From 10052e8ca4e6a6abaeb838ee8ac392079d3faa4a Mon Sep 17 00:00:00 2001 From: Thomas Date: Wed, 21 Oct 2026 01:24:31 -0400 Subject: [PATCH 1/5] Distrust compromised eMudhra roots until upstream ships the fix Eight eMudhra intermediates under emSign ECC Root CA - G3 and the Sectigo-cross-signed Comodo AAA Services root had their private keys compromised. freedesktop-sdk 26.08.2 still trusts both roots, and its fix (freedesktop-sdk!35109) has not landed yet. Block both roots through p11-kit's /etc source so OpenSSL, GnuTLS and NSS reject them in every extracted bundle, and point Python certifi's bundled list at the system one. Both are temporary. --- elements/oci/stack.bst | 5 +++ .../blocklist/comodo-aaa-services-root.pem | 32 +++++++++++++++++++ .../blocklist/emsign-ecc-root-ca-g3.pem | 22 +++++++++++++ 3 files changed, 59 insertions(+) create mode 100644 files/system/etc/pki/ca-trust/source/blocklist/comodo-aaa-services-root.pem create mode 100644 files/system/etc/pki/ca-trust/source/blocklist/emsign-ecc-root-ca-g3.pem diff --git a/elements/oci/stack.bst b/elements/oci/stack.bst index 55d31be..174453e 100644 --- a/elements/oci/stack.bst +++ b/elements/oci/stack.bst @@ -32,3 +32,8 @@ public: - ln -sT var/srv /srv - ln -sT ../var/usrlocal /usr/local - truncate -s 0 /etc/machine-id + # Temporary: certifi bundles its own CA list, which still trusts the + # compromised eMudhra root. Use the system list, which honors the p11-kit + # blocklist. Drop with the blocklist once the junction ships certifi + # 2026.10.19 or newer. + - ln -sf /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /usr/lib/python3*/site-packages/certifi/cacert.pem diff --git a/files/system/etc/pki/ca-trust/source/blocklist/comodo-aaa-services-root.pem b/files/system/etc/pki/ca-trust/source/blocklist/comodo-aaa-services-root.pem new file mode 100644 index 0000000..0ce2d69 --- /dev/null +++ b/files/system/etc/pki/ca-trust/source/blocklist/comodo-aaa-services-root.pem @@ -0,0 +1,32 @@ +# Temporary: distrust this root until freedesktop-sdk ships the eMudhra fix +# (freedesktop-sdk!35109, NSS 3.131.1). Eight intermediates under it had their +# private keys compromised on 2026-10-17: https://emudhra.we-have-a-problem.com/ +# Drop this file once the GNOME junction's ca-certificates removes the root. +# It lives in /etc because p11-kit reads this source first, so the distrusted +# copy wins over Mozilla's anchor in every extracted bundle, including OpenSSL's +# ca-bundle.trust.crt. +-----BEGIN CERTIFICATE----- +MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb +MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow +GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj +YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL +MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE +BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM +GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP +ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua +BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe +3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4 +YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR +rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm +ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU +oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF +MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v +QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t +b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF +AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q +GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz +Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2 +G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi +l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3 +smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg== +-----END CERTIFICATE----- diff --git a/files/system/etc/pki/ca-trust/source/blocklist/emsign-ecc-root-ca-g3.pem b/files/system/etc/pki/ca-trust/source/blocklist/emsign-ecc-root-ca-g3.pem new file mode 100644 index 0000000..a298162 --- /dev/null +++ b/files/system/etc/pki/ca-trust/source/blocklist/emsign-ecc-root-ca-g3.pem @@ -0,0 +1,22 @@ +# Temporary: distrust this root until freedesktop-sdk ships the eMudhra fix +# (freedesktop-sdk!35109, NSS 3.131.1). Eight intermediates under it had their +# private keys compromised on 2026-10-17: https://emudhra.we-have-a-problem.com/ +# Drop this file once the GNOME junction's ca-certificates removes the root. +# It lives in /etc because p11-kit reads this source first, so the distrusted +# copy wins over Mozilla's anchor in every extracted bundle, including OpenSSL's +# ca-bundle.trust.crt. +-----BEGIN CERTIFICATE----- +MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG +EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo +bm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g +RzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJ +TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s +b2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMw +djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0 +WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xyS +fvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuB +zhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggq +hkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWB +CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD ++JbNR6iC8hZVdyR+EhCVBCyj +-----END CERTIFICATE----- From b6e1ba944829904dac76ba5230d880273e3c7577 Mon Sep 17 00:00:00 2001 From: Thomas Date: Wed, 21 Oct 2026 12:41:33 -0400 Subject: [PATCH 2/5] Update to GNOME 51.1 through Dakota's GNOME graph Follow Dakota's testing branch after its GNOME 51.1 and freedesktop-sdk 26.08.2 bump (projectbluefin/dakota#1796), and let Dakota own the GNOME and freedesktop-sdk junctions instead of redirecting them to our own GNOME pin. Our artifacts then match the ones Dakota's CI pushes to the Bluefin cache, so only our own stacks and image assembly build locally. - Drop elements/gnome.bst and refer to Dakota's junctions directly. - Override the apps list, os-release and boot modules inside Dakota's GNOME junction. - Move the firewalld iptables patch into Dakota's GNOME patch queue. - Point packages that moved to freedesktop-sdk-extra at their new paths. - Drop the Shell unzip patch: Shell 51.1 extracts extensions with gnome-autoar instead. This also takes Dakota's GNOME-level choices: its Plymouth theme, bootc, Mesa and ffmpeg builds, initramfs modules and dnsmasq fix. --- docs/building.md | 24 ++--- elements/core/apps.bst | 4 +- elements/core/appstream-cli.bst | 4 +- elements/core/bazaar-companion.bst | 6 +- elements/core/dakota-boot.bst | 12 +-- elements/core/desktop.bst | 88 +++++++++---------- elements/core/docker.bst | 10 +-- elements/core/eu-strip.bst | 4 +- elements/core/ghostty.bst | 6 +- elements/core/gradia-capture.bst | 4 +- elements/core/os-release.bst | 2 +- elements/core/secure-boot.bst | 8 +- elements/core/session.bst | 42 ++++----- elements/core/strip.bst | 4 +- elements/dakota.bst | 11 ++- elements/gnome.bst | 27 ------ elements/oci/image.bst | 10 +-- elements/oci/stack.bst | 16 ++-- patches/dakota/firewalld-iptables.patch | 32 +++++++ patches/gnome/firewalld-iptables.patch | 14 --- .../gnome-shell-portable-unzip-flags.patch | 43 --------- project.conf | 4 +- 22 files changed, 163 insertions(+), 212 deletions(-) delete mode 100644 elements/gnome.bst create mode 100644 patches/dakota/firewalld-iptables.patch delete mode 100644 patches/gnome/firewalld-iptables.patch delete mode 100644 patches/gnome/gnome-shell-portable-unzip-flags.patch diff --git a/docs/building.md b/docs/building.md index 5ded61e..04598eb 100644 --- a/docs/building.md +++ b/docs/building.md @@ -14,7 +14,7 @@ bst --config buildstream.conf show oci/image.bst BuildStream 2.6 or later is required. Validation uses 2.8 in the pinned builder container. Native installations also need the `buildstream-plugins` Python package for the Git source used to fetch the plugin junctions, plus source-plugin tools such as `git` and `patch`. -The OS uses the baseline x86_64 target. x86-64-v3 is disabled in both the GNOME and Dakota junctions to match their normal upstream builds and improve artifact-cache reuse. GNOME passes this option through to freedesktop-sdk. +The OS uses the baseline x86_64 target. x86-64-v3 is disabled in the Dakota junction to match Dakota's normal builds and improve artifact-cache reuse. Dakota passes this option through to GNOME and freedesktop-sdk. Artifact reuse still requires matching source revisions, recipes and build dependencies. Local image configuration and components whose inputs differ from upstream need rebuilding. BuildStream retains completed artifacts for later runs. @@ -70,13 +70,13 @@ See [design history](plan.md) for the composition decisions and remaining milest | Input | Pinned revision | | --- | --- | -| GNOME `gnome-51` | `1808f094d469291bdd85cc92a1a08f07aac6f6a6` | -| freedesktop-sdk | `b02b59ffe19a49a402f357fd5fcb1d552ebc50d7`, tag `freedesktop-sdk-26.08.1` | -| Dakota `testing` | `e59afbe788e441fc1fad560c01fa4dbc267d60d8` | +| Dakota `testing` | `bb14777d9806c3924f5815712b92eb8c8125f95a` | +| GNOME `gnome-51`, through Dakota | `24bd9e3394437b85fc204bf58ecd3d867d815f66` (51.1) | +| freedesktop-sdk, through Dakota | `32c5fea70e827885fc805d38a9dc5716c39ed173`, tag `freedesktop-sdk-26.08.2` | -GNOME owns the nested freedesktop-sdk junction, its patch queue, and its component overrides. Both of Dakota's base junctions redirect into that graph. Dakota and GNOME also share the top-level plugin junctions. The freedesktop-sdk project's internal plugins retain their upstream isolation. +`elements/dakota.bst` is the only base pin. Dakota owns the GNOME and freedesktop-sdk junctions, including their patch queues and overrides, so our artifacts match the ones Dakota's CI pushes to the Bluefin cache. Local elements refer to them as `dakota.bst:gnome-build-meta.bst:…` and `dakota.bst:freedesktop-sdk.bst:…`. Our junction settings override the GNOME apps list, os-release and boot modules inside Dakota's GNOME junction. Dakota and GNOME share the top-level plugin junctions. The freedesktop-sdk project's internal plugins retain their upstream isolation. -Do not run broad source tracking during bring-up. Review GNOME, freedesktop-sdk and Dakota together when updating these pins. Normal builds use the committed refs, not the tips of the tracking branches. +The graph therefore includes Dakota's GNOME-level choices: its Plymouth theme, bootc, Mesa and ffmpeg builds, initramfs modules and dnsmasq fix. Review those when updating the Dakota pin. Normal builds use the committed refs, not the tips of the tracking branches. Local stacks own the session, native application selection, boot configuration and image assembly. Files and Disks are native applications in the OS. The runtime omits GNOME Software, native Papers and Sushi, Tour, GNOME user documentation, and Dakota's aggregate configuration. Sushi is installed as a Flatpak for file previews; PDF thumbnails are not included. @@ -84,7 +84,7 @@ Settings, initial setup and the SDK platform use their upstream recipes. Parenta Dakota supplies Ghostty, xdg-terminal-exec, Tailscale, virtualization, the kernel and modules, and three small network/audio/disk integration fixes. Its gaming kernel, swap changes and Homebrew stack are not selected. -The kernel is Dakota's regular freedesktop-sdk-derived kernel, imported from its published OCI image by `core/dakota-boot.bst`. The GNOME junction selects that import for both the OS and its initramfs. The import preserves module files without stripping them and discards Dakota's initramfs; GNOME builds a new initramfs from the imported modules and this OS's userspace. GNOME's zram configuration stays in place. The same import supplies Dakota-signed systemd-boot and fwupd EFI loaders, Fedora shim/MokManager and Dakota's public certificate. Dakota's upstream enrollment tool and EFI maintenance service are selected separately; no local signing key is used. +The kernel is Dakota's regular freedesktop-sdk-derived