chore: bring in aurorafin-shared (#241)

* chore: add all the things from aurorafin-shared Bluefin is not interested in the lack of AI in the development process of it, let's put everything here. It still makes sense to have this repo to avoid fetching the wallpapers/udev rules in an image build every single time. * fix: correct path for binary * remainings * chore: remove ai stuff we don't use * redo brew validation * use bbrew from main homebrew * remove tiup this is broken, is it gone from some tap? * remove kcl from brewfiles something is broken here as well
2026-11-03 21:49:43 -09:00 · 2026-07-28 20:20:57 +02:00 · 2026-07-28 20:20:57 +02:00 · 7b5c072ad0
commit 7b5c072ad0
parent 0ad800bb4a
72 changed files with 1792 additions and 643 deletions
--- a/.gemini/config.yaml
+++ b/.gemini/config.yaml
@ -1,13 +0,0 @@
-have_fun: true
-memory_config:
-  disabled: true
-code_review:
-  disable: false
-  comment_severity_threshold: HIGH
-  max_review_comments: -1
-  pull_request_opened:
-    help: false
-    summary: false
-    code_review: true
-    include_drafts: true
-ignore_patterns: []
--- a/.gemini/style-guide.md
+++ b/.gemini/style-guide.md
@ -1,375 +0,0 @@
-# Aurora-Common Style Guide
-
-This document defines the coding and configuration standards for the aurora-common repository.
-
-## Repository Overview
-
-Aurora-common is a minimal OCI layer containing shared configuration files for Aurora and Aurora-DX variants. It builds on top of projectbluefin/common and contains no compiled code—only configuration files, shell scripts, and Just recipes.
-
-## File Organization
-
-### Directory Structure Standards
-
-**Always maintain the two-tier structure:**
- `system_files/shared/` - Configuration shared between Aurora and Aurora-DX
- `system_files/dx/` - Aurora-DX specific configurations (developer experience tools)
-
-**Placement rules:**
- DX/developer-specific files → `system_files/dx/`
- Reusable system configurations → `system_files/shared/`
- When in doubt, prefer `shared/` unless it requires DX-specific functionality
-
-**Preserve target system paths:**
-Files must mirror their final destination paths:
-```
-system_files/shared/usr/share/ublue-os/just/example.just
-system_files/dx/etc/profile.d/dx-env.sh
-```
-
-## Shell Scripts (.sh)
-
-### Shebang
-Use `#!/usr/bin/bash` or `#!/usr/bin/env bash` consistently.
-
-### Style
- Use lowercase for local variables: `local_var="value"`
- Use UPPERCASE for environment variables: `SETUP_CHECKER_FILE="${HOME}/.local/share/ublue/setup_versioning.json"`
- Always quote variable expansions: `"${VARIABLE}"`
- Use `[[ ]]` for conditionals, not `[ ]`
-
-### Example
-```bash
-#!/usr/bin/bash
-
-TARGET_VERSION=1
-CONFIG_FILE="${HOME}/.config/myapp.conf"
-
-if [[ -f "${CONFIG_FILE}" ]]; then
-    echo "Configuration found"
-fi
-```
-
-### Error Handling
-Include basic error checking for critical operations:
-```bash
-if [[ ! -e "${SETUP_CHECKER_FILE}" ]]; then
-    mkdir -p "$(dirname "${SETUP_CHECKER_FILE}")"
-    echo "{}" > "${SETUP_CHECKER_FILE}"
-fi
-```
-
-## Just Recipes (.just)
-
-### File Header
-Start Just files with:
-```just
-# vim: set ft=make :
-```
-
-### Recipe Naming
- Use lowercase with hyphens: `toggle-tpm2`, `install-flatpaks`
- Be descriptive: prefer `configure-nvidia` over `nvidia`
-
-### Recipe Groups
-Organize recipes with group annotations:
-```just
-[group('System')]
-toggle-tpm2:
-    @/usr/bin/luks-tpm2-autounlock
-```
-
-Common groups: `System`, `Apps`, `Update`, `Developer`
-
-### Recipe Documentation
-Add a brief comment above each recipe:
-```just
-# Factory reset this device (experimental)
-[group('System')]
-powerwash:
-    #!/usr/bin/bash
-    # ... implementation
-```
-
-### Inline Scripts
-For multi-line recipes, use bash shebang:
-```just
-example-recipe:
-    #!/usr/bin/bash
-    echo "Step 1"
-    echo "Step 2"
-```
-
-### Settings
-Standard settings for entry-point Just files:
-```just
-set allow-duplicate-recipes := true
-set ignore-comments := true
-```
-
-## JSON Configuration Files
-
-### Formatting
- Use **tabs** for indentation (matching existing files)
- Keep JSON minimal and readable
- One property per line
-
-### Example
-```json
-{
-	"logo-directory": "/usr/share/ublue-os/aurora-logos/symbols",
-	"shuffle-logo": true
-}
-```
-
-### Validation
-All JSON files must be valid. Check with:
-```bash
-jq . < file.json
-```
-
-## YAML Configuration Files
-
-### Formatting
- Use **2 spaces** for indentation
- Use kebab-case for keys: `yaml-blocklist-paths`
- Keep files focused on a single configuration purpose
-
-### Example
-```yaml
-yaml-blocklist-paths:
-  - /run/host/etc/bazaar/blocklist.yaml
-
-curated-config-paths:
-  - /run/host/etc/bazaar/curated.yaml
-```
-
-## Containerfile
-
-### Style
- Use explicit tags for base images: `FROM docker.io/library/alpine:latest`
- Use uppercase for Dockerfile instructions: `COPY`, `RUN`, `FROM`
- Group related `RUN` commands with `&&` for layer efficiency
- Add line continuations for readability with `\`
-
-### Multi-stage Pattern
-```dockerfile
-FROM docker.io/library/alpine:latest AS build
-RUN apk add just curl
-
-# Processing steps...
