common.yaml

# We inherit from Fedora CoreOS' base configuration
include:
  - fedora-coreos-config/manifests/kernel.yaml
  - fedora-coreos-config/manifests/system-configuration.yaml
  - fedora-coreos-config/manifests/ignition-and-ostree.yaml
  - fedora-coreos-config/manifests/file-transfer.yaml
  - fedora-coreos-config/manifests/networking-tools.yaml
  - fedora-coreos-config/manifests/user-experience.yaml
  - fedora-coreos-config/manifests/shared-workarounds.yaml
  # RHCOS owned packages
  - packages-rhcos.yaml

# Layers common to all versions of RHCOS and SCOS
ostree-layers:
  - overlay/01fcos
  - overlay/02fcos-nouveau
  - overlay/05rhcos
  - overlay/06gcp-routes
  - overlay/15rhcos-networkmanager-dispatcher
  - overlay/15rhcos-tuned-bits
  - overlay/15rhcos-journald-backcompat
  - overlay/20platform-chrony
  - overlay/21dhcp-chrony
  - overlay/25azure-udev-rules
  - overlay/30rhcos-nvme-compat-udev
  - overlay/30gcp-udev-rules
  - overlay/30lvmdevices
  - overlay/40grub

conditional-include:
  - if: basearch != "s390x"
    # And remove some cruft from grub2
    include: fedora-coreos-config/manifests/grub2-removals.yaml
    #zram default config is in a subpackage in c10s
    # Meanwhile, remove the default config from the package
  - if: osversion == "c9s"
    include: zram-no-defaults.yaml
  - if: osversion == "rhel-9.4"
    include: zram-no-defaults.yaml
  - if: osversion == "rhel-9.6"
    include: zram-no-defaults.yaml
  # Packages specific to el9
  - if: osversion == "c9s"
    include: fedora-coreos-config/manifests/shared-el9.yaml
  - if: osversion == "rhel-9.4"
    include: fedora-coreos-config/manifests/shared-el9.yaml
  - if: osversion == "rhel-9.6"
    include: fedora-coreos-config/manifests/shared-el9.yaml
  - if: inherit_tier_x == true
    include: fedora-coreos-config/manifests/tier-x.yaml
  - if: inherit_tier_x == false
    include: fedora-coreos-config/manifests/tier-x-dupes.yaml

documentation: false

# historical default
recommends: true

postprocess:
  - |
    #!/usr/bin/bash
    set -xeuo pipefail
    # Disable composefs for now on el9 due to ppc64le/kernel-64k bugs:
    # https://issues.redhat.com/browse/RHEL-63985
    if [ -f /usr/lib/ostree/prepare-root.conf ] && [[ $(rpm -q kernel) = *.el9.* ]]; then
      grep -q 'enabled = true' /usr/lib/ostree/prepare-root.conf
      sed -i -e 's,enabled = true,enabled = no,' /usr/lib/ostree/prepare-root.conf
    fi

  # Mark the OS as of the CoreOS variant.
  # XXX: should be part of a centos/redhat-release subpackage instead
  - |
     #!/usr/bin/bash
     set -euo pipefail
     cat >> /usr/lib/os-release <<EOF
     VARIANT=CoreOS
     VARIANT_ID=coreos
     EOF

     # And put "CoreOS" in NAME and PRETTY_NAME
     sed -i -e 's/^NAME="\(.*\)"/NAME="\1 CoreOS"/' /usr/lib/os-release
     . /usr/lib/os-release
     sed -i -e "s/^PRETTY_NAME=.*/PRETTY_NAME=\"$NAME $VERSION\"/" /usr/lib/os-release

  # TEMPORARY: Create /etc/vmware-tools/tools.conf to ensure RHCOS shows up properly in VMWare
  # See https://jira.coreos.com/browse/RHCOS-258
  - |
    #!/usr/bin/env bash
    set -xeo pipefail
    if [ "$(uname -m)" == "x86_64" ]; then
      cat > /etc/vmware-tools/tools.conf <<'EOF'
    [guestosinfo]
    short-name = rhel8-64
    EOF
    fi

 # TEMPORARY: Remove /usr/etc/zkey/ group write permissions
 # See https://github.com/openshift/os/issues/1209
  - |
    #!/usr/bin/env bash
    set -xeo pipefail
    if [ "$(uname -m)" == "s390x" ]; then
      chmod -R g-w /usr/etc/zkey
    fi

