diff --git a/.github/workflows/daily-8.1.yml b/.github/workflows/daily-8.1.yml
deleted file mode 100644
index a68938412..000000000
--- a/.github/workflows/daily-8.1.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-name: Daily OS 8
-
-on:
- push:
- branches:
- - main
- schedule:
- - cron: "0 0 * * *"
- workflow_dispatch: {}
-
-jobs:
- build:
- strategy:
- fail-fast: false
- matrix:
- include:
- - runner: ubuntu-24.04
- arch: amd64
- - runner: ubuntu-24.04-arm
- arch: arm64
- runs-on: ${{ matrix.runner }}
-
- container:
- image: debian:latest
- volumes:
- - /proc:/proc
- options: --privileged
-
- steps:
- - name: Clone build scripts
- uses: actions/checkout@v7
-
- - name: Build and upload daily .iso
- run: |
- ./workflows.sh etc/terraform-daily-8.1-azure-${{ matrix.arch }}.conf "${{ secrets.key }}" "${{ secrets.secret }}" "${{ secrets.endpoint }}" "${{ secrets.bucket }}"
diff --git a/.github/workflows/daily-9.0.yml b/.github/workflows/monthly-image-9.0.yml
similarity index 61%
rename from .github/workflows/daily-9.0.yml
rename to .github/workflows/monthly-image-9.0.yml
index da2db2704..8ec711f96 100644
--- a/.github/workflows/daily-9.0.yml
+++ b/.github/workflows/monthly-image-9.0.yml
@@ -1,11 +1,11 @@
-name: Daily OS 9
+name: Monthly Image-based OS 9
on:
push:
branches:
- main
schedule:
- - cron: "0 0 * * *"
+ - cron: "0 0 1 * *"
workflow_dispatch: {}
jobs:
@@ -30,6 +30,10 @@ jobs:
- name: Clone build scripts
uses: actions/checkout@v7
- - name: Build and upload daily .iso
+ - name: Build
run: |
- ./workflows.sh etc/terraform-daily-9.0-azure-${{ matrix.arch }}.conf "${{ secrets.key }}" "${{ secrets.secret }}" "${{ secrets.endpoint }}" "${{ secrets.bucket }}"
+ ./build.sh etc/terraform-daily-9.0-azure-${{ matrix.arch }}.conf
+
+ - name: Upload
+ run: |
+ ./upload.sh "${{ secrets.key }}" "${{ secrets.secret }}" "${{ secrets.endpoint }}" "${{ secrets.bucket }}" "${{ secrets.install_bucket }}"
diff --git a/.github/workflows/stable-8.1.yml b/.github/workflows/stable-8.1.yml
deleted file mode 100644
index 70a5d57e6..000000000
--- a/.github/workflows/stable-8.1.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-name: Stable OS 8
-
-on:
- push:
- tags:
- - "*"
- schedule:
- - cron: "0 0 1 * *"
- workflow_dispatch: {}
-
-jobs:
- build:
- strategy:
- fail-fast: false
- matrix:
- include:
- - runner: ubuntu-24.04
- arch: amd64
- - runner: ubuntu-24.04-arm
- arch: arm64
- runs-on: ${{ matrix.runner }}
-
- container:
- image: debian:latest
- volumes:
- - /proc:/proc
- options: --privileged
-
- steps:
- - name: Clone build scripts
- uses: actions/checkout@v7
-
- - name: Build and upload stable .iso
- run: |
- ./workflows.sh etc/terraform-stable-8.1-azure-${{ matrix.arch }}.conf "${{ secrets.key }}" "${{ secrets.secret }}" "${{ secrets.endpoint }}" "${{ secrets.bucket }}"
diff --git a/.gitignore b/.gitignore
index 5dce753a5..3ecf0a0b2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,19 @@
-.DS_Store
-tmp
-artifacts
-builds
-*~
\ No newline at end of file
+cosign.key
+**/cosign.key
+cache
+_build_*
+output
+_build-*/**
+*.img
+*.raw
+mkosi.local/
+mkosi.local.conf
+mkosi.output/
+mkosi.cache/
+mkosi.tools/
+mkosi.tools.manifest
+mkosi.key
+mkosi.crt
+mkosi.version
+mkosi.rootpw
+.mkosi-private
\ No newline at end of file
diff --git a/Justfile b/Justfile
new file mode 100644
index 000000000..161add7b8
--- /dev/null
+++ b/Justfile
@@ -0,0 +1,42 @@
+alias serve := start-sysupdate-server
+
+default:
+ #!/usr/bin/env bash
+ set -xeuo pipefail
+ just build-sysupdate
+
+lazy-spin:
+ just _gen_keys
+ just build-sysupdate
+
+build-sysupdate:
+ mkosi build --debug --force --profile=sysupdate && \
+ just sign-repo
+
+# resize:
+# qemu-img resize ./mkosi.output/Elementary_x86-64.raw +40G
+
+_gen_keys:
+ mkosi genkey || true
+
+
+clean:
+ mkosi clean
+ sudo rm -r mkosi.tools/ mkosi.cache/
+
+start-sysupdate-server:
+ #!/usr/bin/env bash
+ just sign-repo && \
+ python -m http.server -d mkosi.output 7676
+
+sign-repo:
+ #!/usr/bin/env bash
+ cd mkosi.output
+ echo "Repo will not be signed, use verify=no."
+ echo "Generating SHA256..."
+ sha256sum Elementary_*_x86-64.usr-x86-64-verity-sig.*.raw \
+ Elementary_*_x86-64.usr-x86-64-verity.*.raw \
+ Elementary_*_x86-64.usr-x86-64.*.raw \
+ Elementary_*_x86-64.efi \
+ > SHA256SUMS
+ cd ..
\ No newline at end of file
diff --git a/LICENSE b/LICENSE
index 94a9ed024..87b23a248 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,674 +1,12 @@
- GNU GENERAL PUBLIC LICENSE
- Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc.
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
- Preamble
-
- The GNU General Public License is a free, copyleft license for
-software and other kinds of works.
-
- The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works. By contrast,
-the GNU General Public License is intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users. We, the Free Software Foundation, use the
-GNU General Public License for most of our software; it applies also to
-any other work released this way by its authors. You can apply it to
-your programs, too.
-
- When we speak of free software, we are referring to freedom, not
-price. Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
- To protect your rights, we need to prevent others from denying you
-these rights or asking you to surrender the rights. Therefore, you have
-certain responsibilities if you distribute copies of the software, or if
-you modify it: responsibilities to respect the freedom of others.
-
- For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must pass on to the recipients the same
-freedoms that you received. You must make sure that they, too, receive
-or can get the source code. And you must show them these terms so they
-know their rights.
-
- Developers that use the GNU GPL protect your rights with two steps:
-(1) assert copyright on the software, and (2) offer you this License
-giving you legal permission to copy, distribute and/or modify it.
-
- For the developers' and authors' protection, the GPL clearly explains
-that there is no warranty for this free software. For both users' and
-authors' sake, the GPL requires that modified versions be marked as
-changed, so that their problems will not be attributed erroneously to
-authors of previous versions.
-
- Some devices are designed to deny users access to install or run
-modified versions of the software inside them, although the manufacturer
-can do so. This is fundamentally incompatible with the aim of
-protecting users' freedom to change the software. The systematic
-pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable. Therefore, we
-have designed this version of the GPL to prohibit the practice for those
-products. If such problems arise substantially in other domains, we
-stand ready to extend this provision to those domains in future versions
-of the GPL, as needed to protect the freedom of users.
-
- Finally, every program is threatened constantly by software patents.
-States should not allow patents to restrict development and use of
-software on general-purpose computers, but in those that do, we wish to
-avoid the special danger that patents applied to a free program could
-make it effectively proprietary. To prevent this, the GPL assures that
-patents cannot be used to render the program non-free.
-
- The precise terms and conditions for copying, distribution and
-modification follow.
-
- TERMS AND CONDITIONS
-
- 0. Definitions.
-
- "This License" refers to version 3 of the GNU General Public License.
-
- "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
- "The Program" refers to any copyrightable work licensed under this
-License. Each licensee is addressed as "you". "Licensees" and
-"recipients" may be individuals or organizations.
-
- To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy. The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
- A "covered work" means either the unmodified Program or a work based
-on the Program.
-
- To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy. Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
- To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies. Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
- An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License. If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
- 1. Source Code.
-
- The "source code" for a work means the preferred form of the work
-for making modifications to it. "Object code" means any non-source
-form of a work.
-
- A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
- The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form. A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
- The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities. However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work. For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
- The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
- The Corresponding Source for a work in source code form is that
-same work.
-
- 2. Basic Permissions.
-
- All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met. This License explicitly affirms your unlimited
-permission to run the unmodified Program. The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work. This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
- You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force. You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright. Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
- Conveying under any other circumstances is permitted solely under
-the conditions stated below. Sublicensing is not allowed; section 10
-makes it unnecessary.
-
- 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
- No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
- When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
- 4. Conveying Verbatim Copies.
-
- You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
- You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
- 5. Conveying Modified Source Versions.
-
- You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
- a) The work must carry prominent notices stating that you modified
- it, and giving a relevant date.
-
- b) The work must carry prominent notices stating that it is
- released under this License and any conditions added under section
- 7. This requirement modifies the requirement in section 4 to
- "keep intact all notices".
-
- c) You must license the entire work, as a whole, under this
- License to anyone who comes into possession of a copy. This
- License will therefore apply, along with any applicable section 7
- additional terms, to the whole of the work, and all its parts,
- regardless of how they are packaged. This License gives no
- permission to license the work in any other way, but it does not
- invalidate such permission if you have separately received it.
-
- d) If the work has interactive user interfaces, each must display
- Appropriate Legal Notices; however, if the Program has interactive
- interfaces that do not display Appropriate Legal Notices, your
- work need not make them do so.
-
- A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit. Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
- 6. Conveying Non-Source Forms.
-
- You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
- a) Convey the object code in, or embodied in, a physical product
- (including a physical distribution medium), accompanied by the
- Corresponding Source fixed on a durable physical medium
- customarily used for software interchange.
-
- b) Convey the object code in, or embodied in, a physical product
- (including a physical distribution medium), accompanied by a
- written offer, valid for at least three years and valid for as
- long as you offer spare parts or customer support for that product
- model, to give anyone who possesses the object code either (1) a
- copy of the Corresponding Source for all the software in the
- product that is covered by this License, on a durable physical
- medium customarily used for software interchange, for a price no
- more than your reasonable cost of physically performing this
- conveying of source, or (2) access to copy the
- Corresponding Source from a network server at no charge.
-
- c) Convey individual copies of the object code with a copy of the
- written offer to provide the Corresponding Source. This
- alternative is allowed only occasionally and noncommercially, and
- only if you received the object code with such an offer, in accord
- with subsection 6b.
-
- d) Convey the object code by offering access from a designated
- place (gratis or for a charge), and offer equivalent access to the
- Corresponding Source in the same way through the same place at no
- further charge. You need not require recipients to copy the
- Corresponding Source along with the object code. If the place to
- copy the object code is a network server, the Corresponding Source
- may be on a different server (operated by you or a third party)
- that supports equivalent copying facilities, provided you maintain
- clear directions next to the object code saying where to find the
- Corresponding Source. Regardless of what server hosts the
- Corresponding Source, you remain obligated to ensure that it is
- available for as long as needed to satisfy these requirements.
-
- e) Convey the object code using peer-to-peer transmission, provided
- you inform other peers where the object code and Corresponding
- Source of the work are being offered to the general public at no
- charge under subsection 6d.
-
- A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
- A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling. In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage. For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product. A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
- "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source. The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
- If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information. But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
- The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed. Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
- Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
- 7. Additional Terms.
-
- "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law. If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
- When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it. (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.) You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
- Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
- a) Disclaiming warranty or limiting liability differently from the
- terms of sections 15 and 16 of this License; or
-
- b) Requiring preservation of specified reasonable legal notices or
- author attributions in that material or in the Appropriate Legal
- Notices displayed by works containing it; or
-
- c) Prohibiting misrepresentation of the origin of that material, or
- requiring that modified versions of such material be marked in
- reasonable ways as different from the original version; or
-
- d) Limiting the use for publicity purposes of names of licensors or
- authors of the material; or
-
- e) Declining to grant rights under trademark law for use of some
- trade names, trademarks, or service marks; or
-
- f) Requiring indemnification of licensors and authors of that
- material by anyone who conveys the material (or modified versions of
- it) with contractual assumptions of liability to the recipient, for
- any liability that these contractual assumptions directly impose on
- those licensors and authors.
-
- All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10. If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term. If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
- If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
- Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
- 8. Termination.
-
- You may not propagate or modify a covered work except as expressly
-provided under this License. Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
- However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
- Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
- Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License. If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
- 9. Acceptance Not Required for Having Copies.
-
- You are not required to accept this License in order to receive or
-run a copy of the Program. Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance. However,
-nothing other than this License grants you permission to propagate or
-modify any covered work. These actions infringe copyright if you do
-not accept this License. Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
- 10. Automatic Licensing of Downstream Recipients.
-
- Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License. You are not responsible
-for enforcing compliance by third parties with this License.
-
- An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations. If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
- You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License. For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
- 11. Patents.
-
- A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based. The
-work thus licensed is called the contributor's "contributor version".
-
- A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version. For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
- Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
- In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement). To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
- If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients. "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
- If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
- A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License. You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
- Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
- 12. No Surrender of Others' Freedom.
-
- If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License. If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all. For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
- 13. Use with the GNU Affero General Public License.
-
- Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU Affero General Public License into a single
-combined work, and to convey the resulting work. The terms of this
-License will continue to apply to the part which is the covered work,
-but the special requirements of the GNU Affero General Public License,
-section 13, concerning interaction through a network will apply to the
-combination as such.
-
- 14. Revised Versions of this License.
