My job requires MS Intune and I got a bit carried away

General
1

Since this thread I made in February (Anyone got Microsoft Intune to work?), I’ve been layering Intune and Edge on top of Aurora DX and everything has been working fine.

However a few other Linux users at my new job also expressed interest in my setup, and layering sounds like it might not work forever, so I finally got around to baking my own image.

Behold! Aurora Corporate Edition! GitHub - cablespaghetti/aurora-corporate-edition: Aurora compatible with a corporate world

Yes it’s just Aurora DX with Intune and Edge installed at this point, but I am pleased with myself and @j0rge ordered me to make a forum thread. :grin: Maybe this will even help some others move over to Aurora/Bluefin at work, who knows?

12 Likes
2

How did you generate the cosign.pub keypair and where do you keep the private key? I noticed that the workflow fails so I suppose there is some github-related configuration one needs to do?

3

So, I found this [GitHub - avisi-cloud/cosign-tutorial: Use cosign to secure your container images using Github actions](repo with instructions) and managed to cosign:

  1. I ran cosign locally and generated a pair of cosign.key and cosign.pub
  2. I created COSIGN_KEY and COSIGN_PASSWORD secrets, setting the first to the content of cosign.key and the latter to the password I used
  3. I added a cosign.pub file to the root of the image template clone
  4. The full set of changes includes the creation of a /nix folder (I tried to run the nix installer but that failed)

This allowed me to build the workflow and generate an image at ghcr.io/karypid/bluefin-dx-nvidia-open-nix which I will now install this image in a VM to see if I can run the nix installer… @fenglengshun you may be interested in this…

1 Like
4

This is in the docs for the template:

2 Likes
5

Yes for cosign I just followed the template docs. There were a few tweaks I had to make to get local VM to work which I’ll commit back but the ISO part was seamless. :slightly_smiling_face:

6

Ahh so you just need to make sure there is a file in /nix so that it makes it to the final built image.

7

Very cool edition and use-case :smile:

1 Like
8

So, this was me trying to find a way to keep the folder alive. There was a “rechunk” process of image cleanup that I am under the impression removes empty folders, so I thought this may prevent that from happening.

If you pull my image and mount it you will see:

$ podman image pull docker://ghcr.io/karypid/bluefin-dx-nvidia-open-nix:stable
...
$ podman unshare -- bash
$ podman image mount bluefin-dx-nvidia-open:stable
(some-folder)
$ ls -a (some-folder)/nix
.  ..  .keep

EDIT: Disregard my original post saying the file was missing! It is there!

Somehow my VM when switching to this image is missing the folder though. Since I can see it is present, maybe I have done an incorrect rebase, so I will investigate further… At least a bit of progres…