UfkRpYdipTlT3Ih6j5h2VmgRPtINCc/ZE28adrWpBoeFIS2YAKOCLC +nZYtHl2nCoLq1U7FSttUGsZ/t8uGCBgnugTfnIYcmlP1jKKA6RJAclK89evDQX5n +R9ZD+Cq3CBMlttvSTCht0qQVlwycedH8iWyYgP/mF0W35BIn7NuuZwWhgR00n/VG +4nbKPOzTWbsP45awcmivdrS74P6mL84WfkghipdmcoyVb1B8ZP4Y/Ke0RXOnLhNe +CfrXXvuW+Pvg2RTfwRDtehGQPAgXbmLmz2ZkV69RGIr54HJv84NDbqZovRTMr7gL +9k3ciCzXCiYQgM8yAyGHV0KEhFSQ1HV7gMnt9UmxbxBE2pGU7vu3CwjYga5DpwU7 +w5wu1TmM5KgZtZvuWOTDnqDLf0cKoIbW8FeeCOn24elcj32bnQDuF9DPey1mqcvT +/yEo/Ushyz6CVYxN8DGgcy2M9JOsnmjDx02h6qgWGWDuKgb9jZrvRedpAQCeemEd +fhEs6ihqVxRFl16HxC4EVijybhAL76SsM2nbtIqW1apBQJQpXWtQwwdvgTVpdEtE +r4ArVJYX5LrswnWEQMOelugUG6S3ZjMfcyOa/O0364iY73vyVgaYK+2XtT2usMux +VL469Kj5m13T6w== +=Mjs/ +-----END PGP PUBLIC KEY BLOCK----- +EOF + +rpm --import /tmp/key + + +rm -rf /var/log/yum.log +rm -rf "/var/lib/yum/*" +rm -rf /root/install.log +rm -rf /root/install.log.syslog +rm -rf /root/anaconda-ks.cfg +rm -rf /var/log/anaconda* + +rm -f /var/lib/systemd/random-seed + +cat /dev/null > /etc/machine-id + +echo "Fixing SELinux contexts." +touch /var/log/cron +touch /var/log/boot.log +mkdir -p /var/cache/yum +/usr/sbin/fixfiles -R -a restore + +# remove these for debugging +sed -i -e 's/ rhgb quiet//' /boot/grub/grub.conf + +# enable resizing on copied AMIs +echo 'install_items+=" sgdisk "' > /etc/dracut.conf.d/sgdisk.conf + +# OCI - Need iscsi as a dracut module +echo 'add_dracutmodules+=" iscsi "' > /etc/dracut.conf.d/iscsi.conf + +# OCI - Virtio drivers +echo 'add_drivers+=" virtio virtio_blk virtio_net virtio_pci virtio_ring virtio_scsi virtio_console "' > /etc/dracut.conf.d/virtio.conf + +# OCI - YOLO +mkdir -p /usr/lib/dracut/modules.d/95oci +OCIDRACUT="H4sIAGtFHmMAA+2WWW/bOBCA/Vr+illZzQXoluPUhgMURYrmpS02fevuGpJIWYQVUiWpJoHr/15S +crLZZBs3QA8U5QfYosQ5NUNSrRRBTfMAi6xoVXDOcVsT6ePg2YgXNBh8C0LNeDTqrpq7124cpfF4 +nIzT8fhwEEaj+HA8gNE38b6FVqpMAAwE5+ohuW3zvyjtw/UnLMtr4lFZSOrlV00mpS+rR/rYUv84 +StJBlIx10ZNREscD/SRNkwGE3yXjO/zm9R/+EeSUBbJCQ/AOPNANQCYgK1LXniwEbdQUKMOEKU9l +ufT6eUbrqRby8kzSwuNlKYmaQDo1JrQhcjkBJWdHIC9mKUg9TIEoKGlN1FVDZtobGr7NVFFB11nm +3YLikNU1v4A8ozXwVgEtQVUEullM5RKKjGkZQTJ8BTmBkrcMo6Eg5QTeiCxvFxMYJmESxWGYImRc +wYLo8i7gOMDkY8Dauob4eCeCT5/Ah1uN7+mhbmx0+vrs5M93s10kZo67Mp6Hec2L5WTtIB1Oby3n +vIYQBPa76P1+XcDODrwHj4DjCgf+nprYGSDQlFwA69KgDNy93ooERpR5uD8FzDs5w3utv+qEnz6d +HKwdmIHTudE2TdgFZ4qyltwodGk2mZBk3snNO0dfTlh7vc722sQ9bcftInCMmiCqFQyiG+lN2HPC +ipm7J5WYC9LUWUH+VXMC/fsrLp39TgtzRuAe3RQpKr5JcAJnS9o0lC3AveXD930HjnfiR4lDl/7y +XC5uqUkjT7CZdgJ13gSdHbP+FcHebSNOr3VJFYSopGgXfWX1S21ZmgV109c3rYCuwzgxe6oJ+/Ts +xdkpbPR5oyhn15l+leR/kuw13L6BdeFAEgwehd3gn7fP372a+QdusBK9ilSYmniq9RTc1eU0MBKB +HnwI11P9n6x3/ycP3QsXme4E56VeoNr4g9GZt/az9zbLdrac//29p7f3tnn8wb9h2/dfchjdOf/D +OIns+f8j2Jz/+iD/4V8ARUWK5d4+rNCTzRkTojVCmDSEYXl/gjJdqrruJ8zNvOJ8CY0gXqt3NTg6 +0vufjg5T8YXvVkeb+dkv3GKxWCwWi8VisVgsFovFYrFYLBaLxWL5jnwGdMMrBgAoAAA=" + +base64 -d <<<"$OCIDRACUT" | tar -xz + +OCICLOUDCFG="IyBPQ0kgY2xvdWQtaW5pdCBjb25maWd1cmF0aW9uCmRhdGFzb3VyY2VfbGlzdDogWydPcmFjbGUn +LCAnT3BlblN0YWNrJ10KZGF0YXNvdXJjZToKICBPcGVuU3RhY2s6CiAgICBtZXRhZGF0YV91cmxz +OiBbJ2h0dHA6Ly8xNjkuMjU0LjE2OS4yNTQnXQogICAgdGltZW91dDogMTAKICAgIG1heF93YWl0 +OiAyMAoKIyBzd2FwIGZpbGUKc3dhcDoKICAgZmlsZW5hbWU6IC8uc3dhcGZpbGUKICAgc2l6ZTog +ImF1dG8iCgpjbG91ZF9pbml0X21vZHVsZXM6CiMgT0NJOiBkaXNrX3NldHVwIGlzIGRpc2FibGVk +CiMtIGRpc2tfc2V0dXAKIC0gbWlncmF0b3IKIC0gYm9vdGNtZAogLSB3cml0ZS1maWxlcwojIE9D +STogVGhlIGdyb3dwYXJ0IG1vZHVsZSBpcyBkaXNhYmxlZCBieSBkZWZhdWx0LiBUbyBlbmFibGUg +YXV0b21hdGljIGJvb3Qgdm9sdW1lIHJlc2l6aW5nLCB1bmNvbW1lbnQKIyB0aGUgYmVsb3cgZW50 +cnkgZm9yICctIGdyb3dwYXJ0JyBhbmQgcmVib290LiBBbGwgdGhlIGRlcGVuZGVudCBwYWNrYWdl +cyBmb3IgdGhlIGdyb3dwYXJ0CiMgbW9kdWxlIHRvIHdvcmsgc3VjaCBhcyBjbG91ZC11dGlscy1n +cm93cGFydCBhbmQgZ2Rpc2sgYXJlIGFscmVhZHkgaW5jbHVkZWQgaW4gdGhlIGltYWdlLgojLSBn +cm93cGFydAogLSByZXNpemVmcwojIE9DSTogc2V0X2hvc3RuYW1lLCB1cGRhdGVfaG9zdG5hbWUs +IHVwZGF0ZV9ldGNfaG9zdHMgYXJlIGRpc2FibGVkCiMtIHNldF9ob3N0bmFtZQojLSB1cGRhdGVf +aG9zdG5hbWUKIy0gdXBkYXRlX2V0Y19ob3N0cwogLSByc3lzbG9nCiAtIHVzZXJzLWdyb3Vwcwog +LSBzc2gKCmNsb3VkX2NvbmZpZ19tb2R1bGVzOgogLSBtb3VudHMKIC0gbG9jYWxlCiAtIHNldC1w +YXNzd29yZHMKIyBPQ0k6IHJoX3N1YnNjcmlwdGlvbiBpcyBkaXNhYmxlZAojLSByaF9zdWJzY3Jp +cHRpb24KIC0geXVtLWFkZC1yZXBvCiAtIHBhY2thZ2UtdXBkYXRlLXVwZ3JhZGUtaW5zdGFsbAog +LSB0aW1lem9uZQogLSBudHAKIC0gcHVwcGV0CiAtIGNoZWYKIC0gc2FsdC1taW5pb24KIC0gbWNv +bGxlY3RpdmUKIC0gZGlzYWJsZS1lYzItbWV0YWRhdGEKIC0gcnVuY21kCgpjbG91ZF9maW5hbF9t +b2R1bGVzOgogLSByaWdodHNjYWxlX3VzZXJkYXRhCiAtIHNjcmlwdHMtcGVyLW9uY2UKIC0gc2Ny +aXB0cy1wZXItYm9vdAogLSBzY3JpcHRzLXBlci1pbnN0YW5jZQogLSBzY3JpcHRzLXVzZXIKIC0g +c3NoLWF1dGhrZXktZmluZ2VycHJpbnRzCiAtIGtleXMtdG8tY29uc29sZQogLSBwaG9uZS1ob21l +CiAtIGZpbmFsLW1lc3NhZ2UKIyBPQ0k6IHBvd2VyLXN0YXRlLWNoYW5nZSBpcyBkaXNhYmxlZAoj +LSBwb3dlci1zdGF0ZS1jaGFuZ2UKCg==" + +base64 -d <<<"$OCICLOUDCFG" >> /etc/cloud/cloud.cfg.d/99_oci.cfg + +# Rerun dracut for the installed kernel (not the running kernel): +KERNEL_VERSION=$(rpm -q kernel --qf '%%{V}-%%{R}.%%{arch}\n') +dracut -f /boot/initramfs-$KERNEL_VERSION.img $KERNEL_VERSION + +# OCI needs Iscsi +grubby --args="libiscsi.debug_libiscsi_eh=1 netroot=iscsi:169.254.0.2:::1:iqn.2015-02.oracle.boot:uefi ip=dhcp rd.iscsi.bypass rd.iscsi.param=node.session.timeo.replacement_timeout=6000" --update-kernel "/boot/vmlinuz-$KERNEL_VERSION" + +passwd -d root +passwd -l root + +# Copyright (C) 2020 Oracle Corp., Inc. All rights reserved. +# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl +# +# /usr/lib/oci-linux-config/cloud/scripts/initramfs-mod/net.sh +# + +echo "$(date) - OCI initramfs network modification script started." + +# Symlink network config files where cloud-init >= 19.4 expects them +DRACUT_CFG=/run/initramfs/state/etc/sysconfig/network-scripts +CI_DIR=/run +if [ -d $DRACUT_CFG ]; then + FILE_COUNT=`ls $DRACUT_CFG | wc -l` + if [ $FILE_COUNT -eq 0 ]; then + # Create dummy file if dracut did not create network device config + dummycfg=$CI_DIR/net-dummy.conf + echo "DEVICE=\"dummy\"" > $dummycfg + echo "BOOTPROTO=dhcp" >> $dummycfg + echo "$(date) - Creating dummy config $dummycfg." + else + for dcfg in $DRACUT_CFG/*; do + filename=${dcfg##*/} + devname=${filename##ifcfg-} + cicfg=$CI_DIR/net-$devname.conf + if [ ! -e $cicfg ]; then + echo "$(date) - Creating symlink from $dcfg to $cicfg." + ln -s $dcfg $cicfg + fi + done + fi +fi + +echo "$(date) - OCI initramfs network modification script done." + + +true + +%end diff --git a/container/rocky-container-base.ks b/container/rocky-container-base.ks new file mode 100644 index 0000000..5ff280f --- /dev/null +++ b/container/rocky-container-base.ks @@ -0,0 +1,83 @@ +%include rocky-container.ks + +%packages --excludedocs --inst-langs=en --nocore --exclude-weakdeps +bash +binutils +coreutils-single +crypto-policies-scripts +curl-minimal +findutils +glibc-minimal-langpack +gzip +hostname +iputils +less +libcurl-minimal +libusbx +rocky-release +rootfiles +tar +usermode +util-linux +vim-minimal +yum + +-brotli +-dosfstools +-kexec-tools +-e2fsprogs +-firewalld +-fuse-libs +-gettext* +-gnupg2-smime +-grub\* +-iptables +-kernel +-libss +-os-prober* +-pinentry +-qemu-guest-agent +-shared-mime-info +-trousers +-xfsprogs +-xkeyboard-config +%end + +%post --erroronfail --log=/root/anaconda-post.log +# container customizations inside the chroot + +# Stay compatible +echo 'container' > /etc/dnf/vars/infra + +#Generate installtime file record +/bin/date +%Y%m%d_%H%M > /etc/BUILDTIME + +# Limit languages to help reduce size. +LANG="en_US" +echo "%_install_langs $LANG" > /etc/rpm/macros.image-language-conf + +# https://bugzilla.redhat.com/show_bug.cgi?id=1727489 +echo 'LANG="C.UTF-8"' > /etc/locale.conf + +# systemd fixes +:> /etc/machine-id +umount /run +systemd-tmpfiles --create --boot + +# mask mounts and login bits +systemctl mask \ + console-getty.service \ + dev-hugepages.mount \ + getty.target \ + sys-fs-fuse-connections.mount \ + systemd-logind.service \ + systemd-remount-fs.service + +# Cleanup the image +rm -f /etc/udev/hwdb.bin +rm -rf /usr/lib/udev/hwdb.d/ \ + /boot /var/lib/dnf/history.* \ + "/tmp/*" "/tmp/.*" || true + + +%end diff --git a/container/rocky-container-minimal.ks b/container/rocky-container-minimal.ks new file mode 100644 index 0000000..24289cc --- /dev/null +++ b/container/rocky-container-minimal.ks @@ -0,0 +1,77 @@ +%include rocky-container.ks + +%packages --excludedocs --inst-langs=en --nocore --exclude-weakdeps +bash +coreutils-single +glibc-minimal-langpack +microdnf +rocky-release +util-linux + +-brotli +-dosfstools +-e2fsprogs +-firewalld +-fuse-libs +-gettext* +-gnupg2-smime +-grub\* +-hostname +-iptables +-iputils +-kernel +-kexec-tools +-less +-libss +-os-prober* +-pinentry +-qemu-guest-agent +-rootfiles +-shared-mime-info +-tar +-trousers +-vim-minimal +-xfsprogs +-xkeyboard-config +-yum +%end + +%post --erroronfail --log=/root/anaconda-post.log +# container customizations inside the chroot + + +rpm --rebuilddb + +/bin/date +%Y-%m-%d_%H:%M:%S > /etc/BUILDTIME + +echo 'container' > /etc/dnf/vars/infra + +LANG="en_US" +echo '%_install_langs en_US.UTF-8' > /etc/rpm/macros.image-language-conf +echo 'LANG="C.UTF-8"' > /etc/locale.conf + +rm -f /var/lib/dnf/history.* +rm -fr "/var/log/*" "/tmp/*" "/tmp/.*" + +for dir in $(ls -d "/usr/share/{locale,i18n}/*" | grep -v 'en_US\|all_languages\|locale\.alias'); do rm -fr $dir; done + +# systemd fixes +umount /run +systemd-tmpfiles --create --boot + +# mask mounts and login bits +systemctl mask \ + console-getty.service \ + dev-hugepages.mount \ + getty.target \ + sys-fs-fuse-connections.mount \ + systemd-logind.service \ + systemd-remount-fs.service + +# Cleanup the image +rm -f /etc/udev/hwdb.bin +rm -rf /usr/lib/udev/hwdb.d/ \ + /boot /var/lib/dnf/history.* \ + "/tmp/*" "/tmp/.*" || true + +%end diff --git a/container/rocky-container-ubi.ks b/container/rocky-container-ubi.ks new file mode 100644 index 0000000..2858704 --- /dev/null +++ b/container/rocky-container-ubi.ks @@ -0,0 +1,85 @@ +%include rocky-container.ks + +%packages --excludedocs --inst-langs=en --nocore --exclude-weakdeps +bash +coreutils-single +crypto-policies-scripts +curl-minimal +findutils +gdb-gdbserver +glibc-minimal-langpack +gzip +libcurl-minimal +systemd +rocky-release +rootfiles +tar +util-linux +vim-minimal +which +yum + +-dosfstools +-kexec-tools +-e2fsprogs +-firewalld +-fuse-libs +-gettext* +-gnupg2-smime +-grub\* +-iptables +-kernel +-libss +-os-prober* +-pinentry +-qemu-guest-agent +-shared-mime-info +-trousers +-xfsprogs +-xkeyboard-config +%end + +%post --erroronfail --log=/root/anaconda-post.log +set -eux +# container customizations inside the chroot + +# Stay compatible +echo 'container' > /etc/dnf/vars/infra + +#Generate installtime file record +/bin/date +%Y%m%d_%H%M > /etc/BUILDTIME + +# Limit languages to help reduce size. +LANG="en_US" +echo "%_install_langs $LANG" > /etc/rpm/macros.image-language-conf + +# https://bugzilla.redhat.com/show_bug.cgi?id=1727489 +echo 'LANG="C.UTF-8"' > /etc/locale.conf + +# systemd fixes +:> /etc/machine-id +umount /run +systemd-tmpfiles --create --boot + +# mask mounts and login bits +systemctl mask \ + console-getty.service \ + dev-hugepages.mount \ + getty.target \ + sys-fs-fuse-connections.mount \ + systemd-logind.service \ + systemd-remount-fs.service + +# Remove network configuration files leftover from anaconda installation +# https://bugzilla.redhat.com/show_bug.cgi?id=1713089 +rm -f /etc/sysconfig/network-scripts/ifcfg-* + +# Cleanup the image +rm -f /etc/udev/hwdb.bin +rm -rf /usr/lib/udev/hwdb.d/ \ + /boot /var/lib/dnf/history.* \ + /var/cache/* /var/log/* \ + "/tmp/*" "/tmp/.*" || true + + +%end diff --git a/container/rocky-container.ks b/container/rocky-container.ks new file mode 100644 index 0000000..ebafddc --- /dev/null +++ b/container/rocky-container.ks @@ -0,0 +1,21 @@ +url --url https://download.rockylinux.org/stg/rocky/9/BaseOS/$basearch/os/ + +text +bootloader --disable +firewall --disabled +network --bootproto=dhcp --device=link --activate --onboot=on +rootpw --lock --iscrypted locked +selinux --disabled +shutdown + +keyboard us +lang en_US.UTF-8 +timezone --utc --nontp Etc/UTC + +# Disk setup +zerombr +clearpart --all --initlabel +autopart --noboot --nohome --noswap --nolvm --fstype=ext4 + +%addon com_redhat_kdump --disable +%end diff --git a/live/10/aarch64/peridot/rocky-live-base-spin.ks b/live/10/aarch64/peridot/rocky-live-base-spin.ks new file mode 100644 index 0000000..445254e --- /dev/null +++ b/live/10/aarch64/peridot/rocky-live-base-spin.ks @@ -0,0 +1,372 @@ +# rocky-live-base-spin.ks +# +# Base installation information for Rocky Linux images +# Contains EPEL. +# + +lang en_US.UTF-8 +keyboard us +timezone US/Eastern +selinux --enforcing +firewall --enabled --service=mdns +xconfig --startxonboot +zerombr +clearpart --all +part / --size 5120 --fstype ext4 +services --enabled=NetworkManager,ModemManager --disabled=sshd +network --bootproto=dhcp --device=link --activate +rootpw --lock --iscrypted locked +shutdown + +%include rocky-repo-epel.ks + +%packages +@base-x +@guest-desktop-agents +@standard +@core +@fonts +@input-methods +@dial-up +@multimedia +@hardware-support + +# explicit +kernel +kernel-modules +kernel-modules-extra +#memtest86+ +anaconda +anaconda-install-env-deps +anaconda-live +@anaconda-tools +efi-filesystem +efivar-libs +efibootmgr +grub2-common +grub2-efi-*64 +grub2-efi-*64-cdboot +#grub2-pc-modules +grub2-tools +#grub2-tools-efi +grub2-tools-extra +grub2-tools-minimal +grubby +shim-*64 +-shim-unsigned-*64 + +# Required for SVG rnotes images +aajohan-comfortaa-fonts + +# RHBZ#1242586 - Required for initramfs creation +dracut-live +#syslinux + +# Anaconda needs all the locales available, just like a DVD installer +glibc-all-langpacks + +# no longer in @core since 2018-10, but needed for livesys script +initscripts +chkconfig + +# absolutely required - don't want a system that can't actually update +epel-release +%end + +%post +# FIXME: it'd be better to get this installed from a package +cat > /etc/rc.d/init.d/livesys << EOF +#!