Diffstat (limited to 'config.sh')
| -rwxr-xr-x | config.sh | 714 |
1 files changed, 700 insertions, 14 deletions
@@ -2,6 +2,14 @@ set -euxo pipefail +installarch=$(uname -m) +kver=$(basename "$(ls -d /usr/lib/modules/*/)") + +if [[ $installarch != "aarch64" ]]; then + printf 'Error: this specific config is only meant for Surface Pro 12", and it is built on ARM64 chip (you have "%s" as build arch).' "$installarch" + exit 1 +fi + #====================================== # Functions... #-------------------------------------- @@ -16,8 +24,10 @@ echo "Configure image: [$kiwi_iname]-[$kiwi_profiles]..." #====================================== # Set SELinux booleans #-------------------------------------- -## Fixes KDE Plasma, see rhbz#2058657 -setsebool -P selinuxuser_execmod 1 +if [[ "$kiwi_profiles" != *"Container"* ]] && [[ "$kiwi_profiles" != *"FEX"* ]] && [[ "$kiwi_profiles" != *"WSL"* ]]; then + ## Fixes KDE Plasma, see rhbz#2058657 + setsebool -P selinuxuser_execmod 1 +fi #====================================== # Clear machine specific configuration @@ -31,18 +41,48 @@ rm -f /var/lib/systemd/random-seed #====================================== # Configure grub correctly #-------------------------------------- -## Works around issues with grub-bls -## See: https://github.com/OSInside/kiwi/issues/2198 -echo "GRUB_DEFAULT=saved" >> /etc/default/grub -## Disable submenus to match Fedora -echo "GRUB_DISABLE_SUBMENU=true" >> /etc/default/grub -## Disable recovery entries to match Fedora -echo "GRUB_DISABLE_RECOVERY=true" >> /etc/default/grub +if [[ "$kiwi_profiles" != *"Container"* ]] && [[ "$kiwi_profiles" != *"FEX"* ]] && [[ "$kiwi_profiles" != *"WSL"* ]]; then + ## Works around issues with grub-bls + ## See: https://github.com/OSInside/kiwi/issues/2198 + echo "GRUB_DEFAULT=saved" >> /etc/default/grub + ## Disable submenus to match Fedora + echo "GRUB_DISABLE_SUBMENU=true" >> /etc/default/grub + ## Disable recovery entries to match Fedora + echo "GRUB_DISABLE_RECOVERY=true" >> /etc/default/grub + ## Surface Pro 12" (Snapdragon X1P-42-100): grub's gfxterm/GOP video probing + ## crashes on this GPU. Force plain text console, skip framebuffer handoff. + echo "GRUB_TERMINAL_OUTPUT=console" >> /etc/default/grub + echo "GRUB_GFXPAYLOAD_LINUX=text" >> /etc/default/grub + ## Surface Pro 12": GRUB_DEVICETREE is the only mechanism Fedora honours for + ## putting a devicetree line in a BLS entry -- 20-grub.install's mkbls emits + ## "devicetree /dtb-$kver/$GRUB_DEVICETREE". /etc/kernel/devicetree does + ## nothing here: /boot/<machine-id> does not exist, so kernel-install runs + ## with layout=other and 90-loaderentry.install (which would read it) bails. + echo "GRUB_DEVICETREE=qcom/x1p42100-microsoft-sp12in.dtb" >> /etc/default/grub + ## Upstream sets menu_auto_hide=1 + boot_indeterminate=1 here for Disk images + ## to match anaconda's behaviour. Deliberately not done for Surface Pro 12": + ## with the menu hidden, GRUB counts down GRUB_TIMEOUT against a blank screen + ## and then crashes during the hand-off on this firmware, so the first boot + ## always fails and only the second succeeds. The equivalent for the + ## anaconda-installed system is the /etc/anaconda/conf.d drop-in below. +fi + +#====================================== +# Resize root partition on first boot +#-------------------------------------- + +if [[ "$kiwi_profiles" == *"Disk"* ]]; then + mkdir -p /etc/repart.d/ + cat > /etc/repart.d/50-root.conf << EOF +[Partition] +Type=root +EOF +fi #====================================== # Delete & lock the root user password #-------------------------------------- -if [[ "$kiwi_profiles" == *"Cloud"* ]] || [[ "$kiwi_profiles" == *"Live"* ]]; then +if [[ "$kiwi_profiles" == *"Cloud"* ]] || [[ "$kiwi_profiles" == *"Disk"* ]] || [[ "$kiwi_profiles" == *"Live"* ]] || [[ "$kiwi_profiles" == *"WSL"* ]]; then passwd -d root passwd -l root fi @@ -59,21 +99,76 @@ if [[ "$kiwi_profiles" == *"Live"* ]]; then if [[ "$kiwi_profiles" == *"KDE"* ]]; then echo 'livesys_session="kde"' > /etc/sysconfig/livesys fi + if [[ "$kiwi_profiles" == *"Budgie"* ]]; then + echo 'livesys_session="budgie"' > /etc/sysconfig/livesys + fi + if [[ "$kiwi_profiles" == *"Cinnamon"* ]]; then + echo 'livesys_session="cinnamon"' > /etc/sysconfig/livesys + fi + if [[ "$kiwi_profiles" == *"COSMIC"* ]]; then + echo 'livesys_session="cosmic"' > /etc/sysconfig/livesys + fi + if [[ "$kiwi_profiles" == *"i3"* ]]; then + echo 'livesys_session="i3"' > /etc/sysconfig/livesys + fi + if [[ "$kiwi_profiles" == *"LXDE"* ]]; then + echo 'livesys_session="lxde"' > /etc/sysconfig/livesys + fi + if [[ "$kiwi_profiles" == *"LXQt"* ]]; then + echo 'livesys_session="lxqt"' > /etc/sysconfig/livesys + fi + if [[ "$kiwi_profiles" == *"MATE_Compiz"* ]]; then + echo 'livesys_session="mate"' > /etc/sysconfig/livesys + fi + if [[ "$kiwi_profiles" == *"MiracleWM"* ]]; then + echo 'livesys_session="miraclewm"' > /etc/sysconfig/livesys + fi + if [[ "$kiwi_profiles" == *"Sway"* ]]; then + echo 'livesys_session="sway"' > /etc/sysconfig/livesys + fi + if [[ "$kiwi_profiles" == *"SoaS"* ]]; then + echo 'livesys_session="soas"' > /etc/sysconfig/livesys + fi + if [[ "$kiwi_profiles" == *"Xfce"* ]]; then + echo 'livesys_session="xfce"' > /etc/sysconfig/livesys + fi +fi + +#====================================== +# Setup firstboot initial setup +#-------------------------------------- + +if [[ "$kiwi_profiles" == *"Disk"* ]]; then + if [[ "$kiwi_profiles" != *"GNOME"* ]] && [[ "$kiwi_profiles" != *"KDE"* ]] && [[ "$kiwi_profiles" != *"COSMIC"* ]]; then + ## Enable initial-setup + systemctl enable initial-setup.service + ## Enable reconfig mode + touch /etc/reconfigSys + fi fi #====================================== # Setup default target #-------------------------------------- -if [[ "$kiwi_profiles" == *"GNOME"* ]] || [[ "$kiwi_profiles" == *"KDE"* ]]; then - systemctl set-default graphical.target -else - systemctl set-default multi-user.target +if [[ "$kiwi_profiles" != *"Container"* ]] && [[ "$kiwi_profiles" != *"FEX"* ]]; then + if [[ "$kiwi_profiles" == *"Desktop"* ]]; then + systemctl set-default graphical.target + else + systemctl set-default multi-user.target + fi fi #====================================== # Setup default customizations #-------------------------------------- +if [[ "$kiwi_profiles" == *"Server"* ]]; then + # Trigger lvm-devices-import.path and .service to create + # a new /etc/lvm/devices/system.devices for the root VG. + rm -f /etc/lvm/devices/system.devices + touch /etc/lvm/devices/auto-import-rootvg +fi + if [[ "$kiwi_profiles" == *"Azure"* ]]; then cat > /etc/ssh/sshd_config.d/50-client-alive-interval.conf << EOF ClientAliveInterval 120 @@ -84,6 +179,29 @@ cat >> /etc/chrony.conf << EOF # https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync#check-for-ptp-clock-source refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 EOF + +# Support Azure's accelerated networking feature; without this the network fails +# to come up. It may need adjustments for additional drivers in the future. +cat > /etc/NetworkManager/conf.d/99-azure-unmanaged-devices.conf << EOF +# Ignore SR-IOV interface on Azure, since it's transparently bonded +# to the synthetic interface +[keyfile] +unmanaged-devices=driver:mlx4_core;driver:mlx5_core +EOF + +# Configure DHCP timeout for Azure to retry indefinitely during VM provisioning +cat > /etc/NetworkManager/conf.d/99-azure-dhcp-timeout.conf << EOF +# Azure requires VMs to attempt DHCP for at least 300 seconds during provisioning, +# as that's the upper bound of how long Azure waits to make networking available. +# NetworkManager's ipv4.dhcp-timeout setting accepts 2147483647 as a special value +# representing infinity, which ensures DHCP keeps retrying indefinitely. This is +# more robust than a fixed timeout and matches systemd-networkd's default behavior. +# Both IPv4 and IPv6 are configured to prepare for IPv6-only scenarios. +# Reference: https://networkmanager.dev/docs/api/latest/nm-settings-nmcli.html +[connection] +ipv4.dhcp-timeout=2147483647 +ipv6.dhcp-timeout=2147483647 +EOF fi if [[ "$kiwi_profiles" == *"GCE"* ]]; then @@ -105,6 +223,13 @@ EOKEYS chmod 600 ~vagrant/.ssh/authorized_keys chown -R vagrant:vagrant ~vagrant/.ssh/ +cat > /etc/sudoers.d/vagrant << EOSUDOER +## Ensure the vagrant user always can use sudo +Defaults:vagrant !requiretty +vagrant ALL=(ALL) NOPASSWD: ALL +EOSUDOER +chmod 600 /etc/sudoers.d/vagrant + cat > /etc/ssh/sshd_config.d/10-vagrant-insecure-rsa-key.conf <<EOF # For now the vagrant insecure key is an rsa key # https://github.com/hashicorp/vagrant/issues/11783 @@ -118,4 +243,565 @@ chmod 600 /root/.ssh/authorized_keys chown -R root:root /root/.ssh fi +# https://bugzilla.redhat.com/show_bug.cgi?id=2356069 +if [[ "$kiwi_profiles" == *"Container"* ]] && [[ "$kiwi_profiles" != *"Init"* ]]; then + if [[ -f /usr/lib/tmpfiles.d/rootfiles.conf ]]; then + systemd-tmpfiles --create /usr/lib/tmpfiles.d/rootfiles.conf + fi +fi + +if [[ "$kiwi_profiles" == *"Container"* ]] || [[ "$kiwi_profiles" == *"FEX"* ]]; then + # Set install langs macro so that new rpms that get installed will + # only install langs that we limit it to. + LANG="en_US" + echo "%_install_langs $LANG" > /etc/rpm/macros.image-language-conf + + # https://bugzilla.redhat.com/show_bug.cgi?id=1727489 + echo 'LANG="C.UTF-8"' > /etc/locale.conf + + # https://bugzilla.redhat.com/show_bug.cgi?id=1400682 + echo "Import RPM GPG key" + releasever=$(rpm --eval '%{?fedora}') + + # When building ELN containers, we don't have the %{fedora} macro + if [ -z $releasever ]; then + releasever=eln + fi + + rpm --import /usr/share/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-primary + + echo "# fstab intentionally empty for containers" > /etc/fstab + + # Remove machine-id on pre generated images + rm -f /etc/machine-id + touch /etc/machine-id + + echo "# resolv placeholder" > /etc/resolv.conf + chmod 644 /etc/resolv.conf + + # Remove extraneous files + rm -rf /tmp/* + + # https://pagure.io/atomic-wg/issue/308 + printf "tsflags=nodocs\n" >>/etc/dnf/dnf.conf + + if [[ "$kiwi_profiles" == *"Base-Generic-Minimal"* ]]; then + # remove some random help txt files + rm -fv /usr/share/gnupg/help*.txt + + # Pruning random things + rm /usr/lib/rpm/rpm.daily + rm -rfv /usr/lib64/nss/unsupported-tools/ # unsupported + + # Statically linked crap + rm -fv /usr/sbin/{glibc_post_upgrade.x86_64,sln} + ln /usr/bin/ln usr/sbin/sln + + # Remove some dnf info + rm -rfv /var/lib/dnf + + # don't need icons + rm -rfv /usr/share/icons/* + + #some random not-that-useful binaries + rm -fv /usr/bin/pinky + + # we lose presets by removing /usr/lib/systemd but we do not care + rm -rfv /usr/lib/systemd + fi + if [[ "$kiwi_profiles" == *"Toolbox"* ]]; then + # Remove macros.image-language-conf file + rm -f /etc/rpm/macros.image-language-conf + + # Remove 'tsflags=nodocs' line from dnf.conf + sed -i '/tsflags=nodocs/d' /etc/dnf/dnf.conf + fi +fi + +if [[ "$kiwi_profiles" == *"Jam"* ]]; then +# Override boot configuration in Anaconda to enable threaded IRQs +cat > /usr/share/anaconda/post-scripts/85-jam-threadirqs.ks << THREADIRQS_EOF +%post + +echo "Enable threaded IRQs" +grubby --update-kernel=ALL --args="threadirqs" +%end +THREADIRQS_EOF + +# Override new user configuration to add audio groups +sed -e "s/UserGroups=.*/UserGroups=wheel,jackuser,audio/" -i /etc/xdg/plasmasetuprc + +# Override livesys-kde settings +cat >> /var/lib/livesys/livesys-session-extra << EOF + +#setup kickoff favorites +/bin/mkdir -p /etc/skel/.config + +JAMFAVORITES=/usr/share/applications/firefox.desktop,/usr/share/applications/mozilla-thunderbird.desktop,/usr/share/applications/studio-controls.desktop,/usr/share/applications/ardour6.desktop,/usr/share/applications/carla.desktop,/usr/share/applications/org.kde.konsole.desktop,/usr/share/applications/org.kde.dolphin.desktop,/usr/share/applications/systemsettings.desktop +JAMFAVORITESLIVE=/usr/share/applications/liveinst.desktop,\$JAMFAVORITES + +cat <<FOE >> /etc/skel/.config/kickoffrc +[Favorites] +FavoriteURLs=\$JAMFAVORITES +FOE + +/usr/sbin/usermod -a -G jackuser,audio liveuser +EOF +fi + +if [[ "$kiwi_profiles" == *"Design_suite"* ]]; then +# Add link to lists of tutorials +cat >> /usr/share/applications/list-design-tutorials.desktop << FOE +[Desktop Entry] +Name=List of design tutorials +GenericName=List of Tutorials for Designers +Comment=Reference of Design Related Tutorials +Exec=xdg-open https://fedoraproject.org/wiki/Design_Suite/Tutorials +Type=Application +Icon=applications-graphics +Categories=Graphics;Documentation; +FOE +chmod a+x /usr/share/applications/list-design-tutorials.desktop + +# Add information about Fedora Design Suite +cat >> /usr/share/applications/fedora-design-suite.desktop << FOE +[Desktop Entry] +Name=Design Suite Info +GenericName=About Design Suite +Comment=Wiki page of Design Suite +Exec=xdg-open https://fedoraproject.org/wiki/Design_Suite +Type=Application +Icon=applications-internet +Categories=Documentation; +FOE +chmod a+x /usr/share/applications/fedora-design-suite.desktop + +# Add information about Fedora Design Team +cat >> /usr/share/applications/fedora-design-team.desktop << FOE +[Desktop Entry] +Name=Design Team Info +GenericName=About Design Team +Comment=Documentation about Design Team +Exec=xdg-open https://docs.fedoraproject.org/en-US/design/ +Type=Application +Icon=applications-internet +Categories=Documentation; +FOE +chmod a+x /usr/share/applications/fedora-design-team.desktop + +# Use Powerline in bash +cat >> /etc/profile.d/powerline-shell.sh << FOE +# Enable powerline daemon +if [ -f `which powerline-daemon` ]; then + powerline-daemon -q + POWERLINE_BASH_CONTINUATION=1 + POWERLINE_BASH_SELECT=1 + . /usr/share/powerline/bash/powerline.sh +fi +FOE +chmod 644 /etc/profile.d/powerline-shell.sh +# End powerline override + +# Override the favorite desktop application in Dash +cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE +[org.gnome.shell] +favorite-apps=['org.mozilla.firefox.desktop', 'shotwell.desktop', 'gimp.desktop', 'darktable.desktop', 'krita.desktop', 'inkscape.desktop', 'blender.desktop', 'libreoffice-writer.desktop', 'scribus.desktop', 'kdenlive.desktop', 'nautilus.desktop', 'anaconda.desktop', 'list-design-tutorials.desktop'] +FOE + +# Rebuild schema cache with any overrides we installed +glib-compile-schemas /usr/share/glib-2.0/schemas +fi + +if [[ "$kiwi_profiles" == *"SoaS"* ]]; then +# Get proper release naming in the control panel +cat >> /boot/olpc_build << EOF +Sugar on a Stick +EOF +cat /etc/fedora-release >> /boot/olpc_build + +# Set the default Plymouth theme to the Sugar Desktop one +/usr/sbin/plymouth-set-default-theme sugar + +# Fix https://bugzilla.redhat.com/show_bug.cgi?id=2239137 +cat > /etc/xdg/autostart/xfce-polkit.desktop <<EOF +[Desktop Entry] +Type=Application +Name=xfce-polkit +Exec=/usr/libexec/xfce-polkit +EOF + +fi + +#====================================== +# Surface Pro 12" customizations +#-------------------------------------- + +install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/yum.repos.d/kernel-sp12in.repo \ + /etc/yum.repos.d/kernel-sp12in.repo + +# Device tree. kernel-surface compiles the patched dts in-tree and installs the +# result twice: into its own module tree (dtb/qcom, from dtbs_install) and into +# /usr/lib/surface-dtb/<kver>/. The latter is the master copy +# 60-surface-dtb.install re-stages into a kernel that shipped without one, +# which is the only reason the image no longer carries a prebuilt blob of its +# own -- the description installs kernel-surface by name and <ignore>s Fedora's +# kernel packages, so the package is always there. +# +# One name throughout, upstream's: this block, GRUB_DEVICETREE above, both +# kernel-install plugins, /etc/kernel/devicetree, and the ISO grub template. +# +# The module-tree and /boot copies plus the /boot/dtb symlink are what