Merge branch 'main' into fastfetch-package

.github/workflows/build-image-gts.yml

@@ -21,7 +21,7 @@ jobs:
       matrix:
         brand_name: [bluefin]
     with:
-      kernel_pin: 6.11.8-200.fc40.x86_64     ## This is where kernels get pinned.
+      kernel_pin: 6.11.11-200.fc40.x86_64     ## This is where kernels get pinned.
       brand_name: ${{ matrix.brand_name }}
       stream_name: gts
 

.github/workflows/build-image-stable.yml

@@ -23,7 +23,7 @@ jobs:
       matrix:
         brand_name: ["bluefin"]
     with:
-      kernel_pin: 6.11.8-300.fc41.x86_64 ## This is where kernels get pinned.
+      kernel_pin: 6.11.11-300.fc41.x86_64 ## This is where kernels get pinned.
       brand_name: ${{ matrix.brand_name }}
       stream_name: stable
 

.github/workflows/clean.yml

@@ -14,7 +14,7 @@ jobs:
       packages: write
     steps:
       - name: Delete Images Older Than 90 Days
-        uses: dataaxiom/ghcr-cleanup-action@2d58aab3d24aed94070e032d3091b83d50d93534 # v1.0.15
+        uses: dataaxiom/ghcr-cleanup-action@cd0cdb900b5dbf3a6f2cc869f0dbb0b8211f50c4 # v1.0.16
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           packages: bluefin,bluefin-asus-nvidia,bluefin-dx,bluefin-dx-asus-nvidia,bluefin-dx-hwe,bluefin-dx-hwe-nvidia,bluefin-dx-nvidia,bluefin-hwe,bluefin-nvidia

.github/workflows/reusable-build-iso.yml

@@ -71,7 +71,7 @@ jobs:
 
       - name: Upload ISOs and Checksum to Job Artifacts
         if: github.ref_name == 'testing'
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
         with:
           name: ${{ env.ISO_NAME }}
           path: ${{ steps.upload-directory.outputs.iso-upload-dir }}

.github/workflows/reusable-build.yml

@@ -155,7 +155,7 @@ jobs:
       - name: Push to GHCR
         id: push
         if: github.event_name != 'pull_request'
-        uses: Wandalen/wretry.action@ffdd254f4eaf1562b8a2c66aeaa37f1ff2231179 # v3.7.3
+        uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0
         with:
           attempt_limit: 3
           attempt_delay: 15000
@@ -216,7 +216,7 @@ jobs:
 
       - name: Upload artifact
         if: github.event_name != 'pull_request'
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
         with:
           name: image-${{ env.IMAGE_NAME }}-${{ matrix.stream_name }}
           retention-days: 1

.github/workflows/reusable-image-scan.yml

@@ -71,7 +71,7 @@ jobs:
           echo "name=$(echo ${IMAGE} | awk -F'/' '{print $NF}' | sed 's/:/-/g')" >> $GITHUB_OUTPUT
 
       - name: Upload scan results
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
         with:
           name: security-${{ steps.artifact-name.outputs.name }}
           if-no-files-found: error

build_files/base/05-override-install.sh

@@ -49,6 +49,13 @@ pip install --prefix=/usr topgrade
 # Install ublue-update -- breaks with packages.json due to missing topgrade
 rpm-ostree install ublue-update
 
+# Required for bluefin faces to work without conflicting with a ton of packages
+rm -f /usr/share/pixmaps/faces/* || echo "Expected directory deletion to fail"
+mv /usr/share/pixmaps/faces/bluefin/* /usr/share/pixmaps/faces
+rm -rf /usr/share/pixmaps/faces/bluefin
+
+rpm-ostree override remove fedora-logos --install=bluefin-logos
+
 # Consolidate Just Files
 find /tmp/just -iname '*.just' -exec printf "\n\n" \; -exec cat {} \; >> /usr/share/ublue-os/just/60-custom.just
 

build_files/base/09-hwe-additions.sh

@@ -42,24 +42,9 @@ rpm-ostree install \
     "${SURFACE_PACKAGES[@]}"
 
 tee /usr/lib/modules-load.d/ublue-surface.conf << EOF
-# Add modules necessary for Disk Encryption via keyboard
-surface_aggregator
-surface_aggregator_registry
-surface_aggregator_hub
-surface_hid_core
-8250_dw
-
-# Surface Laptop 3/Surface Book 3 and later
-surface_hid
-surface_kbd
-
 # Only on AMD models
 pinctrl_amd
 
