build.manifest

---
code_name: "Goldeye"
debian_release: "bookworm"
identity_file_path_default: "~/.ssh/id_rsa"
#
# List of apt repositories that are used and setup inside the build environment
# for TrueNAS SCALE. These are used to pull additional packages or depend packages
# into the build chroots, or the final system images.
############################################################################
apt-repos:
  base-url: https://apt.sys.truenas.net/
  base-url-internal: http://apt-mirror.tn.ixsystems.net/
  url: goldeye/25.10.2/debian/
  distribution: bookworm
  components: main
  additional:
  - url: goldeye/25.10.2/debian-security/
    distribution: bookworm-security
    component: main
  - url: goldeye/25.10.2/debian-backports/
    distribution: bookworm-backports
    component: "main contrib non-free non-free-firmware"
  - url: goldeye/25.10.2/debian-debug/
    distribution: bookworm-debug
    component: main
  - url: goldeye/25.10.2/yarn/
    distribution: stable
    component: main
  - url: goldeye/25.10.2/docker/
    distribution: bookworm
    component: stable
    key: keys/docker.gpg

#
# Packages which are installed into the base TrueNAS SCALE System by default
# NOTE: Installed in the order listed
############################################################################
base-packages:
- name: libssl3
  install_recommends: true
- name: openssl
  install_recommends: true
- name: dosfstools
  install_recommends: true
- name: linux-truenas-production-libc-dev
  install_recommends: true
- name: linux-headers-truenas-production-amd64
  install_recommends: true
- name: linux-headers-truenas-debug-amd64
  install_recommends: true
- name: linux-image-truenas-production-amd64
  install_recommends: true
- name: linux-image-truenas-debug-amd64
  install_recommends: true
- name: linux-perf-truenas
  install_recommends: true
- name: avahi-daemon
  install_recommends: true
- name: avahi-utils
  install_recommends: true
- name: nfs-kernel-server
  install_recommends: true
- name: bpftrace
  install_recommends: true
- name: bpfcc-tools
  install_recommends: true
- name: firmware-bnx2
  install_recommends: true
- name: firmware-bnx2x
  install_recommends: true
- name: firmware-cavium
  install_recommends: true
- name: firmware-linux
  install_recommends: true
- name: firmware-myricom
  install_recommends: true
- name: firmware-netronome
  install_recommends: true
- name: firmware-netxen
  install_recommends: true
- name: firmware-qlogic
  install_recommends: true
- name: firmware-realtek
  install_recommends: true
- name: grub-pc-bin
  install_recommends: true
- name: grub-efi-amd64-bin
  install_recommends: true
- name: htop
  install_recommends: true
- name: incus
  install_recommends: false
- name: incus-agent
  # agent is required to get proper events in websockets and run commands on VMs
  install_recommends: false
- name: ifstat
  install_recommends: true
- name: openzfs
  install_recommends: true
- name: open-vm-tools
  install_recommends: true
- name: linux-cpupower
  install_recommends: true
- name: nscd
  install_recommends: false
- name: truenas-samba
  install_recommends: true
- name: python3-truenas-pylibzfs
  install_recommends: true
- name: truenas-sssd
  install_recommends: true
- name: truenas-ipaclient
  install_recommends: true
- name: truenas-spdk
  install_recommends: true
- name: cifs-utils
  install_recommends: true
- name: nfs4xdr-acl-tools
  install_recommends: true
- name: nfs4-acl-tools
  install_recommends: true
- name: qemu-guest-agent
  install_recommends: true
- name: iscsi-scst
  install_recommends: true
- name: scst
  install_recommends: true
- name: scstadmin
  install_recommends: true
- name: scst-dbg
  install_recommends: true
- name: squashfs-tools
  install_recommends: true
- name: sysstat
  install_recommends: true
- name: truenas
  install_recommends: true