-RUN install -d /out/shared/usr/share && \
-  just --completions bash > /out/shared/usr/share/bash-completion/completions/ujust
-
-FROM scratch AS ctx
-COPY /system_files/shared /system_files/shared
-COPY /system_files/dx /system_files/dx
-COPY --from=build /out/shared /system_files/shared
-```
-
-### Comments
-Add comments for non-obvious operations:
-```dockerfile
-# artwork repo points to ~/.local/share for metadata
-RUN sed -i 's|~/\.local/share|/usr/share|' /out/shared/usr/share/backgrounds/aurora/*.xml
-```
-
-## Homebrew Brewfiles
-
-### Naming Convention
- Use lowercase with hyphens: `system-flatpaks.Brewfile`
- Be descriptive: `full-desktop.Brewfile`, `ai-tools.Brewfile`
-
-### Format
-One application per line, grouped by type with comments:
-```ruby
-# Core Applications
-cask "firefox"
-cask "thunderbird"
-
-# Development Tools
-cask "visual-studio-code"
-```
-
-### Location
-Place Brewfiles in `system_files/shared/usr/share/ublue-os/homebrew/`
-
-## Git Commit Messages
-
-### Format
-Follow [Conventional Commits](https://www.conventionalcommits.org/):
-```
-<type>(<scope>): <description>
-
-[optional body]
-
-[optional footer(s)]
-```
-
-### Types
- `feat:` - New feature or configuration
- `fix:` - Bug fix
- `docs:` - Documentation changes
- `chore:` - Maintenance (dependencies, cleanup)
- `refactor:` - Code restructuring
- `ci:` - CI/CD changes
-
-### Scope
-Use meaningful scopes:
- `just` - Just recipe changes
- `flatpak` - Flatpak configurations
- `firefox` - Firefox settings
- `gnome` - GNOME/desktop settings
- `setup` - Setup hook scripts
- `brew` - Homebrew Brewfile changes
- `dx` - Aurora-DX specific changes
-
-### Examples
-```
-feat(flatpak): add VSCode Wayland support override
-
-fix(just): correct path to system-flatpaks Brewfile
-
-docs(readme): update directory structure documentation
-
-chore(deps): update aurora-wallpapers to latest
-
-feat(dx): add development environment configuration
-```
-
-### AI Attribution
-AI-assisted commits must include attribution:
-```
-feat(just): add new system management recipe
-
-Assisted-by: Claude 3.5 Sonnet via GitHub Copilot
-```
-
-## Comments and Documentation
-
-### When to Comment
- Configuration files: Explain non-obvious settings
- Shell scripts: Document complex logic or version-based behavior
- Just recipes: Brief description of what the recipe does
- Containerfile: Clarify transformations or path changes
-
-### When NOT to Comment
- Self-explanatory code
- Simple variable assignments
- Standard patterns
-
-### Example - Good Comments
-```bash
-# Meant to be used at the start of any setup service script
-# Will version your script accordingly on $SETUP_CHECKER_FILE
-function version-script() {
-    # ... implementation
-}
-```
-
-## File Permissions
-
-### Executable Scripts
-Scripts intended to be executed must be executable:
-```bash
-chmod +x system_files/shared/usr/bin/ublue-image-info.sh
-```
-
-### Configuration Files
-Non-executable files (JSON, YAML, text) should be 644:
-```bash
-chmod 644 system_files/shared/etc/ublue-os/fastfetch.json
-```
-
-## Testing and Validation
-
-### Local Build Testing
-Always test builds locally before pushing:
-```bash
-just build
-```
-
-### Syntax Validation
- **Just files**: `just check`
- **JSON files**: `find system_files -name "*.json" -exec jq . {} \;`
- **Shell scripts**: `bash -n script.sh`
-
-### Structure Inspection
-Verify the built image structure:
-```bash
-just tree
-```
-
-## Pull Request Guidelines
-
-### PR Title
-Use conventional commit format:
-```
-feat(flatpak): add system flatpak overrides for Bazaar
-```
-
-### PR Description
-Include:
-1. What changed
-2. Why it changed
-3. Testing performed (local build, validation)
-
-### Changes
- Keep PRs focused on a single logical change
- Maintain existing file structure
- Don't mix refactoring with feature changes
-
-## Naming Conventions
-
-### Files
- **Just recipes**: lowercase with hyphens (`system.just`, `toggle-tpm2`)
- **Shell scripts**: lowercase with hyphens (`libsetup.sh`, `ublue-image-info.sh`)
- **Config files**: lowercase with hyphens or dots (`fastfetch.json`, `mimeapps.list`)
- **Brewfiles**: descriptive with hyphens (`system-flatpaks.Brewfile`, `full-desktop.Brewfile`)
-
-### Variables (Shell)
- Local: `lowercase_with_underscores`
- Environment: `UPPERCASE_WITH_UNDERSCORES`
- Consistent naming: `TARGET_VERSION`, `SETUP_CHECKER_FILE`
-
-### Functions (Shell)
- Use lowercase with hyphens: `version-script`
- Be descriptive: `check-version`, `install-flatpaks`
-
-## What NOT to Do
-
-❌ **Don't add complex build dependencies** - This repo is intentionally minimal
-❌ **Don't compile code** - This is a configuration-only layer
-❌ **Don't modify the scratch→ctx build pattern** - It's essential for the OCI layer
-❌ **Don't add linters/formatters** - Keep tooling minimal (Just, jq, bash only)
-❌ **Don't break existing directory structure** - Maintain `shared/` vs `dx/` separation
-❌ **Don't add unnecessary comments** - Comment only when clarification is needed
-
-## Editor Configuration
-
-### Vim Modelines
-Include for Just files:
-```just
-# vim: set ft=make :
-```
-
-### Recommended Settings
- **Tabs for JSON**: 1 tab = indentation unit
- **Spaces for YAML**: 2 spaces per level
- **Shell scripts**: 2 or 4 space indentation (be consistent within file)
- **Just recipes**: 4 space indentation
-
-## Consistency Principles
-
-1. **Follow existing patterns** - Look at similar files in the repo
-2. **Mirror destination paths** - Maintain the target filesystem structure
-3. **Keep it simple** - This is intentionally a minimal repository
-4. **Validate before committing** - Run local builds and syntax checks
-5. **Preserve the two-tier structure** - `shared/` vs `dx/` is fundamental
-
-## Questions?
-
-When unsure about where a file belongs or how to structure it:
-1. Check similar existing files in the repository
-2. Refer to `AGENTS.md` for detailed repository context
-3. Default to simplicity and existing patterns
-4. Ask in pull request reviews
--- a/.github/workflows/validate-brewfiles.yml
+++ b/.github/workflows/validate-brewfiles.yml
@ -1,6 +1,6 @@
 name: Validate Brewfiles
-permissions:
-  contents: read
+
+permissions: {}

 on:
  pull_request:
@ -9,58 +9,24 @@ on:
 jobs:
  validate:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false

-      - name: Set up Homebrew
-        uses: Homebrew/actions/setup-homebrew@main
+      - name: Install Just
+        run: |
+          /home/linuxbrew/.linuxbrew/bin/brew install just
+          echo "/home/linuxbrew/.linuxbrew/bin" >> $GITHUB_PATH
+
+      - name: Add Homebrew to PATH
+        run: |
+          echo "/home/linuxbrew/.linuxbrew/bin" >> $GITHUB_PATH

      - name: Validate Brewfiles
        shell: bash
        run: |
-          echo "Validating Brewfiles in homebrew directory..."
-
-          STATUS_FILE=$(mktemp)
-          echo "PASS" > "$STATUS_FILE"
-
-          while IFS= read -r -d '' brewfile ; do
-            echo "::group:: ===$(basename $brewfile)==="
-
-            grep -E -e "^tap" "$brewfile" > taps.Brewfile || true
-            echo "Syncing taps..."
-            brew bundle --file=./taps.Brewfile > /dev/null 2>&1 || true
-
-            # Extract combined list for parallel check
-            FORMULAS=$(grep -E '^\s*brew\s+["'\'']' "$brewfile" | sed -E 's/^\s*brew\s+["'\'']([^"'\'']+)["'\''].*/formula \1/' || true)
-            CASKS=$(grep -E '^\s*cask\s+["'\'']' "$brewfile" | sed -E 's/^\s*cask\s+["'\'']([^"'\'']+)["'\''].*/cask \1/' || true)
-
-            ENTRIES=$(printf "%s\n%s" "$FORMULAS" "$CASKS" | grep -v '^\s*$' || true)
-
-            if [ -n "$ENTRIES" ]; then
-              echo "$ENTRIES" | xargs -P 8 -I {} bash -c '
-                TYPE=$(echo "{}" | cut -d" " -f1)
-                NAME=$(echo "{}" | cut -d" " -f2)
-                if ! brew info --$TYPE "$NAME" &> /dev/null; then
-                  echo "✗ $TYPE \"$NAME\" is invalid or missing tap"
-                  echo "FAIL" >> "'"$STATUS_FILE"'"
-                else
-                  echo "✓ $TYPE \"$NAME\" is valid"
-                fi
-              '
-            else
-              echo "No formulas or casks found."
-            fi
-
-            echo "::endgroup::"
-          done < <(find "system_files/shared/usr/share/ublue-os/homebrew" -iname '*\.Brewfile*' -print0)
-
-          rm -f taps.Brewfile
-
-          if grep -q "FAIL" "$STATUS_FILE"; then
-            echo "Validation complete. Some Brewfiles FAILED."
-            exit 1
-          else
-            echo "Validation complete. All Brewfiles PASSED."