-
- The Free Software Foundation may publish revised and/or new versions of
-the GNU General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
- Each version is given a distinguishing version number. If the
-Program specifies that a certain numbered version of the GNU General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation. If the Program does not specify a version number of the
-GNU General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
- If the Program specifies that a proxy can decide which future
-versions of the GNU General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
- Later license versions may give you additional or different
-permissions. However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
- 15. Disclaimer of Warranty.
-
- THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
- 16. Limitation of Liability.
-
- IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
- 17. Interpretation of Sections 15 and 16.
-
- If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
- END OF TERMS AND CONDITIONS
-
- How to Apply These Terms to Your New Programs
-
- If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
- To do so, attach the following notices to the program. It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-
- Copyright (C)
-
- This program is free software: you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation, either version 3 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program. If not, see .
-
-Also add information on how to contact you by electronic and paper mail.
-
- If the program does terminal interaction, make it output a short
-notice like this when it starts in an interactive mode:
-
- Copyright (C)
- This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
- This is free software, and you are welcome to redistribute it
- under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License. Of course, your program's commands
-might be different; for a GUI interface, you would use an "about box".
-
- You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU GPL, see
-.
-
- The GNU General Public License does not permit incorporating your program
-into proprietary programs. If your program is a subroutine library, you
-may consider it more useful to permit linking proprietary applications with
-the library. If this is what you want to do, use the GNU Lesser General
-Public License instead of this License. But first, please read
-.
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program. If not, see .
\ No newline at end of file
diff --git a/README.md b/README.md
index 119becb62..cbad8aa18 100644
--- a/README.md
+++ b/README.md
@@ -24,21 +24,26 @@
## Building Locally
-As elementary OS is built with the Debian version of `live-build`, not the Ubuntu patched version, it's easiest to build an elementary .iso in a Debian VM or container. This prevents messing up your host system too.
+1. Install `mkosi`, `just`, `fzf`
+2. Generate keys `just _gen_keys`
+3. Build `just build-sysupdate`
-The following example assumes you have Docker correctly installed and set up, and that your current working directory is this repo. When done, your image will be in the `builds` folder.
+### Run with qemu
-Configure the channel (stable, daily) in the configuration file (`etc/terraform-amd64.conf` or `etc/terraform-arm64.conf` based on your host architecture), then run:
+- Resize with `qemu-img resize "$(ls mkosi.output/Elementary_*_x86-64.raw)" +40G`, and you can then directly boot the .raw image with qemu or VirtManager/libvirt.
+- Make sure to have TPM and UEFI enabled in libvirt (Gnome Boxes won't work - doesn't support TPM).
-```sh
-docker run --rm --privileged -it \
- -v /proc:/proc \
- -v ${PWD}:/working_dir \
- -w /working_dir \
- debian:latest \
- ./build.sh
-```
-## Further Information
+### Install / run on baremetal
-More information about the concepts behind `live-build` and the technical decisions made to arrive at this set of tools to build an .iso can be found [on the wiki](https://github.com/elementary/os/wiki/Building-iso-Images).
+Copy the main .raw file to a 40+ GB USB stick with one of the options below. It will then expand and be bootable. Note: Don't run this after resizing for qemu or your image will be the wrong shape.
+
+`sudo dd if="$(ls mkosi.output/Elementary_*_x86-64.raw)" of=/dev/sdX bs=4M status=progress conv=fsync` where X is your usb drive on /dev/sda, etc
+
+or
+
+`sudo mkosi burn /dev/sdX` where X is your usb drive on /dev/sda, etc
+
+or
+
+Fedora Media Writer, etc.
diff --git a/build.sh b/build.sh
old mode 100755
new mode 100644
index 71596c5bd..9d8705fbf
--- a/build.sh
+++ b/build.sh
@@ -2,94 +2,4 @@
set -e
-# check for root permissions
-if [[ "$(id -u)" != 0 ]]; then
- echo "E: Requires root permissions" > /dev/stderr
- exit 1
-fi
-
-# get config
-if [ -n "$1" ]; then
- CONFIG_FILE="$1"
-else
- CONFIG_FILE="etc/terraform-$(dpkg --print-architecture).conf"
-fi
-BASE_DIR="$PWD"
-source "$BASE_DIR"/"$CONFIG_FILE"
-
-echo -e "
-#----------------------#
-# INSTALL DEPENDENCIES #
-#----------------------#
-"
-
-apt-get update
-apt-get install -y live-build patch gnupg2 binutils zstd
-
-# The Debian repositories don't seem to have the `ubuntu-keyring` or `ubuntu-archive-keyring` packages
-# anymore, so we add the archive keys manually. This may need to be updated if Ubuntu changes their signing keys
-# To get the current key ID, find `ubuntu-keyring-xxxx-archive.gpg` in /etc/apt/trusted.gpg.d on a running
-# system and run `gpg --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-xxxx-archive.gpg --list-public-keys `
-gpg --homedir /tmp --no-default-keyring --keyring /etc/apt/trusted.gpg --recv-keys --keyserver keyserver.ubuntu.com F6ECB3762474EDA9D21B7022871920D1991BC93C
-
-# TODO: Remove this once debootstrap can natively build resolute images:
-ln -sfn /usr/share/debootstrap/scripts/gutsy /usr/share/debootstrap/scripts/resolute
-
-build () {
- BUILD_ARCH="$1"
-
- mkdir -p "$BASE_DIR/tmp/$BUILD_ARCH"
- cd "$BASE_DIR/tmp/$BUILD_ARCH" || exit
-
- # remove old configs and copy over new
- rm -rf config auto
- cp -r "$BASE_DIR"/etc/* .
- # Make sure conffile specified as arg has correct name
- cp -f "$BASE_DIR"/"$CONFIG_FILE" terraform.conf
-
- echo -e "
-#------------------#
-# LIVE-BUILD CLEAN #
-#------------------#
-"
- lb clean
-
- echo -e "
-#-------------------#
-# LIVE-BUILD CONFIG #
-#-------------------#
-"
- lb config
-
- echo -e "
-#------------------#
-# LIVE-BUILD BUILD #
-#------------------#
-"
- lb build
-
- echo -e "
-#---------------------------#
-# MOVE OUTPUT TO BUILDS DIR #
-#---------------------------#
-"
-
- YYYYMMDD="$(date +%Y%m%d)"
- OUTPUT_DIR="$BASE_DIR/builds/$BUILD_ARCH"
- mkdir -p "$OUTPUT_DIR"
- FNAME="elementaryos-$VERSION-$CHANNEL-$BUILD_ARCH.$YYYYMMDD$OUTPUT_SUFFIX"
- mv "$BASE_DIR/tmp/$BUILD_ARCH/live-image-$BUILD_ARCH.hybrid.iso" "$OUTPUT_DIR/${FNAME}.iso"
-
- # cd into output to so {FNAME}.sha256.txt only
- # includes the filename and not the path to
- # our file.
- cd $OUTPUT_DIR
- md5sum "${FNAME}.iso" | tee "${FNAME}.md5.txt"
- sha256sum "${FNAME}.iso" | tee "${FNAME}.sha256.txt"
- cd $BASE_DIR
-}
-
-# remove old builds before creating new ones
-rm -rf "$BASE_DIR"/builds
-
-build "$ARCH"
+mkosi -B --debug --force --profile=sysupdate
diff --git a/cosign.pub b/cosign.pub
new file mode 100644
index 000000000..34b63aca0
--- /dev/null
+++ b/cosign.pub
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEO/99O5B1Vc8ykZo5jF4MF1PT0VdQ
+mUFtSTST3FFvWbVKfHpgLaxoLCialVduO1EKwhnbESPfV7fcpLGFe0IsLA==
+-----END PUBLIC KEY-----
diff --git a/etc/auto/config b/etc/auto/config
deleted file mode 100755
index 94ff1b5df..000000000
--- a/etc/auto/config
+++ /dev/null
@@ -1,75 +0,0 @@
-#!/bin/sh
-
-set -e
-
-. ./terraform.conf
-
-if [ "$HWE_KERNEL" = "yes" ]; then
- KERNEL_FLAVORS="generic-hwe-${BASEVERSION}"
-else
- KERNEL_FLAVORS="generic"
-fi
-
-if [ "$HWE_X11" = "yes" ]; then
- XORG_HWE="xserver-xorg-hwe-${BASEVERSION}"
-fi
-
-case "$ARCH" in
- amd64|i386)
- MIRROR_BINARY_URL="http://archive.ubuntu.com/ubuntu/"
- MIRROR_BINARY_SECURITY_URL="http://security.ubuntu.com/ubuntu/"
- ;;
- arm64)
- MIRROR_BINARY_URL="http://ports.ubuntu.com/ubuntu-ports/"
- MIRROR_BINARY_SECURITY_URL="http://ports.ubuntu.com/ubuntu-ports/"
- ;;
-esac
-
-lb config noauto \
- --architectures "$ARCH" \
- --mode debian \
- --initramfs none \
- --distribution "$BASECODENAME" \
- --parent-distribution "$BASECODENAME" \
- --archive-areas "main restricted universe multiverse" \
- --parent-archive-areas "main restricted universe multiverse" \
- --linux-packages linux-image \
- --linux-flavours "$KERNEL_FLAVORS" \
- --bootappend-live "boot=casper maybe-ubiquity quiet splash" \
- --debootstrap-options="--extractor=ar --keyring=/etc/apt/trusted.gpg" \
- --checksums md5 \
- --mirror-bootstrap "$MIRROR_URL" \
- --parent-mirror-bootstrap "$MIRROR_URL" \
- --mirror-chroot-security "$MIRROR_BINARY_SECURITY_URL" \
- --parent-mirror-chroot-security "$MIRROR_BINARY_SECURITY_URL" \
- --mirror-binary-security "$MIRROR_BINARY_SECURITY_URL" \
- --parent-mirror-binary-security "$MIRROR_BINARY_SECURITY_URL" \
- --mirror-binary "$MIRROR_BINARY_URL" \
- --parent-mirror-binary "$MIRROR_BINARY_URL" \
- --keyring-packages ubuntu-keyring \
- --apt-options "--yes --option Acquire::Retries=2 --option Acquire::http::Timeout=45" \
- --cache-packages false \
- --uefi-secure-boot enable \
- --binary-images iso-hybrid \
- --iso-application "$NAME" \
- --iso-volume "$NAME" \
- --firmware-binary false \
- --firmware-chroot false \
- --zsync false \
- --security true \
- "${@}"
-
-# replace channel and suite
-sed -i "s/@CHANNEL/$CHANNEL/" config/archives/*.list*
-sed -i "s/@BASECODENAME/$BASECODENAME/" config/archives/*.list*
-
-DATE=$(date +%Y%m%d)
-sed -i "s/@CHANNEL/$CHANNEL/" config/includes.binary/.disk/info
-sed -i "s/@CODENAME/$CODENAME/" config/includes.binary/.disk/info
-sed -i "s/@ARCH/$ARCH/" config/includes.binary/.disk/info
-sed -i "s/@DISTRO_NAME/$NAME/" config/includes.binary/.disk/info
-sed -i "s/@VERSION/$VERSION/" config/includes.binary/.disk/info
-sed -i "s/@DATE/$DATE/" config/includes.binary/.disk/info
-
-sed -i "s/@XORG_HWE/$XORG_HWE/" config/package-lists/desktop.list.chroot_install
-sed -i "s/@KERNEL_HEADERS/linux-headers-$KERNEL_FLAVORS/" config/package-lists/desktop.list.chroot_install
diff --git a/etc/config/archives/elementary.key b/etc/config/archives/elementary.key
deleted file mode 100644
index 56323a415..000000000
--- a/etc/config/archives/elementary.key
+++ /dev/null
@@ -1,31 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: Hockeypuck 2.2
-
