Finish the wonderland: System told truthfully, in eight tabs instead of ten

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8

config/dot/quickshell/scripts/panama-about

@@ -3,10 +3,11 @@
 # What this machine is, as JSON: {label, value} pairs in display order.
 #
 # GNOME's About panel answers "what am I running on" in one screen, and
-# fastfetch answers it in more detail; this covers both -- model, OS, kernel,
-# uptime, package counts, shell, resolution, processor, memory, swap, disk and
-# locale. Rows are ordered roughly the way fastfetch presents them: what the
-# system is, then what is installed on it, then the hardware underneath.
+# fastfetch answers it in more detail; this covers both -- model, OS, Panama's
+# own revision, firmware, Secure Boot, kernel, uptime, package counts, shell,
+# resolution, processor, memory, swap, disk and locale. Rows are ordered
+# roughly the way fastfetch presents them: what the system is, then what is
+# installed on it, then the hardware underneath.
 #
 # Graphics is deliberately absent: GraphicsDevices already enumerates GPUs for
 # the vitals readout, and naming them again here would be a second source of
@@ -43,6 +44,20 @@ dmi() {
     printf '%s' "$value"
 }
 
+# Which Panama this is, from the checkout it is running out of. A version
+# string restated in a file would be a second source of truth that goes stale
+# the moment somebody forgets to bump it; the commit cannot. Absent outside a
+# git checkout -- an installed copy without .git legitimately has no answer.
+# The script's own directory, not a counted number of "..": this tree is
+# symlinked into ~/.config/quickshell, and git discovers the checkout by
+# walking up from wherever it is told to start.
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if command -v git >/dev/null 2>&1 && git -C "$repo_root" rev-parse --git-dir >/dev/null 2>&1; then
+    panama_rev="$(git -C "$repo_root" describe --tags --always --dirty 2>/dev/null)"
+    panama_age="$(git -C "$repo_root" log -1 --format=%cr 2>/dev/null)"
+    emit "Panama" "${panama_rev}${panama_age:+ · $panama_age}"
+fi
+
 vendor="$(dmi sys_vendor)"
 product="$(dmi product_name)"
 if [[ -n "$vendor" && -n "$product" ]]; then
@@ -51,6 +66,29 @@ else
     emit "Model" "${product:-$vendor}"
 fi
 
+# The BIOS/UEFI version, which is the one firmware fact a person is ever asked
+# for. DMI first because it is a free file read; bootctl only as the fallback,
+# since it reports "n/a" on this class of machine and shelling out for that
+# would be a slower way to learn nothing.
+firmware="$(dmi bios_version)"
+if [[ -z "$firmware" ]] && command -v bootctl >/dev/null 2>&1; then
+    firmware="$(bootctl status 2>/dev/null \
+        | awk -F': *' '/^ *Firmware:/ { print $2; exit }' \
+        | sed 's/ *(n\/a)$//')"
+    [[ "$firmware" == "n/a"* ]] && firmware=""
+fi
+bios_date="$(dmi bios_date)"
+emit "Firmware" "${firmware:+${firmware}${bios_date:+ · $bios_date}}"
+
+# Absent-tolerant on purpose: mokutil is not installed everywhere, and a
+# machine that cannot answer "is Secure Boot on" should not claim it is off.
+if command -v mokutil >/dev/null 2>&1; then
+    case "$(mokutil --sb-state 2>/dev/null)" in
+        *"SecureBoot enabled"*)  emit "Secure Boot" "Enabled" ;;
+        *"SecureBoot disabled"*) emit "Secure Boot" "Disabled" ;;
+    esac
+fi
+
 emit "Hostname" "$(hostnamectl hostname 2>/dev/null || hostname 2>/dev/null)"
 emit "Kernel" "$(uname -r 2>/dev/null)"