/bin/bash +# +# live: Init script for live image +# +# chkconfig: 345 00 99 +# description: Init script for live image. +### BEGIN INIT INFO +# X-Start-Before: display-manager chronyd +### END INIT INFO + +. /etc/init.d/functions + +if ! strstr "\`cat /proc/cmdline\`" rd.live.image || [ "\$1" != "start" ]; then + exit 0 +fi + +if [ -e /.liveimg-configured ] ; then + configdone=1 +fi + +exists() { + which \$1 >/dev/null 2>&1 || return + \$* +} + +livedir="LiveOS" +for arg in \`cat /proc/cmdline\` ; do + if [ "\${arg##rd.live.dir=}" != "\${arg}" ]; then + livedir=\${arg##rd.live.dir=} + continue + fi + if [ "\${arg##live_dir=}" != "\${arg}" ]; then + livedir=\${arg##live_dir=} + fi +done + +# Enable swap unless requested otherwise +swaps=\`blkid -t TYPE=swap -o device\` +if ! strstr "\`cat /proc/cmdline\`" noswap && [ -n "\$swaps" ] ; then + for s in \$swaps ; do + action "Enabling swap partition \$s" swapon \$s + done +fi +if ! strstr "\`cat /proc/cmdline\`" noswap && [ -f /run/initramfs/live/\${livedir}/swap.img ] ; then + action "Enabling swap file" swapon /run/initramfs/live/\${livedir}/swap.img +fi + +# Support for persistent homes +mountPersistentHome() { + # support label/uuid + if [ "\${homedev##LABEL=}" != "\${homedev}" -o "\${homedev##UUID=}" != "\${homedev}" ]; then + homedev=\`/sbin/blkid -o device -t "\$homedev"\` + fi + + # if we're given a file rather than a blockdev, loopback it + if [ "\${homedev##mtd}" != "\${homedev}" ]; then + # mtd devs don't have a block device but get magic-mounted with -t jffs2 + mountopts="-t jffs2" + elif [ ! -b "\$homedev" ]; then + loopdev=\`losetup -f\` + if [ "\${homedev##/run/initramfs/live}" != "\${homedev}" ]; then + action "Remounting live store r/w" mount -o remount,rw /run/initramfs/live + fi + losetup \$loopdev \$homedev + homedev=\$loopdev + fi + + # if it's encrypted, we need to unlock it + if [ "\$(/sbin/blkid -s TYPE -o value \$homedev 2>/dev/null)" = "crypto_LUKS" ]; then + echo + echo "Setting up encrypted /home device" + plymouth ask-for-password --command="cryptsetup luksOpen \$homedev EncHome" + homedev=/dev/mapper/EncHome + fi + + # and finally do the mount + mount \$mountopts \$homedev /home + # if we have /home under what's passed for persistent home, then + # we should make that the real /home. useful for mtd device on olpc + if [ -d /home/home ]; then mount --bind /home/home /home ; fi + [ -x /sbin/restorecon ] && /sbin/restorecon /home + if [ -d /home/liveuser ]; then USERADDARGS="-M" ; fi +} + +# Help locate persistent homes +findPersistentHome() { + for arg in \`cat /proc/cmdline\` ; do + if [ "\${arg##persistenthome=}" != "\${arg}" ]; then + homedev=\${arg##persistenthome=} + fi + done +} + +if strstr "\`cat /proc/cmdline\`" persistenthome= ; then + findPersistentHome +elif [ -e /run/initramfs/live/\${livedir}/home.img ]; then + homedev=/run/initramfs/live/\${livedir}/home.img +fi + +# Mount the persistent home if it's available +if ! strstr "\`cat /proc/cmdline\`" nopersistenthome && [ -n "\$homedev" ] ; then + action "Mounting persistent /home" mountPersistentHome +fi + +if [ -n "\$configdone" ]; then + exit 0 +fi + +# Create the liveuser (no password) so automatic logins and sudo works +action "Adding live user" useradd \$USERADDARGS -c "Live System User" liveuser +passwd -d liveuser > /dev/null +usermod -aG wheel liveuser > /dev/null + +# Same for root +passwd -d root > /dev/null + +# Turn off firstboot (similar to a DVD/minimal install, where it asks +# for the user to accept the EULA before bringing up a TTY) +systemctl --no-reload disable firstboot-text.service 2> /dev/null || : +systemctl --no-reload disable firstboot-graphical.service 2> /dev/null || : +systemctl stop firstboot-text.service 2> /dev/null || : +systemctl stop firstboot-graphical.service 2> /dev/null || : + +# Prelinking damages the images +sed -i 's/PRELINKING=yes/PRELINKING=no/' /etc/sysconfig/prelink &>/dev/null || : + +# Turn off mdmonitor by default +systemctl --no-reload disable mdmonitor.service 2> /dev/null || : +systemctl --no-reload disable mdmonitor-takeover.service 2> /dev/null || : +systemctl stop mdmonitor.service 2> /dev/null || : +systemctl stop mdmonitor-takeover.service 2> /dev/null || : + +# Even if there isn't gnome, this doesn't hurt. +gsettings set org.gnome.software download-updates 'false' || : + +# Disable cron +systemctl --no-reload disable crond.service 2> /dev/null || : +systemctl --no-reload disable atd.service 2> /dev/null || : +systemctl stop crond.service 2> /dev/null || : +systemctl stop atd.service 2> /dev/null || : + +# Disable abrt +systemctl --no-reload disable abrtd.service 2> /dev/null || : +systemctl stop abrtd.service 2> /dev/null || : + +# Don't sync the system clock when running live (RHBZ #1018162) +sed -i 's/rtcsync//' /etc/chrony.conf + +# Mark things as configured +touch /.liveimg-configured + +# add static hostname to work around xauth bug +# https://bugzilla.redhat.com/show_bug.cgi?id=679486 +# the hostname must be something else than 'localhost' +# https://bugzilla.redhat.com/show_bug.cgi?id=1370222 +echo "localhost-live" > /etc/hostname + +EOF + +# HAL likes to start late. +cat > /etc/rc.d/init.d/livesys-late << EOF +#!/bin/bash +# +# live: Late init script for live image +# +# chkconfig: 345 99 01 +# description: Late init script for live image. + +. /etc/init.d/functions + +if ! strstr "\`cat /proc/cmdline\`" rd.live.image || [ "\$1" != "start" ] || [ -e /.liveimg-late-configured ] ; then + exit 0 +fi + +exists() { + which \$1 >/dev/null 2>&1 || return + \$* +} + +touch /.liveimg-late-configured + +# Read some stuff out of the kernel cmdline +for o in \`cat /proc/cmdline\` ; do + case \$o in + ks=*) + ks="--kickstart=\${o#ks=}" + ;; + xdriver=*) + xdriver="\${o#xdriver=}" + ;; + esac +done + +# If liveinst or textinst is given, start installer +if strstr "\`cat /proc/cmdline\`" liveinst ; then + plymouth --quit + /usr/sbin/liveinst \$ks +fi +if strstr "\`cat /proc/cmdline\`" textinst ; then + plymouth --quit + /usr/sbin/liveinst --text \$ks +fi + +# Configure X, allowing user to override xdriver +if [ -n "\$xdriver" ]; then + cat > /etc/X11/xorg.conf.d/00-xdriver.conf <> /etc/fstab << EOF +vartmp /var/tmp tmpfs defaults 0 0 +EOF + +# PackageKit likes to play games. Let's fix that. +rm -f /var/lib/rpm/__db* +releasever=$(rpm -q --qf '%{version}\n' --whatprovides system-release) +basearch=$(uname -i) +rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9 +echo "Packages within this LiveCD" +rpm -qa +# Note that running rpm recreates the rpm db files which aren't needed or wanted +rm -f /var/lib/rpm/__db* + +# go ahead and pre-make the man -k cache (#455968) +/usr/bin/mandb + +# make sure there aren't core files lying around +rm -f /core* + +# remove random seed, the newly installed instance should make it's own +rm -f /var/lib/systemd/random-seed + +# convince readahead not to collect +# FIXME: for systemd + +echo 'File created by kickstart. See systemd-update-done.service(8).' \ + | tee /etc/.updated >/var/.updated + +# Drop the rescue kernel and initramfs, we don't need them on the live media itself. +# See bug 1317709 +rm -f /boot/*-rescue* + +# Disable network service here, as doing it in the services line +# fails due to RHBZ #1369794 - the error is expected +/sbin/chkconfig network off + +# Remove machine-id on generated images +rm -f /etc/machine-id +touch /etc/machine-id + +%end + + +%post --nochroot +cp $INSTALL_ROOT/usr/share/licenses/*-release/* $LIVE_ROOT/ + +# only works on x86_64 +if [ "$(uname -i)" = "i386" -o "$(uname -i)" = "x86_64" ]; then + # For livecd-creator builds + if [ ! -d $LIVE_ROOT/LiveOS ]; then mkdir -p $LIVE_ROOT/LiveOS ; fi + cp /usr/bin/livecd-iso-to-disk $LIVE_ROOT/LiveOS + + # For lorax/livemedia-creator builds + sed -i ' + /## make boot.iso/ i\ + # Add livecd-iso-to-disk script to .iso filesystem at /LiveOS/\ + <% f = "usr/bin/livecd-iso-to-disk" %>\ + %if exists(f):\ + install ${f} ${LIVEDIR}/${f|basename}\ + %endif\ + ' /usr/share/lorax/templates.d/99-generic/live/x86.tmpl +fi + +%end diff --git a/live/10/aarch64/peridot/rocky-live-base.ks b/live/10/aarch64/peridot/rocky-live-base.ks new file mode 100644 index 0000000..e50e9ac --- /dev/null +++ b/live/10/aarch64/peridot/rocky-live-base.ks @@ -0,0 +1,368 @@ +# rocky-live-base.ks +# +# Base installation information for Rocky Linux images +# + +lang en_US.UTF-8 +keyboard us +timezone US/Eastern +selinux --enforcing +firewall --enabled --service=mdns +xconfig --startxonboot +zerombr +clearpart --all +part / --size 5120 --fstype ext4 +services --enabled=NetworkManager,ModemManager --disabled=sshd +network --bootproto=dhcp --device=link --activate +rootpw --lock --iscrypted locked +shutdown + +%include rocky-repo.ks + +%packages +@base-x +@guest-desktop-agents +@standard +@core +@fonts +@input-methods +@dial-up +@multimedia +@hardware-support + +# explicit +kernel +kernel-modules +kernel-modules-extra +#memtest86+ +anaconda +anaconda-install-env-deps +anaconda-live +@anaconda-tools +efi-filesystem +efivar-libs +efibootmgr +grub2-common +grub2-efi-*64 +grub2-efi-*64-cdboot +#grub2-pc-modules +grub2-tools +#grub2-tools-efi +grub2-tools-extra +grub2-tools-minimal +grubby +shim-*64 +-shim-unsigned-*64 + +# Required for SVG rnotes images +aajohan-comfortaa-fonts + +# RHBZ#1242586 - Required for initramfs creation +dracut-live +#syslinux + +# Anaconda needs all the locales available, just like a DVD installer +glibc-all-langpacks + +# This isn't in @core anymore, but livesys still needs it +initscripts +chkconfig +%end + +%post +# FIXME: it'd be better to get this installed from a package +cat > /etc/rc.d/init.d/livesys << EOF +#!/bin/bash +# +# live: Init script for live image +# +# chkconfig: 345 00 99 +# description: Init script for live image. +### BEGIN INIT INFO +# X-Start-Before: display-manager chronyd +### END INIT INFO + +. /etc/init.d/functions + +if ! strstr "\`cat /proc/cmdline\`" rd.live.image || [ "\$1" != "start" ]; then + exit 0 +fi + +if [ -e /.liveimg-configured ] ; then + configdone=1 +fi + +exists() { + which \$1 >/dev/null 2>&1 || return + \$* +} + +livedir="LiveOS" +for arg in \`cat /proc/cmdline\` ; do + if [ "\${arg##rd.live.dir=}" != "\${arg}" ]; then + livedir=\${arg##rd.live.dir=} + continue + fi + if [ "\${arg##live_dir=}" != "\${arg}" ]; then + livedir=\${arg##live_dir=} + fi +done + +# Enable swap unless requested otherwise +swaps=\`blkid -t TYPE=swap -o device\` +if ! strstr "\`cat /proc/cmdline\`" noswap && [ -n "\$swaps" ] ; then + for s in \$swaps ; do + action "Enabling swap partition \$s" swapon \$s + done +fi +if ! strstr "\`cat /proc/cmdline\`" noswap && [ -f /run/initramfs/live/\${livedir}/swap.img ] ; then + action "Enabling swap file" swapon /run/initramfs/live/\${livedir}/swap.img +fi + +# Support for persistent homes +mountPersistentHome() { + # support label/uuid + if [ "\${homedev##LABEL=}" != "\${homedev}" -o "\${homedev##UUID=}" != "\${homedev}" ]; then + homedev=\`/sbin/blkid -o device -t "\$homedev"\` + fi + + # if we're given a file rather than a blockdev, loopback it + if [ "\${homedev##mtd}" != "\${homedev}" ]; then + # mtd devs don't have a block device but get magic-mounted with -t jffs2 + mountopts="-t jffs2" + elif [ ! -b "\$homedev" ]; then + loopdev=\`losetup -f\` + if [ "\${homedev##/run/initramfs/live}" != "\${homedev}" ]; then + action "Remounting live store r/w" mount -o remount,rw /run/initramfs/live + fi + losetup \$loopdev \$homedev + homedev=\$loopdev + fi + + # if it's encrypted, we need to unlock it + if [ "\$(/sbin/blkid -s TYPE -o value \$homedev 2>/dev/null)" = "crypto_LUKS" ]; then + echo + echo "Setting up encrypted /home device" + plymouth ask-for-password --command="cryptsetup luksOpen \$homedev EncHome" + homedev=/dev/mapper/EncHome + fi + + # and finally do the mount + mount \$mountopts \$homedev /home + # if we have /home under what's passed for persistent home, then + # we should make that the real /home. useful for mtd device on olpc + if [ -d /home/home ]; then mount --bind /home/home /home ; fi + [ -x /sbin/restorecon ] && /sbin/restorecon /home + if [ -d /home/liveuser ]; then USERADDARGS="-M" ; fi +} + +# Help locate persistent homes +findPersistentHome() { + for arg in \`cat /proc/cmdline\` ; do + if [ "\${arg##persistenthome=}" != "\${arg}" ]; then + homedev=\${arg##persistenthome=} + fi + done +} + +if strstr "\`cat /proc/cmdline\`" persistenthome= ; then + findPersistentHome +elif [ -e /run/initramfs/live/\${livedir}/home.img ]; then + homedev=/run/initramfs/live/\${livedir}/home.img +fi + +# Mount the persistent home if it's available +if ! strstr "\`cat /proc/cmdline\`" nopersistenthome && [ -n "\$homedev" ] ; then + action "Mounting persistent /home" mountPersistentHome +fi + +if [ -n "\$configdone" ]; then + exit 0 +fi + +# Create the liveuser (no password) so automatic logins and sudo works +action "Adding live user" useradd \$USERADDARGS -c "Live System User" liveuser +passwd -d liveuser > /dev/null +usermod -aG wheel liveuser > /dev/null + +# Same for root +passwd -d root > /dev/null + +# Turn off firstboot (similar to a DVD/minimal install, where it asks +# for the user to accept the EULA before bringing up a TTY) +systemctl --no-reload disable firstboot-text.service 2> /dev/null || : +systemctl --no-reload disable firstboot-graphical.service 2> /dev/null || : +systemctl stop firstboot-text.service 2> /dev/null || : +systemctl stop firstboot-graphical.service 2> /dev/null || : + +# Prelinking damages the images +sed -i 's/PRELINKING=yes/PRELINKING=no/' /etc/sysconfig/prelink &>/dev/null || : + +# Turn off mdmonitor by default +systemctl --no-reload disable mdmonitor.service 2> /dev/null || : +systemctl --no-reload disable mdmonitor-takeover.service 2> /dev/null || : +systemctl stop mdmonitor.service 2> /dev/null || : +systemctl stop mdmonitor-takeover.service 2> /dev/null || : + +# Even if there isn't gnome, this doesn't hurt. +gsettings set org.gnome.software download-updates 'false' || : + +# Disable cron +systemctl --no-reload disable crond.service 2> /dev/null || : +systemctl --no-reload disable atd.service 2> /dev/null || : +systemctl stop crond.service 2> /dev/null || : +systemctl stop atd.service 2> /dev/null || : + +# Disable abrt +systemctl --no-reload disable abrtd.service 2> /dev/null || : +systemctl stop abrtd.service 2> /dev/null || : + +# Don't sync the system clock when running live (RHBZ #1018162) +sed -i 's/rtcsync//' /etc/chrony.conf + +# Mark things as configured +touch /.liveimg-configured + +# add static hostname to work around xauth bug +# https://bugzilla.redhat.com/show_bug.cgi?id=679486 +# the hostname must be something else than 'localhost' +# https://bugzilla.redhat.com/show_bug.cgi?id=1370222 +echo "localhost-live" > /etc/hostname + +EOF + +# HAL likes to start late. +cat > /etc/rc.d/init.d/livesys-late << EOF +#!