local customizations

             @@ -10,3 +10,6 @@    10     10[*.conf]    11     11indent_style = space    12     12indent_size = 4           13           14[mkosi.passphrase]           15insert_final_newline = false

             @@ -11,3 +11,5 @@    11     11.mkosi-private    12     12mkosi.packages/    13     13keys/           14mkosi.profiles/custom/mkosi.extra/usr/local/bin/           15versions/

             @@ -0,0 +1,3 @@            1[submodule "systemd"]            2	path = systemd            3	url = https://github.com/systemd/systemd

             @@ -0,0 +1,1 @@            1systemd/**

             @@ -15,7 +15,7 @@    15     15image.    16     16    17     17The ParticleOS image is built using [mkosi](https://github.com/systemd/mkosi).    18       You will need to install the current main branch of mkosi to build current            18You will need to install the current main branch of mkosi to build current    19     19ParticleOS images.    20     20    21     21First, configure the variant you'd like to build in `mkosi.local.conf`. For a

             @@ -0,0 +1,54 @@            1BIN_DIR := mkosi.profiles/custom/mkosi.extra/usr/local/bin            2PACKAGES_DIR := mkosi.profiles/custom/mkosi.packages            3btdu := $(BIN_DIR)/btdu            4opensnitch := $(PACKAGES_DIR)/opensnitch.rpm            5opensnitch_ui := $(PACKAGES_DIR)/opensnitch_ui.rpm            6ALL := $(btdu) $(opensnitch) $(opensnitch_ui)            7CURRENT_VERSION = $(shell mkosi summary --json | jq -r '.Images[] | select(.Image == "main") | .ImageVersion')            8            9.PHONY: deps           10deps: $(PACKAGES_DIR) $(BIN_DIR) $(ALL)           11           12.PHONY: clean           13clean:           14	rm -fv $(ALL)           15           16$(BIN_DIR) $(PACKAGES_DIR):           17	mkdir -p $@           18           19$(btdu): $(MAKE_TMPDIR)/btdu           20	echo 35b9bb752e6aa902b8281e92a5411b2f1cfb9fa251089adf909dc95efc011c48 $(MAKE_TMPDIR)/btdu | sha256sum --check           21	cp $(MAKE_TMPDIR)/btdu $@           22           23$(MAKE_TMPDIR)/btdu:           24	wget https://github.com/CyberShadow/btdu/releases/download/v0.6.0/btdu-static-x86_64 -O $(MAKE_TMPDIR)/btdu           25           26$(opensnitch): $(MAKE_TMPDIR)/opensnitch.rpm           27	echo 2caf4e13ffd1b7af48306a2e9e979042f526823720b42bee4c00194f140d64dd $(MAKE_TMPDIR)/opensnitch.rpm | sha256sum --check           28	cp $(MAKE_TMPDIR)/opensnitch.rpm $@           29           30$(MAKE_TMPDIR)/opensnitch.rpm:           31		wget https://github.com/evilsocket/opensnitch/releases/download/v1.7.2/opensnitch-1.7.2-1.x86_64.rpm -O $(MAKE_TMPDIR)/opensnitch.rpm           32           33$(opensnitch_ui): $(MAKE_TMPDIR)/opensnitch_ui.rpm           34	echo b26029cbc83880ebc92170035d50237c13b17ffc0b3cf52b89fa1348edfdfb43 $(MAKE_TMPDIR)/opensnitch_ui.rpm | sha256sum --check           35	cp $(MAKE_TMPDIR)/opensnitch_ui.rpm $@           36           37$(MAKE_TMPDIR)/opensnitch_ui.rpm:           38	wget https://github.com/evilsocket/opensnitch/releases/download/v1.7.2/opensnitch-ui-1.7.2-1.noarch.rpm -O $(MAKE_TMPDIR)/opensnitch_ui.rpm           39           40mkosi.crt:           41	ln -s ~/Vaults/particleos_keys/sbctl/var/keys/db/db.pem mkosi.crt           42           43mkosi.key:           44	ln -s ~/Vaults/particleos_keys/sbctl/var/keys/db/db.key mkosi.key           45           46.PHONY: build           47	mkosi build --auto-bump           48           49.PHONY: sysupdate           50sysupdate:           51	mkosi sysupdate -- update           52	mkdir -p versions           53	cat mkosi.output/ParticleOS_$(CURRENT_VERSION)_x86-64.manifest | gzip > versions/$(CURRENT_VERSION).manifest.gz           54	cat mkosi.output/ParticleOS_$(CURRENT_VERSION)_x86-64.changelog | gzip > versions/$(CURRENT_VERSION).changelog.gz

