local customizations

             @@ -10,3 +10,6 @@    10     10[*.conf]    11     11indent_style = space    12     12indent_size = 4           13           14[mkosi.passphrase]           15insert_final_newline = false

             @@ -11,3 +11,5 @@    11     11.mkosi-private    12     12mkosi.packages/    13     13keys/           14mkosi.profiles/custom/mkosi.extra/usr/local/bin/           15versions/

             @@ -0,0 +1,1 @@            1systemd/**

             @@ -15,7 +15,7 @@    15     15image.    16     16    17     17The ParticleOS image is built using [mkosi](https://github.com/systemd/mkosi).    18       You will need to install the current main branch of mkosi to build current            18You will need to install the current main branch of mkosi to build current    19     19ParticleOS images.    20     20    21     21First, configure the variant you'd like to build in `mkosi.local.conf`. For a

             @@ -0,0 +1,77 @@            1BIN_DIR := mkosi.profiles/custom/mkosi.extra/usr/local/bin            2PACKAGES_DIR := mkosi.profiles/custom/mkosi.packages            3btdu := $(BIN_DIR)/btdu            4jj := $(BIN_DIR)/jj            5opensnitch := $(PACKAGES_DIR)/opensnitch.rpm            6opensnitch_ui := $(PACKAGES_DIR)/opensnitch_ui.rpm            7ALL := $(btdu) $(jj) $(opensnitch) $(opensnitch_ui)            8LATEST_VERSION = $(shell mkosi summary --json | jq -r '.Images[] | select(.Image == "main") | .ImageVersion')            9INSTALLED_VERSION = $(shell grep IMAGE_VERSION /etc/os-release | cut -d= -f2 | tr -d \")           10           11.PHONY: deps           12deps: $(PACKAGES_DIR) $(BIN_DIR) $(ALL)           13           14.PHONY: clean           15clean:           16	rm -fv $(ALL)           17           18$(BIN_DIR) $(PACKAGES_DIR):           19	mkdir -p $@           20           21$(jj): $(MAKE_TMPDIR)/jj.tar.gz           22	echo 9967a240e3294a0bce4444c55d40a35b70af44c69b558689aced95e4e497cef2 $(MAKE_TMPDIR)/jj.tar.gz | sha256sum --check           23	tar -xzf $(MAKE_TMPDIR)/jj.tar.gz -C $(MAKE_TMPDIR)           24	cp $(MAKE_TMPDIR)/jj $@           25           26$(MAKE_TMPDIR)/jj.tar.gz:           27	wget https://github.com/jj-vcs/jj/releases/download/v0.35.0/jj-v0.35.0-x86_64-unknown-linux-musl.tar.gz -O $(MAKE_TMPDIR)/jj.tar.gz           28           29$(btdu): $(MAKE_TMPDIR)/btdu           30	echo 35b9bb752e6aa902b8281e92a5411b2f1cfb9fa251089adf909dc95efc011c48 $(MAKE_TMPDIR)/btdu | sha256sum --check           31	cp $(MAKE_TMPDIR)/btdu $@           32           33$(MAKE_TMPDIR)/btdu:           34	wget https://github.com/CyberShadow/btdu/releases/download/v0.6.0/btdu-static-x86_64 -O $(MAKE_TMPDIR)/btdu           35           36$(opensnitch): $(MAKE_TMPDIR)/opensnitch.rpm           37	echo 2caf4e13ffd1b7af48306a2e9e979042f526823720b42bee4c00194f140d64dd $(MAKE_TMPDIR)/opensnitch.rpm | sha256sum --check           38	cp $(MAKE_TMPDIR)/opensnitch.rpm $@           39           40$(MAKE_TMPDIR)/opensnitch.rpm:           41		wget https://github.com/evilsocket/opensnitch/releases/download/v1.7.2/opensnitch-1.7.2-1.x86_64.rpm -O $(MAKE_TMPDIR)/opensnitch.rpm           42           43$(opensnitch_ui): $(MAKE_TMPDIR)/opensnitch_ui.rpm           44	echo b26029cbc83880ebc92170035d50237c13b17ffc0b3cf52b89fa1348edfdfb43 $(MAKE_TMPDIR)/opensnitch_ui.rpm | sha256sum --check           45	cp $(MAKE_TMPDIR)/opensnitch_ui.rpm $@           46           47$(MAKE_TMPDIR)/opensnitch_ui.rpm:           48	wget https://github.com/evilsocket/opensnitch/releases/download/v1.7.2/opensnitch-ui-1.7.2-1.noarch.rpm -O $(MAKE_TMPDIR)/opensnitch_ui.rpm           49           50mkosi.crt:           51	ln -s ~/Vaults/particleos_keys/sbctl/var/keys/db/db.pem mkosi.crt           52           53mkosi.key:           54	ln -s ~/Vaults/particleos_keys/sbctl/var/keys/db/db.key mkosi.key           55           56.PHONY: build           57build:           58	mkosi build --auto-bump           59           60.PHONY: systemd           61systemd:           62	sh -c 'cd systemd && mkosi -t none -f --distribution=fedora --release=43'           63           64.PHONY: sysupdate           65sysupdate:           66	mkosi sysupdate -- update           67	mkdir -p versions           68	cat mkosi.output/ParticleOS_$(LATEST_VERSION)_x86-64.manifest | gzip > versions/$(LATEST_VERSION).manifest.gz           69	cat mkosi.output/ParticleOS_$(LATEST_VERSION)_x86-64.changelog | gzip > versions/$(LATEST_VERSION).changelog.gz           70           71.PHONY: diff_changelog           72diff_changelog:           73	diff --color=always -u <(gzip --decompress --to-stdout versions/$(INSTALLED_VERSION).changelog.gz) mkosi.output/ParticleOS_$(LATEST_VERSION)_x86-64.changelog           74           75.PHONY: diff_manifest           76diff_manifest:           77	diff --color=always -u <(gzip --decompress --to-stdout versions/$(INSTALLED_VERSION).manifest.gz) mkosi.output/ParticleOS_$(LATEST_VERSION)_x86-64.manifest

