diff --git a/Justfile b/Justfile index 7b9524fb1..5bcebad84 100644 --- a/Justfile +++ b/Justfile @@ -35,7 +35,11 @@ check *ARGS: bash mseries/validate.sh {{ARGS}} genkey: - just mkosi genkey + # Like `mkosi genkey`, but with a fixed-length serial so every build's verity signature is the same size. + # A random serial is a byte shorter 1 in 256 times, and a shorter signature written over a longer one + # by an installed system's sysupdate leaves the old tail behind and breaks boot. + OPENSSL_CONF=/dev/null openssl req -new -x509 -newkey rsa:2048 -keyout mkosi.key -out mkosi.crt \ + -days 730 -subj "/CN=mkosi of root/" -nodes -set_serial "0x40$(openssl rand -hex 19)" mkosi +subcommand: mkdir -p {{env_var('HOME')}}/.cache/mkosi-workspace diff --git a/README.md b/README.md index ed3f643e1..5c6c99a61 100644 --- a/README.md +++ b/README.md @@ -478,7 +478,7 @@ The rest of this page is the upstream elementary OS build documentation.

elementary OS

-

Build scripts for image creation

+

Mkosi configurations for building elementary OS images



@@ -490,7 +490,7 @@ The rest of this page is the upstream elementary OS build documentation. --- -## Building, Testing, and Installation +## Building locally You'll need the following runtime dependencies: * podman @@ -504,32 +504,12 @@ Generate keys and then build with `just` just genkey just do-daily ``` -Create install media with [Fedora Media Writer](https://flathub.org/en/apps/org.fedoraproject.MediaWriter) or [Impression](flathub.org/en/apps/io.gitlab.adhami3310.Impression), or boot with GNOME Boxes (>=51). +This will result in a bootable .iso.
+Test it out in a VM, or create an [USB install drive](https://elementary.io/docs/installation#installation) (>= 8GB) -### Installation (sysupdate) -Once in the liveiso, inside the terminal or a tty, run: +## Further Information -```bash -sudo elementary-install -``` -You will be prompted with installation options. - -### Installation (classic) - -To install classic mode, follow the steps in the GUI installer from the liveiso. - -## Operations - -### Upgrades - -`updatectl update` - -Append the exact version ID at the end to upgrade to a specific version, or downgrade. +To get started with elementary OS, begin by [learning the basics](https://elementary.io/docs/learning-the-basics#learning-the-basics). -## Minimum specs -- UEFI with secure boot disabled -- 8 GB of USB flash drive -- GNOME Boxes >=51 (for VM only) -- 55 GB of destination disk -- 4 GB of system memory (RAM) +For contributors, administrators and OEMs, check out the [wiki](https://github.com/elementary/os/wiki) for in-depth information. diff --git a/mkosi.conf.d/ppa.daily.conf b/mkosi.conf.d/ppa.daily.conf index cd8ca2327..565ac50cf 100644 --- a/mkosi.conf.d/ppa.daily.conf +++ b/mkosi.conf.d/ppa.daily.conf @@ -6,3 +6,6 @@ Profiles=|proposed SandboxTrees= %D/repos/daily %D/repos/common-files +ToolsTreeSandboxTrees= + %D/repos/daily + %D/repos/common-files diff --git a/mkosi.conf.d/ppa.stable.conf b/mkosi.conf.d/ppa.stable.conf index ceae510cd..3064ac72a 100644 --- a/mkosi.conf.d/ppa.stable.conf +++ b/mkosi.conf.d/ppa.stable.conf @@ -5,3 +5,6 @@ Profiles=stable SandboxTrees= %D/repos/stable %D/repos/common-files +ToolsTreeSandboxTrees= + %D/repos/stable + %D/repos/common-files diff --git a/mkosi.images/base/mkosi.conf.d/core.conf