Skip to content

Conversation

Copy link

Copilot AI commented Nov 30, 2025

  • Create directory structure (.github/workflows/, config/, initramfs/, scripts/)
  • Create GitHub Actions workflows (build.yml, release.yml, build-uki.yml)
  • Create kernel command line configuration files (config/cmdline.d/)
  • Create systemd-boot loader configuration (config/loader/loader.conf)
  • Create distro profile boot entries using UKI format (config/loader/entries/*.conf)
  • Create per-profile cmdline files for UKI embedding (config/cmdline.d/profiles/)
  • Create initramfs configuration (initramfs/config.yaml and hooks/modules dirs)
  • Create build scripts (scripts/build-uki.sh, scripts/fetch-deps.sh, scripts/create-usb.sh, scripts/build-initramfs.sh)
  • Create Containerfile for build environment
  • Create Makefile for build orchestration
  • Create CLAUDE.md with AI assistant instructions
  • Create comprehensive README.md documentation
  • Run code review and fix issues
  • Run security checks and add explicit workflow permissions
  • Fix kernel detection for containerized builds (detect installed kernel from /lib/modules/)
  • Fix GITHUB_REPOSITORY variable usage in release.yml heredoc
  • Simplify unnecessary cat command substitution in build-uki.sh
  • Fix unquoted $initdir variable in bitboot-network-pull.sh
  • Update Alpine Linux URLs to use edge release and remove non-existent config-lts file
  • Clarify systemd version requirement comment (v258 introduced rd.systemd.pull)
  • Update Fedora version from 41 to 43 (Containerfile, workflows)
  • Split workflows into modular jobs (each distro builds independently so failures don't block others)
  • Replace Fedora CoreOS with uCore (ublue-os/ucore) profile
Original prompt

BitBoot Repository Initialization Prompt

Context & Objective

Initialize a new GitHub repository called bitboot that builds a multiboot USB system producing a unified kernel image (bitboot.efi). This UKI serves as a meta-bootloader combining ZFSBootMenu, netboot.xyz, and systemd-boot into a single portable EFI binary with the revolutionary capability to pull and boot raw disk images directly from HTTP/HTTPS sources at boot time using systemd v258's rd.systemd.pull functionality.

The core innovation is leveraging systemd-import-generator to dynamically download, decompress, and loopback-mount raw disk images before pivoting root—enabling network-booted ephemeral Linux environments from a single USB drive without pre-downloading ISOs. Boot entries are defined as standard systemd-boot loader entries (/loader/entries/*.conf) where each distro profile specifies its pull URL and root device reference.

Technical Architecture

The bitboot.efi unified kernel image must embed:

  1. systemd-stub as the UEFI stub loader
  2. Custom initramfs containing:
    • systemd v258+ with systemd-importd, systemd-import-generator, and rd.systemd.pull support
    • Network stack (networkd, resolved) for HTTP/HTTPS fetching
    • Compression support (xz, zstd, gzip) for decompressing pulled images
    • Loop device support for attaching downloaded raw images to /dev/loop*
    • Minimal shell for recovery/debugging
  3. Embedded kernel with appropriate driver support
  4. ZFSBootMenu components for ZFS pool discovery and BE management
  5. netboot.xyz EFI chainloading capability
  6. systemd-boot configuration for the distro profile menu

ZFSBootMenu Integration Benefits

ZFSBootMenu's recovery environment provides critical capabilities for ZFS administration without requiring a separate boot medium:

  • Pre-compiled ZFS modules matching the embedded kernel (avoids DKMS/kernel mismatch issues)
  • Full ZFS userspace tools: zpool, zfs, zdb, zstream, zinject
  • Recovery shell with networking, SSH, and essential utilities
  • Boot environment management: snapshot, clone, rollback, chroot into any BE
  • Key management for native ZFS encryption

This means users can boot bitboot.efi, enter the ZFSBootMenu recovery shell, and perform tasks like:

  • Creating new ZFS pools for fresh installations
  • Recovering broken boot environments
  • Following the OpenZFS Root on ZFS guide directly
  • Importing/exporting pools from external drives

Boot flow: UEFI → bitboot.efi → systemd-boot menu → select distro profile → rd.systemd.pull downloads image → loopback attach → pivot root → boot into downloaded OS.

