Luca Boccassi
45f561bf12
* f7762b7143 sandbox: Preserve net caps across user namespace before unsharing net * 582eadee34 Revert "Put build history into the output directory" * 5ef262bc53 action: don't fail if apk cannot be downloaded * bdd341ff9b Lock the package cache during package manager invocations * da49fe976c Put build history into the output directory * 1c392f1918 tests: Use unique machine names * e4f4026e30 tests: Reduce VM RAM size * de41a5e03e Don't leak gpg-agent when signing with gpg * 1bc5d61e1d ci: Pin openSUSE to second-to-last Tumbleweed snapshot * c4d565a009 test: Use the main build's snapshot for extension builds * 718b06c866 tests: ignore masked units in check-and-shutdown * 0dc5ecbc02 ci: enable postmarketOS in integration testing * d4c6761ad3 action: install apk to /usr/bin * 9980f31309 mkosi-vm: add systemd-efistub to postmarketOS config * 5640ace38f mkosi.conf: add grub to postmarketOS * 6741b440c0 mkosi-initrd: add sulogin, device-mapper to postmarketOS initrd * c3575c035c mkosi-tools: add missing packages to postmarketOS tools tree * 0774bc2498 mkosi-tools: add apk-tools to tools trees for Arch and OpenSuSE | * bb87e48401 curl: Retry on failures |/ * 41fea1dd8d dnf: Work around librepo rejecting valid repomd signatures cross-distro * 647e3b610b dnf: Proper repository metadata signature requirement * 46d907cce2 dnf: Don't skip unavailable repositories during makecache * a91e89c3b7 run_locale_gen: noop if output_format is confext * 30329e401b tests: Make integration tests runnable locally * be549f04db config: Don't propagate $MKOSI_DNF when using a tools tree * 42ed648981 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 * fd5eedd62b build(deps): bump aws-actions/configure-aws-credentials * 86733c703d tree: check for root when copying SELinux attributes as well * de2256f8fe Skip security.ima xattrs when copying tree as non-root | * 08ebf6d678 vmspawn: Exclude secure-boot unless requested |/ * 1d3c51e36d obs workflow: do not build aarch64/i586
152 lines
3.4 KiB
Plaintext
152 lines
3.4 KiB
Plaintext
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
|
|
[Config]
|
|
MinimumVersion=commit:f7762b71437227922a367bb89597843c77494ef9
|
|
Dependencies=
|
|
minimal-base
|
|
minimal-0
|
|
minimal-1
|
|
|
|
PassEnvironment=
|
|
NO_SYNC
|
|
NO_BUILD
|
|
WIPE
|
|
SANITIZERS
|
|
CC
|
|
CXX
|
|
CFLAGS
|
|
CPPFLAGS
|
|
CXXFLAGS
|
|
LDFLAGS
|
|
LLVM
|
|
MESON_VERBOSE
|
|
MESON_OPTIONS
|
|
SYSEXT
|
|
WITH_DEBUG
|
|
ASAN_OPTIONS
|
|
COVERAGE
|
|
VCS_TAG
|
|
|
|
[Output]
|
|
RepartDirectories=mkosi.repart
|
|
OutputDirectory=../build/mkosi.output
|
|
|
|
[Build]
|
|
History=yes
|
|
ToolsTree=default
|
|
BuildDirectory=../build/mkosi.builddir
|
|
CacheDirectory=../build/mkosi.cache
|
|
Incremental=yes
|
|
WithTests=no
|
|
|
|
[Validation]
|
|
SignExpectedPcr=yes
|
|
SecureBoot=yes
|
|
SecureBootAutoEnroll=yes
|
|
|
|
[Content]
|
|
ExtraTrees=
|
|
mkosi.extra.common
|
|
mkosi.crt:/usr/lib/verity.d/mkosi.crt # sysext verification key
|
|
%O/minimal-0.root-%a.raw:/usr/share/minimal_0.raw
|
|
%O/minimal-0.root-%a-verity.raw:/usr/share/minimal_0.verity
|
|
%O/minimal-0.root-%a-verity-sig.raw:/usr/share/minimal_0.verity.sig
|
|
%O/minimal-1.root-%a.raw:/usr/share/minimal_1.raw
|
|
%O/minimal-1.root-%a-verity.raw:/usr/share/minimal_1.verity
|
|
%O/minimal-1.root-%a-verity-sig.raw:/usr/share/minimal_1.verity.sig
|
|
%O/minimal-base:/usr/share/TEST-13-NSPAWN-container-template
|
|
|
|
KernelInitrdModules=default
|
|
|
|
# Disable relabeling by default as TEST-06-SELINUX handles relabeling itself at runtime.
|
|
SELinuxRelabel=no
|
|
|
|
# Adding more kernel command line arguments is likely to hit the kernel command line limit (512 bytes) in
|
|
# various scenarios. Consider adding support for a credential instead if possible and using that.
|
|
KernelCommandLine=
|
|
systemd.crash_shell
|
|
systemd.log_level=debug,console:info
|
|
systemd.log_ratelimit_kmsg=0
|
|
# Disable the kernel's ratelimiting on userspace logging to kmsg.
|
|
printk.devkmsg=on
|
|
# Make sure /sysroot is mounted rw in the initrd.
|
|
rw
|
|
# Make sure no LSMs are enabled by default.
|
|
selinux=0
|
|
systemd.early_core_pattern=/core
|
|
systemd.firstboot=no
|
|
raid=noautodetect
|
|
oops=panic
|
|
panic=-1
|
|
softlockup_panic=1
|
|
panic_on_warn=1
|
|
psi=1
|
|
mitigations=off
|
|
|
|
Packages=
|
|
acl
|
|
attr
|
|
bash-completion
|
|
binutils
|
|
cpio
|
|
curl
|
|
diffutils
|
|
dnsmasq
|
|
dosfstools
|
|
e2fsprogs
|
|
findutils
|
|
gdb
|
|
grep
|
|
gzip
|
|
jq
|
|
kbd
|
|
keyutils
|
|
kmod
|
|
less
|
|
lsof
|
|
lvm2
|
|
mdadm
|
|
mtools
|
|
nano
|
|
nftables
|
|
nvme-cli
|
|
opensc
|
|
openssl
|
|
p11-kit
|
|
pciutils
|
|
python3
|
|
radvd
|
|
rsync
|
|
sed
|
|
socat
|
|
strace
|
|
swtpm
|
|
tar
|
|
tree
|
|
util-linux
|
|
valgrind
|
|
which
|
|
wireguard-tools
|
|
xfsprogs
|
|
zsh
|
|
zstd
|
|
|
|
[Runtime]
|
|
Credentials=
|
|
journal.storage=persistent
|
|
tty.serial.hvc0.agetty.autologin=root
|
|
tty.serial.hvc0.login.noauth=yes
|
|
tty.console.agetty.autologin=root
|
|
tty.console.login.noauth=yes
|
|
tty.virtual.tty1.agetty.autologin=root
|
|
tty.virtual.tty1.login.noauth=yes
|
|
RuntimeBuildSources=yes
|
|
TPM=yes
|
|
VSock=yes
|
|
KVM=yes
|
|
|
|
[Include]
|
|
Include=%D/mkosi/mkosi.sanitizers
|
|
%D/mkosi/mkosi.coverage
|
|
%D/mkosi/mkosi.pkgenv
|