-            exit 0
-          fi
+          just brew-lint
--- a/.gitignore
+++ b/.gitignore
@ -1 +1,2 @@
 dump*
+*.raw
--- a/.gitmodules
+++ b/.gitmodules
@ -1,6 +1,3 @@
 [submodule "branding"]
 	path = branding
 	url = https://github.com/get-aurora-dev/branding.git
-[submodule "aurorafin-shared"]
-	path = aurorafin-shared
-	url = https://github.com/ublue-os/aurorafin-shared.git
--- a/AGENTS.md
+++ b/AGENTS.md
@ -1,196 +0,0 @@
-# Aurora-Common Copilot Instructions
-
-This document provides essential information for coding agents working with the aurora-common repository.
-
-## Repository Overview
-
-**Aurora-Common** is a shared OCI layer containing configuration files for Aurora and Aurora-DX variants.
-
- **Type**: OCI container layer built on top of projectbluefin/common
- **Purpose**: Provide Aurora-specific configuration and assets while inheriting shared Bluefin configuration
- **Base**: Multi-stage build pulling from aurora-wallpapers, projectbluefin/common, and local files
- **Languages**: Configuration files (JSON, shell scripts, markdown)
- **Build System**: GitHub Actions with podman/buildah, Just for local convenience
-
-## Repository Structure
-
-### Root Directory Files
- `Containerfile` - Multi-stage build pulling wallpapers, projectbluefin/common, and local files
- `Justfile` - Convenience commands for building and inspecting the image
- `cosign.pub` - Container signing public key
- `image-versions.yml` - Version tracking for dependencies
- `README.md` - Repository documentation
- `.pre-commit-config.yaml` - Pre-commit hooks configuration
-
-### Key Directories
- `system_files/` - Configuration files organized by variant
-  - `shared/` - Configuration shared between Aurora and Aurora-DX
-    - `etc/` - System-level configuration (bazaar, dconf, geoclue, profile.d, skel, systemd, ublue-os, zsh)
-    - `usr/` - User-space configuration (bin, lib, libexec, share)
-  - `dx/` - Aurora-DX specific configuration
-    - `etc/` - DX system-level configuration
-    - `usr/` - DX user-space configuration
- `flatpaks/` - Flatpak definitions for Aurora images
- `logos/` - Aurora branding and logo assets
-
-### GitHub Actions
- `.github/workflows/build.yml` - Build workflow using podman/buildah
-
-## Build Instructions
-
-### Prerequisites
- **podman** and **buildah** for building containers
- **just** for convenience commands (optional)
- **pre-commit** for development hooks (optional)
-
-### Build Commands
-
-**Build locally:**
-```bash
-# Using Just
-just build
-
-# Or directly with podman
-podman build -t localhost/aurora-common:latest -f ./Containerfile .
-```
-
-**Inspect the image:**
-```bash
-# View directory structure
-just tree
-
-# Dump all contents to ./dump directory
-just dump
-```
-
-**Validate Just syntax:**
-```bash
-# Check syntax
-just check
-
-# Fix formatting
-just fix
-```
-
-### Build Process
-1. Builder stage pulls aurora-wallpapers and processes them
-2. Scratch stage pulls projectbluefin/common shared files
-3. Local files (flatpaks, logos, system_files) are added
-4. Final image is pushed to `ghcr.io/ublue-os/aurora-common:latest`
-5. Aurora and Aurora-DX images reference this layer in their builds
-
-## Usage in Downstream Projects
-
-Aurora images use this layer in their Containerfiles:
-
-```dockerfile
-FROM ghcr.io/ublue-os/aurora-common:latest AS aurora-common
-
-# Copy shared configuration
-COPY --from=aurora-common /system_files/shared /
-
-# Aurora-DX also copies DX-specific configuration
-COPY --from=aurora-common /system_files/dx /
-
-# Copy wallpapers and other assets
-COPY --from=aurora-common /wallpapers /
-COPY --from=aurora-common /flatpaks /tmp/flatpaks
-COPY --from=aurora-common /logos /tmp/logos
-```
-
-## Making Changes
-
-### Modifying Configuration Files
-
-1. **Edit files in `system_files/`** - Maintain the existing directory structure
-2. **Test locally** with `just build` to ensure no syntax errors
-3. **Create PR** - GitHub Actions will build and validate
-
-### Adding New Configuration Files
-
-1. Determine if the configuration is shared or DX-specific
-2. Place files in the appropriate subdirectory:
-   - Shared configs: `system_files/shared/`
-   - DX-specific: `system_files/dx/`
-3. Follow the existing path structure (etc/ or usr/)
-4. Ensure file permissions are correct (executables for scripts)
-
-### Common Modification Patterns
- **Shared system configs**: Edit files in `system_files/shared/etc/`
- **Shared user configs**: Edit files in `system_files/shared/usr/`
- **DX-specific configs**: Edit files in `system_files/dx/`
- **Flatpak definitions**: Modify `flatpaks/` directory
- **Branding assets**: Update `logos/` directory
-
-## Validation
-
-### Manual Validation
-```bash
-# Build locally to check for errors
-just build
-
-# Check Just syntax
-just check
-
-# Validate JSON files
-find system_files -name "*.json" -exec sh -c 'echo "Checking {}"; cat {} | jq . > /dev/null' \;
-
-# Check shell script syntax
-find system_files -name "*.sh" -exec bash -n {} \;
-
-# Inspect built image
-just tree
-```
-
-### GitHub Actions
-The build workflow automatically:
- Builds the container with podman/buildah
- Pushes to GHCR on merge to main
- Validates build succeeds on PRs
-
-## Development Guidelines
-
-### Making Changes
-1. **Understand shared vs DX** - Place configs in the correct system_files subdirectory
-2. **Maintain structure** - Follow existing directory patterns
-3. **Test locally** - Build with `just build` before pushing
-4. **Use pre-commit hooks** - Run before committing if configured
-
-### File Editing Best Practices
- **JSON files**: Validate syntax with `jq` before committing
- **Shell scripts**: Check syntax with `bash -n script.sh`
- **Just files**: Use `just check` and `just fix` for syntax validation
- **Keep files small** - Each file should have a single, clear purpose
- **Document changes** - Update comments in configuration files
-
-## Trust These Instructions
-
-**This repository structure:**
- Configuration files in `system_files/shared/` and `system_files/dx/`
- Flatpak definitions in `flatpaks/`
- Branding assets in `logos/`
- Multi-stage Containerfile pulling from aurora-wallpapers and projectbluefin/common
- Justfile with convenience commands
- GitHub Actions workflow for automated builds
-
-## Other Rules
-
- Use [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/#specification) for all commits and PR titles
- Keep changes minimal and surgical
- This layer is used by Aurora and Aurora-DX
- Changes to `system_files/shared/` affect both variants
- Changes to `system_files/dx/` only affect Aurora-DX
-
-## Attribution Requirements
-
-AI agents must disclose what tool and model they are using in the "Assisted-by" commit footer:
-
-```text
-Assisted-by: [Model Name] via [Tool Name]
-```
-
-Example:
-
-```text
-Assisted-by: Claude 3.5 Sonnet via GitHub Copilot
-```
--- a/3
+++ b/3
@ -115,8 +115,7 @@ curl -fsSLo /out/system_files/shared/usr/lib/udev/rules.d/70-u2f.rules https://r
 EOF

 FROM scratch AS ctx
-COPY aurorafin-shared/system_files/shared /system_files/shared
-COPY aurorafin-shared/system_files/nvidia /system_files/nvidia
+COPY system_files/nvidia /system_files/nvidia
 COPY --from=builder /out/wallpapers /wallpapers
 COPY --from=builder /out/logos /logos
 COPY --from=builder /out/system_files/shared /system_files/shared
--- a/51
+++ b/51
@ -48,3 +48,54 @@ dump IMAGE="localhost/aurora-common:latest":
    mkdir -p dump
    podman cp "$cid:/." dump/
    podman rm "$cid"
+
+# Validate Brewfiles
+brew-lint dir="system_files/shared/usr/share/ublue-os/homebrew":
+    #!/usr/bin/env bash
+    set -eou pipefail
+
+    system_files/shared/usr/libexec/ublue-brew-trust-brewfile system_files/shared/usr/share/ublue-os/homebrew/*.Brewfile
+
+    STATUS_FILE=$(mktemp)
+    echo "PASS" > "$STATUS_FILE"
+
+    while IFS= read -r -d '' brewfile ; do
+      echo "::group:: ===$(basename $brewfile)==="
+
+      grep -E -e "^tap" "$brewfile" > taps.Brewfile || true
+      echo "Syncing taps..."