-xsFNBGY0W70BEACjPRVK1K0yzj/TPI4AOEfjUFO7w4VHDBXV6tYo/jqjlqXNsnlh
-m2Ou+V6RvJUHvX7OBZIzXWaDnlYeLAho34nF82NV8SoZt6n8YvhKGg3sCqpfDxG2
-ZlsW/N3r1BH/o7bUiLrHmcT0e13qoH2qh0aZrkH6PdNSdxtoe74RNDJM3r5UKWY7
-sailTDftcLhM7pVgK4yno80JVIgWmaW6qg+/UpkF24gHuN9XDXsD4u8ppwRuZA1e
-FPWtlZhh6mkZwoKW+G3geVt5pyztm9wD25eGq5NfqbSkyCWtQuZtF2oG2KQV/qTI
-2Ga8J7lHXraaS+UGmh++AOSj4o0OkeutwFsBRAfJhWusY9etCGnY5+S4CB9ElJqd
-m9pSHrjQtjEtGRP0iDXGVR1m+15fkBcU70cp3IIkxKhcojOJmMhpc5e3H184dB8k
-0GarxMdMPCmABqNfTZa/RTBPvVQoC30TRlTsYDlBzsAtKxZ+HLrJ+KRuKjoisBTD
-zDeGRtLf+Q3gHF8LE8FmkKrDouR8QBL1U6BSev49XZnsB8m1IYH8fLY9ItuyPsjU
-myn4OBongmV3aSDkRNLjit5DOaCuSH7R6AtEGn4PHCBOq15tvGP/Jr73+QPii9RF
-8dH3xiIkSloB1dFOBJ9+kQokO1LoQOsKkYpF+98vmqJ9jsJy/hBqlmifsQARAQAB
-zSRMYXVuY2hwYWQgUFBBIGZvciBlbGVtZW50YXJ5IE9TIHRlYW3CwY4EEwEKADgW
-IQQ2SDfPkeBwkQIxwv6CGbOgrvPUmAUCZjRbvQIbAwULCQgHAgYVCgkICwIEFgID
-AQIeAQIXgAAKCRCCGbOgrvPUmFPmD/9R76nz346nc3jiEBuQDalV562Y7V16jITQ
-T0cQa1J0F1OivPkKKuiNYpstuAK88xoCSV7U50edVtWWMCqMQXAYzpwsIiNWaRV6
-9Z/c7xQnV0MIPVUaoKK6tFNANtRGApjjzkl+F5jQkgTzWOrJzfInj7n/QrkCIGfI
-GR6QXjeM/PcwmMCC7z5OiBi0YPG0SrNQcdDvCZffpppYMYndXZA4huc27ELjVNKS
-SbdWxczMRi/SpPqBount03DfbHAR7oNpXQwIvgUZ8BMKNJ3kVWLMS/qhbpMVLzPy
-E3c62kMkeX5i6BTAfxfdZOZgqSs+pELg4uBeuDdGO1ivlbCgnTnaqeKMcuX9b2s3
-qHjToNiub9JsjpP/q6EpfBVkF5ftdGLZ864EYup4df/BEGjxbYnenifaOFTLpb+K
-ncB3ZNAbkK80+7HrYbd61e2dZWWt6N0IrUllF/GoJPC8trUNoSDtZo8wVOQ7OHG7
-BmPmjwsj6Mf8I6wEjnKK/Lp1l+EVtnOIILypbHwiyaIsBbZJVSS/DaqQQoZyyp+u
-mb4mULGwDdMA7O+785Ktc3V2+tijgSSa7H21UOcoj0gDUe6IffmNs0C6P6e5LhHg
-xqbXPFit+vPyW19q9e+eILGLqKb2biCmApJyDKMKRPjAdL+c7c3C2CJeimp0eZuq
-QQ2R1C+7Og==
-=ivCt
------END PGP PUBLIC KEY BLOCK-----
-
diff --git a/etc/config/archives/elementary.list b/etc/config/archives/elementary.list
deleted file mode 100644
index fc715b7da..000000000
--- a/etc/config/archives/elementary.list
+++ /dev/null
@@ -1,3 +0,0 @@
-deb https://ppa.launchpadcontent.net/elementary-os/@CHANNEL/ubuntu @BASECODENAME main
-deb-src https://ppa.launchpadcontent.net/elementary-os/@CHANNEL/ubuntu @BASECODENAME main
-
diff --git a/etc/config/archives/patches.key b/etc/config/archives/patches.key
deleted file mode 100644
index 56323a415..000000000
--- a/etc/config/archives/patches.key
+++ /dev/null
@@ -1,31 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: Hockeypuck 2.2
-
-xsFNBGY0W70BEACjPRVK1K0yzj/TPI4AOEfjUFO7w4VHDBXV6tYo/jqjlqXNsnlh
-m2Ou+V6RvJUHvX7OBZIzXWaDnlYeLAho34nF82NV8SoZt6n8YvhKGg3sCqpfDxG2
-ZlsW/N3r1BH/o7bUiLrHmcT0e13qoH2qh0aZrkH6PdNSdxtoe74RNDJM3r5UKWY7
-sailTDftcLhM7pVgK4yno80JVIgWmaW6qg+/UpkF24gHuN9XDXsD4u8ppwRuZA1e
-FPWtlZhh6mkZwoKW+G3geVt5pyztm9wD25eGq5NfqbSkyCWtQuZtF2oG2KQV/qTI
-2Ga8J7lHXraaS+UGmh++AOSj4o0OkeutwFsBRAfJhWusY9etCGnY5+S4CB9ElJqd
-m9pSHrjQtjEtGRP0iDXGVR1m+15fkBcU70cp3IIkxKhcojOJmMhpc5e3H184dB8k
-0GarxMdMPCmABqNfTZa/RTBPvVQoC30TRlTsYDlBzsAtKxZ+HLrJ+KRuKjoisBTD
-zDeGRtLf+Q3gHF8LE8FmkKrDouR8QBL1U6BSev49XZnsB8m1IYH8fLY9ItuyPsjU
-myn4OBongmV3aSDkRNLjit5DOaCuSH7R6AtEGn4PHCBOq15tvGP/Jr73+QPii9RF
-8dH3xiIkSloB1dFOBJ9+kQokO1LoQOsKkYpF+98vmqJ9jsJy/hBqlmifsQARAQAB
-zSRMYXVuY2hwYWQgUFBBIGZvciBlbGVtZW50YXJ5IE9TIHRlYW3CwY4EEwEKADgW
-IQQ2SDfPkeBwkQIxwv6CGbOgrvPUmAUCZjRbvQIbAwULCQgHAgYVCgkICwIEFgID
-AQIeAQIXgAAKCRCCGbOgrvPUmFPmD/9R76nz346nc3jiEBuQDalV562Y7V16jITQ
-T0cQa1J0F1OivPkKKuiNYpstuAK88xoCSV7U50edVtWWMCqMQXAYzpwsIiNWaRV6
-9Z/c7xQnV0MIPVUaoKK6tFNANtRGApjjzkl+F5jQkgTzWOrJzfInj7n/QrkCIGfI
-GR6QXjeM/PcwmMCC7z5OiBi0YPG0SrNQcdDvCZffpppYMYndXZA4huc27ELjVNKS
-SbdWxczMRi/SpPqBount03DfbHAR7oNpXQwIvgUZ8BMKNJ3kVWLMS/qhbpMVLzPy
-E3c62kMkeX5i6BTAfxfdZOZgqSs+pELg4uBeuDdGO1ivlbCgnTnaqeKMcuX9b2s3
-qHjToNiub9JsjpP/q6EpfBVkF5ftdGLZ864EYup4df/BEGjxbYnenifaOFTLpb+K
-ncB3ZNAbkK80+7HrYbd61e2dZWWt6N0IrUllF/GoJPC8trUNoSDtZo8wVOQ7OHG7
-BmPmjwsj6Mf8I6wEjnKK/Lp1l+EVtnOIILypbHwiyaIsBbZJVSS/DaqQQoZyyp+u
-mb4mULGwDdMA7O+785Ktc3V2+tijgSSa7H21UOcoj0gDUe6IffmNs0C6P6e5LhHg
-xqbXPFit+vPyW19q9e+eILGLqKb2biCmApJyDKMKRPjAdL+c7c3C2CJeimp0eZuq
-QQ2R1C+7Og==
-=ivCt
------END PGP PUBLIC KEY BLOCK-----
-
diff --git a/etc/config/archives/patches.list b/etc/config/archives/patches.list
deleted file mode 100644
index 440f4c1fc..000000000
--- a/etc/config/archives/patches.list
+++ /dev/null
@@ -1,3 +0,0 @@
-deb https://ppa.launchpadcontent.net/elementary-os/os-patches/ubuntu @BASECODENAME main
-deb-src https://ppa.launchpadcontent.net/elementary-os/os-patches/ubuntu @BASECODENAME main
-
diff --git a/etc/config/archives/patches.pref b/etc/config/archives/patches.pref
deleted file mode 100644
index 02b44ae3a..000000000
--- a/etc/config/archives/patches.pref
+++ /dev/null
@@ -1,6 +0,0 @@
-Explanation: OS patches for elementary OS.
-Explanation: We need this pin because our patched build can lag a few hours behind Ubuntu's updates,
-Explanation: and during those few hours packages can be overwritten with unpatched ones.
-Package: *
-Pin: release o=LP-PPA-elementary-os-os-patches
-Pin-Priority: 999
diff --git a/etc/config/bootloaders/grub-pc/dejavu-bold-14.pf2 b/etc/config/bootloaders/grub-pc/dejavu-bold-14.pf2
deleted file mode 100644
index 9b093b207..000000000
Binary files a/etc/config/bootloaders/grub-pc/dejavu-bold-14.pf2 and /dev/null differ
diff --git a/etc/config/bootloaders/grub-pc/dejavu-bold-16.pf2 b/etc/config/bootloaders/grub-pc/dejavu-bold-16.pf2
deleted file mode 100644
index 11e7f7ab7..000000000
Binary files a/etc/config/bootloaders/grub-pc/dejavu-bold-16.pf2 and /dev/null differ
diff --git a/etc/config/bootloaders/grub-pc/elementary-theme/background.png b/etc/config/bootloaders/grub-pc/elementary-theme/background.png
deleted file mode 100644
index 7e74c3df5..000000000
Binary files a/etc/config/bootloaders/grub-pc/elementary-theme/background.png and /dev/null differ
diff --git a/etc/config/bootloaders/grub-pc/elementary-theme/logo.png b/etc/config/bootloaders/grub-pc/elementary-theme/logo.png
deleted file mode 100644
index 68d5b8f52..000000000
Binary files a/etc/config/bootloaders/grub-pc/elementary-theme/logo.png and /dev/null differ
diff --git a/etc/config/bootloaders/grub-pc/elementary-theme/theme.txt b/etc/config/bootloaders/grub-pc/elementary-theme/theme.txt
deleted file mode 100644
index a8831e2de..000000000
--- a/etc/config/bootloaders/grub-pc/elementary-theme/theme.txt
+++ /dev/null
@@ -1,61 +0,0 @@
-title-text: ""
-desktop-image: "background.png"
-desktop-color: "#000000"
-title-color: "#ffffff"
-title-font: "DejaVu Sans Bold 16"
-message-font: "Unifont Regular 16"
-
-terminal-left: "0"
-terminal-top: "0"
-terminal-width: "100%"
-terminal-height: "100%"
-terminal-border: "0"
-
-# Logo image
-+ image {
- left = 50%-50
- top = 50%-50
- file = "logo.png"
-}
-
-#help bar at the bottom
-+ label {
- top = 100%-50
- left = 0
- width = 100%
- height = 20
- text = "@KEYMAP_SHORT@"
- align = "center"
- color = "#ffffff"
- font = "DejaVu Sans Bold 14"
-}
-
-#boot menu
-+ boot_menu {
- left = 50%-150
- width = 500
- top = 50%+100
- height = 300
-
- item_font = "DejaVu Sans Bold 14"
- item_color = "#999"
- selected_item_font = "DejaVu Sans Bold 14"
- selected_item_color= "#fff"
-
- item_height = 26
- item_padding = 0
- item_icon_space = 0
- item_spacing = 1
- scrollbar = false
-}
-
-# Show a countdown message using the label component
-+ label {
- top = 82%
- left = 35%
- width = 30%
- align = "center"
- id = "__timeout__"
- text = "Booting in %d seconds"
- color = "#f6f6f6"
-}
diff --git a/etc/config/bootloaders/grub-pc/grub.cfg b/etc/config/bootloaders/grub-pc/grub.cfg
deleted file mode 100644
index eb2d5140d..000000000
--- a/etc/config/bootloaders/grub-pc/grub.cfg
+++ /dev/null
@@ -1,39 +0,0 @@
-set default=0
-
-set gfxmode=auto
-loadfont $prefix/dejavu-bold-16.pf2
-loadfont $prefix/dejavu-bold-14.pf2
-loadfont $prefix/unicode.pf2
-insmod all_video
-insmod gfxterm
-insmod png
-
-set color_normal=light-gray/black
-set color_highlight=white/black
-
-set theme=/boot/grub/elementary-theme/theme.txt
-
-terminal_output gfxterm
-
-set timeout=10
-set timeout_style=menu
-
-menuentry "Try or install elementary OS" {
- linux /casper/vmlinuz APPEND_LIVE
- initrd /casper/initrd.lz
-}
-
-menuentry "Try or install elementary OS (Safe graphics)" {
- linux /casper/vmlinuz APPEND_LIVE nomodeset
- initrd /casper/initrd.lz
-}
-
-submenu 'Advanced options...' {
-
-# More installer entries (if any)
-LINUX_ADVANCED_INSTALL
-
-# Memtest (if any)
-MEMTEST
-
-}
diff --git a/etc/config/bootloaders/isolinux/hdt.c32 b/etc/config/bootloaders/isolinux/hdt.c32
deleted file mode 120000
index f84c641c7..000000000
--- a/etc/config/bootloaders/isolinux/hdt.c32
+++ /dev/null
@@ -1 +0,0 @@
-/usr/lib/syslinux/modules/bios/hdt.c32
\ No newline at end of file
diff --git a/etc/config/bootloaders/isolinux/isolinux.bin b/etc/config/bootloaders/isolinux/isolinux.bin
deleted file mode 120000
index 33a2ad6f2..000000000
--- a/etc/config/bootloaders/isolinux/isolinux.bin
+++ /dev/null
@@ -1 +0,0 @@
-/usr/lib/ISOLINUX/isolinux.bin
\ No newline at end of file
diff --git a/etc/config/bootloaders/isolinux/isolinux.cfg b/etc/config/bootloaders/isolinux/isolinux.cfg
deleted file mode 100644
index 0fa37834a..000000000
--- a/etc/config/bootloaders/isolinux/isolinux.cfg
+++ /dev/null
@@ -1,3 +0,0 @@
-default vesamenu.c32
-include stdmenu.cfg
-include live.cfg
diff --git a/etc/config/bootloaders/isolinux/ldlinux.c32 b/etc/config/bootloaders/isolinux/ldlinux.c32
deleted file mode 120000
index df554c7e5..000000000
--- a/etc/config/bootloaders/isolinux/ldlinux.c32
+++ /dev/null
@@ -1 +0,0 @@
-/usr/lib/syslinux/modules/bios/ldlinux.c32
\ No newline at end of file
diff --git a/etc/config/bootloaders/isolinux/libcom32.c32 b/etc/config/bootloaders/isolinux/libcom32.c32
deleted file mode 120000
index 44ab36b56..000000000
--- a/etc/config/bootloaders/isolinux/libcom32.c32
+++ /dev/null
@@ -1 +0,0 @@
-/usr/lib/syslinux/modules/bios/libcom32.c32
\ No newline at end of file
diff --git a/etc/config/bootloaders/isolinux/libgpl.c32 b/etc/config/bootloaders/isolinux/libgpl.c32
deleted file mode 120000
index 81c83fbdf..000000000
--- a/etc/config/bootloaders/isolinux/libgpl.c32
+++ /dev/null
@@ -1 +0,0 @@
-/usr/lib/syslinux/modules/bios/libgpl.c32
\ No newline at end of file
diff --git a/etc/config/bootloaders/isolinux/libmenu.c32 b/etc/config/bootloaders/isolinux/libmenu.c32
deleted file mode 120000
index 2491ff9a1..000000000
--- a/etc/config/bootloaders/isolinux/libmenu.c32
+++ /dev/null
@@ -1 +0,0 @@
-/usr/lib/syslinux/modules/bios/libmenu.c32
\ No newline at end of file
diff --git a/etc/config/bootloaders/isolinux/libutil.c32 b/etc/config/bootloaders/isolinux/libutil.c32
deleted file mode 120000
index 478194e85..000000000
--- a/etc/config/bootloaders/isolinux/libutil.c32
+++ /dev/null
@@ -1 +0,0 @@
-/usr/lib/syslinux/modules/bios/libutil.c32
