chore: un-cliwrap and use dnf5 instead of rpm-ostree

I've been tinkering with and testing dnf5 for a while.

Key items are:
- ensuring cliwrap is properly unwound (checked rpm-ostree Rust code)
- using normal (not wrapped) binaries, eg for dracut
- and the more obvious, replacing "rpm-ostree install" with "dnf5
  install", etc

Relates: #1946

Containerfile

@@ -19,7 +19,8 @@ ARG SHA_HEAD_SHORT="dedbeef"
 ARG UBLUE_IMAGE_TAG="stable"
 
 # Build, cleanup, commit.
-RUN --mount=type=cache,dst=/var/cache/rpm-ostree \
+RUN --mount=type=cache,dst=/var/cache/libdnf5 \
+    --mount=type=cache,dst=/var/cache/rpm-ostree \
     --mount=type=bind,from=ctx,source=/,target=/ctx \
     /ctx/build_files/shared/build-base.sh
 
@@ -36,6 +37,7 @@ ARG SHA_HEAD_SHORT="dedbeef"
 ARG UBLUE_IMAGE_TAG="stable"
 
 # Build, Clean-up, Commit
-RUN --mount=type=cache,dst=/var/cache/rpm-ostree \
+RUN --mount=type=cache,dst=/var/cache/libdnf5 \
+    --mount=type=cache,dst=/var/cache/rpm-ostree \
     --mount=type=bind,from=ctx,source=/,target=/ctx \
     /ctx/build_files/shared/build-dx.sh

build_files/base/01-build-fix.sh

@@ -18,19 +18,17 @@ for repo in "${repos[@]}"; do
 done
 
 if grep -q "kinoite" <<<"${BASE_IMAGE_NAME}"; then
-    rpm-ostree override replace \
-        --experimental \
-        --from repo=updates \
+    dnf5 -y upgrade \
+        --repo=updates \
         qt6-qtbase \
         qt6-qtbase-common \
         qt6-qtbase-mysql \
         qt6-qtbase-gui ||
         true
 fi
 
-rpm-ostree override replace \
-    --experimental \
-    --from repo=updates \
+dnf5 -y upgrade \
+    --repo=updates \
     elfutils-libelf \
     elfutils-libs ||
     true

build_files/base/02-install-copr-repos.sh

@@ -4,12 +4,10 @@
 set -eoux pipefail
 
 # Add Staging repo
-curl --retry 3 -Lo /etc/yum.repos.d/ublue-os-staging-fedora-"$(rpm -E %fedora)".repo \
-    https://copr.fedorainfracloud.org/coprs/ublue-os/staging/repo/fedora-"$(rpm -E %fedora)"/ublue-os-staging-fedora-"$(rpm -E %fedora)".repo
+dnf5 -y copr enable ublue-os/staging
 
 # Add Switcheroo Repo
-curl --retry 3 -Lo /etc/yum.repos.d/_copr_sentry-switcheroo-control_discrete.repo \
-    https://copr.fedorainfracloud.org/coprs/sentry/switcheroo-control_discrete/repo/fedora-"$(rpm -E %fedora)"/sentry-switcheroo-control_discrete-fedora-"$(rpm -E %fedora)".repo
+dnf5 -y copr enable sentry/switcheroo-control_discrete
 
 # Add Nerd Fonts Repo
-curl --retry 3 -Lo /etc/yum.repos.d/_copr_che-nerd-fonts-"$(rpm -E %fedora)".repo https://copr.fedorainfracloud.org/coprs/che/nerd-fonts/repo/fedora-"$(rpm -E %fedora)"/che-nerd-fonts-fedora-"$(rpm -E %fedora)".repo
+dnf5 -y copr enable che/nerd-fonts

build_files/base/03-install-kernel-akmods.sh

@@ -15,7 +15,7 @@ tar -xvzf /tmp/kernel-rpms/"$KERNEL_TARGZ" -C /
 mv /tmp/rpms/* /tmp/kernel-rpms/
 
 # Install Kernel
-rpm-ostree install \
+dnf5 -y install \
     /tmp/kernel-rpms/kernel-[0-9]*.rpm \
     /tmp/kernel-rpms/kernel-core-*.rpm \
     /tmp/kernel-rpms/kernel-modules-*.rpm
@@ -27,21 +27,22 @@ tar -xvzf /tmp/akmods/"$AKMODS_TARGZ" -C /tmp/
 mv /tmp/rpms/* /tmp/akmods/
 