that hook +# and grubby's 10-devicetree.install would normally produce, done up front here +# because kernel-install does not run again during this build -- without the +# module-tree copy, anything keyed off /usr/lib/modules/$kver/dtb (including the +# anaconda post-script) finds nothing and silently does nothing. +dtb_name=x1p42100-microsoft-sp12in.dtb +# One directory per kernel version under /usr/lib/surface-dtb: kernel-surface is +# installonly, so nothing it owns can be version-unqualified. Only one release is +# ever installed at this point in the build, but glob anyway rather than assume. +dtb_src=$(ls -1 /usr/lib/surface-dtb/*/"$dtb_name" 2>/dev/null | sort -V | tail -n1) +if [[ -z "$dtb_src" ]]; then + printf 'Error: no %s under /usr/lib/surface-dtb/, so kernel-surface (built from ../kernel-surface) is not installed.\n' "$dtb_name" >&2 + exit 1 +fi +install -Dm644 "$dtb_src" "/usr/lib/modules/$kver/dtb/qcom/$dtb_name" +install -Dm644 "$dtb_src" "/boot/dtb-$kver/qcom/$dtb_name" +# dtbs_install ships every arm64 device tree, ~1000 boards, and the module tree +# goes straight into the image filesystem. This image targets exactly one board, +# so drop the rest -- the same objection that rules out kernel-uki-dtbloader in +# components/boot.xml. Only affects the image; a later kernel-surface update on +# the installed system restores the full tree. +find "/usr/lib/modules/$kver/dtb" -mindepth 1 \ + \! -path "/usr/lib/modules/$kver/dtb/qcom" \ + \! -name "$dtb_name" \ + -delete +# /boot/dtb -> dtb-$kver is what grubby's 10-devicetree.install maintains, and +# what the boot loader entry's devicetree path resolves through +ln -sfn "dtb-$kver" /boot/dtb +# Defer qcom_q6v5_pas past switch-root so the DSPs' auto_boot can actually find +# their firmware; see the comments in the file for the full failure mode. +install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dracut.conf.d/surface-pro-12-inch.conf \ + /etc/dracut.conf.d/surface-pro-12-inch.conf +install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/cmdline \ + /etc/kernel/cmdline +install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/devicetree \ + /etc/kernel/devicetree +install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/install.conf \ + /etc/kernel/install.conf +install -Dm755 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/60-surface-dtb.install \ + /usr/lib/kernel/install.d/60-surface-dtb.install +# Puts the "devicetree" line into the BLS entry. This is the only mechanism that +# survives an anaconda install: /etc/kernel/devicetree is never read (layout is +# always "other" on Fedora, so 90-loaderentry.install bails) and GRUB_DEVICETREE +# is dropped when anaconda rewrites /etc/default/grub from its own key list. +# kernel-install plugins do run in the target during installation, and sorting +# after 20-grub.install means the entry it generates is already there to patch. +install -Dm755 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/95-surface-dtb-patch.install \ + /usr/lib/kernel/install.d/95-surface-dtb-patch.install +install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules \ + /etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules + +if [[ "$kiwi_profiles" == *"Live"* ]]; then + # Stop anaconda hiding the GRUB menu on the installed system's first boot. + # Only meaningful in the installer environment, hence Live-only; see the + # comments in the file for why a hidden menu breaks this device. + install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/anaconda/conf.d/90-surface-pro-12-inch.conf \ + /etc/anaconda/conf.d/90-surface-pro-12-inch.conf + + # Ship the CD-boot grub on the ISO, not the disk-boot one. + # + # kiwi picks the ISO's EFI loader by globbing the image root (see + # Defaults.get_unsigned_grub_loader, target_type='iso'). That pattern list + # has a CD-boot entry for x86_64 (gcdx64.efi) but none for aarch64, so here + # it falls through to grubaa64.efi -- the *disk* image, whose