\ No newline at end of file
diff --git a/etc/config/bootloaders/isolinux/live.cfg.in b/etc/config/bootloaders/isolinux/live.cfg.in
deleted file mode 100644
index 8f3599b6c..000000000
--- a/etc/config/bootloaders/isolinux/live.cfg.in
+++ /dev/null
@@ -1,27 +0,0 @@
-prompt 0
-
-MENU HIDDEN
-MENU AUTOBOOT Booting elementary OS live disk in # seconds
-timeout 50
-
-label live-@FLAVOUR@
- menu label ^Try or install elementary OS
- menu default
- linux /casper/vmlinuz
- initrd /casper/initrd.lz
- append @APPEND_LIVE@
-
-label live-safe-@FLAVOUR@
- menu label Try or install elementary OS (^Safe graphics)
- linux /casper/vmlinuz
- initrd /casper/initrd.lz
- append @APPEND_LIVE@ nomodeset
-
-label check
- menu label ^Check disk for defects
- linux /casper/vmlinuz
- append boot=casper integrity-check initrd=/casper/initrd.lz quiet splash --
-
-label hd
- menu label ^Boot from first hard disk
- localboot 0x80
diff --git a/etc/config/bootloaders/isolinux/menu.c32 b/etc/config/bootloaders/isolinux/menu.c32
deleted file mode 120000
index 86c360d37..000000000
--- a/etc/config/bootloaders/isolinux/menu.c32
+++ /dev/null
@@ -1 +0,0 @@
-/usr/lib/syslinux/modules/bios/menu.c32
\ No newline at end of file
diff --git a/etc/config/bootloaders/isolinux/stdmenu.cfg b/etc/config/bootloaders/isolinux/stdmenu.cfg
deleted file mode 100644
index cb7f674b2..000000000
--- a/etc/config/bootloaders/isolinux/stdmenu.cfg
+++ /dev/null
@@ -1,42 +0,0 @@
-menu hshift 13
-menu width 49
-menu margin 8
-
-# Override the default radial gradient background with black
-menu background #ff000000
-
-# Title bar
-menu color title 0 #ffffffff #00000000 *
-
-# Border Area
-menu color border * #00000000 #00000000 none
-
-# Unselected menu item
-menu color unsel 0 #999999 #00000000 *
-
-# Unselected hotkey
-menu color hotkey 0 #999999 #00000000 none
-
-# Selection bar
-menu color sel 0 #ffffff #00000000 none
-
-# Selected hotkey
-menu color hotsel 0 #ffffffff #00000000 none
-
-# Press [Tab] message
-menu color tabmsg 0 #f6f6f6 #00000000 none
-
-# Timeout message
-menu color timeout_msg 0 #f6f6f6 #00000000 none
-
-# Timeout counter
-menu color timeout * #ffffffff #00000000 none
-
-# Command line
-menu color cmdline 0 #ffffffff #00000000 none
-
-# Command line marker
-menu color cmdmark 0 #00000000 #00000000 none
-
-# Helptest
-menu color help 0 #ffffffff #00000000 none
diff --git a/etc/config/bootloaders/isolinux/vesamenu.c32 b/etc/config/bootloaders/isolinux/vesamenu.c32
deleted file mode 120000
index 84e2eff1e..000000000
--- a/etc/config/bootloaders/isolinux/vesamenu.c32
+++ /dev/null
@@ -1 +0,0 @@
-/usr/lib/syslinux/modules/bios/vesamenu.c32
\ No newline at end of file
diff --git a/etc/config/hooks/live/000-remove-blacklisted-packages.chroot b/etc/config/hooks/live/000-remove-blacklisted-packages.chroot
deleted file mode 100755
index 13ae4b4df..000000000
--- a/etc/config/hooks/live/000-remove-blacklisted-packages.chroot
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/sh
-# Description: Checkout seed branches and remove blacklisted packages
-
-echo "P: Begin executing remove-blacklisted-packages chroot hook..."
-
-export LSB_OS_RELEASE="/usr/lib/upstream-os-release"
-dist="$(lsb_release -c -s)"
-unset LSB_OS_RELEASE
-
-apt-get install --no-install-recommends -f -q -y git
-
-git clone --depth 1 https://github.com/elementary/seeds.git --single-branch --branch "$dist"
-git clone --depth 1 https://github.com/elementary/platform.git --single-branch --branch "$dist"
-
-for package in $(cat 'platform/blacklist' 'seeds/blacklist' | grep -v '#'); do
- apt-get autoremove --purge -f -q -y "$package"
-done
-
-apt-get autoremove --purge -f -q -y git
-
-rm -R ../seeds ../platform
diff --git a/etc/config/hooks/live/999-cleanup-apt-cache.chroot b/etc/config/hooks/live/999-cleanup-apt-cache.chroot
deleted file mode 100755
index e0a81eceb..000000000
--- a/etc/config/hooks/live/999-cleanup-apt-cache.chroot
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/sh
-# Description: Cleanup apt cache files that add ~100MB to the .iso and aren't needed
-
-rm -f /var/lib/apt/lists/*_Packages
-rm -f /var/lib/apt/lists/*_Sources
-rm -f /var/lib/apt/lists/*_Translation-*
-
diff --git a/etc/config/hooks/live/apparmor-profiles.chroot b/etc/config/hooks/live/apparmor-profiles.chroot
deleted file mode 100755
index 2067aa379..000000000
--- a/etc/config/hooks/live/apparmor-profiles.chroot
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/bin/sh
-# Description: enable experimental AppArmor profile for bubblewrap so Flatpak apps can open in Demo Mode
-
-# The apparmor systemd service (that parses profiles and loads them into the kernel) is patched to be disabled
-# when running on "live" systems due to historical bugs with it breaking applications. Apparmor is still
-# enabled, but no profiles are loaded as a result.
-#
-# There are discussions dating back a few years questioning whether this is still necessary:
-# https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1821688.html
-#
-# Since it breaks our Flatpak apps, remove the config that disables it.
-mkdir -p /usr/lib/systemd/system/apparmor.service.d
-cat << EOF > /usr/lib/systemd/system/apparmor.service.d/99_enable_in_live_mode.conf
-[Unit]
-ConditionPathExists=
-EOF
diff --git a/etc/config/hooks/live/revert-os-release-divert.chroot b/etc/config/hooks/live/revert-os-release-divert.chroot
deleted file mode 100644
index 0389cf73b..000000000
--- a/etc/config/hooks/live/revert-os-release-divert.chroot
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/sh
-# Description: Revert dpkg-divert of /etc/os-release done by live-build
-# https://salsa.debian.org/live-team/live-build/-/blob/debian/1%2520250505/scripts/build/bootstrap_debootstrap?ref_type=tags#L125-142
-
-echo "P: Begin executing revert-os-release-divert chroot hook..."
-
-OS_RELEASE=/etc/os-release
-OS_RELEASE_DIVERTED="${OS_RELEASE}.debootstrap"
-
-dpkg-divert --list "$OS_RELEASE" | grep -q "$OS_RELEASE"
-if [ $? -eq 0 ]; then
- mv "$OS_RELEASE_DIVERTED" "$OS_RELEASE"
- dpkg-divert --quiet --local --remove --no-rename --divert "$OS_RELEASE_DIVERTED" "$OS_RELEASE"
-fi
diff --git a/etc/config/hooks/live/set-disk-info.binary b/etc/config/hooks/live/set-disk-info.binary
deleted file mode 100755
index fc6eb5413..000000000
--- a/etc/config/hooks/live/set-disk-info.binary
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/bin/sh
-
-echo "P: Begin executing set-disk-info binary hook in ${PWD}"
-
-cp -rf ../config/includes.binary/.disk .
diff --git a/etc/config/hooks/live/setup-casper-folder.binary b/etc/config/hooks/live/setup-casper-folder.binary
deleted file mode 100755
index d3f63e9ba..000000000
--- a/etc/config/hooks/live/setup-casper-folder.binary
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/sh
-
-mkdir casper || true
-mv boot/filesystem.squashfs casper/filesystem.squashfs
-mv boot/filesystem.size casper/filesystem.size
-mv boot/initrd.img-* casper/initrd.lz
-mv boot/vmlinuz-* casper/vmlinuz
-mv boot/filesystem.packages-remove casper/filesystem.manifest-remove
-mv boot/filesystem.packages casper/filesystem.manifest
-
-mkdir live || true
-cp casper/vmlinuz live/vmlinuz
diff --git a/etc/config/includes.binary/.disk/base_installable b/etc/config/includes.binary/.disk/base_installable
deleted file mode 100644
index e69de29bb..000000000
diff --git a/etc/config/includes.binary/.disk/cd_type b/etc/config/includes.binary/.disk/cd_type
deleted file mode 100644
index daab660cd..000000000
--- a/etc/config/includes.binary/.disk/cd_type
+++ /dev/null
@@ -1 +0,0 @@
-full_cd/single
diff --git a/etc/config/includes.binary/.disk/info b/etc/config/includes.binary/.disk/info
deleted file mode 100644
index 277b60dc8..000000000
--- a/etc/config/includes.binary/.disk/info
+++ /dev/null
@@ -1 +0,0 @@
-@DISTRO_NAME @VERSION "@CODENAME" - @CHANNEL @ARCH (@DATE)
diff --git a/etc/config/includes.chroot/etc/apt/apt.conf.d/00trustcdrom b/etc/config/includes.chroot/etc/apt/apt.conf.d/00trustcdrom
deleted file mode 100644
index c7588cb4a..000000000
--- a/etc/config/includes.chroot/etc/apt/apt.conf.d/00trustcdrom
+++ /dev/null
@@ -1 +0,0 @@
-APT::Authentication::TrustCDROM "true";
diff --git a/etc/config/package-lists/desktop.list.chroot_install b/etc/config/package-lists/desktop.list.chroot_install
deleted file mode 100644
index 21b75d5f4..000000000
--- a/etc/config/package-lists/desktop.list.chroot_install
+++ /dev/null
@@ -1,7 +0,0 @@
-# elementary meta packages
-elementary-desktop
-elementary-minimal
-elementary-standard
-
-@XORG_HWE
-@KERNEL_HEADERS
diff --git a/etc/config/package-lists/desktop.list.chroot_live b/etc/config/package-lists/desktop.list.chroot_live
deleted file mode 100644
index eccbc11ab..000000000
--- a/etc/config/package-lists/desktop.list.chroot_live
+++ /dev/null
@@ -1 +0,0 @@
-elementary-live
diff --git a/etc/config/package-lists/pool.list.binary b/etc/config/package-lists/pool.list.binary
deleted file mode 100644
index 209b69a73..000000000
--- a/etc/config/package-lists/pool.list.binary
+++ /dev/null
@@ -1,26 +0,0 @@
-b43-fwcutter
-dkms
-open-vm-tools-desktop
-setserial
-user-setup
-
-efibootmgr
-secureboot-db
-shim
-shim-signed
-
-#if ARCHITECTURES amd64
-broadcom-sta-dkms
-intel-microcode
-iucode-tool
-
-grub-efi-amd64
-grub-efi-amd64-bin
-grub-efi-amd64-signed
-#endif
-
-#if ARCHITECTURES arm64
-grub-efi-arm64
-grub-efi-arm64-bin
-grub-efi-arm64-signed
-#endif
diff --git a/etc/terraform-amd64.conf b/etc/terraform-amd64.conf
deleted file mode 100644
index 7d046b1e8..000000000
--- a/etc/terraform-amd64.conf
+++ /dev/null
@@ -1,30 +0,0 @@
-# target architecture
-ARCH="amd64"
-
-# base codename
-BASECODENAME="noble"
-
-# base version
-BASEVERSION="24.04"
-
-# distribution codename
-CODENAME="circe"
-
-# distribution version
-VERSION="8.0"
-
-# distribution channel
-CHANNEL="stable"
-
-# distribution name
-NAME="elementary OS"
-
-# mirror to fetch packages from
-MIRROR_URL="http://archive.ubuntu.com/ubuntu/"
-
-# use HWE kernel and packages?
-HWE_KERNEL="yes"
-HWE_X11="no"
-
-# suffix for generated .iso files
-OUTPUT_SUFFIX=""
diff --git a/etc/terraform-arm64.conf b/etc/terraform-arm64.conf
deleted file mode 100644
index 13540da16..000000000
--- a/etc/terraform-arm64.conf
+++ /dev/null
@@ -1,30 +0,0 @@
-# target architecture
-ARCH="arm64"
-
-# base codename
-BASECODENAME="noble"
-
-# base version
-BASEVERSION="24.04"
-
-# distribution codename
-CODENAME="circe"
-
-# distribution version
-VERSION="8.0"
-
-# distribution channel
-CHANNEL="stable"
-
-# distribution name
-NAME="elementary OS"
-
-# mirror to fetch packages from
-MIRROR_URL="http://ports.ubuntu.com/ubuntu-ports/"
-
-# use HWE kernel and packages?
