Merge elementary/os main (23d5b98b) into dev

Justfile

@@ -35,7 +35,11 @@ check *ARGS:
     bash mseries/validate.sh {{ARGS}}
 
 genkey:
-    just mkosi genkey
+    # Like `mkosi genkey`, but with a fixed-length serial so every build's verity signature is the same size.
+    # A random serial is a byte shorter 1 in 256 times, and a shorter signature written over a longer one
+    # by an installed system's sysupdate leaves the old tail behind and breaks boot.
+    OPENSSL_CONF=/dev/null openssl req -new -x509 -newkey rsa:2048 -keyout mkosi.key -out mkosi.crt \
+        -days 730 -subj "/CN=mkosi of root/" -nodes -set_serial "0x40$(openssl rand -hex 19)"
 
 mkosi +subcommand:
     mkdir -p {{env_var('HOME')}}/.cache/mkosi-workspace

README.md

@@ -478,7 +478,7 @@ The rest of this page is the upstream elementary OS build documentation.
   </a>
   <br>
   <h1 align="center"><center>elementary OS</center></h1>
-  <h3 align="center"><center>Build scripts for image creation</center></h3>
+  <h3 align="center"><center>Mkosi configurations for building elementary OS images</center></h3>
   <br>
   <br>
 </div>
@@ -490,7 +490,7 @@ The rest of this page is the upstream elementary OS build documentation.
 
