chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0

.github/workflows/build.yml

@@ -5,7 +5,7 @@ on:
     branches:
       - main
   schedule:
-    - cron: '05 10 * * *'  # 10:05am UTC everyday
+    - cron: '05 2 * * *'  # 2:05am UTC everyday
   push:
     branches:
       - main
@@ -73,8 +73,9 @@ jobs:
           # This generates all the tags for your image, you can add custom tags here too!
           # Default tags are "$DEFAULT_TAG" and "$DEFAULT_TAG.$date".
           tags: |
-            type=raw,value=${{ env.DEFAULT_TAG }}
-            type=raw,value=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
+            type=raw,value=latest
+            type=raw,value=daily-stable
+            type=raw,value=daily-stable.{{date 'YYYYMMDD'}}
             type=raw,value={{date 'YYYYMMDD'}}
             type=sha,enable=${{ github.event_name == 'pull_request' }}
             type=ref,event=pr
@@ -87,7 +88,7 @@ jobs:
             org.opencontainers.image.title=${{ env.IMAGE_NAME }}
             org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
             org.opencontainers.image.vendor=${{ github.repository_owner }}
-            org.opencontainers.image.version=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
+            org.opencontainers.image.version=daily-stable
             io.artifacthub.package.deprecated=false
             io.artifacthub.package.keywords=${{ env.IMAGE_KEYWORDS }}
             io.artifacthub.package.license=Apache-2.0
@@ -163,7 +164,7 @@ jobs:
       # using Cosign and save the private key as a repository secret in Github for this workflow
       # to consume. For more details, review the image signing section of the README.
       - name: Install Cosign
-        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
 
       - name: Sign container image

.gitignore

@@ -1,4 +1,3 @@
 cosign.key
-_build_*
 output
 _build-*/**

Containerfile

@@ -1,30 +1,48 @@
-# Allow build scripts to be referenced without being copied into the final image
+# My container file
 FROM scratch AS ctx
 COPY build_files /
 
-# Base Image
-FROM ghcr.io/ublue-os/bazzite:stable
-
-## Other possible base images include:
-# FROM ghcr.io/ublue-os/bazzite:latest
-# FROM ghcr.io/ublue-os/bluefin-nvidia:stable
-# 
-# ... and so on, here are more base images
-# Universal Blue Images: https://github.com/orgs/ublue-os/packages
-# Fedora base image: quay.io/fedora/fedora-bootc:41
-# CentOS base images: quay.io/centos-bootc/centos-bootc:stream10
-
-### MODIFICATIONS
-## make modifications desired in your image and install packages by modifying the build.sh script
-## the following RUN directive does all the things required to run "build.sh" as recommended.
+FROM ghcr.io/ublue-os/aurora-dx:stable-daily
 
+COPY system_files /
 RUN --mount=type=bind,from=ctx,source=/,target=/ctx \
     --mount=type=cache,dst=/var/cache \
     --mount=type=cache,dst=/var/log \
     --mount=type=tmpfs,dst=/tmp \
     /ctx/build.sh && \
     ostree container commit
+RUN bootc container lint
+
+##############################################
+# Original Containerfile
+
+# Allow build scripts to be referenced without being copied into the final image
+# FROM scratch AS ctx
+# COPY build_files /
+
+# # Base Image
+# FROM ghcr.io/ublue-os/bazzite:stable
+
+# ## Other possible base images include:
+# # FROM ghcr.io/ublue-os/bazzite:latest
+# # FROM ghcr.io/ublue-os/bluefin-nvidia:stable
+# # 
+# # ... and so on, here are more base images
+# # Universal Blue Images: https://github.com/orgs/ublue-os/packages
+# # Fedora base image: quay.io/fedora/fedora-bootc:41
+# # CentOS base images: quay.io/centos-bootc/centos-bootc:stream10
+
+# ### MODIFICATIONS
+# ## make modifications desired in your image and install packages by modifying the build.sh script
+# ## the following RUN directive does all the things required to run "build.sh" as recommended.
+
+# RUN --mount=type=bind,from=ctx,source=/,target=/ctx \
+#     --mount=type=cache,dst=/var/cache \
+#     --mount=type=cache,dst=/var/log \
+#     --mount=type=tmpfs,dst=/tmp \
+#     /ctx/build.sh && \
+#     ostree container commit
 
