Repository: ublue-os/ucore
Pull request #253: refactor: update to dnf5, use ublue packages
Author: login: bsherman
Labels: name: enhancement
description: New feature or request
name: size:L
description: This PR changes 100-499 lines, ignoring generated files.
name: lgtm
description: This PR has been approved by a maintainer
Created: 2025-05-05T19:17:02Z | Merged: 2025-05-07T03:57:21Z

This PR modernizes the uCore builds a bit, catching up with some of what the rest of Universal Blue has done with the use of dnf5 and ublue-os COPR packages.

Changes:
- fix workaround for F42 CoreOS stable on kernel 6.14.0
- no longer use cliwrap
- use dnf(5) instead of rpm-ostree
- install ublue-os-signing from ublue-os COPR rather than legacy `config` OCI
- install ublue-os-libvirt-workarounds from ublue-OS COPR rather than direct COPY of files (this somehow broke `semodule install`)
- use more specific paths for COPY of system_files (copying / somehow broke `semodule install`)
- no longer attempt to enable module repos as they no longer exist
- consolidate and simplify cleanup steps in the cleanup.sh script



Diff:
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index 4ebacbe9..9e477923 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -59,8 +59,8 @@ jobs:
                 exit 1
             fi
 
-            if [ "42.20250410.3.1" == "${image}" ]; then
-                echo "WARNING: Overriding known problematic release. Downgrading from 42.20250410.3.1 to 41.20250331.3.0"
+            if [[ "${image}" =~ "42.20250410.3" ]]; then
+                echo "WARNING: Overriding known problematic release. Downgrading from 42.20250410.3.* to 41.20250331.3.0"
                 image="41.20250331.3.0"
             fi
 
diff --git a/fedora-coreos/Containerfile b/fedora-coreos/Containerfile
index a47620d2..3bdb616b 100644
--- a/fedora-coreos/Containerfile
+++ b/fedora-coreos/Containerfile
@@ -8,11 +8,9 @@ ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-coreos-stable}"
 ARG AKMODS_COMMON="${IMAGE_REGISTRY}/akmods:${KERNEL_FLAVOR}-${FEDORA_VERSION}"
 ARG AKMODS_NVIDIA="${IMAGE_REGISTRY}/akmods-nvidia:${KERNEL_FLAVOR}-${FEDORA_VERSION}"
 ARG AKMODS_ZFS="${IMAGE_REGISTRY}/akmods-zfs:${KERNEL_FLAVOR}-${FEDORA_VERSION}"
-ARG CONFIG="${IMAGE_REGISTRY}/config:latest"
 FROM ${AKMODS_COMMON} AS akmods-common
 FROM ${AKMODS_NVIDIA} AS akmods-nvidia
 FROM ${AKMODS_ZFS} AS akmods-zfs
-FROM ${CONFIG} AS config
 
 FROM scratch AS ctx
 COPY / /
@@ -31,14 +29,7 @@ RUN --mount=type=cache,dst=/var/cache/rpm-ostree \
     --mount=type=bind,from=akmods-common,src=/rpms/ucore,dst=/tmp/rpms/akmods-common \
     --mount=type=bind,from=akmods-nvidia,src=/rpms,dst=/tmp/rpms/akmods-nvidia \
     --mount=type=bind,from=akmods-zfs,src=/rpms,dst=/tmp/rpms/akmods-zfs \
-    --mount=type=bind,from=config,src=/rpms,dst=/tmp/rpms/config \
     --mount=type=bind,from=akmods-common,src=/kernel-rpms,dst=/tmp/rpms/kernel \
-    mkdir -p /var/lib/alternatives \
-    && /ctx/install.sh \
+    /ctx/install.sh \
     && /ctx/post-install.sh \
-    && mv /var/lib/alternatives /staged-alternatives \
-    && /ctx/cleanup.sh \
-    && ostree container commit \
-    && mkdir -p /var/lib && mv /staged-alternatives /var/lib/alternatives \
-    && mkdir -p /var/tmp \
-    && chmod -R 1777 /var/tmp
\ No newline at end of file
+    && /ctx/cleanup.sh
\ No newline at end of file
diff --git a/fedora-coreos/cleanup.sh b/fedora-coreos/cleanup.sh
index e9549a3e..1552eb56 100755
--- a/fedora-coreos/cleanup.sh
+++ b/fedora-coreos/cleanup.sh
@@ -1,8 +1,12 @@
 #!/usr/bin/bash
 