 # Everyone
+# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming
 sed -i 's@enabled=0@enabled=1@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo
-rpm-ostree install \
+dnf5 -y install \
     /tmp/akmods/kmods/*xone*.rpm \
     /tmp/akmods/kmods/*xpadneo*.rpm \
     /tmp/akmods/kmods/*openrazer*.rpm \
     /tmp/akmods/kmods/*framework-laptop*.rpm
 
 # RPMFUSION Dependent AKMODS
-rpm-ostree install \
+dnf5 -y install \
     https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm \
     https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm
-rpm-ostree install \
+dnf5 -y install \
     broadcom-wl /tmp/akmods/kmods/*wl*.rpm \
     v4l2loopback /tmp/akmods/kmods/*v4l2loopback*.rpm
-rpm-ostree uninstall rpmfusion-free-release rpmfusion-nonfree-release
+dnf5 -y remove rpmfusion-free-release rpmfusion-nonfree-release
 
 # Nvidia AKMODS
 if [[ "${IMAGE_NAME}" =~ nvidia ]]; then
@@ -79,7 +80,7 @@ if [[ ${AKMODS_FLAVOR} =~ coreos ]]; then
     )
 
     # Install
-    rpm-ostree install "${ZFS_RPMS[@]}"
+    dnf5 -y install "${ZFS_RPMS[@]}"
 
     # Depmod and autoload
     depmod -a -v "${KERNEL}"

build_files/base/04-packages.sh

@@ -26,14 +26,15 @@ fi
 
 # simple case to install where no packages need excluding
 if [[ "${#INCLUDED_PACKAGES[@]}" -gt 0 && "${#INSTALLED_EXCLUDED_PACKAGES[@]}" -eq 0 ]]; then
-    rpm-ostree install \
+    dnf5 -y install \
         ${INCLUDED_PACKAGES[@]}
 
 # install/excluded packages both at same time
 elif [[ "${#INCLUDED_PACKAGES[@]}" -gt 0 && "${#INSTALLED_EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
-    rpm-ostree override remove \
-        ${INSTALLED_EXCLUDED_PACKAGES[@]} \
-        $(printf -- "--install=%s " ${INCLUDED_PACKAGES[@]})
+    dnf5 -y remove \
+        ${INSTALLED_EXCLUDED_PACKAGES[@]} && \
+    dnf5 -y install \
+        ${INCLUDED_PACKAGES[@]}
 else
     echo "No packages to install."
 fi
@@ -46,6 +47,6 @@ fi
 
 # remove any excluded packages which are still present on image
 if [[ "${#INSTALLED_EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
-    rpm-ostree override remove \
+    dnf5 -y remove \
         ${INSTALLED_EXCLUDED_PACKAGES[@]}
 fi

build_files/base/05-override-install.sh

@@ -4,48 +4,33 @@ set -eoux pipefail
 
 # Patched shells
 if [[ "${BASE_IMAGE_NAME}" =~ silverblue ]]; then
-    rpm-ostree override replace \
-    --experimental \
-    --from repo=copr:copr.fedorainfracloud.org:ublue-os:staging \
-        gnome-shell
+    dnf5 -y swap \
+    --repo=copr:copr.fedorainfracloud.org:ublue-os:staging \
+        gnome-shell gnome-shell
 elif [[ "${BASE_IMAGE_NAME}" =~ kinoite ]]; then
-    rpm-ostree override replace \
-    --experimental \
-    --from repo=copr:copr.fedorainfracloud.org:ublue-os:staging \
-        kf6-kio-doc \
-        kf6-kio-widgets-libs \
-        kf6-kio-core-libs \
-        kf6-kio-widgets \
-        kf6-kio-file-widgets \
-        kf6-kio-core \
-        kf6-kio-gui
+    dnf5 -y swap \
+    --repo=copr:copr.fedorainfracloud.org:ublue-os:staging \
+        kf6-kio-core kf6-kio-core
 fi
 
 # GNOME Triple Buffering
 if [[ "${BASE_IMAGE_NAME}" =~ silverblue && "${FEDORA_MAJOR_VERSION}" -lt "41" ]]; then
-    rpm-ostree override replace \
-    --experimental \
-    --from repo=copr:copr.fedorainfracloud.org:ublue-os:staging \
-        mutter \
-        mutter-common
+    dnf5 -y swap \
+    --repo=copr:copr.fedorainfracloud.org:ublue-os:staging \
+        mutter mutter
 fi
 
