local customizations

             @@ -10,3 +10,6 @@    10     10[*.conf]    11     11indent_style = space    12     12indent_size = 4           13           14[mkosi.passphrase]           15insert_final_newline = false

             @@ -11,3 +11,5 @@    11     11.mkosi-private    12     12mkosi.packages/    13     13keys/           14mkosi.profiles/custom/mkosi.extra/usr/local/bin/           15versions/

             @@ -0,0 +1,3 @@            1[submodule "systemd"]            2	path = systemd            3	url = https://github.com/systemd/systemd

             @@ -0,0 +1,1 @@            1systemd/**

             @@ -4,6 +4,9 @@     4      4concepts described in     5      5[Fitting Everything Together](https://0pointer.net/blog/fitting-everything-together.html).     6      6            7Note that ParticleOS is still in development, and we don't provide any backwards            8compatibility guarantees at all.            9     7     10The crucial difference that makes ParticleOS unique compared to other immutable     8     11distributions is that users build the ParticleOS image themselves and sign it     9     12with their own keys instead of installing vendor signed images. This allows             @@ -12,7 +15,7 @@    12     15image.    13     16    14     17The ParticleOS image is built using [mkosi](https://github.com/systemd/mkosi).    15       You will need to install the current main branch of mkosi to build current            18You will need to install the current main branch of mkosi to build current    16     19ParticleOS images.    17     20    18     21First, configure the variant you'd like to build in `mkosi.local.conf`. For a

             @@ -0,0 +1,77 @@            1BIN_DIR := mkosi.profiles/custom/mkosi.extra/usr/local/bin            2PACKAGES_DIR := mkosi.profiles/custom/mkosi.packages            3btdu := $(BIN_DIR)/btdu            4jj := $(BIN_DIR)/jj            5opensnitch := $(PACKAGES_DIR)/opensnitch.rpm            6opensnitch_ui := $(PACKAGES_DIR)/opensnitch_ui.rpm            7ALL := $(btdu) $(jj) $(opensnitch) $(opensnitch_ui)            8LATEST_VERSION = $(shell mkosi summary --json | jq -r '.Images[] | select(.Image == "main") | .ImageVersion')            9INSTALLED_VERSION = $(shell grep IMAGE_VERSION /etc/os-release | cut -d= -f2 | tr -d \")           10           11.PHONY: deps           12deps: $(PACKAGES_DIR) $(BIN_DIR) $(ALL)           13           14.PHONY: clean           15clean:           16	rm -fv $(ALL)           17           18$(BIN_DIR) $(PACKAGES_DIR):           19	mkdir -p $@           20           21$(jj): $(MAKE_TMPDIR)/jj.tar.gz           22	echo 9967a240e3294a0bce4444c55d40a35b70af44c69b558689aced95e4e497cef2 $(MAKE_TMPDIR)/jj.tar.gz | sha256sum --check           23	tar -xzf $(MAKE_TMPDIR)/jj.tar.gz -C $(MAKE_TMPDIR)           24	cp $(MAKE_TMPDIR)/jj $@           25           26$(MAKE_TMPDIR)/jj.tar.gz:           27	wget https://github.com/jj-vcs/jj/releases/download/v0.35.0/jj-v0.35.0-x86_64-unknown-linux-musl.tar.gz -O $(MAKE_TMPDIR)/jj.tar.gz           28           29$(btdu): $(MAKE_TMPDIR)/btdu           30	echo 35b9bb752e6aa902b8281e92a5411b2f1cfb9fa251089adf909dc95efc011c48 $(MAKE_TMPDIR)/btdu | sha256sum --check           31	cp $(MAKE_TMPDIR)/btdu $@           32	chmod +x $@           33           34$(MAKE_TMPDIR)/btdu:           35	wget https://github.com/CyberShadow/btdu/releases/download/v0.6.0/btdu-static-x86_64 -O $(MAKE_TMPDIR)/btdu           36           37$(opensnitch): $(MAKE_TMPDIR)/opensnitch.rpm           38	echo 2caf4e13ffd1b7af48306a2e9e979042f526823720b42bee4c00194f140d64dd $(MAKE_TMPDIR)/opensnitch.rpm | sha256sum --check           39	cp $(MAKE_TMPDIR)/opensnitch.rpm $@           40           41$(MAKE_TMPDIR)/opensnitch.rpm:           42		wget https://github.com/evilsocket/opensnitch/releases/download/v1.7.2/opensnitch-1.7.2-1.x86_64.rpm -O $(MAKE_TMPDIR)/opensnitch.rpm           43           44$(opensnitch_ui): $(MAKE_TMPDIR)/opensnitch_ui.rpm           45	echo b26029cbc83880ebc92170035d50237c13b17ffc0b3cf52b89fa1348edfdfb43 $(MAKE_TMPDIR)/opensnitch_ui.rpm | sha256sum --check           46	cp $(MAKE_TMPDIR)/opensnitch_ui.rpm $@           47           48$(MAKE_TMPDIR)/opensnitch_ui.rpm:           49	wget https://github.com/evilsocket/opensnitch/releases/download/v1.7.2/opensnitch-ui-1.7.2-1.noarch.rpm -O $(MAKE_TMPDIR)/opensnitch_ui.rpm           50           51mkosi.crt:           52	ln -s ~/Vaults/particleos_keys/sbctl/var/keys/db/db.pem mkosi.crt           53           54mkosi.key:           55	ln -s ~/Vaults/particleos_keys/sbctl/var/keys/db/db.key mkosi.key           56           57.PHONY: build           58build:           59	mkosi build --auto-bump           60           61.PHONY: systemd           62systemd:           63	sh -c 'cd systemd && mkosi -t none -f --distribution=fedora --release=43'           64           65.PHONY: sysupdate           66sysupdate:           67	mkosi sysupdate -- update           68	mkdir -p versions           69	cat mkosi.output/ParticleOS_$(LATEST_VERSION)_x86-64.changelog | gzip > versions/$(LATEST_VERSION).changelog.gz           70           71.PHONY: diff_changelog           72diff_changelog:           73	sh -c 'diff --color=always -u <(gzip --decompress --to-stdout versions/$(INSTALLED_VERSION).changelog.gz) mkosi.output/ParticleOS_$(LATEST_VERSION)_x86-64.changelog; test $$? -le 1'           74           75.PHONY: diff_manifest           76diff_manifest:           77	sh -c 'diff --color=always -u /etc/os-manifest mkosi.output/ParticleOS_$(LATEST_VERSION)_x86-64.manifest; test $$? -le 1'