 ---
 
-## Building, Testing, and Installation
+## Building locally
 
 You'll need the following runtime dependencies:
 * podman
@@ -504,32 +504,12 @@ Generate keys and then build with `just`
 just genkey
 just do-daily
 ```
-Create install media with [Fedora Media Writer](https://flathub.org/en/apps/org.fedoraproject.MediaWriter) or [Impression](flathub.org/en/apps/io.gitlab.adhami3310.Impression), or boot with GNOME Boxes (>=51).
+This will result in a bootable .iso. </br>
+Test it out in a VM, or create an [USB install drive](https://elementary.io/docs/installation#installation) (>= 8GB)
 
-### Installation (sysupdate)
 
-Once in the liveiso, inside the terminal or a tty, run:
+## Further Information
 
-```bash
-sudo elementary-install
-```
-You will be prompted with installation options.
-
-### Installation (classic)
-
-To install classic mode, follow the steps in the GUI installer from the liveiso.
-
-## Operations
-
-### Upgrades
-
-`updatectl update`
-
-Append the exact version ID at the end to upgrade to a specific version, or downgrade.
+To get started with elementary OS, begin by [learning the basics](https://elementary.io/docs/learning-the-basics#learning-the-basics).
 
-## Minimum specs
-- UEFI with secure boot disabled
-- 8 GB of USB flash drive
-- GNOME Boxes >=51 (for VM only)
-- 55 GB of destination disk
-- 4 GB of system memory (RAM)
+For contributors, administrators and OEMs, check out the [wiki](https://github.com/elementary/os/wiki) for in-depth information.

mkosi.conf.d/ppa.daily.conf

@@ -6,3 +6,6 @@ Profiles=|proposed
 SandboxTrees=
     %D/repos/daily
     %D/repos/common-files
+ToolsTreeSandboxTrees=
+    %D/repos/daily
+    %D/repos/common-files

mkosi.conf.d/ppa.stable.conf

@@ -5,3 +5,6 @@ Profiles=stable
 SandboxTrees=
     %D/repos/stable
     %D/repos/common-files
+ToolsTreeSandboxTrees=
+    %D/repos/stable
+    %D/repos/common-files

mkosi.images/base/mkosi.conf.d/core.conf

@@ -25,6 +25,7 @@ Packages=
     network-manager
     pipewire-audio
     plymouth
+    kmscon
     sudo-rs
     systemd-boot
     systemd-coredump

mkosi.images/base/mkosi.conf.d/elementary.conf

@@ -3,6 +3,8 @@ Distribution=ubuntu
 
 [Content]
 WithRecommends=yes
+RemovePackages=
+    ubuntu-release-upgrader-core
 Packages=
     elementary-desktop
     elementary-minimal

mkosi.images/base/mkosi.extra/usr/lib/systemd/system/systemd-sysext.service.d/10_run_sysusers.conf

@@ -0,0 +1,5 @@
+# systemd-sysusers.service runs before local file systems are mounted, so it never
+# gets sysusers.d files shipped in extensions. Run it again once they are merged.
+[Service]
+ExecStartPost=systemd-sysusers
+ExecReload=systemd-sysusers

mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-nsswitch.conf

@@ -0,0 +1,2 @@
+# Override debian.conf to symlink instead of copy to get updates when they appear upstream.
+L /etc/nsswitch.conf

mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/00-var-run.conf

@@ -0,0 +1,2 @@
+# Sorts before systemd's var.conf, so this L+ replaces a /var/run directory instead of its plain L.
+L+ /var/run - - - - ../run

mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/98-anacron.conf

@@ -0,0 +1 @@
+d /var/spool/anacron 0755 root root -

mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/etc.conf

@@ -29,7 +29,6 @@ L /etc/ld.so.conf
 L /etc/ld.so.conf.d
 # Contains the default systemd locale
 L /etc/locale.conf
-L /etc/nsswitch.conf
 
 # ID
 C /etc/passwd
@@ -77,7 +76,7 @@ C /etc/sensors3.conf
 C /etc/usb_modeswitch.conf
 C /etc/thermald
 L /etc/fwupd
-L? /etc/cups
+C /etc/cups
 
 # Package Management & Updates
 C /etc/apt

mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/var.conf → mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/mseries-var.conf

@@ -1,2 +1 @@
-d     /var/spool/anacron  0755 root root -   -
 d     /run/speech-dispatcher   0755 speech-dispatcher speech-dispatcher -   -

mkosi.images/ext-virt/mkosi.conf

@@ -11,11 +11,25 @@ CompressOutput=zstd
 [Content]
 Bootable=no
 BaseTrees=%O/base_%v
+WithRecommends=yes
+RemovePackages=