 # Fix for ID in fwupd
-rpm-ostree override replace \
-    --experimental \
-    --from repo=copr:copr.fedorainfracloud.org:ublue-os:staging \
-        fwupd \
-        fwupd-plugin-flashrom \
-        fwupd-plugin-modem-manager \
-        fwupd-plugin-uefi-capsule-data
+dnf5 -y swap \
+    --repo=copr:copr.fedorainfracloud.org:ublue-os:staging \
+        fwupd fwupd
 
 # Switcheroo patch
-rpm-ostree override replace \
-    --experimental \
-    --from repo=copr:copr.fedorainfracloud.org:sentry:switcheroo-control_discrete \
-        switcheroo-control
+dnf5 -y swap \
+    --repo=copr:copr.fedorainfracloud.org:sentry:switcheroo-control_discrete \
+        switcheroo-control switcheroo-control
 
-rm /etc/yum.repos.d/_copr_sentry-switcheroo-control_discrete.repo
+dnf5 -y copr remove sentry/switcheroo-control_discrete
 
 # Starship Shell Prompt
 curl --retry 3 -Lo /tmp/starship.tar.gz "https://github.com/starship/starship/releases/latest/download/starship-x86_64-unknown-linux-gnu.tar.gz"
@@ -61,7 +46,7 @@ curl --retry 3 -Lo /usr/share/bash-prexec https://raw.githubusercontent.com/rcal
 pip install --prefix=/usr topgrade
 
 # Install ublue-update -- breaks with packages.json due to missing topgrade
-rpm-ostree install ublue-update
+dnf5 -y install ublue-update
 
 # Consolidate Just Files
 find /tmp/just -iname '*.just' -exec printf "\n\n" \; -exec cat {} \; >> /usr/share/ublue-os/just/60-custom.just

build_files/base/07-base-image-changes.sh

@@ -8,7 +8,7 @@ if [[ "${BASE_IMAGE_NAME}" = "kinoite" ]]; then
 
     # Restore x11 for Nvidia Images
     if [[ "${FEDORA_MAJOR_VERSION}" -eq "40" ]]; then
-        rpm-ostree install plasma-workspace-x11
+        dnf5 -y install plasma-workspace-x11
     fi
 
     # Branding for Images

build_files/base/09-hwe-additions.sh

@@ -35,7 +35,7 @@ SURFACE_PACKAGES=(
     pipewire-plugin-libcamera
 )
 
-rpm-ostree install \
+dnf5 -y install \
     "${ASUS_PACKAGES[@]}" \
     "${SURFACE_PACKAGES[@]}"
 

build_files/base/17-cleanup.sh

@@ -29,8 +29,10 @@ rm -f /etc/xdg/autostart/solaar.desktop
 sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/negativo17-fedora-multimedia.repo
 sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/tailscale.repo
 sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/charm.repo
-sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/ublue-os-staging-fedora-"${FEDORA_MAJOR_VERSION}".repo
-sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_che-nerd-fonts-"${FEDORA_MAJOR_VERSION}".repo
+dnf5 -y copr disable ublue-os/staging
+dnf5 -y copr disable che/nerd-fonts
+dnf5 -y copr disable phracek/PyCharm
+# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming
 sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo
 sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo
 for i in /etc/yum.repos.d/rpmfusion-*; do

build_files/base/19-initramfs.sh

@@ -9,5 +9,5 @@ else
 fi
 
 QUALIFIED_KERNEL="$(rpm -qa | grep -P 'kernel-(|'"$KERNEL_SUFFIX"'-)(\d+\.\d+\.\d+)' | sed -E 's/kernel-(|'"$KERNEL_SUFFIX"'-)//')"
-/usr/libexec/rpm-ostree/wrapped/dracut --no-hostonly --kver "$QUALIFIED_KERNEL" --reproducible -v --add ostree -f "/lib/modules/$QUALIFIED_KERNEL/initramfs.img"
+/usr/bin/dracut --no-hostonly --kver "$QUALIFIED_KERNEL" --reproducible -v --add ostree -f "/lib/modules/$QUALIFIED_KERNEL/initramfs.img"
 chmod 0600 "/lib/modules/$QUALIFIED_KERNEL/initramfs.img"

build_files/dx/01-install-copr-repos-dx.sh

@@ -3,31 +3,25 @@
 set -eoux pipefail
 
 #incus, lxc, lxd
+
 if [[ "${FEDORA_MAJOR_VERSION}" -lt "42" ]]; then
-    curl -Lo /etc/yum.repos.d/ganto-lxc4-fedora-"${FEDORA_MAJOR_VERSION}".repo \
-        https://copr.fedorainfracloud.org/coprs/ganto/lxc4/repo/fedora-"${FEDORA_MAJOR_VERSION}"/ganto-lxc4-fedora-"${FEDORA_MAJOR_VERSION}".repo
+    dnf5 -y copr enable ganto/lxc4
 fi
 
 #umoci
-curl --retry 3 -Lo /etc/yum.repos.d/ganto-umoci-fedora-"${FEDORA_MAJOR_VERSION}".repo \
-    https://copr.fedorainfracloud.org/coprs/ganto/umoci/repo/fedora-"${FEDORA_MAJOR_VERSION}"/ganto-umoci-fedora-"${FEDORA_MAJOR_VERSION}".repo
+dnf5 -y copr enable ganto/umoci
 
 #ublue-os staging
-curl --retry 3 -Lo /etc/yum.repos.d/ublue-os-staging-fedora-"${FEDORA_MAJOR_VERSION}".repo \
-    https://copr.fedorainfracloud.org/coprs/ublue-os/staging/repo/fedora-"${FEDORA_MAJOR_VERSION}"/ublue-os-staging-fedora-"${FEDORA_MAJOR_VERSION}".repo
+dnf5 -y copr enable ublue-os/staging
 
 #karmab-kcli
-curl --retry 3 -Lo /etc/yum.repos.d/karmab-kcli-fedora-"${FEDORA_MAJOR_VERSION}".repo \
-    https://copr.fedorainfracloud.org/coprs/karmab/kcli/repo/fedora-"${FEDORA_MAJOR_VERSION}"/karmab-kcli-fedora-"${FEDORA_MAJOR_VERSION}".repo
+dnf5 -y copr enable karmab/kcli
 
 # Fonts
-curl --retry 3 -Lo /etc/yum.repos.d/atim-ubuntu-fonts-fedora-"${FEDORA_MAJOR_VERSION}".repo \
-    https://copr.fedorainfracloud.org/coprs/atim/ubuntu-fonts/repo/fedora-"${FEDORA_MAJOR_VERSION}"/atim-ubuntu-fonts-fedora-"${FEDORA_MAJOR_VERSION}".repo
+dnf5 -y copr enable atim/ubuntu-fonts
 
 # Kvmfr module
-curl --retry 3 -Lo /etc/yum.repos.d/hikariknight-looking-glass-kvmfr-fedora-"${FEDORA_MAJOR_VERSION}".repo \
-    https://copr.fedorainfracloud.org/coprs/hikariknight/looking-glass-kvmfr/repo/fedora-"${FEDORA_MAJOR_VERSION}"/hikariknight-looking-glass-kvmfr-fedora-"${FEDORA_MAJOR_VERSION}".repo
+dnf5 -y copr enable hikariknight/looking-glass-kvmfr
 
 # Podman-bootc
-curl --retry 3 -Lo /etc/yum.repos.d/gmaglione-podman-bootc-fedora-"${FEDORA_MAJOR_VERSION}".repo \
-    https://copr.fedorainfracloud.org/coprs/gmaglione/podman-bootc/repo/fedora-"${FEDORA_MAJOR_VERSION}"/gmaglione-podman-bootc-fedora-"${FEDORA_MAJOR_VERSION}".repo
+dnf5 -y copr enable gmaglione/podman-bootc

build_files/dx/02-install-kernel-akmods-dx.sh

@@ -2,6 +2,7 @@
 
 set -ouex pipefail
 
+# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming
 sed -i 's@enabled=0@enabled=1@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo
 
 # Fetch Kernel RPMS
@@ -11,7 +12,7 @@ tar -xvzf /tmp/kernel-rpms/"$KERNEL_TARGZ" -C /
 mv /tmp/rpms/* /tmp/kernel-rpms/
 
 if [[ -z "$(grep kernel-devel <<< $(rpm -qa))" ]]; then
-    rpm-ostree install /tmp/kernel-rpms/kernel-devel-*.rpm
+    dnf5 -y install /tmp/kernel-rpms/kernel-devel-*.rpm
 fi
 
 # Fetch AKMODS RPMS
@@ -21,4 +22,4 @@ tar -xvzf /tmp/akmods/"$AKMODS_TARGZ" -C /tmp/
 mv /tmp/rpms/* /tmp/akmods/
 
 # Install RPMS
-rpm-ostree install /tmp/akmods/kmods/*kvmfr*.rpm
+dnf5 -y install /tmp/akmods/kmods/*kvmfr*.rpm

build_files/dx/03-packages-dx.sh

@@ -30,14 +30,15 @@ fi
 
 # simple case to install where no packages need excluding
 if [[ "${#INCLUDED_PACKAGES[@]}" -gt 0 && "${#INSTALLED_EXCLUDED_PACKAGES[@]}" -eq 0 ]]; then
-    rpm-ostree install \
+    dnf5 -y install \
         ${INCLUDED_PACKAGES[@]}
 