- name: wireguard-tools
  install_recommends: false
- name: openzfs-zfs-modules-dbg
  install_recommends: true
- name: openzfs-zfs-initramfs
  install_recommends: true
- name: nvme-cli
  install_recommends: true
- name: convmv
  install_recommends: true
- name: open-iscsi
  install_recommends: true
- name: auditd
  install_recommends: true
- name: lsscsi
  # requested by the support team (NAS-130189)
  install_recommends: false
- name: usbutils
  # lsusb seems useful/harmless, also requested by community on forums
  install_recommends: false
- name: git
  # middleware actually has a hard dependency on the git binary
  # however, if we specify this in the debian/control file, all
  # of the recommended packages get installed which is absurd.
  # We don't need packages like "git-gui", "gitweb", "git-daemon-run" etc.
  # So until we can figure out how to mark packages as dependencies
  # without installing non-dependent packages, this will have to suffice
  install_recommends: false
- name: truenas-audit-rules
  install_recommends: false

#
# Packages which are removed from the base TrueNAS SCALE System by default
# since sometimes optional packages are added as depends, which cause bloat
# NOTE: Removed in the order listed
############################################################################
base-prune:
- gstreamer1.0-x
- gstreamer1.0-plugins-base
- gstreamer1.0-libav
- libgdk-pixbuf2.0-0
- x11-common
- python-is-python2
# dependency tree openvpn->easy-rsa->opensc
# we don't need this package since it's for dealing with smart cards
# but more importantly, removes a category of potentical CVE exposure
- opensc
# remove gnupg to remove class of potential CVEs and also because we
# don't use it
- gnupg
# The functionality that lvm2 provides is mutually exclusive with
# ZFS so remove it. NOTE: We've also seen a well-known piece of
# software (in the wild) that will SSH into us, use lvm tools to
# create volumes on-top of ZVOLs to _explicitly_ "lock" the
# underlying zvol preventing us from doing anything with it.
- lvm2

#
# Update build-epoch when you want to force the next build to be
# non-incremental
############################################################################
build-epoch: 13

# Apt Preferences
############################################################################
apt_preferences:
- Package: "*"
  Pin: "release n=bookworm-backports"
  Pin-Priority: 900
- Package: "*"
  Pin: "origin \"\""
  Pin-Priority: 950
- Package: "*cuda*"
  Pin: "version 525.89*"
  Pin-Priority: 1000
- Package: "*curl*"
  Pin: "release n=bookworm-security"
  Pin-Priority: 1000
- Package: "*libcrypto*"
  Pin: "origin \"\""
  Pin-Priority: 1050
- Package: "*libnvcuvid*"
  Pin: "version 525.89*"
  Pin-Priority: 1000
- Package: "*libssl*"
  Pin: "origin \"\""
  Pin-Priority: 1050
- Package: "*node*"
  Pin: "release n=bookworm-security"
  Pin-Priority: 1000
- Package: "*policykit*"
  Pin: "release n=bookworm-security"
  Pin-Priority: 1000
- Package: "*polkit*"
  Pin: "release n=bookworm-security"
  Pin-Priority: 1000
- Package: "*ssh*"
  Pin: "release n=bookworm-security"
  Pin-Priority: 1000
- Package: "*ssl*"
  Pin: "origin \"\""
  Pin-Priority: 1050
- Package: "*tls*"
  Pin: "release n=bookworm-security"
  Pin-Priority: 1000
- Package: "*zfs*"
  Pin: "version 2.1.*"
  Pin-Priority: 1000
#
# List of additional packages installed into TrueNAS SCALE, along with link
# to the ticket specifying the reason for requesting
# NOTE: Installed in the order listed
############################################################################
additional-packages:
- name: xtail
  comment: used by support (NAS-108788)
  install_recommends: true
- name: iperf3
  comment: requested by sales (NAS-108787)
  install_recommends: true
- name: fio
  comment: requested by sales (NAS-108787)
  install_recommends: true
- name: dnsutils