             @@ -5,6 +5,7 @@     5      5     6      6[Build]     7      7ToolsTree=default            8ToolsTreeProfiles=misc,runtime,gui     8      9History=yes     9     10CacheDirectory=mkosi.cache    10     11Incremental=yes             @@ -106,7 +107,6 @@   106    107RAM=4G   107    108CPUs=4   108    109Ephemeral=yes   109       RuntimeScratch=no   110    110Credentials=   111    111        passwd.plaintext-password.root=particleos   112    112        tty.serial.hvc0.agetty.autologin=particleos

             @@ -1,21 +1,25 @@     1      1[Distribution]     2      2Distribution=fedora     3       Release=42            3Release=43     4      4     5      5[Build]     6      6ToolsTree=default     7      7ToolsTreeDistribution=fedora     8       ExtraSearchPaths=./systemd/build/mkosi.builddir/fedora~42~x86-64/            8ToolsTreeProfiles=misc,runtime,gui            9ExtraSearchPaths=./systemd/build/mkosi.builddir/fedora~43~x86-64/     9     10    10     11[Config]    11       Profiles=desktop,kde           12Profiles=desktop,kde,custom    12     13    13     14[Output]    14       Format=disk           15ManifestFormat=changelog    15     16    16     17[Content]    17       VolatilePackageDirectories=./systemd/build/mkosi.builddir/fedora~42~x86-64/           18VolatilePackageDirectories=./systemd/build/mkosi.builddir/fedora~43~x86-64/    18     19Packages=           20        # keyrings for building other distro images           21        archlinux-keyring           22        debian-keyring    19     23        ansible    20     24        awk    21     25        bash             @@ -24,14 +28,27 @@    24     28        bind-utils    25     29        bat    26     30        clatd           31        clang-devel    27     32        cowsay    28     33        cmatrix    29     34        curl    30     35        dictd           36        diffoscope    31     37        du-dust           38        duf           39        d2    32     40        emacs           41        entr    33     42        exfatprogs           43        exiftool    34     44        fastfetch           45        fcitx5-mozc           46        fcitx5-configtool           47        fcitx5-gtk           48        fcitx5-qt           49        firejail           50        fontawesome-fonts-all           51        kcm-fcitx5    35     52        fd-find    36     53        file    37     54        fish             @@ -45,11 +62,21 @@    45     62        git    46     63        git-absorb    47     64        git-delta           65        git-lfs    48     66        glances           67        # needed for geoclue?           68        glib-networking           69        guestfs-tools    49     70        golang           71        graphviz    50     72        htop    51     73        iio-sensor-proxy           74        ImageMagick    52     75        iperf3           76        java-latest-openjdk           77        katago-opencl           78        intel-opencl           79        OpenCL-ICD-Loader    53     80        @kde-desktop    54     81        kde-connect    55     82        kde-partitionmanager             @@ -60,38 +87,56 @@    60     87        libfprint-tod    61     88        libfprint-2-tod1-broadcom    62     89        libfprint-tod-selinux           90        litecli    63     91        lm_sensors    64     92        lolcat    65     93        lshw           94        lsof    66     95        man    67     96        # include mkosi just for shell completion and man pages    68     97        mkosi    