| -rw-r--r-- | .gitignore | 2 | ||||
| -rw-r--r-- | Jenkinsfile | 7 | ||||
| -rw-r--r-- | README.md | 59 | ||||
| -rw-r--r-- | docs/Fedora45Progress.jpg | bin | 2694880 -> 0 bytes | |||
| -rw-r--r-- | selinux/kiwi-rpm-script.te | 39 |
5 files changed, 14 insertions, 93 deletions
@@ -1,4 +1,2 @@ outdir-build/ outdir/ -selinux/*.pp -selinux/*.mod diff --git a/Jenkinsfile b/Jenkinsfile index 4b18f35..1732307 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -3,8 +3,6 @@ pipeline { options { timestamps() - preserveStashes() - buildDiscarder(logRotator(daysToKeepStr: '7')) } environment { @@ -43,7 +41,7 @@ spec: kubernetes.io/arch: arm64 containers: - name: kiwi - image: fedora:45 + image: fedora:44 imagePullPolicy: Always command: [ 'sleep' ] args: [ 'infinity' ] @@ -152,9 +150,8 @@ spec: mv "${src}" "${dst}" ls -lh - /s5cmd --endpoint-url "${B2_ENDPOINT}" --log debug cp \\ + /s5cmd --endpoint-url "${B2_ENDPOINT}" cp \\ --content-type "application/x-iso9660-image" \\ - --show-progress \\ "${dst}" \\ "s3://${ISO_BUCKET}/fedora/${IMAGE_VERSION}/aarch64/${dst}" ''' @@ -1,13 +1,9 @@ # Fedora KIWI image descriptions, modified to build & launch for Surface Pro 12" Gen 1 - - -**UPD Sep 10 2026:** There has been huge progress made in this project since August! Thanks to kernel patches, pushed onto Linux 7.2 mainstream and [Gentoo overlay](https://github.com/miasvanklei/Gentoo-overlay), most of the previous features which this release lacked (stable suspend on GNOME, accelerometer sensor, dedicated video output, cameras) are now implemented. The project has diverged into [patched kernel](https://sayag.it/fedora-linux-surface-pro-12in/kernel-surface.git) + [libcamera](https://sayag.it/fedora-linux-surface-pro-12in/libcamera.git) builds with an [RPM repo](https://rpm.sayag.it/kernel-sp12in/) publicly available. You can see current state of things in a [feature matrix](#feature-matrix) down below. -  -It is the fork of the original [KIWI image descriptions](https://forge.fedoraproject.org/releng/kiwi-descriptions), modified for launching Fedora Linux 45 Live ISO on Surface Pro 12" Gen 1 (and further installing it on the device). +It is the fork of the original [KIWI image descriptions](https://forge.fedoraproject.org/releng/kiwi-descriptions), modified for launching Fedora Linux Rawhide Live ISO on Surface Pro 12" Gen 1 (and further installing it on the device). I bought this device as I viewed it as a great Linux GNOME tablet, but after several days, many hours of work of trying to do so, I must say that installing a distribution here (and then having it work fine) is a huge pain in the ass. @@ -15,9 +11,9 @@ I bought this device as I viewed it as a great Linux GNOME tablet, but after sev ## How to run -**The compiled ISOs can be downloaded [here](https://dist.sayag.it/fedora/45/aarch64).** +**The compiled ISOs can be downloaded [here](https://dist.sayag.it/surface-pro-12in-ports/fedora/rawhide).** -This KIWI project is built mainly on the base of Fedora Workstation 45 LiveCD ISO. +This KIWI project is built mainly on the base of Fedora Workstation Rawhide LiveCD ISO. Trying a stable version (the latest is Fedora 44 at the time of writing this) is possible, but not tested for now. If you want to compile this image manually, **the build arch must be `aarch64`**. It means that if you are on an `amd64` machine, you would have to use aarch64 instructions emulation tools like `binfmt`. Unfortunately, such a tool will drastically increase the compilation time. @@ -34,42 +30,7 @@ To build this on Fedora Linux: []$ sudo ./kiwi-build --kiwi-file=Fedora.kiwi --image-type=iso --image-profile=Workstation-Live --output-dir ./outdir ``` -### SELinux issues - -In the combo of kiwi-ng 11.1.1 and rpm 6.1.0 (latest versions in Fedora 45 by November 5th 2026), rpm runs %sysusers scriptlets through an exec content of rpm_script_t, and with kiwi.te having no such grant, the host enforcement denies the domain transition, resulting in `setup` pkg, and many more, not getting installed inside the build environment. - -To fix the issue, reproduce rpm_transition_script for the kiwi domain. There is a script to do exactly this in `selinux/` domain. Do this to proceed with ISO build: - -```bash -cd selinux -checkmodule -M -m -o kiwi-rpm-script.mod kiwi-rpm-script.te -semodule_package -o kiwi-rpm-script.pp -m kiwi-rpm-script.mod -sudo semodule -i kiwi-rpm-script.pp -``` - -## Feature matrix - -| Hardware | State | Nuances | -| --- | --- | --- | -| Keyboard | ✓ | | -| Touchpad | ✓ | | -| Tablet Mode | ✓ | | -| Touchscreen | ✓ | | -| Pen | ✓ | Tested with Surface Slim Pen | -| WiFi | ✓ | 2.4/5 GHz networks | -| Bluetooth | ✓ | | -| Speakers | ✓ | | -| Buttons | ✓ | | -| Suspend | ✓ | `s2idle` tested | -| Hibernate | ? | | -| Sensors | ✓ | Accelerometer works, but light sensor outputs garbage, so adaptive brightness is disabled | -| Battery Status | ✓ | | -| Cameras | ✓ | Front camera -- overexposured areas tend to get green; back camera -- uncalibrated | -| GPU acceleration | ✓ | Video encoding/decoding driver is taken dynamically from a Windows partition | -| USB 3 | ✓ | Video passthrough on hubs (via HDMI) also tested and works | -| DisplayPort out | ✓ | Found issues with suspending while an external monitor is active, where the system freezes | - -## Compromises +## What is left out (for now) * Live CD has to run in RAM, so `rd.live.ram=1` is set for cmdline. Otherwise, at least on my ancient flash drive, it fails to load multiple necessary services, including `polkit`. So, ~5 minutes of loading on USB 2 drive, while screen is not backlit, is to be expected. * No rescue vmlinuz. @@ -77,17 +38,21 @@ sudo semodule -i kiwi-rpm-script.pp * No GRUB auto hidden menu. Trying to have the menu hidden results in system restarting after trying to boot it. * Hardware video encoding/decoding needs a firmware blob the image is not allowed to ship. The `qcom/vpu/vpu30_p1_s7.mbn` that `linux-firmware` provides is the same codec signed with Qualcomm's SecTools *test* key chain, which a retail Surface's TrustZone rejects -- `qcom_scm_pas_init_image()` fails and the kernel logs `qcom-iris aa00000.video-codec: error -22 initializing firmware`. The production-signed build exists only inside Microsoft's Surface driver package, which grants no redistribution right, so what ships here is the means and not the blob: * If you kept the Windows ARM64 partition, `surface-video-firmware.service` finds it on the first boot after install and copies `qcvss8380_pa.mbn` out of its DriverStore. Nothing to do. - * If Windows is gone, download the [Surface Pro 12-inch driver pack](https://www.microsoft.com/en-us/download/details.aspx?id=108199) (~500 MB MSI) and run `sudo surface-video-firmware.sh -m /path/to/SurfacePro_12in_*.msi`. + * If Windows is gone, download the [Surface Pro 12-inch driver pack](https://www.microsoft.com/en-us/download/details.aspx?id=108199) (~500 MB MSI) and run `sudo surface-video-firmware.sh -m /path/to/SurfacePro_12in_*.msi`. There is no automatic download: the Download Center hands out per-session links. The kernel's device tree already points `iris` at `/lib/firmware/qcom/x1p42100/Microsoft/Surface12/qcvss8380_pa.mbn`, so the driver picks it up as soon as it is there. -* Explicitly set `s2idle` suspend mode, as `deep` mode did not work properly as of August (when the iso was built without kernel patches). Currently untested if `deep` mode works now. -* No 6 GHz network support (at least my device does not detect mine). -* Adaptive brightness is disabled, as of now the light sensor outputs garbage. +* Suspend on Snapdragon X is still very unstable. No deep sleep is available, so `mem_sleep_default=s2idle` was set. Even that leads to compromises as suspending via GNOME results in hard freeze, so the default power button behavior was changed to `interactive` and should not be changed back to `suspend`. ## Image variants Please look at [`VARIANTS`](VARIANTS.md) for details on the available configurations that can be built. +## CI information + +This project is yet to adapt CI, but it is coming. + +For now the images are being built and tested manually on my personal Surface Pro 12" Gen 1 (16 GB RAM, 512 GB storage). + ## Licensing This is free software: you can redistribute it and/or modify diff --git a/docs/Fedora45Progress.jpg b/docs/Fedora45Progress.jpg Binary files differdeleted file mode 100644 index 0f4a22b..0000000 --- a/docs/Fedora45Progress.jpg +++ /dev/null diff --git a/selinux/kiwi-rpm-script.te b/selinux/kiwi-rpm-script.te deleted file mode 100644 index af2444a..0000000 --- a/selinux/kiwi-rpm-script.te +++ /dev/null @@ -1,39 +0,0 @@ -# Host-side SELinux fix for building with kiwi-ng 11.1.1 on Fedora (kiwi-selinux). -# -# kiwi-selinux installs a policy that runs /usr/bin/kiwi-ng in the kiwi_t -# domain. rpm 6.1 runs %sysusers scriptlets with an rpm_script_t exec -# context (fedora-selinux rpm_transition_script()). kiwi.te never grants -# that transition, so every sysusers scriptlet dies with exit status 127 -# ("command not found" from the exec failure), which is what breaks the -# bootstrap transaction: setup-* fails, /etc/passwd and /etc/group are never -# created, and all later user/group lookups fail. -# -# This module reproduces fedora's rpm_transition_script(kiwi_t, unconfined_r) -# for the kiwi domain. Not part of the image build - install it on the host: -# -# checkmodule -M -m -o kiwi-rpm-script.mod kiwi-rpm-script.te -# semodule_package -o kiwi-rpm-script.pp -m kiwi-rpm-script.mod -# sudo semodule -i kiwi-rpm-script.pp - -module kiwi-rpm-script 1.0; - -require { - type kiwi_t; - type rpm_script_t; - attribute rpm_transition_domain; - attribute_role rpm_script_roles; - role unconfined_r; - class process { transition sigchld }; - class fd use; - class fifo_file { read write getattr ioctl }; -} - -# rpm_transition_script(), expanded for kiwi_t / unconfined_r -typeattribute kiwi_t rpm_transition_domain; -roleattribute unconfined_r rpm_script_roles; - -allow kiwi_t rpm_script_t:process transition; -allow kiwi_t rpm_script_t:fd use; -allow rpm_script_t kiwi_t:fd use; -allow rpm_script_t kiwi_t:fifo_file { read write getattr ioctl }; -allow rpm_script_t kiwi_t:process sigchld; |