baked-in grub + # prefix is /EFI/fedora. Meanwhile kiwi writes its earlyboot config to + # /EFI/BOOT/grub.cfg, and iso-esp-excludes.yaml deletes "fedora" from the + # embedded ESP outright (rhbz#2358785). Net result on aarch64: the loader + # looks for its config in a directory that was deliberately removed, fails + # to load normal.mod, and dies before drawing anything -- black screen. + # + # gcdaa64.efi is byte-for-byte the same grub except its prefix is /EFI/BOOT, + # which is exactly where kiwi puts the config. Overwrite the path kiwi globs + # so it picks that one up instead. + # + # Only affects direct UEFI boot. Ventoy never executes this binary -- it + # loopback-mounts the ISO and runs /boot/grub2/grub.cfg under its own grub. + cp -a /boot/efi/EFI/fedora/gcdaa64.efi /boot/efi/EFI/fedora/grubaa64.efi +fi + +# 51-dracut-rescue.install isn't UKI-aware -- it unconditionally sed's a BLS +# loader entry that layout=uki never creates. Mask it (kernel-install(8)'s +# documented way to disable a plugin: a /dev/null symlink of the same name). +mkdir -p /etc/kernel/install.d +ln -sf /dev/null /etc/kernel/install.d/51-dracut-rescue.install +# kernel-surface's %posttrans scriptlet already ran kernel-install once, before +# this mask existed (root overlay lands after package install), leaving a +# stale rescue image behind. Remove it now so kiwi's systemd_boot EFI-FAT-image +# step doesn't try to cram it in too. +rm -f /boot/initramfs-0-rescue-*.img /boot/loader/entries/*-0-rescue.conf + +# GPU/ADSP/CDSP firmware + qcom DSP/sensor share config from the device tree repo +# (readme.md: "recursively copy the files in ./lib/ to /lib/", same for ./usr/) +cp -a /tmp/harrisonvanderbyl/surface-pro-12-inch-linux/lib/. /lib/ +cp -a /tmp/harrisonvanderbyl/surface-pro-12-inch-linux/usr/. /usr/ + +build_tmp=$(mktemp -d) + +# Snapshot what's installed before pulling in build-only tooling, so we can +# remove exactly what this block adds afterward -- and nothing Kiwi's own +# package lists (other team/desktop profiles) already wanted installed. +pkgs_before=$(mktemp) +rpm -qa --qf '%{NAME}\n' | sort > "$pkgs_before" + +# Wi-Fi (ath12k) board file fixup, adapted from dwhinham/linux-surface-pro-11 +dnf install -y python3 curl zstd +( + cd "$build_tmp" + cp /lib/firmware/ath12k/WCN7850/hw2.0/board-2.bin* . + if [ -f board-2.bin.zst ]; then + zstd -d board-2.bin.zst + elif [ -f board-2.bin.xz ]; then + xz -d board-2.bin.xz + fi + curl --output bdencoder.py -sL \ + https://raw.githubusercontent.com/qca/qca-swiss-army-knife/refs/heads/master/tools/scripts/ath12k/ath12k-bdencoder + python3 bdencoder.py --extract board-2.bin + rm -f bdencoder.py + mv "bus=pci,vendor=17cb,device=1107,subsystem-vendor=17cb,subsystem-device=3378,qmi-chip-id=2,qmi-board-id=255.bin" \ + /lib/firmware/ath12k/WCN7850/hw2.0/board.bin +) + +# AudioReach topology; alsatplg (the topology *compiler*) is build-only, the +# compiled blob is what ships. alsa-ucm-utils' UCM profiles are read at runtime +# by the audio stack, so that one's installed separately, alongside v4l-utils below. +dnf install -y git cmake gcc gcc-c++ make pkgconf-pkg-config alsa-topology-utils m4 +( + cd /tmp/linux-msm/audioreach-topology + git clone https://github.com/linux-msm/audioreach-topology + cd audioreach-topology + export FW_LOCATION=/lib/firmware + cmake . + make + make install +) + +# hexagonrpc + libssc + iio-sensor-proxy (fastrpc/sensor stack); not packaged in Fedora +dnf install -y \ + systemd-devel libgudev-devel polkit-devel gtk3-devel python3-devel \ + meson ninja-build gcc gcc-c++ git pkgconf-pkg-config \ + libqmi-devel glib2-devel protobuf3-c-devel gobject-introspection-devel +# meson's default prefix is /usr/local, and Fedora's dynamic linker does not +# search there -- /etc/ld.so.conf.d ships only iscsi and pipewire entries. Without +# this, libhexagonrpc.so installs fine but ld.so can't find it, and hexagonrpcd +# dies at startup with "no libhexagonrpc.so" (which then takes