From a6b2376ae87749fbe6b8a71575d6b28aef532407 Mon Sep 17 00:00:00 2001 From: JumpyVi <62212220+jumpyvi@users.noreply.github.com> Date: Wed, 14 Oct 2026 11:31:21 -0400 Subject: [PATCH 01/17] Switch to kmscon by default (#917) * Switch to kmscon on sysupdate * Use kmscon for everyone --- mkosi.images/base/mkosi.conf.d/core.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/mkosi.images/base/mkosi.conf.d/core.conf b/mkosi.images/base/mkosi.conf.d/core.conf index cfb28e7b4..7797cbdf5 100644 --- a/mkosi.images/base/mkosi.conf.d/core.conf +++ b/mkosi.images/base/mkosi.conf.d/core.conf @@ -25,6 +25,7 @@ Packages= network-manager pipewire-audio plymouth + kmscon sudo-rs systemd-boot systemd-coredump From a137fa4adbfad530a11bc69d1f422accc1463cdd Mon Sep 17 00:00:00 2001 From: Lewis Goddard Date: Thu, 22 Oct 2026 23:56:49 +0100 Subject: [PATCH 02/17] Add SplitName option to usr-verity-sig partition (#926) --- mkosi.images/sysupdate/mkosi.repart/20-usr-verify-sig-bside.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/mkosi.images/sysupdate/mkosi.repart/20-usr-verify-sig-bside.conf b/mkosi.images/sysupdate/mkosi.repart/20-usr-verify-sig-bside.conf index 318fec069..6f08c9e29 100644 --- a/mkosi.images/sysupdate/mkosi.repart/20-usr-verify-sig-bside.conf +++ b/mkosi.images/sysupdate/mkosi.repart/20-usr-verify-sig-bside.conf @@ -1,3 +1,4 @@ [Partition] Type=usr-verity-sig Label=_empty +SplitName=- From 2781176873fe98fc358045dcf073751ea4c58f33 Mon Sep 17 00:00:00 2001 From: JumpyVi <62212220+jumpyvi@users.noreply.github.com> Date: Thu, 22 Oct 2026 19:24:08 -0400 Subject: [PATCH 03/17] Remove cannonical release-upgrader-core (#919) --- mkosi.images/base/mkosi.conf.d/elementary.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mkosi.images/base/mkosi.conf.d/elementary.conf b/mkosi.images/base/mkosi.conf.d/elementary.conf index 65f7a2a15..f348e67ab 100644 --- a/mkosi.images/base/mkosi.conf.d/elementary.conf +++ b/mkosi.images/base/mkosi.conf.d/elementary.conf @@ -3,6 +3,8 @@ Distribution=ubuntu [Content] WithRecommends=yes +RemovePackages= + ubuntu-release-upgrader-core Packages= elementary-desktop elementary-minimal From 35c8b0b0169f67f742d615127409bd5030ddee8a Mon Sep 17 00:00:00 2001 From: Lewis Goddard Date: Fri, 23 Oct 2026 01:40:50 +0100 Subject: [PATCH 04/17] Enhance genkey target with comments and OpenSSL usage (#928) Updated the genkey target to include comments explaining the fixed-length serial for verity signatures and the use of OpenSSL for key generation. --- Justfile | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Justfile b/Justfile index 189ddef85..de22018ad 100644 --- a/Justfile +++ b/Justfile @@ -30,7 +30,11 @@ _get_timestamp: echo "$(cat ./mkosi.version)" genkey: - just mkosi genkey + # Like `mkosi genkey`, but with a fixed-length serial so every build's verity signature is the same size. + # A random serial is a byte shorter 1 in 256 times, and a shorter signature written over a longer one + # by an installed system's sysupdate leaves the old tail behind and breaks boot. + OPENSSL_CONF=/dev/null openssl req -new -x509 -newkey rsa:2048 -keyout mkosi.key -out mkosi.crt \ + -days 730 -subj "/CN=mkosi of root/" -nodes -set_serial "0x40$(openssl rand -hex 19)" mkosi +subcommand: mkdir -p {{env_var('HOME')}}/.cache/mkosi-workspace From 44d9ea9be07a62a9201a89d8d99793f0b4dba224 Mon Sep 17 00:00:00 2001 From: Lewis Goddard Date: Fri, 23 Oct 2026 02:20:20 +0100 Subject: [PATCH 05/17] Build with tools from the PPA. (#929) * Add ToolsTreeSandboxTrees to ppa.daily.conf * Add ToolsTreeSandboxTrees to ppa.stable.conf --- mkosi.conf.d/ppa.daily.conf | 3 +++ mkosi.conf.d/ppa.stable.conf | 3 +++ 2 files changed, 6 insertions(+) diff --git a/mkosi.conf.d/ppa.daily.conf b/mkosi.conf.d/ppa.daily.conf index cd8ca2327..565ac50cf 100644 --- a/mkosi.conf.d/ppa.daily.conf +++ b/mkosi.conf.d/ppa.daily.conf @@ -6,3 +6,6 @@ Profiles=|proposed SandboxTrees= %D/repos/daily %D/repos/common-files +ToolsTreeSandboxTrees= + %D/repos/daily + %D/repos/common-files diff --git a/mkosi.conf.d/ppa.stable.conf b/mkosi.conf.d/ppa.stable.conf index ceae510cd..3064ac72a 100644 --- a/mkosi.conf.d/ppa.stable.conf +++ b/mkosi.conf.d/ppa.stable.conf @@ -5,3 +5,6 @@ Profiles=stable SandboxTrees= %D/repos/stable %D/repos/common-files +ToolsTreeSandboxTrees= + %D/repos/stable + %D/repos/common-files From 236a0d95e5eb22f1e3b6660a3177838342e18ffd Mon Sep 17 00:00:00 2001 From: JumpyVi <62212220+jumpyvi@users.noreply.github.com> Date: Fri, 23 Oct 2026 08:48:32 -0400 Subject: [PATCH 06/17] Fix var/run symlink (#925) Co-authored-by: Lewis Goddard --- .../base/mkosi.extra/usr/lib/sysusers.d/00-session.conf | 2 +- .../base/mkosi.extra/usr/lib/tmpfiles.d/00-nsswitch.conf | 2 ++ mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf | 1 - mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/var.conf | 6 +++--- 4 files changed, 6 insertions(+), 5 deletions(-) create mode 100644 mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-nsswitch.conf diff --git a/mkosi.images/base/mkosi.extra/usr/lib/sysusers.d/00-session.conf b/mkosi.images/base/mkosi.extra/usr/lib/sysusers.d/00-session.conf index d3b0738fd..74cd2d3c6 100644 --- a/mkosi.images/base/mkosi.extra/usr/lib/sysusers.d/00-session.conf +++ b/mkosi.images/base/mkosi.extra/usr/lib/sysusers.d/00-session.conf @@ -2,5 +2,5 @@ u lightdm - "Light Display Manager" /var/lib/lightdm /usr/sbin/nologin u geoclue - "Geoclue Service" /var/lib/geoclue /usr/sbin/nologin g messagebus 987 u messagebus 987:987 "System Message Bus" /nonexistent /usr/sbin/nologin -u speech-dispatcher - "Speech Dispatcher" /var/run/speech-dispatcher /sbin/nologin +u speech-dispatcher - "Speech Dispatcher" /run/speech-dispatcher /sbin/nologin g speech-dispatcher - - - - diff --git a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-nsswitch.conf b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-nsswitch.conf new file mode 100644 index 000000000..6631c41fc --- /dev/null +++ b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-nsswitch.conf @@ -0,0 +1,2 @@ +# Override debian.conf to symlink instead of copy to get updates when they appear upstream. +L /etc/nsswitch.conf diff --git a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf index 63d58cdd9..a44a8ce51 100644 --- a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf +++ b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf @@ -29,7 +29,6 @@ L /etc/ld.so.conf L /etc/ld.so.conf.d # Contains the default systemd locale L /etc/locale.conf -L /etc/nsswitch.conf # ID C /etc/passwd diff --git a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/var.conf b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/var.conf index 91f1c1e06..073794975 100644 --- a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/var.conf +++ b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/var.conf @@ -1,3 +1,3 @@ -d /var/spool/anacron 0755 root root - - -d /var/spool/rsyslog 0755 root root - - -d /var/run/speech-dispatcher 0755 speech-dispatcher speech-dispatcher - - +# This overrides the same file from systemd. +L+ /var/run - - - - ../run +d /var/spool/anacron 0755 root root - From 7511d1e298124ccf0079660fd9faea7572941996 Mon Sep 17 00:00:00 2001 From: JumpyVi <62212220+jumpyvi@users.noreply.github.com> Date: Fri, 23 Oct 2026 12:31:10 -0400 Subject: [PATCH 07/17] Copy, don't link (#930) --- mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf index a44a8ce51..65ced2445 100644 --- a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf +++ b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf @@ -76,7 +76,7 @@ C /etc/sensors3.conf C /etc/usb_modeswitch.conf C /etc/thermald L /etc/fwupd -L? /etc/cups +C /etc/cups # Package Management & Updates C /etc/apt From a595cc5c59410b592935e7084c56d39f4c2f8e4e Mon Sep 17 00:00:00 2001 From: JumpyVi <62212220+jumpyvi@users.noreply.github.com> Date: Sat, 24 Oct 2026 10:33:20 -0400 Subject: [PATCH 08/17] Update the virt feature (#920) * Update the virt feature * Update mkosi.conf * Create /etc/mdevctl.d * Add libvirt-dnsmasq * Add ovmf * Add qemu-utils * Add 3d accel * Add spice * Use binary packages, not source * Update mkosi.conf * Reload systemd-sysusers after mounting extensions to enable new users Add ExecStartPost and ExecReload to systemd-sysext.service * Update and rename libvirt.conf to libvirt-dnsmasq.conf Avoid overwriting the existing