 set -eoux pipefail
-shopt -s extglob
 
 rm -rf /tmp/* || true
-rm -rf /var/!(cache)
-rm -rf /var/cache/!(rpm-ostree)
\ No newline at end of file
+find /var/* -maxdepth 0 -type d -exec rm -fr {} \;
+
+# this currently fails on /usr/etc
+#bootc container lint
+ostree container commit
+mkdir -p /var/tmp \
+&& chmod -R 1777 /var/tmp
\ No newline at end of file
diff --git a/fedora-coreos/install.sh b/fedora-coreos/install.sh
index 78b8dbc2..65d7a408 100755
--- a/fedora-coreos/install.sh
+++ b/fedora-coreos/install.sh
@@ -12,7 +12,7 @@ QUALIFIED_KERNEL="$(rpm -qa | grep -P 'kernel-(\d+\.\d+\.\d+)' | sed -E 's/kerne
 #### PREPARE
 # enable testing repos if not enabled on testing stream
 if [[ "testing" == "${COREOS_VERSION}" ]]; then
-for REPO in $(ls /etc/yum.repos.d/fedora-updates-testing{,-modular}.repo); do
+for REPO in $(ls /etc/yum.repos.d/fedora-updates-testing.repo); do
   if [[ "$(grep enabled=1 ${REPO} > /dev/null; echo $?)" == "1" ]]; then
     echo "enabling $REPO" &&
     sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' ${REPO}
@@ -20,6 +20,10 @@ for REPO in $(ls /etc/yum.repos.d/fedora-updates-testing{,-modular}.repo); do
 done
 fi
 
+# enable ublue-os repos
+dnf -y install dnf5-plugins
+dnf -y copr enable ublue-os/packages
+
 # always disable cisco-open264 repo
 sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo
 
@@ -27,12 +31,10 @@ sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo
 # inspect to see what RPMS we copied in
 find /tmp/rpms/
 
-rpm-ostree install \
-    /tmp/rpms/akmods-common/ublue-os-ucore-addons*.rpm \
-    /tmp/rpms/config/ublue-os-signing*.rpm
+dnf -y install /tmp/rpms/akmods-common/ublue-os-ucore-addons*.rpm
+dnf -y install ublue-os-signing
 
 # Handle Kernel Skew with override replace
-rpm-ostree cliwrap install-to-root /
 if [[ "${KERNEL_VERSION}" == "${QUALIFIED_KERNEL}" ]]; then
     echo "Installing signed kernel from kernel-cache."
     cd /tmp
@@ -40,10 +42,12 @@ if [[ "${KERNEL_VERSION}" == "${QUALIFIED_KERNEL}" ]]; then
     cp ./lib/modules/*/vmlinuz /usr/lib/modules/*/vmlinuz
     cd /
 else
+    # Remove Existing Kernel
+    for pkg in kernel kernel-core kernel-modules kernel-modules-core kernel-modules-extra; do
+        rpm --erase $pkg --nodeps
+    done
     echo "Install kernel version ${KERNEL_VERSION} from kernel-cache."
-    rpm-ostree override replace \
-        --experimental \
-        --install=zstd \
+    dnf -y install \
         /tmp/rpms/kernel/kernel-[0-9]*.rpm \
         /tmp/rpms/kernel/kernel-core-*.rpm \
         /tmp/rpms/kernel/kernel-modules-*.rpm
@@ -51,7 +55,7 @@ fi
 
 ## CONDITIONAL: install ZFS
 if [[ "-zfs" == "${ZFS_TAG}" ]]; then
-    rpm-ostree install pv /tmp/rpms/akmods-zfs/kmods/zfs/*.rpm /tmp/rpms/akmods-zfs/kmods/zfs/other/zfs-dracut-*.rpm
+    dnf -y install pv /tmp/rpms/akmods-zfs/kmods/zfs/*.rpm /tmp/rpms/akmods-zfs/kmods/zfs/other/zfs-dracut-*.rpm
     # for some reason depmod ran automatically with zfs 2.1 but not with 2.2
     depmod -a -v ${KERNEL_VERSION}
 fi
@@ -61,10 +65,10 @@ if [[ "-nvidia" == "${NVIDIA_TAG}" ]]; then
     # repo for nvidia rpms
     curl -L https://negativo17.org/repos/fedora-nvidia.repo -o /etc/yum.repos.d/fedora-nvidia.repo
 
-    rpm-ostree install /tmp/rpms/akmods-nvidia/ucore/ublue-os-ucore-nvidia*.rpm
+    dnf -y install /tmp/rpms/akmods-nvidia/ucore/ublue-os-ucore-nvidia*.rpm
     sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/nvidia-container-toolkit.repo
 