             @@ -5,6 +5,7 @@     5      5     6      6[Build]     7      7ToolsTree=default            8ToolsTreeProfiles=misc,runtime,gui     8      9History=yes     9     10CacheDirectory=mkosi.cache    10     11Incremental=yes             @@ -42,7 +43,11 @@    42     43        diffutils    43     44        dmidecode    44     45        dosfstools           46        e2fsprogs           47        efibootmgr    45     48        erofs-utils           49        exfatprogs           50        file    46     51        findutils    47     52        fish    48     53        fwupd             @@ -52,6 +57,7 @@    52     57        gzip    53     58        jq    54     59        kbd           60        kexec-tools    55     61        kmod    56     62        less    57     63        man             @@ -61,6 +67,7 @@    61     67        nvme-cli    62     68        opensc    63     69        openssl           70        patch    64     71        p11-kit    65     72        pciutils    66     73        pkcs11-provider             @@ -80,6 +87,7 @@    80     87        wireguard-tools    81     88        xxd    82     89        yubikey-manager           90        zip    83     91        zstd    84     92    85     93VolatilePackages=             @@ -99,7 +107,6 @@    99    107RAM=4G   100    108CPUs=4   101    109Ephemeral=yes   102       RuntimeScratch=no   103    110Credentials=   104    111        passwd.plaintext-password.root=particleos   105    112        tty.serial.hvc0.agetty.autologin=particleos

