local customizations

             @@ -10,3 +10,6 @@    10     10[*.conf]    11     11indent_style = space    12     12indent_size = 4           13           14[mkosi.passphrase]           15insert_final_newline = false

             @@ -11,3 +11,5 @@    11     11.mkosi-private    12     12mkosi.packages/    13     13keys/           14mkosi.profiles/custom/mkosi.extra/usr/local/bin/           15versions/

             @@ -0,0 +1,1 @@            1systemd/**

             @@ -0,0 +1,54 @@            1BIN_DIR := mkosi.profiles/custom/mkosi.extra/usr/local/bin            2PACKAGES_DIR := mkosi.profiles/custom/mkosi.packages            3btdu := $(BIN_DIR)/btdu            4opensnitch := $(PACKAGES_DIR)/opensnitch.rpm            5opensnitch_ui := $(PACKAGES_DIR)/opensnitch_ui.rpm            6ALL := $(btdu) $(opensnitch) $(opensnitch_ui)            7CURRENT_VERSION = $(shell mkosi summary --json | jq -r '.Images[] | select(.Image == "main") | .ImageVersion')            8            9.PHONY: deps           10deps: $(PACKAGES_DIR) $(BIN_DIR) $(ALL)           11           12.PHONY: clean           13clean:           14	rm -fv $(ALL)           15           16$(BIN_DIR) $(PACKAGES_DIR):           17	mkdir -p $@           18           19$(btdu): $(MAKE_TMPDIR)/btdu           20	echo 35b9bb752e6aa902b8281e92a5411b2f1cfb9fa251089adf909dc95efc011c48 $(MAKE_TMPDIR)/btdu | sha256sum --check           21	cp $(MAKE_TMPDIR)/btdu $@           22           23$(MAKE_TMPDIR)/btdu:           24	wget https://github.com/CyberShadow/btdu/releases/download/v0.6.0/btdu-static-x86_64 -O $(MAKE_TMPDIR)/btdu           25           26$(opensnitch): $(MAKE_TMPDIR)/opensnitch.rpm           27	echo 2caf4e13ffd1b7af48306a2e9e979042f526823720b42bee4c00194f140d64dd $(MAKE_TMPDIR)/opensnitch.rpm | sha256sum --check           28	cp $(MAKE_TMPDIR)/opensnitch.rpm $@           29           30$(MAKE_TMPDIR)/opensnitch.rpm:           31		wget https://github.com/evilsocket/opensnitch/releases/download/v1.7.2/opensnitch-1.7.2-1.x86_64.rpm -O $(MAKE_TMPDIR)/opensnitch.rpm           32           33$(opensnitch_ui): $(MAKE_TMPDIR)/opensnitch_ui.rpm           34	echo b26029cbc83880ebc92170035d50237c13b17ffc0b3cf52b89fa1348edfdfb43 $(MAKE_TMPDIR)/opensnitch_ui.rpm | sha256sum --check           35	cp $(MAKE_TMPDIR)/opensnitch_ui.rpm $@           36           37$(MAKE_TMPDIR)/opensnitch_ui.rpm:           38	wget https://github.com/evilsocket/opensnitch/releases/download/v1.7.2/opensnitch-ui-1.7.2-1.noarch.rpm -O $(MAKE_TMPDIR)/opensnitch_ui.rpm           39           40mkosi.crt:           41	ln -s ~/Vaults/particleos_keys/sbctl/var/keys/db/db.pem mkosi.crt           42           43mkosi.key:           44	ln -s ~/Vaults/particleos_keys/sbctl/var/keys/db/db.key mkosi.key           45           46.PHONY: build           47	mkosi build --auto-bump           48           49.PHONY: sysupdate           50sysupdate:           51	mkosi sysupdate -- update           52	mkdir -p versions           53	cat mkosi.output/ParticleOS_$(CURRENT_VERSION)_x86-64.manifest | gzip > versions/$(CURRENT_VERSION).manifest.gz           54	cat mkosi.output/ParticleOS_$(CURRENT_VERSION)_x86-64.changelog | gzip > versions/$(CURRENT_VERSION).changelog.gz