package for users, just add the one that uses a postinst script we won't run. * Enable default NAT network for Qemu * Start libvirtd automatically on boot * Try out virt-manager * Update libvirt groups to avoid flapping * Fix mdevctl missing folders * Fix gschema for virt-manager * append our schema dir to XDG_DATA_DIRS instead * Drop virt-manager package --------- Co-authored-by: Lewis Goddard --- .../10_run_sysusers.conf | 5 +++++ mkosi.images/ext-virt/mkosi.conf | 16 +++++++++++++++- .../libvirt-guests.service.d/10_libvirtd.conf | 6 ++++++ .../system/multi-user.target.d/10_libvirtd.conf | 4 ++++ .../usr/lib/sysusers.d/libvirt-dnsmasq.conf | 4 ++++ .../mkosi.extra/usr/lib/tmpfiles.d/libvirt.conf | 9 +++++++++ mkosi.images/ext-virt/mkosi.finalize | 15 +++++++++++++++ mkosi.images/ext-virt/mkosi.postinst.chroot | 4 ---- 8 files changed, 58 insertions(+), 5 deletions(-) create mode 100644 mkosi.images/base/mkosi.extra/usr/lib/systemd/system/systemd-sysext.service.d/10_run_sysusers.conf create mode 100644 mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/libvirt-guests.service.d/10_libvirtd.conf create mode 100644 mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/multi-user.target.d/10_libvirtd.conf create mode 100644 mkosi.images/ext-virt/mkosi.extra/usr/lib/sysusers.d/libvirt-dnsmasq.conf create mode 100644 mkosi.images/ext-virt/mkosi.extra/usr/lib/tmpfiles.d/libvirt.conf create mode 100755 mkosi.images/ext-virt/mkosi.finalize delete mode 100755 mkosi.images/ext-virt/mkosi.postinst.chroot diff --git a/mkosi.images/base/mkosi.extra/usr/lib/systemd/system/systemd-sysext.service.d/10_run_sysusers.conf b/mkosi.images/base/mkosi.extra/usr/lib/systemd/system/systemd-sysext.service.d/10_run_sysusers.conf new file mode 100644 index 000000000..4530a5c12 --- /dev/null +++ b/mkosi.images/base/mkosi.extra/usr/lib/systemd/system/systemd-sysext.service.d/10_run_sysusers.conf @@ -0,0 +1,5 @@ +# systemd-sysusers.service runs before local file systems are mounted, so it never +# gets sysusers.d files shipped in extensions. Run it again once they are merged. +[Service] +ExecStartPost=systemd-sysusers +ExecReload=systemd-sysusers diff --git a/mkosi.images/ext-virt/mkosi.conf b/mkosi.images/ext-virt/mkosi.conf index 1d1cd75fa..582bb5fe5 100644 --- a/mkosi.images/ext-virt/mkosi.conf +++ b/mkosi.images/ext-virt/mkosi.conf @@ -11,11 +11,25 @@ CompressOutput=zstd [Content] Bootable=no BaseTrees=%O/base_%v +WithRecommends=yes +RemovePackages= + virt-manager Packages= + qemu-system-gui qemu-system-x86 qemu-system-arm + qemu-system-riscv + qemu-system-modules-opengl + qemu-system-modules-spice + qemu-system-misc + qemu-utils libvirt-daemon-system libvirt-clients - virt-manager + libspice-server1 + libvirglrenderer1 + virgl-server + spice-html5 bridge-utils + ovmf + qemu-efi-aarch64 virtinst diff --git a/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/libvirt-guests.service.d/10_libvirtd.conf b/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/libvirt-guests.service.d/10_libvirtd.conf new file mode 100644 index 000000000..2419c4694 --- /dev/null +++ b/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/libvirt-guests.service.d/10_libvirtd.conf @@ -0,0 +1,6 @@ +# Start libvirtd once at boot so autostart networks and guests come up. Upholding +# libvirtd.service directly would restart it whenever it exits idle. After= also +# shuts guests down before libvirtd stops. +[Unit] +Wants=libvirtd.service +After=libvirtd.service diff --git a/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/multi-user.target.d/10_libvirtd.conf b/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/multi-user.target.d/10_libvirtd.conf new file mode 100644 index 000000000..1e2fd4595 --- /dev/null +++ b/mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/multi-user.target.d/10_libvirtd.conf @@ -0,0 +1,4 @@ +# Extensions are merged after the boot transaction is built, so a .wants symlink +# never starts these. Upholds= is re-checked after the service manager reloads. +[Unit] +Upholds=libvirtd.socket libvirtd-ro.socket libvirtd-admin.socket libvirt-guests.service diff --git a/mkosi.images/ext-virt/mkosi.extra/usr/lib/sysusers.d/libvirt-dnsmasq.conf