+      brew bundle --file=./taps.Brewfile > /dev/null 2>&1 || true
+
+      # Extract combined list for parallel check
+      FORMULAS=$(grep -E '^\s*brew\s+["'\'']' "$brewfile" | sed -E 's/^\s*brew\s+["'\'']([^"'\'']+)["'\''].*/formula \1/' || true)
+      CASKS=$(grep -E '^\s*cask\s+["'\'']' "$brewfile" | sed -E 's/^\s*cask\s+["'\'']([^"'\'']+)["'\''].*/cask \1/' || true)
+
+      ENTRIES=$(printf "%s\n%s" "$FORMULAS" "$CASKS" | grep -v '^\s*$' || true)
+
+      if [ -n "$ENTRIES" ]; then
+        echo "$ENTRIES" | xargs -P 8 -I {} bash -c '
+          TYPE=$(echo "{}" | cut -d" " -f1)
+          NAME=$(echo "{}" | cut -d" " -f2)
+          if ! brew info --$TYPE "$NAME" &> /dev/null; then
+            echo "✗ $TYPE \"$NAME\" is invalid or missing tap"
+            echo "FAIL" >> "'"$STATUS_FILE"'"
+          else
+            echo "✓ $TYPE \"$NAME\" is valid"
+          fi
+        '
+      else
+        echo "No formulas or casks found."
+      fi
+
+      echo "::endgroup::"
+    done < <(find "{{ dir }}" -iname '*\.Brewfile*' -print0)
+
+    rm -f taps.Brewfile
+
+    if grep -q "FAIL" "$STATUS_FILE"; then
+      echo "Validation complete. Some Brewfiles FAILED."
+      exit 1
+    else
+      echo "Validation complete. All Brewfiles PASSED."
+      exit 0
+    fi
--- a/1
+++ b/1
@ -1 +0,0 @@
-Subproject commit 81fae1734f0d909e6d8b3d6d3695cbaf1f7ed1f2
--- a/system_files/nvidia/usr/lib/systemd/system/ublue-nvidia-flatpak-runtime-sync.service
+++ b/system_files/nvidia/usr/lib/systemd/system/ublue-nvidia-flatpak-runtime-sync.service
@ -0,0 +1,19 @@
+[Unit]
+Description=Sync NVIDIA system drivers with Flatpak runtime
+After=network-online.target flatpak-system-helper.service
+Wants=network-online.target
+ConditionPathExists=/sys/module/nvidia/version
+# To not run on live ISO
+ConditionPathExists=/run/ostree-booted
+
+[Service]
+Type=oneshot
+ExecCondition=/usr/libexec/ublue-nvidia-flatpak-runtime-sync check
+ExecStart=/usr/libexec/ublue-nvidia-flatpak-runtime-sync sync
+RemainAfterExit=yes
+Restart=on-failure
+RestartSec=30
+TimeoutStartSec=600
+
+[Install]
+WantedBy=multi-user.target
--- a/system_files/nvidia/usr/libexec/ublue-nvidia-flatpak-runtime-sync
+++ b/system_files/nvidia/usr/libexec/ublue-nvidia-flatpak-runtime-sync
@ -0,0 +1,31 @@
+#!/usr/bin/bash
+
+# Workaround for: https://github.com/flatpak/flatpak/issues/3907
+set -euo pipefail
+
+SYSTEM_NVIDIA_VERSION=$(cat /sys/module/nvidia/version)
+FLATPAK_NVIDIA_VERSION=$(echo "${SYSTEM_NVIDIA_VERSION}" | tr '.' '-')
+
+case "${1}" in
+    check)
+        # Exit 0 if sync is needed (versions mismatch), exit 1 if already in sync
+        if flatpak info --system org.freedesktop.Platform.GL.nvidia-"${FLATPAK_NVIDIA_VERSION}" >/dev/null 2>&1 && \
+           flatpak info --system org.freedesktop.Platform.GL32.nvidia-"${FLATPAK_NVIDIA_VERSION}" >/dev/null 2>&1; then
+            echo "NVIDIA Flatpak runtime ${SYSTEM_NVIDIA_VERSION} already installed"
+            exit 1
+        fi
+        echo "NVIDIA Flatpak runtime ${SYSTEM_NVIDIA_VERSION} needs to be installed"
+        exit 0
+        ;;
+    sync)
+        echo "Installing NVIDIA Flatpak runtime version ${SYSTEM_NVIDIA_VERSION}"
+        flatpak remote-add --system --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
+        flatpak install --system --noninteractive -y flathub \
+            org.freedesktop.Platform.GL.nvidia-"${FLATPAK_NVIDIA_VERSION}" \
+            org.freedesktop.Platform.GL32.nvidia-"${FLATPAK_NVIDIA_VERSION}"
+        ;;
+    *)
+        echo "Usage: $0 {check|sync}"
+        exit 1
+        ;;
+esac
--- a/system_files/shared/etc/containers/policy.json
+++ b/system_files/shared/etc/containers/policy.json
@ -0,0 +1,107 @@
+{
+    "default": [
+        {
+            "type": "reject"
+        }
+    ],
+    "transports": {
+        "docker": {
+            "registry.access.redhat.com": [
+                {
+                    "type": "signedBy",
+                    "keyType": "GPGKeys",
+                    "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
+                }
+            ],
+            "registry.redhat.io": [
+                {
+                    "type": "signedBy",
+                    "keyType": "GPGKeys",
+                    "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
+                }
+            ],
+            "quay.io/toolbx-images": [
+                {
+                    "type": "sigstoreSigned",
+                    "keyPath": "/usr/lib/pki/containers/quay.io-toolbx-images.pub",
+                    "signedIdentity": {
+                        "type": "matchRepository"
+                    }
+                }
+            ],
+            "ghcr.io/ublue-os": [
+                {
+                    "type": "sigstoreSigned",
+                    "keyPaths": [
+                        "/usr/lib/pki/containers/ublue-os.pub",
+                        "/usr/lib/pki/containers/ublue-os-backup.pub"
+                    ],
+                    "signedIdentity": {
+                        "type": "matchRepository"
+                    }
+                }
+            ],
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "docker-daemon": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "atomic": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "containers-storage": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "dir": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "oci": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "oci-archive": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "docker-archive": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "tarball": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        }
+    }
+}
--- a/system_files/shared/etc/containers/registries.d/quay.io-toolbx-images.yaml
+++ b/system_files/shared/etc/containers/registries.d/quay.io-toolbx-images.yaml
@ -0,0 +1,3 @@
+docker:
+  quay.io/toolbx-images:
+    use-sigstore-attachments: true
--- a/system_files/shared/etc/containers/registries.d/ublue-os.yaml
+++ b/system_files/shared/etc/containers/registries.d/ublue-os.yaml
@ -0,0 +1,3 @@
+docker:
+  ghcr.io/ublue-os:
+    use-sigstore-attachments: true
--- a/system_files/shared/etc/geoclue/conf.d/99-beacondb.conf
+++ b/system_files/shared/etc/geoclue/conf.d/99-beacondb.conf
@ -0,0 +1,3 @@
+[wifi]
+enable=true
+url=https://api.beacondb.net/v1/geolocate
--- a/system_files/shared/etc/profile.d/ublue-fastfetch.sh
+++ b/system_files/shared/etc/profile.d/ublue-fastfetch.sh
@ -0,0 +1,3 @@
+alias neofetch='ublue-fastfetch'
+alias neowofetch='ublue-fastfetch'
+alias fastfetch='ublue-fastfetch'
--- a/system_files/shared/etc/profile.d/ublue-motd.sh
+++ b/system_files/shared/etc/profile.d/ublue-motd.sh
@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+[ ! -e "$HOME"/.config/no-show-user-motd ] && ublue-motd
--- a/system_files/shared/etc/uupd/config.json
+++ b/system_files/shared/etc/uupd/config.json
@ -0,0 +1,7 @@
+{
+    "modules": {
+        "distrobox": {
+            "disable": true
+        }
+    }
+}
--- a/system_files/shared/usr/bin/luks-tpm2-autounlock
+++ b/system_files/shared/usr/bin/luks-tpm2-autounlock
@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+# References:
+#  https://os.gnome.org/install
+#  https://www.reddit.com/r/Fedora/comments/uo4ufq/any_way_to_get_systemdcryptenroll_working_on/
+#  https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-248.html
+
+gum confirm --affirmative="Enable" --negative="Disable" "Toggle TPM2 auto-unlock"
+EXIT_CODE="$?"