-    rpm-ostree install \
+    dnf -y install \
         /tmp/rpms/akmods-nvidia/kmods/kmod-nvidia*.rpm \
         nvidia-driver-cuda \
         nvidia-container-toolkit
diff --git a/ucore/Containerfile b/ucore/Containerfile
index ecae5ef7..66be02cf 100644
--- a/ucore/Containerfile
+++ b/ucore/Containerfile
@@ -8,11 +8,9 @@ ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-coreos-stable}"
 ARG AKMODS_COMMON="${IMAGE_REGISTRY}/akmods:${KERNEL_FLAVOR}-${FEDORA_VERSION}"
 ARG AKMODS_NVIDIA="${IMAGE_REGISTRY}/akmods-nvidia:${KERNEL_FLAVOR}-${FEDORA_VERSION}"
 ARG AKMODS_ZFS="${IMAGE_REGISTRY}/akmods-zfs:${KERNEL_FLAVOR}-${FEDORA_VERSION}"
-ARG CONFIG="${IMAGE_REGISTRY}/config:latest"
 FROM ${AKMODS_COMMON} AS akmods-common
 FROM ${AKMODS_NVIDIA} AS akmods-nvidia
 FROM ${AKMODS_ZFS} AS akmods-zfs
-FROM ${CONFIG} AS config
 
 FROM scratch AS ctx
 COPY / /
@@ -31,26 +29,22 @@ ARG DOCKER_BUILDX_VERSION=0.12.1
 # 2.24.7 matches docker/moby 24.0.5  which FCOS ships as of 40.20240421
 ARG DOCKER_COMPOSE_VERSION=v2.24.7
 
-COPY system_files /
+COPY system_files/etc /
+COPY system_files/usr/lib /usr/lib/
+COPY system_files/usr/sbin /usr/sbin/
 COPY --from=docker.io/docker/buildx-bin:${DOCKER_BUILDX_VERSION} /buildx /usr/libexec/docker/cli-plugins/docker-buildx
 COPY --from=docker.io/docker/compose-bin:${DOCKER_COMPOSE_VERSION} /docker-compose /usr/libexec/docker/cli-plugins/docker-compose
 
-RUN --mount=type=cache,dst=/var/cache/rpm-ostree \
+RUN --mount=type=cache,dst=/var/cache/libdnf5 \
+    --mount=type=cache,dst=/var/cache/rpm-ostree \
     --mount=type=bind,from=ctx,src=/,dst=/ctx \
     --mount=type=bind,from=akmods-common,src=/rpms/ucore,dst=/tmp/rpms/akmods-common \
     --mount=type=bind,from=akmods-nvidia,src=/rpms,dst=/tmp/rpms/akmods-nvidia \
     --mount=type=bind,from=akmods-zfs,src=/rpms,dst=/tmp/rpms/akmods-zfs \
-    --mount=type=bind,from=config,src=/rpms,dst=/tmp/rpms/config \
     --mount=type=bind,from=akmods-common,src=/kernel-rpms,dst=/tmp/rpms/kernel \
-    mkdir -p /var/lib/alternatives \
-    && /ctx/install-ucore-minimal.sh \
+    /ctx/install-ucore-minimal.sh \
     && /ctx/post-install-ucore-minimal.sh \
-    && mv /var/lib/alternatives /staged-alternatives \
-    && /ctx/cleanup.sh \
-    && ostree container commit \
-    && mkdir -p /var/lib && mv /staged-alternatives /var/lib/alternatives \
-    && mkdir -p /var/tmp \
-    && chmod -R 1777 /var/tmp
+    && /ctx/cleanup.sh
 
 # ucore image section
 FROM ucore-minimal AS ucore
@@ -59,17 +53,11 @@ ARG COREOS_VERSION="${COREOS_VERSION:-stable}"
 ARG NVIDIA_TAG="${NVIDIA_TAG}"
 ARG ZFS_TAG="${ZFS_TAG}"
 
-RUN --mount=type=cache,dst=/var/cache/rpm-ostree \
+RUN --mount=type=cache,dst=/var/cache/libdnf5 \
+    --mount=type=cache,dst=/var/cache/rpm-ostree \
     --mount=type=bind,from=ctx,src=/,dst=/ctx \
-    mkdir -p /var/lib/alternatives \
-    && /ctx/install-ucore.sh \
-    && mv /var/lib/alternatives /staged-alternatives \
-    && /ctx/cleanup.sh \
-    && ostree container commit \
-    && mkdir -p /var/lib && mv /staged-alternatives /var/lib/alternatives \
-    && mkdir -p /var/tmp \
-    && chmod -R 1777 /var/tmp
-
+    /ctx/install-ucore.sh \
+    && /ctx/cleanup.sh
 