Repository Structure Requirements

Create the following layout:

bitboot/
├── .github/
│   └── workflows/
│       ├── build.yml              # Main CI/CD workflow
│       └── release.yml            # Tagged release automation
├── config/
│   ├── cmdline.d/                 # Kernel command line fragments
│   │   ├── base.conf              # Common options (console, logging)
│   │   └── network.conf           # Network boot prerequisites
│   ├── loader/
│   │   ├── loader.conf            # systemd-boot configuration
│   │   └── entries/
│       │   ├── archlinux.conf     # Arch Linux raw image profile
│       │   ├── fedora.conf        # Fedora CoreOS profile
│       │   ├── debian.conf        # Debian live profile
│       │   ├── zfsbootmenu.conf   # ZFSBootMenu chainload
│       │   └── netboot.conf       # netboot.xyz chainload
├── initramfs/
│   ├── hooks/                     # Dracut/mkinitcpio hooks
│   ├── modules/                   # Custom initramfs modules
│   └── config.yaml                # Initramfs generation config
├── scripts/
│   ├── build-uki.sh               # UKI assembly script
│   ├── fetch-deps.sh              # Download ZFSBootMenu/netboot.xyz
│   └── create-usb.sh              # USB image creation
├── Containerfile                  # Build environment container
├── Makefile                       # Build orchestration
├── CLAUDE.md                      # AI assistant instructions
└── README.md                      # Documentation

Distro Profile Entry Format

Each loader entry uses this pattern leveraging rd.systemd.pull:

# /loader/entries/archlinux.conf
title     Arch Linux (Network Pull)
linux     /vmlinuz-linux
initrd    /initramfs-bitboot.img
options   rd.systemd.pull=raw,machine,verify=no,blockdev:archlinux:https://geo.mirror.pkgbuild.com/iso/latest/archlinux-x86_64.iso root=/dev/disk/by-loop-ref/archlinux.raw ip=dhcp

For proper raw images (not ISOs), the pattern is:

# /loader/entries/fedora-coreos.conf  
title     Fedora CoreOS
linux     /vmlinuz-linux
initrd    /initramfs-bitboot.img
options   rd.systemd.pull=raw,machine,verify=no,blockdev:rootdisk:https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/40.2...

</details>



<!-- START COPILOT CODING AGENT TIPS -->
---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our [2 minute survey](https://gh.io/copilot-coding-agent-survey).

Copilot AI and others added 2 commits November 30, 2025 04:00
Co-authored-by: danielbodnar <1790726+danielbodnar@users.noreply.github.com>
Co-authored-by: danielbodnar <1790726+danielbodnar@users.noreply.github.com>
Copilot AI changed the title [WIP] Initialize GitHub repository for BitBoot multiboot system Initialize BitBoot multiboot USB system with rd.systemd.pull support Nov 30, 2025
Copilot AI requested a review from danielbodnar November 30, 2025 04:05
@danielbodnar
Copy link
Contributor

@copilot This build failed, please review and fix https://github.com/bitbuilder-io/bitboot/actions/runs/19793549828/job/56710662467#step:8:18 and repeat until the build succeeds.

Co-authored-by: danielbodnar <1790726+danielbodnar@users.noreply.github.com>
Copy link
Author

Copilot AI commented Nov 30, 2025

@copilot This build failed, please review and fix https://github.com/bitbuilder-io/bitboot/actions/runs/19793549828/job/56710662467#step:8:18 and repeat until the build succeeds.

Fixed in commit 4b38281. The build was failing because uname -r returns the host kernel version (Azure VM's 6.11.0-1018-azure) instead of the installed kernel in the Fedora container (6.17.8-100.fc41). Updated build-initramfs.sh to detect installed kernels from /lib/modules/ when running in a containerized environment. The new workflow run is pending approval.