69     98        mokutil           99        mpv    70    100        ncdu          101        neovim          102        ninja    71    103        okular          104        osc    72    105        # needed for bell fish function    73    106        oxygen-sounds    74               neovim          107        pre-commit    75    108        python3-neovim          109        nmap    76    110        nmap-ncat    77    111        # for coc.nvim    78    112        npm          113        # needed for clatd on F43 apparently          114        perl-IPC-Cmd          115        perl-JSON    79    116        pipewire-utils    80    117        plasma-disks    81    118        plasma-vault    82    119        pnpm    83    120        powertop          121        progress    84    122        proxychains-ng          123        pv          124        python3-netaddr    85    125        ripgrep          126        rubygem-asciidoctor    86    127        rustup    87    128        rsync    88    129        sbctl    89    130        setroubleshoot    90               stgit    91    131        sbsigntools          132        sqlite          133        stgit    92    134        tcpdump          135        # not yet available for fedora 43          136        terraform-ls    93    137        tmux    94    138        toolbox          139        tor    95    140        translate-shell    96    141        trash-cli    97    142        ttyplot             @@ -100,18 +145,12 @@   100    145        @virtualization   101    146        wget   102    147        whois          148        wl-clipboard   103    149        wireshark   104    150        yubikey-manager   105    151        kernel   106               repository/opensnitch-ui-1.7.1-1.noarch.rpm   107               repository/opensnitch-1.7.1-1.x86_64.rpm          152        # repository directory comes from mkosi.packages          153        repository/opensnitch_ui.rpm          154        repository/opensnitch.rpm   108    155        python3-grpcio+protobuf   109    156        python3-slugify   110          111       [Validation]   112       SecureBootKey=./keys/sbctl/var/keys/db/db.key   113       SecureBootCertificate=./keys/sbctl/var/keys/db/db.pem   114       SignExpectedPcrKey=./keys/sbctl/var/keys/db/db.key   115       SignExpectedPcrCertificate=./keys/sbctl/var/keys/db/db.pem   116       VerityKey=./keys/sbctl/var/keys/db/db.key   117       VerityCertificate=./keys/sbctl/var/keys/db/db.pem

             @@ -1,1 +1,1 @@     1       8a6128b68bf5573bda7499318629ecb2be666848            153405835a2aa6e360863660f1e0e4d9a9688085f

             @@ -0,0 +1,13 @@            1rebuild:            2  steps:            3    - trigger_services:            4        project: system:systemd            5        package: particleos-debian            6    - trigger_services:            7        project: system:systemd            8        package: particleos-fedora            9  filters:           10    event: push           11    branches:           12      only:           13        - obs

             @@ -0,0 +1,9 @@            1#!/bin/bash            2# SPDX-License-Identifier: LGPL-2.1-or-later            3set -e            4            5# Debian/Ubuntu PAM patches break /usr/lib/pam.d/ so copy to factory            6# TODO: drop after https://salsa.debian.org/vorlon/pam/-/merge_requests/26 is merged            7if [[ -f /usr/lib/tmpfiles.d/debian.conf ]]; then            8    sed -i '/\/etc\/pam.d/d' /usr/lib/tmpfiles.d/debian.conf            9fi