-# Only on Intel models
-intel_lpss
-intel_lpss_pci
-
 # Surface Book 2
 pinctrl_sunrisepoint
 
@@ -74,6 +59,21 @@ pinctrl_alderlake
 
 # For Surface Pro 10/Surface Laptop 6
 pinctrl_meteorlake
+
+# Only on Intel models
+intel_lpss
+intel_lpss_pci
+
+# Add modules necessary for Disk Encryption via keyboard
+surface_aggregator
+surface_aggregator_registry
+surface_aggregator_hub
+surface_hid_core
+8250_dw
+
+# Surface Laptop 3/Surface Book 3 and later
+surface_hid
+surface_kbd
 EOF
 
 echo "::endgroup::"

build_files/base/18-workarounds.sh

@@ -19,11 +19,4 @@ fi
 #    rpm-ostree override replace https://bodhi.fedoraproject.org/updates/FEDORA-2024-dd2e9fb225
 #fi
 
-# Ping sssd version
-# See Issue: https://github.com/ublue-os/bluefin/issues/2118
-if [ "$FEDORA_MAJOR_VERSION" -eq "41" ]; then
-      rpm-ostree override replace https://bodhi.fedoraproject.org/updates/FEDORA-2024-bfd5344277
-fi
-
-
 echo "::endgroup::"