 # ucore-hci image section
 FROM ucore AS ucore-hci
@@ -78,13 +66,8 @@ ARG COREOS_VERSION="${COREOS_VERSION:-stable}"
 ARG NVIDIA_TAG="${NVIDIA_TAG}"
 ARG ZFS_TAG="${ZFS_TAG}"
 
-RUN --mount=type=cache,dst=/var/cache/rpm-ostree \
+RUN --mount=type=cache,dst=/var/cache/libdnf5 \
+    --mount=type=cache,dst=/var/cache/rpm-ostree \
     --mount=type=bind,from=ctx,src=/,dst=/ctx \
-    mkdir -p /var/lib/alternatives \
-    && /ctx/install-ucore-hci.sh \
-    && mv /var/lib/alternatives /staged-alternatives \
-    && /ctx/cleanup.sh \
-    && ostree container commit \
-    && mkdir -p /var/lib && mv /staged-alternatives /var/lib/alternatives \
-    && mkdir -p /var/tmp \
-    && chmod -R 1777 /var/tmp
\ No newline at end of file
+    /ctx/install-ucore-hci.sh \
+    && /ctx/cleanup.sh
\ No newline at end of file
diff --git a/ucore/cleanup.sh b/ucore/cleanup.sh
index e9549a3e..296d7853 100755
--- a/ucore/cleanup.sh
+++ b/ucore/cleanup.sh
@@ -1,8 +1,13 @@
 #!/usr/bin/bash
 
 set -eoux pipefail
-shopt -s extglob
 
 rm -rf /tmp/* || true
-rm -rf /var/!(cache)
-rm -rf /var/cache/!(rpm-ostree)
\ No newline at end of file
+find /var/* -maxdepth 0 -type d \! -name cache -exec rm -fr {} \;
+find /var/cache/* -maxdepth 0 -type d \! -name libdnf5 \! -name rpm-ostree -exec rm -fr {} \;
+
+# this currently fails on /usr/etc and /var/cache
+#bootc container lint
+ostree container commit
+mkdir -p /var/tmp \
+&& chmod -R 1777 /var/tmp
\ No newline at end of file
diff --git a/ucore/github-release-install.sh b/ucore/github-release-install.sh
index 3d726655..01aea614 100755
--- a/ucore/github-release-install.sh
+++ b/ucore/github-release-install.sh
@@ -11,47 +11,49 @@
 # example: wezterm builds RPMs for different distros so we must be more specific.
 #   ARCH_FILTER of "fedora37.x86_64" gets the x86_64 RPM build for fedora37
 
-
 ORG_PROJ=${1}
 ARCH_FILTER=${2}
 LATEST=${3}
 
 usage() {
-  echo "$0 ORG_PROJ ARCH_FILTER"
-  echo "    ORG_PROJ    - organization/projectname"
-  echo "    ARCH_FILTER - optional extra filter to further limit rpm selection"
-  echo "    LATEST      - optional tag override for latest release (eg, nightly-dev)"
+    echo "$0 ORG_PROJ ARCH_FILTER"
+    echo "    ORG_PROJ    - organization/projectname"
+    echo "    ARCH_FILTER - optional extra filter to further limit rpm selection"
+    echo "    LATEST      - optional tag override for latest release (eg, nightly-dev)"
 
 }
 
-if [ -z ${ORG_PROJ} ]; then
-  usage
-  exit 1
+if [ -z "${ORG_PROJ}" ]; then
+    usage
+    exit 1
 fi
 
-if [ -z ${ARCH_FILTER} ]; then
-  usage
-  exit 2
+if [ -z "${ARCH_FILTER}" ]; then
+    usage
+    exit 2
 fi
 
-if [ -z ${LATEST} ]; then
-  RELTAG="latest"
+if [ -z "${LATEST}" ]; then
+    RELTAG="latest"
 else
-  RELTAG="tags/${LATEST}"
+    RELTAG="tags/${LATEST}"
 fi
 
-set -ouex pipefail
+set ${SET_X:+-x} -eou pipefail
 
 API_JSON=$(mktemp /tmp/api-XXXXXXXX.json)
 API="https://api.github.com/repos/${ORG_PROJ}/releases/${RELTAG}"
 
