wip

Author: travier

examples/bootc-bls/Containerfile.cocl

@@ -1,10 +1,10 @@
-FROM quay.io/fedora/fedora-coreos:stable
+FROM quay.io/fedora/fedora-coreos:42.20250901.3.0
 
 FROM quay.io/afrosi_rh/kbs-client-image:latest as kbc
 FROM quay.io/confidential-clusters/clevis-pin-trustee as clevis
 FROM quay.io/confidential-clusters/ignition:clevis-pin-trustee as ignition
 
-FROM quay.io/fedora/fedora-coreos:stable
+FROM quay.io/fedora/fedora-coreos:42.20250901.3.0
 COPY . /
 
 COPY --from=kbc /usr/local/bin/kbs-client /usr/bin/trustee-attester

examples/bootc-bls/build-bootc-uki

@@ -29,18 +29,19 @@ if [[ ! -f "systemd-bootx64.efi" ]]; then
     # Sign systemd-boot once and re-use it for all builds to keep it unchanged
     sudo podman run --rm \
         --security-opt label=disable \
-        --secret=id=key,src=secureboot/db.key \
-        --secret=id=cert,src=secureboot/db.crt \
+        --volume "$PWD/secureboot/db.key:/run/secrets/key" \
+        --volume "$PWD/secureboot/db.crt:/run/secrets/cert" \
         --volume "$PWD:/var/srv" \
-        --workdir "/var/srv"
+        --workdir "/var/srv" \
         "${FROM}" \
         bash -c "rm -f '/etc/yum.repos.d/fedora-cisco-openh264.repo'; dnf install -y sbsigntools systemd-boot-unsigned; sbsign --key '/run/secrets/key' --cert '/run/secrets/cert' '/usr/lib/systemd/boot/efi/systemd-bootx64.efi' --output '/var/srv/systemd-bootx64.efi'"
 fi
 
 # Replace GRUB with a signed systemd-boot binary
 sudo podman build \
     --from "${FROM}" \
-    -t "${TAG}-systemdboot" \
+    -t "${FROM}-systemdboot" \
+    --iidfile=iid \
     -f Containerfile.systemdboot
 
 cp ../../target/release/bootc .

examples/bootc-bls/build-fcos-bls-cocl

@@ -3,4 +3,5 @@
 export FROM="quay.io/fedora/fedora-coreos:42.20250901.3.0"
 export TAG="quay.io/fedora/fedora-coreos-bls-cocl:42.20250901.3.0"
 export CONTAINERFILE="Containerfile.cocl"
+export EXTRA="extra-cocl"
 exec ./build-bootc-bls

examples/libvirt.sh

@@ -53,7 +53,10 @@ main() {
     fi
 
     connect_to_console="true"
-    if [[ "${connect_to_console}" == "false" ]]; then
+    if [[ "${connect_to_console}" == "true" ]]; then
+        args+=('--autoconsole')
+        args+=('text')
+    else
         args+=('--noautoconsole')
     fi
 

examples/to-filesystem-uki-cocl.sh

@@ -2,6 +2,7 @@
 
 set -euxo pipefail
 
-export IMAGE="quay.io/fedora/fedora-coreos-uki-cocl:stable"
+export IMAGE="quay.io/fedora/fedora-coreos-uki-cocl:42.20250901.3.0"
+export TARGET="quay.io/travier/fedora-coreos-uki-cocl:42.20250901.3.0"
 export DISKIMAGE="${DISKIMAGE:-test-filesystem-fcos-uki-cocl.img}"
 exec ./to-filesystem-uki.sh

examples/to-filesystem-uki.sh

@@ -3,6 +3,7 @@
 set -euxo pipefail
 
 IMAGE="${IMAGE:-quay.io/fedora/fedora-bootc-uki:42}"
+TARGET="${TARGET:-quay.io/fedora/fedora-bootc-uki:42}"
 DISKIMAGE="${DISKIMAGE:-test-filesystem-uki.img}"
 
 umount -R ./mnt || true
@@ -51,6 +52,7 @@ podman run --rm --net=host --privileged --pid=host \
             --composefs-native \
             --bootloader=systemd \
             --source-imgref "containers-storage:$IMAGE" \
+            --target-imgref "${TARGET}" \
             /var/mnt
 
 #             --uki-addon-permanent=btrfs \