b/mkosi.images/ext-virt/mkosi.extra/usr/lib/sysusers.d/libvirt-dnsmasq.conf new file mode 100644 index 000000000..4f40a4b18 --- /dev/null +++ b/mkosi.images/ext-virt/mkosi.extra/usr/lib/sysusers.d/libvirt-dnsmasq.conf @@ -0,0 +1,4 @@ +# Ubuntu creates this user in libvirt-daemon-config-network's postinst rather than +# sysusers.d, and maintainer scripts don't run for extensions. +# Type Name ID GECOS Home directory +u libvirt-dnsmasq - "Libvirt Dnsmasq" /var/lib/libvirt/dnsmasq diff --git a/mkosi.images/ext-virt/mkosi.extra/usr/lib/tmpfiles.d/libvirt.conf b/mkosi.images/ext-virt/mkosi.extra/usr/lib/tmpfiles.d/libvirt.conf new file mode 100644 index 000000000..c54b61888 --- /dev/null +++ b/mkosi.images/ext-virt/mkosi.extra/usr/lib/tmpfiles.d/libvirt.conf @@ -0,0 +1,9 @@ +# Type Path Mode User Group Age Argument +d /var/lib/libvirt/images 0711 root root - - +d /var/lib/libvirt/qemu 0750 libvirt-qemu kvm - - +d /var/cache/libvirt/qemu 0750 libvirt-qemu kvm - - +d /var/log/libvirt/qemu 0750 root libvirt-qemu - - +d /etc/mdevctl.d/ 0750 root root - - +# Enable default NAT network +C /etc/libvirt/qemu/networks/default.xml - - - - /usr/share/libvirt/networks/default.xml +L /etc/libvirt/qemu/networks/autostart/default.xml - - - - /etc/libvirt/qemu/networks/default.xml diff --git a/mkosi.images/ext-virt/mkosi.finalize b/mkosi.images/ext-virt/mkosi.finalize new file mode 100755 index 000000000..5e6e13789 --- /dev/null +++ b/mkosi.images/ext-virt/mkosi.finalize @@ -0,0 +1,15 @@ +#!/usr/bin/env bash +set -euo pipefail + +# Reload the service manager once this extension is merged so the units it ships +# get loaded. mkosi names the file after the image version, hence the glob. +release=("$BUILDROOT"/usr/lib/extension-release.d/extension-release.*) +if [[ ${#release[@]} -ne 1 || ! -f ${release[0]} ]]; then + echo "Expected one extension-release file, found: ${release[*]}" >&2 + exit 1 +fi +echo "EXTENSION_RELOAD_MANAGER=1" >> "${release[0]}" + +# mkosi removes empty directories from extensions, but mdevctl won't run without +# its callout and notifier directories. +mkdir -p "$BUILDROOT"/usr/lib/mdevctl/scripts.d/{callouts,notifiers} diff --git a/mkosi.images/ext-virt/mkosi.postinst.chroot b/mkosi.images/ext-virt/mkosi.postinst.chroot deleted file mode 100755 index b80be8d33..000000000 --- a/mkosi.images/ext-virt/mkosi.postinst.chroot +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/bash -set -xeuo pipefail - -glib-compile-schemas /usr/share/glib-2.0/schemas/ From 88ea0f0af99c0698653351a1149ad249fc60c520 Mon Sep 17 00:00:00 2001 From: Lewis Goddard Date: Sat, 24 Oct 2026 19:25:16 +0100 Subject: [PATCH 09/17] Stop overriding systemd's var.conf (#933) * Modify 00-var-run.conf for directory replacement Updated 00-var-run.conf to sort before systemd's var.conf and replace /var/run directory. * Add tmpfiles configuration for anacron spool directory --- .../base/mkosi.extra/usr/lib/tmpfiles.d/00-var-run.conf | 2 ++ .../base/mkosi.extra/usr/lib/tmpfiles.d/98-anacron.conf | 1 + mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/var.conf | 3 --- 3 files changed, 3 insertions(+), 3 deletions(-) create mode 100644 mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-var-run.conf create mode 100644 mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/98-anacron.conf delete mode 100644 mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/var.conf diff --git a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-var-run.conf b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-var-run.conf new file mode 100644 index 000000000..36039b9be --- /dev/null +++ b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-var-run.conf @@ -0,0 +1,2 @@ +# Sorts before systemd's var.conf, so this L+ replaces a /var/run directory instead of its plain L. +L+ /var/run - - - - ../run diff --git a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/98-anacron.conf b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/98-anacron.conf new file mode 100644 index 000000000..850bd534c --- /dev/null +++ b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/98-anacron.conf @@ -0,0 +1 @@ +d /var/spool/anacron 0755 root root - diff --git a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/var.conf b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/var.conf deleted file mode 100644 index 073794975..000000000 --- a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/var.conf +++ /dev/null @@ -1,3 +0,0 @@ -# This overrides the same file from systemd. -L+ /var/run - - - - ../run -d /var/spool/anacron 0755 root root - From f71b02fccb464d161c708d5e52c62fa6bc20bbd6 Mon Sep 17 00:00:00 2001 From: JumpyVi <62212220+jumpyvi@users.noreply.github.com> Date: Sat, 24 Oct 2026 16:02:30 -0400 Subject: [PATCH 10/17] Keep dpkg database on clients (#931) Co-authored-by: Lewis Goddard --- mkosi.images/sysupdate/mkosi.conf | 3 ++- mkosi.images/sysupdate/mkosi.finalize.chroot | 7 +++++++ 2 files changed, 9 insertions(+), 1 deletion(-) create mode 100755 mkosi.images/sysupdate/mkosi.finalize.chroot diff --git a/mkosi.images/sysupdate/mkosi.conf b/mkosi.images/sysupdate/mkosi.conf index e4faab5f5..8f7989e6a 100644 --- a/mkosi.images/sysupdate/mkosi.conf +++ b/mkosi.images/sysupdate/mkosi.conf @@ -22,7 +22,8 @@ Bootable=yes BaseTrees=%O/base_%v ExtraTrees=%O/modules-db_%a-%v Output=elementary_%v -CleanPackageMetadata=yes +# mkosi.finalize.chroot needs the package database. /var isn't shipped in this image. +CleanPackageMetadata=no Bootloader=systemd-boot KernelInitrdModules= default diff --git a/mkosi.images/sysupdate/mkosi.finalize.chroot b/mkosi.images/sysupdate/mkosi.finalize.chroot new file mode 100755 index 000000000..932a7b539 --- /dev/null +++ b/mkosi.images/sysupdate/mkosi.finalize.chroot @@ -0,0 +1,7 @@ +#!/bin/bash +set -xeuo pipefail + +# Keep a backup of the package database so it can be restored at runtime if needed. +# This runs after RemovePackages= so the database matches what's in the image. +mkdir -p /usr/share/factory/dpkg/ +tar -czf /usr/share/factory/dpkg/dpkg.tar.gz -C / var/lib/dpkg From b70ca9a352d1bfa497ea1f3fd9f033335aff63b6 Mon Sep 17 00:00:00 2001 From: JumpyVi <62212220+jumpyvi@users.noreply.github.com> Date: Sat, 24 Oct 2026 17:14:59 -0400 Subject: [PATCH 11/17] Add required initrd modules (#921) Co-authored-by: Lewis Goddard --- mkosi.images/liveiso/mkosi.conf | 2 ++ mkosi.images/sysupdate/mkosi.conf | 2 ++ 2 files changed, 4 insertions(+) diff --git a/mkosi.images/liveiso/mkosi.conf b/mkosi.images/liveiso/mkosi.conf index d009e36b8..7cca299be 100644 --- a/mkosi.images/liveiso/mkosi.conf +++ b/mkosi.images/liveiso/mkosi.conf @@ -37,6 +37,8 @@ KernelInitrdModules= isofs loop ext4 + usbhid + hid_generic KernelCommandLine= rw console=ttyS0 diff --git a/mkosi.images/sysupdate/mkosi.conf b/mkosi.images/sysupdate/mkosi.conf index 8f7989e6a..906c3a1d0 100644 --- a/mkosi.images/sysupdate/mkosi.conf +++ b/mkosi.images/sysupdate/mkosi.conf @@ -34,6 +34,8 @@ KernelInitrdModules= uas sd_mod dm-verity + usbhid + hid_generic KernelCommandLine= splash quiet From 4f796104d3d7e7ab51352a620f28e5d776a32d06 Mon Sep 17 00:00:00 2001 From: JumpyVi <62212220+jumpyvi@users.noreply.github.com> Date: Sun, 25 Oct 2026 22:14:08 -0400 Subject: [PATCH 12/17] feat: Update info in readme (#927) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat: Update info in readme * Update README.md Co-authored-by: Danielle Foré * Split elementary and os Co-authored-by: Danielle Foré * Update README.md * Change wiki link --------- Co-authored-by: Danielle Foré --- README.md | 34 +++++++--------------------------- 1 file changed, 7 insertions(+), 27 deletions(-) diff --git a/README.md b/README.md index a8b9f5df0..09c50741f 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@

elementary OS

-

Build scripts for image creation

+

Mkosi configurations for building elementary OS images



@@ -22,7 +22,7 @@ --- -## Building, Testing, and Installation +## Building locally You'll need the following runtime dependencies: * podman @@ -36,32 +36,12 @@ Generate keys and then build with `just` just genkey just do-daily ``` -Create install media with [Fedora Media Writer](https://flathub.org/en/apps/org.fedoraproject.MediaWriter) or [Impression](flathub.org/en/apps/io.gitlab.adhami3310.Impression), or boot with GNOME Boxes (>=51). +This will result in a bootable .iso.