  comment: requested by community (NAS-109391)
  install_recommends: true
- name: traceroute
  comment: requested by platform and perf (NAS-110493)
  install_recommends: true
- name: openseachest
  comment: requested by performance team (NAS-106154)
  install_recommends: false
- name: python-is-python3
  comment: NAS-111358 (symlinks /usr/bin/python to python3)
  install_recommends: true
- name: sdparm
  comment: NAS-114723
  install_recommends: true
- name: powertop
  comment: requested by community (NAS-113898)
  install_recommends: true
- name: pv
  comment: requested by community (NAS-115638)
  install_recommends: true
- name: ndctl
  comment: requested by community (NAS-108490)
  install_recommends: true
- name: ipmctl
  comment: requested by community (NAS-108490)
  install_recommends: true
- name: acpica-tools
  comment: requested by platform team (NAS-118432)
  install_recommends: true
- name: freeipmi
  comment: requested by engineering (NAS-121050)
  install_recommends: true
- name: cu
  comment: requested by platform team (NAS-120155)
  install_recommends: true
- name: lrzsz
  comment: requested by platform team (NAS-120155)
  install_recommends: true
- name: minicom
  comment: requested by platform team (NAS-120155)
  install_recommends: true
- name: i2c-tools
  comment: requested by platform team (NAS-120155)
  install_recommends: true
- name: mstflint
  comment: requested by platform team (NAS-136153)
  install_recommends: false
- name: systemd-container
  comment: requested by community (NAS-123533)
  install_recommends: false
- name: intel-gpu-tools
  comment: requested by community (NAS-130356)
  install_recommends: false
- name: p7zip-rar
  comment: requested by community (NAS-131306) https://forums.truenas.com/t/accepted-add-unrar-7zip-to-truenas-scale/10075
  install_recommends: false

#
# List of additional packages installed into TrueNAS SCALE ISO file
# NOTE: Installed in the order listed
############################################################################
iso-packages:
- curl
- bzip2
- linux-image-truenas-production-amd64
- iproute2
- live-boot
- pciutils
- python3-truenas-installer
- udhcpc
- vim-tiny
# Must be the last package as installing it breaks /etc/resolv.conf in chroot
- systemd-resolved

#
# List of Git source repositories the build will checkout and perform a debian
# package build inside of
# Packages will be built in parallel with dependencies being built before automatically
# To have a package built before in a single batch, please set a lower value for batch_priority.
# This can be helpful for CPU intensive packages like kernel which have dependencies waiting
# to be built
############################################################################
sources:
- name: openssl
  repo: https://github.com/truenas/openssl
  branch: release/25.10.3.2
  generate_version: false
  batch_priority: 0
  predepscmd:
    - "apt install -y wget xz-utils"
    - "./pull.sh"
- name: kernel
  repo: https://github.com/truenas/linux
  branch: release/25.10.3.2
  batch_priority: 0
  supports_ccache: true
  env:
    EXTRAVERSION: "-production"
    PYTHON: "python3"
  explicit_deps:
   - python3
  predepscmd:
    - "apt install -y flex bison dwarves libssl-dev devscripts"
    # Install dependencies to build perf
    - "apt install -y libelf-dev libdw-dev systemtap-sdt-dev libunwind-dev libslang2-dev libperl-dev binutils-dev libiberty-dev python3 python3-setuptools python3-dev liblzma-dev libzstd-dev libcap-dev libnuma-dev libbabeltrace-dev openjdk-17-jdk libcapstone-dev llvm-dev"
    # We remove git files because kernel makefile tries to interact with git for determining version
    # which results in misconfigured version due to our debian based changes
    - "rm -rf .git .gitattributes .gitignore"
    - "make defconfig"
    - "./scripts/kconfig/merge_config.sh .config scripts/package/truenas/debian_amd64.config"