             @@ -10,6 +10,7 @@    10     10Packages=    11     11        bash-color-prompt    12     12        bpftool           13        cracklib-dicts    13     14        cryptsetup    14     15        distribution-gpg-keys    15     16        dnf5

             @@ -2,6 +2,7 @@     2      2     3      3[Content]     4      4Packages=            5        bluez     5      6        bolt     6      7        desktop-file-utils     7      8        pax-utils             @@ -8,6 +9,7 @@     8      9        pgpdump     9     10        pipewire    10     11        pipewire-alsa           12        qemu-guest-agent    11     13        wireless-regdb    12     14        xdg-desktop-portal    13     15

             @@ -9,6 +9,7 @@     9      9        bluedevil    10     10        breeze-gtk    11     11        gwenview           12        qt6-qtimageformats    12     13        kde-gtk-config    13     14        kdeplasma-addons    14     15        kgamma

             @@ -0,0 +1,9 @@            1# SPDX-License-Identifier: LGPL-2.1-or-later            2            3[systemd]            4name=systemd packages built from upstream main (Fedora_Rawhide)            5type=rpm-md            6baseurl=https://download.opensuse.org/repositories/system:/systemd/Fedora_Rawhide/            7gpgcheck=1            8gpgkey=file:///usr/share/pki/rpm-gpg/systemd.gpg            9enabled=1

             @@ -1,9 +0,0 @@     1       # SPDX-License-Identifier: LGPL-2.1-or-later     2            3       [systemd]     4       name=systemd packages built from upstream main (Fedora_42)     5       type=rpm-md     6       baseurl=https://download.opensuse.org/repositories/system:/systemd/Fedora_42/     7       gpgcheck=1     8       gpgkey=file:///usr/share/pki/rpm-gpg/systemd.gpg     9       enabled=1

             @@ -1,9 +0,0 @@     1       # SPDX-License-Identifier: LGPL-2.1-or-later     2            3       [systemd]     4       name=systemd packages built from upstream main (Fedora_Rawhide)     5       type=rpm-md     6       baseurl=https://download.opensuse.org/repositories/system:/systemd/Fedora_Rawhide/     7       gpgcheck=1     8       gpgkey=file:///usr/share/pki/rpm-gpg/systemd.gpg     9       enabled=1

             @@ -0,0 +1,4 @@            1#!/usr/bin/sh            2            3chmod 755 /usr/bin/dumpcap            4setcap -r /usr/bin/dumpcap

             @@ -6,4 +6,4 @@     6      6     7      7[Build]     8      8ToolsTreeSandboxTrees=systemd.gpg:/usr/share/pki/rpm-gpg/systemd.gpg     9                             fedora43.repo:/etc/yum.repos.d/systemd.repo            9                      fedora.repo:/etc/yum.repos.d/systemd.repo

             @@ -2,7 +2,8 @@     2      2     3      3[Match]     4      4Distribution=fedora            5Release=rawhide     5      6     6      7[Build]     7      8SandboxTrees=systemd.gpg:/usr/share/pki/rpm-gpg/systemd.gpg     8                    fedora%r.repo:/etc/yum.repos.d/systemd.repo            9             fedora.repo:/etc/yum.repos.d/systemd.repo

             @@ -0,0 +1,13 @@            1[hashicorp]            2name=Hashicorp Stable - $basearch            3baseurl=https://rpm.releases.hashicorp.com/fedora/$releasever/$basearch/stable            4enabled=1            5gpgcheck=1            6gpgkey=https://rpm.releases.hashicorp.com/gpg            7            8[hashicorp-test]            9name=Hashicorp Test - $basearch           10baseurl=https://rpm.releases.hashicorp.com/fedora/$releasever/$basearch/test           11enabled=0           12gpgcheck=1           13gpgkey=https://rpm.releases.hashicorp.com/gpg