             @@ -5,6 +5,7 @@     5      5     6      6[Build]     7      7ToolsTree=default            8ToolsTreeProfiles=misc,runtime,gui     8      9History=yes     9     10CacheDirectory=mkosi.cache    10     11Incremental=yes             @@ -106,7 +107,6 @@   106    107RAM=4G   107    108CPUs=4   108    109Ephemeral=yes   109       RuntimeScratch=no   110    110Credentials=   111    111        passwd.plaintext-password.root=particleos   112    112        tty.serial.hvc0.agetty.autologin=particleos

             @@ -1,21 +1,21 @@     1      1[Distribution]     2      2Distribution=fedora     3       Release=42            3Release=43     4      4     5      5[Build]     6      6ToolsTree=default     7      7ToolsTreeDistribution=fedora     8       ToolsTreeRelease=42     9       ExtraSearchPaths=../systemd/build/mkosi.builddir/fedora~42~x86-64/            8ToolsTreeProfiles=misc,runtime,gui            9ExtraSearchPaths=./systemd/build/mkosi.builddir/fedora~43~x86-64/    10     10    11     11[Config]    12       Profiles=desktop,kde           12Profiles=desktop,kde,custom    13     13    14     14[Output]    15       Format=disk           15ManifestFormat=changelog    16     16    17     17[Content]    18       VolatilePackageDirectories=../systemd/build/mkosi.builddir/fedora~42~x86-64/           18VolatilePackageDirectories=./systemd/build/mkosi.builddir/fedora~43~x86-64/    19     19Packages=    20     20        ansible    21     21        awk             @@ -25,14 +25,27 @@    25     25        bind-utils    26     26        bat    27     27        clatd           28        clang-devel    28     29        cowsay    29     30        cmatrix    30     31        curl           32        debian-keyring    31     33        dictd    32     34        du-dust           35        duf           36        d2    33     37        emacs           38        entr    34     39        exfatprogs           40        exiftool    35     41        fastfetch           42        fcitx5-mozc           43        fcitx5-configtool           44        fcitx5-gtk           45        fcitx5-qt           46        firejail           47        fontawesome-fonts-all           48        kcm-fcitx5    36     49        fd-find    37     50        file    38     51        fish             @@ -46,11 +59,18 @@    46     59        git    47     60        git-absorb    48     61        git-delta           62        git-lfs    49     63        glances           64        # needed for geoclue?           65        glib-networking           66        guestfs-tools    50     67        golang           68        graphviz    51     69        htop    52     70        iio-sensor-proxy           71        ImageMagick    53     72        iperf3           73        java-latest-openjdk    54     74        @kde-desktop    55     75        kde-connect    56     76        kde-partitionmanager             @@ -61,22 +81,32 @@    61     81        libfprint-tod    62     82        libfprint-2-tod1-broadcom    63     83        libfprint-tod-selinux           84        litecli    64     85        lm_sensors    65     86        lolcat    66     87        lshw           88        lsof    67     89        man    68     90        # include mkosi just for shell completion and man pages    69     91        mkosi    70     92        mokutil           93        mpv    71     94        ncdu           95        neovim           96        ninja    72     97        okular           98        osc    73     99        # needed for bell fish function    74    100        oxygen-sounds    75               neovim          101        pre-commit    76    102        python3-neovim          103        nmap    77    104        nmap-ncat    78    105        # for coc.nvim    79    106        npm          107        # needed for clatd on F43 apparently          108        perl-IPC-Cmd          109        perl-JSON    80    110        pipewire-utils    81    111        plasma-disks    82    112        plasma-vault             @@ -83,37 +113,37 @@    83    113        pnpm    84    114        powertop    85    115        proxychains-ng          116        pv          117        python3-netaddr    86    118        ripgrep          119        rubygem-asciidoctor    87    120        rustup    88    121        rsync    89    122        sbctl    90    123        setroubleshoot    91               stgit    92    124        sbsigntools          125        sqlite          126        stgit    93    127        tcpdump          128        # not yet available for fedora 43          129        terraform-ls    94    130        tmux    95    131        toolbox          132        tor    96    133        translate-shell    97    134        trash-cli    98    135        ttyplot    99    136        units   100    137        unrar-free   101               libvirt-daemon   102    138        @virtualization   103    139        wget   104    140        whois          141        wl-clipboard   105    142        wireshark   106    143        yubikey-manager   107    144        kernel   108               repository/opensnitch-ui-1.7.1-1.noarch.rpm   109               repository/opensnitch-1.7.1-1.x86_64.rpm          145        # repository directory comes from mkosi.packages          146        repository/opensnitch_ui.rpm          147        repository/opensnitch.rpm   110    148        python3-grpcio+protobuf   111    149        python3-slugify   112          113       [Validation]   114       SecureBootKey=./keys/sbctl/var/keys/db/db.key   115       SecureBootCertificate=./keys/sbctl/var/keys/db/db.pem   116       SignExpectedPcrKey=./keys/sbctl/var/keys/db/db.key   117       SignExpectedPcrCertificate=./keys/sbctl/var/keys/db/db.pem   118       VerityKey=./keys/sbctl/var/keys/db/db.key   119       VerityCertificate=./keys/sbctl/var/keys/db/db.pem