 # retry up to 5 times with 5 second delays for any error included HTTP 404 etc
-curl --fail --retry 5 --retry-delay 5 --retry-all-errors -sL ${API} -o ${API_JSON}
-RPM_URLS=($(cat ${API_JSON} \
-  | jq \
+curl --fail --retry 5 --retry-delay 5 --retry-all-errors -sL "${API}" -o "${API_JSON}"
+RPM_URLS=$(jq \
     -r \
     --arg arch_filter "${ARCH_FILTER}" \
-    '.assets | sort_by(.created_at) | reverse | .[] | select(.name|test($arch_filter)) | select(.name|test("rpm$")) | .browser_download_url'))
-# WARNING: in case of multiple matches, this only installs the first matched release
-echo "execute: rpm-ostree install \"${RPM_URLS[0]}\""
-rpm-ostree install "${RPM_URLS[0]}"
+    '.assets | sort_by(.created_at) | reverse | .[] | select(.name|test($arch_filter)) | select (.name|test("rpm$")) | .browser_download_url' \
+    "${API_JSON}")
+for URL in ${RPM_URLS}; do
+    # WARNING: in case of multiple matches, this only installs the first matched release
+    echo "execute: dnf -y install \"${URL}\""
+    dnf -y install "${URL}"
+    break
+done
diff --git a/ucore/install-ucore-minimal.sh b/ucore/install-ucore-minimal.sh
index 0e014702..1f8ac0c3 100755
--- a/ucore/install-ucore-minimal.sh
+++ b/ucore/install-ucore-minimal.sh
@@ -4,6 +4,7 @@ set -ouex pipefail
 
 ARCH="$(rpm -E %{_arch})"
 RELEASE="$(rpm -E %fedora)"
+
 pushd /tmp/rpms/kernel
 KERNEL_VERSION=$(find kernel-*.rpm | grep -P "kernel-(\d+\.\d+\.\d+)-.*\.fc${RELEASE}\.${ARCH}" | sed -E 's/kernel-//' | sed -E 's/\.rpm//')
 popd
@@ -12,7 +13,7 @@ QUALIFIED_KERNEL="$(rpm -qa | grep -P 'kernel-(\d+\.\d+\.\d+)' | sed -E 's/kerne
 #### PREPARE
 # enable testing repos if not enabled on testing stream
 if [[ "testing" == "${COREOS_VERSION}" ]]; then
-for REPO in $(ls /etc/yum.repos.d/fedora-updates-testing{,-modular}.repo); do
+for REPO in $(ls /etc/yum.repos.d/fedora-updates-testing.repo); do
   if [[ "$(grep enabled=1 ${REPO} > /dev/null; echo $?)" == "1" ]]; then
     echo "enabling $REPO" &&
     sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' ${REPO}
@@ -20,8 +21,10 @@ for REPO in $(ls /etc/yum.repos.d/fedora-updates-testing{,-modular}.repo); do
 done
 fi
 
-# add the ucore copr repo
-curl -L https://copr.fedorainfracloud.org/coprs/ublue-os/ucore/repo/fedora/ublue-os-ucore-fedora.repo -o /etc/yum.repos.d/ublue-os-ucore-fedora.repo
+# enable ublue-os repos
+dnf -y install dnf5-plugins
+dnf -y copr enable ublue-os/packages
+dnf -y copr enable ublue-os/ucore
 
 # always disable cisco-open264 repo
 sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo
@@ -30,12 +33,10 @@ sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo
 # inspect to see what RPMS we copied in
 find /tmp/rpms/
 
-rpm-ostree install \
-    /tmp/rpms/akmods-common/ublue-os-ucore-addons*.rpm \
-    /tmp/rpms/config/ublue-os-signing*.rpm
+dnf -y install /tmp/rpms/akmods-common/ublue-os-ucore-addons*.rpm
+dnf -y install ublue-os-signing
 
 # Handle Kernel Skew with override replace
-rpm-ostree cliwrap install-to-root /
 if [[ "${KERNEL_VERSION}" == "${QUALIFIED_KERNEL}" ]]; then
     echo "Installing signed kernel from kernel-cache."
     cd /tmp
@@ -43,10 +44,12 @@ if [[ "${KERNEL_VERSION}" == "${QUALIFIED_KERNEL}" ]]; then
     cp ./lib/modules/*/vmlinuz /usr/lib/modules/*/vmlinuz
     cd /
 else
+    # Remove Existing Kernel
+    for pkg in kernel kernel-core kernel-modules kernel-modules-core kernel-modules-extra; do
+        rpm --erase $pkg --nodeps
+    done
     echo "Install kernel version ${KERNEL_VERSION} from kernel-cache."
-    rpm-ostree override replace \
-        --experimental \
-        --install=zstd \
+    dnf -y install \
         /tmp/rpms/kernel/kernel-[0-9]*.rpm \
         /tmp/rpms/kernel/kernel-core-*.rpm \
         /tmp/rpms/kernel/kernel-modules-*.rpm
@@ -54,7 +57,7 @@ fi
 
