Add support for openSUSE distribution #123

val4oss · 2025-11-17T17:16:52Z

Add new sub-image "initrd" to control the initrd content.
- Un-blacklist the erofs for openSUSE image.
openSUSE obs profile
configurations for basic openSUSE Tumbleweed image.

mkosi.profiles/obs/mkosi.conf.d/opensuse-tools.conf

Vogtinator · 2025-11-24T08:38:58Z

mkosi.images/initrd/mkosi.conf.d/opensuse.conf

+# by default erofs is blacklisted in openSUSE and UKIs use erofs for the usrfs
+# we need to remove the blacklist to be able to mount erofs usrfs
+RemoveFiles=
+        /usr/lib/modprobe.d/60-blacklist_fs-erofs.conf


Instead of removing files in /usr, link /etc/modprobe.d/60-blacklist_fs-erofs.conf to /dev/null.

Or is it possible to use something other than erofs?

Thank you for your feed-back 👍

With mkosi config, we cannot directly put a link. However, I can try to add in an extraTree a link that will override /etc/modprobe.d/60-blacklist_fs-erofs.conf

I would also prefer to use another file-system that we do not blacklist, but for my understanding, particleos depends on a filesystem architecture under erofs. Indeed, UKI expects to find the /usr, /usr-verity, and /usr-verity-sign partitions, which, it seems to me, are dependent on erofs. Also it is from the prerequisite of the particleos to have a read-only filesystem.

If we want to best adapt our openSUSE distribution for particleOS, without adding too much complexity to the openSUSE image, I think it's preferable to adapt to erofs?

Unless you have an idea for using btrfs or another non-blacklisted filesystem, I would be happy to try implementing it. 😉

With mkosi config, we cannot directly put a link.

Prepare scripts may work, or just an empty file instead of a link to /dev/null?

Unless you have an idea for using btrfs or another non-blacklisted filesystem, I would be happy to try implementing it. 😉

squashfs maybe?

I think we might have to dig up why erofs got blacklisted in the first place to find a way forward here.

Prepare scripts may work, or just an empty file instead of a link to /dev/null?

Good point, now that the initrd can be customizable we would be able to integrate scripts like the prepare, or better, the postinst or finalize one.
I will apply this changes to have a link to dev/null instead.

Thanks for the idea

squashfs maybe?

It make a lot of sense to use at instead. But with mkosi conf, can we easily override the mkosi.repart config to have one dedicated for a distribution ?

I think we might have to dig up why erofs got blacklisted in the first place to find a way forward here.

I fully agree to dig up. After a quick search, erofs appears to be blacklisted because it's not supported due to low usage. We can refer to this documentation explaining how to unblacklist this filesystem: https://en.opensuse.org/SDB:FilesystemBlacklisting#Unblacklisting_a_File_System_Module

Nevertheless, I will investigate further.

With the last changes, the blacklist file is list to /dev/null. For now, I a m unable to override the mkosi.repart/12-usr.conf to force having a usr partition in squashfs for opensuse distribution. I don't know yet if it is possible to do that.

...

I think we might have to dig up why erofs got blacklisted in the first place to find a way forward here.

I fully agree to dig up. After a quick search, erofs appears to be blacklisted because it's not supported due to low usage. We can refer to this documentation explaining how to unblacklist this filesystem: https://en.opensuse.org/SDB:FilesystemBlacklisting#Unblacklisting_a_File_System_Module

Nevertheless, I will investigate further.

I'd say that is just (biased) suse policy (I'm not sure how I can change this), for RHEL, there is
https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html-single/considerations_in_adopting_rhel_10/index#:~:text=The%20squashfs%20package%20has%20been%20deprecated

Thanks @hsiangkao for the link, I was not aware that squashfs has been deprecated from RHEL 10, it is good to know 👍

From openSUSE status: there is actually an internal discussion about the idea to unblacklist the erofs (No decision has been taken, it is just discussion at the moment).

Nevertheless, as the topic of this request is to add the openSUSE image to the particleOS, with the unblacklist workaround from the initrd, it works. FMHO, We can continue with this, and whatever decisions are made, if erofs is no longer blacklisted in the future, I will remove this workaround. And if the particleOS project is given the ability to change the filesystem of the /usr partition depending on the distribution, then I will do what is necessary to install squashfs for openSUSE. 😃

jcgl17 · 2025-12-12T11:10:27Z

mkosi.conf.d/opensuse/mkosi.conf

+
+[Distribution]
+Release=tumbleweed
+Repositories=non-oss


What requires that the non-oss repository be enabled? OpenSUSE themselves do not enable non-oss by default, so why should ParticleOS?

I'm just a user and would-be ParticleOS contributor, so I can't speak for the maintainers of ParticleOS and systemd. But IMO non-free software should always be opt-in, unless there are very significant reasons to do otherwise. If you see such a need here, please elaborate on that.

There is no need for non-oss to be enabled by default. It shouldn't be part of the base profile.

Thanks for the feed-back
I had based my work on the mkosi configuration files in the systemd-testsuite project, but you are absolutely right, and non-oss should not be there. I'm removing it with the latest modifications.

jcgl17 · 2025-12-12T12:04:48Z

mkosi.conf.d/opensuse/mkosi.conf

+        xz
+        zypper
+
+VolatilePackages=


Relatively small thing, but why are these packages listed out so explicitly, rather than letting the package manager resolve dependencies? Try looking at the corresponding mkosi.conf for the existing distros and working from there. If you need to diverge from what those config files do, please provide rationale in a comment.