             @@ -1,24 +1,30 @@     1      1[Distribution]     2      2Distribution=fedora     3       Release=42            3Release=43     4      4     5      5[Build]     6      6ToolsTree=default     7      7ToolsTreeDistribution=fedora     8       ToolsTreeRelease=42     9       ExtraSearchPaths=../systemd/build/mkosi.builddir/fedora~42~x86-64/            8ToolsTreeProfiles=misc,runtime,gui            9ExtraSearchPaths=./systemd/build/mkosi.builddir/fedora~43~x86-64/    10     10    11     11[Config]    12       Profiles=desktop,kde           12Profiles=desktop,kde,custom    13     13    14     14[Output]    15       Format=disk           15ManifestFormat=changelog    16     16    17     17[Content]    18       VolatilePackageDirectories=../systemd/build/mkosi.builddir/fedora~42~x86-64/    19       Hostname=foobar           18VolatilePackageDirectories=./systemd/build/mkosi.builddir/fedora~43~x86-64/    20     19Packages=           20        # keyrings for building other distro images           21        archlinux-keyring           22        debian-keyring    21     23        ansible           24        ansible-collection-ansible-posix           25        ansible-collection-community-postgresql           26        ansible-collection-community-general           27        ansible-collection-community-crypto    22     28        awk    23     29        bash    24     30        bash-completion             @@ -26,14 +32,27 @@    26     32        bind-utils    27     33        bat    28     34        clatd           35        clang-devel    29     36        cowsay    30     37        cmatrix    31     38        curl    32     39        dictd           40        diffoscope    33     41        du-dust           42        duf           43        d2    34     44        emacs           45        entr    35     46        exfatprogs           47        exiftool    36     48        fastfetch           49        fcitx5-mozc           50        fcitx5-configtool           51        fcitx5-gtk           52        fcitx5-qt           53        firejail           54        fontawesome-fonts-all           55        kcm-fcitx5    37     56        fd-find    38     57        file    39     58        fish             @@ -47,11 +66,21 @@    47     66        git    48     67        git-absorb    49     68        git-delta           69        git-lfs    50     70        glances           71        # needed for geoclue?           72        glib-networking           73        guestfs-tools    51     74        golang           75        graphviz    52     76        htop    53     77        iio-sensor-proxy           78        ImageMagick    54     79        iperf3           80        java-latest-openjdk           81        katago-opencl           82        intel-opencl           83        OpenCL-ICD-Loader    55     84        @kde-desktop    56     85        kde-connect    57     86        kde-partitionmanager             @@ -62,59 +91,71 @@    62     91        libfprint-tod    63     92        libfprint-2-tod1-broadcom    64     93        libfprint-tod-selinux           94        litecli    65     95        lm_sensors    66     96        lolcat    67     97        lshw           98        lsof    68     99        man    69    100        # include mkosi just for shell completion and man pages    70    101        mkosi    71    102        mokutil          103        mpv    72    104        ncdu          105        neovim          106        ninja    73    107        okular          108        opentofu          109        osc    74    110        # needed for bell fish function    75    111        oxygen-sounds    76               neovim          112        pre-commit    77    113        python3-neovim          114        nmap    78    115        nmap-ncat    79    116        # for coc.nvim    80    117        npm          118        # needed for clatd on F43 apparently          119        perl-IPC-Cmd          120        perl-JSON    81    121        pipewire-utils    82    122        plasma-disks    83    123        plasma-vault    84    124        pnpm    85    125        powertop          126        progress    86    127        proxychains-ng          128        pv          129        python3-netaddr    87    130        ripgrep          131        rubygem-asciidoctor    88    132        rustup    89    133        rsync    90    134        sbctl    91    135        setroubleshoot    92               stgit    93    136        sbsigntools          137        sqlite          138        stgit    94    139        tcpdump          140        # not yet available for fedora 43          141        terraform-ls    95    142        tmux    96    143        toolbox          144        tor    97    145        translate-shell    98    146        trash-cli    99    147        ttyplot   100    148        units   101    149        unrar-free   102               libvirt-daemon   103    150        @virtualization   104    151        wget   105    152        whois          153        wl-clipboard   106    154        wireshark   107    155        yubikey-manager   108    156        kernel   109               repository/opensnitch-ui-1.7.1-1.noarch.rpm   110               repository/opensnitch-1.7.1-1.x86_64.rpm          157        # repository directory comes from mkosi.packages          158        repository/opensnitch_ui.rpm          159        repository/opensnitch.rpm   111    160        python3-grpcio+protobuf   112    161        python3-slugify   113          114       [Validation]   115       SecureBootKey=./keys/sbctl/var/keys/db/db.key   116       SecureBootCertificate=./keys/sbctl/var/keys/db/db.pem   117       SignExpectedPcrKey=./keys/sbctl/var/keys/db/db.key   118       SignExpectedPcrCertificate=./keys/sbctl/var/keys/db/db.pem   119       VerityKey=./keys/sbctl/var/keys/db/db.key   120       VerityCertificate=./keys/sbctl/var/keys/db/db.pem

             @@ -0,0 +1,1 @@            153405835a2aa6e360863660f1e0e4d9a9688085f

             @@ -0,0 +1,13 @@            1rebuild:            2  steps:            3    - trigger_services:            4        project: system:systemd            5        package: particleos-debian            6    - trigger_services:            7        project: system:systemd            8        package: particleos-fedora            9  filters:           10    event: push           11    branches:           12      only:           13        - obs

             @@ -18,6 +18,7 @@    18     18        libfido2    19     19        linux    20     20        man-db           21        man-pages    21     22        openssh    22     23        pacman    23     24        pcsclite             @@ -27,6 +28,7 @@    27     28        psmisc    28     29        python3    29     30        qrencode           31        sbsigntools    30     32        shadow    31     33        systemd-ukify    32     34        tgt             @@ -33,6 +35,8 @@    33     35        tpm2-tools    34     36        tpm2-tss    35     37        vim-minimal           38        wget           39        xz    36     40        zram-generator    37     41    38     42VolatilePackages=