@danielbodnar danielbodnar marked this pull request as ready for review November 30, 2025 04:24
Copilot AI review requested due to automatic review settings November 30, 2025 04:24
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request initializes the BitBoot repository, a multiboot USB system that creates unified kernel images (UKIs) capable of booting raw disk images from HTTP/HTTPS sources using systemd v258's rd.systemd.pull functionality.

Key Changes:

  • Complete directory structure and build system implementation (scripts, Makefile, Containerfile, CI/CD workflows)
  • Boot profile configurations for multiple distributions using UKI format with embedded command lines
  • Custom initramfs modules and hooks for network pull, ZFS support, and systemd-import integration

Reviewed changes

Copilot reviewed 34 out of 34 changed files in this pull request and generated 25 comments.

Show a summary per file
File Description
scripts/fetch-deps.sh Downloads ZFSBootMenu, netboot.xyz, and Alpine Linux components with retry logic
scripts/create-usb.sh Creates bootable USB image with GPT/ESP layout and installs all UKIs and dependencies
scripts/build-uki.sh Builds unified kernel images for each profile using ukify or objcopy fallback
scripts/build-initramfs.sh Generates custom initramfs with dracut, includes systemd v258+ components
initramfs/modules/bitboot-pull.sh Dracut module for rd.systemd.pull support with network and compression tools
initramfs/modules/bitboot-pull-premount.sh Pre-mount hook ensuring network availability before image pull
initramfs/hooks/bitboot-zfs.sh ZFS support module with kernel modules and userspace tools
initramfs/hooks/bitboot-network-pull.sh Network pull support with systemd-importd integration
initramfs/config.yaml Dracut configuration defining modules, drivers, and binaries for initramfs
config/loader/loader.conf systemd-boot configuration with timeout and console settings
config/loader/entries/*.conf Boot menu entries for all profiles (chainload EFI binaries)
config/cmdline.d/profiles/*.conf Per-profile kernel command lines embedded into respective UKIs
config/cmdline.d/base.conf Common kernel parameters for console and logging
config/cmdline.d/network.conf Network boot prerequisites with DHCP and systemd-networkd
Makefile Build orchestration with targets for deps, initramfs, uki, and usb creation
Containerfile Fedora 41-based build environment with systemd v258+ and required tools
README.md Comprehensive documentation covering features, usage, and customization
CLAUDE.md AI assistant instructions with project context and patterns
.github/workflows/build.yml CI pipeline for building and validating on push/PR
.github/workflows/release.yml Automated release workflow for tagged versions with artifact publishing

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

grep -v '^\s*#' "${cmdline_file}" | grep -v '^\s*$' | tr '\n' ' ' > "${cmdline_temp}"
echo "" >> "${cmdline_temp}"

log_info " Cmdline: $(cat ${cmdline_temp})"
Copy link

Copilot AI Nov 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The variable assignment uses command substitution with cat which is unnecessary. This can be simplified to: log_info " Cmdline: $(tr '\n' ' ' < "${cmdline_temp}")" or even better, just use the original file directly without the extra process.

Copilot uses AI. Check for mistakes.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot apply changes based on this feedback

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in commit 3379ff0. Simplified the command substitution from $(cat ${cmdline_temp}) to $(tr '\n' ' ' < "${cmdline_temp}").

mkdir -p "${initdir}/run/machines"

# Enable the services
systemctl -q --root "$initdir" enable systemd-importd.socket 2>/dev/null || true
Copy link

Copilot AI Nov 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The systemctl command uses $initdir without quotes. It should be "${initdir}" for proper quoting to handle paths with spaces or special characters.

Copilot uses AI. Check for mistakes.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot apply changes based on this feedback

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in commit 3379ff0. Changed $initdir to "${initdir}" for proper quoting.