-HWE_KERNEL="yes"
-HWE_X11="no"
-
-# suffix for generated .iso files
-OUTPUT_SUFFIX=""
diff --git a/etc/terraform-daily-7.1-azure.conf b/etc/terraform-daily-7.1-azure.conf
deleted file mode 100644
index 2afdb4a8b..000000000
--- a/etc/terraform-daily-7.1-azure.conf
+++ /dev/null
@@ -1,30 +0,0 @@
-# target architecture - i386, amd64 or all
-ARCH="amd64"
-
-# base codename
-BASECODENAME="jammy"
-
-# base version
-BASEVERSION="22.04"
-
-# distribution codename
-CODENAME="horus"
-
-# distribution version
-VERSION="7.1"
-
-# distribution channel
-CHANNEL="daily"
-
-# distribution name
-NAME="elementary OS"
-
-# mirror to fetch packages from
-MIRROR_URL="http://azure.archive.ubuntu.com/ubuntu/"
-
-# use HWE kernel and packages?
-HWE_KERNEL="no"
-HWE_X11="no"
-
-# suffix for generated .iso files
-OUTPUT_SUFFIX=""
diff --git a/etc/terraform-daily-8.1-azure-amd64.conf b/etc/terraform-daily-8.1-azure-amd64.conf
deleted file mode 100644
index 7a2d3be29..000000000
--- a/etc/terraform-daily-8.1-azure-amd64.conf
+++ /dev/null
@@ -1,30 +0,0 @@
-# target architecture
-ARCH="amd64"
-
-# base codename
-BASECODENAME="noble"
-
-# base version
-BASEVERSION="24.04"
-
-# distribution codename
-CODENAME="circe"
-
-# distribution version
-VERSION="8.1"
-
-# distribution channel
-CHANNEL="daily"
-
-# distribution name
-NAME="elementary OS"
-
-# mirror to fetch packages from
-MIRROR_URL="http://azure.archive.ubuntu.com/ubuntu/"
-
-# use HWE kernel and packages?
-HWE_KERNEL="yes"
-HWE_X11="no"
-
-# suffix for generated .iso files
-OUTPUT_SUFFIX=""
diff --git a/etc/terraform-daily-8.1-azure-arm64.conf b/etc/terraform-daily-8.1-azure-arm64.conf
deleted file mode 100644
index a33d7926b..000000000
--- a/etc/terraform-daily-8.1-azure-arm64.conf
+++ /dev/null
@@ -1,30 +0,0 @@
-# target architecture
-ARCH="arm64"
-
-# base codename
-BASECODENAME="noble"
-
-# base version
-BASEVERSION="24.04"
-
-# distribution codename
-CODENAME="circe"
-
-# distribution version
-VERSION="8.1"
-
-# distribution channel
-CHANNEL="daily"
-
-# distribution name
-NAME="elementary OS"
-
-# mirror to fetch packages from
-MIRROR_URL="http://azure.ports.ubuntu.com/ubuntu-ports/"
-
-# use HWE kernel and packages?
-HWE_KERNEL="yes"
-HWE_X11="no"
-
-# suffix for generated .iso files
-OUTPUT_SUFFIX=""
diff --git a/etc/terraform-daily-9.0-azure-amd64.conf b/etc/terraform-daily-9.0-azure-amd64.conf
deleted file mode 100644
index 79fd43a87..000000000
--- a/etc/terraform-daily-9.0-azure-amd64.conf
+++ /dev/null
@@ -1,30 +0,0 @@
-# target architecture
-ARCH="amd64"
-
-# base codename
-BASECODENAME="resolute"
-
-# base version
-BASEVERSION="26.04"
-
-# distribution codename
-CODENAME="tanit"
-
-# distribution version
-VERSION="9.0"
-
-# distribution channel
-CHANNEL="daily"
-
-# distribution name
-NAME="elementary OS"
-
-# mirror to fetch packages from
-MIRROR_URL="http://azure.archive.ubuntu.com/ubuntu/"
-
-# use HWE kernel and packages?
-HWE_KERNEL="yes"
-HWE_X11="no"
-
-# suffix for generated .iso files
-OUTPUT_SUFFIX=""
diff --git a/etc/terraform-daily-9.0-azure-arm64.conf b/etc/terraform-daily-9.0-azure-arm64.conf
deleted file mode 100644
index 22396c465..000000000
--- a/etc/terraform-daily-9.0-azure-arm64.conf
+++ /dev/null
@@ -1,30 +0,0 @@
-# target architecture
-ARCH="arm64"
-
-# base codename
-BASECODENAME="resolute"
-
-# base version
-BASEVERSION="26.04"
-
-# distribution codename
-CODENAME="tanit"
-
-# distribution version
-VERSION="9.0"
-
-# distribution channel
-CHANNEL="daily"
-
-# distribution name
-NAME="elementary OS"
-
-# mirror to fetch packages from
-MIRROR_URL="http://azure.ports.ubuntu.com/ubuntu-ports/"
-
-# use HWE kernel and packages?
-HWE_KERNEL="yes"
-HWE_X11="no"
-
-# suffix for generated .iso files
-OUTPUT_SUFFIX=""
diff --git a/etc/terraform-stable-8.1-azure-amd64.conf b/etc/terraform-stable-8.1-azure-amd64.conf
deleted file mode 100644
index 2f331d868..000000000
--- a/etc/terraform-stable-8.1-azure-amd64.conf
+++ /dev/null
@@ -1,30 +0,0 @@
-# target architecture
-ARCH="amd64"
-
-# base codename
-BASECODENAME="noble"
-
-# base version
-BASEVERSION="24.04"
-
-# distribution codename
-CODENAME="circe"
-
-# distribution version
-VERSION="8.1"
-
-# distribution channel
-CHANNEL="stable"
-
-# distribution name
-NAME="elementary OS"
-
-# mirror to fetch packages from
-MIRROR_URL="http://azure.archive.ubuntu.com/ubuntu/"
-
-# use HWE kernel and packages?
-HWE_KERNEL="yes"
-HWE_X11="no"
-
-# suffix for generated .iso files
-OUTPUT_SUFFIX=""
diff --git a/etc/terraform-stable-8.1-azure-arm64.conf b/etc/terraform-stable-8.1-azure-arm64.conf
deleted file mode 100644
index 59f9438a6..000000000
--- a/etc/terraform-stable-8.1-azure-arm64.conf
+++ /dev/null
@@ -1,30 +0,0 @@
-# target architecture
-ARCH="arm64"
-
-# base codename
-BASECODENAME="noble"
-
-# base version
-BASEVERSION="24.04"
-
-# distribution codename
-CODENAME="circe"
-
-# distribution version
-VERSION="8.1"
-
-# distribution channel
-CHANNEL="stable"
-
-# distribution name
-NAME="elementary OS"
-
-# mirror to fetch packages from
-MIRROR_URL="http://azure.ports.ubuntu.com/ubuntu-ports/"
-
-# use HWE kernel and packages?
-HWE_KERNEL="yes"
-HWE_X11="no"
-
-# suffix for generated .iso files
-OUTPUT_SUFFIX=""
diff --git a/mkosi.bump b/mkosi.bump
new file mode 100755
index 000000000..fa52d3fbf
--- /dev/null
+++ b/mkosi.bump
@@ -0,0 +1,4 @@
+#!/bin/bash
+set -e
+
+date -u +%Y%m%d%H%M%S
diff --git a/mkosi.clean b/mkosi.clean
new file mode 100755
index 000000000..7b94e2bd8
--- /dev/null
+++ b/mkosi.clean
@@ -0,0 +1,6 @@
+#!/bin/sh
+set -e
+set -o nounset
+
+rm -rf "$OUTPUTDIR"/"$IMAGE_ID"*
+rm -rf "$SRCDIR/cache"
diff --git a/mkosi.conf b/mkosi.conf
new file mode 100644
index 000000000..af63a2546
--- /dev/null
+++ b/mkosi.conf
@@ -0,0 +1,26 @@
+[Config]
+MinimumVersion=26~devel
+
+[Distribution]
+Distribution=ubuntu
+Release=resolute
+Repositories=main,universe
+
+[Content]
+Hostname=elementary
+
+[Build]
+ToolsTree=default
+History=yes
+CacheDirectory=mkosi.cache
+Incremental=yes
+
+[Validation]
+SecureBoot=no
+SignExpectedPcr=no
+
+[Output]
+ImageId=Elementary
+OutputDirectory=mkosi.output
+ManifestFormat=json
+Output=%i_%v_%a # Versioned tag for releases
\ No newline at end of file
diff --git a/mkosi.conf.d/elementary/mkosi.conf b/mkosi.conf.d/elementary/mkosi.conf
new file mode 100644
index 000000000..d95b24937
--- /dev/null
+++ b/mkosi.conf.d/elementary/mkosi.conf
@@ -0,0 +1,2 @@
+[Match]
+Distribution=ubuntu
diff --git a/mkosi.conf.d/elementary/mkosi.conf.d/apparmor.conf b/mkosi.conf.d/elementary/mkosi.conf.d/apparmor.conf
new file mode 100644
index 000000000..d624fefc3
--- /dev/null
+++ b/mkosi.conf.d/elementary/mkosi.conf.d/apparmor.conf
@@ -0,0 +1,8 @@
+[Match]
+Distribution=ubuntu
+
+[Content]
+Packages=
+ apparmor
+ apparmor-profiles
+ apparmor-utils
\ No newline at end of file
diff --git a/mkosi.conf.d/elementary/mkosi.conf.d/elementary-apps.conf b/mkosi.conf.d/elementary/mkosi.conf.d/elementary-apps.conf
new file mode 100644
index 000000000..ecdd0c78f
--- /dev/null
+++ b/mkosi.conf.d/elementary/mkosi.conf.d/elementary-apps.conf
@@ -0,0 +1,23 @@
+[Match]
+Distribution=ubuntu
+
+[Content]
+Packages=
+ contractor
+ io.elementary.appcenter
+ io.elementary.bluetooth-daemon
+ io.elementary.code
+ io.elementary.feedback
+ io.elementary.mail
+ io.elementary.monitor
+ io.elementary.onboarding
+ io.elementary.sideload
+ io.elementary.tasks
+ io.elementary.terminal
+ pantheon-files
+ pantheon-photos
+
+
+
+
+
diff --git a/mkosi.conf.d/elementary/mkosi.conf.d/elementary-desktop.conf b/mkosi.conf.d/elementary/mkosi.conf.d/elementary-desktop.conf
new file mode 100644
index 000000000..4228c923c
--- /dev/null
+++ b/mkosi.conf.d/elementary/mkosi.conf.d/elementary-desktop.conf
@@ -0,0 +1,39 @@