             @@ -9,6 +9,7 @@     9      9    10     10[Content]    11     11Packages=           12        apparmor    12     13        apt    13     14        bpftool    14     15        ca-certificates             @@ -28,7 +29,9 @@    28     29        libqrencode4    29     30        linux-image-generic    30     31        linux-perf           32        linux-sysctl-defaults    31     33        login           34        manpages    32     35        openssh-client    33     36        openssh-server    34     37        passwd             @@ -37,7 +40,10 @@    37     40        polkitd    38     41        procps    39     42        python3    40               systemd-boot           43        sbsigntool           44        systemd-boot           45        systemd-boot-efi           46        systemd-boot-efi-signed    41     47        systemd-container    42     48        systemd-coredump    43     49        systemd-cryptsetup             @@ -49,6 +55,9 @@    49     55        systemd-ukify    50     56        systemd-zram-generator    51     57        tpm2-tools           58        util-linux-extra           59        wget           60        xz-utils    52     61    53     62VolatilePackages=    54     63        libnss-myhostname             @@ -56,12 +65,18 @@    56     65        libnss-systemd    57     66        libpam-systemd    58     67        systemd-boot    59               systemd-container    60               systemd-coredump    61               systemd-cryptsetup    62               systemd-homed    63               systemd-resolved    64               systemd-repart    65               systemd-sysv    66               systemd-timesyncd    67               systemd-ukify           68        systemd-boot-efi           69        systemd-boot-efi-signed           70        systemd-container           71        systemd-coredump           72        systemd-cryptsetup           73        systemd-homed           74        systemd-resolved           75        systemd-repart           76        systemd-sysv           77        systemd-timesyncd           78        systemd-ukify           79           80InitrdVolatilePackages=           81        systemd-container           82        systemd-resolved

             @@ -0,0 +1,9 @@            1#!/bin/bash            2# SPDX-License-Identifier: LGPL-2.1-or-later            3set -e            4            5# Debian/Ubuntu PAM patches break /usr/lib/pam.d/ so copy to factory            6# TODO: drop after https://salsa.debian.org/vorlon/pam/-/merge_requests/26 is merged            7if [[ -f /usr/lib/tmpfiles.d/debian.conf ]]; then            8    sed -i '/\/etc\/pam.d/d' /usr/lib/tmpfiles.d/debian.conf            9fi

             @@ -10,6 +10,7 @@    10     10Packages=    11     11        bash-color-prompt    12     12        bpftool           13        cracklib-dicts    13     14        cryptsetup    14     15        distribution-gpg-keys    15     16        dnf5             @@ -24,6 +25,7 @@    24     25        libcap-ng-utils    25     26        libfido2    26     27        man-db           28        man-pages    27     29        openssh    28     30        openssh-clients    29     31        openssh-server             @@ -36,6 +38,7 @@    36     38        procps-ng    37     39        python3    38     40        rpm           41        sbsigntools    39     42        systemd-boot    40     43        systemd-container    41     44        systemd-networkd             @@ -47,6 +50,8 @@    47     50        tpm2-tss    48     51        veritysetup    49     52        vim-minimal           53        wget2           54        xz    50     55        zram-generator-defaults    51     56    52     57VolatilePackages=

             @@ -7,7 +7,8 @@     7      7Format=esp     8      8# UEFI insists on the .img suffix for disk images to boot from, hence let's combine our usual suffix with UEFI's     9      9OutputExtension=raw.img           10Output=netesp_%a    10     11ImageVersion=    11     12    12     13[Content]    13       Bootable=yes           14Bootable=no

             @@ -2,9 +2,15 @@     2      2     3      3[Content]     4      4Packages=            5        bluez            6        bolt     5      7        desktop-file-utils            8        pax-utils            9        pgpdump     6     10        pipewire     7     11        pipewire-alsa           12        qemu-guest-agent           13        wireless-regdb     8     14        xdg-desktop-portal     9     15    10     16# NetworkManager is used in the desktop profiles

             @@ -9,6 +9,7 @@     9      9        bluedevil    10     10        breeze-gtk    11     11        gwenview           12        qt6-qtimageformats    12     13        kde-gtk-config    13     14        kdeplasma-addons    14     15        kgamma

             @@ -8,3 +8,4 @@     8      8[Content]     9      9Packages=    10     10        systemd-boot-efi           11        systemd-boot-efi-signed

             @@ -0,0 +1,4 @@            1#!/usr/bin/sh            2            3chmod 755 /usr/bin/dumpcap            4setcap -r /usr/bin/dumpcap

             @@ -0,0 +1,13 @@            1[hashicorp]            2name=Hashicorp Stable - $basearch            3baseurl=https://rpm.releases.hashicorp.com/fedora/$releasever/$basearch/stable            4enabled=1            5gpgcheck=1            6gpgkey=https://rpm.releases.hashicorp.com/gpg            7            8[hashicorp-test]            9name=Hashicorp Test - $basearch           10baseurl=https://rpm.releases.hashicorp.com/fedora/$releasever/$basearch/test           11enabled=0           12gpgcheck=1           13gpgkey=https://rpm.releases.hashicorp.com/gpg