b/mkosi.images/base/mkosi.conf.d/core.conf index cfb28e7b4..7797cbdf5 100644 --- a/mkosi.images/base/mkosi.conf.d/core.conf +++ b/mkosi.images/base/mkosi.conf.d/core.conf @@ -25,6 +25,7 @@ Packages= network-manager pipewire-audio plymouth + kmscon sudo-rs systemd-boot systemd-coredump diff --git a/mkosi.images/base/mkosi.conf.d/elementary.conf b/mkosi.images/base/mkosi.conf.d/elementary.conf index 65f7a2a15..f348e67ab 100644 --- a/mkosi.images/base/mkosi.conf.d/elementary.conf +++ b/mkosi.images/base/mkosi.conf.d/elementary.conf @@ -3,6 +3,8 @@ Distribution=ubuntu [Content] WithRecommends=yes +RemovePackages= + ubuntu-release-upgrader-core Packages= elementary-desktop elementary-minimal diff --git a/mkosi.images/base/mkosi.extra/usr/lib/systemd/system/systemd-sysext.service.d/10_run_sysusers.conf b/mkosi.images/base/mkosi.extra/usr/lib/systemd/system/systemd-sysext.service.d/10_run_sysusers.conf new file mode 100644 index 000000000..4530a5c12 --- /dev/null +++ b/mkosi.images/base/mkosi.extra/usr/lib/systemd/system/systemd-sysext.service.d/10_run_sysusers.conf @@ -0,0 +1,5 @@ +# systemd-sysusers.service runs before local file systems are mounted, so it never +# gets sysusers.d files shipped in extensions. Run it again once they are merged. +[Service] +ExecStartPost=systemd-sysusers +ExecReload=systemd-sysusers diff --git a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-nsswitch.conf b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-nsswitch.conf new file mode 100644 index 000000000..6631c41fc --- /dev/null +++ b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-nsswitch.conf @@ -0,0 +1,2 @@ +# Override debian.conf to symlink instead of copy to get updates when they appear upstream. +L /etc/nsswitch.conf diff --git a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-var-run.conf b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-var-run.conf new file mode 100644 index 000000000..36039b9be --- /dev/null +++ b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-var-run.conf @@ -0,0 +1,2 @@ +# Sorts before systemd's var.conf, so this L+ replaces a /var/run directory instead of its plain L. +L+ /var/run - - - - ../run diff --git a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/98-anacron.conf b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/98-anacron.conf new file mode 100644 index 000000000..850bd534c --- /dev/null +++ b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/98-anacron.conf @@ -0,0 +1 @@ +d /var/spool/anacron 0755 root root - diff --git a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf index 63d58cdd9..65ced2445 100644 --- a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf +++ b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf @@ -29,7 +29,6 @@ L /etc/ld.so.conf L /etc/ld.so.conf.d # Contains the default systemd locale L /etc/locale.conf -L /etc/nsswitch.conf # ID C /etc/passwd @@ -77,7 +76,7 @@ C /etc/sensors3.conf C /etc/usb_modeswitch.conf C /etc/thermald L /etc/fwupd -L? /etc/cups +C /etc/cups # Package Management & Updates C /etc/apt diff --git a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/var.conf b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/mseries-var.conf similarity index 62% rename from mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/var.conf rename to mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/mseries-var.conf index 741dd6be4..3e15bfca2 100644 --- a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/var.conf +++ b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/mseries-var.conf @@ -1,2 +1 @@ -d /var/spool/anacron 0755 root root - - d /run/speech-dispatcher 0755 speech-dispatcher speech-dispatcher - - diff --git a/mkosi.images/ext-virt/mkosi.conf b/mkosi.images/ext-virt/mkosi.conf index 1d1cd75fa..582bb5fe5 100644 --- a/mkosi.images/ext-virt/mkosi.conf +++ b/mkosi.images/ext-virt/mkosi.conf @@ -11,11 +11,25 @@ CompressOutput=zstd [Content] Bootable=no BaseTrees=%O/base_%v +WithRecommends=yes +RemovePackages= + virt-manager Packages= + qemu-system-gui qemu-system-x86 qemu-system-arm + qemu-system-riscv + qemu-system-modules-opengl + qemu-system-modules-spice + qemu-system-misc + qemu-utils libvirt-daemon-system libvirt-clients - virt-manager + libspice-server1 + libvirglrenderer1 + virgl-server + spice-html5 bridge-utils + ovmf + qemu-efi-aarch64 virtinst diff --git a/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/libvirt-guests.service.d/10_libvirtd.conf b/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/libvirt-guests.service.d/10_libvirtd.conf new file mode 100644 index 000000000..2419c4694 --- /dev/null +++ b/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/libvirt-guests.service.d/10_libvirtd.conf @@ -0,0 +1,6 @@ +# Start libvirtd once at boot so autostart networks and guests come up. Upholding +# libvirtd.service directly would restart it whenever it exits idle. After= also +# shuts guests down before libvirtd stops. +[Unit] +Wants=libvirtd.service +After=libvirtd.service diff --git a/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/multi-user.target.d/10_libvirtd.conf b/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/multi-user.target.d/10_libvirtd.conf new file mode 100644 index 000000000..1e2fd4595 --- /dev/null +++ b/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/multi-user.target.d/10_libvirtd.conf @@ -0,0 +1,4 @@ +# Extensions are merged after the boot transaction is built, so a .wants symlink +# never starts these. Upholds= is re-checked after the service manager reloads. +[Unit] +Upholds=libvirtd.socket libvirtd-ro.socket libvirtd-admin.socket libvirt-guests.service diff --git a/mkosi.images/ext-virt/mkosi.extra/usr/lib/sysusers.d/libvirt-dnsmasq.conf b/mkosi.images/ext-virt/mkosi.extra/usr/lib/sysusers.d/libvirt-dnsmasq.conf new file mode 100644 index 000000000..4f40a4b18 --- /dev/null +++ b/mkosi.images/ext-virt/mkosi.extra/usr/lib/sysusers.d/libvirt-dnsmasq.conf @@ -0,0 +1,4 @@ +# Ubuntu creates this user in libvirt-daemon-config-network's postinst rather than +# sysusers.d, and maintainer scripts don't run for extensions. +# Type Name ID GECOS Home directory +u libvirt-dnsmasq - "Libvirt Dnsmasq" /var/lib/libvirt/dnsmasq diff --git a/mkosi.images/ext-virt/mkosi.extra/usr/lib/tmpfiles.d/libvirt.conf b/mkosi.images/ext-virt/mkosi.extra/usr/lib/tmpfiles.d/libvirt.conf new file mode 100644 index 000000000..c54b61888 --- /dev/null +++ b/mkosi.images/ext-virt/mkosi.extra/usr/lib/tmpfiles.d/libvirt.conf @@ -0,0 +1,9 @@ +# Type Path Mode User Group Age Argument +d /var/lib/libvirt/images 0711 root root - - +d /var/lib/libvirt/qemu 0750 libvirt-qemu kvm - - +d /var/cache/libvirt/qemu 0750 