             @@ -0,0 +1,1 @@            115bd1496c9b59c1ec8ee05e78c65eeb3f148c898

             @@ -0,0 +1,13 @@            1rebuild:            2  steps:            3    - trigger_services:            4        project: system:systemd            5        package: particleos-debian            6    - trigger_services:            7        project: system:systemd            8        package: particleos-fedora            9  filters:           10    event: push           11    branches:           12      only:           13        - obs

             @@ -0,0 +1,9 @@            1#!/bin/bash            2# SPDX-License-Identifier: LGPL-2.1-or-later            3set -e            4            5# Debian/Ubuntu PAM patches break /usr/lib/pam.d/ so copy to factory            6# TODO: drop after https://salsa.debian.org/vorlon/pam/-/merge_requests/26 is merged            7if [[ -f /usr/lib/tmpfiles.d/debian.conf ]]; then            8    sed -i '/\/etc\/pam.d/d' /usr/lib/tmpfiles.d/debian.conf            9fi

             @@ -10,6 +10,7 @@    10     10Packages=    11     11        bash-color-prompt    12     12        bpftool           13        cracklib-dicts    13     14        cryptsetup    14     15        distribution-gpg-keys    15     16        dnf5

             @@ -2,6 +2,7 @@     2      2     3      3[Content]     4      4Packages=            5        bluez     5      6        bolt     6      7        desktop-file-utils     7      8        pax-utils             @@ -8,6 +9,7 @@     8      9        pgpdump     9     10        pipewire    10     11        pipewire-alsa           12        qemu-guest-agent    11     13        wireless-regdb    12     14        xdg-desktop-portal    13     15

             @@ -9,6 +9,7 @@     9      9        bluedevil    10     10        breeze-gtk    11     11        gwenview           12        qt6-qtimageformats    12     13        kde-gtk-config    13     14        kdeplasma-addons    14     15        kgamma