+    virt-manager
 Packages=
+    qemu-system-gui
     qemu-system-x86
     qemu-system-arm
+    qemu-system-riscv
+    qemu-system-modules-opengl
+    qemu-system-modules-spice
+    qemu-system-misc
+    qemu-utils
     libvirt-daemon-system
     libvirt-clients
-    virt-manager
+    libspice-server1
+    libvirglrenderer1
+    virgl-server
+    spice-html5
     bridge-utils
+    ovmf
+    qemu-efi-aarch64
     virtinst

mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/libvirt-guests.service.d/10_libvirtd.conf

@@ -0,0 +1,6 @@
+# Start libvirtd once at boot so autostart networks and guests come up. Upholding
+# libvirtd.service directly would restart it whenever it exits idle. After= also
+# shuts guests down before libvirtd stops.
+[Unit]
+Wants=libvirtd.service
+After=libvirtd.service

mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/multi-user.target.d/10_libvirtd.conf

@@ -0,0 +1,4 @@
+# Extensions are merged after the boot transaction is built, so a .wants symlink
+# never starts these. Upholds= is re-checked after the service manager reloads.
+[Unit]
+Upholds=libvirtd.socket libvirtd-ro.socket libvirtd-admin.socket libvirt-guests.service

mkosi.images/ext-virt/mkosi.extra/usr/lib/sysusers.d/libvirt-dnsmasq.conf

@@ -0,0 +1,4 @@
+# Ubuntu creates this user in libvirt-daemon-config-network's postinst rather than
+# sysusers.d, and maintainer scripts don't run for extensions.
+# Type  Name             ID  GECOS              Home directory
+u       libvirt-dnsmasq  -   "Libvirt Dnsmasq"  /var/lib/libvirt/dnsmasq

mkosi.images/ext-virt/mkosi.extra/usr/lib/tmpfiles.d/libvirt.conf

@@ -0,0 +1,9 @@
+# Type  Path                         Mode  User          Group         Age  Argument
+d       /var/lib/libvirt/images      0711  root          root          -    -
+d       /var/lib/libvirt/qemu        0750  libvirt-qemu  kvm           -    -
+d       /var/cache/libvirt/qemu      0750  libvirt-qemu  kvm           -    -
+d       /var/log/libvirt/qemu        0750  root          libvirt-qemu  -    -
+d       /etc/mdevctl.d/              0750  root          root          -    -
+# Enable default NAT network
+C       /etc/libvirt/qemu/networks/default.xml - - - - /usr/share/libvirt/networks/default.xml
+L       /etc/libvirt/qemu/networks/autostart/default.xml - - - - /etc/libvirt/qemu/networks/default.xml

mkosi.images/ext-virt/mkosi.finalize

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Reload the service manager once this extension is merged so the units it ships
+# get loaded. mkosi names the file after the image version, hence the glob.
+release=("$BUILDROOT"/usr/lib/extension-release.d/extension-release.*)
+if [[ ${#release[@]} -ne 1 || ! -f ${release[0]} ]]; then
+    echo "Expected one extension-release file, found: ${release[*]}" >&2
+    exit 1
+fi
+echo "EXTENSION_RELOAD_MANAGER=1" >> "${release[0]}"
+
+# mkosi removes empty directories from extensions, but mdevctl won't run without
+# its callout and notifier directories.
+mkdir -p "$BUILDROOT"/usr/lib/mdevctl/scripts.d/{callouts,notifiers}

mkosi.images/liveiso/mkosi.conf

@@ -27,16 +27,26 @@ Packages=
 Bootloader=grub
 KernelInitrdModules=
     default
-    ahci
-    nvme
-    xhci_pci
-    usb_storage
-    uas
-    sd_mod
-    sr_mod
-    isofs
-    loop
-    ext4
+    /drivers/hid/
+    /drivers/usb/
+    /drivers/input/
+    /drivers/i2c/
+    /drivers/spi/
+    /drivers/pinctrl/
+    /drivers/mfd/intel-lpss*         # I2C/SPI controllers for laptop keyboards
+    /drivers/platform/surface/
+    /drivers/platform/chrome/
+    /drivers/tty/serial/8250/8250_dw # Surface keyboards via SAM
+    /drivers/ata/
+    /drivers/nvme/
+    /drivers/scsi/
+    /drivers/message/fusion/
+    /drivers/block/
+    /drivers/mmc/
+    /drivers/ufs/
+    /drivers/firewire/
+    /fs/isofs/
+    /fs/overlayfs/
 KernelCommandLine=
     rw
     console=ttyS0

mkosi.images/sysupdate/mkosi.conf

@@ -22,17 +22,29 @@ Bootable=yes
 BaseTrees=%O/base_%v
 ExtraTrees=%O/modules-db_%a-%v
 Output=elementary_%v
-CleanPackageMetadata=yes
