diff --git a/.github/instructions/kiwi.instructions.md b/.github/instructions/kiwi.instructions.md index e7af54a5cd6..7bdd468d8f7 100644 --- a/.github/instructions/kiwi.instructions.md +++ b/.github/instructions/kiwi.instructions.md @@ -9,30 +9,21 @@ Kiwi files define Azure Linux image builds. They use the [KIWI NG](https://osins ## How images are registered Images are defined in `base/images/images.toml`. Each image is -declared as a canonical (unsuffixed) entry plus a `-dev` variant, -each selecting the matching kiwi `profile`: +declared as a canonical entry selecting the matching kiwi `profile`: ```toml [images.container-base] description = "Container Base Image" definition = { type = "kiwi", path = "container-base/container-base.kiwi", profile = "core" } - -[images.container-base-dev] -description = "Container Base Image (dev)" -definition = { type = "kiwi", path = "container-base/container-base.kiwi", profile = "core-dev" } ``` -The two variants share the same kiwi description; they differ only -in which `azurelinux-repos*` package is shipped (controlling where -the resulting OS points at runtime), and — for the `core` container -specifically — the OCI tag (`:4.0` + `:latest` for canonical, -`:4.0-dev` for the dev variant). Both variants build their RPMs -from the same source (the kiwi ``); koji overrides this -during distro builds. - -Distroless container images strip the package manager entirely, so -they ship no `-repos` package and have only a single (canonical) -entry — there's no `-dev` sibling because it would be byte-identical. +Package-manageable images ship `azurelinux-repos`, which enables repositories. +Distroless container images strip the package manager and ship no runtime +repository configuration. + +Runtime repository selection is independent from image build inputs. Kiwi +`` entries provide packages during local builds, and koji overrides +them for distro builds. Each image has its own directory under `base/images/` containing the `.kiwi` file. diff --git a/base/comps/azurelinux-repos/azurelinux-preview.repo b/base/comps/azurelinux-repos/azurelinux-preview.repo new file mode 100644 index 00000000000..82436724089 --- /dev/null +++ b/base/comps/azurelinux-repos/azurelinux-preview.repo @@ -0,0 +1,33 @@ +[azurelinux-preview-base] +name=Azure Linux $releasever - $basearch - Preview - Base +baseurl=https://packages.microsoft.com/azurelinux/4/preview/base/$basearch +enabled=1 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=False + +[azurelinux-preview-base-source] +name=Azure Linux $releasever - Preview - Base - Source +baseurl=https://packages.microsoft.com/azurelinux/4/preview/base/srpms +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-preview-base-debuginfo] +name=Azure Linux $releasever - $basearch - Preview - Base - Debug +baseurl=https://packages.microsoft.com/azurelinux/4/preview/base/debuginfo/$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True diff --git a/base/comps/azurelinux-repos/azurelinux-repos.spec b/base/comps/azurelinux-repos/azurelinux-repos.spec index 75d49856c28..f8e770dcbde 100644 --- a/base/comps/azurelinux-repos/azurelinux-repos.spec +++ b/base/comps/azurelinux-repos/azurelinux-repos.spec @@ -8,40 +8,28 @@ URL: https://aka.ms/azurelinux BuildArch: noarch # Required by %%check -BuildRequires: gnupg sed rpm +BuildRequires: gnupg rpm Source1: archmap -Source2: azurelinux.repo.in -Source3: microsoft.repo +Source2: azurelinux.repo +Source3: azurelinux-preview.repo +Source4: cloud-native.repo +Source5: cloud-native-preview.repo +Source6: microsoft.repo +Source7: microsoft-preview.repo Source10: RPM-GPG-KEY-azurelinux-4.0-primary -# This main package is the default subpackage: official repositories. -# Resolves against packages.microsoft.com; repos and packages are GPG signed. -RemovePathPostfixes: .main Provides: azurelinux-repos(%{version}) = %{release} Requires: system-release(%{version}) Requires: azurelinux-gpg-keys >= %{version}-%{release} -Conflicts: %{name}-dev +Obsoletes: %{name}-dev < %{version}-%{release} %description -This package provides the official Azure Linux yum/dnf repo definitions. - -# Alternate subpackage: daily dev repositories. Unsigned; GPG checks disabled. -%package dev -Summary: Azure Linux development package repository definitions - -RemovePathPostfixes: .dev -Provides: azurelinux-repos(%{version}) = %{release} -Requires: system-release(%{version}) -Requires: azurelinux-gpg-keys >= %{version}-%{release} -Conflicts: %{name} - -%description dev -This package provides the development Azure Linux yum/dnf repo definitions -that resolve against daily development repositories. Repository -metadata and packages from these repositories are NOT GPG signed; signature -verification is disabled. +This package provides the production and preview Azure Linux yum/dnf repo +definitions. Production binary repositories are enabled by default; preview +repositories are temporarily enabled until production repositories are fully +populated; source and debuginfo repositories are disabled by default. %package -n azurelinux-gpg-keys Summary: Azure Linux RPM keys @@ -56,14 +44,14 @@ This package provides the RPM signature keys. %install # Install the keys -install -d -m 755 $RPM_BUILD_ROOT/etc/pki/rpm-gpg -install -m 644 %{_sourcedir}/RPM-GPG-KEY* $RPM_BUILD_ROOT/etc/pki/rpm-gpg/ +install -d -m 755 "%{buildroot}%{_sysconfdir}/pki/rpm-gpg" +install -m 644 %{_sourcedir}/RPM-GPG-KEY* "%{buildroot}%{_sysconfdir}/pki/rpm-gpg/" # Link the primary/secondary keys to arch files, according to archmap. # Ex: if there's a key named RPM-GPG-KEY-azurelinux-4.0-primary, and archmap # says "azurelinux-4.0-primary: x86_64 aarch64", # RPM-GPG-KEY-azurelinux-4.0-{x86_64,aarch64} will be symlinked to that key. -pushd $RPM_BUILD_ROOT/etc/pki/rpm-gpg/ +pushd "%{buildroot}%{_sysconfdir}/pki/rpm-gpg/" for keyfile in RPM-GPG-KEY*; do # resolve symlinks, so that we don't need to keep duplicate entries in archmap real_keyfile=$(basename $(readlink -f $keyfile)) @@ -83,126 +71,15 @@ ln -s RPM-GPG-KEY-azurelinux-%{version}-primary RPM-GPG-KEY-%{version}-azurelinu popd # Install repo files -install -d -m 755 $RPM_BUILD_ROOT/etc/yum.repos.d - -# Helper to replace variables in the .repo file template. -render_repo() { - local outfile="$1" prefix="$2" gpgcheck="$3" repo_gpgcheck="$4" expire="$5" - install -m 644 %{SOURCE2} "$outfile" - # Note: REPO_GPGCHECK_VALUE is substituted BEFORE GPGCHECK_VALUE because - # the latter is a substring of the former — reversing the order would - # leave a corrupted 'repo_gpgcheck=REPO__VALUE' line. - sed -i \ - -e "s|REPO_URI_PREFIX|${prefix}|g" \ - -e "s|REPO_GPGCHECK_VALUE|${repo_gpgcheck}|g" \ - -e "s|GPGCHECK_VALUE|${gpgcheck}|g" \ - -e "s|METADATA_EXPIRE_VALUE|${expire}|g" \ - "$outfile" -} - -# Render official .repo file pointing at packages.microsoft.com, signed, -# longer metadata cache. The .main suffix will be removed thanks to -# RemovePathPostfixes. -# -# NOTE: We presently set repo_gpgcheck=0. It would succeed against this -# repository, but the "first use" experience with dnf5 blocks, presents -# an error and requires a human to confirm import of the gpg keys into -# the libdnf5 cache (separate from RPM database gpg key import). Because -# of this and other issues reported upstream, we will hold off on enabling -# this setting and revisit later. -render_repo \ - "$RPM_BUILD_ROOT/etc/yum.repos.d/azurelinux.repo.main" \ - 'https://packages.microsoft.com/azurelinux/$releasever/beta' \ - 1 0 '7d' - -# Render .repo file pointing at daily dev repos, unsigned, shorter cache. -# The .dev suffix will be removed thanks to RemovePathPostfixes. -render_repo \ - "$RPM_BUILD_ROOT/etc/yum.repos.d/azurelinux.repo.dev" \ - 'https://stcontroltowerdevjwisitg.blob.core.windows.net/azl4-dev' \ - 0 0 '6h' - -# Install the Microsoft subrepo in both subpackages. The URL is fixed to -# packages.microsoft.com (the Microsoft-curated content lives there -# regardless of which Azure Linux base repo a system is pointed at), so the -# same file is shipped to both variants. The .main / .dev suffixes are -# stripped by RemovePathPostfixes. -install -m 644 %{SOURCE3} \ - "$RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.main" -install -m 644 %{SOURCE3} \ - "$RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.dev" +install -d -m 755 "%{buildroot}%{_sysconfdir}/yum.repos.d" +install -m 644 %{SOURCE2} "%{buildroot}%{_sysconfdir}/yum.repos.d/azurelinux.repo" +install -m 644 %{SOURCE3} "%{buildroot}%{_sysconfdir}/yum.repos.d/azurelinux-preview.repo" +install -m 644 %{SOURCE4} "%{buildroot}%{_sysconfdir}/yum.repos.d/cloud-native.repo" +install -m 644 %{SOURCE5} "%{buildroot}%{_sysconfdir}/yum.repos.d/cloud-native-preview.repo" +install -m 644 %{SOURCE6} "%{buildroot}%{_sysconfdir}/yum.repos.d/microsoft.repo" +install -m 644 %{SOURCE7} "%{buildroot}%{_sysconfdir}/yum.repos.d/microsoft-preview.repo" %check -# Make sure all repo variables were substituted -for repo in $RPM_BUILD_ROOT/etc/yum.repos.d/*.repo.*; do - if grep -qE 'REPO_URI_PREFIX|GPGCHECK_VALUE|REPO_GPGCHECK_VALUE|METADATA_EXPIRE_VALUE' $repo; then - echo "ERROR: Repo $repo contains an unsubstituted placeholder value" - exit 1 - fi -done - -main_file=$RPM_BUILD_ROOT/etc/yum.repos.d/azurelinux.repo.main -dev_file=$RPM_BUILD_ROOT/etc/yum.repos.d/azurelinux.repo.dev - -# Main repo file must exist with GPG checking enabled on every section. -if [ ! -f "$main_file" ]; then - echo "ERROR: missing $main_file" - exit 1 -fi -if [ "$(grep -c '^gpgcheck=1' "$main_file")" -ne 3 ] || \ - [ "$(grep -c '^repo_gpgcheck=0' "$main_file")" -ne 3 ]; then - echo "ERROR: $main_file must correctly configure gpgcheck and repo_gpgcheck" - exit 1 -fi -if [ "$(grep -c '^metadata_expire=7d' "$main_file")" -ne 3 ]; then - echo "ERROR: $main_file must have metadata_expire=7d on all 3 sections" - exit 1 -fi - -# Dev file must exist with GPG checking disabled on every section. -if [ ! -f "$dev_file" ]; then - echo "ERROR: missing $dev_file" - exit 1 -fi -if grep -qE '^(gpgcheck|repo_gpgcheck)=1' "$dev_file"; then - echo "ERROR: $dev_file must not have gpgcheck or repo_gpgcheck enabled" - exit 1 -fi -if [ "$(grep -c '^metadata_expire=6h' "$dev_file")" -ne 3 ]; then - echo "ERROR: $dev_file must have metadata_expire=6h on all 3 sections" - exit 1 -fi - -# Both files must have exactly one enabled=1 section (the base repo) plus -# two enabled=0 sections (debuginfo, source). -for repo in "$main_file" "$dev_file"; do - if [ "$(grep -c '^enabled=1' "$repo")" -ne 1 ] || \ - [ "$(grep -c '^enabled=0' "$repo")" -ne 2 ]; then - echo "ERROR: $repo has unexpected enabled-flag distribution" - exit 1 - fi -done - -# Microsoft subrepo: shipped in both subpackages. Must exist, be enabled by -# default, GPG-signed, and point at packages.microsoft.com. -for microsoft_file in \ - $RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.main \ - $RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.dev; do - if [ ! -f "$microsoft_file" ]; then - echo "ERROR: missing $microsoft_file" - exit 1 - fi - if ! grep -q '^baseurl=https://packages.microsoft.com/azurelinux/\$releasever/beta/microsoft/\$basearch$' "$microsoft_file"; then - echo "ERROR: $microsoft_file must point at packages.microsoft.com microsoft subrepo" - exit 1 - fi - if [ "$(grep -c '^enabled=1' "$microsoft_file")" -ne 1 ] || \ - [ "$(grep -c '^gpgcheck=1' "$microsoft_file")" -ne 1 ]; then - echo "ERROR: $microsoft_file must be enabled=1 and gpgcheck=1" - exit 1 - fi -done - # Check arch keys exists on supported architectures, and RPM considers # them valid TMPRING=$(mktemp) @@ -210,27 +87,26 @@ DBPATH=$(mktemp -d) echo -n > "$TMPRING" for ARCH in $(sed -ne "s/^azurelinux-%{version}-primary://p" %{SOURCE1}); do gpg --no-default-keyring --keyring="$TMPRING" \ - --import $RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-%{version}-$ARCH + --import "%{buildroot}%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-%{version}-$ARCH" rpm --dbpath "$DBPATH" --import \ - $RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-%{version}-$ARCH --test + "%{buildroot}%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-%{version}-$ARCH" --test done # Ensure some arch key was imported gpg --no-default-keyring --keyring="$TMPRING" --list-keys | grep -A 2 '^pub\s' rm -f "$TMPRING" %files -%dir /etc/yum.repos.d -%config(noreplace) /etc/yum.repos.d/azurelinux.repo.main -%config(noreplace) /etc/yum.repos.d/microsoft.repo.main - -%files dev -%dir /etc/yum.repos.d -%config(noreplace) /etc/yum.repos.d/azurelinux.repo.dev -%config(noreplace) /etc/yum.repos.d/microsoft.repo.dev +%dir %{_sysconfdir}/yum.repos.d +%config(noreplace) %{_sysconfdir}/yum.repos.d/azurelinux.repo +%config(noreplace) %{_sysconfdir}/yum.repos.d/azurelinux-preview.repo +%config(noreplace) %{_sysconfdir}/yum.repos.d/cloud-native.repo +%config(noreplace) %{_sysconfdir}/yum.repos.d/cloud-native-preview.repo +%config(noreplace) %{_sysconfdir}/yum.repos.d/microsoft.repo +%config(noreplace) %{_sysconfdir}/yum.repos.d/microsoft-preview.repo %files -n azurelinux-gpg-keys -%dir /etc/pki/rpm-gpg -/etc/pki/rpm-gpg/RPM-GPG-KEY-* +%dir %{_sysconfdir}/pki/rpm-gpg +%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-* %changelog diff --git a/base/comps/azurelinux-repos/azurelinux.repo b/base/comps/azurelinux-repos/azurelinux.repo new file mode 100644 index 00000000000..7ee82b9f3c9 --- /dev/null +++ b/base/comps/azurelinux-repos/azurelinux.repo @@ -0,0 +1,33 @@ +[azurelinux-base] +name=Azure Linux $releasever - $basearch - Production - Base +baseurl=https://packages.microsoft.com/azurelinux/4/prod/base/$basearch +enabled=1 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=False + +[azurelinux-base-source] +name=Azure Linux $releasever - Production - Base - Source +baseurl=https://packages.microsoft.com/azurelinux/4/prod/base/srpms +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-base-debuginfo] +name=Azure Linux $releasever - $basearch - Production - Base - Debug +baseurl=https://packages.microsoft.com/azurelinux/4/prod/base/debuginfo/$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True diff --git a/base/comps/azurelinux-repos/azurelinux.repo.in b/base/comps/azurelinux-repos/azurelinux.repo.in deleted file mode 100644 index b347e73fab7..00000000000 --- a/base/comps/azurelinux-repos/azurelinux.repo.in +++ /dev/null @@ -1,33 +0,0 @@ -[azurelinux-base] -name=Azure Linux $releasever - $basearch - Base -baseurl=REPO_URI_PREFIX/base/$basearch -enabled=1 -countme=1 -metadata_expire=METADATA_EXPIRE_VALUE -repo_gpgcheck=REPO_GPGCHECK_VALUE -type=rpm -gpgcheck=GPGCHECK_VALUE -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch -skip_if_unavailable=False - -[azurelinux-base-debuginfo] -name=Azure Linux $releasever - $basearch - Base - Debug -baseurl=REPO_URI_PREFIX/base/debuginfo/$basearch -enabled=0 -metadata_expire=METADATA_EXPIRE_VALUE -repo_gpgcheck=REPO_GPGCHECK_VALUE -type=rpm -gpgcheck=GPGCHECK_VALUE -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch -skip_if_unavailable=True - -[azurelinux-base-source] -name=Azure Linux $releasever - Base - Source -baseurl=REPO_URI_PREFIX/base/srpms -enabled=0 -metadata_expire=METADATA_EXPIRE_VALUE -repo_gpgcheck=REPO_GPGCHECK_VALUE -type=rpm -gpgcheck=GPGCHECK_VALUE -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch -skip_if_unavailable=True diff --git a/base/comps/azurelinux-repos/cloud-native-preview.repo b/base/comps/azurelinux-repos/cloud-native-preview.repo new file mode 100644 index 00000000000..f241a784a97 --- /dev/null +++ b/base/comps/azurelinux-repos/cloud-native-preview.repo @@ -0,0 +1,33 @@ +[azurelinux-preview-cloud-native] +name=Azure Linux $releasever - $basearch - Preview - Cloud Native +baseurl=https://packages.microsoft.com/azurelinux/4/preview/cloud-native/$basearch +enabled=1 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-preview-cloud-native-source] +name=Azure Linux $releasever - Preview - Cloud Native - Source +baseurl=https://packages.microsoft.com/azurelinux/4/preview/cloud-native/srpms +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-preview-cloud-native-debuginfo] +name=Azure Linux $releasever - $basearch - Preview - Cloud Native - Debug +baseurl=https://packages.microsoft.com/azurelinux/4/preview/cloud-native/debuginfo/$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True diff --git a/base/comps/azurelinux-repos/cloud-native.repo b/base/comps/azurelinux-repos/cloud-native.repo new file mode 100644 index 00000000000..51c2eb89b98 --- /dev/null +++ b/base/comps/azurelinux-repos/cloud-native.repo @@ -0,0 +1,33 @@ +[azurelinux-cloud-native] +name=Azure Linux $releasever - $basearch - Production - Cloud Native +baseurl=https://packages.microsoft.com/azurelinux/4/prod/cloud-native/$basearch +enabled=1 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-cloud-native-source] +name=Azure Linux $releasever - Production - Cloud Native - Source +baseurl=https://packages.microsoft.com/azurelinux/4/prod/cloud-native/srpms +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-cloud-native-debuginfo] +name=Azure Linux $releasever - $basearch - Production - Cloud Native - Debug +baseurl=https://packages.microsoft.com/azurelinux/4/prod/cloud-native/debuginfo/$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True diff --git a/base/comps/azurelinux-repos/microsoft-preview.repo b/base/comps/azurelinux-repos/microsoft-preview.repo new file mode 100644 index 00000000000..2ffcc6675c7 --- /dev/null +++ b/base/comps/azurelinux-repos/microsoft-preview.repo @@ -0,0 +1,33 @@ +[azurelinux-preview-microsoft] +name=Azure Linux $releasever - $basearch - Preview - Microsoft +baseurl=https://packages.microsoft.com/azurelinux/4/preview/microsoft/$basearch +enabled=1 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-preview-microsoft-source] +name=Azure Linux $releasever - Preview - Microsoft - Source +baseurl=https://packages.microsoft.com/azurelinux/4/preview/microsoft/srpms +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-preview-microsoft-debuginfo] +name=Azure Linux $releasever - $basearch - Preview - Microsoft - Debug +baseurl=https://packages.microsoft.com/azurelinux/4/preview/microsoft/debuginfo/$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True diff --git a/base/comps/azurelinux-repos/microsoft.repo b/base/comps/azurelinux-repos/microsoft.repo index 98cdb447b54..0df087484a4 100644 --- a/base/comps/azurelinux-repos/microsoft.repo +++ b/base/comps/azurelinux-repos/microsoft.repo @@ -1,11 +1,33 @@ [azurelinux-microsoft] -name=Azure Linux $releasever - $basearch - Microsoft -baseurl=https://packages.microsoft.com/azurelinux/$releasever/beta/microsoft/$basearch +name=Azure Linux $releasever - $basearch - Production - Microsoft +baseurl=https://packages.microsoft.com/azurelinux/4/prod/microsoft/$basearch enabled=1 countme=1 -metadata_expire=7d +metadata_expire=6h repo_gpgcheck=0 type=rpm gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch -skip_if_unavailable=False +skip_if_unavailable=True + +[azurelinux-microsoft-source] +name=Azure Linux $releasever - Production - Microsoft - Source +baseurl=https://packages.microsoft.com/azurelinux/4/prod/microsoft/srpms +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-microsoft-debuginfo] +name=Azure Linux $releasever - $basearch - Production - Microsoft - Debug +baseurl=https://packages.microsoft.com/azurelinux/4/prod/microsoft/debuginfo/$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True diff --git a/base/images/container-base/container-base.kiwi b/base/images/container-base/container-base.kiwi index f81c9f76080..d0bf5af889d 100644 --- a/base/images/container-base/container-base.kiwi +++ b/base/images/container-base/container-base.kiwi @@ -6,38 +6,8 @@ azurelinux@microsoft.com Azure Linux Container Base Image - - @@ -46,12 +16,6 @@ 0.1 dnf5 - - - - - - - - - + - + - - - - - - - @@ -161,15 +96,12 @@ - - - + profiles="core,distroless-minimal,distroless-base,distroless-debug"> diff --git a/base/images/images.toml b/base/images/images.toml index 8a3ccf643c8..dfc481baa7e 100644 --- a/base/images/images.toml +++ b/base/images/images.toml @@ -2,29 +2,12 @@ # Image registry # ============================================================================ # -# Most images come in two variants — a canonical (unsuffixed) build and -# a `-dev` build — each backed by a kiwi profile inside the matching -# `*.kiwi` file: +# Package-manageable images ship `azurelinux-repos`, which exposes repositories. +# Distroless images contain neither a package manager nor runtime repositories. # -# : ships `azurelinux-repos` so the resulting OS points -# at packages.microsoft.com/azurelinux/4.0/beta at runtime. -# (For the `core` container, this is also the variant -# published with the `:4.0` + `:latest` OCI tags.) -# -dev : ships `azurelinux-repos-dev` so the resulting OS points -# at the azl4-dev blob at runtime. (For the `core` -# container, the OCI image is tagged `:4.0-dev` only.) -# -# Distroless container images strip the package manager entirely, so -# they ship no `-repos` package and are not built per-variant — only -# the canonical (unsuffixed) entries exist for those. -# -# Both variants build their RPMs from the same source (the kiwi -# `` points at azl4-dev for local builds; koji overrides -# this for distro builds). -# -# Capabilities and test-suites are identical between a canonical / `-dev` -# pair (the variants only differ in what `-repos` package ships and, -# for `core`, the OCI tag). +# Image build inputs remain independent of the runtime repository definitions: +# each kiwi `` points at azl4-dev for local builds, and koji +# overrides it for distro builds. # ============================================================================ # ---- vm-base ----------------------------------------------------------- @@ -47,24 +30,6 @@ container = false systemd = true runtime-package-management = true -[images.vm-base-dev] -description = "VM Base Image (dev)" -definition = { type = "kiwi", path = "vm-base/vm-base.kiwi", profile = "vm-base-dev" } -tests.test-suites = [ - { name = "static-image-checks" }, - { name = "lisa-main" }, - { name = "lisa-xfs" }, - { name = "lisa-perf" }, - { name = "lisa-smoke" }, - { name = "lisa-kernel-ltp" }, -] - -[images.vm-base-dev.capabilities] -machine-bootable = true -container = false -systemd = true -runtime-package-management = true - # ---- minimal-os -------------------------------------------------------- [images.minimal-os] @@ -80,19 +45,6 @@ container = false systemd = true runtime-package-management = true -[images.minimal-os-dev] -description = "Minimal OS Image (dev)" -definition = { type = "kiwi", path = "minimal-os/minimal-os.kiwi", profile = "minimal-os-dev" } -tests.test-suites = [ - { name = "static-image-checks" }, -] - -[images.minimal-os-dev.capabilities] -machine-bootable = true -container = false -systemd = true -runtime-package-management = true - # ---- container-base (core profile) ------------------------------------- [images.container-base] description = "Container Base Image" @@ -108,23 +60,7 @@ container = true systemd = false runtime-package-management = true -[images.container-base-dev] -description = "Container Base Image (dev)" -definition = { type = "kiwi", path = "container-base/container-base.kiwi", profile = "core-dev" } -tests.test-suites = [ - { name = "static-image-checks" }, - { name = "runtime-container-tests" }, -] - -[images.container-base-dev.capabilities] -machine-bootable = false -container = true -systemd = false -runtime-package-management = true - -# ---- distroless containers (single-variant only) ----------------------- -# No -dev sibling: with a single build-time repo and no runtime package -# management, a -dev distroless build would be byte-identical. +# ---- distroless containers --------------------------------------------- [images.container-distroless-minimal] description = "Container Distroless Minimal Image" @@ -172,27 +108,12 @@ container = false systemd = true runtime-package-management = true -[images.wsl-dev] -description = "WSL Image (dev)" -definition = { type = "kiwi", path = "wsl/wsl.kiwi", profile = "wsl-dev" } -tests.test-suites = [{ name = "static-image-checks" }] - -[images.wsl-dev.capabilities] -machine-bootable = false -container = false -systemd = true -runtime-package-management = true - # ---- vm-iso-installer -------------------------------------------------- [images.vm-iso-installer] description = "VM ISO Installer" definition = { type = "kiwi", path = "vm-iso-installer/vm-iso-installer.kiwi", profile = "vm-iso-installer" } -[images.vm-iso-installer-dev] -description = "VM ISO Installer (dev)" -definition = { type = "kiwi", path = "vm-iso-installer/vm-iso-installer.kiwi", profile = "vm-iso-installer-dev" } - # ============================================================================ # Test suites # ============================================================================ diff --git a/base/images/minimal-os/minimal-os.kiwi b/base/images/minimal-os/minimal-os.kiwi index 38edacae393..9cade58d624 100644 --- a/base/images/minimal-os/minimal-os.kiwi +++ b/base/images/minimal-os/minimal-os.kiwi @@ -6,14 +6,8 @@ azurelinux@microsoft.com Azure Linux Minimal OS Image - - - + 0.1 @@ -42,13 +36,7 @@ - + @@ -56,6 +44,7 @@ + @@ -80,21 +69,9 @@ - - - - - - - - + @@ -104,10 +81,4 @@ - - - - - - diff --git a/base/images/tests/README.md b/base/images/tests/README.md index 8ce78e38bc5..9f97406b99d 100644 --- a/base/images/tests/README.md +++ b/base/images/tests/README.md @@ -21,14 +21,6 @@ azldev image build wsl azldev image test wsl ``` -(Most images come in two variants. The canonical/unsuffixed name -ships `azurelinux-repos` so the resulting OS points at PMC's -`azurelinux/4.0/beta` repo at runtime; the `-dev` variant ships -`azurelinux-repos-dev` so the OS points at the azl4-dev blob. -Distroless container images strip the package manager entirely and -have only the canonical entry. Append `-dev` to the image name — -where present — to validate the dev variant.) - `azldev` creates a per-suite Python venv, installs this directory's `pyproject.toml`, and invokes pytest with the right `--image-path`, `--image-name`, and `--capabilities` arguments. @@ -180,8 +172,7 @@ base/images/ during collection — no boilerplate per file or per subdir). The directory name is treated as a *family*: an `--image-name` matches the family if it equals the family exactly OR has the form - `-` (so `cases/static/vm-base/` runs for both - `vm-base` and `vm-base-dev`). + `-` if an image family introduces variants. - **Shared runtime (every container):** add a `cases/runtime/test_.py`. Use `container_exec_shell("...")