iio-sensor-proxy +# down with it via Requires=). Cover both libdir spellings. +printf '/usr/local/lib\n/usr/local/lib64\n' > /etc/ld.so.conf.d/surface-pro-12-inch.conf +( + cd /tmp/harrisonvanderbyl/hexagonrpc + meson setup build + ninja -C build + ninja -C build install + ldconfig +) +( + cd /tmp/DylanVanAssche/libssc + meson setup _build + meson compile -C _build + meson install -C _build + ldconfig +) +( + cd /tmp/harrisonvanderbyl/iio-sensor-proxy + meson _build -Dssc-support=enabled -Dprefix=/usr + ninja -v -C _build install +) + +# Remove exactly what got newly installed since the snapshot above (compilers, +# -devel headers, alsatplg, and whatever they pulled in transitively). Anything +# that was already installed before -- because some other team/desktop profile +# in this same build wanted it, or it's part of the base image -- is left alone. +pkgs_new=$(comm -13 "$pkgs_before" <(rpm -qa --qf '%{NAME}\n' | sort)) +if [ -n "$pkgs_new" ]; then + dnf remove -y $pkgs_new +fi +rm -f "$pkgs_before" + +# UCM profiles read at runtime by the audio stack +dnf install -y alsa-ucm-utils + +install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service \ + /etc/systemd/system/hexagonrpc.service + +# iio-sensor-proxy keeps the unit its own build installed, and gets only the +# ordering against hexagonrpcd added on top. The drop-in is dead weight if that +# unit is not there, so check rather than let it pass silently. +test -f /usr/lib/systemd/system/iio-sensor-proxy.service +install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf \ + /etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf + +# Only hexagonrpcd is enabled statically. iio-sensor-proxy is started through +# its D-Bus name by whatever asks for net.hadess.SensorProxy, which then pulls +# hexagonrpc.service in through the drop-in above. +systemctl enable hexagonrpc.service + +# Cameras (msm/camss). Nothing has to be wired up at boot. libcamera's "simple" +# pipeline handler claims qcom-camss and builds the media graph itself in +# configure(), including flipping the csiphy -> msm_csid0 link between the rear +# ov13858 and the front ov02c10, so a media-ctl unit only fights it: pinning +# csid0 to the rear sensor at boot leaves the front camera disconnected until +# something re-links it, and the formats such a unit has to guess are what made +# the old wireupcameras.service die with "Unable to setup formats: Invalid +# argument (22)" on every boot. +# +# v4l-utils stays, for inspecting the graph by hand -- media-ctl -p, and +# v4l2-ctl --stream-mmap on the RDI node to check the sensor below libcamera. +dnf install -y v4l-utils + +# The front ov02c10 needs a libcamera that knows its analogue gain model and +# black level; upstream libcamera has neither, and there is no plugin mechanism +# for them, but kernel-sp12in repo offers libcamera with supported models. +# Pulled in by name because it would otherwise only arrive as a dependency, +# which makes it easy to lose without noticing. +dnf install -y libcamera libcamera-ipa + +libcamera_nevra=$(rpm -q libcamera) +case "${libcamera_nevra}" in + *.sp12in*) printf 'Using %s\n' "${libcamera_nevra}" ;; + *) + printf 'Error: %s is Fedora'"'"'s libcamera, not the sp12in rebuild.\n' \ + "${libcamera_nevra}" >&2 + printf 'Fedora has probably bumped the release past the rebuild; rebase\n' >&2 + printf 'patches/ in ../libcamera and tag a new release suffix.