kernel, imported from its published OCI image by `core/dakota-boot.bst`. The Dakota junction's GNOME override selects that import for both the OS and its initramfs. The import preserves module files without stripping them and discards Dakota's initramfs; GNOME builds a new initramfs from the imported modules and this OS's userspace. GNOME's zram configuration stays in place. The same import supplies Dakota-signed systemd-boot and fwupd EFI loaders, Fedora shim/MokManager and Dakota's public certificate. Dakota's upstream enrollment tool and EFI maintenance service are selected separately; no local signing key is used. The OCI source follows Dakota's regular `testing` image and pins an amd64 manifest digest. Renovate updates that digest independently of the Dakota recipe pin in `elements/dakota.bst`. The source is the production `testing` image at Dakota revision `95ff6c060392d2c3b05c82d057b1e9e5adf59eb8`; the selected amd64 digest is `sha256:4697e6606ae5c23b58e24c2001654af60a614d977d23d37cc9358baa17d103a7`. Fetching it downloads the whole Dakota image, but only the kernel/modules and signed boot payload enter the imported artifact. BuildStream caches the source and the small extracted artifact locally. No Dakota application defaults are imported, and no kernel compilation or private signing key is needed. @@ -118,9 +118,9 @@ Docker starts as a system service. Use `sudo docker` initially. Adding an accoun Flatpak Builder has native `patch`, `strip`, `eu-strip` and `eu-elfcompress` available. Local recipes keep the binutils and elfutils binaries in the image because freedesktop-sdk classifies them as development files, which image composition excludes. -The GNOME junction carries a small patch adding iptables to firewalld's build and runtime dependencies. This lets its configure step discover the real IPv4 and IPv6 command paths instead of recording `/bin/false`. Docker's default iptables backend needs these paths for firewalld's direct API, even though firewalld itself keeps its nftables backend. Remove the patch when upstream supplies the dependency. +`patches/dakota/firewalld-iptables.patch` adds a patch to Dakota's GNOME patch queue that adds iptables to firewalld's build and runtime dependencies. This lets its configure step discover the real IPv4 and IPv6 command paths instead of recording `/bin/false`. Docker's default iptables backend needs these paths for firewalld's direct API, even though firewalld itself keeps its nftables backend. Remove the patch when upstream supplies the dependency. -The junction also carries Dakota's exact GNOME Shell extension extraction patch. The image provides `bsdunzip`, which rejects Shell's combined `-u` and `-o` flags; the patch drops `-u` so installations through Extension Manager can extract successfully. Dakota's GNOME junction redirects here, so updating Dakota alone does not apply its patch. Keeping the patch identical preserves matching Shell and bundled-extension artifact keys with Dakota when the other build inputs match. Remove it when upstream fixes extraction or supplies a compatible unzip implementation. +The image temporarily distrusts the `emSign ECC Root CA - G3` and `Comodo AAA Services root` certificates after the eMudhra intermediate key compromise. Their certificates are in p11-kit's `/etc/pki/ca-trust/source/blocklist`, which the system's OpenSSL, GnuTLS and NSS trust stores all read. The `/etc` source takes precedence over the distribution bundle, so every extracted bundle rejects them. Python's bundled certifi list is replaced with a link to the system list. Remove both once freedesktop-sdk's `ca-certificates` drops these roots and its certifi is 2026.10.19 or newer. Tailscale starts without enrollment. Run `sudo tailscale up` after installing. Its machine state belongs in writable `/var`, never in the image definition. @@ -160,9 +160,9 @@ A temporary installer VM has installed the image onto a virtual disk, which boot ## Upstream references -- [GNOME build metadata at the selected revision](https://gitlab.gnome.org/GNOME/gnome-build-meta/-/tree/1808f094d469291bdd85cc92a1a08f07aac6f6a6) -- [Dakota at the selected revision](https://github.com/projectbluefin/dakota/tree/e59afbe788e441fc1fad560c01fa4dbc267d60d8) +- [GNOME build metadata at the selected revision](https://gitlab.gnome.org/GNOME/gnome-build-meta/-/tree/24bd9e3394437b85fc204bf58ecd3d867d815f66) +- [Dakota at the selected revision](https://github.com/projectbluefin/dakota/tree/bb14777d9806c3924f5815712b92eb8c8125f95a) - [Official Docker image recipe](https://github.com/docker-library/docker/tree/master/29) - [mise installation](https://mise.jdx.dev/installing-mise.html) -The image assembly follows the GNOME and Dakota recipes at those revisions. The shared plugin junctions follow upstream release tags, independently of GNOME and Dakota. Upstream components retain their own licenses. +The image assembly follows the Dakota recipes, and the GNOME recipes Dakota selects, at those revisions. The shared plugin junctions follow upstream release tags, independently of Dakota. Upstream components retain their own licenses. diff --git a/elements/core/apps.bst b/elements/core/apps.bst index cf93d7a..7725b47 100644 --- a/elements/core/apps.bst +++ b/elements/core/apps.bst @@ -2,5 +2,5 @@ kind: stack description: Native desktop applications included in the OS depends: -- gnome.bst:core/gnome-disk-utility.bst -- gnome.bst:core/nautilus.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-disk-utility.bst +- dakota.bst:gnome-build-meta.bst:core/nautilus.bst diff --git a/elements/core/appstream-cli.bst b/elements/core/appstream-cli.bst index 5b2210c..5182a7c 100644 --- a/elements/core/appstream-cli.bst +++ b/elements/core/appstream-cli.bst @@ -2,10 +2,10 @@ kind: manual description: Keep appstreamcli in the runtime image depends: -- gnome.bst:freedesktop-sdk.bst:components/appstream.bst +- dakota.bst:freedesktop-sdk.bst:components/appstream.bst build-depends: -- gnome.bst:freedesktop-sdk.bst:public-stacks/runtime-gnu.bst +- dakota.bst:freedesktop-sdk.bst:public-stacks/runtime-gnu.bst variables: strip-binaries: '' diff --git a/elements/core/bazaar-companion.bst b/elements/core/bazaar-companion.bst index 8cc401e..76736b8 100644 --- a/elements/core/bazaar-companion.bst +++ b/elements/core/bazaar-companion.bst @@ -4,11 +4,11 @@ description: Bazaar Companion adapted for GNOME 51 build-depends: - dakota.bst:bluefin/shell-extensions/bazaar-companion.bst - dakota.bst:core/sandbox-tools.bst -- gnome.bst:freedesktop-sdk.bst:components/jq.bst +- dakota.bst:freedesktop-sdk.bst:components/jq.bst runtime-depends: -- gnome.bst:core/gnome-shell.bst -- gnome.bst:core-deps/flatpak.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-shell.bst +- dakota.bst:gnome-build-meta.bst:core-deps/flatpak.bst variables: strip-binaries: "" diff --git a/elements/core/dakota-boot.bst b/elements/core/dakota-boot.bst index 4ea7985..f68ae6c 100644 --- a/elements/core/dakota-boot.bst +++ b/elements/core/dakota-boot.bst @@ -11,12 +11,12 @@ sources: os: linux build-depends: -- gnome.bst:freedesktop-sdk.bst:public-stacks/runtime-gnu.bst -- gnome.bst:freedesktop-sdk.bst:components/findutils.bst -- gnome.bst:freedesktop-sdk.bst:components/grep.bst -- gnome.bst:freedesktop-sdk.bst:components/openssl.bst -- gnome.bst:freedesktop-sdk.bst:components/sbsigntools-maybe.bst -- gnome.bst:freedesktop-sdk.bst:components/kmod.bst +- dakota.bst:freedesktop-sdk.bst:public-stacks/runtime-gnu.bst +- dakota.bst:freedesktop-sdk.bst:components/findutils.bst +- dakota.bst:freedesktop-sdk.bst:components/grep.bst +- dakota.bst:freedesktop-sdk.bst:components/openssl.bst +- dakota.bst:freedesktop-sdk.bst:components/sbsigntools-maybe.bst +- dakota.bst:freedesktop-sdk.bst:components/kmod.bst variables: # Any post-signing stripping would invalidate the imported signatures. diff --git a/elements/core/desktop.bst b/elements/core/desktop.bst index 51bfbfc..2698869 100644 --- a/elements/core/desktop.bst +++ b/elements/core/desktop.bst @@ -3,42 +3,42 @@ description: GNOME desktop and host services for the first bootable image depends: - core/apps.bst -- gnome.bst:core/meta-gnome-core-os-services.bst +- dakota.bst:gnome-build-meta.bst:core/meta-gnome-core-os-services.bst - core/session.bst -- gnome.bst:sdk-platform.bst -- gnome.bst:core/systemd-presets.bst -- gnome.bst:gnomeos-deps/preset-all.bst -- gnome.bst:core-deps/xdg-desktop-portal-gnome.bst -- gnome.bst:core-deps/xdg-desktop-portal-gtk.bst -- gnome.bst:core-deps/flatpak.bst -- gnome.bst:core-deps/fwupd.bst -- gnome.bst:gnomeos-deps/flathub-config.bst -- gnome.bst:gnomeos-deps/journald-config.bst -- gnome.bst:gnomeos-deps/nm-connectivity-config.bst -- gnome.bst:gnomeos-deps/wpa-supplicant-config.bst -- gnome.bst:gnomeos-deps/plymouth-gnome-theme.bst -- gnome.bst:gnomeos-deps/spice-vdagent.bst -- gnome.bst:gnomeos-deps/alsa-ucm-conf.bst -- gnome.bst:gnomeos-deps/nss-mdns.bst -- gnome.bst:gnomeos-deps/ld-config.bst -- gnome.bst:gnomeos-deps/modprobe-config.bst -- gnome.bst:gnomeos-deps/zram-generator.bst -- gnome.bst:gnomeos-deps/fprintd.bst -- gnome.bst:gnomeos-deps/iio-sensor-proxy.bst -- gnome.bst:gnomeos-deps/firewalld.bst -- gnome.bst:freedesktop-sdk.bst:public-stacks/runtime-gnu.bst -- gnome.bst:freedesktop-sdk.bst:vm/mesa-default.bst -- gnome.bst:freedesktop-sdk.bst:components/pipewire-daemon.bst -- gnome.bst:freedesktop-sdk.bst:components/wireplumber.bst -- gnome.bst:freedesktop-sdk.bst:components/linux-firmware.bst -- gnome.bst:freedesktop-sdk.bst:components/sof-firmware.bst -- gnome.bst:freedesktop-sdk.bst:components/wireless-regdb-bin.bst -- gnome.bst:freedesktop-sdk.bst:components/bash-config.bst -- gnome.bst:freedesktop-sdk.bst:components/bash-completion.bst -- gnome.bst:freedesktop-sdk.bst:components/iproute2.bst -- gnome.bst:freedesktop-sdk.bst:components/iputils.bst -- gnome.bst:freedesktop-sdk.bst:components/nano.bst -- gnome.bst:freedesktop-sdk.bst:components/rsync.bst +- dakota.bst:gnome-build-meta.bst:sdk-platform.bst +- dakota.bst:gnome-build-meta.bst:core/systemd-presets.bst +- dakota.bst:gnome-build-meta.bst:gnomeos-deps/preset-all.bst +- dakota.bst:gnome-build-meta.bst:core-deps/xdg-desktop-portal-gnome.bst +- dakota.bst:gnome-build-meta.bst:core-deps/xdg-desktop-portal-gtk.bst +- dakota.bst:gnome-build-meta.bst:core-deps/flatpak.bst +- dakota.bst:gnome-build-meta.bst:core-deps/fwupd.bst +- dakota.bst:gnome-build-meta.bst:gnomeos-deps/flathub-config.bst +- dakota.bst:gnome-build-meta.bst:gnomeos-deps/journald-config.bst +- dakota.bst:gnome-build-meta.bst:gnomeos-deps/nm-connectivity-config.bst +- dakota.bst:gnome-build-meta.bst:gnomeos-deps/wpa-supplicant-config.bst +- dakota.bst:gnome-build-meta.bst:gnomeos-deps/plymouth-gnome-theme.bst +- dakota.bst:gnome-build-meta.bst:freedesktop-sdk-extra.bst:components/spice-vdagent.bst +- dakota.bst:gnome-build-meta.bst:gnomeos-deps/alsa-ucm-conf.bst +- dakota.bst:gnome-build-meta.bst:freedesktop-sdk-extra.bst:components/nss-mdns.bst +- dakota.bst:gnome-build-meta.bst:gnomeos-deps/ld-config.bst +- dakota.bst:gnome-build-meta.bst:gnomeos-deps/modprobe-config.bst +- dakota.bst:gnome-build-meta.bst:freedesktop-sdk-extra.bst:components/zram-generator.bst +- dakota.bst:gnome-build-meta.bst:gnomeos-deps/fprintd.bst +- dakota.bst:gnome-build-meta.bst:gnomeos-deps/iio-sensor-proxy.bst +- dakota.bst:gnome-build-meta.bst:gnomeos-deps/firewalld.bst +- dakota.bst:freedesktop-sdk.bst:public-stacks/runtime-gnu.bst +- dakota.bst:freedesktop-sdk.bst:vm/mesa-default.bst +- dakota.bst:freedesktop-sdk.bst:components/pipewire-daemon.bst +- dakota.bst:freedesktop-sdk.bst:components/wireplumber.bst +- dakota.bst:freedesktop-sdk.bst:components/linux-firmware.bst +- dakota.bst:freedesktop-sdk.bst:components/sof-firmware.bst +- dakota.bst:freedesktop-sdk.bst:components/wireless-regdb-bin.bst +- dakota.bst:freedesktop-sdk.bst:components/bash-config.bst +- dakota.bst:freedesktop-sdk.bst:components/bash-completion.bst +- dakota.bst:freedesktop-sdk.bst:components/iproute2.bst +- dakota.bst:freedesktop-sdk.bst:components/iputils.bst +- dakota.bst:freedesktop-sdk.bst:components/nano.bst +- dakota.bst:freedesktop-sdk.bst:components/rsync.bst # Small integration fixes are consumed directly from the pinned Dakota graph. - dakota.bst:bluefin/network.bst @@ -54,12 +54,12 @@ depends: - dakota.bst:bluefin/xdg-terminal-exec.bst - dakota.bst:bluefin/tailscale.bst - dakota.bst:bluefin/virtualization.bst -- gnome.bst:gnomeos-deps/distrobox.bst -- gnome.bst:gnomeos-deps/wl-clipboard.bst -- gnome.bst:freedesktop-sdk.bst:components/podman.bst -- gnome.bst:freedesktop-sdk.bst:components/containers-common.bst -- gnome.bst:freedesktop-sdk.bst:components/flatpak-builder.bst -- gnome.bst:freedesktop-sdk.bst:components/patch.bst -- gnome.bst:freedesktop-sdk.bst:components/ovmf-maybe.bst -- gnome.bst:freedesktop-sdk.bst:components/git.bst -- gnome.bst:freedesktop-sdk.bst:components/curl.bst +- dakota.bst:gnome-build-meta.bst:freedesktop-sdk-extra.bst:components/distrobox.bst +- dakota.bst:gnome-build-meta.bst:freedesktop-sdk-extra.bst:components/wl-clipboard.bst +- dakota.bst:freedesktop-sdk.bst:components/podman.bst +- dakota.bst:freedesktop-sdk.bst:components/containers-common.bst +- dakota.bst:freedesktop-sdk.bst:components/flatpak-builder.bst +- dakota.bst:freedesktop-sdk.bst:components/patch.bst +- dakota.bst:freedesktop-sdk.bst:components/ovmf-maybe.bst +- dakota.bst:freedesktop-sdk.bst:components/git.bst +- dakota.bst:freedesktop-sdk.bst:components/curl.bst diff --git a/elements/core/docker.bst b/elements/core/docker.bst index d586fae..b9fe3b9 100644 --- a/elements/core/docker.bst +++ b/elements/core/docker.bst @@ -16,13 +16,13 @@ sources: directory: config build-depends: -- gnome.bst:freedesktop-sdk.bst:public-stacks/runtime-gnu.bst +- dakota.bst:freedesktop-sdk.bst:public-stacks/runtime-gnu.bst runtime-depends: -- gnome.bst:freedesktop-sdk.bst:components/iptables.bst -- gnome.bst:freedesktop-sdk.bst:components/kmod.bst -- gnome.bst:freedesktop-sdk.bst:components/procps.bst -- gnome.bst:freedesktop-sdk.bst:components/ca-certificates.bst +- dakota.bst:freedesktop-sdk.bst:components/iptables.bst +- dakota.bst:freedesktop-sdk.bst:components/kmod.bst +- dakota.bst:freedesktop-sdk.bst:components/procps.bst +- dakota.bst:freedesktop-sdk.bst:components/ca-certificates.bst variables: strip-binaries: '' diff --git a/elements/core/eu-strip.bst b/elements/core/eu-strip.bst index b071e6f..6ec889e 100644 --- a/elements/core/eu-strip.bst +++ b/elements/core/eu-strip.bst @@ -2,10 +2,10 @@ kind: manual description: Keep elfutils tools available to Flatpak Builder depends: -- gnome.bst:freedesktop-sdk.bst:components/elfutils.bst +- dakota.bst:freedesktop-sdk.bst:components/elfutils.bst build-depends: -- gnome.bst:freedesktop-sdk.bst:public-stacks/runtime-gnu.bst +- dakota.bst:freedesktop-sdk.bst:public-stacks/runtime-gnu.bst variables: strip-binaries: '' diff --git a/elements/core/ghostty.bst b/elements/core/ghostty.bst index e5292f5..79c3af9 100644 --- a/elements/core/ghostty.bst +++ b/elements/core/ghostty.bst @@ -6,10 +6,10 @@ build-depends: # A filter does not inherit the parent artifact's runtime dependencies. runtime-depends: -- gnome.bst:sdk/gtk.bst -- gnome.bst:sdk/libadwaita.bst +- dakota.bst:gnome-build-meta.bst:sdk/gtk.bst +- dakota.bst:gnome-build-meta.bst:sdk/libadwaita.bst - dakota.bst:bluefin/gtk4-layer-shell.bst -- gnome.bst:freedesktop-sdk.bst:public-stacks/runtime-minimal.bst +- dakota.bst:freedesktop-sdk.bst:public-stacks/runtime-minimal.bst config: include-orphans: true diff --git a/elements/core/gradia-capture.bst b/elements/core/gradia-capture.bst index 2cd8f68..36dbf26 100644 --- a/elements/core/gradia-capture.bst +++ b/elements/core/gradia-capture.bst @@ -4,10 +4,10 @@ description: Gradia Capture with GNOME 51 enabled in its metadata build-depends: - dakota.bst:bluefin/shell-extensions/gradia-capture.bst - dakota.bst:core/sandbox-tools.bst -- gnome.bst:freedesktop-sdk.bst:components/jq.bst +- dakota.bst:freedesktop-sdk.bst:components/jq.bst runtime-depends: -- gnome.bst:core/gnome-shell.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-shell.bst variables: strip-binaries: "" diff --git a/elements/core/os-release.bst b/elements/core/os-release.bst index 6f10d2f..f565181 100644 --- a/elements/core/os-release.bst +++ b/elements/core/os-release.bst @@ -1,7 +1,7 @@ kind: manual build-depends: -- gnome.bst:freedesktop-sdk.bst:public-stacks/runtime-gnu.bst +- dakota.bst:freedesktop-sdk.bst:public-stacks/runtime-gnu.bst variables: strip-binaries: '' diff --git a/elements/core/secure-boot.bst b/elements/core/secure-boot.bst index 4d9a2c2..1d7cd31 100644 --- a/elements/core/secure-boot.bst +++ b/elements/core/secure-boot.bst @@ -6,8 +6,8 @@ depends: - dakota.bst:bluefin/secure-boot-tools.bst - dakota.bst:bluefin/lockdown-kargs.bst - dakota.bst:bluefin/kexec-disable.bst -- gnome.bst:gnomeos-deps/mokutil.bst +- dakota.bst:gnome-build-meta.bst:freedesktop-sdk-extra.bst:components/mokutil.bst # Used by Dakota's enrollment, TPM reseal and readiness commands. -- gnome.bst:freedesktop-sdk.bst:components/openssl.bst -- gnome.bst:freedesktop-sdk.bst:components/cryptsetup.bst -- gnome.bst:freedesktop-sdk.bst:components/jq.bst +- dakota.bst:freedesktop-sdk.bst:components/openssl.bst +- dakota.bst:freedesktop-sdk.bst:components/cryptsetup.bst +- dakota.bst:freedesktop-sdk.bst:components/jq.bst diff --git a/elements/core/session.bst b/elements/core/session.bst index fdcf9ed..2cf9696 100644 --- a/elements/core/session.bst +++ b/elements/core/session.bst @@ -4,27 +4,27 @@ description: GNOME session, settings, accessibility and desktop resources # GNOME 51's shell stack also includes Tour and Sushi. Sushi pulls in the # native Papers GUI, so keep the session selection explicit here. depends: -- gnome.bst:core/gdm.bst -- gnome.bst:core/gnome-backgrounds.bst -- gnome.bst:core/gnome-bluetooth.bst -- gnome.bst:core/gnome-color-manager.bst -- gnome.bst:core/gnome-control-center.bst -- gnome.bst:core/gnome-desktop.bst -- gnome.bst:core/gnome-initial-setup.bst -- gnome.bst:core/gnome-menus.bst -- gnome.bst:core/gnome-remote-desktop.bst -- gnome.bst:core/gnome-session.bst -- gnome.bst:core/gnome-settings-daemon.bst -- gnome.bst:core/gnome-shell.bst -- gnome.bst:core/gnome-user-share.bst -- gnome.bst:core/gvfs-daemon.bst -- gnome.bst:core/mutter.bst -- gnome.bst:core/orca.bst -- gnome.bst:core/rygel.bst -- gnome.bst:core/tecla.bst -- gnome.bst:sdk/adwaita-icon-theme.bst -- gnome.bst:sdk/glib-networking.bst -- gnome.bst:sdk/gsettings-desktop-schemas.bst +- dakota.bst:gnome-build-meta.bst:core/gdm.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-backgrounds.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-bluetooth.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-color-manager.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-control-center.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-desktop.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-initial-setup.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-menus.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-remote-desktop.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-session.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-settings-daemon.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-shell.bst +- dakota.bst:gnome-build-meta.bst:core/gnome-user-share.bst +- dakota.bst:gnome-build-meta.bst:core/gvfs-daemon.bst +- dakota.bst:gnome-build-meta.bst:core/mutter.bst +- dakota.bst:gnome-build-meta.bst:core/orca.bst +- dakota.bst:gnome-build-meta.bst:core/rygel.bst +- dakota.bst:gnome-build-meta.bst:core/tecla.bst +- dakota.bst:gnome-build-meta.bst:sdk/adwaita-icon-theme.bst +- dakota.bst:gnome-build-meta.bst:sdk/glib-networking.bst +- dakota.bst:gnome-build-meta.bst:sdk/gsettings-desktop-schemas.bst # Reuse Dakota's individually pinned extensions without its aggregate defaults. - dakota.bst:bluefin/shell-extensions/dash-to-dock.bst diff --git a/elements/core/strip.bst b/elements/core/strip.bst index 9bf2c03..dec993a 100644 --- a/elements/core/strip.bst +++ b/elements/core/strip.bst @@ -2,10 +2,10 @@ kind: manual description: Keep GNU strip available to Flatpak Builder depends: -- gnome.bst:freedesktop-sdk.bst:components/binutils.bst +- dakota.bst:freedesktop-sdk.bst:components/binutils.bst build-depends: -- gnome.bst:freedesktop-sdk.bst:public-stacks/runtime-gnu.bst +- dakota.bst:freedesktop-sdk.bst:public-stacks/runtime-gnu.bst variables: strip-binaries: '' diff --git a/elements/dakota.bst b/elements/dakota.bst index 5b37f6b..b945957 100644 --- a/elements/dakota.bst +++ b/elements/dakota.bst @@ -5,9 +5,11 @@ sources: url: github:projectbluefin/dakota.git # renovate: datasource=git-refs depName=projectbluefin/dakota packageName=https://github.com/projectbluefin/dakota.git track: testing - ref: 95ff6c060392d2c3b05c82d057b1e9e5adf59eb8 + ref: bb14777d9806c3924f5815712b92eb8c8125f95a - kind: patch path: patches/dakota/personal-os-secure-boot.patch +- kind: patch + path: patches/dakota/firewalld-iptables.patch config: options: @@ -17,8 +19,9 @@ config: # Sign only upstream; consume the published signatures here. secure_boot_signing: false overrides: - # Share GNOME's dependency graph for the borrowed Dakota recipes. - gnome-build-meta.bst: gnome.bst - freedesktop-sdk.bst: gnome.bst:freedesktop-sdk.bst + gnome-build-meta.bst:core/meta-gnome-core-apps.bst: core/apps.bst + gnome-build-meta.bst:oci/integration/os-release.bst: core/os-release.bst + # Share the published kernel/modules between the OS and its initramfs. + gnome-build-meta.bst:gnomeos/initramfs/signed-modules.bst: core/dakota-boot.bst plugins/buildstream-plugins.bst: plugins/buildstream-plugins.bst plugins/buildstream-plugins-community.bst: plugins/buildstream-plugins-community.bst diff --git a/elements/gnome.bst b/elements/gnome.bst deleted file mode 100644 index 82af3cd..0000000 --- a/elements/gnome.bst +++ /dev/null @@ -1,27 +0,0 @@ -kind: junction - -sources: -- kind: git_repo - url: gnome:gnome-build-meta.git - # renovate: datasource=git-refs depName=GNOME/gnome-build-meta packageName=https://gitlab.gnome.org/GNOME/gnome-build-meta.git - track: gnome-51 - ref: 1808f094d469291bdd85cc92a1a08f07aac6f6a6 -- kind: patch - path: patches/gnome/firewalld-iptables.patch -# Dakota redirects its GNOME junction here, so carry its Shell fix here too. -- kind: patch - path: patches/gnome/gnome-shell-portable-unzip-flags.patch - -config: - options: - arch: '%{arch}' - channel: stable - x86_64_v3: false - recc: passthrough - overrides: - plugins/buildstream-plugins.bst: plugins/buildstream-plugins.bst - plugins/buildstream-plugins-community.bst: plugins/buildstream-plugins-community.bst - core/meta-gnome-core-apps.bst: core/apps.bst - oci/integration/os-release.bst: core/os-release.bst - # Share the published kernel/modules between the OS and its initramfs. - gnomeos/initramfs/signed-modules.bst: core/dakota-boot.bst diff --git a/elements/oci/image.bst b/elements/oci/image.bst index 73d0486..7b8ff57 100644 --- a/elements/oci/image.bst +++ b/elements/oci/image.bst @@ -2,11 +2,11 @@ kind: script description: Single-layer bootc OCI image for VM bring-up build-depends: -- gnome.bst:freedesktop-sdk.bst:components/fakecap.bst -- gnome.bst:freedesktop-sdk.bst:components/oci-builder.bst -- gnome.bst:freedesktop-sdk.bst:components/glib.bst -- gnome.bst:core-deps/dconf.bst -- gnome.bst:freedesktop-sdk.bst:vm/prepare-image.bst +- dakota.bst:freedesktop-sdk.bst:components/fakecap.bst +- dakota.bst:freedesktop-sdk.bst:components/oci-builder.bst +- dakota.bst:freedesktop-sdk.bst:components/glib.bst +- dakota.bst:gnome-build-meta.bst:core-deps/dconf.bst +- dakota.bst:freedesktop-sdk.bst:vm/prepare-image.bst - oci/init-scripts.bst - filename: oci/filesystem.bst config: diff --git a/elements/oci/stack.bst b/elements/oci/stack.bst index 174453e..e9d4042 100644 --- a/elements/oci/stack.bst +++ b/elements/oci/stack.bst @@ -5,14 +5,14 @@ depends: - core/config.bst - core/secure-boot.bst - core/os-release.bst -- gnome.bst:gnomeos/initramfs/signed-modules.bst -- gnome.bst:oci/initramfs/image.bst -- gnome.bst:gnomeos-deps/bootc.bst -- gnome.bst:oci/integration/bootc-config.bst -- gnome.bst:oci/integration/lvm2-enable-activation.bst -- gnome.bst:freedesktop-sdk.bst:components/btrfs-progs.bst -- gnome.bst:freedesktop-sdk.bst:vm/config/useradd-default.bst -- gnome.bst:freedesktop-sdk.bst:vm/config/sudo.bst +- dakota.bst:gnome-build-meta.bst:gnomeos/initramfs/signed-modules.bst +- dakota.bst:gnome-build-meta.bst:oci/initramfs/image.bst +- dakota.bst:gnome-build-meta.bst:gnomeos-deps/bootc.bst +- dakota.bst:gnome-build-meta.bst:oci/integration/bootc-config.bst +- dakota.bst:gnome-build-meta.bst:oci/integration/lvm2-enable-activation.bst +- dakota.bst:freedesktop-sdk.bst:components/btrfs-progs.bst +- dakota.bst:freedesktop-sdk.bst:vm/config/useradd-default.bst +- dakota.bst:freedesktop-sdk.bst:vm/config/sudo.bst public: bst: diff --git a/patches/dakota/firewalld-iptables.patch b/patches/dakota/firewalld-iptables.patch new file mode 100644 index 0000000..ca3684a --- /dev/null +++ b/patches/dakota/firewalld-iptables.patch @@ -0,0 +1,32 @@ +From: Personal OS maintainers +Subject: [PATCH] Add firewalld's iptables fix to Dakota's GNOME patch queue + +Dakota owns our GNOME junction, so carry the fix as one more patch in its +gnome-build-meta queue. The queued patch explains the change itself. + +diff --git a/patches/gnome-build-meta/personal-os-firewalld-iptables.patch b/patches/gnome-build-meta/personal-os-firewalld-iptables.patch +new file mode 100644 +index 0000000..477ad12 +--- /dev/null ++++ b/patches/gnome-build-meta/personal-os-firewalld-iptables.patch +@@ -0,0 +1,20 @@ ++Upstream-Status: Pending ++Exit: Drop when gnome-build-meta adds iptables to firewalld itself. ++Subject: firewalld: discover iptables during configuration ++ ++Docker uses firewalld's direct API even when firewalld uses nftables. ++Without iptables in the build sandbox, configure records /bin/false for ++its IPv4/IPv6 commands. Keep iptables available at build time and runtime. ++ ++diff --git a/elements/gnomeos-deps/firewalld.bst b/elements/gnomeos-deps/firewalld.bst ++index 4018dfb6..674db542 100644 ++--- a/elements/gnomeos-deps/firewalld.bst +++++ b/elements/gnomeos-deps/firewalld.bst ++@@ -17,6 +17,7 @@ build-depends: ++ - freedesktop-sdk.bst:components/libxslt.bst ++ ++ depends: +++- freedesktop-sdk.bst:components/iptables.bst ++ - freedesktop-sdk.bst:components/python3-nftables.bst ++ - freedesktop-sdk.bst:components/python3.bst ++ diff --git a/patches/gnome/firewalld-iptables.patch b/patches/gnome/firewalld-iptables.patch deleted file mode 100644 index 81a4a8b..0000000 --- a/patches/gnome/firewalld-iptables.patch +++ /dev/null @@ -1,14 +0,0 @@ -From: Personal OS maintainers -Subject: [PATCH] firewalld: discover iptables during configuration - -Docker uses firewalld's direct API even when firewalld uses nftables. -Without iptables in the build sandbox, configure records /bin/false for -its IPv4/IPv6 commands. Keep iptables available at build time and runtime. - -diff --git a/elements/gnomeos-deps/firewalld.bst b/elements/gnomeos-deps/firewalld.bst ---- a/elements/gnomeos-deps/firewalld.bst -+++ b/elements/gnomeos-deps/firewalld.bst -@@ -19,2 +19,3 @@ depends: -+- freedesktop-sdk.bst:components/iptables.bst - - freedesktop-sdk.bst:components/python3-nftables.bst - - freedesktop-sdk.bst:components/python3.bst diff --git a/patches/gnome/gnome-shell-portable-unzip-flags.patch b/patches/gnome/gnome-shell-portable-unzip-flags.patch deleted file mode 100644 index 012ccf6..0000000 --- a/patches/gnome/gnome-shell-portable-unzip-flags.patch +++ /dev/null @@ -1,43 +0,0 @@ -Upstream-Status: Pending -Exit: Drop when GNOME Shell stops shelling out to unzip for extension extraction - (GNOME/gnome-shell#8567, GNOME/gnome-shell!4403), or when the image ships a - traditional Info-ZIP unzip again. -Subject: gnome-shell: use portable unzip flags for extension extraction - -diff --git a/elements/core/gnome-shell.bst b/elements/core/gnome-shell.bst -index ebce5ab..4a81cb9 100644 ---- a/elements/core/gnome-shell.bst -+++ b/elements/core/gnome-shell.bst -@@ -12,6 +12,8 @@ sources: - url: gnome:libshew.git - directory: subprojects/libshew - ref: d16afc40412b565d2bbecf80335f54a19a978009 -+- kind: patch -+ path: patches/gnome-shell/0001-extensionDownloader-use-portable-unzip-flags.patch - - build-depends: - - (@): include/gcc-for-recc.yml -diff --git a/patches/gnome-shell/0001-extensionDownloader-use-portable-unzip-flags.patch b/patches/gnome-shell/0001-extensionDownloader-use-portable-unzip-flags.patch -new file mode 100644 -index 0000000..1f8b144 ---- /dev/null -+++ b/patches/gnome-shell/0001-extensionDownloader-use-portable-unzip-flags.patch -@@ -0,0 +1,18 @@ -+Upstream-Status: Pending -+Exit: Drop when GNOME Shell stops shelling out to unzip for extension extraction -+ (GNOME/gnome-shell#8567, GNOME/gnome-shell!4403), or when the image ships a -+ traditional Info-ZIP unzip again. -+ -+diff --git a/js/ui/extensionDownloader.js b/js/ui/extensionDownloader.js -+index 16f765a..191da18 100644 -+--- a/js/ui/extensionDownloader.js -++++ b/js/ui/extensionDownloader.js -+@@ -124,7 +124,7 @@ async function extractExtensionArchive(bytes, dir) { -+ stream.close_async(GLib.PRIORITY_DEFAULT, null); -+ -+ const unzip = Gio.Subprocess.new( -+- ['unzip', '-uod', dir.get_path(), '--', file.get_path()], -++ ['unzip', '-od', dir.get_path(), '--', file.get_path()], -+ Gio.SubprocessFlags.NONE); -+ await unzip.wait_check_async(null); -+ diff --git a/project.conf b/project.conf index cd4789d..cbc1b54 100644 --- a/project.conf +++ b/project.conf @@ -3,7 +3,7 @@ min-version: 2.6 element-path: elements (@): -- gnome.bst:freedesktop-sdk.bst:include/runtime.yml +- dakota.bst:freedesktop-sdk.bst:include/runtime.yml - include/image.yml options: @@ -35,7 +35,7 @@ plugins: junction: plugins/buildstream-plugins-community.bst sources: [git_repo, patch_queue] - origin: junction - junction: gnome.bst + junction: dakota.bst:gnome-build-meta.bst elements: [collect_initial_scripts] fatal-warnings: From 156f860d83bcf4064cb13a333bbf1fae9c42e9ea Mon Sep 17 00:00:00 2001 From: Thomas Date: Wed, 21 Oct 2026 12:41:33 -0400 Subject: [PATCH 3/5] Only follow Dakota commits whose CI build succeeded Renovate tracked the head of Dakota's testing branch, which can be a commit that hasn't built yet or failed to build. A custom datasource now reads the newest build.yml push run on testing and offers its commit only when that run succeeded, so every proposed commit has pushed its artifacts to the Bluefin cache. Older successful runs are not trusted because Dakota skips the build for a push when a newer one is queued. GNOME and freedesktop-sdk now move with Dakota, so the generic git-refs element manager is no longer needed. A package rule keeps the commit-to-commit comparison link on Dakota update PRs. --- docs/automation.md | 2 +- elements/dakota.bst | 2 +- renovate.json | 22 ++++++++++++++++++---- 3 files changed, 20 insertions(+), 6 deletions(-) diff --git a/docs/automation.md b/docs/automation.md index b8a2891..4e4c563 100644 --- a/docs/automation.md +++ b/docs/automation.md @@ -30,7 +30,7 @@ Keep the full version and `-dind` suffix. Renovate updates the tag and digest to The shared BuildStream plugin junctions have their own release tags and commit pins, managed directly by Renovate. They no longer follow GNOME's plugin recipes. The Docker source carries a small compatibility patch shared with other OCI imports, covering HTTP content types, Zstd layers and `sha256:` refs. Review that patch when updating the plugin release. -GNOME and Dakota track their existing Git branches. Container images and Actions are also tracked; nested component versions remain owned by their upstream junctions. Dependency updates need no checksum or recipe synchronization script. +The Dakota recipe pin follows Dakota's `testing` branch, but only to commits whose Dakota CI build succeeded, so their artifacts are already in the Bluefin cache. A Renovate custom datasource reads the newest `build.yml` push run on `testing` and offers its commit only if that run succeeded. Dakota skips the build for a push when a newer push is already queued, so older successful runs are not trusted. While the newest build is still running or has failed, Renovate reports a lookup warning and leaves the pin alone. GNOME and freedesktop-sdk move with Dakota. Container images and Actions are also tracked; nested component versions remain owned by their upstream junctions. Dependency updates need no checksum or recipe synchronization script. The kernel image in `elements/core/dakota-boot.bst` independently follows Dakota's `testing` channel with an exact amd64 manifest digest. Kernel, modules, signed EFI binaries and signing certificate come from the same image; the Dakota recipe pin does not have to match its source revision. diff --git a/elements/dakota.bst b/elements/dakota.bst index b945957..32fb50a 100644 --- a/elements/dakota.bst +++ b/elements/dakota.bst @@ -3,7 +3,7 @@ kind: junction sources: - kind: git_repo url: github:projectbluefin/dakota.git - # renovate: datasource=git-refs depName=projectbluefin/dakota packageName=https://github.com/projectbluefin/dakota.git + # renovate: datasource=custom.dakota-build depName=projectbluefin/dakota track: testing ref: bb14777d9806c3924f5815712b92eb8c8125f95a - kind: patch diff --git a/renovate.json b/renovate.json index 7982f56..bc0ac2e 100644 --- a/renovate.json +++ b/renovate.json @@ -11,6 +11,15 @@ ], "automerge": false, "prHourlyLimit": 10, + "customDatasources": { + "dakota-build": { + "description": "Offer Dakota's newest testing push only once its CI build succeeded, so its artifacts are in the Bluefin cache. Dakota skips the build for a push when a newer one is queued, so only the newest push run is trusted.", + "defaultRegistryUrlTemplate": "https://api.github.com/repos/{{packageName}}/actions/workflows/build.yml/runs?branch={{currentValue}}&event=push&per_page=1", + "transformTemplates": [ + "workflow_runs[0].conclusion = \"success\" ? {\"sourceUrl\": \"https://github.com/{{packageName}}\", \"releases\": [{\"version\": \"{{currentValue}}\", \"digest\": workflow_runs[0].head_sha, \"releaseTimestamp\": workflow_runs[0].updated_at}]} : {\"releases\": []}" + ] + } + }, "customManagers": [ { "customType": "regex", @@ -29,10 +38,10 @@ }, { "customType": "regex", - "managerFilePatterns": ["/^elements/.*\\.bst$/"], - "matchStrings": ["# renovate: datasource=git-refs depName=(?\\S+) packageName=(?\\S+)\\n track: (?[^\\n]+)\\n ref: (?:[^\\n]*-g)?(?[a-f0-9]{40})"], - "datasourceTemplate": "git-refs", - "autoReplaceStringTemplate": "# renovate: datasource=git-refs depName={{{depName}}} packageName={{{packageName}}}\n track: {{{currentValue}}}\n ref: {{{newDigest}}}" + "managerFilePatterns": ["/^elements/dakota\\.bst$/"], + "matchStrings": ["# renovate: datasource=custom\\.dakota-build depName=(?\\S+)\\n track: (?[^\\n]+)\\n ref: (?