libvirt-qemu kvm - - +d /var/log/libvirt/qemu 0750 root libvirt-qemu - - +d /etc/mdevctl.d/ 0750 root root - - +# Enable default NAT network +C /etc/libvirt/qemu/networks/default.xml - - - - /usr/share/libvirt/networks/default.xml +L /etc/libvirt/qemu/networks/autostart/default.xml - - - - /etc/libvirt/qemu/networks/default.xml diff --git a/mkosi.images/ext-virt/mkosi.finalize b/mkosi.images/ext-virt/mkosi.finalize new file mode 100755 index 000000000..5e6e13789 --- /dev/null +++ b/mkosi.images/ext-virt/mkosi.finalize @@ -0,0 +1,15 @@ +#!/usr/bin/env bash +set -euo pipefail + +# Reload the service manager once this extension is merged so the units it ships +# get loaded. mkosi names the file after the image version, hence the glob. +release=("$BUILDROOT"/usr/lib/extension-release.d/extension-release.*) +if [[ ${#release[@]} -ne 1 || ! -f ${release[0]} ]]; then + echo "Expected one extension-release file, found: ${release[*]}" >&2 + exit 1 +fi +echo "EXTENSION_RELOAD_MANAGER=1" >> "${release[0]}" + +# mkosi removes empty directories from extensions, but mdevctl won't run without +# its callout and notifier directories. +mkdir -p "$BUILDROOT"/usr/lib/mdevctl/scripts.d/{callouts,notifiers} diff --git a/mkosi.images/ext-virt/mkosi.postinst.chroot b/mkosi.images/ext-virt/mkosi.postinst.chroot deleted file mode 100755 index b80be8d33..000000000 --- a/mkosi.images/ext-virt/mkosi.postinst.chroot +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/bash -set -xeuo pipefail - -glib-compile-schemas /usr/share/glib-2.0/schemas/ diff --git a/mkosi.images/liveiso/mkosi.conf b/mkosi.images/liveiso/mkosi.conf index d009e36b8..1df16a056 100644 --- a/mkosi.images/liveiso/mkosi.conf +++ b/mkosi.images/liveiso/mkosi.conf @@ -27,16 +27,26 @@ Packages= Bootloader=grub KernelInitrdModules= default - ahci - nvme - xhci_pci - usb_storage - uas - sd_mod - sr_mod - isofs - loop - ext4 + /drivers/hid/ + /drivers/usb/ + /drivers/input/ + /drivers/i2c/ + /drivers/spi/ + /drivers/pinctrl/ + /drivers/mfd/intel-lpss* # I2C/SPI controllers for laptop keyboards + /drivers/platform/surface/ + /drivers/platform/chrome/ + /drivers/tty/serial/8250/8250_dw # Surface keyboards via SAM + /drivers/ata/ + /drivers/nvme/ + /drivers/scsi/ + /drivers/message/fusion/ + /drivers/block/ + /drivers/mmc/ + /drivers/ufs/ + /drivers/firewire/ + /fs/isofs/ + /fs/overlayfs/ KernelCommandLine= rw console=ttyS0 diff --git a/mkosi.images/sysupdate/mkosi.conf b/mkosi.images/sysupdate/mkosi.conf index e4faab5f5..bd5e2ae2c 100644 --- a/mkosi.images/sysupdate/mkosi.conf +++ b/mkosi.images/sysupdate/mkosi.conf @@ -22,17 +22,29 @@ Bootable=yes BaseTrees=%O/base_%v ExtraTrees=%O/modules-db_%a-%v Output=elementary_%v -CleanPackageMetadata=yes +# mkosi.finalize.chroot needs the package database. /var isn't shipped in this image. +CleanPackageMetadata=no Bootloader=systemd-boot KernelInitrdModules= default - ahci - nvme - xhci_pci - usb_storage - uas - sd_mod - dm-verity + /drivers/hid/ + /drivers/usb/ + /drivers/input/ + /drivers/i2c/ + /drivers/spi/ + /drivers/pinctrl/ + /drivers/mfd/intel-lpss* # I2C/SPI controllers for laptop keyboards + /drivers/platform/surface/ + /drivers/platform/chrome/ + /drivers/tty/serial/8250/8250_dw # Surface keyboards via SAM + /drivers/ata/ + /drivers/nvme/ + /drivers/scsi/ + /drivers/message/fusion/ + /drivers/block/ + /drivers/mmc/ + /drivers/ufs/ + /drivers/firewire/ KernelCommandLine= splash quiet diff --git a/mkosi.images/sysupdate/mkosi.finalize.chroot b/mkosi.images/sysupdate/mkosi.finalize.chroot new file mode 100755 index 000000000..932a7b539 --- /dev/null +++ b/mkosi.images/sysupdate/mkosi.finalize.chroot @@ -0,0 +1,7 @@ +#!