/bin/bash +# +# live: Late init script for live image +# +# chkconfig: 345 99 01 +# description: Late init script for live image. + +. /etc/init.d/functions + +if ! strstr "\`cat /proc/cmdline\`" rd.live.image || [ "\$1" != "start" ] || [ -e /.liveimg-late-configured ] ; then + exit 0 +fi + +exists() { + which \$1 >/dev/null 2>&1 || return + \$* +} + +touch /.liveimg-late-configured + +# Read some stuff out of the kernel cmdline +for o in \`cat /proc/cmdline\` ; do + case \$o in + ks=*) + ks="--kickstart=\${o#ks=}" + ;; + xdriver=*) + xdriver="\${o#xdriver=}" + ;; + esac +done + +# If liveinst or textinst is given, start installer +if strstr "\`cat /proc/cmdline\`" liveinst ; then + plymouth --quit + /usr/sbin/liveinst \$ks +fi +if strstr "\`cat /proc/cmdline\`" textinst ; then + plymouth --quit + /usr/sbin/liveinst --text \$ks +fi + +# Configure X, allowing user to override xdriver +if [ -n "\$xdriver" ]; then + cat > /etc/X11/xorg.conf.d/00-xdriver.conf <> /etc/fstab << EOF +vartmp /var/tmp tmpfs defaults 0 0 +EOF + +# PackageKit likes to play games. Let's fix that. +rm -f /var/lib/rpm/__db* +releasever=$(rpm -q --qf '%{version}\n' --whatprovides system-release) +basearch=$(uname -i) +rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9 +echo "Packages within this LiveCD" +rpm -qa +# Note that running rpm recreates the rpm db files which aren't needed or wanted +rm -f /var/lib/rpm/__db* + +# go ahead and pre-make the man -k cache (#455968) +/usr/bin/mandb + +# make sure there aren't core files lying around +rm -f /core* + +# remove random seed, the newly installed instance should make it's own +rm -f /var/lib/systemd/random-seed + +# convince readahead not to collect +# FIXME: for systemd + +echo 'File created by kickstart. See systemd-update-done.service(8).' \ + | tee /etc/.updated >/var/.updated + +# Drop the rescue kernel and initramfs, we don't need them on the live media itself. +# See bug 1317709 +rm -f /boot/*-rescue* + +# Disable network service here, as doing it in the services line +# fails due to RHBZ #1369794 - the error is expected +/sbin/chkconfig network off + +# Remove machine-id on generated images +rm -f /etc/machine-id +touch /etc/machine-id + +%end + + +%post --nochroot +cp $INSTALL_ROOT/usr/share/licenses/*-release/* $LIVE_ROOT/ + +# This only works on x86_64 +if [ "$(uname -i)" = "i386" -o "$(uname -i)" = "x86_64" ]; then + # For livecd-creator builds + if [ ! -d $LIVE_ROOT/LiveOS ]; then mkdir -p $LIVE_ROOT/LiveOS ; fi + cp /usr/bin/livecd-iso-to-disk $LIVE_ROOT/LiveOS + + # For lorax/livemedia-creator builds + sed -i ' + /## make boot.iso/ i\ + # Add livecd-iso-to-disk script to .iso filesystem at /LiveOS/\ + <% f = "usr/bin/livecd-iso-to-disk" %>\ + %if exists(f):\ + install ${f} ${LIVEDIR}/${f|basename}\ + %endif\ + ' /usr/share/lorax/templates.d/99-generic/live/x86.tmpl +fi + +%end diff --git a/live/10/aarch64/peridot/rocky-live-cinnamon-common.ks b/live/10/aarch64/peridot/rocky-live-cinnamon-common.ks new file mode 100644 index 0000000..8157dca --- /dev/null +++ b/live/10/aarch64/peridot/rocky-live-cinnamon-common.ks @@ -0,0 +1,79 @@ +# cinnamon +%packages +rocky-backgrounds +rocky-release +thunderbird +firefox +f36-backgrounds-gnome +f36-backgrounds-extras-gnome +f37-backgrounds-gnome +f37-backgrounds-extras-gnome +gjs + +NetworkManager-adsl +NetworkManager-bluetooth +NetworkManager-l2tp-gnome +NetworkManager-libreswan-gnome +NetworkManager-openconnect-gnome +NetworkManager-openvpn-gnome +NetworkManager-ppp +NetworkManager-pptp-gnome +NetworkManager-wifi +NetworkManager-wwan +cinnamon +cinnamon-control-center +cinnamon-screensaver +eom +firewall-config +gnome-calculator +gnome-disk-utility +gnome-screenshot +gnome-system-monitor +gnome-terminal +gstreamer1-plugins-ugly-free +gvfs-gphoto2 +gvfs-mtp +gvfs-smb +#hexchat +imsettings-systemd +initial-setup-gui +lightdm +metacity +nemo-fileroller +nemo-image-converter +nemo-preview +nm-connection-editor +pipewire-alsa +pipewire-pulseaudio +powerline +redshift-gtk +sane-backends-drivers-scanners +setroubleshoot +slick-greeter +slick-greeter-cinnamon +tmux +tmux-powerline +transmission +vim-enhanced +vim-powerline +xdg-user-dirs-gtk +xed +xreader +wireplumber + +parole +#audacious +#rhythmbox + +#libreoffice-calc +#libreoffice-emailmerge +#libreoffice-graphicfilter +#libreoffice-impress +#libreoffice-writer + +-xsane +-xane-gimp +-mpage +-hplip +-isdn4k-utils +%end diff --git a/live/10/aarch64/peridot/rocky-live-cinnamon.ks b/live/10/aarch64/peridot/rocky-live-cinnamon.ks new file mode 100644 index 0000000..b86fe38 --- /dev/null +++ b/live/10/aarch64/peridot/rocky-live-cinnamon.ks @@ -0,0 +1,64 @@ +# rocky-live-cinnamon.ks + +%include rocky-live-base-spin.ks +%include rocky-live-cinnamon-common.ks + +part / --size 8192 + +%post +# cinnamon configuration + +cat > /etc/sysconfig/desktop <> /etc/rc.d/init.d/livesys << EOF +# make the installer show up +if [ -f /usr/share/applications/liveinst.desktop ]; then + # Show harddisk install in shell dash + sed -i -e 's/NoDisplay=true/NoDisplay=false/' /usr/share/applications/liveinst.desktop "" +fi +mkdir /home/liveuser/Desktop +cp /usr/share/applications/liveinst.desktop /home/liveuser/Desktop +chmod +x /home/liveuser/Desktop/liveinst.desktop + +# move to anaconda +mv /usr/share/applications/liveinst.desktop /usr/share/applications/anaconda.desktop + +if [ -f /usr/share/anaconda/gnome/fedora-welcome.desktop ]; then + mkdir -p ~liveuser/.config/autostart + cp /usr/share/anaconda/gnome/fedora-welcome.desktop /usr/share/applications/ + cp /usr/share/anaconda/gnome/fedora-welcome.desktop ~liveuser/.config/autostart/ +fi + +# set up lightdm autologin +sed -i 's/^#autologin-user=.*/autologin-user=liveuser/' /etc/lightdm/lightdm.conf +sed -i 's/^#autologin-user-timeout=.*/autologin-user-timeout=0/' /etc/lightdm/lightdm.conf +sed -i 's/^#show-language-selector=.*/show-language-selector=true/' /etc/lightdm/lightdm-gtk-greeter.conf + +# set cinnamon as default session, otherwise login will fail +sed -i 's/^#user-session=.*/user-session=cinnamon/' /etc/lightdm/lightdm.conf + +# Turn off PackageKit-command-not-found while uninstalled +if [ -f /etc/PackageKit/CommandNotFound.conf ]; then + sed -i -e 's/^SoftwareSourceSearch=true/SoftwareSourceSearch=false/' /etc/PackageKit/CommandNotFound.conf +fi + +# The updater applet might or might not exist +rm -f /etc/xdg/autostart/org.mageia.dnfdragora-updater.desktop + +# reset selinux contexts +chown -R liveuser:liveuser /home/liveuser/ +restorecon -R /home/liveuser/ +restorecon -R / + +EOF + +# this doesn't come up automatically. not sure why. +systemctl enable --force lightdm.service + +# CRB needs to be enabled for EPEL to function. +dnf config-manager --set-enabled crb + +%end diff --git a/live/10/aarch64/peridot/rocky-live-kde-base.ks b/live/10/aarch64/peridot/rocky-live-kde-base.ks new file mode 100644 index 0000000..4da7880 --- /dev/null +++ b/live/10/aarch64/peridot/rocky-live-kde-base.ks @@ -0,0 +1,130 @@ +# Maintained by RelEng + +%include rocky-live-base-spin.ks +%include rocky-live-kde-common.ks + +%post + +# set default GTK+ theme for root (see #683855, #689070, #808062) +cat > /root/.gtkrc-2.0 << EOF +include "/usr/share/themes/Adwaita/gtk-2.0/gtkrc" +include "/etc/gtk-2.0/gtkrc" +gtk-theme-name="Adwaita" +EOF +mkdir -p /root/.config/gtk-3.0 +cat > /root/.config/gtk-3.0/settings.ini << EOF +[Settings] +gtk-theme-name = Adwaita +EOF + +rm -f /usr/share/wallpapers/Fedora +ln -s rocky-abstract-2 /usr/share/wallpapers/Fedora + +# add initscript +cat >> /etc/rc.d/init.d/livesys << EOF + +# are we *not* able to use wayland sessions? +if strstr "\`cat /proc/cmdline\`" nomodeset ; then +PLASMA_SESSION_FILE="plasmax11.desktop" +else +PLASMA_SESSION_FILE="plasma.desktop" +fi + +# set up autologin for user liveuser +if [ -f /etc/sddm.conf ]; then +sed -i 's/^#User=.*/User=liveuser/' /etc/sddm.conf +sed -i "s/^#Session=.*/Session=\${PLASMA_SESSION_FILE}/" /etc/sddm.conf +else +cat > /etc/sddm.conf << SDDM_EOF +[Autologin] +User=liveuser +Session=\${PLASMA_SESSION_FILE} +SDDM_EOF +fi + +# add liveinst.desktop to favorites menu +mkdir -p /home/liveuser/.config/ +cat > /home/liveuser/.config/kickoffrc << MENU_EOF +[Favorites] +FavoriteURLs=/usr/share/applications/firefox.desktop,/usr/share/applications/org.kde.dolphin.desktop,/usr/share/applications/systemsettings.desktop,/usr/share/applications/org.kde.konsole.desktop,/usr/share/applications/liveinst.desktop +MENU_EOF + +# show liveinst.desktop on desktop and in menu +sed -i 's/NoDisplay=true/NoDisplay=false/' /usr/share/applications/liveinst.desktop +# set executable bit disable KDE security warning +chmod +x /usr/share/applications/liveinst.desktop +mkdir /home/liveuser/Desktop +cp -a /usr/share/applications/liveinst.desktop /home/liveuser/Desktop/ + +if [ -f /usr/share/anaconda/gnome/fedora-welcome.desktop ]; then + mkdir -p ~liveuser/.config/autostart + cp /usr/share/anaconda/gnome/fedora-welcome.desktop /usr/share/applications/ + cp /usr/share/anaconda/gnome/fedora-welcome.desktop ~liveuser/.config/autostart/ +fi + +# Set akonadi backend +mkdir -p /home/liveuser/.config/akonadi +cat > /home/liveuser/.config/akonadi/akonadiserverrc << AKONADI_EOF +[%General] +Driver=QSQLITE3 +AKONADI_EOF + +# "Disable plasma-discover-notifier" +mkdir -p /home/liveuser/.config/autostart +cp -a /etc/xdg/autostart/org.kde.discover.notifier.desktop /home/liveuser/.config/autostart/ +echo 'Hidden=true' >> /home/liveuser/.config/autostart/org.kde.discover.notifier.desktop + +# Disable baloo +cat > /home/liveuser/.config/baloofilerc << BALOO_EOF +[Basic Settings] +Indexing-Enabled=false +BALOO_EOF + +# Disable kres-migrator +cat > /home/liveuser/.kde/share/config/kres-migratorrc << KRES_EOF +[Migration] +Enabled=false +KRES_EOF + +# Disable kwallet migrator +cat > /home/liveuser/.config/kwalletrc << KWALLET_EOL +[Migration] +alreadyMigrated=true +KWALLET_EOL +# Disable automount of 'known' devices +# https://bugzilla.redhat.com/show_bug.cgi?id=2073708 +cat > /home/liveuser/.config/kded_device_automounterrc << AUTOMOUNTER_EOF +[General] +AutomountEnabled=false +AutomountOnLogin=false +AutomountOnPlugin=false +AUTOMOUNTER_EOF + +# disable kdeconnect +cat > /home/liveuser/.config/autostart/org.kde.kdeconnect.daemon.desktop << KDECONNECT_EOF +[Desktop Entry] +Hidden=true +KDECONNECT_EOF +mkdir -p /home/liveuser/.local/share/dbus-1/services/ +cat > /home/liveuser/.local/share/dbus-1/services/org.kde.kdeconnect.service << DBUS_EOF +[D-BUS Service] +Name=org.kde.kdeconnect +Exec=/usr/bin/false +DBUS_EOF + +# make sure to set the right permissions and selinux contexts +chown -R liveuser:liveuser /home/liveuser/ +restorecon -R /home/liveuser/ +restorecon -R / + +EOF + +systemctl enable --force sddm.service +dnf config-manager --set-enabled crb + +cat > /etc/sddm.conf.d/theme.conf <> /etc/rc.d/init.d/livesys << EOF +# make the installer show up +if [ -f /usr/share/applications/liveinst.desktop ]; then + # Show harddisk install in shell dash + sed -i -e 's/NoDisplay=true/NoDisplay=false/' /usr/share/applications/liveinst.desktop "" +fi +mkdir /home/liveuser/Desktop +cp /usr/share/applications/liveinst.desktop /home/liveuser/Desktop +chmod +x /home/liveuser/Desktop/liveinst.desktop + +# move to anaconda - probably not required for MATE. +mv /usr/share/applications/liveinst.desktop /usr/share/applications/anaconda.desktop + +if [ -f /usr/share/anaconda/gnome/fedora-welcome.desktop ]; then + mkdir -p ~liveuser/.config/autostart + cp /usr/share/anaconda/gnome/fedora-welcome.desktop /usr/share/applications/ + cp /usr/share/anaconda/gnome/fedora-welcome.desktop ~liveuser/.config/autostart/ +fi + +# rebuild schema cache with any overrides we installed +glib-compile-schemas /usr/share/glib-2.0/schemas + +# set up lightdm autologin +sed -i 's/^#autologin-user=.*/autologin-user=liveuser/' /etc/lightdm/lightdm.conf +sed -i 's/^#autologin-user-timeout=.*/autologin-user-timeout=0/' /etc/lightdm/lightdm.conf +sed -i 's/^#show-language-selector=.*/show-language-selector=true/' /etc/lightdm/lightdm-gtk-greeter.conf + +# set MATE as default session, otherwise login will fail +sed -i 's/^#user-session=.*/user-session=mate/' /etc/lightdm/lightdm.conf + +# Turn off PackageKit-command-not-found while uninstalled +if [ -f /etc/PackageKit/CommandNotFound.conf ]; then + sed -i -e 's/^SoftwareSourceSearch=true/SoftwareSourceSearch=false/' /etc/PackageKit/CommandNotFound.conf +fi + +# The updater applet might or might not exist +rm -f /etc/xdg/autostart/org.mageia.dnfdragora-updater.desktop + +# reset selinux contexts +chown -R liveuser:liveuser /home/liveuser/ +restorecon -R /home/liveuser/ +restorecon -R / + +EOF + +# this doesn't come up automatically. not sure why. +systemctl enable --force lightdm.service + +# CRB needs to be enabled for EPEL to function. +dnf config-manager --set-enabled crb + +%end diff --git a/live/10/aarch64/peridot/rocky-live-minimization.ks b/live/10/aarch64/peridot/rocky-live-minimization.ks new file mode 100644 index 0000000..3c64dff --- /dev/null +++ b/live/10/aarch64/peridot/rocky-live-minimization.ks @@ -0,0 +1,14 @@ +# Saving space +%packages + +# save some space +-mpage +-hplip +-isdn4k-utils + +# scanning takes quite a bit of space :/ +-xsane +-xsane-gimp +-sane-backends + +%end diff --git a/live/10/aarch64/peridot/rocky-live-workstation-lite.ks b/live/10/aarch64/peridot/rocky-live-workstation-lite.ks new file mode 100644 index 0000000..f9511ee --- /dev/null +++ b/live/10/aarch64/peridot/rocky-live-workstation-lite.ks @@ -0,0 +1,101 @@ +# Maintained by Release Engineering +# mailto:releng@rockylinux.org + +%include rocky-live-base.ks +%include rocky-workstation-common-lite.ks +# +# Disable this for now as packagekit is causing compose failures +# by leaving a gpg-agent around holding /dev/null open. +# +#include snippets/packagekit-cached-metadata.ks + +part / --size 7750 + +%post + +cat >> /etc/rc.d/init.d/livesys << EOF + + +# disable gnome-software automatically downloading updates +cat >> /usr/share/glib-2.0/schemas/org.gnome.software.gschema.override << FOE +[org.gnome.software] +download-updates=false +FOE + +# don't autostart gnome-software session service +rm -f /etc/xdg/autostart/gnome-software-service.desktop + +# disable the gnome-software shell search provider +cat >> /usr/share/gnome-shell/search-providers/org.gnome.Software-search-provider.ini << FOE +DefaultDisabled=true +FOE + +# don't run gnome-initial-setup +mkdir ~liveuser/.config +touch ~liveuser/.config/gnome-initial-setup-done + +# suppress anaconda spokes redundant with gnome-initial-setup +cat >> /etc/sysconfig/anaconda << FOE +[NetworkSpoke] +visited=1 + +[PasswordSpoke] +visited=1 + +[UserSpoke] +visited=1 +FOE + +# make the installer show up +if [ -f /usr/share/applications/liveinst.desktop ]; then + # Show harddisk install in shell dash + sed -i -e 's/NoDisplay=true/NoDisplay=false/' /usr/share/applications/liveinst.desktop "" + # need to move it to anaconda.desktop to make shell happy + mv /usr/share/applications/liveinst.desktop /usr/share/applications/anaconda.desktop + + cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +[org.gnome.shell] +favorite-apps=['firefox.desktop', 'evolution.desktop', 'org.gnome.Nautilus.desktop', 'anaconda.desktop'] +FOE + + # Make the welcome screen show up + if [ -f /usr/share/anaconda/gnome/fedora-welcome.desktop ]; then + mkdir -p ~liveuser/.config/autostart + cp /usr/share/anaconda/gnome/fedora-welcome.desktop /usr/share/applications/ + cp /usr/share/anaconda/gnome/fedora-welcome.desktop ~liveuser/.config/autostart/ + fi + + # Disable GNOME welcome tour so it doesn't overlap with Fedora welcome screen + cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +welcome-dialog-last-shown-version='4294967295' +FOE + + # Copy Anaconda branding in place + if [ -d /usr/share/lorax/product/usr/share/anaconda ]; then + cp -a /usr/share/lorax/product/* / + fi +fi + +# rebuild schema cache with any overrides we installed +glib-compile-schemas /usr/share/glib-2.0/schemas + +# set up auto-login +cat > /etc/gdm/custom.conf << FOE +[daemon] +AutomaticLoginEnable=True +AutomaticLogin=liveuser +FOE + +# Turn off PackageKit-command-not-found while uninstalled +if [ -f /etc/PackageKit/CommandNotFound.conf ]; then + sed -i -e 's/^SoftwareSourceSearch=true/SoftwareSourceSearch=false/' /etc/PackageKit/CommandNotFound.conf +fi + +# make sure to set the right permissions and selinux contexts +chown -R liveuser:liveuser /home/liveuser/ +restorecon -R /home/liveuser/ +restorecon -R / + +EOF + +%end diff --git a/live/10/aarch64/peridot/rocky-live-workstation.ks b/live/10/aarch64/peridot/rocky-live-workstation.ks new file mode 100644 index 0000000..7266a6f --- /dev/null +++ b/live/10/aarch64/peridot/rocky-live-workstation.ks @@ -0,0 +1,102 @@ +# Maintained by Release Engineering +# mailto:releng@rockylinux.org + +%include rocky-live-base.ks +%include rocky-workstation-common.ks +# +# Disable this for now as packagekit is causing compose failures +# by leaving a gpg-agent around holding /dev/null open. +# +#include snippets/packagekit-cached-metadata.ks + +part / --size 7750 + +%post + +cat >> /etc/rc.d/init.d/livesys << EOF + + +# disable gnome-software automatically downloading updates +cat >> /usr/share/glib-2.0/schemas/org.gnome.software.gschema.override << FOE +[org.gnome.software] +allow-updates=false +download-updates=false +FOE + +# don't autostart gnome-software session service +rm -f /etc/xdg/autostart/gnome-software-service.desktop + +# disable the gnome-software shell search provider +cat >> /usr/share/gnome-shell/search-providers/org.gnome.Software-search-provider.ini << FOE +DefaultDisabled=true +FOE + +# don't run gnome-initial-setup +mkdir ~liveuser/.config +touch ~liveuser/.config/gnome-initial-setup-done + +# suppress anaconda spokes redundant with