             @@ -3,6 +3,7 @@     3      3# This overrides the same file from systemd since we want to symlink everything     4      4# into /etc instead of copying so updates to /usr propagate properly.     5      5L /etc/os-release - - - - ../usr/lib/os-release            6L /etc/os-manifest - - - - ../usr/lib/os-manifest     6      7L+ /etc/mtab - - - - ../proc/self/mounts     7      8# Contains the default systemd locale     8      9L /etc/locale.conf             @@ -15,6 +16,9 @@    15     16L? /etc/bashrc    16     17L? /etc/bash.bashrc    17     18L? /etc/bash.bash_logout           19# TODO: drop once https://github.com/scop/bash-completion/pull/1399 is merged,           20# needed for shell completion of sd-run/run0           21L? /etc/bash_completion.d    18     22# Canonical location to look for certificates    19     23L? /etc/ca-certificates    20     24L? /etc/crypto-policies             @@ -45,6 +49,8 @@    45     49L? /etc/tuned    46     50# Required by gdm    47     51L? /etc/gdm           52# Required by sdm           53L? /etc/sddm    48     54# Required by geoclue    49     55L? /etc/geoclue    50     56# Required by fwupd             @@ -51,12 +57,21 @@    51     57L /etc/fwupd    52     58# Required by gnome    53     59L? /etc/dconf    54       # Required by a bunch of binary symlinks in fedora           60L? /etc/skel           61# CUPS is pulled in by GNOME, and fails if the configs are not there           62L? /etc/cups           63# On some distributions various binaries in /usr/bin are managed via           64# /etc/alternatives.    55     65L? /etc/alternatives           66# PackageKit does not run without /etc/PackageKit/ and GNOME stalls           67# logout/reboot if it doesn't run.           68L? /etc/PackageKit           69# ModemManager needds its dbus policy file           70L? /etc/dbus1/systemd.d/org.freedesktop.ModemManager1.conf           71# man fails without this in /etc/           72L? /etc/manpath.config    56     73# Required by man-db-cache-update.service    57     74L? /etc/sysconfig/man-db    58       # sddm breaks otherwise, at least with homed?    59       L? /etc/sddm    60     75    61     76## custom    62     77C /etc/opensnitchd             @@ -65,8 +80,8 @@    65     80    66     81#firewalld    67     82# this stuff from the `setup` package in Fedora is just kinda funny...           83C+ /etc/firewalld    68     84L? /etc/protocols    69       L? /etc/firewalld    70     85L? /etc/logrotate.d/firewalld    71     86L? /etc/modprobe.d/firewalld-sysctls.conf    72     87L? /etc/sysconfig/firewalld             @@ -77,5 +92,22 @@    77     92# cups    78     93L? /etc/cups    79     94           95# firejail           96L? /etc/firejail           97L? /etc/login.defs           98           99# OpenCL          100L? /etc/OpenCL          101    80    102# abrtd    81    103L? /etc/libreport          104          105# guestfs-tools (virt-builder)          106C+ /etc/virt-builder          107          108# libvirt needs all          109C+ /etc/libvirt          110          111# miscellaneous legacy file          112L? /etc/shells          113L? /etc/hosts

             @@ -10,6 +10,7 @@    10     10        linux-firmware    11     11        intel-media-driver    12     12        mesa           13        modemmanager    13     14        networkmanager    14     15        noto-fonts    15     16        pipewire-pulse             @@ -18,3 +19,4 @@    18     19        vulkan-intel    19     20        vulkan-nouveau    20     21        vulkan-radeon           22        wpa_supplicant

             @@ -4,7 +4,6 @@     4      4Distribution=debian     5      5     6      6[Content]     7       Splash=/usr/share/pixmaps/debian-logo.png     8      7Packages=     9      8        debconf    10      9        desktop-base             @@ -15,12 +14,22 @@    15     14        fonts-adobe-sourcesans3    16     15        fonts-noto-color-emoji    17     16        fonts-noto-mono           17        gstreamer1.0-libav           18        gstreamer1.0-plugins-ugly    18     19        kbd           20        libsecret-tools           21        libyubikey-udev    19     22        mesa-vulkan-drivers           23        modemmanager    20     24        network-manager    21     25        pipewire-pulse    22     26        plymouth-themes    23               task-desktop           27        steam-devices    24     28        tuned-ppd    25     29        va-driver-all    26     30        vdpau-driver-all           31        wpasupplicant           32           33InitrdVolatilePackages=           34        systemd-container           35        systemd-resolved

             @@ -16,10 +16,13 @@    16     16        linux-firmware    17     17        mesa-dri-drivers    18     18        mesa-vulkan-drivers           19        ModemManager    19     20        nvidia-gpu-firmware    20     21        NetworkManager    21     22        NetworkManager-wifi    22     23        pipewire-pulseaudio           24        steam-devices    23     25        tuned-ppd    24     26        google-noto-fonts-all    25     27        google-noto-color-emoji-fonts           28        wpa_supplicant

             @@ -5,7 +5,9 @@     5      5     6      6[Content]     7      7Packages=     8               gdm3     9               gnome-session-xsession            8        gnome-browser-connector            9        gnome-core           10        gnome-initial-setup           11        gnome-keyring-pkcs11    10     12        gnome-software-plugin-flatpak    11     13        gnome-software-plugin-fwupd