[a-f0-9]{40})"], + "datasourceTemplate": "custom.dakota-build", + "versioningTemplate": "exact" }, { "customType": "regex", @@ -75,6 +84,11 @@ "Updates the signed kernel, matching modules and Secure Boot files imported from Dakota's image. Other Dakota recipes are pinned separately." ] }, + { + "matchDatasources": ["custom.dakota-build"], + "matchUpdateTypes": ["digest"], + "changelogUrl": "{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}" + }, { "matchManagers": ["github-actions"], "matchDepTypes": ["action"], From 65d76ab5cc38d62b9c3eaef2419841931e3012fb Mon Sep 17 00:00:00 2001 From: Thomas Date: Wed, 21 Oct 2026 13:05:37 -0400 Subject: [PATCH 4/5] Rebuild the CA trust bundles at every boot bootc keeps locally changed /etc files across upgrades. Adding a local CA with update-ca-trust changes the extracted bundles, so such systems kept their old bundles and never received certificate changes from image updates, including the eMudhra blocklist. Rebuild the bundles early in boot, before the network starts, from the booted image's certificates and the local sources in /etc/pki/ca-trust/source. --- docs/building.md | 2 ++ .../system-preset/00-personal-os.preset | 2 ++ .../lib/systemd/system/update-ca-trust.service | 18 ++++++++++++++++++ 3 files changed, 22 insertions(+) create mode 100644 files/system/usr/lib/systemd/system/update-ca-trust.service diff --git a/docs/building.md b/docs/building.md index 04598eb..4c267fb 100644 --- a/docs/building.md +++ b/docs/building.md @@ -122,6 +122,8 @@ Flatpak Builder has native `patch`, `strip`, `eu-strip` and `eu-elfcompress` ava The image temporarily distrusts the `emSign ECC Root CA - G3` and `Comodo AAA Services root` certificates after the eMudhra intermediate key compromise. Their certificates are in p11-kit's `/etc/pki/ca-trust/source/blocklist`, which the system's OpenSSL, GnuTLS and NSS trust stores all read. The `/etc` source takes precedence over the distribution bundle, so every extracted bundle rejects them. Python's bundled certifi list is replaced with a link to the system list. Remove both once freedesktop-sdk's `ca-certificates` drops these roots and its certifi is 2026.10.19 or newer. +`update-ca-trust.service` rebuilds the extracted CA bundles early in every boot. bootc keeps locally changed `/etc` files across upgrades, and adding a local CA with `update-ca-trust` changes those bundles, so without this refresh such systems would keep their old bundles and miss certificate changes from image updates. Local sources in `/etc/pki/ca-trust/source` are preserved. + Tailscale starts without enrollment. Run `sudo tailscale up` after installing. Its machine state belongs in writable `/var`, never in the image definition. Libvirt uses socket activation and Dakota's dedicated QEMU account settings. The image includes UEFI guest firmware. No VM GUI frontend is preinstalled. diff --git a/files/system/usr/lib/systemd/system-preset/00-personal-os.preset b/files/system/usr/lib/systemd/system-preset/00-personal-os.preset index 8a4a8ae..8f8ce7a 100644 --- a/files/system/usr/lib/systemd/system-preset/00-personal-os.preset +++ b/files/system/usr/lib/systemd/system-preset/00-personal-os.preset @@ -10,6 +10,8 @@ enable bootc-fetch-apply-updates.timer enable dakota-secure-boot-update.service enable systemd-resolved.service enable global-preset-all.service +# Apply image certificate changes on systems with local CA changes. +enable update-ca-trust.service enable flatpak-preinstall.service # Socket activation starts libvirt when a VM client needs it. diff --git a/files/system/usr/lib/systemd/system/update-ca-trust.service b/files/system/usr/lib/systemd/system/update-ca-trust.service new file mode 100644 index 0000000..fe244f8 --- /dev/null +++ b/files/system/usr/lib/systemd/system/update-ca-trust.service @@ -0,0 +1,18 @@ +[Unit] +Description=Rebuild the system CA trust bundles +Documentation=man:update-ca-trust(8) +# bootc keeps locally changed /etc files across upgrades, including bundles +# rebuilt after adding a local CA. Rebuild them from the booted image's +# certificates and local sources so certificate changes in updates apply. +DefaultDependencies=no +After=local-fs.target +Before=sysinit.target network-pre.target shutdown.target +Conflicts=shutdown.target + +[Service] +Type=oneshot +ExecStart=/usr/bin/update-ca-trust extract +RemainAfterExit=yes + +[Install] +WantedBy=sysinit.target From aaae874798aed07243c29b1f2ad45ef3097c190f Mon Sep 17 00:00:00 2001 From: Thomas Date: Wed, 21 Oct 2026 13:05:37 -0400 Subject: [PATCH 5/5] Trim stale details from the docs Drop pinned hashes and exact versions that Renovate updates in code but not in the docs, describe Dakota's ownership of the GNOME graph, and replace the dated bring-up logs in validation.md with the current verified state, known issues and remaining checks. The detailed logs remain in git history. --- docs/automation.md | 8 +-- docs/building.md | 28 ++++------ docs/chunkah.md | 4 +- docs/plan.md | 10 ++-- docs/secure-boot.md | 6 +-- docs/validation.md | 126 +++++++++----------------------------------- 6 files changed, 47 insertions(+), 135 deletions(-) diff --git a/docs/automation.md b/docs/automation.md index 4e4c563..a4f8ea1 100644 --- a/docs/automation.md +++ b/docs/automation.md @@ -4,7 +4,7 @@ The version uses the UTC date when the build starts. `N` is one more than the largest matching version tag already published to GHCR, so the first published image on September 21, 2026 is `20260921.1`. Failed and cancelled builds do not reserve a number. A rerun only advances the counter if its previous attempt published the version tag. CI writes this version into the image before BuildStream starts. It appears in `os-release`, the OCI metadata and the boot image selector as, for example, `Personal OS 20260921.1`. -The build uses standard GitHub-hosted Ubuntu runners and upstream BuildStream caches, without preserving local artifacts between runs. Full builds have already completed successfully on those runners. +The build uses standard GitHub-hosted Ubuntu runners and upstream BuildStream caches, without preserving local artifacts between runs. Publication uses Red Hat's `push-to-registry` Action. It reuses the image already imported into Podman for bootc validation, then publishes the version, commit and `latest` tags. The workflow's `IMAGE_NAME` is `tb516/os`; keep it aligned with `include/image.yml` if the repository moves. Renovate tracks the publishing Action's pinned revision. @@ -22,8 +22,8 @@ Docker's Engine, CLI, Compose and Buildx update together through the official Do ```yaml # renovate: datasource=docker depName=docker.io/library/docker - track: 29.9.1-dind - ref: sha256:d18cae6d97a9ebf10a017859d3cdf728de0f2efc465364ba0bab6e2c9a87ccdc + track: -dind + ref: sha256: ``` Keep the full version and `-dind` suffix. Renovate updates the tag and digest together and preserves the architecture of the existing Linux amd64 manifest pin. BuildStream's Docker source expects a platform manifest rather than a multi-platform index. @@ -42,4 +42,4 @@ Kernel updates show image build timestamps, Dakota source revisions, kernel sour The report uses the workflow's existing `RENOVATE_TOKEN`. It includes the PR revision and skips publishing if that revision changed during generation. Existing comments are updated only when their content changes. A temporary fetch failure preserves an existing successful report for the same PR revision. -Review GNOME/Dakota compatibility and local integration assumptions before merging. The build starts after merging, so an update PR does not establish that the new OS builds or boots. +Review Dakota updates and local integration assumptions before merging. The build starts after merging, so an update PR does not establish that the new OS builds or boots. diff --git a/docs/building.md b/docs/building.md index 4c267fb..d404f24 100644 --- a/docs/building.md +++ b/docs/building.md @@ -68,13 +68,7 @@ The GitHub build workflow publishes on pushes to `main`. See [automation](automa See [design history](plan.md) for the composition decisions and remaining milestones. -| Input | Pinned revision | -| --- | --- | -| Dakota `testing` | `bb14777d9806c3924f5815712b92eb8c8125f95a` | -| GNOME `gnome-51`, through Dakota | `24bd9e3394437b85fc204bf58ecd3d867d815f66` (51.1) | -| freedesktop-sdk, through Dakota | `32c5fea70e827885fc805d38a9dc5716c39ed173`, tag `freedesktop-sdk-26.08.2` | - -`elements/dakota.bst` is the only base pin. Dakota owns the GNOME and freedesktop-sdk junctions, including their patch queues and overrides, so our artifacts match the ones Dakota's CI pushes to the Bluefin cache. Local elements refer to them as `dakota.bst:gnome-build-meta.bst:…` and `dakota.bst:freedesktop-sdk.bst:…`. Our junction settings override the GNOME apps list, os-release and boot modules inside Dakota's GNOME junction. Dakota and GNOME share the top-level plugin junctions. The freedesktop-sdk project's internal plugins retain their upstream isolation. +`elements/dakota.bst` pins a commit on Dakota's `testing` branch and is the only base pin. Dakota owns the GNOME and freedesktop-sdk junctions, including their patch queues and overrides, so our artifacts match the ones Dakota's CI pushes to the Bluefin cache. Local elements refer to them as `dakota.bst:gnome-build-meta.bst:…` and `dakota.bst:freedesktop-sdk.bst:…`. Our junction settings override the GNOME apps list, os-release and boot modules inside Dakota's GNOME junction. Dakota and GNOME share the top-level plugin junctions. The freedesktop-sdk project's internal plugins retain their upstream isolation. The graph therefore includes Dakota's GNOME-level choices: its Plymouth theme, bootc, Mesa and ffmpeg builds, initramfs modules and dnsmasq fix. Review those when updating the Dakota pin. Normal builds use the committed refs, not the tips of the tracking branches. @@ -86,15 +80,13 @@ Dakota supplies Ghostty, xdg-terminal-exec, Tailscale, virtualization, the kerne The kernel is Dakota's regular freedesktop-sdk-derived kernel, imported from its published OCI image by `core/dakota-boot.bst`. The Dakota junction's GNOME override selects that import for both the OS and its initramfs. The import preserves module files without stripping them and discards Dakota's initramfs; GNOME builds a new initramfs from the imported modules and this OS's userspace. GNOME's zram configuration stays in place. The same import supplies Dakota-signed systemd-boot and fwupd EFI loaders, Fedora shim/MokManager and Dakota's public certificate. Dakota's upstream enrollment tool and EFI maintenance service are selected separately; no local signing key is used. -The OCI source follows Dakota's regular `testing` image and pins an amd64 manifest digest. Renovate updates that digest independently of the Dakota recipe pin in `elements/dakota.bst`. The source is the production `testing` image at Dakota revision `95ff6c060392d2c3b05c82d057b1e9e5adf59eb8`; the selected amd64 digest is `sha256:4697e6606ae5c23b58e24c2001654af60a614d977d23d37cc9358baa17d103a7`. Fetching it downloads the whole Dakota image, but only the kernel/modules and signed boot payload enter the imported artifact. BuildStream caches the source and the small extracted artifact locally. No Dakota application defaults are imported, and no kernel compilation or private signing key is needed. +The OCI source follows Dakota's regular `testing` image and pins an amd64 manifest digest. Renovate updates that digest independently of the Dakota recipe pin in `elements/dakota.bst`. Fetching it downloads the whole Dakota image, but only the kernel/modules and signed boot payload enter the imported artifact. BuildStream caches the source and the small extracted artifact locally. No Dakota application defaults are imported, and no kernel compilation or private signing key is needed. The pinned BuildStream docker source needs `patches/buildstream-plugins/docker-oci-zstd.patch` to accept zstd layers and manifests whose media type is supplied only by the HTTP header. It also accepts and writes the standard `sha256:` digest prefix so Renovate can manage the pin directly. Python 3.14 or later is required for zstd extraction; the pinned builder provides it. Remove this patch once the upstream plugin supports these formats and the prefixed digest syntax. -The shared official-plugin junction selects release 2.8.0. Its upstream OCI media-type support replaces that portion of our original patch. As of October 18, 2026, upstream still lacks the HTTP Content-Type fallback, zstd layer acceptance and prefixed refs; no issue or PR covering those additions was found. - The import verifies kernel and EFI signatures against the certificate from that image, requires signed modules and checks the kernel's security capabilities/default LSMs. It fails rather than silently accepting an unsigned update. Lockdown and disabled kexec come from Dakota's recipes; local boot arguments enable Intel IOMMU and disable IOMMU passthrough. See [Secure Boot bring-up](secure-boot.md) for enrollment and the validation still needed before deployment. -BuildStream extracts Docker Engine, CLI, Compose and Buildx from the official `docker.io/library/docker:29.9.1-dind` image, pinned to its Linux amd64 manifest digest. Only selected binaries enter the OS; Alpine files and container entrypoints are excluded. Docker uses embedded containerd, with its runtime helpers