gnome-initial-setup +cat >> /etc/sysconfig/anaconda << FOE +[NetworkSpoke] +visited=1 + +[PasswordSpoke] +visited=1 + +[UserSpoke] +visited=1 +FOE + +# make the installer show up +if [ -f /usr/share/applications/liveinst.desktop ]; then + # Show harddisk install in shell dash + sed -i -e 's/NoDisplay=true/NoDisplay=false/' /usr/share/applications/liveinst.desktop "" + # need to move it to anaconda.desktop to make shell happy + mv /usr/share/applications/liveinst.desktop /usr/share/applications/anaconda.desktop + + cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +[org.gnome.shell] +favorite-apps=['firefox.desktop', 'evolution.desktop', 'org.gnome.Nautilus.desktop', 'anaconda.desktop'] +FOE + + # Make the welcome screen show up + if [ -f /usr/share/anaconda/gnome/fedora-welcome.desktop ]; then + mkdir -p ~liveuser/.config/autostart + cp /usr/share/anaconda/gnome/fedora-welcome.desktop /usr/share/applications/ + cp /usr/share/anaconda/gnome/fedora-welcome.desktop ~liveuser/.config/autostart/ + fi + + # Disable GNOME welcome tour so it doesn't overlap with Fedora welcome screen + cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +welcome-dialog-last-shown-version='4294967295' +FOE + + # Copy Anaconda branding in place + if [ -d /usr/share/lorax/product/usr/share/anaconda ]; then + cp -a /usr/share/lorax/product/* / + fi +fi + +# rebuild schema cache with any overrides we installed +glib-compile-schemas /usr/share/glib-2.0/schemas + +# set up auto-login +cat > /etc/gdm/custom.conf << FOE +[daemon] +AutomaticLoginEnable=True +AutomaticLogin=liveuser +FOE + +# Turn off PackageKit-command-not-found while uninstalled +if [ -f /etc/PackageKit/CommandNotFound.conf ]; then + sed -i -e 's/^SoftwareSourceSearch=true/SoftwareSourceSearch=false/' /etc/PackageKit/CommandNotFound.conf +fi + +# make sure to set the right permissions and selinux contexts +chown -R liveuser:liveuser /home/liveuser/ +restorecon -R /home/liveuser/ +restorecon -R / + +EOF + +%end diff --git a/live/10/aarch64/peridot/rocky-live-xfce-common.ks b/live/10/aarch64/peridot/rocky-live-xfce-common.ks new file mode 100644 index 0000000..1231a0d --- /dev/null +++ b/live/10/aarch64/peridot/rocky-live-xfce-common.ks @@ -0,0 +1,90 @@ +# xfce +%packages + +# these aren't an epel thing for some reason. +@xfce-desktop --nodefaults +#@^xfce-desktop-environment +#@xfce-apps +#@xfce-extra-plugins +#@xfce-media +#@xfce-office + +# Manual install... +#geany +gparted +#mousepad +#ristretto +seahorse +#transmission +pcp-selinux +lightdm +#gdm +-gdm +-gnome-shell + +# Some stuff might already be here, doesn't hurt to list it. +firefox +thunderbird +firewall-config +#pidgin +rocky-backgrounds +rocky-backgrounds-compat +rocky-release +gparted +#rhythmbox + +xfce4-about +xfce4-taskmanager +#xfce4-battery-plugin +xfce4-datetime-plugin +xfce4-netload-plugin +xfce4-notifyd +#xfce4-places-plugin +xfce4-screenshooter-plugin +xfce4-smartbookmark-plugin +xfce4-systemload-plugin +xfce4-time-out-plugin +xfce4-weather-plugin +xfce4-whiskermenu-plugin +#xfdashboard +#xfdashboard-themes +pavucontrol + +# XFCE group defaults +xfce4-appfinder +xfce4-power-manager +#xfce4-pulseaudio-plugin +xfce4-screensaver +xfce4-terminal +network-manager-applet +openssh-askpass +thunar-archive-plugin +thunar-volman +tumbler +xfce-polkit + +wget +xdg-user-dirs +xdg-user-dirs-gtk + +# help welcome screen +gjs + +# save some space +-autofs +-acpid +-gimp-help +-desktop-backgrounds-basic +-aspell-* +-xfce4-sensors-plugin +-xfce4-eyes-plugin + +### MINIMIZATION +-mpage +-hplip +-isdn4k-utils +-xsane +-xsane-gimp +-sane-backends + +%end diff --git a/live/10/aarch64/peridot/rocky-live-xfce.ks b/live/10/aarch64/peridot/rocky-live-xfce.ks new file mode 100644 index 0000000..6f6a94f --- /dev/null +++ b/live/10/aarch64/peridot/rocky-live-xfce.ks @@ -0,0 +1,118 @@ +# rocky-live-kde.ks +# BROKEN + +%include rocky-live-base-spin.ks +%include rocky-live-xfce-common.ks + +part / --size 6144 + +%post +# xfce configuration + +# create /etc/sysconfig/desktop (needed for installation) + +cat > /etc/sysconfig/desktop <> /etc/rc.d/init.d/livesys << EOF + +mkdir -p /home/liveuser/.config/xfce4 +# ugly stuff, this should give us a default background for now +#mkdir -p /usr/share/backgrounds/images +#ln -s /usr/share/backgrounds/f32/default/f32.png \ +# /usr/share/backgrounds/images/default.png + +cat > /home/liveuser/.config/xfce4/helpers.rc << FOE +MailReader=sylpheed-claws +FileManager=Thunar +WebBrowser=firefox +FOE + +# disable screensaver locking (#674410) +cat >> /home/liveuser/.xscreensaver << FOE +mode: off +lock: False +dpmsEnabled: False +FOE + +# deactivate xfconf-migration (#683161) +rm -f /etc/xdg/autostart/xfconf-migration-4.6.desktop || : + +# deactivate xfce4-panel first-run dialog (#693569) +mkdir -p /home/liveuser/.config/xfce4/xfconf/xfce-perchannel-xml +cp /etc/xdg/xfce4/panel/default.xml /home/liveuser/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml + +# set up lightdm autologin +sed -i 's/^#autologin-user=.*/autologin-user=liveuser/' /etc/lightdm/lightdm.conf +sed -i 's/^#autologin-user-timeout=.*/autologin-user-timeout=0/' /etc/lightdm/lightdm.conf +sed -i 's/^#show-language-selector=.*/show-language-selector=true/' /etc/lightdm/lightdm-gtk-greeter.conf + +# set Xfce as default session, otherwise login will fail +sed -i 's/^#user-session=.*/user-session=xfce/' /etc/lightdm/lightdm.conf + +# debrand +#sed -i "s/Red Hat Enterprise/Rocky/g" /usr/share/anaconda/gnome/fedora-welcome.desktop +#sed -i "s/RHEL/Rocky Linux/g" /usr/share/anaconda/gnome/fedora-welcome +#sed -i "s/Red Hat Enterprise/Rocky/g" /usr/share/anaconda/gnome/fedora-welcome +#sed -i "s/org.fedoraproject.AnacondaInstaller/fedora-logo-icon/g" /usr/share/anaconda/gnome/fedora-welcome +#sed -i "s/org.fedoraproject.AnacondaInstaller/fedora-logo-icon/g" /usr/share/applications/liveinst.desktop + +# set default background +cat > /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-desktop.xml < + + + + + + + + + + + + + + +XFCEEOF + +# Show harddisk install on the desktop +sed -i -e 's/NoDisplay=true/NoDisplay=false/' /usr/share/applications/liveinst.desktop +mkdir /home/liveuser/Desktop +cp /usr/share/applications/liveinst.desktop /home/liveuser/Desktop/ + +if [ -f /usr/share/anaconda/gnome/fedora-welcome.desktop ]; then + mkdir -p ~liveuser/.config/autostart + cp /usr/share/anaconda/gnome/fedora-welcome.desktop /usr/share/applications/ + cp /usr/share/anaconda/gnome/fedora-welcome.desktop ~liveuser/.config/autostart/ +fi + +# no updater applet in live environment +rm -f /etc/xdg/autostart/org.mageia.dnfdragora-updater.desktop + +# and mark it as executable (new Xfce security feature) +chmod +x /home/liveuser/Desktop/liveinst.desktop + +cat > ~liveuser/.profile << PROFILE_EOF +export XDG_DATA_DIRS="\\\${XDG_DATA_DIRS}:\\\${HOME}/Desktop" +PROFILE_EOF + +# move to anaconda - probably not required for XFCE. +mv /usr/share/applications/liveinst.desktop /usr/share/applications/anaconda.desktop + +# this goes at the end after all other changes. +chown -R liveuser:liveuser /home/liveuser +restorecon -R /home/liveuser +restorecon -R / + +EOF + +# this doesn't come up automatically. not sure why. +systemctl enable --force lightdm.service + +# CRB needs to be enabled for EPEL to function. +dnf config-manager --set-enabled crb + +%end diff --git a/live/10/aarch64/peridot/rocky-repo-epel.ks b/live/10/aarch64/peridot/rocky-repo-epel.ks new file mode 100644 index 0000000..6d326bb --- /dev/null +++ b/live/10/aarch64/peridot/rocky-repo-epel.ks @@ -0,0 +1,12 @@ +# These should change based on the major/minor release + +# Base repos +repo --name=BaseOS --cost=200 --baseurl=https://yumrepofs.build.resf.org/v1/projects/6202c09e-6252-4d3a-bcd3-9c7751682970/repo/hashed-BaseOS/$basearch +repo --name=AppStream --cost=200 --baseurl=https://yumrepofs.build.resf.org/v1/projects/6202c09e-6252-4d3a-bcd3-9c7751682970/repo/hashed-AppStream/$basearch +repo --name=CRB --cost=200 --baseurl=https://yumrepofs.build.resf.org/v1/projects/6202c09e-6252-4d3a-bcd3-9c7751682970/repo/hashed-CRB/$basearch +repo --name=extras --cost=200 --baseurl=https://yumrepofs.build.resf.org/v1/projects/6202c09e-6252-4d3a-bcd3-9c7751682970/repo/hashed-extras/$basearch +repo --name=epel --cost=200 --baseurl=https://dl.fedoraproject.org/pub/epel/9/Everything/$basearch/ +#repo --name=epel-modular --cost=200 --baseurl=https://dl.fedoraproject.org/pub/epel/9/Modular/$basearch/ + +# URL to the base os repo +url --url=https://yumrepofs.build.resf.org/v1/projects/6202c09e-6252-4d3a-bcd3-9c7751682970/repo/hashed-BaseOS/$basearch diff --git a/live/10/aarch64/peridot/rocky-repo.ks b/live/10/aarch64/peridot/rocky-repo.ks new file mode 100644 index 0000000..050b3bb --- /dev/null +++ b/live/10/aarch64/peridot/rocky-repo.ks @@ -0,0 +1,10 @@ +# These should change based on the major/minor release + +# Base repos +repo --name=BaseOS --cost=200 --baseurl=https://yumrepofs.build.resf.org/v1/projects/6202c09e-6252-4d3a-bcd3-9c7751682970/repo/hashed-BaseOS/$basearch +repo --name=AppStream --cost=200 --baseurl=https://yumrepofs.build.resf.org/v1/projects/6202c09e-6252-4d3a-bcd3-9c7751682970/repo/hashed-AppStream/$basearch +repo --name=CRB --cost=200 --baseurl=https://yumrepofs.build.resf.org/v1/projects/6202c09e-6252-4d3a-bcd3-9c7751682970/repo/hashed-CRB/$basearch +repo --name=extras --cost=200 --baseurl=https://yumrepofs.build.resf.org/v1/projects/6202c09e-6252-4d3a-bcd3-9c7751682970/repo/hashed-extras/$basearch + +# URL to the base os repo +url --url=https://yumrepofs.build.resf.org/v1/projects/6202c09e-6252-4d3a-bcd3-9c7751682970/repo/hashed-BaseOS/$basearch diff --git a/live/10/aarch64/peridot/rocky-workstation-common-lite.ks b/live/10/aarch64/peridot/rocky-workstation-common-lite.ks new file mode 100644 index 0000000..e26d9dd --- /dev/null +++ b/live/10/aarch64/peridot/rocky-workstation-common-lite.ks @@ -0,0 +1,27 @@ +%packages + +# Exclude unwanted groups that rocky-live-base.ks pulls in +-@dial-up +-@input-methods +-@standard + +# Make sure to sync any additions / removals done here with +# workstation-product-environment in comps +@base-x +@core +@fonts +@gnome-desktop +@guest-desktop-agents +@hardware-support +@internet-browser +@networkmanager-submodules + +# Libreoffice +#libreoffice-calc +#libreoffice-writer + +# Exclude unwanted packages from @anaconda-tools group +-gfs2-utils +-reiserfs-utils + +%end diff --git a/live/10/aarch64/peridot/rocky-workstation-common.ks b/live/10/aarch64/peridot/rocky-workstation-common.ks new file mode 100644 index 0000000..1d45e45 --- /dev/null +++ b/live/10/aarch64/peridot/rocky-workstation-common.ks @@ -0,0 +1,32 @@ +%packages + +# Exclude unwanted groups that rocky-live-base.ks pulls in +-@dial-up +-@input-methods +-@standard + +# Make sure to sync any additions / removals done here with +# workstation-product-environment in comps +@base-x +@core +@fonts +@gnome-desktop +@guest-desktop-agents +@hardware-support +@internet-browser +@multimedia +@networkmanager-submodules +@workstation-product + +# Libreoffice +#libreoffice-calc +#libreoffice-emailmerge +#libreoffice-graphicfilter +#libreoffice-impress +#libreoffice-writer + +# Exclude unwanted packages from @anaconda-tools group +-gfs2-utils +-reiserfs-utils + +%end diff --git a/live/10/aarch64/prod/rocky-live-base-spin.ks b/live/10/aarch64/prod/rocky-live-base-spin.ks new file mode 100644 index 0000000..2991229 --- /dev/null +++ b/live/10/aarch64/prod/rocky-live-base-spin.ks @@ -0,0 +1,118 @@ +# rocky-live-base-spin.ks +# +# Base installation information for Rocky Linux images +# Contains EPEL. +# + +lang en_US.UTF-8 +keyboard us +timezone US/Eastern +selinux --enforcing +firewall --enabled --service=mdns +xconfig --startxonboot +zerombr +clearpart --all +part / --size 5120 --fstype ext4 +services --enabled=NetworkManager,ModemManager --disabled=sshd +network --bootproto=dhcp --device=link --activate +rootpw --lock --iscrypted locked +shutdown + +%include rocky-repo-epel.ks + +%packages +@base-x +@guest-desktop-agents +@standard +@core +@fonts +@input-methods +@dial-up +@multimedia +@hardware-support + +# explicit +kernel +kernel-modules +kernel-modules-extra +#memtest86+ +anaconda +anaconda-install-env-deps +anaconda-live +@anaconda-tools +efi-filesystem +efivar-libs +efibootmgr +grub2-common +grub2-efi-*64 +grub2-efi-*64-cdboot +#grub2-pc-modules +grub2-tools +#grub2-tools-efi +grub2-tools-extra +grub2-tools-minimal +grubby +shim-*64 +-shim-unsigned-*64 +-fcoe-utils + +# Required for SVG rnotes images +aajohan-comfortaa-fonts + +# RHBZ#1242586 - Required for initramfs creation +dracut-live +#syslinux + +# Anaconda needs all the locales available, just like a DVD installer +glibc-all-langpacks + +# adapted from fedora +livesys-scripts + +# absolutely required - don't want a system that can't actually update +epel-release +%end + +%post +systemctl enable livesys.service +systemctl enable livesys-late.service +systemctl enable tmp.mount + +cat >> /etc/fstab << EOF +vartmp /var/tmp tmpfs defaults 0 0 +EOF + +# fix packagekit +rm -f /var/lib/rpm/__db* +echo "Packages within this LiveCD" +rpm -qa --qf '%{size}\t%{name}-%{version}-%{release}.%{arch}\n' |sort -rn +# Note that running rpm recreates the rpm db files which aren't needed or wanted +rm -f /var/lib/rpm/__db* + +# go ahead and pre-make the man -k cache (#455968) +/usr/bin/mandb + +# make sure there aren't core files lying around +rm -f /core* + +# remove random seed, the newly installed instance should make it's own +rm -f /var/lib/systemd/random-seed + +# convince readahead not to collect +# FIXME: for systemd +echo 'File created by kickstart. See systemd-update-done.service(8).' \ + | tee /etc/.updated >/var/.updated + +# Drop the rescue kernel and initramfs, we don't need them on the live media itself. +# See bug 1317709 +rm -f /boot/*-rescue* + +# Disable network service here, as doing it in the services line +# fails due to RHBZ #1369794 +systemctl disable network + +# Remove machine-id on pre generated images +rm -f /etc/machine-id +touch /etc/machine-id + +%end diff --git a/live/10/aarch64/prod/rocky-live-base.ks b/live/10/aarch64/prod/rocky-live-base.ks new file mode 100644 index 0000000..96ba7ab --- /dev/null +++ b/live/10/aarch64/prod/rocky-live-base.ks @@ -0,0 +1,114 @@ +# rocky-live-base.ks +# +# Base installation information for Rocky Linux images +# + +lang en_US.UTF-8 +keyboard us +timezone US/Eastern +selinux --enforcing +firewall --enabled --service=mdns +xconfig --startxonboot +zerombr +clearpart --all +part / --size 5120 --fstype ext4 +services --enabled=NetworkManager,ModemManager --disabled=sshd +network --bootproto=dhcp --device=link --activate +rootpw --lock --iscrypted locked +shutdown + +%include rocky-repo.ks + +%packages +@base-x +@guest-desktop-agents +@standard +@core +@fonts +@input-methods +@dial-up +@multimedia +@hardware-support + +# explicit +kernel +kernel-modules +kernel-modules-extra +#memtest86+ +anaconda +anaconda-install-env-deps +anaconda-live +@anaconda-tools +efi-filesystem +efivar-libs +efibootmgr +grub2-common +grub2-efi-*64 +grub2-efi-*64-cdboot +#grub2-pc-modules +grub2-tools +#grub2-tools-efi +grub2-tools-extra +grub2-tools-minimal +grubby +shim-*64 +-shim-unsigned-*64 +-fcoe-utils + +# Required for SVG rnotes images +aajohan-comfortaa-fonts + +# RHBZ#1242586 - Required for initramfs creation +dracut-live +#syslinux + +# Anaconda needs all the locales available, just like a DVD installer +glibc-all-langpacks + +# adapted from fedora +livesys-scripts +%end + +%post +systemctl enable livesys.service +systemctl enable livesys-late.service +systemctl enable tmp.mount + +cat >> /etc/fstab << EOF +vartmp /var/tmp tmpfs defaults 0 0 +EOF + +# fix packagekit +rm -f /var/lib/rpm/__db* +echo "Packages within this LiveCD" +rpm -qa --qf '%{size}\t%{name}-%{version}-%{release}.