             @@ -5,4 +5,8 @@     5      5     6      6[Content]     7      7Packages=            8        adwaita-fonts-all     8      9        gdm           10        rsms-inter-fonts           11        rsms-inter-vf-fonts           12        default-fonts-core-emoji

             @@ -40,3 +40,8 @@    40     40    41     41# Maybe man db    42     42enable man-db-cache-update.service           43           44# Fedora 43 introduces a new authselect service in place of package scriptlets.           45# It fails and (I believe) shouldn't be needed           46# https://bugzilla.redhat.com/show_bug.cgi?id=2397255           47disable authselect-apply-changes.service

             @@ -0,0 +1,13 @@            1# SPDX-License-Identifier: LGPL-2.1-or-later            2            3[TriggerMatch]            4Distribution=debian            5Release=trixie            6            7[TriggerMatch]            8Distribution=ubuntu            9Release=|oracular           10Release=|plucky           11           12[Content]           13Packages=gnome-session-xsession

             @@ -0,0 +1,2 @@            1# TODO: drop after https://salsa.debian.org/printing-team/cups/-/merge_requests/11 is merged            2g lpadmin

             @@ -0,0 +1,2 @@            1# TODO: drop after https://gitlab.freedesktop.org/geoclue/geoclue/-/merge_requests/202 is merged            2u geoclue - - /var/lib/geoclue

             @@ -0,0 +1,3 @@            1# TODO: drop after https://salsa.debian.org/tts-team/speech-dispatcher/-/merge_requests/6 is merged            2u speech-dispatcher - "Speech Dispatcher" /run/speech-dispatcher /bin/false            3m speech-dispatcher audio

             @@ -0,0 +1,2 @@            1# TODO: drop after https://salsa.debian.org/debian/wpa/-/merge_requests/18 is merged            2g netdev

             @@ -8,3 +8,7 @@     8      8     9      9# On Debian/Ubuntu the nftable service fails if this config is not present    10     10L? /etc/nftables.conf           11           12# These can be dropped once https://bugs.debian.org/1108017 is fixed           13L? /etc/adduser.conf           14L? /etc/deluser.conf

             @@ -0,0 +1,3 @@            1title Debian 13 ParticleOS Current from OBS (Network Boot)            2architecture x64            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/debian_13_images/ParticleOS_x86-64.efi

             @@ -1,3 +0,0 @@     1       title Debian Testing ParticleOS Current from OBS (Network Boot)     2       architecture x64     3       uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/Debian_Testing_images/ParticleOS-x86-64.efi

             @@ -0,0 +1,3 @@            1title Debian Testing ParticleOS Current from OBS (Network Boot)            2architecture x64            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/debian_14_images/ParticleOS_x86-64.efi

             @@ -1,3 +0,0 @@     1       title Fedora 41 ParticleOS Current from OBS (Network Boot)     2       architecture x64     3       uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/Fedora_41_images/ParticleOS-x86-64.efi

             @@ -0,0 +1,3 @@            1title Fedora 42 ParticleOS Current from OBS (Network Boot)            2architecture x64            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/fedora_42_images/ParticleOS_x86-64.efi

             @@ -1,3 +1,3 @@     1      1title Fedora Rawhide ParticleOS Current from OBS (Network Boot)     2      2architecture x64     3       uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/Fedora_Rawhide_images/ParticleOS-x86-64.efi            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/fedora_44_images/ParticleOS_x86-64.efi

             @@ -0,0 +1,6 @@            1<?xml version="1.0" encoding="utf-8"?>            2<service>            3  <short>Hugo</short>            4  <description>Used for running Hugo's development server</description>            5  <port protocol="tcp" port="1313"/>            6</service>

             @@ -0,0 +1,4 @@            1# apt gets pulled in, but with /usr read-only doesn't make sense to run updates            2disable apt-daily.timer            3disable apt-daily-upgrade.timer            4disable apt-listchanges.timer