  # Nuke network.service from orbit
  # https://github.com/openshift/os/issues/117
  - |
    #!/usr/bin/env bash
    set -xeo pipefail
    rm -rf /etc/rc.d/init.d/network /etc/rc.d/rc*.d/*network

    # We're not using resolved yet
    rm -f /usr/lib/systemd/system/systemd-resolved.service

  # This updates the PAM configuration to reference all of the SSSD modules.
  # Removes the `authselect` binary afterwards since `authselect` does not play well with `nss-altfiles`
  # (https://github.com/pbrezina/authselect/issues/48).
  # https://bugzilla.redhat.com/show_bug.cgi?id=1774154
  # NOTE: This is a temporary hack which should be updated after switching to systemd-sysusers
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    # use `authselect test` since `authselect select` wants to copy to `/var` too
    authselect test sssd --nsswitch | tail -n +2 > /etc/nsswitch.conf
    for pam_file in system-auth password-auth smartcard-auth fingerprint-auth postlogin; do
      authselect test sssd --${pam_file} | tail -n +2 > /etc/pam.d/${pam_file}
    done
    rm -f $(which authselect)

  # Make sure that we do not ship broken symlinks:
  # https://github.com/openshift/os/issues/1003
  # Remove known broken symlinks that point to non-existing files or directories
  - |
    #!/usr/bin/env bash
    set -euo pipefail

    list_broken_symlinks_folders=(
      '/etc/alternatives/'
      '/usr/lib/.build-id/'
    )

    # It is not possible to remove files from usr after first boot so that is
    # why we are removing them in the postprocess scripts here.

    list_known_removed_folders=(
      '/usr/bin/systemd-firstboot'
      '/usr/lib/systemd/system-generators/systemd-gpt-auto-generator'
      '/usr/share/doc/'
      '/usr/share/info/'
      '/usr/share/man/'
      )
    for folder in "${list_broken_symlinks_folders[@]}"; do
        find "${folder}" -type l | while read -r file_name; do
            real_path=$(realpath -m "${file_name}");
            if [[ -e "${real_path}" ]]; then
              continue
            fi
            for element in "${list_known_removed_folders[@]}"; do
              if [[ "${real_path}" == "${element}"* ]]; then
                  rm -r "${file_name}"
              fi
            done
        done
    done
  - |
    #!/usr/bin/env bash
    set -xeo pipefail

    # FIXME: Why is this only broken here?  NM isn't removing the link?
    sed -i '/etc.resolv/d' /usr/lib/tmpfiles.d/etc.conf

  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    # Enable tmp-on-tmpfs by default because we don't want to have things leak
    # across reboots, it increases alignment with FCOS, and also fixes the
    # Live ISO. First, verify that RHEL is still disabling.
    grep -q '# RHEL-only: Disable /tmp on tmpfs' /usr/lib/systemd/system/basic.target
    echo '# RHCOS-only: we follow the Fedora/upstream default' >> /usr/lib/systemd/system/basic.target
    echo 'Wants=tmp.mount' >> /usr/lib/systemd/system/basic.target

  - |
    #!/usr/bin/env bash
    set -xeo pipefail
    # See https://issues.redhat.com/browse/LOG-3117
    # Something changed between rhel8 and rhel9 to not generate this by default
    # but we have containers that expect it to be mounted so for now let's continue
    # generating it.
    ln -sr /usr/share/zoneinfo/UTC /etc/localtime

remove-files:
  # We don't ship man(1) or info(1)
  - usr/share/info
  - usr/share/man
  # Drop text docs too
  - usr/share/doc

etc-group-members:
  - wheel
  - sudo
  - systemd-journal
  - adm
ignore-removed-users:
  - root
ignore-removed-groups:
  - root
check-passwd:
  type: "file"
  filename: "passwd"
check-groups:
  type: "file"
  filename: "group"

exclude-packages:
  # https://github.com/coreos/rpm-ostree/pull/1789/files/a0cd999a8acd5b40ec1024a794a642916fbc8ff8#diff-fc2076dc46933204a7a798f544ce3734
  # People need to use `rpm-ostree kargs` instead.
  - grubby
  # udisks2 is a fwupd recommends only need for encrypted swap checks
  - udisks2
  # dhcp-client is recommended by chrony for handling NTP servers given out via
  # DHCP, but we have a NM dispatcher script that is doing that
  # See: https://bugzilla.redhat.com/show_bug.cgi?id=1930468
  # See: https://bugzilla.redhat.com/show_bug.cgi?id=1800901
  - dhcp-client

