From 71d236aa15d27ac6b83193a89dd032691a50d338 Mon Sep 17 00:00:00 2001 From: Lukas Greve Date: Thu, 24 Sep 2026 15:17:49 +0200 Subject: [PATCH] cook: ship the fscrypt stack by default in Phyllome OS - ingredients/repo/phyllome.ks: add the git.phyllo.me roots registry as a downstream repo (install-time only; the phyllome-fscrypt package owns /etc/yum.repos.d/phyllome.repo on the installed system) - ingredients/packages/fscrypt.ks: install phyllome-fscrypt, which pulls fscrypt + pam_fscrypt via Requires - recipe_templates: new 'fscrypt' feature mapping the two fragments - recipes_manifest: enable fscrypt for phyllomeos and phyllomeos-headless (default tier, repository 44) make lint/validate/test pass; both default dishes regenerate with the phyllome repo and phyllome-fscrypt included. --- cook/ingredients/packages/fscrypt.ks | 16 ++++++++++++++++ cook/ingredients/repo/phyllome.ks | 16 ++++++++++++++++ cook/recipe_templates.yaml | 4 ++++ cook/recipes_manifest.yaml | 2 ++ 4 files changed, 38 insertions(+) create mode 100644 cook/ingredients/packages/fscrypt.ks create mode 100644 cook/ingredients/repo/phyllome.ks diff --git a/cook/ingredients/packages/fscrypt.ks b/cook/ingredients/packages/fscrypt.ks new file mode 100644 index 0000000..484091f --- /dev/null +++ b/cook/ingredients/packages/fscrypt.ks @@ -0,0 +1,16 @@ +# __ ____ ____ _____ +# ____ / /_ __ __/ / /___ ____ ___ ___ / __ \/ ___/ +# / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \ / / / /\__ \ +# / /_/ / / / / /_/ / / / /_/ / / / / / / __/ / /_/ /___/ / +# / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/ \____//____/ +# /_/ /____/ + +# fscrypt stack: CLI, PAM module and the Phyllome OS configuration package. +# phyllome-fscrypt depends on fscrypt + pam_fscrypt + authselect, so installing +# it alone pulls the whole stack. + +%packages --exclude-weakdeps + +phyllome-fscrypt # SELinux, PAM, repo + first-boot activation for fscrypt + +%end # End of the packages section \ No newline at end of file diff --git a/cook/ingredients/repo/phyllome.ks b/cook/ingredients/repo/phyllome.ks new file mode 100644 index 0000000..b479d7f --- /dev/null +++ b/cook/ingredients/repo/phyllome.ks @@ -0,0 +1,16 @@ +# __ ____ ____ _____ +# ____ / /_ __ __/ / /___ ____ ___ ___ / __ \/ ___/ +# / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \ / / / /\__ \ +# / /_/ / / / / /_/ / / / /_/ / / / / / / __/ / /_/ /___/ / +# / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/ \____//____/ +# /_/ /____/ + +# Phyllome OS downstream repository: the fscrypt / phyllome-fscrypt RPMs +# published to the git.phyllo.me roots registry. +# +# gpgcheck stays at the anaconda default (enforced by the registry's TLS end-to- +# end; Gitea's RPM registry does not sign its repodata, see +# fscrypt-fedora/rpm/README.md). Noverifyssl is not set: the registry presents +# a valid TLS certificate. + +repo --name=phyllome --baseurl=https://git.phyllo.me/api/packages/roots/rpm # Phyllome OS repository (fscrypt stack) \ No newline at end of file diff --git a/cook/recipe_templates.yaml b/cook/recipe_templates.yaml index bf372c3..bd031ec 100644 --- a/cook/recipe_templates.yaml +++ b/cook/recipe_templates.yaml @@ -74,6 +74,10 @@ features: intelgpu: hypervisor/intelgpu.ks hardware-support: packages/hardware-support.ks guest-agents: guest-agents/base.ks + fscrypt: + true: + - repo/phyllome.ks + - packages/fscrypt.ks live: true: - live/core/base.ks diff --git a/cook/recipes_manifest.yaml b/cook/recipes_manifest.yaml index 20203ac..0e912fb 100644 --- a/cook/recipes_manifest.yaml +++ b/cook/recipes_manifest.yaml @@ -36,6 +36,7 @@ recipes: initial-setup: gnome hardware-support: true guest-agents: true + fscrypt: true hypervisor: desktop hypervisor_type: any @@ -50,6 +51,7 @@ recipes: initial-setup: server hardware-support: true guest-agents: true + fscrypt: true hypervisor: base hypervisor_type: any -- 2.43.0