+Test it out in a VM, or create an [USB install drive](https://elementary.io/docs/installation#installation) (>= 8GB) -### Installation (sysupdate) -Once in the liveiso, inside the terminal or a tty, run: +## Further Information -```bash -sudo elementary-install -``` -You will be prompted with installation options. - -### Installation (classic) - -To install classic mode, follow the steps in the GUI installer from the liveiso. - -## Operations - -### Upgrades - -`updatectl update` - -Append the exact version ID at the end to upgrade to a specific version, or downgrade. +To get started with elementary OS, begin by [learning the basics](https://elementary.io/docs/learning-the-basics#learning-the-basics). -## Minimum specs -- UEFI with secure boot disabled -- 8 GB of USB flash drive -- GNOME Boxes >=51 (for VM only) -- 55 GB of destination disk -- 4 GB of system memory (RAM) +For contributors, administrators and OEMs, check out the [wiki](https://github.com/elementary/os/wiki) for in-depth information. From 23d5b98b101e8e1d72cced853f46205c784aefd9 Mon Sep 17 00:00:00 2001 From: JumpyVi <62212220+jumpyvi@users.noreply.github.com> Date: Sun, 25 Oct 2026 22:41:14 -0400 Subject: [PATCH 13/17] Use drivers directories instead of manual entries (#935) * Use drivers directories * Sync sysupdate and liveiso modules * Prefix paths with /, expand drive and keyboard support --------- Co-authored-by: Lewis Goddard --- mkosi.images/liveiso/mkosi.conf | 32 +++++++++++++++++++------------ mkosi.images/sysupdate/mkosi.conf | 27 +++++++++++++++++--------- 2 files changed, 38 insertions(+), 21 deletions(-) diff --git a/mkosi.images/liveiso/mkosi.conf b/mkosi.images/liveiso/mkosi.conf index 7cca299be..1df16a056 100644 --- a/mkosi.images/liveiso/mkosi.conf +++ b/mkosi.images/liveiso/mkosi.conf @@ -27,18 +27,26 @@ Packages= Bootloader=grub KernelInitrdModules= default - ahci - nvme - xhci_pci - usb_storage - uas - sd_mod - sr_mod - isofs - loop - ext4 - usbhid - hid_generic + /drivers/hid/ + /drivers/usb/ + /drivers/input/ + /drivers/i2c/ + /drivers/spi/ + /drivers/pinctrl/ + /drivers/mfd/intel-lpss* # I2C/SPI controllers for laptop keyboards + /drivers/platform/surface/ + /drivers/platform/chrome/ + /drivers/tty/serial/8250/8250_dw # Surface keyboards via SAM + /drivers/ata/ + /drivers/nvme/ + /drivers/scsi/ + /drivers/message/fusion/ + /drivers/block/ + /drivers/mmc/ + /drivers/ufs/ + /drivers/firewire/ + /fs/isofs/ + /fs/overlayfs/ KernelCommandLine= rw console=ttyS0 diff --git a/mkosi.images/sysupdate/mkosi.conf b/mkosi.images/sysupdate/mkosi.conf index 906c3a1d0..bd5e2ae2c 100644 --- a/mkosi.images/sysupdate/mkosi.conf +++ b/mkosi.images/sysupdate/mkosi.conf @@ -27,15 +27,24 @@ CleanPackageMetadata=no Bootloader=systemd-boot KernelInitrdModules= default - ahci - nvme - xhci_pci - usb_storage - uas - sd_mod - dm-verity - usbhid - hid_generic + /drivers/hid/ + /drivers/usb/ + /drivers/input/ + /drivers/i2c/ + /drivers/spi/ + /drivers/pinctrl/ + /drivers/mfd/intel-lpss* # I2C/SPI controllers for laptop keyboards + /drivers/platform/surface/ + /drivers/platform/chrome/ + /drivers/tty/serial/8250/8250_dw # Surface keyboards via SAM + /drivers/ata/ + /drivers/nvme/ + /drivers/scsi/ + /drivers/message/fusion/ + /drivers/block/ + /drivers/mmc/ + /drivers/ufs/ + /drivers/firewire/ KernelCommandLine= splash quiet From e4dca2a3f6295883df8e979c2cb3dbb065b55277 Mon Sep 17 00:00:00 2001 From: Sean Dolbec Date: Sat, 31 Oct 2026 14:31:48 -0400 Subject: [PATCH 14/17] Record the arm64 image build of the elementary/os merge --- mseries/OS9-HANDOFF.md | 2 +- mseries/upstream-audits/daily/2026-10-31.md | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/mseries/OS9-HANDOFF.md b/mseries/OS9-HANDOFF.md index 79f067d7f..50f25c88d 100644 --- a/mseries/OS9-HANDOFF.md +++ b/mseries/OS9-HANDOFF.md @@ -1,6 +1,6 @@ ## elementary/os upstream sync and repo housekeeping — 2026-10-31 -Merged `elementary/os` `main` into `dev` up to `23d5b98b10` (13 commits since the 2026-10-12 sync): kmscon by default, `/var/run` and dpkg-database fixes, virt extension update, driver-directory initrd modules, release-upgrader removal. Conflicts: kept our `sysusers.d/00-session.conf`; took upstream's deletion of `tmpfiles.d/var.conf` and moved our `/run/speech-dispatcher` line to `tmpfiles.d/mseries-var.conf`. Pins updated in `UPSTREAM-PINS.md`; details in `upstream-audits/daily/2026-10-31.md`. Verified: merge resolves cleanly; checks are the PR CI run (local `validate.sh` needs bash 4+, not on this Mac). Not verified: an image build with the new initrd module lists, kmscon, or any boot on the j314s. Found the upstream watch dashboard failing since 2026-10-28 (issue body over 65,536 characters with 510 sources); fixed separately. Next: CodexBar v0.78.0 -> v0.83.0 port bump; audit the omarchy-mac-pkgs DSP-microphone and initramfs