Librem 11 release

Initial packages for Librem 11

Don't you want to use the high-res backround ?

You mean the 3840x2160 byzantium background? Personally I thought this one looked a lot better.

The dithering/noise in the blue-purple gradient looks really "patchy" to me like JPEG artifacts, not sure if this is really a compression artifact or intentional but it does not look great on this display IMO. I think it's the vibrant AMOLED display, they are not as prominent to me on my LG desktop LCD. (Admittedly JPEG artifacts are a bit of a pet peeve of mine, they just sort of stick out to me ).

The phone background looks great IMO. I don't notice any JPEG artifacts, and even though it is upscaled a bit in the horizontal orientation it is not noticeable at all.

/cc @francois.techene regarding background

I'd avoid shipping the wallpaper in here. Either https://gitlab.gnome.org/guidog/phosh-wallpapers/ (if we consider it "upstreamable") or a the PureOS artwork package (as it then later on works with GNOME Shell too) would be a good fit.

Is that so or use the fdo sound theme as the laptops?

Not sure, this device is precisely in between the phone and laptops IMO. Now that you mention it, I think I will remove this though since the sound theme package is specifically called 'librem5', doubt any of the sounds would actually say the brand name but I guess you never know

This is removed now

are these needed? I would expect to rather have suspend on there?

Yes, meant to delete this, thank you

We now have 5 minute sleep on battery, no sleep on AC

assigned to @jonathon.hall

added 1 commit

• 68c1cddd - .gitlab-ci.yml: Build package in CI

Compare with previous version

added 1 commit

• 633094a0 - debian/pureos-ci.yml: Build package in CI

Compare with previous version

added 1 commit

• c8a3d209 - debian/pureos-ci.yml: Build package in CI

Compare with previous version

have you tried without this? I would assume this is not needed on L11 (and it could potentially be demoted to recommends as well (see e.g. Librem5/librem5-base!375 (merged) )

changed this line in version 5 of the diff

I looked over the package and tried Firefox with/without firefox-esr-mobile-config.

It has a visible impact on the default new tab page:

• Default search engine is DuckDuckGo instead of Google
• Telemetry is disabled, so you don't get the "Firefox automatically sends some data... [Choose What I Share]" banner
• The mostly-social-media shortcuts are removed, in particular the sponsored ones

IMO this is significant enough that I would prefer to keep it. It's much cleaner and a bit less creepy. I did move it to recommends though.

The adaptive changes for small displays don't matter, but AFAICT they don't harm anything either. The repo says it removes other search engines besides DDG and Wikipedia and also installs uBlock Origin by default, but those don't seem to actually work. (They would be awesome though.)

Also @guido.gunther, regarding this comment (Librem5/librem5-base!375 (comment 248225)) - AFAICT we do install non-gnome by default on L5 because librem5-gnome depends on librem5-non-gnome.

Default without firefox-esr-mobile-config:

Default with firefox-esr-mobile-config:

When/where is this file touched? I couldn't find anything grepping the repo

The image builder writes the dump file with a copy of the original LUKS header from the image, so this script can tell if it needs to reencrypt by comparing the LUKS header.

(I copied this from https://source.puri.sm/Librem5/librem5-base/-/blob/pureos/latest/default/initramfs-tools/scripts/local-bottom/0reencrypt - could/should we move it to a common package somewhere? Or maybe the image builder could place this file since it is somewhat specific to the way it builds the image?)

Nothing touches reencrypt-disabled - I figured that was for testing or something. The script knows whether to start a reencrypt by comparing the LUKS header, so it doesn't have to write anything specific to indicate that a reencrypt has already been done.

The Librem 5 image builder using vmdebootstrap dumps it here: https://source.puri.sm/Librem5/image-builder/-/blob/master/root.sh#L102

The new builder for L11 (and hopefully eventually L5 too) does it here: https://source.puri.sm/jonathon.hall/pureos-image-recipes/-/blob/librem11/scripts/img/mkimg.sh#L139 (This wasn't here when you reviewed though, was still working on it.)

so I take it this is only supposed to run once on first boot (after rootfs has been resized?)

what happens if the passphrase was changed?

Mostly. It's only supposed to start a reencrypt once, but it could also resume a reencryption if the reencryption was interrupted somehow (power failure / force shut down / etc.).

It's before resizing. I believe reencrypting after resize would take much longer since it would reencrypt all the "free" space - I suppose this would mean nothing is leaked about how much space is in use, but I think it would take way too long to block the first boot out of the box.

The only way to change the passphrase would be to do it manually from PureBoot, or an initramfs shell, etc.; fairly 'expert' methods. The reencryption blocks boot, so you can't boot until it's complete. If you did change the passphrase, the LUKS header would no longer match, so no reencryption would occur.

I did not test those scenarios since it's the same script we're shipping on L5.

Does this not lack a cryptsetup luksDump to $DUMPFILE somewhere in this block?

The dump comes from the image builder, since it's intending to check if the LUKS header is still the one from the image.

nit: maybe @guido.gunther can open a MR against librem5-ci and then the URL could be adjusted?

I was a bit confused around reencryption, because I didn't see how it get's disabled.

Other than that I left some nits here and there.

Thanks for working on this!

I think we don't need that for current GTK4

With phosh-core in there we can drop a lot of dependencies in crimson. These are the deps of phosh-core:

 dconf-gsettings-backend,
 evolution-data-server,
 feedbackd (>= 0.2.0),
 fonts-cantarell,
 glib-networking,
 gnome-backgrounds,
 gnome-control-center (>= 1:44),
 gnome-keyring,
 gnome-online-accounts,
 gnome-settings-daemon (>= 44),
 gnome-session-bin,
 gnome-session-common,
 gsettings-desktop-schemas,
 gstreamer1.0-packagekit,
 gstreamer1.0-plugins-base,
 gstreamer1.0-plugins-good,
 gvfs-backends,
 gvfs-fuse [linux-any],
 libglib2.0-bin,
 libpam-gnome-keyring,
 network-manager,
 phosh (>= 0.27.0),
 phosh-mobile-tweaks,
 pipewire-pulse | pulseaudio,
 libspa-0.2-bluetooth | libspa-0.2-bluetooth,,
 sound-theme-freedesktop,
 squeekboard (>= 1.22.0) | phosh-osk-stub (>= 0.27.0),

We have also phosh-{phone,tablet} nowadays. Using that would make the dependency list even shorter.

(if time is tight this can be cleaned up past release)

Thanks, cleaned all of this up. Spotted a few packages that were related to phone hardware as well.

Details in the commit (!1 (0570d57d)), but I added pureos-standard and phosh-full. Also added phosh-tablet to ensure the dep from phosh-full on phosh-phone | phosh-tablet doesn't pull in the phone packages.