` for normal runtime tests. Use `container_exec([...])` only when the test must avoid a shell, such as diff --git a/base/images/tests/cases/static/test_footprint.py b/base/images/tests/cases/static/test_footprint.py index 4471b8fc26f..5edee2e302b 100644 --- a/base/images/tests/cases/static/test_footprint.py +++ b/base/images/tests/cases/static/test_footprint.py @@ -46,7 +46,7 @@ def _family_of(image_name: str, known: Iterable[str]) -> str | None: - """Map an ``--image-name`` to its family (e.g. ``container-base-dev`` → ``container-base``).""" + """Map an ``--image-name`` to its family, including optional suffixed variants.""" for family in known: if image_name == family or image_name.startswith(family + "-"): return family diff --git a/base/images/tests/utils/pytest_plugin.py b/base/images/tests/utils/pytest_plugin.py index f3ab066227a..881dc920325 100644 --- a/base/images/tests/utils/pytest_plugin.py +++ b/base/images/tests/utils/pytest_plugin.py @@ -182,9 +182,9 @@ def pytest_runtest_setup(item: pytest.Item) -> None: # image: skip if --image-name doesn't match the marker's family. # Family matching: the marker's value is treated as a family name that # matches an image-name exactly OR matches a `-` name - # (e.g. ``image("vm-base")`` matches both ``vm-base`` and - # ``vm-base-dev``). This lets tests under ``cases//`` apply - # to every variant of an image without per-variant duplication. + # (e.g. ``image("vm-base")`` also matches any ``vm-base-*`` variant). + # This lets tests under ``cases//`` apply to every variant of + # an image without per-variant duplication. image_name = item.config.getoption("--image-name", default=None) for marker in item.iter_markers("image"): expected = marker.args[0] if marker.args else None diff --git a/base/images/vm-base/vm-base.kiwi b/base/images/vm-base/vm-base.kiwi index 8c870852e71..3d1462d64a7 100644 --- a/base/images/vm-base/vm-base.kiwi +++ b/base/images/vm-base/vm-base.kiwi @@ -6,20 +6,8 @@ azurelinux@microsoft.com Azure Linux VM Base Image - - - + 0.1 @@ -79,13 +67,7 @@ - + @@ -94,6 +76,7 @@ + @@ -167,21 +150,9 @@ - - - - - - - - + @@ -191,10 +162,4 @@ - - - - - - diff --git a/base/images/vm-iso-installer/config.sh b/base/images/vm-iso-installer/config.sh index c13bfc2c0d1..8ae63f6a11f 100644 --- a/base/images/vm-iso-installer/config.sh +++ b/base/images/vm-iso-installer/config.sh @@ -32,37 +32,6 @@ echo "=== Architecture: $ARCH ===" echo " GRUB EFI package: $GRUB_EFI_PKG" echo " Shim EFI binary: $SHIM_EFI" -#---------------------------------------------------------------------- -# Variant detection -#---------------------------------------------------------------------- -# kiwi sets `kiwi_profiles` to a comma-separated list of active profiles -# (one per build, set by --profile). The variant decides which -# `azurelinux-repos*` package goes into the image and the kickstart, -# which in turn controls the runtime repo of the installed system. -# -# OFFLINE_REPO_BLOCKLIST lists packages that must NOT appear in the -# offline repo. The opposite-variant repos package goes here: -# `azurelinux-repos` and `-dev` Conflict: with each other, and -# `azurelinux-release-common` has `Recommends: azurelinux-repos`, which -# would otherwise drag the canonical package into the dev offline repo -# via --resolve --alldeps and risk dnf picking the wrong one. -case ",${kiwi_profiles:-}," in - *,vm-iso-installer-dev,*) - AZL_REPOS_PKG="azurelinux-repos-dev" - OFFLINE_REPO_BLOCKLIST=( "azurelinux-repos" ) - ;; - *,vm-iso-installer,*) - AZL_REPOS_PKG="azurelinux-repos" - OFFLINE_REPO_BLOCKLIST=( "azurelinux-repos-dev" ) - ;; - *) - echo "ERROR: cannot determine variant from kiwi_profiles='${kiwi_profiles:-}'" >&2 - exit 1 - ;; -esac -echo " Variant repos pkg: $AZL_REPOS_PKG" -echo " Offline repo blocklist: ${OFFLINE_REPO_BLOCKLIST[*]}" - #---------------------------------------------------------------------- # Download all target-install packages + deps for the offline repo #---------------------------------------------------------------------- @@ -97,7 +66,7 @@ INSTALL_PKGS=( vim-minimal ca-certificates azurelinux-release - "$AZL_REPOS_PKG" + azurelinux-repos setup rootfiles shadow-utils @@ -134,11 +103,6 @@ echo "=== Downloading target-install packages + dependencies ===" AZL_BASE_URL="https://stcontroltowerdevjwisitg.blob.core.windows.net/azl4-dev/base/$ARCH" -EXCLUDE_ARGS=() -for pkg in "${OFFLINE_REPO_BLOCKLIST[@]}"; do - EXCLUDE_ARGS+=( --exclude="$pkg" ) -done - dnf5 download \ --setopt=reposdir=/dev/null \ --repofrompath=azl-base,"$AZL_BASE_URL" \ @@ -146,7 +110,6 @@ dnf5 download \ --resolve \ --alldeps \ --skip-unavailable \ - "${EXCLUDE_ARGS[@]}" \ --destdir="$OFFLINE_REPO" \ "${INSTALL_PKGS[@]}" "${EXTRA_REPO_PKGS[@]}" || { echo "WARNING: dnf download had errors — some packages may be missing" @@ -165,21 +128,6 @@ createrepo_c "$OFFLINE_REPO" #---------------------------------------------------------------------- echo "=== Validating offline repo completeness ===" -# Verify that no blocklisted package landed in the offline repo. -# The `-[0-9]*` boundary disambiguates the package name from prefix -# overlap (e.g. `foo` vs `foo-bar`) since RPM filenames are -# `--..rpm` with version starting in a digit. -for pkg in "${OFFLINE_REPO_BLOCKLIST[@]}"; do - if ls "$OFFLINE_REPO/${pkg}"-[0-9]*.rpm >/dev/null 2>&1; then - echo "!!!" - echo "!!! FATAL: blocklisted package landed in offline repo:" - echo "!!! $(ls "$OFFLINE_REPO/${pkg}"-[0-9]*.rpm)" - echo "!!!" - echo "Fix: ensure the dnf5 download command excludes $pkg." - exit 1 - fi -done - DRYRUN_ROOT=$(mktemp -d /tmp/azl-dryrun-XXXXXX) DRYRUN_ERRORS=$(dnf5 install \ --assumeno \ diff --git a/base/images/vm-iso-installer/vm-iso-installer.kiwi b/base/images/vm-iso-installer/vm-iso-installer.kiwi index 562befc142f..0eff32567b9 100644 --- a/base/images/vm-iso-installer/vm-iso-installer.kiwi +++ b/base/images/vm-iso-installer/vm-iso-installer.kiwi @@ -8,10 +8,8 @@ azurelinux@microsoft.com Azure Linux 4.0 ISO Installer - - - + 0.1 @@ -44,6 +42,7 @@ + @@ -121,21 +120,10 @@ - - - - - - - - + @@ -144,13 +132,6 @@ - - - - - - - diff --git a/base/images/wsl/wsl.kiwi b/base/images/wsl/wsl.kiwi index f8d5f56b3f7..fcbe91e4c96 100644 --- a/base/images/wsl/wsl.kiwi +++ b/base/images/wsl/wsl.kiwi @@ -6,10 +6,8 @@ azurelinux@microsoft.com Azure Linux WSL Image - - - + 0.1 @@ -95,18 +93,7 @@ - - - - - - - - + diff --git a/locks/azurelinux-repos.lock b/locks/azurelinux-repos.lock index cec67aa0c16..95c50f878dd 100644 --- a/locks/azurelinux-repos.lock +++ b/locks/azurelinux-repos.lock @@ -1,4 +1,4 @@ # Managed by azldev component update. Do not edit manually. version = 1 manual-bump = 2 -input-fingerprint = 'sha256:961ff87a22a62a84240de8406574e98749f0329e786906a1ce49f0690a36dba8' +input-fingerprint = 'sha256:941507adf90f6759358b62b98be3740236b4148d8ea054d693c6828b610fdde4' diff --git a/specs/a/azurelinux-repos/azurelinux-preview.repo b/specs/a/azurelinux-repos/azurelinux-preview.repo new file mode 100644 index 00000000000..82436724089 --- /dev/null +++ b/specs/a/azurelinux-repos/azurelinux-preview.repo @@ -0,0 +1,33 @@ +[azurelinux-preview-base] +name=Azure Linux $releasever - $basearch - Preview - Base +baseurl=https://packages.microsoft.com/azurelinux/4/preview/base/$basearch +enabled=1 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=False + +[azurelinux-preview-base-source] +name=Azure Linux $releasever - Preview - Base - Source +baseurl=https://packages.microsoft.com/azurelinux/4/preview/base/srpms +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-preview-base-debuginfo] +name=Azure Linux $releasever - $basearch - Preview - Base - Debug +baseurl=https://packages.microsoft.com/azurelinux/4/preview/base/debuginfo/$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True diff --git a/specs/a/azurelinux-repos/azurelinux-repos.spec b/specs/a/azurelinux-repos/azurelinux-repos.spec index 248319ab7e1..7d45f57831e 100644 --- a/specs/a/azurelinux-repos/azurelinux-repos.spec +++ b/specs/a/azurelinux-repos/azurelinux-repos.spec @@ -2,7 +2,7 @@ ## (rpmautospec version 0.8.3) ## RPMAUTOSPEC: autorelease, autochangelog %define autorelease(e:s:pb:n) %{?-p:0.}%{lua: - release_number = 11; + release_number = 12; base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); print(release_number + base_release_number - 1); }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} @@ -21,40 +21,28 @@ URL: https://aka.ms/azurelinux BuildArch: noarch # Required by %%check -BuildRequires: gnupg sed rpm +BuildRequires: gnupg rpm Source1: archmap -Source2: azurelinux.repo.in -Source3: microsoft.repo +Source2: azurelinux.repo +Source3: azurelinux-preview.repo +Source4: cloud-native.repo +Source5: cloud-native-preview.repo +Source6: microsoft.repo +Source7: microsoft-preview.repo Source10: RPM-GPG-KEY-azurelinux-4.0-primary -# This main package is the default subpackage: official repositories. -# Resolves against packages.microsoft.com; repos and packages are GPG signed. -RemovePathPostfixes: .main Provides: azurelinux-repos(%{version}) = %{release} Requires: system-release(%{version}) Requires: azurelinux-gpg-keys >= %{version}-%{release} -Conflicts: %{name}-dev +Obsoletes: %{name}-dev < %{version}-%{release} %description -This package provides the official Azure Linux yum/dnf repo definitions. - -# Alternate subpackage: daily dev repositories. Unsigned; GPG checks disabled. -%package dev -Summary: Azure Linux development package repository definitions - -RemovePathPostfixes: .dev -Provides: azurelinux-repos(%{version}) = %{release} -Requires: system-release(%{version}) -Requires: azurelinux-gpg-keys >= %{version}-%{release} -Conflicts: %{name} - -%description dev -This package provides the development Azure Linux yum/dnf repo definitions -that resolve against daily development repositories. Repository -metadata and packages from these repositories are NOT GPG signed; signature -verification is disabled. +This package provides the production and preview Azure Linux yum/dnf repo +definitions. Production binary repositories are enabled by default; preview +repositories are temporarily enabled until production repositories are fully +populated; source and debuginfo repositories are disabled by default. %package -n azurelinux-gpg-keys Summary: Azure Linux RPM keys @@ -69,14 +57,14 @@ This package provides the RPM signature keys. %install # Install the keys -install -d -m 755 $RPM_BUILD_ROOT/etc/pki/rpm-gpg -install -m 644 %{_sourcedir}/RPM-GPG-KEY* $RPM_BUILD_ROOT/etc/pki/rpm-gpg/ +install -d -m 755 "%{buildroot}%{_sysconfdir}/pki/rpm-gpg" +install -m 644 %{_sourcedir}/RPM-GPG-KEY* "%{buildroot}%{_sysconfdir}/pki/rpm-gpg/" # Link the primary/secondary keys to arch files, according to archmap. # Ex: if there's a key named RPM-GPG-KEY-azurelinux-4.0-primary, and archmap # says "azurelinux-4.0-primary: x86_64 aarch64", # RPM-GPG-KEY-azurelinux-4.0-{x86_64,aarch64} will be symlinked to that key. -pushd $RPM_BUILD_ROOT/etc/pki/rpm-gpg/ +pushd "%{buildroot}%{_sysconfdir}/pki/rpm-gpg/" for keyfile in RPM-GPG-KEY*; do # resolve symlinks, so that we don't need to keep duplicate entries in archmap real_keyfile=$(basename $(readlink -f $keyfile)) @@ -96,126 +84,15 @@ ln -s RPM-GPG-KEY-azurelinux-%{version}-primary RPM-GPG-KEY-%{version}-azurelinu popd # Install repo files -install -d -m 755 $RPM_BUILD_ROOT/etc/yum.repos.d - -# Helper to replace variables in the .repo file template. -render_repo() { - local outfile="$1" prefix="$2" gpgcheck="$3" repo_gpgcheck="$4" expire="$5" - install -m 644 %{SOURCE2} "$outfile" - # Note: REPO_GPGCHECK_VALUE is substituted BEFORE GPGCHECK_VALUE because - # the latter is a substring of the former — reversing the order would - # leave a corrupted 'repo_gpgcheck=REPO__VALUE' line. - sed -i \ - -e "s|REPO_URI_PREFIX|${prefix}|g" \ - -e "s|REPO_GPGCHECK_VALUE|${repo_gpgcheck}|g" \ - -e "s|GPGCHECK_VALUE|${gpgcheck}|g" \ - -e "s|METADATA_EXPIRE_VALUE|${expire}|g" \ - "$outfile" -} - -# Render official .repo file pointing at