             @@ -0,0 +1,4 @@            1#!/usr/bin/sh            2            3chmod 755 /usr/bin/dumpcap            4setcap -r /usr/bin/dumpcap

             @@ -0,0 +1,13 @@            1[hashicorp]            2name=Hashicorp Stable - $basearch            3baseurl=https://rpm.releases.hashicorp.com/fedora/$releasever/$basearch/stable            4enabled=1            5gpgcheck=1            6gpgkey=https://rpm.releases.hashicorp.com/gpg            7            8[hashicorp-test]            9name=Hashicorp Test - $basearch           10baseurl=https://rpm.releases.hashicorp.com/fedora/$releasever/$basearch/test           11enabled=0           12gpgcheck=1           13gpgkey=https://rpm.releases.hashicorp.com/gpg

             @@ -15,6 +15,9 @@    15     15L? /etc/bashrc    16     16L? /etc/bash.bashrc    17     17L? /etc/bash.bash_logout           18# TODO: drop once https://github.com/scop/bash-completion/pull/1399 is merged,           19# needed for shell completion of sd-run/run0           20L? /etc/bash_completion.d    18     21# Canonical location to look for certificates    19     22L? /etc/ca-certificates    20     23L? /etc/crypto-policies             @@ -51,8 +54,17 @@    51     54L /etc/fwupd    52     55# Required by gnome    53     56L? /etc/dconf    54       # Required by a bunch of binary symlinks in fedora           57L? /etc/skel           58# CUPS is pulled in by GNOME, and fails if the configs are not there           59L? /etc/cups           60# On some distributions various binaries in /usr/bin are managed via           61# /etc/alternatives.    55     62L? /etc/alternatives           63# PackageKit does not run without /etc/PackageKit/ and GNOME stalls           64# logout/reboot if it doesn't run.           65L? /etc/PackageKit           66# ModemManager needds its dbus policy file           67L? /etc/dbus1/systemd.d/org.freedesktop.ModemManager1.conf    56     68# Required by man-db-cache-update.service    57     69L? /etc/sysconfig/man-db    58     70# sddm breaks otherwise, at least with homed?             @@ -65,8 +77,8 @@    65     77    66     78#firewalld    67     79# this stuff from the `setup` package in Fedora is just kinda funny...           80C+ /etc/firewalld    68     81L? /etc/protocols    69       L? /etc/firewalld    70     82L? /etc/logrotate.d/firewalld    71     83L? /etc/modprobe.d/firewalld-sysctls.conf    72     84L? /etc/sysconfig/firewalld             @@ -77,5 +89,19 @@    77     89# cups    78     90L? /etc/cups    79     91           92# firejail           93L? /etc/firejail           94L? /etc/login.defs           95    80     96# abrtd    81     97L? /etc/libreport           98           99# guestfs-tools (virt-builder)          100C+ /etc/virt-builder          101          102# libvirt needs all          103C+ /etc/libvirt          104          105# miscellaneous legacy file          106L? /etc/shells          107L? /etc/hosts

             @@ -7,8 +7,7 @@     7      7Packages=     8      8        gnome-browser-connector     9      9        gnome-core    10               # TODO: enable when it integrates with homed    11               # gnome-initial-setup           10        gnome-initial-setup    12     11        gnome-keyring-pkcs11    13     12        gnome-session-xsession    14     13        gnome-software-plugin-flatpak

             @@ -5,4 +5,8 @@     5      5     6      6[Content]     7      7Packages=            8        adwaita-fonts-all     8      9        gdm           10        rsms-inter-fonts           11        rsms-inter-vf-fonts           12        default-fonts-core-emoji

             @@ -40,3 +40,8 @@    40     40    41     41# Maybe man db    42     42enable man-db-cache-update.service           43           44# Fedora 43 introduces a new authselect service in place of package scriptlets.           45# It fails and (I believe) shouldn't be needed           46# https://bugzilla.redhat.com/show_bug.cgi?id=2397255           47disable authselect-apply-changes.service