-### LINTING
-## Verify final image and contents are correct.
-RUN bootc container lint
+# ### LINTING
+# ## Verify final image and contents are correct.
+# RUN bootc container lint

README.md

@@ -1,3 +1,57 @@
+# Custom Aurora DX
+
+This is my own custom Universal Blue image, that is based off of the aurora-dx:daily-stable which I use for work. I have customised the <https://github.com/ublue-os/image-template> template to build this image.
+
+# Rebasing to this image
+
+Feel free to use this image if you wish, but I will not be providing support for this image
+
+```bash
+rpm-ostree rebase ostree-image-signed:docker://ghcr.io/wolfyreload/aurora-ewx:daily-stable
+```
+
+# Setup dotnet
+
+Install latest dotnet sdk with `dotnet-install --channel 9.0` if you want to install the dotnet runtime `dotnet-install --runtime dotnet --version 6.0.0`
+
+Allow all users to use the dotnet runtime and sdk
+
+```bash
+echo "export DOTNET_ROOT=$HOME/.dotnet" | sudo tee /etc/profile.d/dotnet.sh
+echo 'export PATH=$PATH:$DOTNET_ROOT:$DOTNET_ROOT/tools' | sudo tee --append /etc/profile.d/dotnet.sh
+```
+
+# Setup nvm and nodejs
+
+run `install-nvm`
+
+```
+echo 'export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"' | sudo tee /etc/profile.d/nvm.sh
+echo '[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" # This loads nvm' | sudo tee --append /etc/profile.d/nvm.sh
+```
+
+Run `nvm install --lts` to install the latest lts version of nodejs
+
+# Install powershell
+
+```
+dotnet tool install --global PowerShell
+```
+
+# Windows VM
+
+The simplist way to run Windows in a virtual machine is to use this appimage <https://github.com/ivan-hc/VirtualBox-appimage/releases>
+
+# Rebasing to an older image
+
+Open the terminal and run `ewx-rebase-helper` and follow the prompts
+
+# Default brew packages
+
+`brew install git-credential-oauth gh openjdk sshpass`
+
+# Original Readme
+
 # image-template
 
 This repository is meant to be a template for building your own custom [bootc](https://github.com/bootc-dev/bootc) image. This template is the recommended way to make customizations to any image published by the Universal Blue Project.

build_files/build.sh

@@ -2,6 +2,42 @@
 
 set -ouex pipefail
 
+# this installs a package from fedora repos
+dnf5 install -y openfortivpn \
+        earlyoom 
+
+# Downlaod and install Azure data studio
+wget https://go.microsoft.com/fwlink/?linkid=2324527 -O /tmp/azure-data-studio.rpm
+dnf5 install -y /tmp/azure-data-studio.rpm
+
+# Add dotnet install script
+wget https://dot.net/v1/dotnet-install.sh -O /usr/bin/dotnet-install
+chmod +x /usr/bin/dotnet-install
+
+# Add nvm installer 
+wget https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh -O /usr/bin/nvm-install
+chmod +x /usr/bin/nvm-install
+
+# Add teams for Linux
+wget \
+    https://github.com/IsmaelMartinez/teams-for-linux/releases/download/v2.2.1/teams-for-linux-2.2.1.AppImage \
+    -O /usr/bin/teams_for_linux.appimage
+chmod +x /usr/bin/teams_for_linux.appimage
+
+# Add openfortivpn-webview
+wget \
+    https://github.com/gm-vm/openfortivpn-webview/releases/download/v1.2.3-electron/openfortivpn-webview-1.2.3-x86_64.AppImage \
+    -O /usr/bin/openfortivpn-webview.appimage
+chmod +x /usr/bin/openfortivpn-webview.appimage
+
+# Enable earlyoom
+systemctl enable earlyoom.service
+
+<<'###BLOCK-COMMENT'
+#!/bin/bash
+
+set -ouex pipefail
+
 ### Install packages
 