packages.microsoft.com, signed, -# longer metadata cache. The .main suffix will be removed thanks to -# RemovePathPostfixes. -# -# NOTE: We presently set repo_gpgcheck=0. It would succeed against this -# repository, but the "first use" experience with dnf5 blocks, presents -# an error and requires a human to confirm import of the gpg keys into -# the libdnf5 cache (separate from RPM database gpg key import). Because -# of this and other issues reported upstream, we will hold off on enabling -# this setting and revisit later. -render_repo \ - "$RPM_BUILD_ROOT/etc/yum.repos.d/azurelinux.repo.main" \ - 'https://packages.microsoft.com/azurelinux/$releasever/beta' \ - 1 0 '7d' - -# Render .repo file pointing at daily dev repos, unsigned, shorter cache. -# The .dev suffix will be removed thanks to RemovePathPostfixes. -render_repo \ - "$RPM_BUILD_ROOT/etc/yum.repos.d/azurelinux.repo.dev" \ - 'https://stcontroltowerdevjwisitg.blob.core.windows.net/azl4-dev' \ - 0 0 '6h' - -# Install the Microsoft subrepo in both subpackages. The URL is fixed to -# packages.microsoft.com (the Microsoft-curated content lives there -# regardless of which Azure Linux base repo a system is pointed at), so the -# same file is shipped to both variants. The .main / .dev suffixes are -# stripped by RemovePathPostfixes. -install -m 644 %{SOURCE3} \ - "$RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.main" -install -m 644 %{SOURCE3} \ - "$RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.dev" +install -d -m 755 "%{buildroot}%{_sysconfdir}/yum.repos.d" +install -m 644 %{SOURCE2} "%{buildroot}%{_sysconfdir}/yum.repos.d/azurelinux.repo" +install -m 644 %{SOURCE3} "%{buildroot}%{_sysconfdir}/yum.repos.d/azurelinux-preview.repo" +install -m 644 %{SOURCE4} "%{buildroot}%{_sysconfdir}/yum.repos.d/cloud-native.repo" +install -m 644 %{SOURCE5} "%{buildroot}%{_sysconfdir}/yum.repos.d/cloud-native-preview.repo" +install -m 644 %{SOURCE6} "%{buildroot}%{_sysconfdir}/yum.repos.d/microsoft.repo" +install -m 644 %{SOURCE7} "%{buildroot}%{_sysconfdir}/yum.repos.d/microsoft-preview.repo" %check -# Make sure all repo variables were substituted -for repo in $RPM_BUILD_ROOT/etc/yum.repos.d/*.repo.*; do - if grep -qE 'REPO_URI_PREFIX|GPGCHECK_VALUE|REPO_GPGCHECK_VALUE|METADATA_EXPIRE_VALUE' $repo; then - echo "ERROR: Repo $repo contains an unsubstituted placeholder value" - exit 1 - fi -done - -main_file=$RPM_BUILD_ROOT/etc/yum.repos.d/azurelinux.repo.main -dev_file=$RPM_BUILD_ROOT/etc/yum.repos.d/azurelinux.repo.dev - -# Main repo file must exist with GPG checking enabled on every section. -if [ ! -f "$main_file" ]; then - echo "ERROR: missing $main_file" - exit 1 -fi -if [ "$(grep -c '^gpgcheck=1' "$main_file")" -ne 3 ] || \ - [ "$(grep -c '^repo_gpgcheck=0' "$main_file")" -ne 3 ]; then - echo "ERROR: $main_file must correctly configure gpgcheck and repo_gpgcheck" - exit 1 -fi -if [ "$(grep -c '^metadata_expire=7d' "$main_file")" -ne 3 ]; then - echo "ERROR: $main_file must have metadata_expire=7d on all 3 sections" - exit 1 -fi - -# Dev file must exist with GPG checking disabled on every section. -if [ ! -f "$dev_file" ]; then - echo "ERROR: missing $dev_file" - exit 1 -fi -if grep -qE '^(gpgcheck|repo_gpgcheck)=1' "$dev_file"; then - echo "ERROR: $dev_file must not have gpgcheck or repo_gpgcheck enabled" - exit 1 -fi -if [ "$(grep -c '^metadata_expire=6h' "$dev_file")" -ne 3 ]; then - echo "ERROR: $dev_file must have metadata_expire=6h on all 3 sections" - exit 1 -fi - -# Both files must have exactly one enabled=1 section (the base repo) plus -# two enabled=0 sections (debuginfo, source). -for repo in "$main_file" "$dev_file"; do - if [ "$(grep -c '^enabled=1' "$repo")" -ne 1 ] || \ - [ "$(grep -c '^enabled=0' "$repo")" -ne 2 ]; then - echo "ERROR: $repo has unexpected enabled-flag distribution" - exit 1 - fi -done - -# Microsoft subrepo: shipped in both subpackages. Must exist, be enabled by -# default, GPG-signed, and point at packages.microsoft.com. -for microsoft_file in \ - $RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.main \ - $RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.dev; do - if [ ! -f "$microsoft_file" ]; then - echo "ERROR: missing $microsoft_file" - exit 1 - fi - if ! grep -q '^baseurl=https://packages.microsoft.com/azurelinux/\$releasever/beta/microsoft/\$basearch$' "$microsoft_file"; then - echo "ERROR: $microsoft_file must point at packages.microsoft.com microsoft subrepo" - exit 1 - fi - if [ "$(grep -c '^enabled=1' "$microsoft_file")" -ne 1 ] || \ - [ "$(grep -c '^gpgcheck=1' "$microsoft_file")" -ne 1 ]; then - echo "ERROR: $microsoft_file must be enabled=1 and gpgcheck=1" - exit 1 - fi -done - # Check arch keys exists on supported architectures, and RPM considers # them valid TMPRING=$(mktemp) @@ -223,31 +100,33 @@ DBPATH=$(mktemp -d) echo -n > "$TMPRING" for ARCH in $(sed -ne "s/^azurelinux-%{version}-primary://p" %{SOURCE1}); do gpg --no-default-keyring --keyring="$TMPRING" \ - --import $RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-%{version}-$ARCH + --import "%{buildroot}%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-%{version}-$ARCH" rpm --dbpath "$DBPATH" --import \ - $RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-%{version}-$ARCH --test + "%{buildroot}%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-%{version}-$ARCH" --test done # Ensure some arch key was imported gpg --no-default-keyring --keyring="$TMPRING" --list-keys | grep -A 2 '^pub\s' rm -f "$TMPRING" %files -%dir /etc/yum.repos.d -%config(noreplace) /etc/yum.repos.d/azurelinux.repo.main -%config(noreplace) /etc/yum.repos.d/microsoft.repo.main - -%files dev -%dir /etc/yum.repos.d -%config(noreplace) /etc/yum.repos.d/azurelinux.repo.dev -%config(noreplace) /etc/yum.repos.d/microsoft.repo.dev +%dir %{_sysconfdir}/yum.repos.d +%config(noreplace) %{_sysconfdir}/yum.repos.d/azurelinux.repo +%config(noreplace) %{_sysconfdir}/yum.repos.d/azurelinux-preview.repo +%config(noreplace) %{_sysconfdir}/yum.repos.d/cloud-native.repo +%config(noreplace) %{_sysconfdir}/yum.repos.d/cloud-native-preview.repo +%config(noreplace) %{_sysconfdir}/yum.repos.d/microsoft.repo +%config(noreplace) %{_sysconfdir}/yum.repos.d/microsoft-preview.repo %files -n azurelinux-gpg-keys -%dir /etc/pki/rpm-gpg -/etc/pki/rpm-gpg/RPM-GPG-KEY-* +%dir %{_sysconfdir}/pki/rpm-gpg +%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-* %changelog ## START: Generated by rpmautospec +* Thu