+[Match]
+Distribution=ubuntu
+
+[Content]
+Packages=
+ appcenter
+ pantheon-greeter
+ elementary-artwork
+ elementary-wallpapers
+ fonts-inter
+ fonts-elementary-core
+ fonts-elementary-extra
+ fonts-roboto-mono-elementary
+ granite-demo
+ elementary-default-settings
+ elementary-desktop
+ elementary-minimal
+ elementary-printer-test-page
+ elementary-os-overlay
+ elementary-icon-theme
+ elementary-sdk
+ elementary-standard
+ io.elementary.session-settings
+ io.elementary.initial-setup
+ gnome-session-bin
+ gnome-session-common
+ desktop-base
+ pantheon-shell
+ pantheon
+ io.elementary.settings-daemon
+ io.elementary.portals
+ pantheon-agent-polkit
+ xwayland
+ gala
+
+
+
+
+
diff --git a/mkosi.conf.d/elementary/mkosi.conf.d/elementary-panel.conf b/mkosi.conf.d/elementary/mkosi.conf.d/elementary-panel.conf
new file mode 100644
index 000000000..c875537fa
--- /dev/null
+++ b/mkosi.conf.d/elementary/mkosi.conf.d/elementary-panel.conf
@@ -0,0 +1,22 @@
+[Match]
+Distribution=ubuntu
+
+[Content]
+Packages=
+ io.elementary.dock
+ io.elementary.notifications
+ io.elementary.wingpanel
+ io.elementary.shortcut-overlay
+ io.elementary.panel.bluetooth
+ io.elementary.panel.datetime
+ io.elementary.panel.keyboard
+ io.elementary.panel.network
+ io.elementary.panel.nightlight
+ io.elementary.panel.notifications
+ io.elementary.panel.power
+ io.elementary.quick-settings
+
+
+
+
+
diff --git a/mkosi.conf.d/elementary/mkosi.conf.d/elementary-settings.conf b/mkosi.conf.d/elementary/mkosi.conf.d/elementary-settings.conf
new file mode 100644
index 000000000..890dd112b
--- /dev/null
+++ b/mkosi.conf.d/elementary/mkosi.conf.d/elementary-settings.conf
@@ -0,0 +1,31 @@
+[Match]
+Distribution=ubuntu
+
+[Content]
+Packages=
+ io.elementary.settings
+ io.elementary.settings.applications
+ io.elementary.settings.bluetooth
+ io.elementary.settings.datetime
+ io.elementary.settings.desktop
+ io.elementary.settings.display
+ io.elementary.settings.keyboard
+ io.elementary.settings.locale
+ io.elementary.settings.mouse-touchpad
+ io.elementary.settings.network
+ io.elementary.settings.notifications
+ io.elementary.settings.onlineaccounts
+ io.elementary.settings.power
+ io.elementary.settings.printers
+ io.elementary.settings.screentime-limits
+ io.elementary.settings.security-privacy
+ #io.elementary.settings.sharing
+ io.elementary.settings.sound
+ io.elementary.settings.system
+ io.elementary.settings.useraccounts
+ io.elementary.settings.wacom
+
+
+
+
+
diff --git a/mkosi.conf.d/elementary/mkosi.conf.d/elementary.conf b/mkosi.conf.d/elementary/mkosi.conf.d/elementary.conf
new file mode 100644
index 000000000..c51a5e66c
--- /dev/null
+++ b/mkosi.conf.d/elementary/mkosi.conf.d/elementary.conf
@@ -0,0 +1,58 @@
+[Content]
+RemoveFiles=
+ /usr/bin/chsh
+ /usr/bin/lchsh
+
+VolatilePackages=
+ systemd-container
+
+RemovePackages=
+ anacron
+
+Packages=
+ plymouth
+ plymouth-theme-elementary
+ linux-image-generic
+ linux-firmware
+ libpam-systemd
+ dbus-user-session
+ systemd-resolved
+ systemd-cryptsetup
+ cryptsetup
+ btrfs-progs
+ bolt
+ x11-common
+ curl
+ wget
+ binutils
+ iputils-ping
+ ubuntu-keyring
+ distrobox
+ fastfetch
+ oras
+ flatpak
+ htop
+ podman
+ vim
+ fzf
+ gcr
+ git
+ locales-all
+ glycin-loaders
+ gnome-disk-utility
+ gnome-keyring
+ libpam-gnome-keyring
+ totem-video-thumbnailer
+ just
+ lshw
+ nano
+ ncurses-base
+ network-manager
+ ssh-askpass-gnome
+ systemd-homed
+ sudo-rs
+ yq
+ jq
+ xdg-desktop-portal-gtk
+ xdg-user-dirs
+ systemd-zram-generator
\ No newline at end of file
diff --git a/mkosi.extra/usr/lib/dracut/dracut.conf.d/base-ubuntu.conf b/mkosi.extra/usr/lib/dracut/dracut.conf.d/base-ubuntu.conf
new file mode 100644
index 000000000..bc2e09618
--- /dev/null
+++ b/mkosi.extra/usr/lib/dracut/dracut.conf.d/base-ubuntu.conf
@@ -0,0 +1,4 @@
+export DRACUT_NO_XATTR=1
+reproducible=yes
+hostonly=no
+compress=zstd
diff --git a/mkosi.extra/usr/lib/dracut/dracut.conf.d/lvm2.conf b/mkosi.extra/usr/lib/dracut/dracut.conf.d/lvm2.conf
new file mode 100644
index 000000000..fa0c03dab
--- /dev/null
+++ b/mkosi.extra/usr/lib/dracut/dracut.conf.d/lvm2.conf
@@ -0,0 +1 @@
+add_dracutmodules+=" lvm dm crypt fips "
diff --git a/mkosi.extra/usr/lib/sysctl.d/60-apparmor.conf b/mkosi.extra/usr/lib/sysctl.d/60-apparmor.conf
new file mode 100644
index 000000000..9dec26aed
--- /dev/null
+++ b/mkosi.extra/usr/lib/sysctl.d/60-apparmor.conf
@@ -0,0 +1,2 @@
+kernel.apparmor_restrict_unprivileged_userns=0
+kernel.apparmor_restrict_unprivileged_unconfined=0
\ No newline at end of file
diff --git a/mkosi.extra/usr/lib/systemd/system-preset/01-systemd.preset b/mkosi.extra/usr/lib/systemd/system-preset/01-systemd.preset
new file mode 100644
index 000000000..9452a002d
--- /dev/null
+++ b/mkosi.extra/usr/lib/systemd/system-preset/01-systemd.preset
@@ -0,0 +1,6 @@
+disable systemd-timesyncd.service
+disable sshd.socket
+disable sshd.service
+enable firewalld.service
+enable systemd-resolved.service
+enable plymouth.service
diff --git a/mkosi.extra/usr/lib/systemd/system-preset/91-resolved-default.preset b/mkosi.extra/usr/lib/systemd/system-preset/91-resolved-default.preset
new file mode 100644
index 000000000..df1bca628
--- /dev/null
+++ b/mkosi.extra/usr/lib/systemd/system-preset/91-resolved-default.preset
@@ -0,0 +1 @@
+enable systemd-resolved.service
diff --git a/mkosi.extra/usr/lib/systemd/user-preset/01-zirconium.preset b/mkosi.extra/usr/lib/systemd/user-preset/01-zirconium.preset
new file mode 100644
index 000000000..2daae828f
--- /dev/null
+++ b/mkosi.extra/usr/lib/systemd/user-preset/01-zirconium.preset
@@ -0,0 +1,4 @@
+enable gnome-keyring-daemon.service
+enable gnome-keyring-daemon.socket
+enable gcr-ssh-agent.service
+enable gcr-ssh-agent.socket
diff --git a/mkosi.extra/usr/lib/sysusers.d/session.conf b/mkosi.extra/usr/lib/sysusers.d/session.conf
new file mode 100644
index 000000000..d23e69189
--- /dev/null
+++ b/mkosi.extra/usr/lib/sysusers.d/session.conf
@@ -0,0 +1,2 @@
+u lightdm - "Light Display Manager" /var/lib/lightdm /usr/sbin/nologin
+u geoclue - "Geoclue Service" /var/lib/geoclue /usr/sbin/nologin
\ No newline at end of file
diff --git a/mkosi.extra/usr/lib/sysusers.d/wpa.conf b/mkosi.extra/usr/lib/sysusers.d/wpa.conf
new file mode 100644
index 000000000..a1c19663b
--- /dev/null
+++ b/mkosi.extra/usr/lib/sysusers.d/wpa.conf
@@ -0,0 +1 @@
+g netdev - -
\ No newline at end of file
diff --git a/mkosi.extra/usr/lib/tmpfiles.d/99-factory.conf b/mkosi.extra/usr/lib/tmpfiles.d/99-factory.conf
new file mode 100644
index 000000000..546291743
--- /dev/null
+++ b/mkosi.extra/usr/lib/tmpfiles.d/99-factory.conf
@@ -0,0 +1,2 @@
+C+ /etc/containers/
+L? /etc/hostname
\ No newline at end of file
diff --git a/mkosi.extra/usr/lib/tmpfiles.d/login.conf b/mkosi.extra/usr/lib/tmpfiles.d/login.conf
new file mode 100644
index 000000000..72393e306
--- /dev/null
+++ b/mkosi.extra/usr/lib/tmpfiles.d/login.conf
@@ -0,0 +1 @@
+d /var/lib/lightdm/data 0755 root root -
\ No newline at end of file
diff --git a/mkosi.extra/usr/lib/tmpfiles.d/resolved-default.conf b/mkosi.extra/usr/lib/tmpfiles.d/resolved-default.conf
new file mode 100644
index 000000000..360c949bf
--- /dev/null
+++ b/mkosi.extra/usr/lib/tmpfiles.d/resolved-default.conf
@@ -0,0 +1 @@
+L /etc/resolv.conf - - - - ../run/systemd/resolve/stub-resolv.conf
diff --git a/mkosi.extra/usr/share/factory/etc/.gitkeep b/mkosi.extra/usr/share/factory/etc/.gitkeep
new file mode 100644
index 000000000..326c1956b
--- /dev/null
+++ b/mkosi.extra/usr/share/factory/etc/.gitkeep
@@ -0,0 +1 @@
+# add factory overwrite here...
\ No newline at end of file
diff --git a/mkosi.extra/usr/share/flatpak/remotes.d/appcenter.flatpakrepo b/mkosi.extra/usr/share/flatpak/remotes.d/appcenter.flatpakrepo