# Try to maintain this list ordering by "in RHEL, then not in RHEL".
# To verify, disable all repos except the ootpa ones and then comment
# out the bottom and run `coreos-assembler build`.
# A lof of packages are inherited by the manifests included at the top.
packages:
 # Contains SCTP (https://bugzilla.redhat.com/show_bug.cgi?id=1718049)
 # and it's not really going to be worth playing the "where's my kernel module"
 # game long term.  If we ship it we support it, etc.
 - kernel-modules-extra
 # Audit
 - audit
 # Bootloader updater
 - bootupd
 # Containers
 - containernetworking-plugins
 - container-selinux
 # Needed for newer rpm-ostree
 - "'skopeo >= 2:1.7.0'"
 # Networking
 - nfs-utils
 - dnsmasq
 # needed for rpm-ostree today
 - polkit
 # Extra runtime
 - sssd
 # Common tools used by scripts and admins interactively
 - rsync tmux
 - nmap-ncat strace
 # Future update manager on the client-side
 - bootc
 # Editors
 - nano
 # Red Hat CA certs
 - subscription-manager-rhsm-certificates
 # Used on the bootstrap node
 - systemd-journal-remote
 # Extras
 - systemd-journal-gateway
 # Used to update PAM configuration to work with SSSD
 # https://bugzilla.redhat.com/show_bug.cgi?id=1774154
 - authselect
 # https://bugzilla.redhat.com/show_bug.cgi?id=1900759
 - qemu-guest-agent
 # passwd was obsoleted by shadow-utils in F40+, but still needed here
 - passwd
 # Gluster - Used for Openshift e2e gluster testcases
 # Reverts https://gitlab.cee.redhat.com/coreos/redhat-coreos/merge_requests/367 and add it for all arches
 - glusterfs-fuse
 # Needed for kernel-devel extension: https://bugzilla.redhat.com/show_bug.cgi?id=1885408
 # x86_64 and s390x have these packages installed as dependencies of other packages, ppc64le does not
 # FIXME: once the below BZs have been resolved to remove perl dependencies, this can be done in the extensions script
 # https://bugzilla.redhat.com/show_bug.cgi?id=1877905
 # https://bugzilla.redhat.com/show_bug.cgi?id=1886201
 - perl-interpreter
 # https://github.com/coreos/fedora-coreos-tracker/issues/404
 # https://bugzilla.redhat.com/show_bug.cgi?id=1925698
 # https://github.com/openshift/machine-config-operator/pull/2421
 - conntrack-tools
 # Upstream PR https://github.com/coreos/fedora-coreos-config/pull/786
 - WALinuxAgent-udev
 # Provide fips-mode-setup which is needed by rhcos-fips.sh
 - crypto-policies-scripts
 # For semanage
 - policycoreutils-python-utils
 # https://github.com/coreos/fedora-coreos-tracker/issues/1687
 - dnf
 # https://issues.redhat.com/browse/OCPBUGS-35247
 - subscription-manager

packages-x86_64:
  # Temporary add of open-vm-tools. Should be removed when containerized
  - open-vm-tools
  - irqbalance
  # Until we sort out 4.2 -> 4.3 upgrades, we need to carry this.
  # See also https://github.com/ostreedev/ostree/pull/1929
  - ostree-grub2
  # rdma-core cleanly covers some key bare metal use cases
  - rdma-core

packages-ppc64le:
  - irqbalance
  - librtas
  - powerpc-utils-core
  - ppc64-diag-rtas
  - rdma-core

packages-aarch64:
  - irqbalance

packages-s390x:
  # Required for IBM Secure Execution. Now is part of s390utils-base.rpm
  # https://github.com/coreos/fedora-coreos-tracker/issues/1217
  - /usr/bin/genprotimg

remove-from-packages:
  - - filesystem
    - "/usr/share/backgrounds"
  # https://bugzilla.redhat.com/show_bug.cgi?id=1762509
  # https://bugzilla.redhat.com/show_bug.cgi?id=1727058
  - - initscripts
    - "/"
  # Remove the systemd unit; we only want the binary to be used
  # by MCD or kubelet.  See above.
  - - conntrack-tools
    - /usr/lib/systemd/system