jlebon
commented
2 years ago Enable read only /sysroot for Fedora Silverblue & Kinoite
- This change is about enabling an opt-in ostree feature that re-mounts /sysroot as read only to avoid accidental changes.
- Tracking bug: #2060976
A similar issue exists in FCOS BTW: the first official FCOS stable release was January 11, 2020. It did not ship with read-only sysroot. That came in May/June 2020. So we have potentially really old FCOS stable nodes provisioned in those first 5-6 months (and of course testing too, which started even earlier) which today still don't have read-only sysroot.
It'd be nice to have some stats to know how many such nodes exist, but it likely isn't worth the effort/risk to try migrating them. Maybe instead we can add a CLHM dropin which suggests reprovisioning if read-only sysroot isn't active?
dustymabe
lucab
cgwalters
Output generated by and stored alongside (with modifications) this script in a fork of the pgm_scripts repo.
Fedora 37 Accepted System-Wide Changes (wiki source)
✔️ DNS Over TLSFedora will attempt to use DNS over TLS (DoT) if supported by configured DNS servers.Tracking bug: #1889901NOTES: JL: no special considerations necessary for FCOS, but be on the lookout for DNS-related falloutF35 changes issue: https://github.com/coreos/fedora-coreos-tracker/issues/873✔️ DNF/RPM Copy on Write enablement for all variantsRPM Copy on Write provides a better experience for Fedora Users as it reduces the amount of I/O and offsets CPU cost of package decompression. RPM Copy on Write uses reflinking capabilities in btrfs, which is the default filesystem starting from Fedora 33 for most variants. Note that this behavior is not being turned on by default for this Change.Tracking bug: #1915976NOTES: JL: this path of librpm is not used by rpm-ostree. the whole download and unpack path is ostree native and has different tradeoffs. good to keep track of this conceptually, but nothing for FCOS to do here.Drop NIS(+) support from PAMThis change is about dropping user-authentication using NIS(+) from PAM.Tracking bug: #2021660NOTES: JL: may affect users who use NIS+? likely not though. If so, we should direct them to e.g. LDAP or FreeIPA as the Change proposal suggests. so overall, skip.This change is about retiring the ypbind, yp-tools, and ypserv packages, and removal of the {nis,yp}domainname user-space utility programs from the hostname package.Tracking bug: #2022386NOTES: JL: may affect users who use NIS+? likely not though. If so, we should direct them to e.g. LDAP or FreeIPA as the Change proposal suggests. so overall, skip.Changes/LegacyXorgDriverRemovalThis change removes the xorg-x11-drv-vesa and xorg-x11-drv-fbdev driver packages, and associated support code from the xorg-x11-server-Xorg package.Tracking bug: #2078921NOTES: DM: FCOS doesn't ship a graphical desktop. This shouldn't affect us.Build all JDKs in Fedora against in-tree libraries and with static stdc++libThis is initial step to move JDKs to be more like other JDKs, to build proper transferable images, and to lower certification burden of each binary. Long storyshort, first step in: https://fedoraproject.org/wiki/MoveFedoraJDKsToBecomePortableJDKsTracking bug: #2097516NOTES: DM: We don't ship java✔️ RPM Macros for Build FlagsCreate a corresponding macro for each compiler flag in the redhat-rpm-config macro file and create "extra flag" macros to make it easier for packages to add and remove compiler flags.Tracking bug: #2100610NOTES: DM: We may want to update our packages, but no need to update anything now.✔️ MAC Address Policy noneThe systemd-udev package installs "/usr/lib/systemd/network/99-default.link", which sets Link.MACAddressPolicy=persistent for all software NIC devices. This proposal is to add to the policy so that we use Link.MACAddressPolicy=none for bond/bridge/team devices.Tracking bug: #2107754NOTES: DM: This is our change proposal. See https://github.com/coreos/fedora-coreos-tracker/issues/919Fedora 37 Accepted Self-Contained Changes (wiki source)
✔️ glibc 32 Build AdjustmentsThe glibc32 package is a special package used by gcc and a few other packages to work around the lack of RPM multilib repository support in Koji. It is difficult to maintain, and the current approach raises questions regarding (L)GPL compliance.Tracking bug: #1598524NOTES: JL: none of our components use glibc32 AFAIK, so should be good to skip.✔️ Modular GNOME Keyring servicesThe monolithic daemon provided by GNOME Keyring will be split into dedicated sub-daemons, so that they can be consistently managed by systemd.Tracking bug: #1899998NOTES: *LB**: we don't ship these GNOME services in FCOS✔️ Wayland by Default for SDDMChange the default display server mode for SDDM to use a Wayland-based greeter rather than an X11-based one.Tracking bug: #2050378NOTES: LB: we don't shipsddmin FCOSHaskell GHC 9.0 & Stackage LTS 19The GHC Haskell compiler will be updated from major version 8.10 to 9.0, and Haskell packages will be updated from Stackage LTS 18 to LTS 19 versions.Tracking bug: #2080355NOTES: LB: we don't ship GHC in FCOS