new file mode 100644
index 000000000..f487455be
--- /dev/null
+++ b/mkosi.extra/usr/share/flatpak/remotes.d/appcenter.flatpakrepo
@@ -0,0 +1,8 @@
+[Flatpak Repo]
+Title=AppCenter
+Url=https://flatpak.elementaryos.org/repo
+Homepage=https://elementary.io/
+Icon=https://flatpak.elementaryos.org/icon.svg
+Comment=The open source, pay-what-you-want app store from elementary
+Description=Reviewed and curated by elementary to ensure a native, privacy-respecting, and secure experience
+GPGKey=LS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tCgptUUVOQkZjUlJOSUJDQURyRW5JUjkxYjJ2WDZCckFBWXFEUlRLWmVGZE1GRzdTdFNxRm8zbFpIMktGZDdLQmVCCnhZV25VM1YveEpRKzFsRnVqbytuYTZ6N0w5cUJydGlrWWRJbjlNYzNlU3l3L2ZsaTFGa011b0ZtZE10ajZrMUYKeitORU0wZFNyRUxhdkJNUHpYYjRrakY4WkdLbmVSMzV2NFkzUlArbHZaRGl1bVpwdkZ6VHpVMEFSVVJreEgzTgpiWWlYMG1raTc1Z3krRUh3Q1JlU1BqQnhLOTQrc1FSb0NsSmRyUWJGYUh0WERxZmgyWFZRTW0yTm5tSmFmMlJiCk1Gbzc1ekVveEh6WWJuQnlXZFIvWGg2dWhsU3lEYUJZME8wZjFjM3ljR243VVQrN0NBZEdrYTZHdTJWWlVYRUgKR0xaUzRvdFZodG95Z2Era0dhaUo3U1lSU1F6ZDBTL3hQUHh0QUJFQkFBRzBLR1ZzWlcxbGJuUmhjbmtnWW5WcApiR1J6SUR4aWRXbHNaSE5BWld4bGJXVnVkR0Z5ZVM1cGJ6NkpBVGNFRXdFSkFDRUZBbGNSUk5JQ0d3TUZDd2tJCkJ3TUZGUWtLQ0FzRkZnTUNBUUFDSGdFQ0Y0QUFDZ2tRcDA5ejcvNXd1Unpmd1FmL1FlR3RkbFFpVjNISkMvaEYKeVE0Q0hPeFpKRnJwZS9VZC90YXprVWlwbGMyWS9tcnJldGdkR2hJb0o2TnBRV3BEVENMRm12RDVDRXE5bGV0cwplUlVOVUx3MjF1dG5pdVRyckRYWmUxdG9tMEZrRlNkeUNZOFVwRERPYzdMa3piUTh3S28xQVNreXlFajhmVlhMCkVvT2tic2pSUUpVWFMvNlNkb1JTZVZpdXREZXdqVHkwWXZlbFVNVnhjWDVINVRqSmZYbVpNR1V4dEdVZWYzUmEKUkRYUjY5a21GamY3VW12MkFpaVZzZW5kcXJmSFJMblpRUnNiYmxOQWxObDVKK1ZUbEtrdmN3WGl2V2V3bFZVYQpPTDhIUEZvOWQya3hJYmV4RzJ5THdudXdtZmF2U0ZKVjROWWVtU1BTS2w2bEpWYkkzUCt6eitVODdWT01yOEtmCnVMMERvN2tCRFFSWEVVVFNBUWdBdkEzb1o3ck4xaUU4TTNROTFIVzM3bEJWK0V0YWdpckpVYTYrbTJvdlBmYTYKVG5PUHN5Z1NZOEVpTVBLQjhyRHhWUmszMlhuendObDNNQ21XMFlqTjFTMnNkRnY4WW5QWEx6WEtKV1lxVGFDTgpkZ0pQaEZ6K0xkZ1BtdVcya0hIM0VOWjhrT0JLZVZKZFErVUN4WmtFZEpaVmhuc0lQNjBwSHBTMmw4b01HWllrCnd0UnBlNkJEdEpNbHBnVVZXSzFqSnJmL1VqL0pBNjIrcnB2QWwyN1R4ZFpncHNtWU5hT3BnOWd1bVY4YUd0VWsKNGw2WDBOalNrS2FrYTdtMkJVTEFIb3RZT0FLMThEMHo3d3NzbEdiU2ZDWUtOS3NYS29VYlg5ZnB4anhQVXByTQpIUUo3TkFlZkRnZmllREltRm1CcGNTWEViem5VenQ1dmdTS3lIR05zdXdBUkFRQUJpUUVmQkJnQkNRQUpCUUpYCkVVVFNBaHNNQUFvSkVLZFBjKy8rY0xrY2VKQUgvMFhQVTJmeithaXBoNGx0dDludmRrWS9pcUZKNC9uZzJwWWoKejlLOWU4Sld1NjVFQkJrVW4zSjgwY1Z3TVRjQ3ZaZHVEeU1IaXpvYlBpbEhVeVdBZHdYdExYZ0xUWTVUUmZrZApIUVRLVmhGcXEvTHJwclVCUm9BSlFmVGJMNlhkQ1g4RHk3cTg5OXlhaUhzQkpkMUl6RUJpS3BmVE9jMVJtVnQvCnR2YUcwK1doQlJlL2FIdTV3bktrZkV4TGRzVzhtRHJOVW5EeWtUajUwQ2tpMWtmRnZMV2xTTHo2d2xYeXFHMVUKMWFCK25FTTdkMS9yL2pvRnNvWWZ0MlRUc2NOaTBIdnhZOFUxbU5TRDVIN0lYSzFlY0dUNTNmU2NsUFBrclZkNQorRjRZQnBkOUZJeTdMQm5MaGZLMEY0YUJlN2lUTFBpWUo3VFVwSWV6M2s3dWJSR0dCWmc9Cj1JQ3JSCi0tLS0tRU5EIFBHUCBQVUJMSUMgS0VZIEJMT0NLLS0tLS0K
\ No newline at end of file
diff --git a/mkosi.extra/usr/share/flatpak/remotes.d/flathub.flatpakrepo b/mkosi.extra/usr/share/flatpak/remotes.d/flathub.flatpakrepo
new file mode 100644
index 000000000..26a88a345
--- /dev/null
+++ b/mkosi.extra/usr/share/flatpak/remotes.d/flathub.flatpakrepo
@@ -0,0 +1,8 @@
+[Flatpak Repo]
+Title=Flathub
+Url=https://dl.flathub.org/repo/
+Homepage=https://flathub.org/
+Comment=Central repository of Flatpak applications
+Description=Central repository of Flatpak applications
+Icon=https://dl.flathub.org/repo/logo.svg
+GPGKey=mQINBFlD2sABEADsiUZUOYBg1UdDaWkEdJYkTSZD68214m8Q1fbrP5AptaUfCl8KYKFMNoAJRBXn9FbE6q6VBzghHXj/rSnA8WPnkbaEWR7xltOqzB1yHpCQ1l8xSfH5N02DMUBSRtD/rOYsBKbaJcOgW0K21sX+BecMY/AI2yADvCJEjhVKrjR9yfRX+NQEhDcbXUFRGt9ZT+TI5yT4xcwbvvTu7aFUR/dH7+wjrQ7lzoGlZGFFrQXSs2WI0WaYHWDeCwymtohXryF8lcWQkhH8UhfNJVBJFgCY8Q6UHkZG0FxMu8xnIDBMjBmSZKwKQn0nwzwM2afskZEnmNPYDI8nuNsSZBZSAw+ThhkdCZHZZRwzmjzyRuLLVFpOj3XryXwZcSefNMPDkZAuWWzPYjxS80cm2hG1WfqrG0Gl8+iX69cbQchb7gbEb0RtqNskTo9DDmO0bNKNnMbzmIJ3/rTbSahKSwtewklqSP/01o0WKZiy+n/RAkUKOFBprjJtWOZkc8SPXV/rnoS2dWsJWQZhuPPtv3tefdDiEyp7ePrfgfKxuHpZES0IZRiFI4J/nAUP5bix+srcIxOVqAam68CbAlPvWTivRUMRVbKjJiGXIOJ78wAMjqPg3QIC0GQ0EPAWwAOzzpdgbnG7TCQetaVV8rSYCuirlPYN+bJIwBtkOC9SWLoPMVZTwQARAQABtC5GbGF0aHViIFJlcG8gU2lnbmluZyBLZXkgPGZsYXRodWJAZmxhdGh1Yi5vcmc+iQJUBBMBCAA+FiEEblwF2XnHba+TwIE1QYTdTZB6fK4FAllD2sACGwMFCRLMAwAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQQYTdTZB6fK5RJQ/+Ptd4sWxaiAW91FFk7+wmYOkEe1NY2UDNJjEEz34PNP/1RoxveHDt43kYJQ23OWaPJuZAbu+fWtjRYcMBzOsMCaFcRSHFiDIC9aTp4ux/mo+IEeyarYt/oyKb5t5lta6xaAqg7rwt65jW5/aQjnS4h7eFZ+dAKta7Y/fljNrOznUp81/SMcx4QA5G2Pw0hs4Xrxg59oONOTFGBgA6FF8WQghrpR7SnEe0FSEOVsAjwQ13Cfkfa7b70omXSWp7GWfUzgBKyoWxKTqzMN3RQHjjhPJcsQnrqH5enUu4Pcb2LcMFpzimHnUgb9ft72DP5wxfzHGAWOUiUXHbAekfq5iFks8cha/RST6wkxG3Rf44Zn09aOxh1btMcGL+5xb1G0BuCQnA0fP/kDYIPwh9z22EqwRQOspIcvGeLVkFeIfubxpcMdOfQqQnZtHMCabV5Q/Rk9K1ZGc8M2hlg8gHbXMFch2xJ0Wu72eXbA/UY5MskEeBgawTQnQOK/vNm7t0AJMpWK26Qg6178UmRghmeZDj9uNRc3EI1nSbgvmGlpDmCxaAGqaGL1zW4KPW5yN25/qeqXcgCvUjZLI9PNq3Kvizp1lUrbx7heRiSoazCucvHQ1VHUzcPVLUKKTkoTP8okThnRRRsBcZ1+jI4yMWIDLOCT7IW3FePr+3xyuy5eEo9a25Ag0EWUPa7AEQALT/CmSyZ8LWlRYQZKYw417p7Z2hxqd6TjwkwM3IQ1irumkWcTZBZIbBgrSOg6CcXD2oWydCQHWi9qaxhuhEl2bJL5LskmBcMxVdQeD0LLHd8QUnbnnIby8ocvWN1alPfvJFjCUTrmD22U1ycOzRw2lIe4kiQONbOZtdWrVImQQSndjFlisitbmlWHvHm2lOOYy8+GJB7YffVV193hmnBSJffCy4bvkuLxsI+n1DhOzc7MPV3z6HGk4HiEcF0yyt9tCYhpsxHFdBoq2h771HfAcS0s98EVAqYMFnf9em+4cnYpdI6mhIfS1FQiKl6DBAYA8tT3ggla00DurPo0JwX/zN+PaO5h/6O9aCZwV7G6rbkgMuqMergXaf8oP38gr0z+MqWnkfM63Bodq68GP4l4hd02BoFBbDf38TMuGQB14+twJMdfbAxo2MbgluvQgfwHfZ2ca6gyEY+9s/YD1gugLjV+S6CB51WkFNe1z4tAPgJZNxUcKCbeaHNbthl8Hks/pY9RCEseX/EdfzF18epbSjJMPh4DPQXbUoFwmyuYcoBOPmvZHNl9hK7B/1RP8w1ZrXk8qdupC0SNbafX7270B7lMMVImzZetGsM9ypXJ6llhp3FwW09iseNyGJGPsr/dvTMGDXqOPfU/9SAS1LSTY4K9PbRtdrBE318YX8mIk5ABEBAAGJBHIEGAEIACYWIQRuXAXZecdtr5PAgTVBhN1NkHp8rgUCWUPa7AIbAgUJEswDAAJACRBBhN1NkHp8rsF0IAQZAQgAHRYhBFSmzd2JGfsgQgDYrFYnAunj7X7oBQJZQ9rsAAoJEFYnAunj7X7oR6AP/0KYmiAFeqx14Z43/6s2gt3VhxlSd8bmcVV7oJFbMhdHBIeWBp2BvsUf00I0Zl14ZkwCKfLwbbORC2eIxvzJ+QWjGfPhDmS4XUSmhlXxWnYEveSek5Tde+fmu6lqKM8CHg5BNx4GWIX/vdLi1wWJZyhrUwwICAxkuhKxuP2Z1An48930eslTD2GGcjByc27+9cIZjHKa07I/aLffo04V+oMT9/tgzoquzgpVV4jwekADo2MJjhkkPveSNI420bgT+Q7Fi1l0X1aFUniBvQMsaBa27PngWm6xE2ZYvh7nWCdd5g0c0eLIHxWwzV1lZ4Ryx4ITO/VL25ItECcjhTRdYa64sA62MYSaB0x3eR+SihpgP3wSNPFu3MJo6FKTFdi4CBAEmpWHFW7FcRmd+cQXeFrHLN3iNVWryy0HK/CUEJmiZEmpNiXecl4vPIIuyF0zgSCztQtKoMr+injpmQGC/rF/ELBVZTUSLNB350S0Ztvw0FKWDAJSxFmoxt3xycqvvt47rxTrhi78nkk6jATKGyvP55sO+K7Q7Wh0DXA69hvPrYW2eu8jGCdVGxi6HX7L1qcfEd0378S71dZ3g9o6KKl1OsDWWQ6MJ6FGBZedl/ibRfs8p5+sbCX3lQSjEFy3rx6n0rUrXx8U2qb+RCLzJlmC5MNBOTDJwHPcX6gKsUcXZrEQALmRHoo3SrewO41RCr+5nUlqiqV3AohBMhnQbGzyHf2+drutIaoh7Rj80XRh2bkkuPLwlNPf+bTXwNVGse4bej7B3oV6Ae1N7lTNVF4Qh+1OowtGjmfJPWo0z1s6HFJVxoIof9z58Msvgao0zrKGqaMWaNQ6LUeC9g9Aj/9Uqjbo8X54aLiYs8Z1WNc06jKP+gv8AWLtv6CR+l2kLez1YMDucjm7v6iuCMVAmZdmxhg5I/X2+OM3vBsqPDdQpr2TPDLX3rCrSBiS0gOQ6DwN5N5QeTkxmY/7QO8bgLo/Wzu1iilH4vMKW6LBKCaRx5UEJxKpL4wkgITsYKneIt3NTHo5EOuaYk+y2+Dvt6EQFiuMsdbfUjs3seIHsghX/cbPJa4YUqZAL8C4OtVHaijwGo0ymt9MWvS9yNKMyT0JhN2/BdeOVWrHk7wXXJn/ZjpXilicXKPx4udCF76meE+6N2u/T+RYZ7fP1QMEtNZNmYDOfA6sViuPDfQSHLNbauJBo/n1sRYAsL5mcG22UDchJrlKvmK3EOADCQg+myrm8006LltubNB4wWNzHDJ0Ls2JGzQZCd/xGyVmUiidCBUrD537WdknOYE4FD7P0cHaM9brKJ/M8LkEH0zUlo73bY4XagbnCqve6PvQb5G2Z55qhWphd6f4B6DGed86zJEa/RhS
\ No newline at end of file
diff --git a/mkosi.extra/usr/share/glib-2.0/schemas/io.elementary.desktop.wingpanel.power.gschema.xml b/mkosi.extra/usr/share/glib-2.0/schemas/io.elementary.desktop.wingpanel.power.gschema.xml
new file mode 100644
index 000000000..036c91cd9
--- /dev/null
+++ b/mkosi.extra/usr/share/glib-2.0/schemas/io.elementary.desktop.wingpanel.power.gschema.xml
@@ -0,0 +1,10 @@
+
+
+
+
+ false
+ Sets if the percentage of the primary battery is shown in the panel.
+ Enable this to see the percentage of the battery directly in the panel without having to click onto the power-indicator.