             @@ -107,7 +107,6 @@   107    107RAM=4G   108    108CPUs=4   109    109Ephemeral=yes   110       RuntimeScratch=no   111    110Credentials=   112    111        passwd.plaintext-password.root=particleos   113    112        tty.serial.hvc0.agetty.autologin=particleos

             @@ -1,18 +1,21 @@     1      1[Distribution]     2      2Distribution=fedora     3       Release=42            3Release=43     4      4     5      5[Build]     6      6ToolsTree=default     7      7ToolsTreeDistribution=fedora     8      8ToolsTreeProfiles=misc,runtime,gui     9       ExtraSearchPaths=./systemd/build/mkosi.builddir/fedora~42~x86-64/            9ExtraSearchPaths=./systemd/build/mkosi.builddir/fedora~43~x86-64/    10     10    11     11[Config]    12       Profiles=desktop,kde           12Profiles=desktop,kde,custom           13           14[Output]           15ManifestFormat=changelog    13     16    14     17[Content]    15       VolatilePackageDirectories=./systemd/build/mkosi.builddir/fedora~42~x86-64/           18VolatilePackageDirectories=./systemd/build/mkosi.builddir/fedora~43~x86-64/    16     19Packages=    17     20        ansible    18     21        awk             @@ -22,18 +25,27 @@    22     25        bind-utils    23     26        bat    24     27        clatd           28        clang-devel    25     29        cowsay    26     30        cmatrix    27     31        curl           32        debian-keyring    28     33        dictd    29     34        du-dust           35        duf           36        d2    30     37        emacs           38        entr    31     39        exfatprogs           40        exiftool    32     41        fastfetch    33     42        fcitx5-mozc    34     43        fcitx5-configtool    35     44        fcitx5-gtk    36     45        fcitx5-qt           46        firejail           47        fontawesome-fonts-all           48        kcm-fcitx5    37     49        fd-find    38     50        file    39     51        fish             @@ -49,6 +61,8 @@    49     61        git-delta    50     62        git-lfs    51     63        glances           64        # needed for geoclue?           65        glib-networking    52     66        guestfs-tools    53     67        golang    54     68        graphviz             @@ -67,23 +81,32 @@    67     81        libfprint-tod    68     82        libfprint-2-tod1-broadcom    69     83        libfprint-tod-selinux           84        litecli    70     85        lm_sensors    71     86        lolcat    72     87        lshw           88        lsof    73     89        man    74     90        # include mkosi just for shell completion and man pages    75     91        mkosi    76     92        mokutil           93        mpv    77     94        ncdu           95        neovim           96        ninja    78     97        okular           98        osc    79     99        # needed for bell fish function    80    100        oxygen-sounds    81               neovim    82    101        pre-commit    83    102        python3-neovim          103        nmap    84    104        nmap-ncat    85    105        # for coc.nvim    86    106        npm          107        # needed for clatd on F43 apparently          108        perl-IPC-Cmd          109        perl-JSON    87    110        pipewire-utils    88    111        plasma-disks    89    112        plasma-vault             @@ -90,15 +113,19 @@    90    113        pnpm    91    114        powertop    92    115        proxychains-ng          116        pv    93    117        python3-netaddr    94    118        ripgrep          119        rubygem-asciidoctor    95    120        rustup    96    121        rsync    97    122        sbctl    98    123        setroubleshoot    99               stgit   100    124        sbsigntools          125        sqlite          126        stgit   101    127        tcpdump          128        # not yet available for fedora 43   102    129        terraform-ls   103    130        tmux   104    131        toolbox             @@ -115,15 +142,8 @@   115    142        wireshark   116    143        yubikey-manager   117    144        kernel   118               repository/opensnitch-ui-1.7.1-1.noarch.rpm   119               repository/opensnitch-1.7.1-1.x86_64.rpm          145        # repository directory comes from mkosi.packages          146        repository/opensnitch_ui.rpm          147        repository/opensnitch.rpm   120    148        python3-grpcio+protobuf   121    149        python3-slugify   122          123       [Validation]   124       SecureBootKey=./keys/sbctl/var/keys/db/db.key   125       SecureBootCertificate=./keys/sbctl/var/keys/db/db.pem   126       SignExpectedPcrKey=./keys/sbctl/var/keys/db/db.key   127       SignExpectedPcrCertificate=./keys/sbctl/var/keys/db/db.pem   128       VerityKey=./keys/sbctl/var/keys/db/db.key   129       VerityCertificate=./keys/sbctl/var/keys/db/db.pem