             @@ -3,6 +3,7 @@     3      3# This overrides the same file from systemd since we want to symlink everything     4      4# into /etc instead of copying so updates to /usr propagate properly.     5      5L /etc/os-release - - - - ../usr/lib/os-release            6L /etc/os-manifest - - - - ../usr/lib/os-manifest     6      7L+ /etc/mtab - - - - ../proc/self/mounts     7      8# Contains the default systemd locale     8      9L /etc/locale.conf             @@ -15,6 +16,9 @@    15     16L? /etc/bashrc    16     17L? /etc/bash.bashrc    17     18L? /etc/bash.bash_logout           19# TODO: drop once https://github.com/scop/bash-completion/pull/1399 is merged,           20# needed for shell completion of sd-run/run0           21L? /etc/bash_completion.d    18     22# Canonical location to look for certificates    19     23L? /etc/ca-certificates    20     24L? /etc/crypto-policies             @@ -45,6 +49,8 @@    45     49L? /etc/tuned    46     50# Required by gdm    47     51L? /etc/gdm           52# Required by sdm           53L? /etc/sddm    48     54# Required by geoclue    49     55L? /etc/geoclue    50     56# Required by fwupd             @@ -51,12 +57,21 @@    51     57L /etc/fwupd    52     58# Required by gnome    53     59L? /etc/dconf    54       # Required by a bunch of binary symlinks in fedora           60L? /etc/skel           61# CUPS is pulled in by GNOME, and fails if the configs are not there           62L? /etc/cups           63# On some distributions various binaries in /usr/bin are managed via           64# /etc/alternatives.    55     65L? /etc/alternatives           66# PackageKit does not run without /etc/PackageKit/ and GNOME stalls           67# logout/reboot if it doesn't run.           68L? /etc/PackageKit           69# ModemManager needds its dbus policy file           70L? /etc/dbus1/systemd.d/org.freedesktop.ModemManager1.conf           71# man fails without this in /etc/           72L? /etc/manpath.config    56     73# Required by man-db-cache-update.service    57     74L? /etc/sysconfig/man-db    58       # sddm breaks otherwise, at least with homed?    59       L? /etc/sddm    60     75    61     76## custom    62     77C /etc/opensnitchd             @@ -65,8 +80,8 @@    65     80    66     81#firewalld    67     82# this stuff from the `setup` package in Fedora is just kinda funny...           83C+ /etc/firewalld    68     84L? /etc/protocols    69       L? /etc/firewalld    70     85L? /etc/logrotate.d/firewalld    71     86L? /etc/modprobe.d/firewalld-sysctls.conf    72     87L? /etc/sysconfig/firewalld             @@ -77,5 +92,22 @@    77     92# cups    78     93L? /etc/cups    79     94           95# firejail           96L? /etc/firejail           97L? /etc/login.defs           98           99# OpenCL          100L? /etc/OpenCL          101    80    102# abrtd    81    103L? /etc/libreport          104          105# guestfs-tools (virt-builder)          106C+ /etc/virt-builder          107          108# libvirt needs all          109C+ /etc/libvirt          110          111# miscellaneous legacy file          112L? /etc/shells          113L? /etc/hosts

             @@ -7,9 +7,7 @@     7      7Packages=     8      8        gnome-browser-connector     9      9        gnome-core    10               # TODO: enable when it integrates with homed    11               # gnome-initial-setup           10        gnome-initial-setup    12     11        gnome-keyring-pkcs11    13               gnome-session-xsession    14     12        gnome-software-plugin-flatpak    15     13        gnome-software-plugin-fwupd

             @@ -5,4 +5,8 @@     5      5     6      6[Content]     7      7Packages=            8        adwaita-fonts-all     8      9        gdm           10        rsms-inter-fonts           11        rsms-inter-vf-fonts           12        default-fonts-core-emoji

             @@ -40,3 +40,8 @@    40     40    41     41# Maybe man db    42     42enable man-db-cache-update.service           43           44# Fedora 43 introduces a new authselect service in place of package scriptlets.           45# It fails and (I believe) shouldn't be needed           46# https://bugzilla.redhat.com/show_bug.cgi?id=2397255           47disable authselect-apply-changes.service