             @@ -1,4 +0,0 @@     1       # apt gets pulled in, but with /usr read-only doesn't make sense to run updates     2       disable apt-daily.timer     3       disable apt-daily-upgrade.timer     4       disable apt-listchanges.timer

             @@ -9,20 +9,6 @@     9      9# On Debian/Ubuntu the nftable service fails if this config is not present    10     10L? /etc/nftables.conf    11     11    12       # Very basic stuff like awk and which is managed through alternatives    13       L? /etc/alternatives    14           15       # CUPS is pulled in by GNOME, and fails if the configs are not there    16       L? /etc/cups    17           18       # Needed to create users by GNOME's GUI    19       L? /etc/skel    20     12# These can be dropped once https://bugs.debian.org/1108017 is fixed    21     13L? /etc/adduser.conf    22     14L? /etc/deluser.conf    23           24       # PackageKit does not run without /etc/PackageKit/ and GNOME stalls logout/reboot if it doesn't run    25       L? /etc/PackageKit    26           27       # TODO: drop once https://github.com/scop/bash-completion/pull/1399 is merged, needed for shell completion of sd-run/run0    28       L? /etc/bash_completion.d

             @@ -0,0 +1,3 @@            1title Debian 13 ParticleOS Current from OBS (Network Boot)            2architecture x64            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/debian_13_images/ParticleOS_x86-64.efi

             @@ -1,3 +0,0 @@     1       title Debian Testing ParticleOS Current from OBS (Network Boot)     2       architecture x64     3       uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/Debian_Testing_images/ParticleOS-x86-64.efi

             @@ -0,0 +1,3 @@            1title Debian Testing ParticleOS Current from OBS (Network Boot)            2architecture x64            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/debian_14_images/ParticleOS_x86-64.efi

             @@ -1,3 +0,0 @@     1       title Fedora 41 ParticleOS Current from OBS (Network Boot)     2       architecture x64     3       uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/Fedora_41_images/ParticleOS-x86-64.efi

             @@ -0,0 +1,3 @@            1title Fedora 42 ParticleOS Current from OBS (Network Boot)            2architecture x64            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/fedora_42_images/ParticleOS_x86-64.efi

             @@ -1,3 +1,3 @@     1      1title Fedora Rawhide ParticleOS Current from OBS (Network Boot)     2      2architecture x64     3       uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/Fedora_Rawhide_images/ParticleOS-x86-64.efi            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/fedora_44_images/ParticleOS_x86-64.efi

             @@ -0,0 +1,6 @@            1<?xml version="1.0" encoding="utf-8"?>            2<service>            3  <short>Hugo</short>            4  <description>Used for running Hugo's development server</description>            5  <port protocol="tcp" port="1313"/>            6</service>

             @@ -0,0 +1,4 @@            1# apt gets pulled in, but with /usr read-only doesn't make sense to run updates            2disable apt-daily.timer            3disable apt-daily-upgrade.timer            4disable apt-listchanges.timer

             @@ -0,0 +1,14 @@            1# SPDX-License-Identifier: LGPL-2.1-or-later            2# TODO: drop once https://gitlab.freedesktop.org/accountsservice/accountsservice/-/issues/89 is fixed            3            4[Unit]            5Description=Tell the accounts service about homed users            6After=systemd-homed.service accounts-daemon.service            7Before=systemd-user-sessions.service            8            9[Service]           10Type=oneshot           11ExecStart=/bin/bash -c "for n in $$(busctl call org.freedesktop.home1 /org/freedesktop/home1 org.freedesktop.home1.Manager ListHomes --json=pretty | jq -r '.data.[].[].[0]'); do busctl call org.freedesktop.Accounts /org/freedesktop/Accounts org.freedesktop.Accounts CacheUser s $$n; done"           12           13[Install]           14WantedBy=multi-user.target