+case "${EXIT_CODE}" in
+  0|1)
+    ;;
+  *)
+    exit 0
+esac
+
+RD_LUKS_UUID="$(xargs -n1 -a /proc/cmdline | grep -E -e "rd.luks.(uuid|name)" | head -n 1 | cut -d= -f 2 | sed "s/^luks-//" )"
+CRYPT_DISK="$(realpath "/dev/disk/by-uuid/${RD_LUKS_UUID}")"
+
+if ! find /dev -iname "${RD_LUKS_UUID:-INVALIDINVALID}" | grep -F -e "${RD_LUKS_UUID}" &>/dev/null; then
+  echo "Could not find LUKS device used to boot system on system mount table. Is your drive encrypted?"
+  exit 1
+fi
+
+if [ "${EXIT_CODE}" == 1 ] ; then
+  sudo systemd-cryptenroll --wipe-slot=tpm2 "${CRYPT_DISK}"
+  exit 0
+fi
+
+gum confirm "Would you like to set up a PIN?"
+EXIT_CODE="$?"
+SET_PIN_ARG=""
+case "${EXIT_CODE}" in
+  0)
+    export SET_PIN_ARG="--tpm2-with-pin=yes"
+    ;;
+  1)
+    ;;
+  *)
+    exit 0
+esac
+
+if sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs='' ${SET_PIN_ARG} "${CRYPT_DISK}" ; then
+  echo "TPM2 LUKS auto-unlock configured for next reboot."
+fi
--- a/system_files/shared/usr/bin/ublue-bling
+++ b/system_files/shared/usr/bin/ublue-bling
@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+set -eoux pipefail
+
+BLING_CLI_DIRECTORY="/usr/share/ublue-os/bling"
+
+BLING_SCRIPT_SOURCE=""
+TARGET_CONFIG_FILE=""
+shell="$(basename "${SHELL}")"
+case "${shell}" in
+    "fish")
+        BLING_SCRIPT_SOURCE="bling.fish"
+        TARGET_CONFIG_FILE="${XDG_CONFIG_HOME:-$HOME/.config}/fish/config.fish"
+    ;;
+    "zsh")
+        BLING_SCRIPT_SOURCE="bling.sh"
+        TARGET_CONFIG_FILE="${ZDOTDIR:-$HOME}/.zshrc"
+    ;;
+    "bash")
+        BLING_SCRIPT_SOURCE="bling.sh"
+        TARGET_CONFIG_FILE="${HOME}/.bashrc"
+    ;;
+    *)
+        echo 'Unknown shell. You are on your own.'
+        exit 1
+    ;;
+esac
+
+function is-bling-installed() {
+    echo "hello"
+    [ -f "$TARGET_CONFIG_FILE" ] || return 1
+
+    if [ -n "$(grep -n "source $BLING_CLI_DIRECTORY/$BLING_SCRIPT_SOURCE" "$TARGET_CONFIG_FILE" | grep -Eo '^[^:]+')" ]; then
+        return 0
+    fi
+    return 1
+}
+
+[ -f "${BLING_ENV_SCRIPT:-/usr/share/ublue-os/bling/env.sh}" ] && . "${BLING_ENV_SCRIPT:-/usr/share/ublue-os/bling/env.sh}"
+
+BLING_MESSAGE_ENABLE="${BLING_MESSAGE_ENABLE:-Enable bling for ${shell}?}"
+BLING_MESSAGE_DISABLE="${BLING_MESSAGE_DISABLE:-Disable bling for ${shell}?}"
+
+if is-bling-installed "${shell}" ; then
+    gum confirm "${BLING_MESSAGE_DISABLE}"
+    if ! sed -i "/### ${BLING_SCRIPT_SOURCE} source start/,/### ${BLING_SCRIPT_SOURCE} source end/d" "${TARGET_CONFIG_FILE}" ; then
+        sed -i "$(grep -n "source ${BLING_SCRIPT_SOURCE}" "${TARGET_CONFIG_FILE}" | grep -Eo '^[^:]+')"d "${HOME}/.bashrc"
+    fi
+    echo "Bling removed. Reopen your terminal so that the configurations may be removed"
+else
+    gum confirm "${BLING_MESSAGE_ENABLE}" --affirmative="Bling me up!" --negative "No, I'm boring"
+    echo "Adding bling to your $(basename "${TARGET_CONFIG_FILE}")"
+    cat<<EOF >> "${TARGET_CONFIG_FILE}"
+### ${BLING_SCRIPT_SOURCE} source start
+test -f ${BLING_CLI_DIRECTORY}/${BLING_SCRIPT_SOURCE} && source ${BLING_CLI_DIRECTORY}/${BLING_SCRIPT_SOURCE}
+### ${BLING_SCRIPT_SOURCE} source end
+EOF
+    echo "Installation complete. Reopen your terminal so that the configurations may be applied"
+fi
--- a/system_files/shared/usr/bin/ublue-bling-fastfetch
+++ b/system_files/shared/usr/bin/ublue-bling-fastfetch
@ -0,0 +1,44 @@
+#!/usr/bin/bash
+
+THEME="$(dconf read /org/gnome/desktop/interface/accent-color 2>/dev/null || echo -e "$DEFAULT_THEME")"
+# Dconf will fail if the accent-color has not been changed yet
+if [ "$THEME" == "" ] ; then
+	# Gsettings will not update if the system's schemas have not been configured properly
+	THEME="$(gsettings get org.gnome.desktop.interface accent-color 2>/dev/null || echo -e "$DEFAULT_THEME")"
+fi
+THEME="${THEME//\'/}"
+THEME="${FASTFETCH_FORCE_THEME:-$THEME}"
+
+FASTFETCH_COLOR_SET="38;2;53;132;228"
+case $THEME in
+  "blue")
+    FASTFETCH_COLOR_SET="38;2;53;132;228"
+    ;;
+  "green")
+    FASTFETCH_COLOR_SET="38;2;58;148;74"
+    ;;
+  "orange")
+    FASTFETCH_COLOR_SET="38;2;237;91;0"
+    ;;
+  "pink")
+    FASTFETCH_COLOR_SET="38;2;213;97;153"
+    ;;
+  "purple")
+    FASTFETCH_COLOR_SET="38;2;139;62;165"
+    ;;
+  "red")
+    FASTFETCH_COLOR_SET="38;2;230;45;66"
+    ;;
+  "slate")
+    FASTFETCH_COLOR_SET="38;2;111;131;150"
+    ;;
+  "teal")
+    FASTFETCH_COLOR_SET="38;2;33;144;164"
+    ;;
+  "yellow")
+    FASTFETCH_COLOR_SET="38;2;200;136;0"
+    ;;
+esac
+
+echo $FASTFETCH_COLOR_SET
+exit 0
--- a/system_files/shared/usr/bin/ublue-fastfetch
+++ b/system_files/shared/usr/bin/ublue-fastfetch
@ -0,0 +1,30 @@
+#!/usr/bin/bash
+
+get_config() {
+	FASTFETCH_CONFIG_FILE="${FASTFETCH_CONFIG_FILE:-/etc/ublue-os/fastfetch.json}"
+	QUERY="$1"
+	FALLBACK="$2"
+	shift
+	shift
+	OUTPUT="$(jq -r "${QUERY}" "${FASTFETCH_CONFIG_FILE}" 2>/dev/null || echo "${FALLBACK}")"
+	if [ "${OUTPUT}" == "null" ] ; then
+		echo "${FALLBACK}"
+		return
+	fi
+	echo "${OUTPUT}"
+}
+
+FASTFETCH_CONFIG="$(get_config '."fastfetch-config"' "/usr/share/ublue-os/fastfetch.jsonc")"
+SHUFFLE_LOGO="$(get_config '."shuffle-logo"' "false")"
+LOGO_DIRECTORY="$(get_config '."logo-directory"' "/usr/share/ublue-os/fastfetch")"
+
+export DEFAULT_THEME # Gets passed to `ublue-bling-fastfetch`
+DEFAULT_THEME="$(get_config '."default-theme"' "slate")"
+if [ "$SHUFFLE_LOGO" == "true" ] ; then
+  FETCH_LOGO="$(find "$LOGO_DIRECTORY" -type f | shuf -n 1)"
+  exec fastfetch --logo "$FETCH_LOGO" --color "$(ublue-bling-fastfetch)" --config "${FASTFETCH_CONFIG}" "${@}"
+else
+  exec fastfetch --color "$(ublue-bling-fastfetch)" --config "${FASTFETCH_CONFIG}" "${@}"
+fi
+
+
--- a/system_files/shared/usr/bin/ublue-image-info.sh
+++ b/system_files/shared/usr/bin/ublue-image-info.sh
@ -0,0 +1,10 @@
+#!/usr/bin/bash
+
+# shellcheck disable=2046
+echo -n "$(jq -r '"\(.["image-name"]):\(.["image-tag"])"' < /usr/share/ublue-os/image-info.json)"
+
+if [[ "$(rpm-ostree status --booted)" =~ "signed" ]]; then
+	echo -n " 🔐"
+else
+	echo -n -e " \033[5m🔓\033[0m"
+fi
--- a/system_files/shared/usr/bin/ublue-motd
+++ b/system_files/shared/usr/bin/ublue-motd
@ -0,0 +1,11 @@
+#!/usr/bin/env sh
+