 # install/excluded packages both at same time
 elif [[ "${#INCLUDED_PACKAGES[@]}" -gt 0 && "${#INSTALLED_EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
-    rpm-ostree override remove \
-        ${INSTALLED_EXCLUDED_PACKAGES[@]} \
-        $(printf -- "--install=%s " ${INCLUDED_PACKAGES[@]})
+    dnf5 -y remove \
+        ${INSTALLED_EXCLUDED_PACKAGES[@]} && \
+    dnf5 -y install \
+        ${INCLUDED_PACKAGES[@]}
 else
     echo "No packages to install."
 fi
@@ -50,6 +51,6 @@ fi
 
 # remove any excluded packages which are still present on image
 if [[ "${#INSTALLED_EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
-    rpm-ostree override remove \
+    dnf5 -y remove \
         ${INSTALLED_EXCLUDED_PACKAGES[@]}
 fi

build_files/dx/09-cleanup-dx.sh

@@ -11,17 +11,19 @@ systemctl enable --global bluefin-dx-user-vscode.service
 systemctl disable pmie.service
 systemctl disable pmlogger.service
 
-sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/ublue-os-staging-fedora-"${FEDORA_MAJOR_VERSION}".repo
-if [[ -f /etc/yum.repos.d/ganto-lxc4-fedora-"${FEDORA_MAJOR_VERSION}".repo ]]; then
-    sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/ganto-lxc4-fedora-"${FEDORA_MAJOR_VERSION}".repo
+dnf5 -y copr disable ublue-os/staging
+if [[ "${FEDORA_MAJOR_VERSION}" -lt "42" ]]; then
+    dnf5 -y copr disable ganto/lxc4
 fi
-sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/ganto-umoci-fedora-"${FEDORA_MAJOR_VERSION}".repo
-sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/karmab-kcli-fedora-"${FEDORA_MAJOR_VERSION}".repo
-sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/atim-ubuntu-fonts-fedora-"${FEDORA_MAJOR_VERSION}".repo
+dnf5 -y copr disable ganto/umoci
+dnf5 -y copr disable karmab/kcli
+dnf5 -y copr disable atim/ubuntu-fonts
+dnf5 -y copr disable hikariknight/looking-glass-kvmfr
 sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/vscode.repo
 sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/docker-ce.repo
-sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr:copr.fedorainfracloud.org:phracek:PyCharm.repo
+dnf5 -y copr disable phracek/PyCharm
 sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo
+# NOTE: we won't use dnf5 copr plugin for ublue-os/akmods until our upstream provides the COPR standard naming
 sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/_copr_ublue-os-akmods.repo
 
 for i in /etc/yum.repos.d/rpmfusion-*; do

build_files/shared/build-base.sh

@@ -2,6 +2,23 @@
 
 set -eoux pipefail
 
+# there is no 'rpm-ostree cliwrap uninstall-from-root', but this is close enough. See:
+# https://github.com/coreos/rpm-ostree/blob/6d2548ddb2bfa8f4e9bafe5c6e717cf9531d8001/rust/src/cliwrap.rs#L25-L32
+if [ -d /usr/libexec/rpm-ostree/wrapped ]; then
+    # binaries which could be created if they did not exist thus may not be in wrapped dir
+    rm -f \
+        /usr/bin/yum \
+        /usr/bin/dnf \
+        /usr/bin/kernel-install
+    # binaries which were wrapped
+    mv -f /usr/libexec/rpm-ostree/wrapped/* /usr/bin
+    rm -fr /usr/libexec/rpm-ostree
+fi
+
+if [ ${FEDORA_MAJOR_VERSION} -lt 41 ]; then
+    rpm-ostree install --idempotent dnf5 dnf5-plugins
+fi
+
 # Make Alternatives Directory
 mkdir -p /var/lib/alternatives
 

build_files/shared/clean-stage.sh

@@ -1,8 +1,7 @@
 #!/usr/bin/bash
 
 set -eoux pipefail
-shopt -s extglob
 
 rm -rf /tmp/* || true
-rm -rf /var/!(cache)
-rm -rf /var/cache/!(rpm-ostree)
+find /var/* -maxdepth 0 -type d \! -name cache -exec rm -fr {} \;
+find /var/cache/* -maxdepth 0 -type d \! -name libdnf5 \! -name rpm-ostree -exec rm -fr {} \;