    - "./scripts/kconfig/merge_config.sh .config scripts/package/truenas/truenas.config"
    - "./scripts/kconfig/merge_config.sh .config scripts/package/truenas/tn-production.config"
    - "make syncconfig"
    - "make archprepare"
    - "./scripts/package/mkdebian"
  buildcmd:
    - "rm -rf .config.old"
    - "make -j$(nproc) bindeb-pkg"
  subpackages:
    - name: kernel-dbg
      batch_priority: 0
      supports_ccache: true
      env:
        EXTRAVERSION: "-debug"
      predepscmd:
        - "apt install -y flex bison dwarves libssl-dev devscripts"
        # We remove git files because kernel makefile tries to interact with git for determining version
        # which results in misconfigured version due to our debian based changes
        - "rm -rf .git .gitattributes .gitignore"
        - "make defconfig"
        - "./scripts/kconfig/merge_config.sh .config scripts/package/truenas/debian_amd64.config"
        - "./scripts/kconfig/merge_config.sh .config scripts/package/truenas/truenas.config"
        - "./scripts/kconfig/merge_config.sh .config scripts/package/truenas/tn-debug.config"
        - "make syncconfig"
        - "make archprepare"
        - "./scripts/package/mkdebian"
      buildcmd:
        - "rm -rf .config.old"
        - "make -j$(nproc) bindeb-pkg"
- name: nfs4xdr_acl_tools
  repo: https://github.com/truenas/nfs4xdr-acl-tools
  branch: release/25.10.3.2
- name: openzfs
  repo: https://github.com/truenas/zfs
  batch_priority: 0
  branch: release/25.10.3.2
  env:
    KVERS: "$(shell apt info linux-headers-truenas-production-amd64 | awk '/Source:/ { print $$2}' | sed 's/linux-//')"
    KSRC: "/usr/src/linux-headers-truenas-production-amd64"
    KOBJ: "$(KSRC)"
  predepscmd:
    - "cp -r contrib/debian debian"
    - "sed -i 's/libtool,/libtool, linux-image-truenas-production-amd64, linux-headers-truenas-production-amd64,/' debian/control"
  deps_path: contrib/debian
  prebuildcmd:
    - "sh autogen.sh"
    - "./configure"
    - "cp contrib/debian/changelog debian/changelog"
    - "sed 's/@CFGOPTS@/--enable-debuginfo/g' debian/rules.in > debian/rules"
    - "chmod +x debian/rules"
  buildcmd:
    - "dpkg-buildpackage -us -uc -b"
    - "rm ../openzfs-zfs-dkms*.deb ../openzfs-zfs-dracut*.deb"
    - "debian/rules override_dh_binary-modules"
  explicit_deps:
    - kernel
    - kernel-dbg
    - openssl
  generate_version: false
  subpackages:
    - name: openzfs-dbg
      batch_priority: 0
      env:
        KVERS: "$(shell apt info linux-headers-truenas-debug-amd64 | awk '/Source:/ { print $$2}' | sed 's/linux-//')"
        KSRC: "/usr/src/linux-headers-truenas-debug-amd64"
        KOBJ: "$(KSRC)"
      predepscmd:
        - "cp -r contrib/debian debian"
        - "sed -i 's/libtool,/libtool, linux-image-truenas-debug-amd64, linux-headers-truenas-debug-amd64,/' debian/control"
      deps_path: contrib/debian
      prebuildcmd:
        - "sh autogen.sh"
        - "./configure"
        - "cp contrib/debian/changelog debian/changelog"
        - "sed 's/@CFGOPTS@/--enable-debug --enable-debuginfo/g' debian/rules.in > debian/rules"
        - "chmod +x debian/rules"
        - "sed  -i 's/Provides: openzfs-zfs-modules/Provides: openzfs-zfs-modules-dbg/'  debian/control.modules.in"
      buildcmd:
        - "sh autogen.sh"
        - "./scripts/make_gitrev.sh"
        - "debian/rules override_dh_binary-modules"
      explicit_deps:
        - kernel
        - kernel-dbg
        - openssl
      generate_version: false
- name: truenas_pylibzfs
  repo: https://github.com/truenas/truenas_pylibzfs
  branch: release/25.10.3.2
  explicit_deps:
    - openzfs
- name: truenas_samba
  repo: https://github.com/truenas/samba
  branch: release/25.10.3.2
  generate_version: false
  batch_priority: 0
  explicit_deps:
    - openzfs
- name: truenas_sssd
  repo: https://github.com/truenas/sssd
