add: ventoy

[c4i0b]

What software is being packaged here?

ventoy — an open source tool to create bootable USB drives for ISO/WIM/IMG/VHD(x)/EFI files.

• Source: https://github.com/ventoy/Ventoy
• Website: https://www.ventoy.net
• License: GPL-3.0-or-later

Describe the motivation

Closes #3790.

Ventoy is extremely popular (~78k★) and is not available as an RPM in Fedora or Terra. This gives Fedora users a clean, dnf-installable package with the GUI (ventoygui + .desktop, so it shows in the application menu and opens with a click, no terminal).

Additional context

• Repackages the upstream prebuilt Linux release (ventoy-<ver>-linux.tar.gz). Building from source is impractical: Ventoy bundles and compiles GRUB2 + EDK2 (UEFI) + IPXE using vendored cross-toolchains (Linaro/bootlin/mips/musl) in a CentOS 7.8 env — upstream itself builds it via Docker. Every distro (CachyOS, AUR) uses the prebuilt release; this mirrors the CachyOS ventoy-bin packaging.
• Pattern follows CachyOS: install to /opt/ventoy/ (hardcoded in upstream scripts), wrappers in %{_bindir} (ventoy, ventoygui, ventoyweb, ventoyplugson, ventoy-persistent, ventoy-extend-persistent), .desktop + icon, system xzcat/hexdump symlinked in, bundled tool .xz binaries decompressed at build time, log path → /var/log/ventoy.log, shebangs → bash, and a sanitize.patch (the version-drifted Ventoy2Disk.sh hunk was dropped — its logic is self-consistent and covered by the build-time decompress).
• The .desktop launches ventoygui as the current user; VentoyGUI escalates to root internally via polkit (system password prompt) — polkit is in Recommends. No sudo in the .desktop.
• ExclusiveArch: x86_64 aarch64; __strip /bin/true + debug_package %nil (prebuilt binaries); update.rhai via gh("ventoy/Ventoy").
• Tested: anda build -c terra-rawhide-x86_64 → green; installed in fedora:rawhide — wrappers, VentoyGUI.<arch>, boot.img, .desktop and icon all land correctly.

Checklist

• This package is maintained OR there is a valid reason to add it (e.g. python dependency)
• I have tested at least the x86_64 version of the package
• I have read through any relevant Terra and Fedora packaging documentation/policies/guidelines
• I have made sure there are no security issues with this package to the best of my ability
• I have made sure this is not in Fedora (unless adding to the extras repo).

Distrobox test (with clean Fedora image)

[Owen-sz]

We've discussed adding Ventoy before, but due to questionable binary blobs included in the source code we determined that we cannot be sure there is not a security risk with this package. More info can be found here - NixOS/nixpkgs#404663
I appreciate the PR though, and am happy to discuss further.

[c4i0b]

Thanks for the context @Owen-sz. We weren't aware of the blob transparency concerns or the NixOS issue when putting this together. That's a fair position. Closing the PR. Happy to revisit if upstream ever addresses the blob situation.

[Owen-sz]

Thanks for the context @Owen-sz. We weren't aware of the blob transparency concerns or the NixOS issue when putting this together. That's a fair position. Closing the PR. Happy to revisit if upstream ever addresses the blob situation.

Sounds good, I'd also love to have this package if upstream can provide transparency.