backlight candidates. +Merged `elementary/os` `main` into `dev` up to `23d5b98b10` (13 commits since the 2026-10-12 sync): kmscon by default, `/var/run` and dpkg-database fixes, virt extension update, driver-directory initrd modules, release-upgrader removal. Conflicts: kept our `sysusers.d/00-session.conf`; took upstream's deletion of `tmpfiles.d/var.conf` and moved our `/run/speech-dispatcher` line to `tmpfiles.d/mseries-var.conf`. Pins updated in `UPSTREAM-PINS.md`; details in `upstream-audits/daily/2026-10-31.md`. Verified: merge resolves cleanly; checks are the PR CI run (local `validate.sh` needs bash 4+, not on this Mac). Image build: `daily-9.0` run 41226284220 on merge commit `96ce379f` built `elementaryos-9.0-daily-arm64.20261031174950.iso` (8.0 GB, kmscon 9.3.2-1 installed) and `test-image-wiring.py` passed ("Built live ISO hardware payload check passed"). Not verified: kmscon on the console or any boot on the j314s. Found the upstream watch dashboard failing since 2026-10-28 (issue body over 65,536 characters with 510 sources); fixed separately. Next: CodexBar v0.78.0 -> v0.83.0 port bump; audit the omarchy-mac-pkgs DSP-microphone and initramfs backlight candidates. ## Warren local AI and eGPU updates — 2026-10-30 diff --git a/mseries/upstream-audits/daily/2026-10-31.md b/mseries/upstream-audits/daily/2026-10-31.md index 64188924e..122036560 100644 --- a/mseries/upstream-audits/daily/2026-10-31.md +++ b/mseries/upstream-audits/daily/2026-10-31.md @@ -8,6 +8,7 @@ upstream's and unverified on this j314s. ## Summary - **elementary/os `main` merged into `dev`** up to `23d5b98b10` (#935, 2026-10-25): 13 commits. Two conflicts with our `ccca0b23` ("Fix OS 9 build log configuration issues"), resolved as below. + arm64 ISO builds from the merge (`daily-9.0` run 41226284220) and passes the image wiring check; not booted. - **Upstream watch dashboard (issue #51) has been failing since 2026-10-28**: 510 tracked sources pushed the issue body past GitHub's 65,536-character limit, so 23 of the last 30 scheduled runs failed and no new upstream changes were recorded. Fixed in a separate PR (digests stored as From 43768ee2bbc5183aaa2670506348340ec7280ef2 Mon Sep 17 00:00:00 2001 From: Sean Dolbec Date: Sat, 31 Oct 2026 14:38:50 -0400 Subject: [PATCH 15/17] Audit 2026-10-31: verdicts for the omarchy-mac-pkgs mic and initramfs candidates --- mseries/upstream-audits/daily/2026-10-31.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/mseries/upstream-audits/daily/2026-10-31.md b/mseries/upstream-audits/daily/2026-10-31.md index 122036560..66b58492c 100644 --- a/mseries/upstream-audits/daily/2026-10-31.md +++ b/mseries/upstream-audits/daily/2026-10-31.md @@ -45,11 +45,13 @@ upstream's and unverified on this j314s. | aurora-silicon/linux integration/aurora | 44d5afc79d (7.2.10) | 23827fe87f (10-30) | not diffed | ## Candidates (omarchy-mac-pkgs, translate to Ubuntu/mkosi; do not copy Arch mechanics) -1. **DSP microphone MONO port recovery** (`27cff08f`, `7f5e4dc2`, `c19d2932`, `12ae21fd`): maps the - asahi-audio DSP mic's MONO port and recovers it after an update. M1 Pro has the DSP mic. - Verdict: **AUDIT-DEEPER** (compare with our audio watchdog; no change to the running audio stack). -2. **Keyboard backlight at the passphrase prompt** (`a0fa1a8b`) and **PMP driver before unlock** - (`7ae91471`): initramfs-only. Verdict: **AUDIT-DEEPER** for the factory image's LUKS path. +1. **DSP microphone MONO port recovery** (`27cff08f`, `7f5e4dc2`, `c19d2932`, `12ae21fd`): **SKIP** (follow-up + pass, same day). The AUX0→MONO rename only affects `omarchy-audio-asahi-mic-map`, which PORT-MAP records as + deliberately not ported (Quickshell-specific). The "mic missing until WirePlumber restarts after an update" case + is covered for our install path: `install-audio-stack.sh` restarts the audio services. +2. **Keyboard backlight at the passphrase prompt** (`a0fa1a8b`) and **PMP driver before unlock** (`7ae91471`): + **PORTED** (follow-up pass) into `mseries/boot/initramfs-hardware.snippet` plus a udev rule, PR #714. Matters on + kernels that build `apple_pmp`/`pwm_apple` as modules; fairydust builds both in. Not verified on hardware. 