             @@ -0,0 +1,8 @@            1[Flatpak Repo]            2Title=Flathub            3Url=https://dl.flathub.org/repo/            4Homepage=https://flathub.org/            5Comment=Central repository of Flatpak applications            6Description=Central repository of Flatpak applications            7Icon=https://dl.flathub.org/repo/logo.svg            8GPGKey=mQINBFlD2sABEADsiUZUOYBg1UdDaWkEdJYkTSZD68214m8Q1fbrP5AptaUfCl8KYKFMNoAJRBXn9FbE6q6VBzghHXj/rSnA8WPnkbaEWR7xltOqzB1yHpCQ1l8xSfH5N02DMUBSRtD/rOYsBKbaJcOgW0K21sX+BecMY/AI2yADvCJEjhVKrjR9yfRX+NQEhDcbXUFRGt9ZT+TI5yT4xcwbvvTu7aFUR/dH7+wjrQ7lzoGlZGFFrQXSs2WI0WaYHWDeCwymtohXryF8lcWQkhH8UhfNJVBJFgCY8Q6UHkZG0FxMu8xnIDBMjBmSZKwKQn0nwzwM2afskZEnmNPYDI8nuNsSZBZSAw+ThhkdCZHZZRwzmjzyRuLLVFpOj3XryXwZcSefNMPDkZAuWWzPYjxS80cm2hG1WfqrG0Gl8+iX69cbQchb7gbEb0RtqNskTo9DDmO0bNKNnMbzmIJ3/rTbSahKSwtewklqSP/01o0WKZiy+n/RAkUKOFBprjJtWOZkc8SPXV/rnoS2dWsJWQZhuPPtv3tefdDiEyp7ePrfgfKxuHpZES0IZRiFI4J/nAUP5bix+srcIxOVqAam68CbAlPvWTivRUMRVbKjJiGXIOJ78wAMjqPg3QIC0GQ0EPAWwAOzzpdgbnG7TCQetaVV8rSYCuirlPYN+bJIwBtkOC9SWLoPMVZTwQARAQABtC5GbGF0aHViIFJlcG8gU2lnbmluZyBLZXkgPGZsYXRodWJAZmxhdGh1Yi5vcmc+iQJUBBMBCAA+FiEEblwF2XnHba+TwIE1QYTdTZB6fK4FAllD2sACGwMFCRLMAwAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQQYTdTZB6fK5RJQ/+Ptd4sWxaiAW91FFk7+wmYOkEe1NY2UDNJjEEz34PNP/1RoxveHDt43kYJQ23OWaPJuZAbu+fWtjRYcMBzOsMCaFcRSHFiDIC9aTp4ux/mo+IEeyarYt/oyKb5t5lta6xaAqg7rwt65jW5/aQjnS4h7eFZ+dAKta7Y/fljNrOznUp81/SMcx4QA5G2Pw0hs4Xrxg59oONOTFGBgA6FF8WQghrpR7SnEe0FSEOVsAjwQ13Cfkfa7b70omXSWp7GWfUzgBKyoWxKTqzMN3RQHjjhPJcsQnrqH5enUu4Pcb2LcMFpzimHnUgb9ft72DP5wxfzHGAWOUiUXHbAekfq5iFks8cha/RST6wkxG3Rf44Zn09aOxh1btMcGL+5xb1G0BuCQnA0fP/kDYIPwh9z22EqwRQOspIcvGeLVkFeIfubxpcMdOfQqQnZtHMCabV5Q/Rk9K1ZGc8M2hlg8gHbXMFch2xJ0Wu72eXbA/UY5MskEeBgawTQnQOK/vNm7t0AJMpWK26Qg6178UmRghmeZDj9uNRc3EI1nSbgvmGlpDmCxaAGqaGL1zW4KPW5yN25/qeqXcgCvUjZLI9PNq3Kvizp1lUrbx7heRiSoazCucvHQ1VHUzcPVLUKKTkoTP8okThnRRRsBcZ1+jI4yMWIDLOCT7IW3FePr+3xyuy5eEo9a25Ag0EWUPa7AEQALT/CmSyZ8LWlRYQZKYw417p7Z2hxqd6TjwkwM3IQ1irumkWcTZBZIbBgrSOg6CcXD2oWydCQHWi9qaxhuhEl2bJL5LskmBcMxVdQeD0LLHd8QUnbnnIby8ocvWN1alPfvJFjCUTrmD22U1ycOzRw2lIe4kiQONbOZtdWrVImQQSndjFlisitbmlWHvHm2lOOYy8+GJB7YffVV193hmnBSJffCy4bvkuLxsI+n1DhOzc7MPV3z6HGk4HiEcF0yyt9tCYhpsxHFdBoq2h771HfAcS0s98EVAqYMFnf9em+4cnYpdI6mhIfS1FQiKl6DBAYA8tT3ggla00DurPo0JwX/zN+PaO5h/6O9aCZwV7G6rbkgMuqMergXaf8oP38gr0z+MqWnkfM63Bodq68GP4l4hd02BoFBbDf38TMuGQB14+twJMdfbAxo2MbgluvQgfwHfZ2ca6gyEY+9s/YD1gugLjV+S6CB51WkFNe1z4tAPgJZNxUcKCbeaHNbthl8Hks/pY9RCEseX/EdfzF18epbSjJMPh4DPQXbUoFwmyuYcoBOPmvZHNl9hK7B/1RP8w1ZrXk8qdupC0SNbafX7270B7lMMVImzZetGsM9ypXJ6llhp3FwW09iseNyGJGPsr/dvTMGDXqOPfU/9SAS1LSTY4K9PbRtdrBE318YX8mIk5ABEBAAGJBHIEGAEIACYWIQRuXAXZecdtr5PAgTVBhN1NkHp8rgUCWUPa7AIbAgUJEswDAAJACRBBhN1NkHp8rsF0IAQZAQgAHRYhBFSmzd2JGfsgQgDYrFYnAunj7X7oBQJZQ9rsAAoJEFYnAunj7X7oR6AP/0KYmiAFeqx14Z43/6s2gt3VhxlSd8bmcVV7oJFbMhdHBIeWBp2BvsUf00I0Zl14ZkwCKfLwbbORC2eIxvzJ+QWjGfPhDmS4XUSmhlXxWnYEveSek5Tde+fmu6lqKM8CHg5BNx4GWIX/vdLi1wWJZyhrUwwICAxkuhKxuP2Z1An48930eslTD2GGcjByc27+9cIZjHKa07I/aLffo04V+oMT9/tgzoquzgpVV4jwekADo2MJjhkkPveSNI420bgT+Q7Fi1l0X1aFUniBvQMsaBa27PngWm6xE2ZYvh7nWCdd5g0c0eLIHxWwzV1lZ4Ryx4ITO/VL25ItECcjhTRdYa64sA62MYSaB0x3eR+SihpgP3wSNPFu3MJo6FKTFdi4CBAEmpWHFW7FcRmd+cQXeFrHLN3iNVWryy0HK/CUEJmiZEmpNiXecl4vPIIuyF0zgSCztQtKoMr+injpmQGC/rF/ELBVZTUSLNB350S0Ztvw0FKWDAJSxFmoxt3xycqvvt47rxTrhi78nkk6jATKGyvP55sO+K7Q7Wh0DXA69hvPrYW2eu8jGCdVGxi6HX7L1qcfEd0378S71dZ3g9o6KKl1OsDWWQ6MJ6FGBZedl/ibRfs8p5+sbCX3lQSjEFy3rx6n0rUrXx8U2qb+RCLzJlmC5MNBOTDJwHPcX6gKsUcXZrEQALmRHoo3SrewO41RCr+5nUlqiqV3AohBMhnQbGzyHf2+drutIaoh7Rj80XRh2bkkuPLwlNPf+bTXwNVGse4bej7B3oV6Ae1N7lTNVF4Qh+1OowtGjmfJPWo0z1s6HFJVxoIof9z58Msvgao0zrKGqaMWaNQ6LUeC9g9Aj/9Uqjbo8X54aLiYs8Z1WNc06jKP+gv8AWLtv6CR+l2kLez1YMDucjm7v6iuCMVAmZdmxhg5I/X2+OM3vBsqPDdQpr2TPDLX3rCrSBiS0gOQ6DwN5N5QeTkxmY/7QO8bgLo/Wzu1iilH4vMKW6LBKCaRx5UEJxKpL4wkgITsYKneIt3NTHo5EOuaYk+y2+Dvt6EQFiuMsdbfUjs3seIHsghX/cbPJa4YUqZAL8C4OtVHaijwGo0ymt9MWvS9yNKMyT0JhN2/BdeOVWrHk7wXXJn/ZjpXilicXKPx4udCF76meE+6N2u/T+RYZ7fP1QMEtNZNmYDOfA6sViuPDfQSHLNbauJBo/n1sRYAsL5mcG22UDchJrlKvmK3EOADCQg+myrm8006LltubNB4wWNzHDJ0Ls2JGzQZCd/xGyVmUiidCBUrD537WdknOYE4FD7P0cHaM9brKJ/M8LkEH0zUlo73bY4XagbnCqve6PvQb5G2Z55qhWphd6f4B6DGed86zJEa/RhS