%{arch}\n' |sort -rn +# Note that running rpm recreates the rpm db files which aren't needed or wanted +rm -f /var/lib/rpm/__db* + +# go ahead and pre-make the man -k cache (#455968) +/usr/bin/mandb + +# make sure there aren't core files lying around +rm -f /core* + +# remove random seed, the newly installed instance should make it's own +rm -f /var/lib/systemd/random-seed + +# convince readahead not to collect +# FIXME: for systemd +echo 'File created by kickstart. See systemd-update-done.service(8).' \ + | tee /etc/.updated >/var/.updated + +# Drop the rescue kernel and initramfs, we don't need them on the live media itself. +# See bug 1317709 +rm -f /boot/*-rescue* + +# Disable network service here, as doing it in the services line +# fails due to RHBZ #1369794 +systemctl disable network + +# Remove machine-id on pre generated images +rm -f /etc/machine-id +touch /etc/machine-id + +%end diff --git a/live/10/aarch64/prod/rocky-live-cinnamon-common.ks b/live/10/aarch64/prod/rocky-live-cinnamon-common.ks new file mode 100644 index 0000000..b27b305 --- /dev/null +++ b/live/10/aarch64/prod/rocky-live-cinnamon-common.ks @@ -0,0 +1,77 @@ +# cinnamon +%packages +rocky-backgrounds +rocky-release +thunderbird +firefox +f40-backgrounds-gnome +f40-backgrounds-extras-gnome +gjs + +NetworkManager-adsl +NetworkManager-bluetooth +NetworkManager-l2tp-gnome +NetworkManager-libreswan-gnome +NetworkManager-openconnect-gnome +NetworkManager-openvpn-gnome +NetworkManager-ppp +NetworkManager-pptp-gnome +NetworkManager-wifi +NetworkManager-wwan +cinnamon +cinnamon-control-center +cinnamon-screensaver +eom +firewall-config +gnome-calculator +gnome-disk-utility +gnome-screenshot +gnome-system-monitor +gnome-terminal +gstreamer1-plugins-ugly-free +gvfs-gphoto2 +gvfs-mtp +gvfs-smb +#hexchat +imsettings-systemd +initial-setup-gui +lightdm +metacity +nemo-fileroller +nemo-image-converter +nemo-preview +nm-connection-editor +pipewire-alsa +pipewire-pulseaudio +powerline +redshift-gtk +sane-backends-drivers-scanners +setroubleshoot +slick-greeter +slick-greeter-cinnamon +tmux +tmux-powerline +transmission +vim-enhanced +vim-powerline +xdg-user-dirs-gtk +xed +xreader +wireplumber + +parole +#audacious +#rhythmbox + +#libreoffice-calc +#libreoffice-emailmerge +#libreoffice-graphicfilter +#libreoffice-impress +#libreoffice-writer + +-xsane +-xane-gimp +-mpage +-hplip +-isdn4k-utils +%end diff --git a/live/10/aarch64/prod/rocky-live-cinnamon.ks b/live/10/aarch64/prod/rocky-live-cinnamon.ks new file mode 100644 index 0000000..9a5c562 --- /dev/null +++ b/live/10/aarch64/prod/rocky-live-cinnamon.ks @@ -0,0 +1,24 @@ +# rocky-live-cinnamon.ks + +%include rocky-live-base-spin.ks +%include rocky-live-cinnamon-common.ks + +part / --size 8192 + +%post +# cinnamon configuration + +cat > /etc/sysconfig/desktop < /root/.gtkrc-2.0 << EOF +include "/usr/share/themes/Adwaita/gtk-2.0/gtkrc" +include "/etc/gtk-2.0/gtkrc" +gtk-theme-name="Adwaita" +EOF +mkdir -p /root/.config/gtk-3.0 +cat > /root/.config/gtk-3.0/settings.ini << EOF +[Settings] +gtk-theme-name = Adwaita +EOF + +rm -f /usr/share/wallpapers/Fedora +ln -s rocky-abstract-2 /usr/share/wallpapers/Fedora + +systemctl enable --force sddm.service +dnf config-manager --set-enabled crb + +cat > /etc/sddm.conf.d/theme.conf <> /etc/rc.d/init.d/livesys << EOF + + +# disable gnome-software automatically downloading updates +cat >> /usr/share/glib-2.0/schemas/org.gnome.software.gschema.override << FOE +[org.gnome.software] +download-updates=false +FOE + +# don't autostart gnome-software session service +rm -f /etc/xdg/autostart/gnome-software-service.desktop + +# disable the gnome-software shell search provider +cat >> /usr/share/gnome-shell/search-providers/org.gnome.Software-search-provider.ini << FOE +DefaultDisabled=true +FOE + +# don't run gnome-initial-setup +mkdir ~liveuser/.config +touch ~liveuser/.config/gnome-initial-setup-done + +# suppress anaconda spokes redundant with gnome-initial-setup +cat >> /etc/sysconfig/anaconda << FOE +[NetworkSpoke] +visited=1 + +[PasswordSpoke] +visited=1 + +[UserSpoke] +visited=1 +FOE + +# make the installer show up +if [ -f /usr/share/applications/liveinst.desktop ]; then + # Show harddisk install in shell dash + sed -i -e 's/NoDisplay=true/NoDisplay=false/' /usr/share/applications/liveinst.desktop "" + # need to move it to anaconda.desktop to make shell happy + mv /usr/share/applications/liveinst.desktop /usr/share/applications/anaconda.desktop + + cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +[org.gnome.shell] +favorite-apps=['firefox.desktop', 'evolution.desktop', 'org.gnome.Nautilus.desktop', 'anaconda.desktop'] +FOE + + # Make the welcome screen show up + if [ -f /usr/share/anaconda/gnome/fedora-welcome.desktop ]; then + mkdir -p ~liveuser/.config/autostart + cp /usr/share/anaconda/gnome/fedora-welcome.desktop /usr/share/applications/ + cp /usr/share/anaconda/gnome/fedora-welcome.desktop ~liveuser/.config/autostart/ + fi + + # Disable GNOME welcome tour so it doesn't overlap with Fedora welcome screen + cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +welcome-dialog-last-shown-version='4294967295' +FOE + + # Copy Anaconda branding in place + if [ -d /usr/share/lorax/product/usr/share/anaconda ]; then + cp -a /usr/share/lorax/product/* / + fi +fi + +# rebuild schema cache with any overrides we installed +glib-compile-schemas /usr/share/glib-2.0/schemas + +# set up auto-login +cat > /etc/gdm/custom.conf << FOE +[daemon] +AutomaticLoginEnable=True +AutomaticLogin=liveuser +FOE + +# Turn off PackageKit-command-not-found while uninstalled +if [ -f /etc/PackageKit/CommandNotFound.conf ]; then + sed -i -e 's/^SoftwareSourceSearch=true/SoftwareSourceSearch=false/' /etc/PackageKit/CommandNotFound.conf +fi + +# make sure to set the right permissions and selinux contexts +chown -R liveuser:liveuser /home/liveuser/ +restorecon -R /home/liveuser/ +restorecon -R / + +EOF + +%end diff --git a/live/10/aarch64/prod/rocky-live-workstation.ks b/live/10/aarch64/prod/rocky-live-workstation.ks new file mode 100644 index 0000000..3a5c9b5 --- /dev/null +++ b/live/10/aarch64/prod/rocky-live-workstation.ks @@ -0,0 +1,18 @@ +# Maintained by Release Engineering +# mailto:releng@rockylinux.org + +%include rocky-live-base.ks +%include rocky-workstation-common.ks +# +# Disable this for now as packagekit is causing compose failures +# by leaving a gpg-agent around holding /dev/null open. +# +#include snippets/packagekit-cached-metadata.ks + +part / --size 7750 + +%post + +sed -i 's/^livesys_session=.*/livesys_session="gnome"/' /etc/sysconfig/livesys + +%end diff --git a/live/10/aarch64/prod/rocky-live-xfce-common.ks b/live/10/aarch64/prod/rocky-live-xfce-common.ks new file mode 100644 index 0000000..1231a0d --- /dev/null +++ b/live/10/aarch64/prod/rocky-live-xfce-common.ks @@ -0,0 +1,90 @@ +# xfce +%packages + +# these aren't an epel thing for some reason. +@xfce-desktop --nodefaults +#@^xfce-desktop-environment +#@xfce-apps +#@xfce-extra-plugins +#@xfce-media +#@xfce-office + +# Manual install... +#geany +gparted +#mousepad +#ristretto +seahorse +#transmission +pcp-selinux +lightdm +#gdm +-gdm +-gnome-shell + +# Some stuff might already be here, doesn't hurt to list it. +firefox +thunderbird +firewall-config +#pidgin +rocky-backgrounds +rocky-backgrounds-compat +rocky-release +gparted +#rhythmbox + +xfce4-about +xfce4-taskmanager +#xfce4-battery-plugin +xfce4-datetime-plugin +xfce4-netload-plugin +xfce4-notifyd +#xfce4-places-plugin +xfce4-screenshooter-plugin +xfce4-smartbookmark-plugin +xfce4-systemload-plugin +xfce4-time-out-plugin +xfce4-weather-plugin +xfce4-whiskermenu-plugin +#xfdashboard +#xfdashboard-themes +pavucontrol + +# XFCE group defaults +xfce4-appfinder +xfce4-power-manager +#xfce4-pulseaudio-plugin +xfce4-screensaver +xfce4-terminal +network-manager-applet +openssh-askpass +thunar-archive-plugin +thunar-volman +tumbler +xfce-polkit + +wget +xdg-user-dirs +xdg-user-dirs-gtk + +# help welcome screen +gjs + +# save some space +-autofs +-acpid +-gimp-help +-desktop-backgrounds-basic +-aspell-* +-xfce4-sensors-plugin +-xfce4-eyes-plugin + +### MINIMIZATION +-mpage +-hplip +-isdn4k-utils +-xsane +-xsane-gimp +-sane-backends + +%end diff --git a/live/10/aarch64/prod/rocky-live-xfce.ks b/live/10/aarch64/prod/rocky-live-xfce.ks new file mode 100644 index 0000000..04242a2 --- /dev/null +++ b/live/10/aarch64/prod/rocky-live-xfce.ks @@ -0,0 +1,27 @@ +# rocky-live-kde.ks +# BROKEN + +%include rocky-live-base-spin.ks +%include rocky-live-xfce-common.ks + +part / --size 6144 + +%post +# xfce configuration + +# create /etc/sysconfig/desktop (needed for installation) + +cat > /etc/sysconfig/desktop <> /etc/fstab << EOF +vartmp /var/tmp tmpfs defaults 0 0 +EOF + +# fix packagekit +rm -f /var/lib/rpm/__db* +echo "Packages within this LiveCD" +rpm -qa --qf '%{size}\t%{name}-%{version}-%{release}.%{arch}\n' |sort -rn +# Note that running rpm recreates the rpm db files which aren't needed or wanted +rm -f /var/lib/rpm/__db* + +# go ahead and pre-make the man -k cache (#455968) +/usr/bin/mandb + +# make sure there aren't core files lying around +rm -f /core* + +# remove random seed, the newly installed instance should make it's own +rm -f /var/lib/systemd/random-seed + +# convince readahead not to collect +# FIXME: for systemd +echo 'File created by kickstart. See systemd-update-done.service(8).' \ + | tee /etc/.updated >/var/.updated + +# Drop the rescue kernel and initramfs, we don't need them on the live media itself. +# See bug 1317709 +rm -f /boot/*-rescue* + +# Disable network service here, as doing it in the services line +# fails due to RHBZ #1369794 +systemctl disable network + +# Remove machine-id on pre generated images +rm -f /etc/machine-id +touch /etc/machine-id + +%end diff --git a/live/10/aarch64/stage/rocky-live-base.ks b/live/10/aarch64/stage/rocky-live-base.ks new file mode 100644 index 0000000..96ba7ab --- /dev/null +++ b/live/10/aarch64/stage/rocky-live-base.ks @@ -0,0 +1,114 @@ +# rocky-live-base.ks +# +# Base installation information for Rocky Linux images +# + +lang en_US.UTF-8 +keyboard us +timezone US/Eastern +selinux --enforcing +firewall --enabled --service=mdns +xconfig --startxonboot +zerombr +clearpart --all +part / --size 5120 --fstype ext4 +services --enabled=NetworkManager,ModemManager --disabled=sshd +network --bootproto=dhcp --device=link --activate +rootpw --lock --iscrypted locked +shutdown + +%include rocky-repo.ks + +%packages +@base-x +@guest-desktop-agents +@standard +@core +@fonts +@input-methods +@dial-up +@multimedia +@hardware-support + +# explicit +kernel +kernel-modules +kernel-modules-extra +#memtest86+ +anaconda +anaconda-install-env-deps +anaconda-live +@anaconda-tools +efi-filesystem +efivar-libs +efibootmgr +grub2-common +grub2-efi-*64 +grub2-efi-*64-cdboot +#grub2-pc-modules +grub2-tools +#grub2-tools-efi +grub2-tools-extra +grub2-tools-minimal +grubby +shim-*64 +-shim-unsigned-*64 +-fcoe-utils + +# Required for SVG rnotes images +aajohan-comfortaa-fonts + +# RHBZ#1242586 - Required for initramfs creation +dracut-live +#syslinux + +# Anaconda needs all the locales available, just like a DVD installer +glibc-all-langpacks + +# adapted from fedora +livesys-scripts +%end + +%post +systemctl enable livesys.service +systemctl enable livesys-late.service +systemctl enable tmp.mount + +cat >> /etc/fstab << EOF +vartmp /var/tmp tmpfs defaults 0 0 +EOF + +# fix packagekit +rm -f /var/lib/rpm/__db* +echo "Packages within this LiveCD" +rpm -qa --qf '%{size}\t%{name}-%{version}-%{release}.%{arch}\n' |sort -rn +# Note that running rpm recreates the rpm db files which aren't needed or wanted +rm -f /var/lib/rpm/__db* + +# go ahead and pre-make the man -k cache (#455968) +/usr/bin/mandb + +# make sure there aren't core files lying around +rm -f /core* + +# remove random seed, the newly installed instance should make it's own +rm -f /var/lib/systemd/random-seed + +# convince readahead not to collect +# FIXME: for systemd +echo 'File created by kickstart. See systemd-update-done.service(8).' \ + | tee /etc/.updated >/var/.updated + +# Drop the rescue kernel and initramfs, we don't need them on the live media itself. +# See bug 1317709 +rm -f /boot/*-rescue* + +# Disable network service here, as doing it in the services line +# fails due to RHBZ #1369794 +systemctl disable network + +# Remove machine-id on pre generated images +rm -f /etc/machine-id +touch /etc/machine-id + +%end diff --git a/live/10/aarch64/stage/rocky-live-cinnamon-common.ks b/live/10/aarch64/stage/rocky-live-cinnamon-common.ks new file mode 100644 index 0000000..b27b305 --- /dev/null +++ b/live/10/aarch64/stage/rocky-live-cinnamon-common.ks @@ -0,0 +1,77 @@ +# cinnamon +%packages +rocky-backgrounds +rocky-release +thunderbird +firefox +f40-backgrounds-gnome +f40-backgrounds-extras-gnome +gjs + +NetworkManager-adsl +NetworkManager-bluetooth +NetworkManager-l2tp-gnome +NetworkManager-libreswan-gnome +NetworkManager-openconnect-gnome +NetworkManager-openvpn-gnome +NetworkManager-ppp +NetworkManager-pptp-gnome +NetworkManager-wifi +NetworkManager-wwan +cinnamon +cinnamon-control-center +cinnamon-screensaver +eom +firewall-config +gnome-calculator +gnome-disk-utility +gnome-screenshot +gnome-system-monitor +gnome-terminal +gstreamer1-plugins-ugly-free +gvfs-gphoto2 +gvfs-mtp +gvfs-smb +#hexchat +imsettings-systemd +initial-setup-gui +lightdm +metacity +nemo-fileroller +nemo-image-converter +nemo-preview +nm-connection-editor +pipewire-alsa +pipewire-pulseaudio +powerline +redshift-gtk +sane-backends-drivers-scanners +setroubleshoot +slick-greeter +slick-greeter-cinnamon +tmux +tmux-powerline +transmission +vim-enhanced +vim-powerline +xdg-user-dirs-gtk +xed +xreader +wireplumber + +parole +#audacious +#rhythmbox + +#libreoffice-calc +#libreoffice-emailmerge +#libreoffice-graphicfilter +#libreoffice-impress +#libreoffice-writer + +-xsane +-xane-gimp +-mpage +-hplip +-isdn4k-utils +%end diff --git a/live/10/aarch64/stage/rocky-live-cinnamon.ks b/live/10/aarch64/stage/rocky-live-cinnamon.ks new file mode 100644 index 0000000..9a5c562 --- /dev/null +++ b/live/10/aarch64/stage/rocky-live-cinnamon.ks @@ -0,0 +1,24 @@ +# rocky-live-cinnamon.ks + +%include rocky-live-base-spin.ks +%include rocky-live-cinnamon-common.ks + +part / --size 8192 + +%post +# cinnamon configuration + +cat > /etc/sysconfig/desktop < /root/.gtkrc-2.0 << EOF +include "/usr/share/themes/Adwaita/gtk-2.0/gtkrc" +include "/etc/gtk-2.0/gtkrc" +gtk-theme-name="Adwaita" +EOF +mkdir -p /root/.config/gtk-3.0 +cat > /root/.config/gtk-3.0/settings.ini << EOF +[Settings] +gtk-theme-name = Adwaita +EOF + +rm -f /usr/share/wallpapers/Fedora +ln -s rocky-abstract-2 /usr/share/wallpapers/Fedora + +systemctl enable --force sddm.service +dnf config-manager --set-enabled crb + +cat > /etc/sddm.conf.d/theme.conf <> /etc/rc.d/init.d/livesys << EOF + + +# disable gnome-software automatically downloading updates +cat >> /usr/share/glib-2.0/schemas/org.gnome.software.gschema.override << FOE +[org.gnome.software] +download-updates=false +FOE + +# don't autostart gnome-software session service +rm -f /etc/xdg/autostart/gnome-software-service.desktop + +# disable the gnome-software shell search provider +cat >> /usr/share/gnome-shell/search-providers/org.gnome.Software-search-provider.ini << FOE +DefaultDisabled=true +FOE + +# don't run gnome-initial-setup +mkdir ~liveuser/.config +touch ~liveuser/.config/gnome-initial-setup-done + +# suppress anaconda spokes redundant with gnome-initial-setup +cat >> /etc/sysconfig/anaconda << FOE +[NetworkSpoke] +visited=1 + +[PasswordSpoke] +visited=1 + +[UserSpoke] +visited=1 +FOE + +# make the installer show up +if [ -f /usr/share/applications/liveinst.desktop ]; then + # Show harddisk install in shell dash + sed -i -e 's/NoDisplay=true/NoDisplay=false/' /usr/share/applications/liveinst.desktop "" + # need to move it to anaconda.desktop to make shell happy + mv /usr/share/applications/liveinst.desktop /usr/share/applications/anaconda.desktop + + cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +[org.gnome.shell] +favorite-apps=['firefox.desktop', 'evolution.desktop', 'org.gnome.Nautilus.desktop', 'anaconda.desktop'] +FOE + + # Make the welcome screen show up + if [ -f /usr/share/anaconda/gnome/fedora-welcome.desktop ]; then + mkdir -p ~liveuser/.config/autostart + cp /usr/share/anaconda/gnome/fedora-welcome.desktop /usr/share/applications/ + cp /usr/share/anaconda/gnome/fedora-welcome.desktop ~liveuser/.config/autostart/ + fi + + # Disable GNOME welcome tour so it doesn't overlap with Fedora welcome screen + cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +welcome-dialog-last-shown-version='4294967295' +FOE + + # Copy Anaconda branding in place + if [ -d /usr/share/lorax/product/usr/share/anaconda ]; then + cp -a /usr/share/lorax/product/* / + fi +fi + +# rebuild schema cache with any overrides we installed +glib-compile-schemas /usr/share/glib-2.0/schemas + +# set up auto-login +cat > /etc/gdm/custom.conf << FOE +[daemon] +AutomaticLoginEnable=True +AutomaticLogin=liveuser +FOE + +# Turn off PackageKit-command-not-found while uninstalled +if [ -f /etc/PackageKit/CommandNotFound.conf ]; then + sed -i -e 's/^SoftwareSourceSearch=true/SoftwareSourceSearch=false/' /etc/PackageKit/CommandNotFound.conf +fi + +# make sure to set the right permissions and selinux contexts +chown -R liveuser:liveuser /home/liveuser/ +restorecon -R /home/liveuser/ +restorecon -R / + +EOF + +%end diff --git a/live/10/aarch64/stage/rocky-live-workstation.ks b/live/10/aarch64/stage/rocky-live-workstation.ks new file mode 100644 index 0000000..3a5c9b5 --- /dev/null +++ b/live/10/aarch64/stage/rocky-live-workstation.ks @@ -0,0 +1,18 @@ +# Maintained by Release Engineering +# mailto:releng@rockylinux.org + +%include rocky-live-base.ks +%include rocky-workstation-common.ks +# +# Disable this for now as packagekit is causing compose failures +# by leaving a gpg-agent around holding /dev/null open. +# +#include snippets/packagekit-cached-metadata.ks + +part / --size 7750 + +%post + +sed -i 's/^livesys_session=.*/livesys_session="gnome"/' /etc/sysconfig/livesys + +%end diff --git a/live/10/aarch64/stage/rocky-live-xfce-common.ks b/live/10/aarch64/stage/rocky-live-xfce-common.ks new file mode 100644 index 0000000..1231a0d --- /dev/null +++ b/live/10/aarch64/stage/rocky-live-xfce-common.ks @@ -0,0 +1,90 @@ +# xfce +%packages + +# these aren't an epel thing for some reason. +@xfce-desktop --nodefaults +#@^xfce-desktop-environment +#@xfce-apps +#@xfce-extra-plugins +#@xfce-media +#@xfce-office + +# Manual install... +#geany +gparted +#mousepad +#ristretto +seahorse +#transmission +pcp-selinux +lightdm +#gdm +-gdm +-gnome-shell + +# Some stuff might already be here, doesn't hurt to list it. +firefox +thunderbird +firewall-config +#pidgin +rocky-backgrounds +rocky-backgrounds-compat +rocky-release +gparted +#rhythmbox + +xfce4-about +xfce4-taskmanager +#xfce4-battery-plugin +xfce4-datetime-plugin +xfce4-netload-plugin +xfce4-notifyd +#xfce4-places-plugin +xfce4-screenshooter-plugin +xfce4-smartbookmark-plugin +xfce4-systemload-plugin +xfce4-time-out-plugin +xfce4-weather-plugin +xfce4-whiskermenu-plugin +#xfdashboard +#xfdashboard-themes +pavucontrol + +# XFCE group defaults +xfce4-appfinder +xfce4-power-manager +#xfce4-pulseaudio-plugin +xfce4-screensaver +xfce4-terminal +network-manager-applet +openssh-askpass +thunar-archive-plugin +thunar-volman +tumbler +xfce-polkit + +wget +xdg-user-dirs +xdg-user-dirs-gtk + +# help welcome screen +gjs + +# save some space +-autofs +-acpid +-gimp-help +-desktop-backgrounds-basic +-aspell-* +-xfce4-sensors-plugin +-xfce4-eyes-plugin + +### MINIMIZATION +-mpage +-hplip +-isdn4k-utils +-xsane +-xsane-gimp +-sane-backends + +%end diff --git a/live/10/aarch64/stage/rocky-live-xfce.ks b/live/10/aarch64/stage/rocky-live-xfce.ks new file mode 100644 index 0000000..04242a2 --- /dev/null +++ b/live/10/aarch64/stage/rocky-live-xfce.ks @@ -0,0 +1,27 @@ +# rocky-live-kde.ks +# BROKEN + +%include rocky-live-base-spin.ks +%include rocky-live-xfce-common.ks + +part / --size 6144 + +%post +# xfce configuration + +# create /etc/sysconfig/desktop (needed for installation) + +cat > /etc/sysconfig/desktop <> /etc/fstab << EOF +vartmp /var/tmp tmpfs defaults 0 0 +EOF + +# fix packagekit +rm -f /var/lib/rpm/__db* +echo "Packages within this LiveCD" +rpm -qa --qf '%{size}\t%{name}-%{version}-%{release}.%{arch}\n' |sort -rn +# Note that running rpm recreates the rpm db files which aren't needed or wanted +rm -f /var/lib/rpm/__db* + +# go ahead and pre-make the man -k cache (#455968) +/usr/bin/mandb + +# make sure there aren't core files lying around +rm -f /core* + +# remove random seed, the newly installed instance should make it's own +rm -f /var/lib/systemd/random-seed + +# convince readahead not to collect +# FIXME: for systemd +echo 'File created by kickstart. See systemd-update-done.service(8).' \ + | tee /etc/.updated >/var/.updated + +# Drop the rescue kernel and initramfs, we don't need them on the live media itself. +# See bug 1317709 +rm -f /boot/*-rescue* + +# Disable network service here, as doing it in the services line +# fails due to RHBZ #1369794 +systemctl disable network + +# Remove machine-id on pre generated images +rm -f /etc/machine-id +touch /etc/machine-id + +%end diff --git a/live/10/x86_64/peridot/rocky-live-base.ks b/live/10/x86_64/peridot/rocky-live-base.ks new file mode 100644 index 0000000..a82ffe2 --- /dev/null +++ b/live/10/x86_64/peridot/rocky-live-base.ks @@ -0,0 +1,114 @@ +# rocky-live-base.ks +# +# Base installation information for Rocky Linux images +# + +lang en_US.UTF-8 +keyboard us +timezone US/Eastern +selinux --enforcing +firewall --enabled --service=mdns +xconfig --startxonboot +zerombr +clearpart --all +part / --size 5120 --fstype ext4 +services --enabled=NetworkManager,ModemManager --disabled=sshd +network --bootproto=dhcp --device=link --activate +rootpw --lock --iscrypted locked +shutdown + +%include rocky-repo.ks + +%packages +@base-x +@guest-desktop-agents +@standard +@core +@fonts +@input-methods +@dial-up +@multimedia +@hardware-support + +# explicit +kernel +kernel-modules +kernel-modules-extra +memtest86+ +anaconda +anaconda-install-env-deps +anaconda-live +@anaconda-tools +efi-filesystem +efivar-libs +efibootmgr +grub2-common +grub2-efi-*64 +grub2-efi-*64-cdboot +grub2-pc-modules +grub2-tools +grub2-tools-efi +grub2-tools-extra +grub2-tools-minimal +grubby +shim-*64 +-shim-unsigned-*64 +-fcoe-utils + +# Required for SVG rnotes images +aajohan-comfortaa-fonts + +# RHBZ#1242586 - Required for initramfs creation +dracut-live +syslinux + +# Anaconda needs all the locales available, just like a DVD installer +glibc-all-langpacks + +# adapted from fedora +livesys-scripts +%end + +%post +systemctl enable livesys.service +systemctl enable livesys-late.service +systemctl enable tmp.mount + +cat >> /etc/fstab << EOF +vartmp /var/tmp tmpfs defaults 0 0 +EOF + +# fix packagekit +rm -f /var/lib/rpm/__db* +echo "Packages within this LiveCD" +rpm -qa --qf '%{size}\t%{name}-%{version}-%{release}.%{arch}\n' |sort -rn +# Note that running rpm recreates the rpm db files which aren't needed or wanted +rm -f /var/lib/rpm/__db* + +# go ahead and pre-make the man -k cache (#455968) +/usr/bin/mandb + +# make sure there aren't core files lying around +rm -f /core* + +# remove random seed, the newly installed instance should make it's own +rm -f /var/lib/systemd/random-seed + +# convince readahead not to collect +# FIXME: for systemd +echo 'File created by kickstart. See systemd-update-done.service(8).' \ + | tee /etc/.updated >/var/.updated + +# Drop the rescue kernel and initramfs, we don't need them on the live media itself. +# See bug 1317709 +rm -f /boot/*-rescue* + +# Disable network service here, as doing it in the services line +# fails due to RHBZ #1369794 +systemctl disable network + +# Remove machine-id on pre generated images +rm -f /etc/machine-id +touch /etc/machine-id + +%end diff --git a/live/10/x86_64/peridot/rocky-live-cinnamon-common.ks b/live/10/x86_64/peridot/rocky-live-cinnamon-common.ks new file mode 100644 index 0000000..37c8855 --- /dev/null +++ b/live/10/x86_64/peridot/rocky-live-cinnamon-common.ks @@ -0,0 +1,77 @@ +# cinnamon +%packages +rocky-backgrounds +rocky-release +thunderbird +firefox +f40-backgrounds-gnome +f40-backgrounds-extras-gnome +gjs + +NetworkManager-adsl +NetworkManager-bluetooth +NetworkManager-l2tp-gnome +NetworkManager-libreswan-gnome +NetworkManager-openconnect-gnome +NetworkManager-openvpn-gnome +NetworkManager-ppp +NetworkManager-pptp-gnome +NetworkManager-wifi +NetworkManager-wwan +cinnamon +cinnamon-control-center +cinnamon-screensaver +eom +firewall-config +gnome-calculator +gnome-disk-utility +gnome-screenshot +gnome-system-monitor +gnome-terminal +gstreamer1-plugins-ugly-free +gvfs-gphoto2 +gvfs-mtp +gvfs-smb +hexchat +imsettings-systemd +initial-setup-gui +lightdm +metacity +nemo-fileroller +nemo-image-converter +nemo-preview +nm-connection-editor +pipewire-alsa +pipewire-pulseaudio +powerline +redshift-gtk +sane-backends-drivers-scanners +setroubleshoot +slick-greeter +slick-greeter-cinnamon +tmux +tmux-powerline +transmission +vim-enhanced +vim-powerline +xdg-user-dirs-gtk +xed +xreader +wireplumber + +parole +#audacious +#rhythmbox + +#libreoffice-calc +#libreoffice-emailmerge +#libreoffice-graphicfilter +#libreoffice-impress +#libreoffice-writer + +-xsane +-xane-gimp +-mpage +-hplip +-isdn4k-utils +%end diff --git a/live/10/x86_64/peridot/rocky-live-cinnamon.ks b/live/10/x86_64/peridot/rocky-live-cinnamon.ks new file mode 100644 index 0000000..9a5c562 --- /dev/null +++ b/live/10/x86_64/peridot/rocky-live-cinnamon.ks @@ -0,0 +1,24 @@ +# rocky-live-cinnamon.ks + +%include rocky-live-base-spin.ks +%include rocky-live-cinnamon-common.ks + +part / --size 8192 + +%post +# cinnamon configuration + +cat > /etc/sysconfig/desktop < /root/.gtkrc-2.0 << EOF +include "/usr/share/themes/Adwaita/gtk-2.0/gtkrc" +include "/etc/gtk-2.0/gtkrc" +gtk-theme-name="Adwaita" +EOF +mkdir -p /root/.config/gtk-3.0 +cat > /root/.config/gtk-3.0/settings.ini << EOF +[Settings] +gtk-theme-name = Adwaita +EOF + +rm -f /usr/share/wallpapers/Fedora +ln -s rocky-abstract-2 /usr/share/wallpapers/Fedora + +systemctl enable --force sddm.service +dnf config-manager --set-enabled crb + +cat > /etc/sddm.conf.d/theme.conf <> /etc/rc.d/init.d/livesys << EOF + + +# disable gnome-software automatically downloading updates +cat >> /usr/share/glib-2.0/schemas/org.gnome.software.gschema.override << FOE +[org.gnome.software] +download-updates=false +FOE + +# don't autostart gnome-software session service +rm -f /etc/xdg/autostart/gnome-software-service.desktop + +# disable the gnome-software shell search provider +cat >> /usr/share/gnome-shell/search-providers/org.gnome.Software-search-provider.ini << FOE +DefaultDisabled=true +FOE + +# don't run gnome-initial-setup +mkdir ~liveuser/.config +touch ~liveuser/.config/gnome-initial-setup-done + +# suppress anaconda spokes redundant with gnome-initial-setup +cat >> /etc/sysconfig/anaconda << FOE +[NetworkSpoke] +visited=1 + +[PasswordSpoke] +visited=1 + +[UserSpoke] +visited=1 +FOE + +# make the installer show up +if [ -f /usr/share/applications/liveinst.desktop ]; then + # Show harddisk install in shell dash + sed -i -e 's/NoDisplay=true/NoDisplay=false/' /usr/share/applications/liveinst.desktop "" + # need to move it to anaconda.desktop to make shell happy + mv /usr/share/applications/liveinst.desktop /usr/share/applications/anaconda.desktop + + cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +[org.gnome.shell] +favorite-apps=['firefox.desktop', 'evolution.desktop', 'org.gnome.Nautilus.desktop', 'anaconda.desktop'] +FOE + + # Make the welcome screen show up + if [ -f /usr/share/anaconda/gnome/fedora-welcome.desktop ]; then + mkdir -p ~liveuser/.config/autostart + cp /usr/share/anaconda/gnome/fedora-welcome.desktop /usr/share/applications/ + cp /usr/share/anaconda/gnome/fedora-welcome.desktop ~liveuser/.config/autostart/ + fi + + # Disable GNOME welcome tour so it doesn't overlap with Fedora welcome screen + cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +welcome-dialog-last-shown-version='4294967295' +FOE + + # Copy Anaconda branding in place + if [ -d /usr/share/lorax/product/usr/share/anaconda ]; then + cp -a /usr/share/lorax/product/* / + fi +fi + +# rebuild schema cache with any overrides we installed +glib-compile-schemas /usr/share/glib-2.0/schemas + +# set up auto-login +cat > /etc/gdm/custom.conf << FOE +[daemon] +AutomaticLoginEnable=True +AutomaticLogin=liveuser +FOE + +# Turn off PackageKit-command-not-found while uninstalled +if [ -f /etc/PackageKit/CommandNotFound.conf ]; then + sed -i -e 's/^SoftwareSourceSearch=true/SoftwareSourceSearch=false/' /etc/PackageKit/CommandNotFound.conf +fi + +# make sure to set the right permissions and selinux contexts +chown -R liveuser:liveuser /home/liveuser/ +restorecon -R /home/liveuser/ +restorecon -R / + +EOF + +%end diff --git a/live/10/x86_64/peridot/rocky-live-workstation.ks b/live/10/x86_64/peridot/rocky-live-workstation.ks new file mode 100644 index 0000000..3a5c9b5 --- /dev/null +++ b/live/10/x86_64/peridot/rocky-live-workstation.ks @@ -0,0 +1,18 @@ +# Maintained by Release Engineering +# mailto:releng@rockylinux.org + +%include rocky-live-base.ks +%include rocky-workstation-common.ks +# +# Disable this for now as packagekit is causing compose failures +# by leaving a gpg-agent around holding /dev/null open. +# +#include snippets/packagekit-cached-metadata.ks + +part / --size 7750 + +%post + +sed -i 's/^livesys_session=.