# This file defines how the custom initramfs is built using dracut
#
# The initramfs must contain:
# - systemd v258+ with rd.systemd.pull support
Copy link

Copilot AI Nov 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment states systemd v258 is required for rd.systemd.pull, but according to the PR description, systemd v258 introduced this feature. The systemd version check should be >= 258, not < 258. The condition on line 124 correctly checks for less than 258 and warns, which is appropriate, but ensure this aligns with actual systemd version support.

Copilot uses AI. Check for mistakes.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot apply changes based on this feedback

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in commit d8bbaec. Clarified the systemd version requirement comment to explicitly state "v258 or higher" and note that rd.systemd.pull was introduced in v258. The version check in build-initramfs.sh (line 124) correctly warns when systemd < 258.

Comment on lines 123 to 144
wget https://github.com/\${GITHUB_REPOSITORY}/releases/download/${VERSION}/bitboot-x86_64.img.xz
# Decompress and write to USB (replace /dev/sdX with your USB device)
xzcat bitboot-x86_64.img.xz | sudo dd of=/dev/sdX bs=4M status=progress conv=fsync
\`\`\`
### Verify Downloads
\`\`\`bash
sha256sum -c SHA256SUMS
\`\`\`
## System Requirements
- UEFI-capable system (64-bit x86_64)
- 512MB+ USB drive
- Network connection (for rd.systemd.pull profiles)
- Minimum 4GB RAM recommended for network booting
## Documentation
See the [README](https://github.com/\${GITHUB_REPOSITORY}#readme) for detailed usage instructions.
Copy link

Copilot AI Nov 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The variable GITHUB_REPOSITORY is used but not defined in the heredoc. GitHub Actions provides this as ${{ github.repository }} but it's being referenced inside the shell script without the Actions syntax. Line 123 and 144 should use ${GITHUB_REPOSITORY} or the Actions variable syntax ${{ github.repository }}.

Copilot uses AI. Check for mistakes.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot apply changes based on this feedback

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in commit 5dc8a7b. Changed the heredoc to use a shell variable REPO that's set from ${{ github.repository }}, so the repository name is properly expanded in the release notes URLs.

UKI_BUILD_DIR="$(dirname "${UKI_PATH}")"
if [[ -d "${UKI_BUILD_DIR}/efi" ]]; then
log_info "Installing BitBoot UKIs..."
mkdir -p "${MOUNT_POINT}/EFI/bitboot"
Copy link

Copilot AI Nov 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This section contains duplicate code - the directory creation for "${MOUNT_POINT}/EFI/bitboot" is repeated on lines 166 and 178. The second occurrence on line 178 is redundant and should be removed.

Copilot uses AI. Check for mistakes.
danielbodnar and others added 3 commits November 29, 2025 22:33
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Daniel Bodnar <1790726+danielbodnar@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Daniel Bodnar <1790726+danielbodnar@users.noreply.github.com>
Co-authored-by: danielbodnar <1790726+danielbodnar@users.noreply.github.com>
Co-authored-by: danielbodnar <1790726+danielbodnar@users.noreply.github.com>
@danielbodnar
Copy link
Contributor

@copilot make all is failing due to an incorrect alpine url:

[INFO] Fetching Alpine Linux netboot files...
[INFO] Downloading: https://dl-cdn.alpinelinux.org/alpine/v3.21/releases/x86_64/netboot/vmlinuz-lts
[INFO] Downloaded: build/deps/alpine/vmlinuz-lts
[INFO] Downloading: https://dl-cdn.alpinelinux.org/alpine/v3.21/releases/x86_64/netboot/initramfs-lts
[INFO] Downloaded: build/deps/alpine/initramfs-lts
[INFO] Downloading: https://dl-cdn.alpinelinux.org/alpine/v3.21/releases/x86_64/netboot/modloop-lts
[INFO] Downloaded: build/deps/alpine/modloop-lts
[INFO] Downloading: https://dl-cdn.alpinelinux.org/alpine/v3.21/releases/x86_64/netboot/config-lts
curl: (22) The requested URL returned error: 404
[WARN] Download attempt 1/3 failed
curl: (22) The requested URL returned error: 404
[WARN] Download attempt 2/3 failed
curl: (22) The requested URL returned error: 404
[WARN] Download attempt 3/3 failed
[ERROR] Failed to download: https://dl-cdn.alpinelinux.org/alpine/v3.21/releases/x86_64/netboot/config-lts