             @@ -0,0 +1,13 @@            1# SPDX-License-Identifier: LGPL-2.1-or-later            2            3[TriggerMatch]            4Distribution=debian            5Release=trixie            6            7[TriggerMatch]            8Distribution=ubuntu            9Release=|oracular           10Release=|plucky           11           12[Content]           13Packages=gnome-session-xsession

             @@ -1,4 +0,0 @@     1       # apt gets pulled in, but with /usr read-only doesn't make sense to run updates     2       disable apt-daily.timer     3       disable apt-daily-upgrade.timer     4       disable apt-listchanges.timer

             @@ -9,20 +9,6 @@     9      9# On Debian/Ubuntu the nftable service fails if this config is not present    10     10L? /etc/nftables.conf    11     11    12       # Very basic stuff like awk and which is managed through alternatives    13       L? /etc/alternatives    14           15       # CUPS is pulled in by GNOME, and fails if the configs are not there    16       L? /etc/cups    17           18       # Needed to create users by GNOME's GUI    19       L? /etc/skel    20     12# These can be dropped once https://bugs.debian.org/1108017 is fixed    21     13L? /etc/adduser.conf    22     14L? /etc/deluser.conf    23           24       # PackageKit does not run without /etc/PackageKit/ and GNOME stalls logout/reboot if it doesn't run    25       L? /etc/PackageKit    26           27       # TODO: drop once https://github.com/scop/bash-completion/pull/1399 is merged, needed for shell completion of sd-run/run0    28       L? /etc/bash_completion.d

             @@ -0,0 +1,3 @@            1title Debian 13 ParticleOS Current from OBS (Network Boot)            2architecture x64            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/debian_13_images/ParticleOS_x86-64.efi

             @@ -1,3 +0,0 @@     1       title Debian Testing ParticleOS Current from OBS (Network Boot)     2       architecture x64     3       uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/Debian_Testing_images/ParticleOS-x86-64.efi

             @@ -0,0 +1,3 @@            1title Debian Testing ParticleOS Current from OBS (Network Boot)            2architecture x64            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/debian_14_images/ParticleOS_x86-64.efi

             @@ -1,3 +0,0 @@     1       title Fedora 41 ParticleOS Current from OBS (Network Boot)     2       architecture x64     3       uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/Fedora_41_images/ParticleOS-x86-64.efi

             @@ -0,0 +1,3 @@            1title Fedora 42 ParticleOS Current from OBS (Network Boot)            2architecture x64            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/fedora_42_images/ParticleOS_x86-64.efi

             @@ -1,3 +1,3 @@     1      1title Fedora Rawhide ParticleOS Current from OBS (Network Boot)     2      2architecture x64     3       uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/Fedora_Rawhide_images/ParticleOS-x86-64.efi            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/fedora_44_images/ParticleOS_x86-64.efi

             @@ -0,0 +1,6 @@            1<?xml version="1.0" encoding="utf-8"?>            2<service>            3  <short>Hugo</short>            4  <description>Used for running Hugo's development server</description>            5  <port protocol="tcp" port="1313"/>            6</service>

             @@ -0,0 +1,4 @@            1# apt gets pulled in, but with /usr read-only doesn't make sense to run updates            2disable apt-daily.timer            3disable apt-daily-upgrade.timer            4disable apt-listchanges.timer

             @@ -0,0 +1,14 @@            1# SPDX-License-Identifier: LGPL-2.1-or-later            2# TODO: drop once https://gitlab.freedesktop.org/accountsservice/accountsservice/-/issues/89 is fixed            3            4[Unit]            5Description=Tell the accounts service about homed users            6After=systemd-homed.service accounts-daemon.service            7Before=systemd-user-sessions.service            8            9[Service]           10Type=oneshot           11ExecStart=/bin/bash -c "for n in $$(busctl call org.freedesktop.home1 /org/freedesktop/home1 org.freedesktop.home1.Manager ListHomes --json=pretty | jq -r '.data.[].[].[0]'); do busctl call org.freedesktop.Accounts /org/freedesktop/Accounts org.freedesktop.Accounts CacheUser s $$n; done"           12           13[Install]           14WantedBy=multi-user.target