under `/usr/libexec/docker`. Only its service adds that directory to PATH, keeping Podman's runtime independent. The mise binary lives in each user's home directory and is not part of the image or Renovate's dependencies. +BuildStream extracts Docker Engine, CLI, Compose and Buildx from the official `docker.io/library/docker` `-dind` image, pinned to its Linux amd64 manifest digest. Only selected binaries enter the OS; Alpine files and container entrypoints are excluded. Docker uses embedded containerd, with its runtime helpers under `/usr/libexec/docker`. Only its service adds that directory to PATH, keeping Podman's runtime independent. The mise binary lives in each user's home directory and is not part of the image or Renovate's dependencies. `mise-bootstrap.service` runs at user login and uses the official `https://mise.run` installer to install mise into `~/.local/bin/mise`. The installer selects the release and verifies its download. System accounts are excluded. An existing file at that path skips installation; failures retry every 15 minutes while the user manager is running. A successful installation is left alone on subsequent logins. Removing the binary makes it eligible for installation again; use `systemctl --user mask --now mise-bootstrap.service` to opt out first. @@ -106,9 +98,9 @@ The image supplies Bash activation through `/etc/profile.d/mise.sh` and adds mis Alt+Tab switches between individual windows, while Super+Tab switches between applications, matching Dakota. Super+E opens the home folder in Files. Dash to Dock, AppIndicator tray icons and Custom Command Menu are installed from the pinned Dakota recipes and enabled by default. The menu sits at the top left and opens About, System Monitor, Settings, Home, Bazaar, Extension Manager and the terminal. Its entries live in the local dconf database because the extension loads its own bundled schemas. Dakota's menu recipe also installs distro dconf snippets, but this image's profile only reads the local database. -Bazaar Companion is also installed and enabled by default. It adds App Details and Uninstall actions to Flatpak application menus, with App Details opening Bazaar. The image reuses Dakota's pinned extension and updates the uninstall dialog for GNOME 51's layout API, then adds 51 to its supported-version metadata. The menu actions still need testing in a running VM. +Bazaar Companion is also installed and enabled by default. It adds App Details and Uninstall actions to Flatpak application menus, with App Details opening Bazaar. The image reuses Dakota's pinned extension and updates the uninstall dialog for GNOME 51's layout API, then adds 51 to its supported-version metadata. -Gradia Capture is installed and enabled using Dakota's pinned build with GNOME 51 added to its metadata. It adds screenshot annotations; installing Gradia from Bazaar also enables its editor and OCR integration. Screenshot capture still needs testing in a running VM. +Gradia Capture is installed and enabled using Dakota's pinned build with GNOME 51 added to its metadata. It adds screenshot annotations; installing Gradia from Bazaar also enables its editor and OCR integration. These defaults do not replace saved user settings after a rebase. If needed, enable the extensions in Extension Manager and reset the relevant shortcuts in Settings. The Home shortcut can also be restored with `gsettings reset org.gnome.settings-daemon.plugins.media-keys home`, and `gsettings reset org.gnome.shell enabled-extensions` replaces your saved enabled-extension list with this image's defaults. Saved menu customizations take precedence too. @@ -134,7 +126,7 @@ At each boot, `flatpak-preinstall.service` runs `flatpak preinstall --system --n Flatpak tracks preinstalled apps itself and respects manual uninstalls. Changes to the declarations take effect on the next run, including removal of previously managed apps that are no longer declared. There is no separate installation marker or shell installer. Each Flatpak declares its own runtime. Bazaar can manage subsequent Flatpak updates. To retry immediately, run `sudo systemctl restart flatpak-preinstall.service`. -The default Flatpaks are Bazaar, Mission Center, Sushi (`org.gnome.NautilusPreviewer`), Extension Manager, Refine, Flatseal, Logs and GNOME Firmware. Extension Manager manages GNOME Shell extensions; Refine exposes GNOME settings and experimental features; Flatseal reviews and changes Flatpak permissions; Logs reads the systemd journal. GNOME Firmware talks to the host fwupd service. Sushi exports the D-Bus service used by Files for spacebar previews. Its current Flathub build grants read access to the home directory; previews on removable drives or network mounts may need additional permissions. Verify these apps and preview activation in the VM before considering this integration complete. +The default Flatpaks are Bazaar, Mission Center, Sushi (`org.gnome.NautilusPreviewer`), Extension Manager, Refine, Flatseal, Logs and GNOME Firmware. Extension Manager manages GNOME Shell extensions; Refine exposes GNOME settings and experimental features; Flatseal reviews and changes Flatpak permissions; Logs reads the systemd journal. GNOME Firmware talks to the host fwupd service. Sushi exports the D-Bus service used by Files for spacebar previews. Its current Flathub build grants read access to the home directory; previews on removable drives or network mounts may need additional permissions. The current update path is manual: @@ -162,9 +154,9 @@ A temporary installer VM has installed the image onto a virtual disk, which boot ## Upstream references -- [GNOME build metadata at the selected revision](https://gitlab.gnome.org/GNOME/gnome-build-meta/-/tree/24bd9e3394437b85fc204bf58ecd3d867d815f66) -- [Dakota at the selected revision](https://github.com/projectbluefin/dakota/tree/bb14777d9806c3924f5815712b92eb8c8125f95a) -- [Official Docker image recipe](https://github.com/docker-library/docker/tree/master/29) +- [Dakota](https://github.com/projectbluefin/dakota) +- [GNOME build metadata](https://gitlab.gnome.org/GNOME/gnome-build-meta) +- [Official Docker image recipe](https://github.com/docker-library/docker) - [mise installation](https://mise.jdx.dev/installing-mise.html) -The image assembly follows the Dakota recipes, and the GNOME recipes Dakota selects, at those revisions. The shared plugin junctions follow upstream release tags, independently of Dakota. Upstream components retain their own licenses. +The image assembly follows the Dakota recipes, and the GNOME recipes Dakota selects, at the pinned revision. The shared plugin junctions follow upstream release tags, independently of Dakota. Upstream components retain their own licenses. diff --git a/docs/chunkah.md b/docs/chunkah.md index 0e44268..54f233b 100644 --- a/docs/chunkah.md +++ b/docs/chunkah.md @@ -24,5 +24,5 @@ Actual transfer savings need measuring across two builds with a small update. Runtime validation still needs a chunked image boot and upgrade in a VM, plus CI disk usage and packaging time measurements. -References: [Chunkah usage](https://github.com/coreos/chunkah/blob/v0.6.0/README.md) -and [fallback component detection](https://github.com/coreos/chunkah/blob/v0.6.0/src/components/bigfiles.rs). +References: [Chunkah usage](https://github.com/coreos/chunkah/blob/main/README.md) +and [fallback component detection](https://github.com/coreos/chunkah/blob/main/src/components/bigfiles.rs). diff --git a/docs/plan.md b/docs/plan.md index fe7d0ad..dec14cd 100644 --- a/docs/plan.md +++ b/docs/plan.md @@ -10,11 +10,11 @@ The initial base is GNOME 51 and freedesktop-sdk 26.08, using baseline x86_64. D x86-64-v3 was tried during bring-up, then disabled because upstream GNOME and Dakota CI use the baseline target. Reusing upstream artifacts takes priority over CPU-specific compilation, especially for future hosted CI builds. -Dakota tracks `testing` with a fixed commit. The initial `next` pin was replaced after confirming that the borrowed components were identical on `testing`; the rolling branch was unnecessary for the pinned GNOME 51 base. +Dakota is pinned to commits on its `testing` branch whose CI build succeeded. Its rolling `next` branch follows GNOME's development branch and is not used. ## Composition decisions -- Keep one shared GNOME/freedesktop-sdk graph. Pin compatible upstream revisions and review them together when updating. +- Take GNOME and freedesktop-sdk through Dakota's junctions and pin only Dakota, so the graph matches the artifacts Dakota's CI caches. This also accepts Dakota's GNOME-level choices, such as its boot splash and bootc. - Own the final composition locally. Reuse individual Dakota elements through a junction without importing `bluefin/deps.bst` or `bluefin/common.bst`. - Use public artifact and source caches read-only. Preserve upstream recipes where possible, but let image requirements determine composition. - Build one complete OS image. The initial split into two editions was removed to keep builds and validation focused on the system that will be used. @@ -24,8 +24,6 @@ Dakota tracks `testing` with a fixed commit. The initial `next` pin was replaced GNOME supplies the desktop session and host integration. Flatpak is the normal GUI application format, with Bazaar as the store and an explicit default application list. Files and Disks are native applications. Sushi is selected as a default Flatpak for file previews. PDF thumbnails are omitted so the image does not need native Papers or a separate extraction recipe. -Helium and Microsoft Visual Studio Code were initially included as native applications for host integration. They have since been removed from the image. - Use Flatpak's built-in `.preinstall` declarations and a boot service, following Dakota's approach. The default set includes the app store, system monitor, file previews, GNOME extension management, GNOME tweaks, Flatpak permission management and journal viewing. Flatpak owns installation state and respects manual removals; changes to the default selection do not require maintaining a custom installer or completion marker. Keep parental controls and Help as supplied by upstream. An initial attempt to exclude them required modifying three GNOME recipes; maintaining those changes was not worth the smaller application selection. GNOME user documentation remains excluded through the local session list. Keep sharing services, remote desktop, accessibility and color management. @@ -34,7 +32,7 @@ Ghostty is image-managed and supplies the preferred terminal integration. Distro Tailscale and QEMU/libvirt belong in the image because they need host services. Selected Dakota elements also provide resolver integration, the composefs disk-visibility rule and the PC-speaker audio rule. -The initial implementation keeps bootc install defaults local to select Btrfs. It retains GNOME's bootc version and zram defaults. Exact pins and recipe ownership are documented in the [build guide](building.md). +The initial implementation keeps bootc install defaults local to select Btrfs. It uses Dakota's bootc and GNOME's zram defaults. Exact pins and recipe ownership are documented in the [build guide](building.md). ## Deployment decisions @@ -50,4 +48,4 @@ Dependency-update PRs and CI publication to GHCR are in place. 2. Verify a fresh installation through the adapted installer, its update origin, and a subsequent update-and-rollback cycle. 