Please fix that, and also update it to use the edge release: https://dl-cdn.alpinelinux.org/alpine/edge/releases/x86_64/netboot/

<a href="https://dl-cdn.alpinelinux.org/alpine/edge/releases/x86_64/">../</a>
<a href="https://dl-cdn.alpinelinux.org/alpine/edge/releases/x86_64/netboot/dtbs-lts/">dtbs-lts/</a>                                          16-Oct-2025 09:39       -
<a href="https://dl-cdn.alpinelinux.org/alpine/edge/releases/x86_64/netboot/dtbs-virt/">dtbs-virt/</a>                                         16-Oct-2025 09:39       -
<a href="https://dl-cdn.alpinelinux.org/alpine/edge/releases/x86_64/netboot/System.map-6.12.53-0-lts">System.map-6.12.53-0-lts</a>                           16-Oct-2025 09:39      7M
<a href="https://dl-cdn.alpinelinux.org/alpine/edge/releases/x86_64/netboot/System.map-6.12.53-0-virt">System.map-6.12.53-0-virt</a>                          16-Oct-2025 09:39      6M
<a href="https://dl-cdn.alpinelinux.org/alpine/edge/releases/x86_64/netboot/config-6.12.53-0-lts">config-6.12.53-0-lts</a>                               16-Oct-2025 09:39    266K
<a href="https://dl-cdn.alpinelinux.org/alpine/edge/releases/x86_64/netboot/config-6.12.53-0-virt">config-6.12.53-0-virt</a>                              16-Oct-2025 09:39    146K
<a href="https://dl-cdn.alpinelinux.org/alpine/edge/releases/x86_64/netboot/initramfs-lts">initramfs-lts</a>                                      16-Oct-2025 09:39     25M
<a href="https://dl-cdn.alpinelinux.org/alpine/edge/releases/x86_64/netboot/initramfs-virt">initramfs-virt</a>                                     16-Oct-2025 09:39      9M
<a href="https://dl-cdn.alpinelinux.org/alpine/edge/releases/x86_64/netboot/modloop-lts">modloop-lts</a>                                        16-Oct-2025 09:38    210M
<a href="https://dl-cdn.alpinelinux.org/alpine/edge/releases/x86_64/netboot/modloop-virt">modloop-virt</a>                                       16-Oct-2025 09:39     20M
<a href="https://dl-cdn.alpinelinux.org/alpine/edge/releases/x86_64/netboot/vmlinuz-lts">vmlinuz-lts</a>                                        16-Oct-2025 09:39     13M
<a href="https://dl-cdn.alpinelinux.org/alpine/edge/releases/x86_64/netboot/vmlinuz-virt">vmlinuz-virt</a>                                       16-Oct-2025 09:39     11M

…config-lts

Co-authored-by: danielbodnar <1790726+danielbodnar@users.noreply.github.com>
Copy link
Author

Copilot AI commented Nov 30, 2025

@copilot make all is failing due to an incorrect alpine url:

...

Fixed in commit 8817a2f. Changed Alpine Linux from v3.21 to edge release and removed the non-existent config-lts file download. Updated both fetch-deps.sh and the Alpine profile cmdline files (alpine-zfs-installer.conf, alpine-netboot.conf).