 # Packages can be installed from any enabled yum repo on the image.
@@ -16,9 +52,10 @@ dnf5 install -y tmux
 #
 # dnf5 -y copr enable ublue-os/staging
 # dnf5 -y install package
-# Disable COPRs so they don't end up enabled on the final image:
+# Disable COPRs so they don't end up enabled on the final image
 # dnf5 -y copr disable ublue-os/staging
 
 #### Example for enabling a System Unit File
 
 systemctl enable podman.socket
+###BLOCK-COMMENT

cosign.pub

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1YhhvUWZe6vC378v5IoLu/wpjZ/w
+FksGkO1njXMxVRlTQBvNaxHB96aqyEUfYcGKo+ik47gjUfQJAZXa6dTE2g==
+-----END PUBLIC KEY-----

system_files/etc/default/earlyoom

@@ -0,0 +1,23 @@
+# Default settings for earlyoom. This file is sourced by /bin/sh from
+# /etc/init.d/earlyoom or by systemd from earlyoom.service.
+
+# Options to pass to earlyoom
+# EARLYOOM_ARGS="-r 3600"
+
+# Examples:
+
+# Print memory report every minute instead of every hour
+# EARLYOOM_ARGS="-r 60"
+
+# Available minimum memory 5%
+# EARLYOOM_ARGS="-m 5"
+
+# Available minimum memory 15% and free minimum swap 5%
+# EARLYOOM_ARGS="-m 15 -s 5"
+
+# Avoid killing processes whose name matches this regexp
+# EARLYOOM_ARGS="--avoid '(^|/)(init|X|sshd|firefox)$'"
+
+# See more at `earlyoom -h'
+
+EARLYOOM_ARGS="-r 60 -m 8 -s 8 --avoid '(^|/)(teams|TimeTrackerServ|VirtualBoxVM)$'"

system_files/etc/sudoers.d/openfortivpn

@@ -0,0 +1 @@
+%wheel ALL=(root) NOPASSWD: /usr/bin/openfortivpn

system_files/etc/systemd/zram-generator.conf

@@ -0,0 +1,3 @@
+[zram0]
+zram-size=ram
+compression-algorithm=lz4

system_files/etc/udev/rules.d/60-vboxusb.rules

@@ -0,0 +1,7 @@
+KERNEL=="vboxdrv", OWNER="root", GROUP="vboxusers", MODE="0660"
+KERNEL=="vboxdrvu", OWNER="root", GROUP="root", MODE="0666"
+KERNEL=="vboxnetctl", OWNER="root", GROUP="vboxusers", MODE="0660"
+SUBSYSTEM=="usb_device", ACTION=="add", RUN+="/usr/lib/virtualbox/VBoxCreateUSBNode.sh $major $minor $attr{bDeviceClass}"
+SUBSYSTEM=="usb", ACTION=="add", ENV{DEVTYPE}=="usb_device", RUN+="/usr/lib/virtualbox/VBoxCreateUSBNode.sh $major $minor $attr{bDeviceClass}"
+SUBSYSTEM=="usb_device", ACTION=="remove", RUN+="/usr/lib/virtualbox/VBoxCreateUSBNode.sh --remove $major $minor"
+SUBSYSTEM=="usb", ACTION=="remove", ENV{DEVTYPE}=="usb_device", RUN+="/usr/lib/virtualbox/VBoxCreateUSBNode.sh --remove $major $minor"