+MOTD_TEMPLATE_FILE="${MOTD_TEMPLATE_FILE:-/usr/share/ublue-os/motd/template.md}"
+. "${MOTD_ENV_SCRIPT:-/usr/share/ublue-os/motd/env.sh}"
+
+if command -v tput >/dev/null 2>&1 && [ -t 1 ]; then
+  cols=$(tput cols 2>/dev/null)
+  envsubst < "${MOTD_TEMPLATE_FILE}" | glow -w $cols -
+else
+  envsubst < "${MOTD_TEMPLATE_FILE}" | glow -
+fi
--- a/system_files/shared/usr/bin/ublue-privileged-setup
+++ b/system_files/shared/usr/bin/ublue-privileged-setup
@ -0,0 +1,28 @@
+#!/usr/bin/bash
+
+get_config() {
+	SETUP_CONFIG_FILE="${SETUP_CONFIG_FILE:-/etc/ublue-os/setup.json}"
+	QUERY="$1"
+	FALLBACK="$2"
+	shift
+	shift
+	OUTPUT="$(jq -r "$QUERY" "$SETUP_CONFIG_FILE" 2>/dev/null || echo "$FALLBACK")"
+	if [ "$OUTPUT" == "null" ] ; then
+		echo "$FALLBACK"
+		return
+	fi
+	echo "$OUTPUT"
+}
+
+PRIVILEGED_HOOKS_DIRECTORY="$(get_config '."privileged-hooks-directory"' "/usr/share/ublue-os/privileged-setup.hooks.d")"
+HOOKS_VERBOSE="${HOOKS_VERBOSE:-$(get_config '."verbose"' "false")}"
+
+if [ "${HOOKS_VERBOSE}" == "true" ] ; then
+	set -x
+fi
+
+if [ -d "${PRIVILEGED_HOOKS_DIRECTORY}" ] ; then
+	for script in $PRIVILEGED_HOOKS_DIRECTORY/* ; do
+		bash $script
+	done
+fi
--- a/system_files/shared/usr/bin/ublue-system-setup
+++ b/system_files/shared/usr/bin/ublue-system-setup
@ -0,0 +1,29 @@
+#!/usr/bin/bash
+
+get_config() {
+	SETUP_CONFIG_FILE="${SETUP_CONFIG_FILE:-/etc/ublue-os/setup.json}"
+	QUERY="$1"
+	FALLBACK="$2"
+	shift
+	shift
+	OUTPUT="$(jq -r "$QUERY" "$SETUP_CONFIG_FILE" 2>/dev/null || echo "$FALLBACK")"
+	if [ "$OUTPUT" == "null" ] ; then
+		echo "$FALLBACK"
+		return
+	fi
+	echo "$OUTPUT"
+}
+
+SYSTEM_HOOKS_DIRECTORY="$(get_config '."system-hooks-directory"' "/usr/share/ublue-os/system-setup.hooks.d")"
+HOOKS_VERBOSE="${HOOKS_VERBOSE:-$(get_config '."verbose"' "false")}"
+
+if [ "${HOOKS_VERBOSE}" == "true" ] ; then
+	set -x
+fi
+
+if [ -d "${SYSTEM_HOOKS_DIRECTORY}" ] ; then
+	for script in $SYSTEM_HOOKS_DIRECTORY/* ; do
+		bash $script
+	done
+fi
+
--- a/system_files/shared/usr/bin/ublue-user-setup
+++ b/system_files/shared/usr/bin/ublue-user-setup
@ -0,0 +1,29 @@
+#!/usr/bin/bash
+
+get_config() {
+	SETUP_CONFIG_FILE="${SETUP_CONFIG_FILE:-/etc/ublue-os/setup.json}"
+	QUERY="$1"
+	FALLBACK="$2"
+	shift
+	shift
+	OUTPUT="$(jq -r "$QUERY" "$SETUP_CONFIG_FILE" 2>/dev/null || echo "$FALLBACK")"
+	if [ "$OUTPUT" == "null" ] ; then
+		echo "$FALLBACK"
+		return
+	fi
+	echo "$OUTPUT"
+}
+
+USER_HOOKS_DIRECTORY="$(get_config '."user-hooks-directory"' "/usr/share/ublue-os/user-setup.hooks.d")"
+HOOKS_VERBOSE="${HOOKS_VERBOSE:-$(get_config '."verbose"' "false")}"
+
+if [ "${HOOKS_VERBOSE}" == "true" ] ; then
+	set -x
+fi
+
+# Privileged setup can be called via user services
+if [ -d "$USER_HOOKS_DIRECTORY" ] ; then
+	for script in $USER_HOOKS_DIRECTORY/* ; do
+		bash $script
+	done
+fi
--- a/system_files/shared/usr/bin/ujust
+++ b/system_files/shared/usr/bin/ujust
@ -0,0 +1,3 @@
+#!/usr/bin/bash
+
+just --justfile /usr/share/ublue-os/just/00-entry.just "${@}"
--- a/system_files/shared/usr/lib/modprobe.d/amd-legacy.conf
+++ b/system_files/shared/usr/lib/modprobe.d/amd-legacy.conf
@ -0,0 +1,6 @@
+# Enable Legacy AMD hardware support
+options amdgpu si_support=1
+options amdgpu cik_support=1
+
+options radeon si_support=0
+options radeon cik_support=0
--- a/system_files/shared/usr/lib/pki/containers/quay.io-toolbx-images.pub
+++ b/system_files/shared/usr/lib/pki/containers/quay.io-toolbx-images.pub
@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQr63Nsc66mA3oGMArrQPm8/AkuTO
+K+ZrK3WCWzx00LW5K1qu+BS3U4eyMmXaFKIsX69PEFZWzXKy9psum8wj9Q==
+-----END PUBLIC KEY-----
--- a/system_files/shared/usr/lib/pki/containers/ublue-os-backup.pub
+++ b/system_files/shared/usr/lib/pki/containers/ublue-os-backup.pub
@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERTMY78++NW5twobx8+Fwd+wqrTwd
+U8+Jv+r7QS+jwbl4VZ4GDbHjz01dRsqTbzdRjlYK+ERXTm9NfJJ5IlFFtw==
+-----END PUBLIC KEY-----
--- a/system_files/shared/usr/lib/pki/containers/ublue-os.pub
+++ b/system_files/shared/usr/lib/pki/containers/ublue-os.pub
@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHLRpBfPRYiMl9wb7s6fx47PzzNWu
+3zyJgXhWEvxoOgwv9CpwjbvUwR9qHxNMWkJhuGE6cjDA2hpy1I6NbA+24Q==
+-----END PUBLIC KEY-----
--- a/system_files/shared/usr/lib/systemd/system-preset/01-uupd.preset
+++ b/system_files/shared/usr/lib/systemd/system-preset/01-uupd.preset
@ -0,0 +1 @@
+enable uupd.timer
--- a/system_files/shared/usr/lib/systemd/system/flatpak-preinstall.service
+++ b/system_files/shared/usr/lib/systemd/system/flatpak-preinstall.service
@ -0,0 +1,19 @@
+[Unit]
+Description=Preinstall Flatpaks
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=/usr/bin/flatpak
+Documentation=man:flatpak-preinstall(1)
+StartLimitIntervalSec=600
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/flatpak preinstall -y
+RemainAfterExit=true
+Restart=on-failure
+RestartSec=30
+
+StartLimitBurst=3
+
+[Install]
+WantedBy=multi-user.target
--- a/system_files/shared/usr/lib/systemd/system/ublue-system-setup.service
+++ b/system_files/shared/usr/lib/systemd/system/ublue-system-setup.service
@ -0,0 +1,12 @@
+[Unit]
+Description=Configure system
+After=rpm-ostreed.service
+Before=systemd-user-sessions.service
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/ublue-system-setup
+User=root
+
+[Install]
+WantedBy=multi-user.target
--- a/system_files/shared/usr/lib/systemd/user/ublue-user-setup.service
+++ b/system_files/shared/usr/lib/systemd/user/ublue-user-setup.service
@ -0,0 +1,12 @@
+[Unit]
+Description=Configure system for current user
+Wants=network-online.target
+After=network-online.target
+ConditionUser=!@system
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/ublue-user-setup
+
+[Install]
+WantedBy=graphical-session.target
--- a/system_files/shared/usr/lib/ublue/setup-services/libsetup.sh
+++ b/system_files/shared/usr/lib/ublue/setup-services/libsetup.sh
@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+SETUP_CHECKER_FILE="${SETUP_CHECKER_FILE:-$HOME/.local/share/ublue/setup_versioning.json}"
+
+# Meant to be used at the start of any setup service script. Will version your script accordingly on $SETUP_CHECKER_FILE