+# mkosi.finalize.chroot needs the package database. /var isn't shipped in this image.
+CleanPackageMetadata=no
 Bootloader=systemd-boot
 KernelInitrdModules=
     default
-    ahci
-    nvme
-    xhci_pci
-    usb_storage
-    uas
-    sd_mod
-    dm-verity
+    /drivers/hid/
+    /drivers/usb/
+    /drivers/input/
+    /drivers/i2c/
+    /drivers/spi/
+    /drivers/pinctrl/
+    /drivers/mfd/intel-lpss*         # I2C/SPI controllers for laptop keyboards
+    /drivers/platform/surface/
+    /drivers/platform/chrome/
+    /drivers/tty/serial/8250/8250_dw # Surface keyboards via SAM
+    /drivers/ata/
+    /drivers/nvme/
+    /drivers/scsi/
+    /drivers/message/fusion/
+    /drivers/block/
+    /drivers/mmc/
+    /drivers/ufs/
+    /drivers/firewire/
 KernelCommandLine=
     splash
     quiet

mkosi.images/sysupdate/mkosi.finalize.chroot

@@ -0,0 +1,7 @@
+#!/bin/bash
+set -xeuo pipefail
+
+# Keep a backup of the package database so it can be restored at runtime if needed.
+# This runs after RemovePackages= so the database matches what's in the image.
+mkdir -p /usr/share/factory/dpkg/
+tar -czf /usr/share/factory/dpkg/dpkg.tar.gz -C / var/lib/dpkg

mkosi.images/sysupdate/mkosi.repart/20-usr-verify-sig-bside.conf

@@ -1,3 +1,4 @@
 [Partition]
 Type=usr-verity-sig
 Label=_empty
+SplitName=-

mseries/OS9-HANDOFF.md

@@ -1,3 +1,7 @@
+## elementary/os upstream sync and repo housekeeping — 2026-10-31
+
+Merged `elementary/os` `main` into `dev` up to `23d5b98b10` (13 commits since the 2026-10-12 sync): kmscon by default, `/var/run` and dpkg-database fixes, virt extension update, driver-directory initrd modules, release-upgrader removal. Conflicts: kept our `sysusers.d/00-session.conf`; took upstream's deletion of `tmpfiles.d/var.conf` and moved our `/run/speech-dispatcher` line to `tmpfiles.d/mseries-var.conf`. Pins updated in `UPSTREAM-PINS.md`; details in `upstream-audits/daily/2026-10-31.md`. Verified: merge resolves cleanly; checks are the PR CI run (local `validate.sh` needs bash 4+, not on this Mac). Image build: `daily-9.0` run 41226284220 on merge commit `96ce379f` built `elementaryos-9.0-daily-arm64.20261031174950.iso` (8.0 GB, kmscon 9.3.2-1 installed) and `test-image-wiring.py` passed ("Built live ISO hardware payload check passed"). Not verified: kmscon on the console or any boot on the j314s. Found the upstream watch dashboard failing since 2026-10-28 (issue body over 65,536 characters with 510 sources); fixed separately. Next: CodexBar v0.78.0 -> v0.83.0 port bump; audit the omarchy-mac-pkgs DSP-microphone and initramfs backlight candidates.
+
 ## Warren local AI and eGPU updates — 2026-10-30
 
 Installed `mseries-nvidia-open-source` `595.112.07+apple.1-1` (SHA-256 `a397b68a...b209ab23`) containing the three prepared NVIDIA fixes and license at `/usr/src/mseries-nvidia-open-595.112.07`. This is source only; no NVIDIA module or matching CUDA userspace is installed. The [source package script](nvidia-egpu/package-source.sh) verifies the exact prepared diff before packaging.

mseries/UPSTREAM-PINS.md

@@ -24,6 +24,16 @@ The fetched `elementary/os` `main` reference on 2026-10-13 was
 `7024fd04646a6a8565bf6805989b59fd72de928c`. This is the comparison point for
 the OS 9 source audit; recheck the upstream branch before the next port.
 
+On 2026-10-31 `dev` merged `elementary/os` `main` up to
+`23d5b98b101e8e1d72cced853f46205c784aefd9` ("Use drivers directories instead
+of manual entries (#935)", 2026-10-25): 13 commits, including kmscon by
+default (#917), the `/var/run` and dpkg-database fixes (#925, #931, #933), the
+virt extension update (#920) and driver-directory initrd modules (#921, #935).
+Upstream deleted `tmpfiles.d/var.conf` so it no longer shadows systemd's file;
+our `/run/speech-dispatcher` entry moved to `tmpfiles.d/mseries-var.conf`. Our
+`sysusers.d/00-session.conf` keeps its M-series form (dbus.conf owns
+messagebus). See `mseries/upstream-audits/daily/2026-10-31.md`.
+
 ## Wingpanel network speed readout
 
 The Apple Silicon image builds `elementary/panel-network` at