3. **Touch ID series** (Oct 18–25, released in omarchy-mac 0.2.1): SEP driver options, fprintd drop-in, stop fprintd before sleep, owner consent before enabling. j314s has Touch ID. Upstream itself keeps it out of the manual until a stock boot enrols. Verdict: **WATCH**. From c466c6372f573632b283d407fae108249d6b0ac4 Mon Sep 17 00:00:00 2001 From: Sean Dolbec Date: Sat, 31 Oct 2026 18:04:42 -0400 Subject: [PATCH 16/17] Audit 2026-10-31: triage the upstream watch dashboard (fairydust j314 USB4/DP-altmode) --- mseries/upstream-audits/daily/2026-10-31.md | 34 +++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/mseries/upstream-audits/daily/2026-10-31.md b/mseries/upstream-audits/daily/2026-10-31.md index 66b58492c..b6e447eed 100644 --- a/mseries/upstream-audits/daily/2026-10-31.md +++ b/mseries/upstream-audits/daily/2026-10-31.md @@ -64,3 +64,37 @@ upstream's and unverified on this j314s. Full source list from `UPSTREAM-DAILY-AUDIT-PROMPT.md` was not walked: Aurora tree diff, m1n1, u-boot, AsahiLinux repos, Pantheon components, Mesa/PipeWire/BlueZ, news sites, CVE feeds. The dashboard (once green again) covers head movement for the 510 tracked sources. + +## Dashboard triage (issue #51, evening pass) +The watcher ran green again at 21:36 UTC and lists 255 unacknowledged changes across 593 tracked sources +(198 discovered branches, 23 repo heads, 18 branch-list hashes, 14 PR lists, 2 people). Filtered for the j314s +(t600x) and the dock goal; everything else is other hardware, ML engines or messaging (deferred). + +**Act on (AUDIT-DEEPER):** +1. **AsahiLinux/linux `fairydust` was rebased** (`ce9f2eba72` -> `ad2ca9b65c`, 2026-10-30; diverged, so the pin + in `daily-9.0.yml` and `fairydust/debian/README.md` no longer matches any branch commit). The new + `t600x-j314-j316.dtsi` adds native USB4 nodes (ACIO/NHI aliases, Type-C -> USB4 TBT endpoints), DCPEXT + Type-C routing behind `ENABLE_DCPEXT_TYPEC`, and **DP-altmode on the front-left port of j314/j316** + (`b8b2015b04`, Janne Grunau), with tipd HPD tracking/OOB hotplug HACKs (`05ad4c59cc`, `5b93151cb2`) and + `ps_atc1_common` forced always-on (`a3213235ef`, "works around missing suspend/resume handling in ATC phy"). + This may supersede parts of our `fairydust/usb4/0001-usb4-thunderbolt-apple-m1pro-on-fairydust.patch`. + Next: diff our patch against the new tree before any re-pin; the always-on domain likely costs idle power and + affects suspend. Dock picture already works on Aurora .20, so this is the fairydust lane only. No pin change made. +2. **omacom/linux-aurora #311 merged** (brcmfmac passes the country code; touches `t600x-j314-j316.dtsi`). + Arrives with the next Aurora release; relevant to j314s Wi-Fi regulatory behaviour. WATCH. + +**Watch:** +- `omacom/linux-aurora:diag/j314s-cpu-context-return` (Oct 21): opt-in j314s CPU deep-idle tracing experiment, + not a fix. Relevant to the open suspend item. +- `ludagoo/linux-aurora`: `fix/fpwm1-s2idle-restore` (J313/t8103 report; pmdomain change may apply to t600x + keyboard PWM, unverified), `fix/bcm4378-sleep-roam` (BCM4378 pktid reclaim; j314s Wi-Fi chip not confirmed here). +- `aurora-silicon/linux:fix/m1m2-typec-usb4-router` is now absent (deleted or merged); check where it went. +- zackb/tether v0.3.2 (pin 0.2.38; optional add-on still blocked on BlueZ >= 5.86). +- omacom/omarchy-mac-pkgs moved again to `ea0097a523` after this audit's `061be4d6` pass. +- elementary/os `2993aef6` "Try 64mb" (#936) touches only upstream's release workflow, which is gated off in + this fork; take it at the next sync. + +**Skip:** M3/M4/Neo/j6xx branches, MLX/ANE/TensorFold/transcribe engines (tracked by the local-AI ledger), +BlueBubbles/passwords/Locals (messaging deferred), RepoBar (our port is a reimplementation, not a pinned binary). + +Recommendation: issue #51 can be closed after reading this section; closing acknowledges all 255. From 49acb204d8f281bb6d76590c2ed53d9cbd14b73b Mon Sep 17 00:00:00 2001 From: Sean Dolbec Date: Sat, 31 Oct 2026 18:06:47 -0400 Subject: [PATCH 17/17] Audit 2026-10-31: record the archived fairydust source tarball --- mseries/upstream-audits/daily/2026-10-31.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/mseries/upstream-audits/daily/2026-10-31.md b/mseries/upstream-audits/daily/2026-10-31.md index b6e447eed..04965d6e5 100644 --- a/mseries/upstream-audits/daily/2026-10-31.md +++ b/mseries/upstream-audits/daily/2026-10-31.md @@ -80,6 +80,11 @@ The watcher ran green again at 21:36 UTC and lists 255 unacknowledged changes ac This may supersede parts of our `fairydust/usb4/0001-usb4-thunderbolt-apple-m1pro-on-fairydust.patch`. Next: diff our patch against the new tree before any re-pin; the always-on domain likely costs idle power and affects suspend. Dock picture already works on Aurora .20, so this is the fairydust lane only. No pin change made. + The pinned commit is no longer on any branch, so GitHub may eventually garbage-collect it. Its tarball + (sha256 `20ce358a…7f34aa`, matching `kernel-manifest.json`) is now attached to + `techmore/ElementaryOS_MSeries-Kernel` release `kernel-2026.10.27.1` with `SOURCE-SHA256SUMS`, preserving + the corresponding source for the shipped kernel. Builds still download from codeload; add that asset as a + fallback if codeload stops serving the commit. 2. **omacom/linux-aurora #311 merged** (brcmfmac passes the country code; touches `t600x-j314-j316.dtsi`). Arrives with the next Aurora release; relevant to j314s Wi-Fi regulatory behaviour. WATCH.