From 4f1e1574cb894e2ebdf56b97fcb0caa4225131ce Mon Sep 17 00:00:00 2001
From: Jakob Naucke <jnaucke@redhat.com>
Date: Mon, 23 Feb 2026 17:44:01 +0100
Subject: [PATCH] coreos: Build without orphan_file

9's e2fsprogs don't support it

Signed-off-by: Jakob Naucke <jnaucke@redhat.com>
---
 coreos/Containerfile.cosa | 4 ++++
 coreos/justfile           | 9 ++++-----
 2 files changed, 8 insertions(+), 5 deletions(-)
 create mode 100644 coreos/Containerfile.cosa

diff --git a/coreos/Containerfile.cosa b/coreos/Containerfile.cosa
new file mode 100644
index 0000000..ee302c1
--- /dev/null
+++ b/coreos/Containerfile.cosa
@@ -0,0 +1,4 @@
+FROM quay.io/coreos-assembler/coreos-assembler:latest
+USER root
+RUN yq -i '(.pipelines[].stages[] | select(.type == "org.osbuild.mkfs.ext4")).options.orphan_file = false' \
+    /usr/lib/coreos-assembler/osbuild-manifests/coreos.osbuild.x86_64.mpp.yaml
diff --git a/coreos/justfile b/coreos/justfile
index 6eeaa42..e6b143e 100644
--- a/coreos/justfile
+++ b/coreos/justfile
@@ -27,6 +27,8 @@ archive := os + ".ociarchive"
 full_name := os_name
 label := os_name
 
+cosa_image := "cosa-no-orphan-file"
+
 kbc_image := "quay.io/trusted-execution-clusters/trustee-attester:fedora-b13fd8a"
 clevis_pin_trustee_image := "quay.io/trusted-execution-clusters/clevis-pin-trustee"
 ignition_image := "ghcr.io/trusted-execution-clusters/ignition:20260112-85608d6"
@@ -43,6 +45,7 @@ info:
 
 
 build:
+    sudo podman build -t {{cosa_image}} -f Containerfile.cosa .
     sudo podman build --no-cache \
            --build-arg BASE={{base}} \
            --build-arg COM_COREOS_OSNAME={{label}} \
@@ -61,10 +64,6 @@ cosa_function := '''
     cosa() {
         env | grep COREOS_ASSEMBLER || true
 
-        # Default container image
-        COREOS_ASSEMBLER_CONTAINER_LATEST="quay.io/coreos-assembler/coreos-assembler:latest"
-        sudo podman pull $COREOS_ASSEMBLER_CONTAINER_LATEST
-
         set -ex
         sudo podman run --rm -ti --security-opt=label=disable --privileged -u 0 \
 				--network host \
@@ -74,7 +73,7 @@ cosa_function := '''
             ${COREOS_ASSEMBLER_GIT:+-v=$COREOS_ASSEMBLER_GIT/src/:/usr/lib/coreos-assembler/:ro} \
             ${COREOS_ASSEMBLER_ADD_CERTS:+-v=/etc/pki/ca-trust:/etc/pki/ca-trust:ro} \
             ${COREOS_ASSEMBLER_CONTAINER_RUNTIME_ARGS} \
-            ${COREOS_ASSEMBLER_CONTAINER:-$COREOS_ASSEMBLER_CONTAINER_LATEST} "$@"
+            ${COREOS_ASSEMBLER_CONTAINER:-''' + cosa_image + '''} "$@"
     }
 '''