Thanks for this comment. I was initially inspired by the list of packages used to create the minimla tumbleweed image as we can found here: https://build.opensuse.org/projects/openSUSE:Factory:ToTest/packages/opensuse-tumbleweed-image/files/config.kiwi?expand=1

But you're absolutely right, and in the ParticleOS environment, it's better to start with an existing distro. So, with the latest changes, I've adapted the list accordingly, hoping it will be better.

jcgl17 · 2025-12-12T12:05:16Z

mkosi.images/initrd/mkosi.conf.d/opensuse/mkosi.conf

+
+[Content]
+# Main pcrlock files has been move from experimental to udev package but some
+# needed files are still in systemd-experimental.


Which files? Would be good to know when this can be removed.

I added the list of requires missing files. Unfortunately, these files will remains in systemd-experimental package at the moment, I don't think there are plans to move them.

Doesn't look like you adjusted VolatilePackages= at all.

Indeed, thanks, should be better now :)

Conan-Kudo · 2025-12-12T18:17:59Z

mkosi.profiles/obs/opensuse.repo

+name=Base:System Factory Devel Project (openSUSE_Tumbleweed)
+type=rpm-md
+baseurl=https://download.opensuse.org/repositories/system:/systemd/openSUSE_Tumbleweed/
+gpgcheck=0


This should be =1 instead of =0.

Not sure if it is possible to verify the signature of the custom repo to system:systemd with zypper in that stage. There is no script that can auto-import-gpg before the creation of the sandboxtree. I wasn't able to get rid of the Signature veirification with zypper.

Try looking at the gpgkey setting in the corresponding Fedora file. Maybe the file pointed to by that setting has an equivalent in openSUSE.

As already discussed in this issue report from zypper: openSUSE/zypper#528 (comment), at the moment there is no option for zypper to fetch local gpg key. The keys need to be trusted from the rpmdb, so it needs to call rpm --import PUBKEY ... at least first.
gpgkey settings int he corresponding Fedora file cannot have an equivalent in openSUSE.

If I'm understanding correctly then, rpm --import PUBKEY ... or any other needed commands should be called in a script run by mkosi. Maybe someone more knowledgeable can weigh in here, but I assume that mkosi.sync/SyncScripts= would be the appropriate place here:

If mkosi.sync (SyncScripts=) exists, it is executed before the image is built. This script may be used to update various sources that are used to build the image.

This script also run too late, see https://github.com/systemd/mkosi/blob/main/mkosi/resources/man/mkosi.1.md#execution-flow there aren't any scripts called before the step2: "Sync the package manager repository metadata"

Maybe that's worth filing an issue or asking about in the Matrix room.

Conan-Kudo · 2025-12-12T18:18:47Z

Why is Base:System added here? systemd is fairly up-to-date in Tumbleweed itself.

val4oss · 2025-12-12T18:31:41Z

Why is Base:System added here? systemd is fairly up-to-date in Tumbleweed itself.

It is not Base:System it is system:systemd project for the obs profile. As it is done for other distros with obs profile. I just figured out that the title of the repo is wrong, I will correct it (because from my test I used Base:system as it has the v258 where in Tumbleweed it is still v257)

* configurations for basic openSUSE Tumbleweed image. * Add new sub-image "initrd" to control the initrd content. * Un-blacklist the erofs for openSUSE image. * Add systemd-experimental for missing pcrlock files * openSUSE obs profile Signed-off-by: val4oss <val4oss@pm.me>

val4oss marked this pull request as draft November 19, 2025 14:44

val4oss force-pushed the opensuse branch from 1c440a5 to 4522824 Compare November 21, 2025 16:37

val4oss marked this pull request as ready for review November 21, 2025 16:38

Vogtinator reviewed Nov 24, 2025

View reviewed changes

mkosi.profiles/obs/mkosi.conf.d/opensuse-tools.conf Show resolved Hide resolved

Vogtinator reviewed Nov 24, 2025

View reviewed changes

val4oss force-pushed the opensuse branch 2 times, most recently from 51fcea4 to e9a59eb Compare November 25, 2025 13:43

jcgl17 reviewed Dec 12, 2025

View reviewed changes

val4oss force-pushed the opensuse branch from e9a59eb to 5685d2a Compare December 12, 2025 18:16

Conan-Kudo suggested changes Dec 12, 2025

View reviewed changes

val4oss force-pushed the opensuse branch from 5685d2a to 8500170 Compare December 12, 2025 18:33

val4oss force-pushed the opensuse branch from 8500170 to 51fcf8e Compare December 15, 2025 11:43

Add support for openSUSE distribution #123

Are you sure you want to change the base?

Add support for openSUSE distribution #123

Uh oh!

Conversation

val4oss commented Nov 17, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hsiangkao Dec 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jcgl17 Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jcgl17 Dec 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Conan-Kudo commented Dec 12, 2025

Uh oh!

val4oss commented Dec 12, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

hsiangkao Dec 11, 2025 •

edited

Loading

jcgl17 Dec 12, 2025 •

edited

Loading

jcgl17 Dec 13, 2025 •

edited

Loading