+# :target_versioning_name: Whatever you want to name your versioning tag. Please keep it always the same
+# :type_of_service: Must be either `user`, `privileged`, or `system`
+# :version: Target version to check/apply to your file
+#
+# Meant to be used as follows (or similar):
+# version-script tailscale user 1 || exit 0
+function version-script() {
+  TARGET_VERSIONING_NAME=$1
+  TYPE_OF_SERVICE=$2
+  VERSION=$3
+  shift
+  shift
+  shift
+
+  if [ ! -e "${SETUP_CHECKER_FILE}" ] ; then
+    mkdir -p "$(dirname "${SETUP_CHECKER_FILE}")"
+    echo "{}" > "${SETUP_CHECKER_FILE}"
+  fi
+
+  if [ "$(jq -r -c ".version.${TYPE_OF_SERVICE}.\"${TARGET_VERSIONING_NAME}\"" "${SETUP_CHECKER_FILE}")" == "${VERSION}" ] ; then
+    echo "Exiting as current version (${VERSION}) for ${TYPE_OF_SERVICE}-${TARGET_VERSIONING_NAME} is the same as latest version recorded on ${SETUP_CHECKER_FILE}"
+    return 1
+  fi
+  ANNOYING_JQ_WORKAROUND=$(mktemp)
+  jq ".version.${TYPE_OF_SERVICE}.\"${TARGET_VERSIONING_NAME}\" = \"${VERSION}\"" "${SETUP_CHECKER_FILE}" >"${ANNOYING_JQ_WORKAROUND}"
+  mv "${ANNOYING_JQ_WORKAROUND}" "${SETUP_CHECKER_FILE}"
+  set +x
+  return 0
+}
--- a/system_files/shared/usr/lib/udev/rules.d/10-switch.rules
+++ b/system_files/shared/usr/lib/udev/rules.d/10-switch.rules
@ -0,0 +1,4 @@
+# This got added on https://github.com/ublue-os/config/pull/154
+# Written by https://github.com/badlydrawnface
+# Makes restarting a jigged switch easier
+SUBSYSTEMS=="usb", ATTRS{manufacturer}=="NVIDIA Corp.", ATTRS{product}=="APX", GROUP="nintendo_switch"
--- a/system_files/shared/usr/lib/udev/rules.d/50-framework16.rules
+++ b/system_files/shared/usr/lib/udev/rules.d/50-framework16.rules
@ -0,0 +1,15 @@
+# Written by https://github.com/kylegospo
+
+# Audio Expansion Card
+ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="32ac", ATTR{idProduct}=="0010", ATTR{power/autosuspend}="10", ATTR{power/control}="auto", GOTO="rules_end"
+
+# Framework Laptop 16 Keyboard Module - ANSI
+ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="32ac", ATTR{idProduct}=="0012", ATTR{power/autosuspend}="-1", ATTR{power/control}="on", ATTR{power/wakeup}="disabled", GOTO="rules_end"
+
+# Framework Laptop 16 Numpad Module
+ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="32ac", ATTR{idProduct}=="0014", ATTR{power/autosuspend}="-1", ATTR{power/control}="on", ATTR{power/wakeup}="disabled", GOTO="rules_end"
+
+# Framework Laptop 16 Keyboard Module
+ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="32ac", ATTR{idProduct}=="0018", ATTR{power/autosuspend}="-1", ATTR{power/control}="on", ATTR{power/wakeup}="disabled", GOTO="rules_end"
+
+LABEL="rules_end"
--- a/system_files/shared/usr/lib/udev/rules.d/50-steam-horipad-controller.rules
+++ b/system_files/shared/usr/lib/udev/rules.d/50-steam-horipad-controller.rules
@ -0,0 +1,11 @@
+# Added to config on https://github.com/ublue-os/config/pull/354
+# Commit from https://github.com/aarron-lee
+# udev rules from GloriousEggroll
+
+# Wireless HORIPAD STEAM; Bluetooth
+KERNEL=="hidraw*", KERNELS=="*0F0D:0196*", MODE="0660", TAG+="uaccess"
+KERNEL=="hidraw*", ATTRS{idVendor}=="0f0d", ATTRS{idProduct}=="0196", MODE="0660", TAG+="uaccess"
+
+# Wired HORIPAD STEAM; USB
+KERNEL=="hidraw*", KERNELS=="*0F0D:01AB*", MODE="0660", TAG+="uaccess"
+KERNEL=="hidraw*", ATTRS{idVendor}=="0f0d", ATTRS{idProduct}=="01ab", MODE="0660", TAG+="uaccess"
--- a/system_files/shared/usr/lib/udev/rules.d/50-usb-realtek-net.rules
+++ b/system_files/shared/usr/lib/udev/rules.d/50-usb-realtek-net.rules
@ -0,0 +1,48 @@
+# This is used to change the default configuration of Realtek USB ethernet adapters
+# First added on https://github.com/ublue-os/config/commit/34ee4b21ad34ca80115a95d8a18fd735c4cb29ad
+# Added by https://github.com/bsherman
+
+ACTION!="add", GOTO="usb_realtek_net_end"
+SUBSYSTEM!="usb", GOTO="usb_realtek_net_end"
+ENV{DEVTYPE}!="usb_device", GOTO="usb_realtek_net_end"
+
+# Modify this to change the default value
+ENV{REALTEK_MODE1}="1"
+ENV{REALTEK_MODE2}="3"
+
+# Realtek
+ATTR{idVendor}=="0bda", ATTR{idProduct}=="815[2,3,5,6]", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="0bda", ATTR{idProduct}=="8053", ATTR{bcdDevice}=="e???", ATTR{bConfigurationValue}!="$env{REALTEK_MODE2}", ATTR{bConfigurationValue}="$env{REALTEK_MODE2}"
+
+# Samsung
+ATTR{idVendor}=="04e8", ATTR{idProduct}=="a101", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+
+# Lenovo
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="304f", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="3052", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="3054", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="3057", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="3062", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="3069", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="3082", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="3098", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="7205", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="720a", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="720b", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="720c", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="7214", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="721e", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="8153", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="a359", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="a387", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+
+# TP-LINK
+ATTR{idVendor}=="2357", ATTR{idProduct}=="0601", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+
+# Nvidia
+ATTR{idVendor}=="0955", ATTR{idProduct}=="09ff", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+
+# LINKSYS
+ATTR{idVendor}=="13b1", ATTR{idProduct}=="0041", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+
+LABEL="usb_realtek_net_end"
--- a/system_files/shared/usr/lib/udev/rules.d/50-zsa.rules
+++ b/system_files/shared/usr/lib/udev/rules.d/50-zsa.rules
@ -0,0 +1,25 @@
+# Source: https://github.com/zsa/wally/wiki/Linux-install#2-create-a-udev-rule-file
+# Rules for Oryx web flashing and live training
+KERNEL=="hidraw*", ATTRS{idVendor}=="16c0", MODE="0664", GROUP="plugdev"