*/livesys_session="gnome"/' /etc/sysconfig/livesys + +%end diff --git a/live/10/x86_64/peridot/rocky-live-xfce-common.ks b/live/10/x86_64/peridot/rocky-live-xfce-common.ks new file mode 100644 index 0000000..1231a0d --- /dev/null +++ b/live/10/x86_64/peridot/rocky-live-xfce-common.ks @@ -0,0 +1,90 @@ +# xfce +%packages + +# these aren't an epel thing for some reason. +@xfce-desktop --nodefaults +#@^xfce-desktop-environment +#@xfce-apps +#@xfce-extra-plugins +#@xfce-media +#@xfce-office + +# Manual install... +#geany +gparted +#mousepad +#ristretto +seahorse +#transmission +pcp-selinux +lightdm +#gdm +-gdm +-gnome-shell + +# Some stuff might already be here, doesn't hurt to list it. +firefox +thunderbird +firewall-config +#pidgin +rocky-backgrounds +rocky-backgrounds-compat +rocky-release +gparted +#rhythmbox + +xfce4-about +xfce4-taskmanager +#xfce4-battery-plugin +xfce4-datetime-plugin +xfce4-netload-plugin +xfce4-notifyd +#xfce4-places-plugin +xfce4-screenshooter-plugin +xfce4-smartbookmark-plugin +xfce4-systemload-plugin +xfce4-time-out-plugin +xfce4-weather-plugin +xfce4-whiskermenu-plugin +#xfdashboard +#xfdashboard-themes +pavucontrol + +# XFCE group defaults +xfce4-appfinder +xfce4-power-manager +#xfce4-pulseaudio-plugin +xfce4-screensaver +xfce4-terminal +network-manager-applet +openssh-askpass +thunar-archive-plugin +thunar-volman +tumbler +xfce-polkit + +wget +xdg-user-dirs +xdg-user-dirs-gtk + +# help welcome screen +gjs + +# save some space +-autofs +-acpid +-gimp-help +-desktop-backgrounds-basic +-aspell-* +-xfce4-sensors-plugin +-xfce4-eyes-plugin + +### MINIMIZATION +-mpage +-hplip +-isdn4k-utils +-xsane +-xsane-gimp +-sane-backends + +%end diff --git a/live/10/x86_64/peridot/rocky-live-xfce.ks b/live/10/x86_64/peridot/rocky-live-xfce.ks new file mode 100644 index 0000000..04242a2 --- /dev/null +++ b/live/10/x86_64/peridot/rocky-live-xfce.ks @@ -0,0 +1,27 @@ +# rocky-live-kde.ks +# BROKEN + +%include rocky-live-base-spin.ks +%include rocky-live-xfce-common.ks + +part / --size 6144 + +%post +# xfce configuration + +# create /etc/sysconfig/desktop (needed for installation) + +cat > /etc/sysconfig/desktop <> /etc/fstab << EOF +vartmp /var/tmp tmpfs defaults 0 0 +EOF + +# fix packagekit +rm -f /var/lib/rpm/__db* +echo "Packages within this LiveCD" +rpm -qa --qf '%{size}\t%{name}-%{version}-%{release}.%{arch}\n' |sort -rn +# Note that running rpm recreates the rpm db files which aren't needed or wanted +rm -f /var/lib/rpm/__db* + +# go ahead and pre-make the man -k cache (#455968) +/usr/bin/mandb + +# make sure there aren't core files lying around +rm -f /core* + +# remove random seed, the newly installed instance should make it's own +rm -f /var/lib/systemd/random-seed + +# convince readahead not to collect +# FIXME: for systemd +echo 'File created by kickstart. See systemd-update-done.service(8).' \ + | tee /etc/.updated >/var/.updated + +# Drop the rescue kernel and initramfs, we don't need them on the live media itself. +# See bug 1317709 +rm -f /boot/*-rescue* + +# Disable network service here, as doing it in the services line +# fails due to RHBZ #1369794 +systemctl disable network + +# Remove machine-id on pre generated images +rm -f /etc/machine-id +touch /etc/machine-id + +%end diff --git a/live/10/x86_64/prod/rocky-live-base.ks b/live/10/x86_64/prod/rocky-live-base.ks new file mode 100644 index 0000000..a82ffe2 --- /dev/null +++ b/live/10/x86_64/prod/rocky-live-base.ks @@ -0,0 +1,114 @@ +# rocky-live-base.ks +# +# Base installation information for Rocky Linux images +# + +lang en_US.UTF-8 +keyboard us +timezone US/Eastern +selinux --enforcing +firewall --enabled --service=mdns +xconfig --startxonboot +zerombr +clearpart --all +part / --size 5120 --fstype ext4 +services --enabled=NetworkManager,ModemManager --disabled=sshd +network --bootproto=dhcp --device=link --activate +rootpw --lock --iscrypted locked +shutdown + +%include rocky-repo.ks + +%packages +@base-x +@guest-desktop-agents +@standard +@core +@fonts +@input-methods +@dial-up +@multimedia +@hardware-support + +# explicit +kernel +kernel-modules +kernel-modules-extra +memtest86+ +anaconda +anaconda-install-env-deps +anaconda-live +@anaconda-tools +efi-filesystem +efivar-libs +efibootmgr +grub2-common +grub2-efi-*64 +grub2-efi-*64-cdboot +grub2-pc-modules +grub2-tools +grub2-tools-efi +grub2-tools-extra +grub2-tools-minimal +grubby +shim-*64 +-shim-unsigned-*64 +-fcoe-utils + +# Required for SVG rnotes images +aajohan-comfortaa-fonts + +# RHBZ#1242586 - Required for initramfs creation +dracut-live +syslinux + +# Anaconda needs all the locales available, just like a DVD installer +glibc-all-langpacks + +# adapted from fedora +livesys-scripts +%end + +%post +systemctl enable livesys.service +systemctl enable livesys-late.service +systemctl enable tmp.mount + +cat >> /etc/fstab << EOF +vartmp /var/tmp tmpfs defaults 0 0 +EOF + +# fix packagekit +rm -f /var/lib/rpm/__db* +echo "Packages within this LiveCD" +rpm -qa --qf '%{size}\t%{name}-%{version}-%{release}.%{arch}\n' |sort -rn +# Note that running rpm recreates the rpm db files which aren't needed or wanted +rm -f /var/lib/rpm/__db* + +# go ahead and pre-make the man -k cache (#455968) +/usr/bin/mandb + +# make sure there aren't core files lying around +rm -f /core* + +# remove random seed, the newly installed instance should make it's own +rm -f /var/lib/systemd/random-seed + +# convince readahead not to collect +# FIXME: for systemd +echo 'File created by kickstart. See systemd-update-done.service(8).' \ + | tee /etc/.updated >/var/.updated + +# Drop the rescue kernel and initramfs, we don't need them on the live media itself. +# See bug 1317709 +rm -f /boot/*-rescue* + +# Disable network service here, as doing it in the services line +# fails due to RHBZ #1369794 +systemctl disable network + +# Remove machine-id on pre generated images +rm -f /etc/machine-id +touch /etc/machine-id + +%end diff --git a/live/10/x86_64/prod/rocky-live-cinnamon-common.ks b/live/10/x86_64/prod/rocky-live-cinnamon-common.ks new file mode 100644 index 0000000..37c8855 --- /dev/null +++ b/live/10/x86_64/prod/rocky-live-cinnamon-common.ks @@ -0,0 +1,77 @@ +# cinnamon +%packages +rocky-backgrounds +rocky-release +thunderbird +firefox +f40-backgrounds-gnome +f40-backgrounds-extras-gnome +gjs + +NetworkManager-adsl +NetworkManager-bluetooth +NetworkManager-l2tp-gnome +NetworkManager-libreswan-gnome +NetworkManager-openconnect-gnome +NetworkManager-openvpn-gnome +NetworkManager-ppp +NetworkManager-pptp-gnome +NetworkManager-wifi +NetworkManager-wwan +cinnamon +cinnamon-control-center +cinnamon-screensaver +eom +firewall-config +gnome-calculator +gnome-disk-utility +gnome-screenshot +gnome-system-monitor +gnome-terminal +gstreamer1-plugins-ugly-free +gvfs-gphoto2 +gvfs-mtp +gvfs-smb +hexchat +imsettings-systemd +initial-setup-gui +lightdm +metacity +nemo-fileroller +nemo-image-converter +nemo-preview +nm-connection-editor +pipewire-alsa +pipewire-pulseaudio +powerline +redshift-gtk +sane-backends-drivers-scanners +setroubleshoot +slick-greeter +slick-greeter-cinnamon +tmux +tmux-powerline +transmission +vim-enhanced +vim-powerline +xdg-user-dirs-gtk +xed +xreader +wireplumber + +parole +#audacious +#rhythmbox + +#libreoffice-calc +#libreoffice-emailmerge +#libreoffice-graphicfilter +#libreoffice-impress +#libreoffice-writer + +-xsane +-xane-gimp +-mpage +-hplip +-isdn4k-utils +%end diff --git a/live/10/x86_64/prod/rocky-live-cinnamon.ks b/live/10/x86_64/prod/rocky-live-cinnamon.ks new file mode 100644 index 0000000..9a5c562 --- /dev/null +++ b/live/10/x86_64/prod/rocky-live-cinnamon.ks @@ -0,0 +1,24 @@ +# rocky-live-cinnamon.ks + +%include rocky-live-base-spin.ks +%include rocky-live-cinnamon-common.ks + +part / --size 8192 + +%post +# cinnamon configuration + +cat > /etc/sysconfig/desktop < /root/.gtkrc-2.0 << EOF +include "/usr/share/themes/Adwaita/gtk-2.0/gtkrc" +include "/etc/gtk-2.0/gtkrc" +gtk-theme-name="Adwaita" +EOF +mkdir -p /root/.config/gtk-3.0 +cat > /root/.config/gtk-3.0/settings.ini << EOF +[Settings] +gtk-theme-name = Adwaita +EOF + +rm -f /usr/share/wallpapers/Fedora +ln -s rocky-abstract-2 /usr/share/wallpapers/Fedora + +systemctl enable --force sddm.service +dnf config-manager --set-enabled crb + +cat > /etc/sddm.conf.d/theme.conf <> /etc/rc.d/init.d/livesys << EOF + + +# disable gnome-software automatically downloading updates +cat >> /usr/share/glib-2.0/schemas/org.gnome.software.gschema.override << FOE +[org.gnome.software] +download-updates=false +FOE + +# don't autostart gnome-software session service +rm -f /etc/xdg/autostart/gnome-software-service.desktop + +# disable the gnome-software shell search provider +cat >> /usr/share/gnome-shell/search-providers/org.gnome.Software-search-provider.ini << FOE +DefaultDisabled=true +FOE + +# don't run gnome-initial-setup +mkdir ~liveuser/.config +touch ~liveuser/.config/gnome-initial-setup-done + +# suppress anaconda spokes redundant with gnome-initial-setup +cat >> /etc/sysconfig/anaconda << FOE +[NetworkSpoke] +visited=1 + +[PasswordSpoke] +visited=1 + +[UserSpoke] +visited=1 +FOE + +# make the installer show up +if [ -f /usr/share/applications/liveinst.desktop ]; then + # Show harddisk install in shell dash + sed -i -e 's/NoDisplay=true/NoDisplay=false/' /usr/share/applications/liveinst.desktop "" + # need to move it to anaconda.desktop to make shell happy + mv /usr/share/applications/liveinst.desktop /usr/share/applications/anaconda.desktop + + cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +[org.gnome.shell] +favorite-apps=['firefox.desktop', 'evolution.desktop', 'org.gnome.Nautilus.desktop', 'anaconda.desktop'] +FOE + + # Make the welcome screen show up + if [ -f /usr/share/anaconda/gnome/fedora-welcome.desktop ]; then + mkdir -p ~liveuser/.config/autostart + cp /usr/share/anaconda/gnome/fedora-welcome.desktop /usr/share/applications/ + cp /usr/share/anaconda/gnome/fedora-welcome.desktop ~liveuser/.config/autostart/ + fi + + # Disable GNOME welcome tour so it doesn't overlap with Fedora welcome screen + cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +welcome-dialog-last-shown-version='4294967295' +FOE + + # Copy Anaconda branding in place + if [ -d /usr/share/lorax/product/usr/share/anaconda ]; then + cp -a /usr/share/lorax/product/* / + fi +fi + +# rebuild schema cache with any overrides we installed +glib-compile-schemas /usr/share/glib-2.0/schemas + +# set up auto-login +cat > /etc/gdm/custom.conf << FOE +[daemon] +AutomaticLoginEnable=True +AutomaticLogin=liveuser +FOE + +# Turn off PackageKit-command-not-found while uninstalled +if [ -f /etc/PackageKit/CommandNotFound.conf ]; then + sed -i -e 's/^SoftwareSourceSearch=true/SoftwareSourceSearch=false/' /etc/PackageKit/CommandNotFound.conf +fi + +# make sure to set the right permissions and selinux contexts +chown -R liveuser:liveuser /home/liveuser/ +restorecon -R /home/liveuser/ +restorecon -R / + +EOF + +%end diff --git a/live/10/x86_64/prod/rocky-live-workstation.ks b/live/10/x86_64/prod/rocky-live-workstation.ks new file mode 100644 index 0000000..3a5c9b5 --- /dev/null +++ b/live/10/x86_64/prod/rocky-live-workstation.ks @@ -0,0 +1,18 @@ +# Maintained by Release Engineering +# mailto:releng@rockylinux.org + +%include rocky-live-base.ks +%include rocky-workstation-common.ks +# +# Disable this for now as packagekit is causing compose failures +# by leaving a gpg-agent around holding /dev/null open. +# +#include snippets/packagekit-cached-metadata.ks + +part / --size 7750 + +%post + +sed -i 's/^livesys_session=.*/livesys_session="gnome"/' /etc/sysconfig/livesys + +%end diff --git a/live/10/x86_64/prod/rocky-live-xfce-common.ks b/live/10/x86_64/prod/rocky-live-xfce-common.ks new file mode 100644 index 0000000..1231a0d --- /dev/null +++ b/live/10/x86_64/prod/rocky-live-xfce-common.ks @@ -0,0 +1,90 @@ +# xfce +%packages + +# these aren't an epel thing for some reason. +@xfce-desktop --nodefaults +#@^xfce-desktop-environment +#@xfce-apps +#@xfce-extra-plugins +#@xfce-media +#@xfce-office + +# Manual install... +#geany +gparted +#mousepad +#ristretto +seahorse +#transmission +pcp-selinux +lightdm +#gdm +-gdm +-gnome-shell + +# Some stuff might already be here, doesn't hurt to list it. +firefox +thunderbird +firewall-config +#pidgin +rocky-backgrounds +rocky-backgrounds-compat +rocky-release +gparted +#rhythmbox + +xfce4-about +xfce4-taskmanager +#xfce4-battery-plugin +xfce4-datetime-plugin +xfce4-netload-plugin +xfce4-notifyd +#xfce4-places-plugin +xfce4-screenshooter-plugin +xfce4-smartbookmark-plugin +xfce4-systemload-plugin +xfce4-time-out-plugin +xfce4-weather-plugin +xfce4-whiskermenu-plugin +#xfdashboard +#xfdashboard-themes +pavucontrol + +# XFCE group defaults +xfce4-appfinder +xfce4-power-manager +#xfce4-pulseaudio-plugin +xfce4-screensaver +xfce4-terminal +network-manager-applet +openssh-askpass +thunar-archive-plugin +thunar-volman +tumbler +xfce-polkit + +wget +xdg-user-dirs +xdg-user-dirs-gtk + +# help welcome screen +gjs + +# save some space +-autofs +-acpid +-gimp-help +-desktop-backgrounds-basic +-aspell-* +-xfce4-sensors-plugin +-xfce4-eyes-plugin + +### MINIMIZATION +-mpage +-hplip +-isdn4k-utils +-xsane +-xsane-gimp +-sane-backends + +%end diff --git a/live/10/x86_64/prod/rocky-live-xfce.ks b/live/10/x86_64/prod/rocky-live-xfce.ks new file mode 100644 index 0000000..04242a2 --- /dev/null +++ b/live/10/x86_64/prod/rocky-live-xfce.ks @@ -0,0 +1,27 @@ +# rocky-live-kde.ks +# BROKEN + +%include rocky-live-base-spin.ks +%include rocky-live-xfce-common.ks + +part / --size 6144 + +%post +# xfce configuration + +# create /etc/sysconfig/desktop (needed for installation) + +cat > /etc/sysconfig/desktop <> /etc/fstab << EOF +vartmp /var/tmp tmpfs defaults 0 0 +EOF + +# fix packagekit +rm -f /var/lib/rpm/__db* +echo "Packages within this LiveCD" +rpm -qa --qf '%{size}\t%{name}-%{version}-%{release}.%{arch}\n' |sort -rn +# Note that running rpm recreates the rpm db files which aren't needed or wanted +rm -f /var/lib/rpm/__db* + +# go ahead and pre-make the man -k cache (#455968) +/usr/bin/mandb + +# make sure there aren't core files lying around +rm -f /core* + +# remove random seed, the newly installed instance should make it's own +rm -f /var/lib/systemd/random-seed + +# convince readahead not to collect +# FIXME: for systemd +echo 'File created by kickstart. See systemd-update-done.service(8).' \ + | tee /etc/.updated >/var/.updated + +# Drop the rescue kernel and initramfs, we don't need them on the live media itself. +# See bug 1317709 +rm -f /boot/*-rescue* + +# Disable network service here, as doing it in the services line +# fails due to RHBZ #1369794 +systemctl disable network + +# Remove machine-id on pre generated images +rm -f /etc/machine-id +touch /etc/machine-id + +%end diff --git a/live/10/x86_64/stage/rocky-live-base.ks b/live/10/x86_64/stage/rocky-live-base.ks new file mode 100644 index 0000000..a82ffe2 --- /dev/null +++ b/live/10/x86_64/stage/rocky-live-base.ks @@ -0,0 +1,114 @@ +# rocky-live-base.ks +# +# Base installation information for Rocky Linux images +# + +lang en_US.UTF-8 +keyboard us +timezone US/Eastern +selinux --enforcing +firewall --enabled --service=mdns +xconfig --startxonboot +zerombr +clearpart --all +part / --size 5120 --fstype ext4 +services --enabled=NetworkManager,ModemManager --disabled=sshd +network --bootproto=dhcp --device=link --activate +rootpw --lock --iscrypted locked +shutdown + +%include rocky-repo.ks + +%packages +@base-x +@guest-desktop-agents +@standard +@core +@fonts +@input-methods +@dial-up +@multimedia +@hardware-support + +# explicit +kernel +kernel-modules +kernel-modules-extra +memtest86+ +anaconda +anaconda-install-env-deps +anaconda-live +@anaconda-tools +efi-filesystem +efivar-libs +efibootmgr +grub2-common +grub2-efi-*64 +grub2-efi-*64-cdboot +grub2-pc-modules +grub2-tools +grub2-tools-efi +grub2-tools-extra +grub2-tools-minimal +grubby +shim-*64 +-shim-unsigned-*64 +-fcoe-utils + +# Required for SVG rnotes images +aajohan-comfortaa-fonts + +# RHBZ#1242586 - Required for initramfs creation +dracut-live +syslinux + +# Anaconda needs all the locales available, just like a DVD installer +glibc-all-langpacks + +# adapted from fedora +livesys-scripts +%end + +%post +systemctl enable livesys.service +systemctl enable livesys-late.service +systemctl enable tmp.mount + +cat >> /etc/fstab << EOF +vartmp /var/tmp tmpfs defaults 0 0 +EOF + +# fix packagekit +rm -f /var/lib/rpm/__db* +echo "Packages within this LiveCD" +rpm -qa --qf '%{size}\t%{name}-%{version}-%{release}.