\n' >&2 + exit 1 + ;; +esac + +# Hardware video decode needs firmware this image is not allowed to carry. The +# qcom/vpu/vpu30_p1_s7.mbn in linux-firmware is the same codec signed with +# Qualcomm's SecTools test keys, which a retail Surface's TrustZone rejects, and +# the production-signed build exists only inside Microsoft's Surface driver +# package, under terms that grant no redistribution right. +# +# So the image ships the means rather than the blob: a script that copies it out +# of a Windows install the owner already has a licence for, and a unit that runs +# that once on a dual-boot machine. Where Windows is gone, the script says which +# driver pack to download and how to point it at one. +dnf install -y msitools +install -Dm755 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh \ + /usr/local/bin/surface-video-firmware.sh +install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service \ + /etc/systemd/system/surface-video-firmware.service +systemctl enable surface-video-firmware.service + +# Suspend on Snapdragon is still very unstable. This is the reason why +# 'mem_sleep_default=s2idle' is set explicitly in the cmdline as 'deep' mode +# does not function at all. +# Even then, suspending via gnome settings daemon results in hard freeze. +# This is why: +# logind behavior is kept intact with suspend behavior. +# gnome default power button behavior was replaced with 'interactive'. +install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/logind.conf.d/60-surface-power-key.conf \ + /etc/systemd/logind.conf.d/60-surface-power-key.conf +install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/db/local.d/00-power-button \ + /etc/dconf/db/local.d/00-power-button +install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/profile/user \ + /etc/dconf/profile/user + +dconf update + +restorecon -Rv /usr /lib /etc/systemd /etc/dconf /etc/udev/rules.d /etc/yum.repos.d + +#====================================== +# Set the WSL name for ELN +#-------------------------------------- +if [[ "$kiwi_profiles" == *"WSL"* ]] && [[ "$kiwi_iname" == *"ELN"* ]]; then +wsl-setup --name Fedora-ELN +fi + +#====================================== +# Finalization steps +#-------------------------------------- +# Inhibit the ldconfig cache generation unit, see rhbz2348669 +touch -r "/usr" "/etc/.updated" "/var/.updated" + +if [[ "$kiwi_profiles" == *"FEX"* ]]; then + # Remove most things except libraries used by FEX and wine stuff. + # Most binaries that are present in non-x86 architectures should be removed, + # so they do not run under emulation. + + # rm mingw static libs and headers + rm -rf /usr/{x86_64,i686}-w64-mingw32/sys-root/mingw/{lib,include} + + # rm everything in libexec + rm -rf /usr/libexec + + # rm everything in /usr/share except wine and mesa related stuff + find /usr/share -mindepth 1 -maxdepth 1 \ + \! -name wine -a \ + \! -name mesa-demos -a \ + \! -name drirc.d -a \ + \! -name vulkan \ + \! -name licenses \ + -exec rm -rf {} \; + + # rm everything in /etc except /etc/alternatives and ld stuff + find /etc -mindepth 1 -maxdepth 1 \ + \! -name alternatives -a \ + \! -name 'ld.so*' -a \ + \! -name '*.kiwi' \ + -exec rm -rf {} \; + + # rm non-libs in lib/lib64 + rm -rf /usr/{lib,lib64}/{locale,tmpfiles.d,systemd,modprobe.d,kbd,cmake} + rm -rf /usr/{lib,lib64}/python* + + # lib/clc and lib64/clc are identical, replace with a symlink + rm -rf /usr/lib/clc + ln -s ../lib64/clc /usr/lib/clc + + # rm sbin except for ldconfig, we don't even have root in some setups + find /usr/sbin -mindepth 1 -maxdepth 1 \ + \! -name 'ldconfig' \ + -exec rm -rf {} \; + + # rm misc stuff + rm -rf /usr/{include,games,local,src,tmp} + + # Finally, remove most binaries except Wine stuff, Mesa stuff, the shell, + # path-related stuff, and system info tools. + find /usr/bin -mindepth 1 -maxdepth 1 \ + \! -name 'wine*' -a \ + \! -name 'mango*' -a \ + \! -name notepad -a \ + \! -name 'msi*' -a \ + \! -name regedit -a \ + \! -name regsvr32 -a \ + \! -name 'vulkan*' -a \ + \! -name 'vk*' -a \ + \! -name clinfo -a \ + \! -name eglinfo -a \ + \! -name glxinfo -a \ + \! -name ulimit -a \ + \! -name ldd -a \ + \! -name env -a \ + \! -name sh -a \ + \! -name bash -a \ + \! -name ls -a \ + \! -name stat -a \ + \! -name dirname -a \ + \! -name realpath -a \ + \! -name readlink -a \ + \! -name basename -a \ + \! -name nproc -a \ + \! -name uname -a \ + \! -name arch -a \ + \! -name rm \ + -exec rm -rf {} \; + + # Do this last for obvious reasons. + rm /usr/bin/rm +fi + +rm -rf /tmp/* + exit 0 |