system_files/usr/bin/ewx-forticlientvpn

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+# Check if cookie was captured
+if [ -z "$VPN_URL" ]; then
+    echo '$VPN_URL not populated'
+    exit 1
+fi
+
+COOKIE=$(/usr/bin/openfortivpn-webview.appimage \
+    $VPN_URL:$VPN_PORT \
+    --trusted-cert="${VPN_CERT_SIGNATURE}" | grep "SVPNCOOKIE=" | tr -d '\r')
+
+# Check if cookie was captured
+if [ -z "$COOKIE" ]; then
+    echo "Failed to capture VPN cookie"
+    exit 1
+fi
+
+echo "$COOKIE" | sudo openfortivpn $VPN_URL:$VPN_PORT \
+    -u $VPN_USERNAME \
+    -p $VPN_USER_PASSWORD \
+    --trusted-cert $VPN_CERT_SIGNATURE2 \
+    --set-dns=1 \
+    --pppd-use-peerdns=0 \
+    --cookie-on-stdin
+

system_files/usr/bin/ewx-rebase-helper

@@ -0,0 +1,62 @@
+#!/usr/bin/bash
+#shellcheck disable=1091
+source /usr/lib/ujust/ujust.sh
+IMAGE_INFO="/usr/share/ublue-os/image-info.json"
+IMAGE_NAME="aurora-ewx"
+CURRENT_IMAGE_BRANCH="daily-stable"
+CURRENT_TAG=$(jq -r '."version"' < $IMAGE_INFO)
+CHANNELS=(daily-stable)
+BASE_IMAGE_PATH="ghcr.io/wolfyreload"
+function rebase_channel(){
+    clear
+    echo "Which channel would you like to rebase to?"
+    echo "* daily-stable"
+    target_tag=$(Choose cancel "${CHANNELS[@]}")
+    if [[ "$target_tag" == "cancel" ]]; then
+        exit 0
+    fi
+    rebase_target="$BASE_IMAGE_PATH/$IMAGE_NAME:$target_tag"
+}
+function rebase_date() {
+    clear
+    base_image="ghcr.io/wolfyreload/${IMAGE_NAME}"
+    echo "Warning: This will pin you to a specific version, do not forget to rebase back to a channel to resume receiving updates."
+    valid_tags=( $(list_tags | sed 's/\"//g' | sed 's/,//g'))
+    echo "Select image"
+    target_tag=$(Choose cancel "${valid_tags[@]}")
+    if [[ "$target_tag" == "cancel" ]]; then
+        exit 0
+    fi
+    rebase_target="$BASE_IMAGE_PATH/$IMAGE_NAME:$target_tag"
+}
+
+function list_tags(){
+    skopeo list-tags docker://$BASE_IMAGE_PATH/$IMAGE_NAME | grep -E --color=never -- "\"$CURRENT_IMAGE_BRANCH\.[0-9]{8}(.*)\"" | sort -rV | head -n 15
+}
+function perform_rebase(){
+    clear
+    echo "Rebase Target is ${rebase_target}"
+    echo "Confirm Rebase"
+    if [[ $(Confirm) -ne "0" ]]; then
+        exit 0
+    fi
+    if /usr/bin/grep "^LockLayering=true" /etc/rpm-ostreed.conf &> /dev/null; then
+        pkexec bootc switch --enforce-container-sigpolicy "${rebase_target}"
+        exit 0
+    fi
+    rpm-ostree rebase ostree-image-signed:docker://"${rebase_target}"
+    exit 0
+}
+clear
+echo "Choose your rebase action."
+echo "channel - Switch between stable, test and unstable update channel"
+echo "date - Rebase to a specific dated version"
+option=$(Choose cancel channel date)
+if [[ "$option" == "channel" ]]; then
+    rebase_channel
+elif [[ "$option" == "date" ]]; then
+    rebase_date
+else
+    exit 0
+fi
+perform_rebase