%{arch}\n' |sort -rn +# Note that running rpm recreates the rpm db files which aren't needed or wanted +rm -f /var/lib/rpm/__db* + +# go ahead and pre-make the man -k cache (#455968) +/usr/bin/mandb + +# make sure there aren't core files lying around +rm -f /core* + +# remove random seed, the newly installed instance should make it's own +rm -f /var/lib/systemd/random-seed + +# convince readahead not to collect +# FIXME: for systemd +echo 'File created by kickstart. See systemd-update-done.service(8).' \ + | tee /etc/.updated >/var/.updated + +# Drop the rescue kernel and initramfs, we don't need them on the live media itself. +# See bug 1317709 +rm -f /boot/*-rescue* + +# Disable network service here, as doing it in the services line +# fails due to RHBZ #1369794 +systemctl disable network + +# Remove machine-id on pre generated images +rm -f /etc/machine-id +touch /etc/machine-id + +%end diff --git a/live/10/x86_64/stage/rocky-live-cinnamon-common.ks b/live/10/x86_64/stage/rocky-live-cinnamon-common.ks new file mode 100644 index 0000000..37c8855 --- /dev/null +++ b/live/10/x86_64/stage/rocky-live-cinnamon-common.ks @@ -0,0 +1,77 @@ +# cinnamon +%packages +rocky-backgrounds +rocky-release +thunderbird +firefox +f40-backgrounds-gnome +f40-backgrounds-extras-gnome +gjs + +NetworkManager-adsl +NetworkManager-bluetooth +NetworkManager-l2tp-gnome +NetworkManager-libreswan-gnome +NetworkManager-openconnect-gnome +NetworkManager-openvpn-gnome +NetworkManager-ppp +NetworkManager-pptp-gnome +NetworkManager-wifi +NetworkManager-wwan +cinnamon +cinnamon-control-center +cinnamon-screensaver +eom +firewall-config +gnome-calculator +gnome-disk-utility +gnome-screenshot +gnome-system-monitor +gnome-terminal +gstreamer1-plugins-ugly-free +gvfs-gphoto2 +gvfs-mtp +gvfs-smb +hexchat +imsettings-systemd +initial-setup-gui +lightdm +metacity +nemo-fileroller +nemo-image-converter +nemo-preview +nm-connection-editor +pipewire-alsa +pipewire-pulseaudio +powerline +redshift-gtk +sane-backends-drivers-scanners +setroubleshoot +slick-greeter +slick-greeter-cinnamon +tmux +tmux-powerline +transmission +vim-enhanced +vim-powerline +xdg-user-dirs-gtk +xed +xreader +wireplumber + +parole +#audacious +#rhythmbox + +#libreoffice-calc +#libreoffice-emailmerge +#libreoffice-graphicfilter +#libreoffice-impress +#libreoffice-writer + +-xsane +-xane-gimp +-mpage +-hplip +-isdn4k-utils +%end diff --git a/live/10/x86_64/stage/rocky-live-cinnamon.ks b/live/10/x86_64/stage/rocky-live-cinnamon.ks new file mode 100644 index 0000000..9a5c562 --- /dev/null +++ b/live/10/x86_64/stage/rocky-live-cinnamon.ks @@ -0,0 +1,24 @@ +# rocky-live-cinnamon.ks + +%include rocky-live-base-spin.ks +%include rocky-live-cinnamon-common.ks + +part / --size 8192 + +%post +# cinnamon configuration + +cat > /etc/sysconfig/desktop < /root/.gtkrc-2.0 << EOF +include "/usr/share/themes/Adwaita/gtk-2.0/gtkrc" +include "/etc/gtk-2.0/gtkrc" +gtk-theme-name="Adwaita" +EOF +mkdir -p /root/.config/gtk-3.0 +cat > /root/.config/gtk-3.0/settings.ini << EOF +[Settings] +gtk-theme-name = Adwaita +EOF + +rm -f /usr/share/wallpapers/Fedora +ln -s rocky-abstract-2 /usr/share/wallpapers/Fedora + +systemctl enable --force sddm.service +dnf config-manager --set-enabled crb + +cat > /etc/sddm.conf.d/theme.conf <> /etc/rc.d/init.d/livesys << EOF + + +# disable gnome-software automatically downloading updates +cat >> /usr/share/glib-2.0/schemas/org.gnome.software.gschema.override << FOE +[org.gnome.software] +download-updates=false +FOE + +# don't autostart gnome-software session service +rm -f /etc/xdg/autostart/gnome-software-service.desktop + +# disable the gnome-software shell search provider +cat >> /usr/share/gnome-shell/search-providers/org.gnome.Software-search-provider.ini << FOE +DefaultDisabled=true +FOE + +# don't run gnome-initial-setup +mkdir ~liveuser/.config +touch ~liveuser/.config/gnome-initial-setup-done + +# suppress anaconda spokes redundant with gnome-initial-setup +cat >> /etc/sysconfig/anaconda << FOE +[NetworkSpoke] +visited=1 + +[PasswordSpoke] +visited=1 + +[UserSpoke] +visited=1 +FOE + +# make the installer show up +if [ -f /usr/share/applications/liveinst.desktop ]; then + # Show harddisk install in shell dash + sed -i -e 's/NoDisplay=true/NoDisplay=false/' /usr/share/applications/liveinst.desktop "" + # need to move it to anaconda.desktop to make shell happy + mv /usr/share/applications/liveinst.desktop /usr/share/applications/anaconda.desktop + + cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +[org.gnome.shell] +favorite-apps=['firefox.desktop', 'evolution.desktop', 'org.gnome.Nautilus.desktop', 'anaconda.desktop'] +FOE + + # Make the welcome screen show up + if [ -f /usr/share/anaconda/gnome/fedora-welcome.desktop ]; then + mkdir -p ~liveuser/.config/autostart + cp /usr/share/anaconda/gnome/fedora-welcome.desktop /usr/share/applications/ + cp /usr/share/anaconda/gnome/fedora-welcome.desktop ~liveuser/.config/autostart/ + fi + + # Disable GNOME welcome tour so it doesn't overlap with Fedora welcome screen + cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +welcome-dialog-last-shown-version='4294967295' +FOE + + # Copy Anaconda branding in place + if [ -d /usr/share/lorax/product/usr/share/anaconda ]; then + cp -a /usr/share/lorax/product/* / + fi +fi + +# rebuild schema cache with any overrides we installed +glib-compile-schemas /usr/share/glib-2.0/schemas + +# set up auto-login +cat > /etc/gdm/custom.conf << FOE +[daemon] +AutomaticLoginEnable=True +AutomaticLogin=liveuser +FOE + +# Turn off PackageKit-command-not-found while uninstalled +if [ -f /etc/PackageKit/CommandNotFound.conf ]; then + sed -i -e 's/^SoftwareSourceSearch=true/SoftwareSourceSearch=false/' /etc/PackageKit/CommandNotFound.conf +fi + +# make sure to set the right permissions and selinux contexts +chown -R liveuser:liveuser /home/liveuser/ +restorecon -R /home/liveuser/ +restorecon -R / + +EOF + +%end diff --git a/live/10/x86_64/stage/rocky-live-workstation.ks b/live/10/x86_64/stage/rocky-live-workstation.ks new file mode 100644 index 0000000..3a5c9b5 --- /dev/null +++ b/live/10/x86_64/stage/rocky-live-workstation.ks @@ -0,0 +1,18 @@ +# Maintained by Release Engineering +# mailto:releng@rockylinux.org + +%include rocky-live-base.ks +%include rocky-workstation-common.ks +# +# Disable this for now as packagekit is causing compose failures +# by leaving a gpg-agent around holding /dev/null open. +# +#include snippets/packagekit-cached-metadata.ks + +part / --size 7750 + +%post + +sed -i 's/^livesys_session=.*/livesys_session="gnome"/' /etc/sysconfig/livesys + +%end diff --git a/live/10/x86_64/stage/rocky-live-xfce-common.ks b/live/10/x86_64/stage/rocky-live-xfce-common.ks new file mode 100644 index 0000000..1231a0d --- /dev/null +++ b/live/10/x86_64/stage/rocky-live-xfce-common.ks @@ -0,0 +1,90 @@ +# xfce +%packages + +# these aren't an epel thing for some reason. +@xfce-desktop --nodefaults +#@^xfce-desktop-environment +#@xfce-apps +#@xfce-extra-plugins +#@xfce-media +#@xfce-office + +# Manual install... +#geany +gparted +#mousepad +#ristretto +seahorse +#transmission +pcp-selinux +lightdm +#gdm +-gdm +-gnome-shell + +# Some stuff might already be here, doesn't hurt to list it. +firefox +thunderbird +firewall-config +#pidgin +rocky-backgrounds +rocky-backgrounds-compat +rocky-release +gparted +#rhythmbox + +xfce4-about +xfce4-taskmanager +#xfce4-battery-plugin +xfce4-datetime-plugin +xfce4-netload-plugin +xfce4-notifyd +#xfce4-places-plugin +xfce4-screenshooter-plugin +xfce4-smartbookmark-plugin +xfce4-systemload-plugin +xfce4-time-out-plugin +xfce4-weather-plugin +xfce4-whiskermenu-plugin +#xfdashboard +#xfdashboard-themes +pavucontrol + +# XFCE group defaults +xfce4-appfinder +xfce4-power-manager +#xfce4-pulseaudio-plugin +xfce4-screensaver +xfce4-terminal +network-manager-applet +openssh-askpass +thunar-archive-plugin +thunar-volman +tumbler +xfce-polkit + +wget +xdg-user-dirs +xdg-user-dirs-gtk + +# help welcome screen +gjs + +# save some space +-autofs +-acpid +-gimp-help +-desktop-backgrounds-basic +-aspell-* +-xfce4-sensors-plugin +-xfce4-eyes-plugin + +### MINIMIZATION +-mpage +-hplip +-isdn4k-utils +-xsane +-xsane-gimp +-sane-backends + +%end diff --git a/live/10/x86_64/stage/rocky-live-xfce.ks b/live/10/x86_64/stage/rocky-live-xfce.ks new file mode 100644 index 0000000..04242a2 --- /dev/null +++ b/live/10/x86_64/stage/rocky-live-xfce.ks @@ -0,0 +1,27 @@ +# rocky-live-kde.ks +# BROKEN + +%include rocky-live-base-spin.ks +%include rocky-live-xfce-common.ks + +part / --size 6144 + +%post +# xfce configuration + +# create /etc/sysconfig/desktop (needed for installation) + +cat > /etc/sysconfig/desktop <> /etc/fstab + +# sudo +echo "%vagrant ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/vagrant +chmod 0440 /etc/sudoers.d/vagrant + +# Fix for https://github.com/CentOS/sig-cloud-instance-build/issues/38 +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +PERSISTENT_DHCLIENT="yes" +EOF + +# sshd: disable password authentication and DNS checks +ex -s /etc/ssh/sshd_config <>/etc/sysconfig/sshd <> /home/vagrant/.ssh/authorized_keys +chmod 600 /home/vagrant/.ssh/authorized_keys +chown -R vagrant:vagrant /home/vagrant/.ssh + +# Fix for issue #76, regular users can gain admin privileges via su +ex -s /etc/pam.d/su <<'EOF' +# allow vagrant to use su, but prevent others from becoming root or vagrant +/^account\s\+sufficient\s\+pam_succeed_if.so uid = 0 use_uid quiet$/ +:append +account [success=1 default=ignore] \\ + pam_succeed_if.so user = vagrant use_uid quiet +account required pam_succeed_if.so user notin root:vagrant +. +:update +:quit +EOF + +# systemd should generate a new machine id during the first boot, to +# avoid having multiple Vagrant instances with the same id in the local +# network. /etc/machine-id should be empty, but it must exist to prevent +# boot errors (e.g. systemd-journald failing to start). +:>/etc/machine-id + +echo 'vag' > /etc/yum/vars/infra + +# Blacklist the floppy module to avoid probing timeouts +echo blacklist floppy > /etc/modprobe.d/nofloppy.conf +chcon -u system_u -r object_r -t modules_conf_t /etc/modprobe.d/nofloppy.conf + +# Customize the initramfs +pushd /etc/dracut.conf.d +# Enable VMware PVSCSI support for VMware Fusion guests. +echo 'add_drivers+=" vmw_pvscsi "' > vmware-fusion-drivers.conf +echo 'add_drivers+=" hv_netvsc hv_storvsc hv_utils hv_vmbus hid-hyperv "' > hyperv-drivers.conf +# There's no floppy controller, but probing for it generates timeouts +echo 'omit_drivers+=" floppy "' > nofloppy.conf +popd +# Fix the SELinux context of the new files +restorecon -f - <> /etc/fstab + +# sudo +echo "%vagrant ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/vagrant +chmod 0440 /etc/sudoers.d/vagrant + +# Fix for https://github.com/CentOS/sig-cloud-instance-build/issues/38 +cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF +DEVICE="eth0" +BOOTPROTO="dhcp" +ONBOOT="yes" +TYPE="Ethernet" +PERSISTENT_DHCLIENT="yes" +EOF + +# sshd: disable password authentication and DNS checks +# for virtualbox we're disabling it after provisioning +cat >>/etc/sysconfig/sshd <> /home/vagrant/.ssh/authorized_keys +chmod 600 /home/vagrant/.ssh/authorized_keys +chown -R vagrant:vagrant /home/vagrant/.ssh + +# Fix for issue #76, regular users can gain admin privileges via su +ex -s /etc/pam.d/su <<'EOF' +# allow vagrant to use su, but prevent others from becoming root or vagrant +/^account\s\+sufficient\s\+pam_succeed_if.so uid = 0 use_uid quiet$/ +:append +account [success=1 default=ignore] \\ + pam_succeed_if.so user = vagrant use_uid quiet +account required pam_succeed_if.so user notin root:vagrant +. +:update +:quit +EOF + +# Install VBoxGuestAdditions for installed kernel +kver=$(rpm -q --queryformat="%{VERSION}-%{RELEASE}.%{ARCH}" kernel) +echo "stg/rocky" > /etc/dnf/vars/contentdir +sed -i 's/^#baseurl/baseurl/g;s/^mirrorlist/#mirrorlist/g' /etc/yum.repos.d/rocky*repo +dnf -y install kernel-headers-$kver kernel-devel gcc make perl elfutils-libelf-devel +sed -i 's/^baseurl/#baseurl/g;s/^#mirrorlist/mirrorlist/g' /etc/yum.repos.d/rocky*repo +echo "pub/rocky" > /etc/dnf/vars/contentdir +curl -L -o /tmp/vboxadditions.iso https://download.virtualbox.org/virtualbox/6.1.40/VBoxGuestAdditions_6.1.40.iso +mkdir -p /media/VBoxGuestAdditions +mount -o loop,ro /tmp/vboxadditions.iso /media/VBoxGuestAdditions +mkdir -p /tmp/VBoxGuestAdditions +sh /media/VBoxGuestAdditions/VBoxLinuxAdditions.run --nox11 --noexec --keep --target /tmp/VBoxGuestAdditions +pushd /tmp/VBoxGuestAdditions +./install.sh +/sbin/rcvboxadd quicksetup all +popd +ls "/lib/modules/${kver}/misc/" +modinfo "/lib/modules/${kver}/misc/vboxsf.ko" +rm -rf /tmp/VBoxGuestAdditions +umount /media/VBoxGuestAdditions +rm -f /tmp/vboxadditions.iso +rmdir /media/VBoxGuestAdditions +dnf -y remove kernel-devel gcc make perl elfutils-libelf-devel + +# systemd should generate a new machine id during the first boot, to +# avoid having multiple Vagrant instances with the same id in the local +# network. /etc/machine-id should be empty, but it must exist to prevent +# boot errors (e.g. systemd-journald failing to start). +:>/etc/machine-id + +echo 'vag' > /etc/yum/vars/infra + +# Blacklist the floppy module to avoid probing timeouts +echo blacklist floppy > /etc/modprobe.d/nofloppy.conf +chcon -u system_u -r object_r -t modules_conf_t /etc/modprobe.d/nofloppy.conf + +# Customize the initramfs +pushd /etc/dracut.conf.d +# Enable VMware PVSCSI support for VMware Fusion guests. +echo 'add_drivers+=" vmw_pvscsi "' > vmware-fusion-drivers.conf +echo 'add_drivers+=" hv_netvsc hv_storvsc hv_utils hv_vmbus hid-hyperv "' > hyperv-drivers.conf +# There's no floppy controller, but probing for it generates timeouts +echo 'omit_drivers+=" floppy "' > nofloppy.conf +popd +# Fix the SELinux context of the new files +restorecon -f - <> /etc/fstab + +# sudo +echo "%vagrant ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/vagrant +chmod 0440 /etc/sudoers.d/vagrant + +# sshd: disable password authentication and DNS checks +ex -s /etc/ssh/sshd_config <>/etc/sysconfig/sshd <> /home/vagrant/.ssh/authorized_keys +chmod 600 /home/vagrant/.ssh/authorized_keys +chown -R vagrant:vagrant /home/vagrant/.ssh + +# Fix for issue #76, regular users can gain admin privileges via su +ex -s /etc/pam.d/su <<'EOF' +# allow vagrant to use su, but prevent others from becoming root or vagrant +/^account\s\+sufficient\s\+pam_succeed_if.so uid = 0 use_uid quiet$/ +:append +account [success=1 default=ignore] \\ + pam_succeed_if.so user = vagrant use_uid quiet +account required pam_succeed_if.so user notin root:vagrant +. +:update +:quit +EOF + +# systemd should generate a new machine id during the first boot, to +# avoid having multiple Vagrant instances with the same id in the local +# network. /etc/machine-id should be empty, but it must exist to prevent +# boot errors (e.g. systemd-journald failing to start). +:>/etc/machine-id + +echo 'vag' > /etc/yum/vars/infra + +# Blacklist the floppy module to avoid probing timeouts +echo blacklist floppy > /etc/modprobe.d/nofloppy.conf +chcon -u system_u -r object_r -t modules_conf_t /etc/modprobe.d/nofloppy.conf + +# Customize the initramfs +pushd /etc/dracut.conf.d +# Enable VMware PVSCSI support for VMware Fusion guests. +echo 'add_drivers+=" vmw_pvscsi "' > vmware-fusion-drivers.conf +echo 'add_drivers+=" hv_netvsc hv_storvsc hv_utils hv_vmbus hid-hyperv "' > hyperv-drivers.conf +# There's no floppy controller, but probing for it generates timeouts +echo 'omit_drivers+=" floppy "' > nofloppy.conf +popd +# Fix the SELinux context of the new files +restorecon -f - <