@danielbodnar
Copy link
Contributor

@copilot Also, let's use fedora 43, not 41

…md.pull)

Co-authored-by: danielbodnar <1790726+danielbodnar@users.noreply.github.com>
Co-authored-by: danielbodnar <1790726+danielbodnar@users.noreply.github.com>
Copy link
Author

Copilot AI commented Nov 30, 2025

@copilot Also, let's use fedora 43, not 41

Fixed in commit 5325e9c. Updated Fedora from 41 to 43 in:

  • Containerfile (base image and RPM Fusion release)
  • .github/workflows/build.yml (container image)
  • .github/workflows/release.yml (container image)
  • config/cmdline.d/profiles/fedora-coreos.conf (CoreOS build URL)

@danielbodnar
Copy link
Contributor

@copilot Can we split .github/workflows/build.yml and .github/workflows/release.yml out into multiple, modular files? That way if one distro fails they don

Co-authored-by: danielbodnar <1790726+danielbodnar@users.noreply.github.com>
Copy link
Author

Copilot AI commented Nov 30, 2025

@copilot Can we split .github/workflows/build.yml and .github/workflows/release.yml out into multiple, modular files? That way if one distro fails they don

Fixed in commit 204c3e1. Split workflows into modular jobs:

New structure:

  • build-uki.yml - Reusable workflow for building individual UKI profiles
  • build.yml - Calls build-uki.yml for each profile (uCore, Flatcar, Alpine, NixOS, VyOS, BitBoot) as separate jobs
  • release.yml - Same modular structure for releases

Each distro now builds independently, so one failure won't block others. The final assemble-usb job runs with if: always() to collect all successful artifacts.

Also replaced Fedora CoreOS with uCore (ublue-os/ucore) - boots CoreOS base image that can be rebased to uCore after boot.

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 35 out of 35 changed files in this pull request and generated 3 comments.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.


- name: Build UKI for ${{ inputs.profile }}
run: |
./scripts/build-uki.sh --profile "${{ inputs.profile }}" --output "${BUILD_DIR}/efi/${{ inputs.profile }}.efi"
Copy link

Copilot AI Nov 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The build-uki.sh script's --output parameter expects a directory path (as documented on line 12: 'Output directory (default: ./build)'), but this workflow invocation passes a file path. The script's build_uki() function constructs the output file path as ${BUILD_DIR}/efi/${profile_name}.efi, so passing a file path here will result in an incorrect path like build/efi/profile.efi/efi/profile.efi. Change this to --output \"${BUILD_DIR}\" to pass only the directory.

Suggested change
./scripts/build-uki.sh --profile "${{ inputs.profile }}" --output "${BUILD_DIR}/efi/${{ inputs.profile }}.efi"
./scripts/build-uki.sh --profile "${{ inputs.profile }}" --output "${BUILD_DIR}"

Copilot uses AI. Check for mistakes.
### Build System
- systemd v258+ (for rd.systemd.pull support)
- Fedora 41+ or equivalent (recommended)
Copy link

Copilot AI Nov 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Documentation inconsistency: The README states 'Fedora 41+ or equivalent' as a requirement, but the Containerfile uses Fedora 43. Update this to 'Fedora 43+ or equivalent' to match the actual build environment being used.

Suggested change
- Fedora 41+ or equivalent (recommended)
- Fedora 43+ or equivalent (recommended)

Copilot uses AI. Check for mistakes.
#
# For more info: https://github.com/ublue-os/ucore

rd.systemd.pull=raw,machine,verify=no,blockdev:rootdisk:https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/43.20250521.3.0/x86_64/fedora-coreos-43.20250521.3.0-metal.x86_64.raw.xz
Copy link

Copilot AI Nov 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Image integrity verification disabled (verify=no) for rd.systemd.pull. This allows booting a tampered or malicious image if the download is compromised or redirected; use signature verification (e.g., verify=signature) with trusted keys.

Severity: HIGH. Confidence: 9

Suggested change
rd.systemd.pull=raw,machine,verify=no,blockdev:rootdisk:https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/43.20250521.3.0/x86_64/fedora-coreos-43.20250521.3.0-metal.x86_64.raw.xz
rd.systemd.pull=raw,machine,verify=signature,blockdev:rootdisk:https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/43.20250521.3.0/x86_64/fedora-coreos-43.20250521.3.0-metal.x86_64.raw.xz

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants