Gabriel Brown
153554b5df
The audit's third tier: everything between this installer and a fresh machine it has never met. The one path that could cost a person their display: the interview probes Secure Boot with mokutil, which install-packages had not installed yet, so on a minimal base the MOK question silently never fired -- and install-hardware still installed akmod-nvidia and blacklisted nouveau, arming a reboot into an unloadable driver with its fallback disabled. The probe tools (pciutils, mokutil, fwupd) now bootstrap beside gum, and install-hardware re-checks Secure Boot for itself and refuses the driver rather than the display. Secrets leave the checkout: the personal environment moves to ~/.config/panama/env at mode 600 by migration, and .bashrc sources it with a permission check that quietly re-tightens drift. change-settings no longer overwrites /etc/dnf/dnf.conf -- two performance keys are set additively, the defaultyes=True that made every `dnf remove` treat Enter as yes is gone, and a migration strips it from machines that already received it. Package installation survives the world changing: the initial and desktop lists run with --skip-unavailable and a report_missing pass that names what was skipped (resolved through --whatprovides, so capability names like awk do not cry wolf); the openh264, appstream and core-group extras go through soft; RustDesk resolves its RPM for the machine's own architecture; and the Claude Desktop repository script is fetched to a kept file and run, never piped from the network into root. The hardware predicates stop guessing: a wireless mouse's scope=Device battery no longer turns a tower into a laptop, USB-PD-only machines read their power state from the battery's own status instead of being permanently "on AC", the lid falls back to logind's LidClosed where ACPI is silent, and charge limits reach every pack of a two-battery machine in one authorization -- with the reported percentage summed across packs. And the parsers stop assuming this machine: snapper is read through --machine-readable csv with named columns instead of a localized box-drawing table, and reports whether snapshots are even possible so ext4 and unconfigured-btrfs stop looking identical; fprintd is parsed under LC_ALL=C; the hypridle drop-in resolves the binary it points at; the recorder's render node became an "auto" token resolved at record time; update-grub writes the config its firmware actually boots; the nvm prompt hook and the SSH tmux takeover are guarded; hipblas and rocm-opencl move to an opt-in gpu-compute category; and the two interactive python tools' libraries are declared. Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh
92 lines
3.0 KiB
Plaintext
92 lines
3.0 KiB
Plaintext
adw-gtk3-theme
|
|
akmods
|
|
alsa-plugins-pulseaudio
|
|
cascadiamono-nerd-fonts
|
|
decibels
|
|
# The Wayland build specifically; the x11 one cannot inject into this session.
|
|
# Its config is linked by link-dotfiles.
|
|
espanso-wayland
|
|
desktop-file-utils
|
|
dnf-plugins-core
|
|
ffmpeg
|
|
firamono-nerd-fonts
|
|
# A second engine to check pages against; Helium is the daily driver. Its
|
|
# chrome is themed from config/firefox, which link-dotfiles places into the
|
|
# profile.
|
|
firefox
|
|
fuse-libs
|
|
# Ghostty and its config in config/dot/ghostty are linked by link-dotfiles.
|
|
ghostty
|
|
# The Calendar agenda opens events in this; see CalendarAgenda.qml.
|
|
gnome-calendar
|
|
# NOT GNOME-session residue. Panama's own Settings hands off to this for the
|
|
# panels it deliberately does not own -- Online Accounts, Color, Sound, Network,
|
|
# Keyboard, Privacy, Wellbeing, Accessibility, and the System panel for users,
|
|
# date and time, region and remote desktop. See the allow-list in
|
|
# services/SystemSettings.qml, which is what decides.
|
|
gnome-control-center
|
|
# install-hardware sets the nouveau blacklist and nvidia-drm.modeset with
|
|
# grubby, which replaces an argument it already set rather than appending a
|
|
# second copy -- the reason that stage needs no editor.
|
|
grubby
|
|
# fmp4 and mp4 are deliberately absent: Fedora 44 no longer packages either
|
|
# (dnf5 refuses the whole transaction over one missing name, so a dead entry
|
|
# here costs the entire desktop). Machines installed on older Fedora still
|
|
# carry them as orphans, which is why this list looked fine from one.
|
|
gstreamer1-plugin-gif
|
|
gstreamer1-plugin-gtk4
|
|
gstreamer1-plugin-hsv
|
|
gstreamer1-plugin-json
|
|
gstreamer1-plugin-libav
|
|
gstreamer1-plugin-openh264
|
|
gstreamer1-plugins-bad-free-devel
|
|
gstreamer1-plugins-good
|
|
gstreamer1-plugins-good-extras
|
|
gstreamer1-plugins-good-gtk
|
|
gstreamer1-plugins-good-qt
|
|
gstreamer1-plugins-good-qt6
|
|
jetbrainsmono-nerd-fonts
|
|
kernel-devel
|
|
lame
|
|
lame-devel
|
|
libva-devel
|
|
libva-utils
|
|
libxcrypt-compat
|
|
loupe
|
|
mesa-libGL-devel
|
|
mesa-libGLU
|
|
mesa-libOpenCL
|
|
mokutil
|
|
mozilla-openh264
|
|
# Arial, Georgia and Times, so web pages that assume them render correctly.
|
|
mscore-fonts
|
|
nautilus
|
|
nautilus-extensions
|
|
# Also what lets Nautilus load Panama's own right-click extensions: send to
|
|
# phone, and convert a video or image. See config/local/share/nautilus-python.
|
|
nautilus-python
|
|
# Ships both the Nautilus "Open in Terminal" extension and its gsettings
|
|
# schema. Panama used to copy its own fork of the extension over the same
|
|
# path, which left a fresh machine with the extension and no schema -- and
|
|
# the fork had drifted 63 lines behind the packaged one.
|
|
nautilus-open-any-terminal
|
|
nextcloud-client
|
|
openssl-devel
|
|
opus-devel
|
|
papers
|
|
python3-dnf-plugin-versionlock
|
|
# The launcher's Copy Password command; talks to the same Bitwarden account
|
|
# the desktop app signs into. See panama-pick.
|
|
rbw
|
|
# The Snapshots page is snapper end to end; see scripts/panama-snapshots.
|
|
snapper
|
|
sushi
|
|
# Fonts the desktop names by family and would otherwise render as tofu.
|
|
# VictorMono is required: it draws every glyph in the shell.
|
|
victormono-nerd-fonts
|
|
wine
|
|
wine-core
|
|
wine-mono
|
|
winetricks
|
|
xdg-utils
|