/bin/bash +set -xeuo pipefail + +# Keep a backup of the package database so it can be restored at runtime if needed. +# This runs after RemovePackages= so the database matches what's in the image. +mkdir -p /usr/share/factory/dpkg/ +tar -czf /usr/share/factory/dpkg/dpkg.tar.gz -C / var/lib/dpkg diff --git a/mkosi.images/sysupdate/mkosi.repart/20-usr-verify-sig-bside.conf b/mkosi.images/sysupdate/mkosi.repart/20-usr-verify-sig-bside.conf index 318fec069..6f08c9e29 100644 --- a/mkosi.images/sysupdate/mkosi.repart/20-usr-verify-sig-bside.conf +++ b/mkosi.images/sysupdate/mkosi.repart/20-usr-verify-sig-bside.conf @@ -1,3 +1,4 @@ [Partition] Type=usr-verity-sig Label=_empty +SplitName=- diff --git a/mseries/OS9-HANDOFF.md b/mseries/OS9-HANDOFF.md index 743fbbc12..50f25c88d 100644 --- a/mseries/OS9-HANDOFF.md +++ b/mseries/OS9-HANDOFF.md @@ -1,3 +1,7 @@ +## elementary/os upstream sync and repo housekeeping — 2026-10-31 + +Merged `elementary/os` `main` into `dev` up to `23d5b98b10` (13 commits since the 2026-10-12 sync): kmscon by default, `/var/run` and dpkg-database fixes, virt extension update, driver-directory initrd modules, release-upgrader removal. Conflicts: kept our `sysusers.d/00-session.conf`; took upstream's deletion of `tmpfiles.d/var.conf` and moved our `/run/speech-dispatcher` line to `tmpfiles.d/mseries-var.conf`. Pins updated in `UPSTREAM-PINS.md`; details in `upstream-audits/daily/2026-10-31.md`. Verified: merge resolves cleanly; checks are the PR CI run (local `validate.sh` needs bash 4+, not on this Mac). Image build: `daily-9.0` run 41226284220 on merge commit `96ce379f` built `elementaryos-9.0-daily-arm64.20261031174950.iso` (8.0 GB, kmscon 9.3.2-1 installed) and `test-image-wiring.py` passed ("Built live ISO hardware payload check passed"). Not verified: kmscon on the console or any boot on the j314s. Found the upstream watch dashboard failing since 2026-10-28 (issue body over 65,536 characters with 510 sources); fixed separately. Next: CodexBar v0.78.0 -> v0.83.0 port bump; audit the omarchy-mac-pkgs DSP-microphone and initramfs backlight candidates. + ## Warren local AI and eGPU updates — 2026-10-30 Installed `mseries-nvidia-open-source` `595.112.07+apple.1-1` (SHA-256 `a397b68a...b209ab23`) containing the three prepared NVIDIA fixes and license at `/usr/src/mseries-nvidia-open-595.112.07`. This is source only; no NVIDIA module or matching CUDA userspace is installed. The [source package script](nvidia-egpu/package-source.sh) verifies the exact prepared diff before packaging. diff --git a/mseries/UPSTREAM-PINS.md b/mseries/UPSTREAM-PINS.md index c214d27fa..46d6c18cf 100644 --- a/mseries/UPSTREAM-PINS.md +++ b/mseries/UPSTREAM-PINS.md @@ -24,6 +24,16 @@ The fetched `elementary/os` `main` reference on 2026-10-13 was `7024fd04646a6a8565bf6805989b59fd72de928c`. This is the comparison point for the OS 9 source audit; recheck the upstream branch before the next port. +On 2026-10-31 `dev` merged `elementary/os` `main` up to +`23d5b98b101e8e1d72cced853f46205c784aefd9` ("Use drivers directories instead +of manual entries (#935)", 2026-10-25): 13 commits, including kmscon by +default (#917), the `/var/run` and dpkg-database fixes (#925, #931, #933), the +virt extension update (#920) and driver-directory initrd modules (#921, #935). +Upstream deleted `tmpfiles.d/var.conf` so it no longer shadows systemd's file; +our `/run/speech-dispatcher` entry moved to `tmpfiles.d/mseries-var.conf`. Our +`sysusers.d/00-session.conf` keeps its M-series form (dbus.conf owns +messagebus). See `mseries/upstream-audits/daily/2026-10-31.md`. + ## Wingpanel network speed readout The Apple Silicon image builds `elementary/panel-network` at diff --git a/mseries/upstream-audits/daily/2026-10-31.md b/mseries/upstream-audits/daily/2026-10-31.md new file mode 100644 index 000000000..04965d6e5 --- /dev/null +++ b/mseries/upstream-audits/daily/2026-10-31.md @@ -0,0 +1,105 @@ +# Daily upstream audit — 2026-10-31 + +Previous report: `2026-10-19.md` (12 days; the scheduled audit did not run in between). +Scoped pass: elementary/os was **merged** in this change; the other sources below were +compared read-only. Nothing was built, booted, installed or restarted. "Works" claims are +upstream's and unverified on this j314s. + +## Summary +- **elementary/os `main` merged into `dev`** up to `23d5b98b10` (#935, 2026-10-25): 13 commits. + Two conflicts with our `ccca0b23` ("Fix OS 9 build log configuration issues"), resolved as below. + arm64 ISO builds from the merge (`daily-9.0` run 41226284220) and passes the image wiring check; not booted. +- **Upstream watch dashboard (issue #51) has been failing since 2026-10-28**: 510 tracked sources + pushed the issue body past GitHub's 65,536-character limit, so 23 of the last 30 scheduled runs + failed and no new upstream changes were recorded. Fixed in a separate PR (digests stored as + 12-character prefixes; the real dashboard shrinks from 62.9k to 38.9k characters). +- omacom/omarchy-mac-pkgs moved 110 commits past the 2026-10-13 pin (Touch ID, DSP microphone + recovery, keyboard backlight at the passphrase prompt, EFI variable save, M3 Air display). +- CodexBar **v0.83.0** released today; our port is pinned at v0.78.0 (five releases behind). +- Aurora: still no tagged release after `aurora-2026.10.17.20` (our pin); `integration/aurora` + head is `23827fe87f` (2026-10-30). + +## elementary/os merge (7024fd0464 -> 23d5b98b10) +| Commit | Change | Effect on M-series | +|---|---|---| +| a6b2376ae8 #917 | `kmscon` added to base packages | New text console. No conflicting getty/console config in our tree; initramfs keymap/font snippets untouched. **Unverified on hardware.** | +| 2781176873 #919 | `RemovePackages=ubuntu-release-upgrader-core` | Accepted. | +| a137fa4adb #926 | `SplitName=-` on the B-side usr-verity-sig partition | Accepted. | +| 35c8b0b016 #928 | `just genkey` uses OpenSSL with a fixed-length serial | Accepted; our Justfile wrapper lines unchanged. | +| 44d9ea9be0 #929 | `ToolsTreeSandboxTrees=` for daily/stable PPA | Accepted. | +| 236a0d95e5 #925, 7511d1e298 #930, 88ea0f0af9 #933 | `/var/run` symlink via `00-var-run.conf`; stop shadowing systemd's `var.conf`; copy, don't link | **Conflict**: upstream deleted `tmpfiles.d/var.conf`; we had edited it. Took the deletion; our `/run/speech-dispatcher` directory moved to `tmpfiles.d/mseries-var.conf` (name no longer shadows systemd's file). `/var/spool/anacron` is now upstream's `98-anacron.conf`. | +| f71b02fccb #931 | Keep dpkg database: `CleanPackageMetadata=no` + factory `dpkg.tar.gz` | Accepted. | +| a595cc5c59 #920 | virt extension rework (libvirt sysusers/tmpfiles/finalize) | Accepted; we do not modify `ext-virt`. | +| b70ca9a352 #921, 23d5b98b10 #935 | Initrd modules by driver directory (`/drivers/hid/`, `/drivers/nvme/`, `/drivers/spi/` …) | Accepted for liveiso and sysupdate. Our arm64 drop-in `sysupdate/mkosi.conf.d/arch.arm64.conf` still lists the old names plus `hid_apple`, `hid_magicmouse`, `dm-verity`; mkosi appends lists, so these are now redundant but harmless. Left unchanged to avoid touching the arm64 build without a CI image run. | +| 4f796104d3 #927 | README wording | Auto-merged into the upstream section of our README. | +| — | `sysusers.d/00-session.conf` | **Conflict**: both sides moved speech-dispatcher's home to `/run`; kept ours, which also drops the duplicate messagebus lines (`dbus.conf` owns them). | + +## Other sources (old -> new) +| Source | Old (last seen) | New head | Note | +|---|---|---|---| +| omacom/omarchy-mac-pkgs main (MIT) | 1e4c6e2b08 (10-19 audit) | 061be4d6ac (10-30) | see candidates | +| omacom/omarchy-mac quattro | ba546a61f8 | ba546a61f8 | unchanged | +| elementary/panel-network main | 8685ec8e55 (build pin) | 8685ec8e55 | unchanged | +| steipete/CodexBar | v0.78.0 (port pin) | v0.83.0 (10-31) | port bump due; follow `mseries/CODEXBAR-PORT.md` | +| omacom/linux-aurora releases | aurora-2026.10.17.20 | aurora-2026.10.17.20 | no new tag | +| aurora-silicon/linux integration/aurora | 44d5afc79d (7.2.10) | 23827fe87f (10-30) | not diffed | + +## Candidates (omarchy-mac-pkgs, translate to Ubuntu/mkosi; do not copy Arch mechanics) +1. **DSP microphone MONO port recovery** (`27cff08f`, `7f5e4dc2`, `c19d2932`, `12ae21fd`): **SKIP** (follow-up + pass, same day). The AUX0→MONO rename only affects `omarchy-audio-asahi-mic-map`, which PORT-MAP records as + deliberately not ported (Quickshell-specific). The "mic missing until WirePlumber restarts after an update" case + is covered for our install path: `install-audio-stack.sh` restarts the audio services. +2. **Keyboard backlight at the passphrase prompt** (`a0fa1a8b`) and **PMP driver before unlock** (`7ae91471`): + **PORTED** (follow-up pass) into `mseries/boot/initramfs-hardware.snippet` plus a udev rule, PR #714. Matters on + kernels that build `apple_pmp`/`pwm_apple` as modules; fairydust builds both in. Not verified on hardware. +3. **Touch ID series** (Oct 18–25, released in omarchy-mac 0.2.1): SEP driver options, fprintd + drop-in, stop fprintd before sleep, owner consent before enabling. j314s has Touch ID. + Upstream itself keeps it out of the manual until a stock boot enrols. Verdict: **WATCH**. +4. **EFI variable save to U-Boot's file at shutdown** (`ffe75454`): boot chain; we use the Ubuntu + Asahi PPA U-Boot. Verdict: **WATCH** (no bootloader change from an audit). +5. M3 Air display/GPU, Neo sensor key, Limine keying, mpv defaults: **SKIP** (other hardware or + Omarchy-only). + +## Not checked +Full source list from `UPSTREAM-DAILY-AUDIT-PROMPT.md` was not walked: Aurora tree diff, m1n1, +u-boot, AsahiLinux