 ## CONDITIONAL: install ZFS (and sanoid deps)
 if [[ "-zfs" == "${ZFS_TAG}" ]]; then
-    rpm-ostree install pv /tmp/rpms/akmods-zfs/kmods/zfs/*.rpm /tmp/rpms/akmods-zfs/kmods/zfs/other/zfs-dracut-*.rpm
+    dnf -y install pv /tmp/rpms/akmods-zfs/kmods/zfs/*.rpm /tmp/rpms/akmods-zfs/kmods/zfs/other/zfs-dracut-*.rpm
     # for some reason depmod ran automatically with zfs 2.1 but not with 2.2
     depmod -a -v ${KERNEL_VERSION}
 fi
@@ -64,10 +67,10 @@ if [[ "-nvidia" == "${NVIDIA_TAG}" ]]; then
     # repo for nvidia rpms
     curl -L https://negativo17.org/repos/fedora-nvidia.repo -o /etc/yum.repos.d/fedora-nvidia.repo
 
-    rpm-ostree install /tmp/rpms/akmods-nvidia/ucore/ublue-os-ucore-nvidia*.rpm
+    dnf -y install /tmp/rpms/akmods-nvidia/ucore/ublue-os-ucore-nvidia*.rpm
     sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/nvidia-container-toolkit.repo
 
-    rpm-ostree install \
+    dnf -y install \
         /tmp/rpms/akmods-nvidia/kmods/kmod-nvidia*.rpm \
         nvidia-driver-cuda \
         nvidia-container-toolkit
diff --git a/ucore/install-ucore.sh b/ucore/install-ucore.sh
index 2aaebcfa..d8ce5611 100755
--- a/ucore/install-ucore.sh
+++ b/ucore/install-ucore.sh
@@ -6,7 +6,7 @@ RELEASE="$(rpm -E %fedora)"
 
 ## CONDITIONAL: install sanoid if ZFS
 if [[ "-zfs" == "${ZFS_TAG}" ]]; then
-    rpm-ostree install sanoid
+    dnf -y install sanoid
 fi
 
 # install packages.json stuffs
diff --git a/ucore/packages.json b/ucore/packages.json
index df33fdea..f021d45e 100644
--- a/ucore/packages.json
+++ b/ucore/packages.json
@@ -50,6 +50,7 @@
                 "cockpit-machines",
                 "libvirt-client",
                 "libvirt-daemon-kvm",
+                "ublue-os-libvirt-workarounds",
                 "virt-install"
             ]
         },
diff --git a/ucore/packages.sh b/ucore/packages.sh
index 70a847da..07a9c9a9 100755
--- a/ucore/packages.sh
+++ b/ucore/packages.sh
@@ -9,40 +9,16 @@ INCLUDED_PACKAGES=($(jq -r "[(.all.include | (.all, select(.\"$IMAGE_NAME\" != n
                              (select(.\"$COREOS_VERSION\" != null).\"$COREOS_VERSION\".include | (.all, select(.\"$IMAGE_NAME\" != null).\"$IMAGE_NAME\")[])] \
                              | sort | unique[]" /ctx/packages.json))
 
-# build list of all packages requested for exclusion
-EXCLUDED_PACKAGES=($(jq -r "[(.all.exclude | (.all, select(.\"$IMAGE_NAME\" != null).\"$IMAGE_NAME\")[]), \
-                             (select(.\"$COREOS_VERSION\" != null).\"$COREOS_VERSION\".exclude | (.all, select(.\"$IMAGE_NAME\" != null).\"$IMAGE_NAME\")[])] \
-                             | sort | unique[]" /ctx/packages.json))
-
-
-# ensure exclusion list only contains packages already present on image
-if [[ "${#EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
-    EXCLUDED_PACKAGES=($(rpm -qa --queryformat='%{NAME} ' ${EXCLUDED_PACKAGES[@]}))
-fi
-
-# ensure exclusion list only contains packages already present on image
-if [[ "${#EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
-    EXCLUDED_PACKAGES=($(rpm -qa --queryformat='%{NAME} ' ${EXCLUDED_PACKAGES[@]}))
-fi
-
-# simple case to install where no packages need excluding
-if [[ "${#INCLUDED_PACKAGES[@]}" -gt 0 && "${#EXCLUDED_PACKAGES[@]}" -eq 0 ]]; then
-    rpm-ostree install \
-        ${INCLUDED_PACKAGES[@]}
-
-# install/excluded packages both at same time
-elif [[ "${#INCLUDED_PACKAGES[@]}" -gt 0 && "${#EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
-    rpm-ostree override remove \
-        ${EXCLUDED_PACKAGES[@]} \
-        $(printf -- "--install=%s " ${INCLUDED_PACKAGES[@]})
-
+# Install Packages
+if [[ "${#INCLUDED_PACKAGES[@]}" -gt 0 ]]; then
+    dnf -y install \
+        "${INCLUDED_PACKAGES[@]}"
 else
     echo "No packages to install."
 