+
+
+
diff --git a/mkosi.postinst.chroot b/mkosi.postinst.chroot
new file mode 100755
index 000000000..bf18d6b05
--- /dev/null
+++ b/mkosi.postinst.chroot
@@ -0,0 +1,6 @@
+#!/bin/bash
+set -xeuo pipefail
+
+fc-cache --force --really-force --system-only --verbose
+
+glib-compile-schemas /usr/share/glib-2.0/schemas/
diff --git a/mkosi.profiles/sysupdate/mkosi.conf b/mkosi.profiles/sysupdate/mkosi.conf
new file mode 100644
index 000000000..c331e3fc6
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.conf
@@ -0,0 +1,38 @@
+[Match]
+Profiles=sysupdate
+
+[Output]
+SplitArtifacts=uki,partitions
+Format=disk
+
+[Content]
+Bootable=yes
+Bootloader=systemd-boot
+UnifiedKernelImageFormat=%i_%v_%a
+InitrdProfiles=
+KernelInitrdModules=
+ default
+ ahci
+ nvme
+ xhci_pci
+ usb_storage
+ uas
+ sd_mod
+ dm-verity
+KernelCommandLine=
+ splash
+ quiet
+ root=dissect
+ mount.usr=dissect
+ rw
+ audit=0
+ systemd.image_policy=esp=unprotected:xbootldr=unprotected+unused+absent:usr=signed:root=encrypted+absent:home=unprotected+absent:=ignore
+ systemd.image_filter=usr=Elementary_*:usr-verity=Elementary_*:usr-verity-sig=Elementary_*:root=Elementary-*:home=Elementary-*
+ systemd.debug-shell=ttyS0
+ rd.systemd.debug-shell=ttyS0
+ ipe.enforce=0
+
+[Validation]
+# just for now, please do enable secureboot
+SecureBoot=no
+SignExpectedPcr=no
diff --git a/mkosi.profiles/sysupdate/mkosi.conf.d/ubuntu/mkosi.conf b/mkosi.profiles/sysupdate/mkosi.conf.d/ubuntu/mkosi.conf
new file mode 100644
index 000000000..3f572bede
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.conf.d/ubuntu/mkosi.conf
@@ -0,0 +1,20 @@
+[Match]
+Distribution=ubuntu
+
+[Content]
+Packages=systemd-container
+
+VolatilePackages=
+ passwd
+ login
+ uidmap
+ systemd-boot
+
+InitrdVolatilePackages=
+ systemd
+ udev
+
+InitrdPackages=
+ linux-firmware
+ cryptsetup
+ cryptsetup-bin
\ No newline at end of file
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/boot/loader/loader.conf b/mkosi.profiles/sysupdate/mkosi.extra/boot/loader/loader.conf
new file mode 100644
index 000000000..e67411086
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/boot/loader/loader.conf
@@ -0,0 +1 @@
+timeout 6
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/00-esp.conf b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/00-esp.conf
new file mode 100644
index 000000000..ec520239e
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/00-esp.conf
@@ -0,0 +1,6 @@
+[Partition]
+Type=esp
+Format=vfat
+CopyFiles=/boot:/
+SizeMinBytes=1G
+SizeMaxBytes=1G
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/10-usr-verity-sig.conf b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/10-usr-verity-sig.conf
new file mode 100644
index 000000000..c6647667e
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/10-usr-verity-sig.conf
@@ -0,0 +1,4 @@
+[Partition]
+Type=usr-verity-sig
+Label=%M_%A_verity_sig
+CopyBlocks=auto
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/11-usr-verity.conf b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/11-usr-verity.conf
new file mode 100644
index 000000000..d3a162d6a
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/11-usr-verity.conf
@@ -0,0 +1,6 @@
+[Partition]
+Type=usr-verity
+Label=%M_%A_verity
+CopyBlocks=auto
+SizeMinBytes=400M
+SizeMaxBytes=400M
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/12-usr.conf b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/12-usr.conf
new file mode 100644
index 000000000..17fd4a3c2
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/12-usr.conf
@@ -0,0 +1,7 @@
+[Partition]
+Type=usr
+Label=%M_%A
+SizeMinBytes=5G
+SizeMaxBytes=20G
+Weight=2000
+CopyBlocks=auto
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/20-usr-verity-sig.conf b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/20-usr-verity-sig.conf
new file mode 100644
index 000000000..318fec069
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/20-usr-verity-sig.conf
@@ -0,0 +1,3 @@
+[Partition]
+Type=usr-verity-sig
+Label=_empty
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/21-usr-verity.conf b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/21-usr-verity.conf
new file mode 100644
index 000000000..6c813102e
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/21-usr-verity.conf
@@ -0,0 +1,6 @@
+[Partition]
+Type=usr-verity
+Label=_empty
+NoAuto=1
+SizeMinBytes=400M
+SizeMaxBytes=400M
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/22-usr.conf b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/22-usr.conf
new file mode 100644
index 000000000..aff32b239
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/22-usr.conf
@@ -0,0 +1,7 @@
+[Partition]
+Type=usr
+Label=_empty
+NoAuto=1
+SizeMinBytes=5G
+SizeMaxBytes=20G
+Weight=2000
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/40-root.conf b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/40-root.conf
new file mode 100644
index 000000000..735fb2183
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/40-root.conf
@@ -0,0 +1,10 @@
+[Partition]
+Type=root
+Format=btrfs
+SizeMinBytes=9G
+Weight=18000
+Subvolumes=/var
+MakeDirectories=/var/log/journal
+Encrypt=tpm2
+FactoryReset=yes
+Label=%M-root
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/50-home.conf b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/50-home.conf
new file mode 100644
index 000000000..3c7e04426
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/repart.d/50-home.conf
@@ -0,0 +1,7 @@
+[Partition]
+Type=home
+Format=btrfs
+SizeMinBytes=10G
+Weight=45000
+FactoryReset=yes
+Label=%M-home
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/systemd/system-preset/10-elementary.preset b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/systemd/system-preset/10-elementary.preset
new file mode 100644
index 000000000..b050c120c
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/systemd/system-preset/10-elementary.preset
@@ -0,0 +1,14 @@
+enable systemd-resolved
+enable NetworkManager.service
+enable NetworkManager-wait-online.service
+disable systemd-networkd
+
+enable systemd-timesyncd.service
+disable systemd-homed-firstboot.service
+disable systemd-firstboot.service
+
+enable systemd-homed.service
+
+disable avahi.*
+
+enable preset-global.service
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/systemd/system/preset-global.service b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/systemd/system/preset-global.service
new file mode 100644
index 000000000..53a76fbdf
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/systemd/system/preset-global.service
@@ -0,0 +1,17 @@
+[Unit]
+ConditionFirstBoot=no
+ConditionPathIsReadWrite=/etc
+
+DefaultDependencies=no
+
+Before=basic.target
+Conflicts=shutdown.target
+Before=shutdown.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=systemctl preset-all --global
+
+[Install]
+WantedBy=basic.target
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/systemd/system/systemd-firstboot.service b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/systemd/system/systemd-firstboot.service
new file mode 100644
index 000000000..4bb28c3fd
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/systemd/system/systemd-firstboot.service
@@ -0,0 +1 @@
+# Masked
\ No newline at end of file
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/systemd/zram-generator.conf b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/systemd/zram-generator.conf
new file mode 100644
index 000000000..52ea5d619
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/systemd/zram-generator.conf
@@ -0,0 +1,3 @@
+[zram0]
+zram-size = min(ram / 2, 16384)
+compression-algorithm = zstd
\ No newline at end of file
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/sysupdate.d/10-usr-verity-sig.transfer b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/sysupdate.d/10-usr-verity-sig.transfer
new file mode 100644
index 000000000..02a9f701c
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/sysupdate.d/10-usr-verity-sig.transfer
@@ -0,0 +1,15 @@
+[Transfer]
+ProtectVersion=%A
+
+[Source]
+Type=url-file
+Path=http://10.0.2.2:7676/
+MatchPattern=Elementary_@v_%a.usr-%a-verity-sig.@u.raw
+
+[Target]
+Type=partition
+Path=auto
+MatchPattern=Elementary_@v_verity_sig
+MatchPartitionType=usr-verity-sig
+PartitionFlags=0
+ReadOnly=1
\ No newline at end of file
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/sysupdate.d/11-usr-verity.transfer b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/sysupdate.d/11-usr-verity.transfer
new file mode 100644
index 000000000..c58ffde6f
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/sysupdate.d/11-usr-verity.transfer
@@ -0,0 +1,15 @@
+[Transfer]
+ProtectVersion=%A
+
+[Source]
+Type=url-file
+Path=http://10.0.2.2:7676/
+MatchPattern=Elementary_@v_%a.usr-%a-verity.@u.raw
+
+[Target]
+Type=partition
+Path=auto
+MatchPattern=Elementary_@v_verity
+MatchPartitionType=usr-verity
+PartitionFlags=0
+ReadOnly=1
\ No newline at end of file
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/sysupdate.d/12-usr.transfer b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/sysupdate.d/12-usr.transfer
new file mode 100644
index 000000000..22b81820a
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/sysupdate.d/12-usr.transfer
@@ -0,0 +1,15 @@
+[Transfer]
+ProtectVersion=%A
+
+[Source]
+Type=url-file
+Path=http://10.0.2.2:7676/
+MatchPattern=Elementary_@v_%a.usr-%a.@u.raw
+
+[Target]
+Type=partition
+Path=auto
+MatchPattern=Elementary_@v
+MatchPartitionType=usr
+PartitionFlags=0
+ReadOnly=1
\ No newline at end of file
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/sysupdate.d/20-uki.transfer b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/sysupdate.d/20-uki.transfer
new file mode 100644
index 000000000..9270dbd22
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/sysupdate.d/20-uki.transfer
@@ -0,0 +1,23 @@
+[Transfer]
+ProtectVersion=%A
+
+[Source]
+Type=url-file
+Path=http://10.0.2.2:7676/
+MatchPattern=Elementary_@v_%a.efi
+
+[Target]
+Type=regular-file
+Path=/EFI/Linux
+PathRelativeTo=boot
+MatchPattern=Elementary_@v_%a+@l-@d.efi \
+ Elementary_@v_%a+@l.efi \
+ Elementary_@v_%a.efi \
+ Elementary_@v+@l-@d.efi \
+ Elementary_@v+@l.efi \
+ Elementary_@v.efi
+# MatchPartitionType=uki
+Mode=0600
+TriesLeft=3
+TriesDone=0
+InstancesMax=2
\ No newline at end of file
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/tmpfiles.d/aliases.conf b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/tmpfiles.d/aliases.conf
new file mode 100644
index 000000000..ad5c58b98
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/tmpfiles.d/aliases.conf
@@ -0,0 +1,3 @@
+# Type Path Mode UID GID Age Target
+L+ /usr/sbin/systemd-sysupdate - - - - /usr/lib/systemd/systemd-sysupdate
+L+ /usr/sbin/sysupdate - - - - /usr/lib/systemd/systemd-sysupdate
\ No newline at end of file
diff --git a/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/tmpfiles.d/etc.conf b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/tmpfiles.d/etc.conf
new file mode 100644
index 000000000..d26cb712c
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.extra/usr/lib/tmpfiles.d/etc.conf
@@ -0,0 +1,79 @@
+# This overrides the same file from systemd since we want to symlink everything
+# into /etc instead of copying so updates to /usr propagate properly.
+L /etc/os-release - - - - ../usr/lib/os-release
+L+ /etc/mtab - - - - ../proc/self/mounts
+# Contains the default systemd locale
+L /etc/locale.conf
+L /etc/nsswitch.conf
+C /etc/profile
+C /etc/profile.d
+# Required by pam_env plugin
+C /etc/security
+L? /etc/bashrc
+L? /etc/bash.bashrc
+L? /etc/bash.bash_logout
+# TODO: drop once https://github.com/scop/bash-completion/pull/1399 is merged,
+# needed for shell completion of sd-run/run0
+L? /etc/bash_completion.d
+# Canonical location to look for certificates
+L? /etc/ca-certificates
+L? /etc/crypto-policies
+L? /etc/pki
+L /etc/debuginfod
+L /etc/ssh/ssh_config
+L /etc/ssh/ssh_config.d
+L /etc/ssh/sshd_config
+L /etc/ssh/sshd_config.d
+# Canonical location to look for certificates
+L /etc/ssl
+# niri-session requires /etc/shells
+L /etc/shells
+L /etc/sudoers
+# Required by pam environment plugin
+L /etc/environment
+# Required to generate desktop environment application menus
+C /etc/xdg
+# Contains default font configuration
+L /etc/fonts
+# Configuration for man
+L /etc/man_db.conf
+# Configuration for ldconfig
+L /etc/ld.so.conf
+L /etc/ld.so.conf.d
+# Required by authselect (Fedora/CentOS)
+L? /etc/authselect
+# Required by tuned
+L? /etc/tuned
+# Required by light
+C /etc/lightdm
+C /etc/dbus-1
+# Required by geoclue
+L? /etc/geoclue
+# Required by fwupd
+L /etc/fwupd
+# Required by gnome
+C /etc/dconf
+# Used by some services, like nftables
+L? /etc/services
+# Required by nftables service
+L? /etc/nftables.conf
+L? /etc/skel
+# CUPS is pulled in by GNOME, and fails if the configs are not there
+L? /etc/cups
+# On some distributions various binaries in /usr/bin are managed via
+# /etc/alternatives.
+L? /etc/alternatives
+# ModemManager needs its dbus policy file
+L? /etc/dbus1/systemd.d/org.freedesktop.ModemManager1.conf
+# man fails without this in /etc/
+L? /etc/manpath.config
+# WPASupplicant also needs its configuration
+L? /etc/wpa_supplicant/wpa_supplicant.conf
+# Make sure flatpak's XDG_DATA_DIR integration works
+L? /etc/profile.d/flatpak.sh
+
+C /etc/NetworkManager
+C /etc/apparmor
+C /etc/apparmor.d
+
+C /etc/sudoers.d
diff --git a/mkosi.profiles/sysupdate/mkosi.finalize b/mkosi.profiles/sysupdate/mkosi.finalize
new file mode 100755
index 000000000..e679c8d0f
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.finalize
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Capture the entirety of /etc in /usr/share/factory/etc so we can use
+# systemd-tmpfiles to symlink individual directories from it to /etc.
+mkdir -p "$BUILDROOT/usr/share/factory/"
+cp --archive --no-target-directory --update=none "$BUILDROOT/etc" "$BUILDROOT/usr/share/factory/etc"
+ln -sr "$BUILDROOT/usr" "$BUILDROOT/usr/share/factory/usr"
diff --git a/mkosi.profiles/sysupdate/mkosi.postinst.chroot b/mkosi.profiles/sysupdate/mkosi.postinst.chroot
new file mode 100755
index 000000000..14b2b5e78
--- /dev/null
+++ b/mkosi.profiles/sysupdate/mkosi.postinst.chroot
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if command -v authselect >/dev/null; then
+ authselect select local
+ authselect enable-feature with-systemd-homed
+fi
+
+if [[ -d /etc/pam.d ]]; then
+ find /etc/pam.d -mindepth 1 -exec mv {} /usr/lib/pam.d \;
+ rmdir /etc/pam.d
+fi
+
+# Get rid of obsolete stuff in the pam stack.
+find /usr/lib/pam.d/ -mindepth 1 -exec sed --in-place '/pam_shells.so/d' {} \;
+find /usr/lib/pam.d/ -mindepth 1 -exec sed --in-place '/pam_securetty.so/d' {} \;
+
+# Fedora disables the userdb ssh dropin by default, but helpfully leaves it available in
+# the package so that we can just symlink it to a name that will be picked up by systemd-tmpfiles.
+if [[ -f /usr/lib/tmpfiles.d/20-systemd-userdb.conf.example ]]; then
+ ln --symbolic 20-systemd-userdb.conf.example /usr/lib/tmpfiles.d/20-systemd-userdb.conf
+fi
+
+
+(
+ . /usr/lib/os-release
+ cat >/usr/lib/os-release </usr/lib/issue < SHA256SUMS
- if [ "$CHANNEL" == "stable" ]; then
- # install transmission
- apt-get install -y transmission-cli
- cd "$(dirname "$ISOPATH")" || exit 1
- # create torrent file
- transmission-create "$(basename "$ISOPATH")" \
- -t https://ashrise.com:443/phoenix/announce \
- -t udp://open.demonii.com:1337/announce \
- -t udp://tracker.ccc.de:80/announce \
- -t udp://tracker.istole.it:80/announce \
- -t udp://tracker.openbittorrent.com:80/announce \
- -t udp://tracker.publicbt.com:80/announce
- cd ~- || exit 1
- echo "uploading $ISO.torrent..."
- python3 upload.py "$KEY" "$SECRET" "$ENDPOINT" "$BUCKET" "$ISOPATH.torrent" "$ISO.torrent" || exit 1
+sha256sum "$RAW" | tee "$SHA"
+md5sum "$RAW" | tee "$MD5"
- fi
-done <<< "$ISOPATHS"
+upload_file "$INSTALL_BUCKET" "$RAW" "elementaryos.raw"
+upload_file "$INSTALL_BUCKET" "$SHA" "elementaryos.raw.sha256"
+upload_file "$INSTALL_BUCKET" "$MD5" "elementaryos.raw.md5"
diff --git a/workflows.sh b/workflows.sh
deleted file mode 100755
index 2dc80485e..000000000
--- a/workflows.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/bash
-
-set -e
-
-CONFIG_FILE="$1"
-KEY="$2"
-SECRET="$3"
-ENDPOINT="$4"
-BUCKET="$5"
-
-./build.sh "$CONFIG_FILE"
-./upload.sh "$CONFIG_FILE" "$KEY" "$SECRET" "$ENDPOINT" "$BUCKET"