Downloads the JUnit XML artifacts from the downstream openQA jobs,
then names them according to their test flow, collecting them as a
test report so we can have a nice summary in merge requests.
It wasn't getting enabled because it lacked an [Installed] section. But
we can also turn it on in a different way, by shipping a symlink in
/usr, which also acts as a proper factory default.
Dirty Frag has been fixed upstream:
- xfrm-ESP Page-Cache Write (CVE-2026-43284) was patched in mainline f4c50a4034e6
- RxRPC Page-Cache Write (CVE-2026-43500) was patched in mainline aa54b1d27fe0
Reference: https://github.com/V4bel/dirtyfragFixes#673
This reverts commit 486cf7bc9f.
We don't need a watchdog for normal desktop use cases. Expressing that
intention, we had already set kernel.nmi_watchdog = 0 to disable the
kernel panic watchdog.
We can go further and instead use the "nowatchdog" kernel parameter to
disable *all* of them, and then additionally blacklist their kernel
modules. This should have a very slightly positive impact on battery
life and boot/shutdown times.
Ensure users are only faced with one polkit prompt when running certain
commands, and ensure they use POSIX sh function syntax, not bash, as the
shebang is for /bin/sh.
Clean up the paths a bit and leverage the pre-existing 3 day
lifecycle rule in ci-artifacts that will delete stale artifacts.
Implement support for transfers between buckets in publisher, with
explicit source and destination URLs.
This makes CI green and lets the pipelines finish if publish-manual
is never run. Also be explicit that the publish job should never show up
outside of a protected branch in kde-linux/kde-linux.
Ensures we can't have two publish jobs running at the same time that
point to the same staging directory. Also ensures that publish will
immediately exit if there's nothing to stage, so we aren't vacuuming
prematurely.
Download secure files before staging builds, so mkosi can embed the
public key into the image again, and so it can import the public key for
us. Also explicitly create the GPG homedir again and import the public
key in the publish step because mkosi won't have created it there.
Integrates OpenQA image testing into CI.
Builds images once in the imaging job, then passes the resulting image and
update channel to the OpenQA pipeline in kde-linux/os-autoinst-distri-kdelinux.
For regular test builds, upload the built ISO and a temporary sysupdate tree
to ci-artifacts on storage.kde.org. The resulting IMAGE_URL, STAGING_CHANNEL_URL
and ephemeral update signing key are exported through the imaging job dotenv
artifact so OpenQA can boot the image and run upgrade tests against the build
under test.
For protected default-branch builds, stage the release artifacts under a
per-job staging prefix in the kde-linux bucket. OpenQA tests the staged ISO
and sysupdate channel before the publish job is allowed to run.
Publishing downloads the staged artifacts, uploads the public ISO/torrent and
sysupdate assets to files.kde.org, chunks and uploads the root to the desync
chunk store, then merges the staged S3 tree into the live tree on the bucket
and regenerates the published SHA256SUMS.
Adds a `kde-linux-collect-logs` command-line tool that collects system
diagnostics into a single timestamped `.tar.zst` archive for attaching
to bug reports. It gathers a system summary, a full `inxi -Faz` dump,
graphics info (`drm_info`, `kscreen-doctor -o`), the environment,
`/etc/fstab`, `dmesg`, boot journals, and a few KDE-specific extras,
writing each to its own file and skipping missing tools gracefully.
Refuses to run inside a container, and `inxi -z` auto-filters MACs and
serials.
Also adds `inxi` to the CLI package set, since it forms the basis of
the report.
Resolves#547