 fi
 
-# check if any excluded packages are still present
-# (this can happen if an included package pulls in a dependency)
+# build list of all packages requested for exclusion
 EXCLUDED_PACKAGES=($(jq -r "[(.all.exclude | (.all, select(.\"$IMAGE_NAME\" != null).\"$IMAGE_NAME\")[]), \
                              (select(.\"$COREOS_VERSION\" != null).\"$COREOS_VERSION\".exclude | (.all, select(.\"$IMAGE_NAME\" != null).\"$IMAGE_NAME\")[])] \
                              | sort | unique[]" /ctx/packages.json))
@@ -53,6 +29,8 @@ fi
 
 # remove any excluded packages which are still present on image
 if [[ "${#EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
-    rpm-ostree override remove \
-        ${EXCLUDED_PACKAGES[@]}
+    dnf -y remove \
+        "${EXCLUDED_PACKAGES[@]}"
+else
+    echo "No packages to remove."
 fi
diff --git a/ucore/post-install-ucore-minimal.sh b/ucore/post-install-ucore-minimal.sh
index 7d4aa890..9f117bff 100755
--- a/ucore/post-install-ucore-minimal.sh
+++ b/ucore/post-install-ucore-minimal.sh
@@ -24,7 +24,6 @@ systemctl disable docker.socket
 systemctl disable zincati.service
 
 systemctl enable gssproxy-workaround.service
-systemctl enable libvirt-workaround.service
 systemctl enable swtpm-workaround.service
 
 
diff --git a/ucore/system_files/usr/lib/systemd/system/libvirt-workaround.service b/ucore/system_files/usr/lib/systemd/system/libvirt-workaround.service
deleted file mode 100644
index 440e0567..00000000
--- a/ucore/system_files/usr/lib/systemd/system/libvirt-workaround.service
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-Description=Workaround to relabel libvirt files and directories
-ConditionPathIsDirectory=/var/lib/libvirt/
-After=local-fs.target
-
-[Service]
-Type=oneshot
-ExecStart=-/usr/sbin/restorecon -Rv /var/lib/libvirt/
-ExecStart=-/usr/sbin/restorecon -Rv /var/log/libvirt/
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target
diff --git a/ucore/system_files/usr/lib/tmpfiles.d/libvirt-workaround.conf b/ucore/system_files/usr/lib/tmpfiles.d/libvirt-workaround.conf
deleted file mode 100644
index 4af298b7..00000000
--- a/ucore/system_files/usr/lib/tmpfiles.d/libvirt-workaround.conf
+++ /dev/null
@@ -1 +0,0 @@
-d /var/log/libvirt 0750 - - - -


Reviews:
user: login: copilot-pull-request-reviewer[bot]
body: ## Pull Request Overview

This PR refactors the build process to modernize uCore builds by updating dependency management and package installation methods.  
- Update the release override logic using a regex instead of a direct string equality check.  
- Refactor the workflow script to adapt to dnf5 and ublue packages.

<details>
<summary>Files not reviewed (13)</summary>

* **fedora-coreos/Containerfile**: Language not supported
* **fedora-coreos/cleanup.sh**: Language not supported
* **fedora-coreos/install.sh**: Language not supported
* **ucore/Containerfile**: Language not supported
* **ucore/cleanup.sh**: Language not supported
* **ucore/github-release-install.sh**: Language not supported
* **ucore/install-ucore-minimal.sh**: Language not supported
* **ucore/install-ucore.sh**: Language not supported
* **ucore/packages.json**: Language not supported
* **ucore/packages.sh**: Language not supported
* **ucore/post-install-ucore-minimal.sh**: Language not supported
* **ucore/system_files/usr/lib/systemd/system/libvirt-workaround.service**: Language not supported
* **ucore/system_files/usr/lib/tmpfiles.d/libvirt-workaround.conf**: Language not supported
</details>



state: COMMENTED
author_association: NONE
submitted_at: 2025-05-06T06:55:05Z
user: login: castrojo
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-05-06T16:53:14Z
user: login: m2Giles
body: Mostly just some nitpick items that can be addressed in later commits. This get Ucore in the right direction.

Longer term, I think we have a lot of duplicated code that can be brought together.