3. Complete hardware and external-integration acceptance, including accelerated graphics, audible output, Tailscale enrollment and running libvirt guests. -The full image builds, installs and boots through systemd-boot into a GNOME Wayland session. Initial setup, native apps, default Flatpaks, PDF previews, container networking and persistence across reboot have passed VM checks. Keep exact results and limits in the validation notes rather than treating this roadmap as evidence of completion. +The full image builds, installs and boots through systemd-boot into a GNOME Wayland session. Initial setup, native apps, default Flatpaks, container networking and persistence across reboot have passed VM checks. Keep exact results and limits in the validation notes rather than treating this roadmap as evidence of completion. diff --git a/docs/secure-boot.md b/docs/secure-boot.md index f68d2e7..9e5ee5c 100644 --- a/docs/secure-boot.md +++ b/docs/secure-boot.md @@ -6,11 +6,11 @@ Personal OS uses Dakota's signed boot chain. The full image build and disposable `core/dakota-boot.bst` imports the signed kernel, matching modules, signed systemd-boot/fwupd EFI loaders, Fedora's Microsoft-signed shim/MokManager and Dakota's public certificate from one pinned production OCI image. It preserves signatures and builds our own initramfs. The import requires the signed payload and relevant kernel capabilities; it does not fall back to unsigned files. -Dakota's merged source recipes provide the enrollment helper, its boot-time EFI maintenance service, explicit `lockdown=integrity`, and `kernel.kexec_load_disabled=1`. A local patch installs the helper as `/usr/libexec/personal-os-secure-boot`, updates the service to call it, and labels new firmware entries `Personal OS`. GNOME supplies `mokutil`. Local boot arguments request `intel_iommu=on` and `iommu.passthrough=0`; AMD IOMMU is enabled by the kernel by default. The imported kernel must include BPF LSM and lockdown in its default LSM list. +Dakota's merged source recipes provide the enrollment helper, its boot-time EFI maintenance service, explicit `lockdown=integrity`, and `kernel.kexec_load_disabled=1`. A local patch installs the helper as `/usr/libexec/personal-os-secure-boot`, updates the service to call it, and labels new firmware entries `Personal OS`. freedesktop-sdk-extra supplies `mokutil`. Local boot arguments request `intel_iommu=on` and `iommu.passthrough=0`; AMD IOMMU is enabled by the kernel by default. The imported kernel must include BPF LSM and lockdown in its default LSM list. Signing stays upstream. Keep Dakota's `secure_boot_signing` build option false here: enabling it would request upstream signing elements and private-key inputs, which this project does not need. -The image tracks `testing` for Renovate updates and pins its production image at revision `95ff6c060392d2c3b05c82d057b1e9e5adf59eb8`. Builds use the exact pinned digest. The import rejects unsigned payloads; review the payload before accepting an image update. +Renovate follows Dakota's production `testing` image, and builds use the exact pinned digest. The import rejects unsigned payloads; review the payload before accepting an image update. ## Enrollment after build and boot validation @@ -43,7 +43,7 @@ Lockdown prevents hibernation and loading modules signed by untrusted keys. Disa Dakota's `check` command is an upstream diagnostic, not Epic's acceptance test. Read its reported failures/waits; its exit code alone does not establish readiness. -The tested VM boots through Microsoft-trusted shim, Dakota-signed systemd-boot and the signed kernel. Dakota's checker reports eight passes and two waits for key recognition. Firmware rejects a direct bootloader launch that bypasses shim, and the kernel rejects a module with its signature removed. The maintenance service restores stale/missing EFI files. See [validation results](validation.md) for the image digest and evidence. +The tested VM boots through Microsoft-trusted shim, Dakota-signed systemd-boot and the signed kernel. Dakota's checker reports eight passes and two waits for key recognition. Firmware rejects a direct bootloader launch that bypasses shim, and the kernel rejects a module with its signature removed. The maintenance service restores stale/missing EFI files. See [validation notes](validation.md) for what has been tested. Remaining validation before upgrading the host: diff --git a/docs/validation.md b/docs/validation.md index 14ed81d..b9807ba 100644 --- a/docs/validation.md +++ b/docs/validation.md @@ -1,109 +1,31 @@ -# Bring-up status +# Validation status -## Signed boot integration, October 18, 2026 +Changes are checked with a local build and, when they affect the running system, a fresh install in the disposable VM described in [VM notes](vm.md). Detailed results for each change are in its pull request. -- Dakota recipes are pinned to merged Secure Boot commit `e59afbe788e441fc1fad560c01fa4dbc267d60d8`. The boot payload independently uses the production `testing` image at revision `95ff6c060392d2c3b05c82d057b1e9e5adf59eb8`, amd64 digest `sha256:4697e6606ae5c23b58e24c2001654af60a614d977d23d37cc9358baa17d103a7`. -- The signed import and full OS image build pass. The import verifies kernel and EFI signatures against Dakota's certificate, requires module signatures and checks kernel security capabilities. No kernel compilation or private signing elements are involved. Bootc container lint reports 13 passed checks and one skipped check. -- Exported and installed OS manifest `sha256:b879cb1bb871fa2e85e585ceb7275ee7296a3c60fe0570f813b43f7e819ba164`, using Linux 7.2.9. All 4,345 modules, the kernel, EFI binaries and certificate match the imported artifact byte for byte. All 426 modules included in our generated initramfs retain their original bytes; the final image contains that same initramfs. Dakota's certificate SHA-256 is `b261aa6adf2702563105b6db8234729e4f7a384a7b5e7f5e32c46c8153b0d7c`. -- Installed onto a disposable 48 GiB disk using a helper VM. Booted through QEMU's Secure Boot capable OVMF firmware with SMM, a persistent software TPM 2.0 and an emulated Intel IOMMU. Ran Dakota's enrollment command, approved its certificate in MokManager, then enabled firmware Secure Boot with Microsoft's UEFI certificates. Dakota's key is in MOK, not the firmware trust database. -- The enforced boot reaches GNOME Initial Setup with no failed services. `bootctl` reports Secure Boot enabled and the current loader under `EFI/dakota`. Dakota's checker reports eight passes and two waits for Epic recognizing the Dakota key. TPM PCRs 9 and 12 are nonzero; lockdown is integrity, kexec is disabled, BPF LSM is active and virtual IOMMU translation is enabled. This is a conventional kernel/initramfs boot, not a measured UKI. -- A signed `dummy` module loads successfully. Removing its signature makes insertion fail with `Key was rejected by service`; the kernel records `Loading of unsigned module is rejected`. -- The enabled maintenance service restores a deliberately stale Dakota EFI bootloader and a missing fwupd shim copy to the image's bytes. The fallback shim also matches. A one-shot direct boot of `EFI/systemd/systemd-bootx64.efi` bypassing shim fails with firmware `Access Denied`, then the normal shim chain boots successfully again. -- The installer completes with exit zero despite the same fs-verity corruption diagnostic recorded during Docker testing. The installed image boots successfully afterward; that diagnostic remains unresolved. GNOME Initial Setup's session also reaches its shutdown timeout on the first normal reboot. -- Dependency-graph resolution, edited YAML/TOML parsing, shell syntax and whitespace checks pass. Evidence and the powered-off VM remain under ignored `build/secureboot`. No host firmware, boot entries, installed OS or disk encryption state was changed. -- OS update/rollback under Secure Boot, actual fwupd capsule execution, hardware TPM/IOMMU state, TPM-encrypted disk unlock and EAC/game acceptance remain untested. [Secure Boot bring-up](secure-boot.md) describes the remaining checks. A VM and Dakota's diagnostic cannot establish Epic's key acceptance. +## Verified in VMs -## Docker image import, October 18, 2026 +- The image builds, passes `bootc container lint`, installs with bootc's composefs backend, Btrfs and systemd-boot, and boots through UEFI into GNOME with no failed services. +- GNOME Initial Setup creates a conventional account. Password login and changes in `/etc`, `/var` and the home directory survive a reboot. +- Secure Boot enrollment, enforced boot, unsigned-module rejection and EFI refresh work. See [Secure Boot bring-up](secure-boot.md). +- NetworkManager and resolved provide networking. Docker with Compose and Buildx works alongside firewalld, as do rootless Podman and Distrobox. +- Libvirt's default network starts with dnsmasq, and a KVM guest boots through libvirt. Tailscale starts and waits for enrollment. +- Flatpak preinstallation installs the default apps and respects removals. Sushi renders previews from Files. +- GNOME Shell extensions install from extensions.gnome.org. +- The compromised eMudhra test hosts fail TLS verification through OpenSSL, GnuTLS and Python, while normal HTTPS works. +- PipeWire and WirePlumber expose the virtual audio device. -- Started from local `main` at `142d756`, independently of the kernel worktree. Reused its shared plugin prerequisite: BuildStream plugins 2.8.0, direct release/commit pins for both plugin junctions, and the same OCI compatibility patch. No kernel recipe or source pins changed. -- BuildStream fetched the Linux amd64 manifest of `docker.io/library/docker:29.9.1-dind` at `sha256:d18cae6d97a9ebf10a017859d3cdf728de0f2efc465364ba0bab6e2c9a87ccdc` and built the Docker element. The full OS image build passed in 2m48s with nine build tasks using the existing cache. All selected Docker files survived the image exclusions with identical bytes and permissions. -- Installed OS manifest `sha256:9b948f219686c98cc18ef3bfda289daedda641047279e64030d7ce691d9eddfd` onto a fresh disposable 48 GiB disk. It booted through UEFI/systemd-boot with Linux 7.2.9 and a read-only composefs root requiring verity. The other checkout and host Docker state were untouched. -- Docker starts with the unchanged systemd service and daemon configuration while firewalld is active. Engine/CLI report 29.9.1, Compose 5.6.0, and Buildx 0.38.0. The daemon reports embedded containerd 2.4.2; there is no standalone containerd binary or process. Runtime helpers remain private under `/usr/libexec/docker`. -- Docker containers passed DNS and outbound HTTPS, custom bridge service-name lookup, `--init`, and HTTP through guest-localhost port 18080. Compose brought up a service, executed a command, and served HTTP on port 18081. Buildx built and loaded an image with an executed `RUN` step; running that image returned the expected output. -- A separate regular user ran rootless Podman using `/usr/bin/crun`, with DNS and outbound HTTPS. Its running container remained usable across `systemctl restart docker`. Both Docker and Compose services recovered their published ports after that restart, and fresh Docker containers still passed DNS and HTTPS. Test workloads were removed afterward. -- Renovate 44.164.4 strict configuration validation passed. Its actual regex extraction, live Docker datasource lookup, and replacement logic preserved the amd64 manifest pin and changed the tag/digest together using `29.9.0-dind` as a test input. The extra live plugin lookup hit GitHub's unauthenticated API rate limit; both plugin commit pins were independently verified against their Git release tags. +## Known issues -Before opening the PR, rebooted the installed disk and reran the corrected full test script end-to-end. It exited with status 0, including an uncached Buildx build, Docker/Compose published ports after daemon restart, and the rootless Podman checks. Docker and firewalld remained active; that boot had no fs-verity corruption messages during the runtime checks. The complete output is retained as `build/docker-import/pr-test-results.log`. +- Installation and later reads of some image objects have logged fs-verity `FILE CORRUPTED` diagnostics, although the data read back matches the image. The cause is unknown. +- The initramfs warns about groups missing from its reduced account database, and tmpfiles warns about symlinked home paths and the read-only root. Neither leaves failed services. +- GNOME Initial Setup's session can reach its shutdown timeout on the first reboot. -Evidence, temporary test scripts, and the powered-off VM are retained under ignored `build/docker-import`. The first test attempts exposed two fixture assumptions, Alpine lacking `httpd` and the OS lacking `runuser`. The successful checks used the official BusyBox image for HTTP and systemd to run Podman as the regular user. No OS packaging adjustment was needed for those fixtures. +## Remaining checks -The installer and a later read of stored image objects logged fs-verity `FILE CORRUPTED` diagnostics. The affected objects map to the unchanged QEMU binary, Rusticl and SVT-AV1 libraries, and kernel `vmlinux`. Reads returned hashes matching the composed image, and the Docker runtime checks passed, but the diagnostics remain unexplained. This was not a clean-log VM run. Existing Docker data migration, a cold CI build, non-amd64 platforms, and an OS update/rollback were not tested. - -## Docker and firewalld, September 20, 2026 - -- Booted the fresh-install disk from `build/kernel-vm` with a disposable QEMU snapshot. Its image digest is `sha256:348f165c7cb4e167e262716410d176e2cd7c9855f1c6a077ea834227aff1b80c`, with Linux 7.2.6 and Docker 29.8.1. No Dakota rebase was involved. -- Docker initially started, but restarting it with firewalld running reproduced `failed to create NAT chain DOCKER: COMMAND_FAILED: INVALID_IPV`. The installed firewalld configuration pointed its IPv4/IPv6 iptables commands at `/bin/false`. -- Applied a prototype path correction to a temporary copy of the configuration and bind-mounted it over the original inside the VM. After restarting firewalld, Docker started and passed another restart. Container DNS, outbound HTTPS and a port published on guest localhost all passed. -- Replaced that prototype with a GNOME recipe patch adding iptables as a build and runtime dependency of firewalld. Its configure step now has the tools available for path discovery; image assembly no longer edits Python files. The patched dependency graph resolves successfully. -- The patched firewalld package built successfully. Its build commands took 6 seconds, BuildStream completed the package job in 8 seconds, and a warm-cache invocation took 14 seconds end to end. The resulting artifact records `/usr/bin/iptables`, `/usr/bin/iptables-restore`, `/usr/bin/ip6tables` and `/usr/bin/ip6tables-restore`. -- Warming the otherwise incomplete local build-dependency cache took about six minutes, dominated by GCC and gRPC artifact downloads. A clean CI runner may see similar network overhead, though some dependencies can overlap the normal full-image graph. A rebuilt-image boot test remains outstanding. -- Evidence is under `build/docker-vm-check`. The test used a runtime bind mount, not a rebuilt image; full image rebuild and boot validation remain outstanding. The original VM disk was unchanged. - -## Dakota kernel switch, September 18, 2026 - -- Selected Dakota testing's regular Linux 7.2.6 kernel through one GNOME junction override. The full graph uses the same kernel for the image, modules and initramfs. Baseline x86_64 and GNOME's zram setup remain selected. -- Pulled kernel artifact `bluefin/core-linux-fdsdk/c2ca442ed88de40fae172d753e9e619c57b23db6a451c1b25a0db19800bb67ca` from Bluefin's cache. It matches the unmodified pinned Dakota project's key; no kernel compilation was needed. -- Full local image build passed in 2m19s with eight build tasks and no failures, using existing local artifacts. This is not a cold CI timing. The exported image at `build/kernel-image` passed bootc lint with 13 checks passed and one skipped. -- Installed the new image into a fresh 48 GiB virtual disk and booted it through UEFI/systemd-boot without a directly supplied kernel. `uname -r` reports `7.2.6`; the graphical target and GDM are active, and no system units failed. Zram is active and the background bootc update timer is enabled. -- VM evidence and its disk are under `build/kernel-vm`. The helper install uses the local test origin `localhost/personal-os:dev`; it does not validate registry updates or the ISO installer. - -## Original baseline validation - -Checked on September 17, 2026, using BuildStream 2.7 in the pinned builder container and a QEMU/KVM VM. - -This section records the image tested then. Helium and VS Code have since been removed; their checks below do not apply to the current image. - -The full baseline x86_64 image builds, installs through bootc and boots through UEFI/systemd-boot into GNOME. Initial setup creates a conventional account, and password login and writable state survive a reboot. This is local VM acceptance, not a published release or hardware certification. - -## Image and build checks - -- `just build`, OCI checkout and `just validate` pass. The exported image is at `build/image`, with the same image loaded into rootless Podman as `localhost/personal-os:dev`. -- Tested manifest: `sha256:902f4478a0050616264ee84372ab02d37e6946765c09ad834a9199422d468c1a`. Its uncompressed layer is about 9.29 GiB. It retains the amd64 platform and `containers.bootc=1` label. -- The image's own `bootc container lint` reports 13 checks passed, one skipped and no warnings in a disposable container with networking disabled and a read-only root. -- Kernel 7.2.2 and its matching initramfs are present. Writable-state symlinks, directory modes, OS identity, an empty image machine ID, service presets, compiled schemas and application MIME/desktop integration were checked. -- Helium, mise and VS Code execute as a non-root user. The native executables and VS Code's Node modules resolve their shared libraries. VS Code uses its official tar archive, with no Debian-package extraction. -- The graph resolves without duplicate-junction or missing-element errors. x86-64-v3 is disabled. The baseline build pulled 506 upstream artifacts; the kernel required a local build because its module-certificate inputs differ from upstream CI. -- Switching Dakota from the original `next` pin to the selected `testing` pin did not change the borrowed recipes or resolved artifact keys. -- Shell syntax, YAML, bootc TOML, Docker JSON, desktop files, local systemd units and GSettings overrides were checked. The complete image is rebuilt after recipe changes. - -## VM checks that passed - -- Installed from the exported OCI directory onto a fresh 48 GiB virtual disk using bootc's composefs backend, Btrfs and systemd-boot. The installer reported completion. -- Booted the installed disk through UEFI without a directly supplied kernel or helper root. `bootc status` reports the expected manifest, composefs deployment and systemd bootloader, with missing verity disallowed. -- Reached GNOME initial setup, created the `tester` administrator account without homed, entered a Wayland desktop, rebooted and logged in with its password. -- The root is a read-only composefs overlay. `/etc` and `/var` are writable Btrfs state. Test files in `/etc`, `/var` and the user's home, the machine ID and Helium/VS Code profile directories survived reboot. -- No failed system or user services remained after reboot and login. Homed and automatic bootc apply/reboot updates remain disabled. -- NetworkManager obtains network configuration, resolved works, and guest/container DNS and HTTPS requests succeed. -- Helium displays an HTTPS page. VS Code opens from GNOME and its integrated Bash terminal creates a file that survives reboot. Neither application needs a `--no-sandbox` launch option. -- Ghostty opens with its bundled resources and shell integration. Files, Disks and Settings open successfully. -- Files generates a PDF thumbnail. Pressing space opens that PDF through the Sushi Flatpak and renders its contents. -- Flatpak preinstallation installs Bazaar, Mission Center and Sushi. Bazaar loads the Flathub catalog and Mission Center opens. Uninstalling Mission Center and rerunning `flatpak preinstall` leaves it removed; it was then manually reinstalled for the retained test VM. -- Docker starts and runs a container with working DNS and HTTPS. Rootless Podman runs a separate container with working DNS and HTTPS under the account created by initial setup. Its subordinate UID/GID ranges are present. -- Distrobox creates and enters an Alpine container as the regular user using Podman. -- Tailscale starts and reports that it is logged out, as expected before enrollment. Libvirt socket activation works and `virsh -c qemu:///system list --all` succeeds. `/dev/kvm` is available in the guest. -- PipeWire and WirePlumber expose the virtual audio card, sink and source. - -Screenshots and logs are retained locally under the ignored `build/vm` directory. See [VM notes](vm.md) for opening the disk and the installation method. - -The PDF thumbnail check above predates removal of the thumbnailer dependency. Sushi remains installed for spacebar previews, but the current image does not provide PDF thumbnails. - -## Fixes discovered during validation - -- The Ghostty/ncurses terminfo overlap is handled by a local filter that permits only the bundled Ghostty terminfo replacement. Other overlaps remain fatal. -- `systemd-homed-firstboot.service` needed its own disable preset because its `Also=` setting could otherwise re-enable homed. -- The pinned OCI builder copied and hashed its tar before closing it. Podman accepted the resulting archive, but bootc's composefs importer failed at the final entry with `Unexpected EOF in splitstream`. The local packaging command closes the tar before upstream hashes and copies it. Installation then succeeds. -- The OCI root lacked `/sys`, which prevented systemd from switching out of the initramfs. Image assembly now explicitly creates `/dev`, `/proc` and `/sys`; a fresh installation then boots successfully. - -The boot journal still has upstream initramfs warnings about groups absent from its reduced account database and tmpfiles messages about symlinked home paths and the read-only root. The corresponding accounts exist in the real root, and these messages do not leave failed services. They remain cleanup work rather than unreported clean-log checks. - -## Remaining acceptance work - -The first standard-runner CI build passed on September 18, 2026 and published the original kernel baseline to GHCR. It took 2h03m, pulling 695 artifacts and building 20; Linux 7.2.2 compilation took 77 minutes. The workflow uses upstream caches without preserving local artifacts between runs. The signed OCI kernel import has passed local build and VM checks; its first CI build will run after merge. - -- Publish successive images and verify fetching, staging, rebooting into an update and rolling back. The current `localhost/personal-os:dev` origin is a placeholder, and automatic apply/reboot remains disabled. -- Adapt an end-user installer and test its account provisioning, origin selection and offline media. The temporary VM installer is not a distributable installer. -- Test accelerated graphics and real audio output, hardware support, Secure Boot enrollment on physical hardware and an actual libvirt guest. This run used software graphics and a discarded audio backend. -- Test Tailscale enrollment, browser credential storage and login callbacks, and application data across an OS update. -- Test Flatpak retries after a fresh offline boot, changes to preinstall declarations across an OS update, and Sushi previews on removable drives and network mounts. - -These checks were not inferred from successful builds or VM startup. +- Publish successive images and verify fetching, staging, rebooting into an update and rolling back, including with Secure Boot enabled. +- Install through the installer ISO, including account creation, update origin and offline media. See [installer releases](installer-plan.md). +- Test accelerated graphics, audible output, physical hardware, firmware capsule updates, TPM disk unlock and EAC. See [Secure Boot bring-up](secure-boot.md). +- Test Tailscale enrollment, a full libvirt guest installation, browser credential storage and application data across an OS update. +- Test Bazaar Companion's menu actions and Gradia Capture's screenshot annotations. +- Test Flatpak retries after an offline first boot, preinstall changes across an OS update, and Sushi previews on removable drives and network mounts. +- Measure Chunkah's layer reuse and CI cost, and boot and upgrade a chunked image.