  branch: release/25.10.3.2
  generate_version: false
  predepscmd:
    - "apt install -y wget xz-utils systemd-dev truenas-samba"
  explicit_deps:
    - openzfs
    - truenas_samba
- name: truenas_ipaclient
  repo: https://github.com/truenas/freeipa
  branch: release/25.10.3.2
  generate_version: false
  predepscmd:
    - "apt install -y pkg-config truenas-samba truenas-sssd"
    - "sh -x fetch.sh"
  explicit_deps:
    - openzfs
    - python3
    - truenas_samba
    - truenas_sssd
- name: truenas_spdk
  repo: https://github.com/truenas/truenas_spdk
  branch: release/25.10.3.2
  generate_version: false
  predepscmd:
    - "apt install -y rsync"
    - "sh -x fetch.sh"
    - "scripts/pkgdep.sh  --rdma"
  explicit_deps:
    - python3
    - kernel
    - kernel-dbg
- name: avahi
  repo: https://github.com/truenas/avahi
  branch: release/25.10.3.2
  generate_version: false
- name: py_libzfs
  repo: https://github.com/truenas/py-libzfs
  branch: release/25.10.3.2
  explicit_deps:
    - openzfs
- name: zettarepl
  repo: https://github.com/truenas/zettarepl
  branch: release/25.10.3.2
- name: truenas_crypto_utils
  repo: https://github.com/truenas/truenas_crypto_utils
  branch: release/25.10.3.2
- name: truenas_connect_utils
  repo: https://github.com/truenas/truenas_connect_utils
  branch: release/25.10.3.2
- name: truenas_installer
  repo: https://github.com/truenas/truenas-installer
  branch: release/25.10.3.2
- name: scst
  repo: https://github.com/truenas/scst
  generate_version: false
  env:
    KVER: "$(shell apt info linux-headers-truenas-production-amd64 | awk '/Source:/ { print $$2}' | sed 's/linux-//')"
    KDIR: "/lib/modules/$(KVER)/build"
  prebuildcmd:
    - "sed -i s/^DEBIAN_REVISION=.*/DEBIAN_REVISION=~truenas+1/g Makefile"
    - "make debian/changelog"
  buildcmd:
    - "make 2perf"
    - "make scst-dist-gzip"
    - "make dpkg DEBEMAIL=no-reply@ixsystems.com DEBFULLNAME=TrueNAS"
  explicit_deps:
    - kernel
    - kernel-dbg
  branch: release/25.10.3.2
  subpackages:
    - name: scst-dbg
      generate_version: false
      env:
        KVER: "$(shell apt info linux-headers-truenas-debug-amd64 | awk '/Source:/ { print $$2}' | sed 's/linux-//')"
        KDIR: "/lib/modules/$(KVER)/build"
        PKG_BUILD_MODE: 2debug
      depscmd:
        - "cat debian/control.dbgmodules > debian/control"
      prebuildcmd:
        - "sed -i s/^DEBIAN_REVISION=.*/DEBIAN_REVISION=~truenas+1/g Makefile"
        - "cat debian/control.dbgmodules > debian/control"
        - "make debian/changelog"
      buildcmd:
        - "make 2debug"
        - "make scst-dist-gzip"
        - "make dpkg DEBEMAIL=no-reply@ixsystems.com DEBFULLNAME=TrueNAS"
      explicit_deps:
        - kernel
        - kernel-dbg
- name: truenas_binaries
  repo: https://github.com/truenas/binaries
  branch: release/25.10.3.2
- name: truenas_webui
  repo: https://github.com/truenas/webui
  predepscmd:
    - "apt -y install wget && apt -y install yarn --no-install-recommends"  # yarn recommends nodejs, which we don't want
  prebuildcmd:
    - "sh -ex debian/fetch_node.sh"  # download and install pre-built nodejs
    - "yarn install --network-timeout 100000"
    - "tar cvzf node_files.tgz node_modules/"
    - "rm -rf node_modules"
  branch: release/25.10.3.2
  secret_env: ["SENTRY_AUTH_TOKEN"]
- name: sedutil
  repo: https://github.com/truenas/sedutil
  branch: release/25.10.3.2
- name: python_netsnmpagent
  repo: https://github.com/truenas/python-netsnmpagent
  branch: release/25.10.3.2
- name: python_truenas_requirements
  repo: https://github.com/truenas/python-truenas-requirements
  branch: release/25.10.3.2
- name: licenselib
  repo: https://github.com/truenas/licenselib
  branch: release/25.10.3.2
- name: zectl
  repo: https://github.com/truenas/zectl
  branch: release/25.10.3.2
  predepscmd:
    - "cp -a packaging/debian ."
