Add cryptsetup, tpm2-tools and tpm2-tss to every encrypted dish so the
initrd can be rebuilt with TPM2 support. A guarded %pre stashes a
preseeded LUKS passphrase from the kickstart, and a guarded %post
enrolls PCR 7-bound auto-unlock via systemd-cryptenroll, switches
crypttab to tpm2-device=auto and regenerates the initrd. Without a
preseeded passphrase or a TPM device the enrollment is skipped and the
system keeps the regular passphrase prompt.
- storage/biosboot.ks: GPT disk label with a 2 MiB BIOS boot partition,
no ESP (pure legacy layout); registered as the 'biosboot' storage choice
- recipe_templates.yaml: make the desktop hypervisor a superset of the
base hypervisor so GNOME hypervisor dishes get libvirtd + virt-manager
- recipes_manifest.yaml: enable the desktop-hypervisor group targeting
Fedora 44 (gnome, biosboot, grub, security enabled, gnome initial-setup,
hardware-support, intelcpu)
- initial-setup/gnome/config.ks: apply the vendor.conf fix (truncate and
append skip=privacy / providers=local-first!) as an enabled %post
- tests: update BASE_FRAGMENTS fixture to core-explicit.ks (follow-up to
ccf4f9d)
- Move recipe-generator/ to cook/ for cleaner structure
- Fix ksflatten-relative path conversion to handle all %include paths
- Fix validation exit code to only fail on actual errors
- All recipes now generate and flatten successfully via make all
Lukas Greve