just/bluefin-system.just

@@ -146,8 +146,8 @@ configure-vfio ACTION="":
     This is only used for GPU passthrough of a secondary dGPU.
     It will enable vfio and configure kvmfr for use with $(Urllink "https://looking-glass.io" "Looking Glass")
     If you do not plan to use any of this then press ESC.
-    EOF
     ${bold}NOTE:${normal} Since this is a niche use case, support will be ${b}very limited${n}
+    EOF
         OPTION=$(Choose \
           "Enable VFIO drivers" \
           "Disable VFIO drivers" \
@@ -156,32 +156,31 @@ configure-vfio ACTION="":
     fi
     if [[ "${OPTION,,}" =~ (^enable[[:space:]]vfio|vfio-on) ]]; then
         echo "Enabling VFIO..."
-        VIRT_TEST=$(rpm-ostree kargs)
         CPU_VENDOR=$(grep "vendor_id" "/proc/cpuinfo" | uniq | awk -F": " '{ print $2 }')
         VENDOR_KARG="unset"
-        if [[ ${VIRT_TEST} == *kvm.report_ignored_msrs* ]]; then
-            echo 'add_drivers+=" vfio vfio_iommu_type1 vfio-pci "' | sudo tee /etc/dracut.conf.d/vfio.conf
-            rpm-ostree initramfs --enable
-            if [[ ${CPU_VENDOR} == "AuthenticAMD" ]]; then
-                VENDOR_KARG="amd_iommu=on"
-            elif [[ ${CPU_VENDOR} == "GenuineIntel" ]]; then
-                VENDOR_KARG="intel_iommu=on"
-            fi
-            if [[ ${VENDOR_KARG} == "unset" ]]; then
-                echo "Failed to get CPU vendor, exiting..."
-                exit 1
-            else
-                rpm-ostree kargs \
-                  --append-if-missing="${VENDOR_KARG}" \
-                  --append-if-missing="iommu=pt" \
-                  --append-if-missing="rd.driver.pre=vfio_pci" \
-                  --append-if-missing="vfio_pci.disable_vga=1"
-                echo "VFIO will be enabled on next boot, make sure you enable IOMMU, VT-d or AMD-v in your BIOS!"
-                echo "Please understand that since this is such a niche use case, support will be very limited!"
-                echo "To add your unused/second GPU device ids to the vfio driver by running"
-                echo 'rpm-ostree kargs --append-if-missing="vfio-pci.ids=xxxx:yyyy,xxxx:yyzz"'
-                echo "NOTE: Your second GPU will not be usable by the host after you do this!"
-            fi
+        echo 'add_drivers+=" vfio vfio_iommu_type1 vfio-pci "' | sudo tee /etc/dracut.conf.d/vfio.conf
+        rpm-ostree initramfs --enable
+        if [[ ${CPU_VENDOR} == "AuthenticAMD" ]]; then
+            VENDOR_KARG="amd_iommu=on"
+        elif [[ ${CPU_VENDOR} == "GenuineIntel" ]]; then
+            VENDOR_KARG="intel_iommu=on"
+        fi
+        if [[ ${VENDOR_KARG} == "unset" ]]; then
+            echo "Failed to get CPU vendor, exiting..."
+            exit 1
+        else
+            rpm-ostree kargs \
+                --append-if-missing="${VENDOR_KARG}" \
+                --append-if-missing="iommu=pt" \
+                --append-if-missing="rd.driver.pre=vfio_pci" \
+                --append-if-missing="vfio_pci.disable_vga=1" \
+                --append-if-missing="kvm.ignore_msrs=1" \
+                --append-if-missing="kvm.report_ignored_msrs=0"
+            echo "VFIO will be enabled on next boot, make sure you enable IOMMU, VT-d or AMD-v in your BIOS!"
+            echo "Please understand that since this is such a niche use case, support will be very limited!"
+            echo "To add your unused/second GPU device ids to the vfio driver by running"
+            echo 'rpm-ostree kargs --append-if-missing="vfio-pci.ids=xxxx:yyyy,xxxx:yyzz"'
+            echo "NOTE: Your second GPU will not be usable by the host after you do this!"
         fi
     elif [[ "${OPTION,,}" =~ (^disable[[:space:]]vfio|vfio-off) ]]; then
         echo ""

packages.json

@@ -10,6 +10,7 @@
 				"bootc",
 				"bluefin-cli-logos",
 				"bluefin-fastfetch",
+				"bluefin-faces",
 				"ddcutil",
 				"evtest",
 				"epson-inkjet-printer-escpr",
@@ -58,6 +59,7 @@
 				"tailscale",
 				"tmux",
 				"ublue-fastfetch",
+				"ublue-motd",
 				"usbmuxd",
 				"wireguard-tools",
 				"xprop",

system_files/shared/usr/libexec/ublue-system-setup

@@ -9,7 +9,7 @@ VEN_ID="$(cat /sys/devices/virtual/dmi/id/chassis_vendor)"
 CPU_VENDOR=$(grep "vendor_id" "/proc/cpuinfo" | uniq | awk -F": " '{ print $2 }')
 
 # SCRIPT VERSION
-HWS_VER=3
+HWS_VER=4
 HWS_VER_FILE="/etc/ublue/hws_version"
 [[ -f "$HWS_VER_FILE" ]] && HWS_VER_RAN=$(cat $HWS_VER_FILE)
 
@@ -63,9 +63,11 @@ else
   echo "No karg changes needed"
 fi
 
+SYS_ID="$(cat /sys/devices/virtual/dmi/id/product_name)"
+
 # FRAMEWORK 13 AMD FIXES
 if [[ ":Framework:" =~ ":$VEN_ID:" ]]; then
-  if [[ $SYS_ID == "Laptop ("* ]]; then
+  if [[ $SYS_ID == "Laptop 13 ("* ]]; then
     if [[ "AuthenticAMD" == "$CPU_VENDOR" ]]; then
       if [[ ! -f /etc/modprobe.d/alsa.conf ]]; then
         echo 'Fixing 3.5mm jack'