             @@ -1,1 +1,1 @@     1       5a8b9fd49f7602c19b56deb8cc0efd23e0aa8e2a            115bd1496c9b59c1ec8ee05e78c65eeb3f148c898

             @@ -0,0 +1,13 @@            1rebuild:            2  steps:            3    - trigger_services:            4        project: system:systemd            5        package: particleos-debian            6    - trigger_services:            7        project: system:systemd            8        package: particleos-fedora            9  filters:           10    event: push           11    branches:           12      only:           13        - obs

             @@ -0,0 +1,9 @@            1#!/bin/bash            2# SPDX-License-Identifier: LGPL-2.1-or-later            3set -e            4            5# Debian/Ubuntu PAM patches break /usr/lib/pam.d/ so copy to factory            6# TODO: drop after https://salsa.debian.org/vorlon/pam/-/merge_requests/26 is merged            7if [[ -f /usr/lib/tmpfiles.d/debian.conf ]]; then            8    sed -i '/\/etc\/pam.d/d' /usr/lib/tmpfiles.d/debian.conf            9fi

             @@ -2,6 +2,7 @@     2      2     3      3[Content]     4      4Packages=            5        bluez     5      6        bolt     6      7        desktop-file-utils     7      8        pax-utils             @@ -8,6 +9,7 @@     8      9        pgpdump     9     10        pipewire    10     11        pipewire-alsa           12        qemu-guest-agent    11     13        wireless-regdb    12     14        xdg-desktop-portal    13     15

             @@ -0,0 +1,4 @@            1#!/usr/bin/sh            2            3chmod 755 /usr/bin/dumpcap            4setcap -r /usr/bin/dumpcap

             @@ -63,6 +63,8 @@    63     63# PackageKit does not run without /etc/PackageKit/ and GNOME stalls    64     64# logout/reboot if it doesn't run.    65     65L? /etc/PackageKit           66# ModemManager needds its dbus policy file           67L? /etc/dbus1/systemd.d/org.freedesktop.ModemManager1.conf    66     68# Required by man-db-cache-update.service    67     69L? /etc/sysconfig/man-db    68     70# sddm breaks otherwise, at least with homed?             @@ -75,8 +77,8 @@    75     77    76     78#firewalld    77     79# this stuff from the `setup` package in Fedora is just kinda funny...           80C+ /etc/firewalld    78     81L? /etc/protocols    79       L? /etc/firewalld    80     82L? /etc/logrotate.d/firewalld    81     83L? /etc/modprobe.d/firewalld-sysctls.conf    82     84L? /etc/sysconfig/firewalld             @@ -87,6 +89,10 @@    87     89# cups    88     90L? /etc/cups    89     91           92# firejail           93L? /etc/firejail           94L? /etc/login.defs           95    90     96# abrtd    91     97L? /etc/libreport    92     98             @@ -95,3 +101,7 @@    95    101    96    102# libvirt needs all    97    103C+ /etc/libvirt          104          105# miscellaneous legacy file          106L? /etc/shells          107L? /etc/hosts