             @@ -0,0 +1,14 @@            1# SPDX-License-Identifier: LGPL-2.1-or-later            2# TODO: drop once https://gitlab.freedesktop.org/accountsservice/accountsservice/-/issues/89 is fixed            3            4[Unit]            5Description=Tell the accounts service about homed users            6After=systemd-homed.service accounts-daemon.service            7Before=systemd-user-sessions.service            8            9[Service]           10Type=oneshot           11ExecStart=/bin/bash -c "for n in $$(busctl call org.freedesktop.home1 /org/freedesktop/home1 org.freedesktop.home1.Manager ListHomes --json=pretty | jq -r '.data.[].[].[0]'); do busctl call org.freedesktop.Accounts /org/freedesktop/Accounts org.freedesktop.Accounts CacheUser s $$n; done"           12           13[Install]           14WantedBy=multi-user.target

             @@ -0,0 +1,3 @@            1# Disabled by default in the package            2disable speech-dispatcherd.service            3

             @@ -1,3 +0,0 @@     1       # TODO: drop once https://bugs.debian.org/1025349 is fixed     2       [Install]     3       Alias=display-manager.service

             @@ -0,0 +1,3 @@            1# TODO: drop once https://bugs.debian.org/1025349 is fixed            2[Install]            3Alias=display-manager.service