Aug 20 2026 reuben olinsky - 4.0-21 +- feat(azurelinux-repos): configure release channels + * Wed Aug 19 2026 reuben olinsky - 4.0-20 - build: mass rebuild auto-bumpable components diff --git a/specs/a/azurelinux-repos/azurelinux.repo b/specs/a/azurelinux-repos/azurelinux.repo new file mode 100644 index 00000000000..7ee82b9f3c9 --- /dev/null +++ b/specs/a/azurelinux-repos/azurelinux.repo @@ -0,0 +1,33 @@ +[azurelinux-base] +name=Azure Linux $releasever - $basearch - Production - Base +baseurl=https://packages.microsoft.com/azurelinux/4/prod/base/$basearch +enabled=1 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=False + +[azurelinux-base-source] +name=Azure Linux $releasever - Production - Base - Source +baseurl=https://packages.microsoft.com/azurelinux/4/prod/base/srpms +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-base-debuginfo] +name=Azure Linux $releasever - $basearch - Production - Base - Debug +baseurl=https://packages.microsoft.com/azurelinux/4/prod/base/debuginfo/$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True diff --git a/specs/a/azurelinux-repos/azurelinux.repo.in b/specs/a/azurelinux-repos/azurelinux.repo.in deleted file mode 100644 index b347e73fab7..00000000000 --- a/specs/a/azurelinux-repos/azurelinux.repo.in +++ /dev/null @@ -1,33 +0,0 @@ -[azurelinux-base] -name=Azure Linux $releasever - $basearch - Base -baseurl=REPO_URI_PREFIX/base/$basearch -enabled=1 -countme=1 -metadata_expire=METADATA_EXPIRE_VALUE -repo_gpgcheck=REPO_GPGCHECK_VALUE -type=rpm -gpgcheck=GPGCHECK_VALUE -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch -skip_if_unavailable=False - -[azurelinux-base-debuginfo] -name=Azure Linux $releasever - $basearch - Base - Debug -baseurl=REPO_URI_PREFIX/base/debuginfo/$basearch -enabled=0 -metadata_expire=METADATA_EXPIRE_VALUE -repo_gpgcheck=REPO_GPGCHECK_VALUE -type=rpm -gpgcheck=GPGCHECK_VALUE -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch -skip_if_unavailable=True - -[azurelinux-base-source] -name=Azure Linux $releasever - Base - Source -baseurl=REPO_URI_PREFIX/base/srpms -enabled=0 -metadata_expire=METADATA_EXPIRE_VALUE -repo_gpgcheck=REPO_GPGCHECK_VALUE -type=rpm -gpgcheck=GPGCHECK_VALUE -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch -skip_if_unavailable=True diff --git a/specs/a/azurelinux-repos/cloud-native-preview.repo b/specs/a/azurelinux-repos/cloud-native-preview.repo new file mode 100644 index 00000000000..f241a784a97 --- /dev/null +++ b/specs/a/azurelinux-repos/cloud-native-preview.repo @@ -0,0 +1,33 @@ +[azurelinux-preview-cloud-native] +name=Azure Linux $releasever - $basearch - Preview - Cloud Native +baseurl=https://packages.microsoft.com/azurelinux/4/preview/cloud-native/$basearch +enabled=1 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-preview-cloud-native-source] +name=Azure Linux $releasever - Preview - Cloud Native - Source +baseurl=https://packages.microsoft.com/azurelinux/4/preview/cloud-native/srpms +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-preview-cloud-native-debuginfo] +name=Azure Linux $releasever - $basearch - Preview - Cloud Native - Debug +baseurl=https://packages.microsoft.com/azurelinux/4/preview/cloud-native/debuginfo/$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True diff --git a/specs/a/azurelinux-repos/cloud-native.repo b/specs/a/azurelinux-repos/cloud-native.repo new file mode 100644 index 00000000000..51c2eb89b98 --- /dev/null +++ b/specs/a/azurelinux-repos/cloud-native.repo @@ -0,0 +1,33 @@ +[azurelinux-cloud-native] +name=Azure Linux $releasever - $basearch - Production - Cloud Native +baseurl=https://packages.microsoft.com/azurelinux/4/prod/cloud-native/$basearch +enabled=1 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-cloud-native-source] +name=Azure Linux $releasever - Production - Cloud Native - Source +baseurl=https://packages.microsoft.com/azurelinux/4/prod/cloud-native/srpms +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-cloud-native-debuginfo] +name=Azure Linux $releasever - $basearch - Production - Cloud Native - Debug +baseurl=https://packages.microsoft.com/azurelinux/4/prod/cloud-native/debuginfo/$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True diff --git a/specs/a/azurelinux-repos/microsoft-preview.repo b/specs/a/azurelinux-repos/microsoft-preview.repo new file mode 100644 index 00000000000..2ffcc6675c7 --- /dev/null +++ b/specs/a/azurelinux-repos/microsoft-preview.repo @@ -0,0 +1,33 @@ +[azurelinux-preview-microsoft] +name=Azure Linux $releasever - $basearch - Preview - Microsoft +baseurl=https://packages.microsoft.com/azurelinux/4/preview/microsoft/$basearch +enabled=1 +countme=1 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-preview-microsoft-source] +name=Azure Linux $releasever - Preview - Microsoft - Source +baseurl=https://packages.microsoft.com/azurelinux/4/preview/microsoft/srpms +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-preview-microsoft-debuginfo] +name=Azure Linux $releasever - $basearch - Preview - Microsoft - Debug +baseurl=https://packages.microsoft.com/azurelinux/4/preview/microsoft/debuginfo/$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True diff --git a/specs/a/azurelinux-repos/microsoft.repo b/specs/a/azurelinux-repos/microsoft.repo index 98cdb447b54..0df087484a4 100644 --- a/specs/a/azurelinux-repos/microsoft.repo +++ b/specs/a/azurelinux-repos/microsoft.repo @@ -1,11 +1,33 @@ [azurelinux-microsoft] -name=Azure Linux $releasever - $basearch - Microsoft -baseurl=https://packages.microsoft.com/azurelinux/$releasever/beta/microsoft/$basearch +name=Azure Linux $releasever - $basearch - Production - Microsoft +baseurl=https://packages.microsoft.com/azurelinux/4/prod/microsoft/$basearch enabled=1 countme=1 -metadata_expire=7d +metadata_expire=6h repo_gpgcheck=0 type=rpm gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch -skip_if_unavailable=False +skip_if_unavailable=True + +[azurelinux-microsoft-source] +name=Azure Linux $releasever - Production - Microsoft - Source +baseurl=https://packages.microsoft.com/azurelinux/4/prod/microsoft/srpms +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True + +[azurelinux-microsoft-debuginfo] +name=Azure Linux $releasever - $basearch - Production - Microsoft - Debug +baseurl=https://packages.microsoft.com/azurelinux/4/prod/microsoft/debuginfo/$basearch +enabled=0 +metadata_expire=6h +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch +skip_if_unavailable=True