             @@ -7,8 +7,7 @@     7      7Packages=     8      8        gnome-browser-connector     9      9        gnome-core    10               # TODO: enable when it integrates with homed    11               # gnome-initial-setup           10        gnome-initial-setup    12     11        gnome-keyring-pkcs11    13     12        gnome-session-xsession    14     13        gnome-software-plugin-flatpak

             @@ -5,4 +5,8 @@     5      5     6      6[Content]     7      7Packages=            8        adwaita-fonts-all     8      9        gdm           10        rsms-inter-fonts           11        rsms-inter-vf-fonts           12        default-fonts-core-emoji

             @@ -40,3 +40,8 @@    40     40    41     41# Maybe man db    42     42enable man-db-cache-update.service           43           44# Fedora 43 introduces a new authselect service in place of package scriptlets.           45# It fails and (I believe) shouldn't be needed           46# https://bugzilla.redhat.com/show_bug.cgi?id=2397255           47disable authselect-apply-changes.service

             @@ -1,4 +0,0 @@     1       # apt gets pulled in, but with /usr read-only doesn't make sense to run updates     2       disable apt-daily.timer     3       disable apt-daily-upgrade.timer     4       disable apt-listchanges.timer

             @@ -0,0 +1,3 @@            1title Debian 13 ParticleOS Current from OBS (Network Boot)            2architecture x64            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/debian_13_images/ParticleOS_x86-64.efi

             @@ -1,3 +0,0 @@     1       title Debian Testing ParticleOS Current from OBS (Network Boot)     2       architecture x64     3       uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/Debian_Testing_images/ParticleOS-x86-64.efi

             @@ -0,0 +1,3 @@            1title Debian Testing ParticleOS Current from OBS (Network Boot)            2architecture x64            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/debian_14_images/ParticleOS_x86-64.efi

             @@ -1,3 +0,0 @@     1       title Fedora 41 ParticleOS Current from OBS (Network Boot)     2       architecture x64     3       uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/Fedora_41_images/ParticleOS-x86-64.efi

             @@ -0,0 +1,3 @@            1title Fedora 42 ParticleOS Current from OBS (Network Boot)            2architecture x64            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/fedora_42_images/ParticleOS_x86-64.efi

             @@ -1,3 +1,3 @@     1      1title Fedora Rawhide ParticleOS Current from OBS (Network Boot)     2      2architecture x64     3       uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/Fedora_Rawhide_images/ParticleOS-x86-64.efi            3uki-url http://downloadcontentcdn.opensuse.org/repositories/system:/systemd/fedora_44_images/ParticleOS_x86-64.efi

             @@ -0,0 +1,6 @@            1<?xml version="1.0" encoding="utf-8"?>            2<service>            3  <short>Hugo</short>            4  <description>Used for running Hugo's development server</description>            5  <port protocol="tcp" port="1313"/>            6</service>

             @@ -0,0 +1,4 @@            1# apt gets pulled in, but with /usr read-only doesn't make sense to run updates            2disable apt-daily.timer            3disable apt-daily-upgrade.timer            4disable apt-listchanges.timer

             @@ -0,0 +1,14 @@            1# SPDX-License-Identifier: LGPL-2.1-or-later            2# TODO: drop once https://gitlab.freedesktop.org/accountsservice/accountsservice/-/issues/89 is fixed            3            4[Unit]            5Description=Tell the accounts service about homed users            6After=systemd-homed.service accounts-daemon.service            7Before=systemd-user-sessions.service            8            9[Service]           10Type=oneshot           11ExecStart=/bin/bash -c "for n in $$(busctl call org.freedesktop.home1 /org/freedesktop/home1 org.freedesktop.home1.Manager ListHomes --json=pretty | jq -r '.data.[].[].[0]'); do busctl call org.freedesktop.Accounts /org/freedesktop/Accounts org.freedesktop.Accounts CacheUser s $$n; done"           12           13[Install]           14WantedBy=multi-user.target