/usr/etc we should resolve but it is now only a warning and not an error.
state: APPROVED
author_association: MEMBER
submitted_at: 2025-05-07T00:37:50Z
user: login: KyleGospo
state: APPROVED
author_association: MEMBER
submitted_at: 2025-05-07T03:50:52Z

Review comments:
diff_hunk: @@ -59,8 +59,8 @@ jobs:
                 exit 1
             fi
 
-            if [ "42.20250410.3.1" == "${image}" ]; then
-                echo "WARNING: Overriding known problematic release. Downgrading from 42.20250410.3.1 to 41.20250331.3.0"
+            if [[ "${image}" =~ "42.20250410.3" ]]; then
path: .github/workflows/reusable-build.yml
user: login: Copilot
body: [nitpick] Consider using an anchored regular expression (e.g., '^42\.20250410\.3\.') to precisely match the intended version format and avoid false positives.
```suggestion
            if [[ "${image}" =~ ^42\.20250410\.3\..*$ ]]; then
```
created_at: 2025-05-06T06:55:05Z
author_association: NONE
path: fedora-coreos/cleanup.sh
user: login: m2Giles
body: We can move the file containers/policy.json into place and then nuke /usr/etc
created_at: 2025-05-07T00:25:12Z
author_association: MEMBER
diff_hunk: @@ -12,46 +12,50 @@ QUALIFIED_KERNEL="$(rpm -qa | grep -P 'kernel-(\d+\.\d+\.\d+)' | sed -E 's/kerne
 #### PREPARE
 # enable testing repos if not enabled on testing stream
 if [[ "testing" == "${COREOS_VERSION}" ]]; then
-for REPO in $(ls /etc/yum.repos.d/fedora-updates-testing{,-modular}.repo); do
+for REPO in $(ls /etc/yum.repos.d/fedora-updates-testing.repo); do
   if [[ "$(grep enabled=1 ${REPO} > /dev/null; echo $?)" == "1" ]]; then
     echo "enabling $REPO" &&
     sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' ${REPO}
   fi
 done
 fi
 
+# enable ublue-os repos
+dnf -y install dnf5-plugins
+dnf -y copr enable ublue-os/packages
+
 # always disable cisco-open264 repo
 sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo
 
 #### INSTALL
 # inspect to see what RPMS we copied in
 find /tmp/rpms/
 
-rpm-ostree install \
-    /tmp/rpms/akmods-common/ublue-os-ucore-addons*.rpm \
-    /tmp/rpms/config/ublue-os-signing*.rpm
+dnf -y install /tmp/rpms/akmods-common/ublue-os-ucore-addons*.rpm
+dnf -y install ublue-os-signing
 
 # Handle Kernel Skew with override replace
-rpm-ostree cliwrap install-to-root /
 if [[ "${KERNEL_VERSION}" == "${QUALIFIED_KERNEL}" ]]; then
     echo "Installing signed kernel from kernel-cache."
     cd /tmp
     rpm2cpio /tmp/rpms/kernel/kernel-core-*.rpm | cpio -idmv
     cp ./lib/modules/*/vmlinuz /usr/lib/modules/*/vmlinuz
     cd /
 else
+    # Remove Existing Kernel
path: fedora-coreos/install.sh
user: login: m2Giles
body: We could just always do this instead of doing the rpm2cpio dance.

We can also consider uninstalling using dnf5.
created_at: 2025-05-07T00:27:35Z
author_association: MEMBER

PR comments:
user: login: m2Giles
created_at: 2025-05-05T21:08:45Z
body: Need to also make sure that we regenerate the initramfs after installing the kernel.
author_association: MEMBER
user: login: bsherman
created_at: 2025-05-05T21:10:17Z
body: > Need to also make sure that we regenerate the initramfs after installing the kernel.

hmm... did i drop this or has it never been here?
author_association: COLLABORATOR
user: login: m2Giles
created_at: 2025-05-05T21:17:35Z
body: > > Need to also make sure that we regenerate the initramfs after installing the kernel.
> 
> hmm... did i drop this or has it never been here?

I don't see it being deleted. I'm guessing this was never implemented on Ucore.
author_association: MEMBER
user: login: bsherman
created_at: 2025-05-05T21:28:10Z
body: 
> 
> I don't see it being deleted. I'm guessing this was never implemented on Ucore.

Right. I think that's the case. 

I know I specifically wasn't trying to force use of nvidia as a boot device, so maybe that's was why? Or I just forgot and no one caught it before now. 

If we Install a new kernel should probably be rebuilding the initrd...

But don't need to for just the signed kernel swap, correct?
author_association: COLLABORATOR
user: login: bsherman
created_at: 2025-05-06T06:54:38Z
body: > I don't see it being deleted. I'm guessing this was never implemented on Ucore.

I filed an issue to remember #254 
author_association: COLLABORATOR