repos, Pantheon components, Mesa/PipeWire/BlueZ, news sites, CVE feeds. The +dashboard (once green again) covers head movement for the 510 tracked sources. + +## Dashboard triage (issue #51, evening pass) +The watcher ran green again at 21:36 UTC and lists 255 unacknowledged changes across 593 tracked sources +(198 discovered branches, 23 repo heads, 18 branch-list hashes, 14 PR lists, 2 people). Filtered for the j314s +(t600x) and the dock goal; everything else is other hardware, ML engines or messaging (deferred). + +**Act on (AUDIT-DEEPER):** +1. **AsahiLinux/linux `fairydust` was rebased** (`ce9f2eba72` -> `ad2ca9b65c`, 2026-10-30; diverged, so the pin + in `daily-9.0.yml` and `fairydust/debian/README.md` no longer matches any branch commit). The new + `t600x-j314-j316.dtsi` adds native USB4 nodes (ACIO/NHI aliases, Type-C -> USB4 TBT endpoints), DCPEXT + Type-C routing behind `ENABLE_DCPEXT_TYPEC`, and **DP-altmode on the front-left port of j314/j316** + (`b8b2015b04`, Janne Grunau), with tipd HPD tracking/OOB hotplug HACKs (`05ad4c59cc`, `5b93151cb2`) and + `ps_atc1_common` forced always-on (`a3213235ef`, "works around missing suspend/resume handling in ATC phy"). + This may supersede parts of our `fairydust/usb4/0001-usb4-thunderbolt-apple-m1pro-on-fairydust.patch`. + Next: diff our patch against the new tree before any re-pin; the always-on domain likely costs idle power and + affects suspend. Dock picture already works on Aurora .20, so this is the fairydust lane only. No pin change made. + The pinned commit is no longer on any branch, so GitHub may eventually garbage-collect it. Its tarball + (sha256 `20ce358a…7f34aa`, matching `kernel-manifest.json`) is now attached to + `techmore/ElementaryOS_MSeries-Kernel` release `kernel-2026.10.27.1` with `SOURCE-SHA256SUMS`, preserving + the corresponding source for the shipped kernel. Builds still download from codeload; add that asset as a + fallback if codeload stops serving the commit. +2. **omacom/linux-aurora #311 merged** (brcmfmac passes the country code; touches `t600x-j314-j316.dtsi`). + Arrives with the next Aurora release; relevant to j314s Wi-Fi regulatory behaviour. WATCH. + +**Watch:** +- `omacom/linux-aurora:diag/j314s-cpu-context-return` (Oct 21): opt-in j314s CPU deep-idle tracing experiment, + not a fix. Relevant to the open suspend item. +- `ludagoo/linux-aurora`: `fix/fpwm1-s2idle-restore` (J313/t8103 report; pmdomain change may apply to t600x + keyboard PWM, unverified), `fix/bcm4378-sleep-roam` (BCM4378 pktid reclaim; j314s Wi-Fi chip not confirmed here). +- `aurora-silicon/linux:fix/m1m2-typec-usb4-router` is now absent (deleted or merged); check where it went. +- zackb/tether v0.3.2 (pin 0.2.38; optional add-on still blocked on BlueZ >= 5.86). +- omacom/omarchy-mac-pkgs moved again to `ea0097a523` after this audit's `061be4d6` pass. +- elementary/os `2993aef6` "Try 64mb" (#936) touches only upstream's release workflow, which is gated off in + this fork; take it at the next sync. + +**Skip:** M3/M4/Neo/j6xx branches, MLX/ANE/TensorFold/transcribe engines (tracked by the local-AI ledger), +BlueBubbles/passwords/Locals (messaging deferred), RepoBar (our port is a reimplementation, not a pinned binary). + +Recommendation: issue #51 can be closed after reading this section; closing acknowledges all 255.