  deps_path: packaging/debian
  explicit_deps:
    - openzfs
- name: ixdiagnose
  repo: https://github.com/truenas/ixdiagnose
  branch: release/25.10.3.2
- name: ixhardware
  repo: https://github.com/truenas/ixhardware
  branch: release/25.10.3.2
- name: apps_validation
  repo: https://github.com/truenas/apps_validation
  branch: release/25.10.3.2
- name: py_cryptit
  repo: https://github.com/truenas/py-cryptit
  branch: release/25.10.3.2
- name: py_sgio
  repo: https://github.com/truenas/py-sgio
  branch: release/25.10.3.2
- name: py_fenced
  repo: https://github.com/truenas/py-fenced
  branch: release/25.10.3.2
- name: py_nvme
  repo: https://github.com/truenas/py-nvme
  branch: release/25.10.3.2
- name: truenas
  repo: https://github.com/truenas/middleware
  branch: release/25.10.3.2
  subdir: debian
  subpackages:
    - name: middlewared
      explicit_deps:
        - truenas_samba
        - truenas_sssd
      subdir: src/middlewared
    - name: middlewared-docs
      subdir: src/middlewared_docs
    - name: truenas_files
      subdir: src/freenas
- name: truenas_api_client
  repo: https://github.com/truenas/api_client
  branch: release/25.10.3.2
- name: truenas_verify
  repo: https://github.com/truenas/truenas_verify
  branch: release/25.10.3.2
- name: midcli
  repo: https://github.com/truenas/midcli
  branch: release/25.10.3.2
- name: grub2
  repo: https://github.com/truenas/grub2
  branch: release/25.10.3.2
  debian_fork: true
  predepscmd:
    - "apt install -y wget xz-utils"
    - "./pull.sh"
  deoptions: nocheck
  generate_version: false
  jobs: 1
  batch_priority: 150
- name: parted
  repo: https://github.com/truenas/parted
  branch: release/25.10.3.2
  debian_fork: true
  predepscmd:
    - "apt install -y wget xz-utils"
    - "./pull.sh"
  deoptions: nocheck
  generate_version: false
- name: rclone
  repo: https://github.com/truenas/rclone
  branch: release/25.10.3.2
  deoptions: nocheck
  generate_version: false
- name: restic
  repo: https://github.com/truenas/restic
  branch: release/25.10.3.2
  deoptions: nocheck
  generate_version: false
- name: py_sg3
  repo: https://github.com/truenas/py-sg3
  branch: release/25.10.3.2
- name: smartmontools
  repo: https://github.com/truenas/smartmontools
  branch: release/25.10.3.2
  debian_fork: true
  predepscmd:
    - "apt install -y wget xz-utils"
    - "./pull.sh"
  deoptions: nocheck
  generate_version: false
- name: util-linux
  repo: https://github.com/truenas/util-linux
  branch: release/25.10.3.2
  debian_fork: true
  predepscmd:
    - "apt install -y wget xz-utils"
    - "./pull.sh"
  deoptions: nocheck
  generate_version: false
- name: python3
  repo: https://github.com/truenas/python.git
  branch: release/25.10.3.2
  batch_priority: 0
  deoptions: nocheck
  generate_version: false
  predepscmd:
    - "apt install -y python3-docs-theme python3-sphinx texinfo wget"
    - "wget https://www.python.org/ftp/python/3.11.9/Python-3.11.9.tar.xz"
    - "tar --strip-components=1 -xvf Python-3.11.9.tar.xz"
- name: truenas_audit_rules
  repo: https://github.com/truenas/audit_rules.git
  branch: release/25.10.3.2
  generate_version: false
- name: nfs_utils
  repo: https://github.com/truenas/nfs-utils.git
  branch: release/25.10.3.2
  generate_version: false

# Nvidia extensions versions
############################################################################
extensions:
  nvidia:
    current: "570.172.08"