+KERNEL=="hidraw*", ATTRS{idVendor}=="3297", MODE="0664", GROUP="plugdev"
+
+# Legacy rules for live training over webusb (Not needed for firmware v21+)
+  # Rule for all ZSA keyboards
+  SUBSYSTEM=="usb", ATTR{idVendor}=="3297", GROUP="plugdev"
+  # Rule for the Moonlander
+  SUBSYSTEM=="usb", ATTR{idVendor}=="3297", ATTR{idProduct}=="1969", GROUP="plugdev"
+  # Rule for the Ergodox EZ
+  SUBSYSTEM=="usb", ATTR{idVendor}=="feed", ATTR{idProduct}=="1307", GROUP="plugdev"
+  # Rule for the Planck EZ
+  SUBSYSTEM=="usb", ATTR{idVendor}=="feed", ATTR{idProduct}=="6060", GROUP="plugdev"
+
+# Wally Flashing rules for the Ergodox EZ
+ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", ENV{ID_MM_DEVICE_IGNORE}="1"
+ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789A]?", ENV{MTP_NO_PROBE}="1"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789ABCD]?", MODE:="0666"
+KERNEL=="ttyACM*", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", MODE:="0666"
+
+# Keymapp / Wally Flashing rules for the Moonlander and Planck EZ
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE:="0666", SYMLINK+="stm32_dfu"
+# Keymapp Flashing rules for the Voyager
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="3297", MODE:="0666", SYMLINK+="ignition_dfu"
--- a/system_files/shared/usr/lib/udev/rules.d/60-arduino-mbed.rules
+++ b/system_files/shared/usr/lib/udev/rules.d/60-arduino-mbed.rules
@ -0,0 +1,8 @@
+# Source: https://github.com/arduino/ArduinoCore-mbed/blob/main/post_install.sh
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="2e8a", MODE:="0666"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="2341", MODE:="0666"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="1fc9", MODE:="0666"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="0525", MODE:="0666"
+
+# Arduino Nano clone, @vfosnar owns one
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="1a86", ATTRS{idProduct}=="7523", MODE:="0666"
--- a/system_files/shared/usr/lib/udev/rules.d/70-titan-key.rules
+++ b/system_files/shared/usr/lib/udev/rules.d/70-titan-key.rules
@ -0,0 +1,3 @@
+# First appeared on https://github.com/ublue-os/config/commit/7e539b4408e3515bb6b24e62ad5459b49f7b1bb5#diff-f47a075172a8fe955d7b173f0d6f8b298a593ef1d014d1baf65e8477f565ca77
+# Commit made by https://github.com/castrojo/
+KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="18d1|096e", ATTRS{idProduct}=="5026|0858|085b", TAG+="uaccess"
--- a/system_files/shared/usr/lib/udev/rules.d/70-wooting.rules
+++ b/system_files/shared/usr/lib/udev/rules.d/70-wooting.rules
@ -0,0 +1,99 @@
+# This is a soft fork of the official Wooting keyboard udev rules
+# Modified by https://github.com/Arcitec on https://github.com/ublue-os/config/pull/45
+
+# Wooting One Legacy
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff01", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff01", MODE="0660", TAG+="uaccess"
+# Wooting One update mode 
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2402", MODE="0660", TAG+="uaccess"
+
+# Wooting Two Legacy
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff02", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff02", MODE="0660", TAG+="uaccess"
+# Wooting Two update mode  
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2403", MODE="0660", TAG+="uaccess"
+
+# Wooting One
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1100", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1100", MODE="0660", TAG+="uaccess"
+# Wooting One Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1101", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1101", MODE="0660", TAG+="uaccess"
+# Wooting One 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1102", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1102", MODE="0660", TAG+="uaccess"
+
+# Wooting Two
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1200", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1200", MODE="0660", TAG+="uaccess"
+# Wooting Two Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1201", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1201", MODE="0660", TAG+="uaccess"
+# Wooting Two 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1202", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1202", MODE="0660", TAG+="uaccess"
+
+# Wooting Lekker
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1210", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1210", MODE="0660", TAG+="uaccess"
+# Wooting Lekker Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1211", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1211", MODE="0660", TAG+="uaccess"
+# Wooting Lekker 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1212", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1212", MODE="0660", TAG+="uaccess"
+
+# Wooting Lekker update mode  
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="121f", MODE="0660", TAG+="uaccess"
+
+# Wooting Two HE
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1220", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1220", MODE="0660", TAG+="uaccess"
+# Wooting Two HE Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1221", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1221", MODE="0660", TAG+="uaccess"
+# Wooting Two HE 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1222", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1222", MODE="0660", TAG+="uaccess"
+
+# Wooting Two HE update mode  
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="122f", MODE="0660", TAG+="uaccess"
+
+# Wooting Two HE (ARM)
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1230", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1230", MODE="0660", TAG+="uaccess"
+# Wooting Two HE Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1231", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1231", MODE="0660", TAG+="uaccess"
+# Wooting Two HE 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1232", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1232", MODE="0660", TAG+="uaccess"
+
+# Wooting Two HE (ARM) update mode  
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="123f", MODE="0660", TAG+="uaccess"
+
+# Wooting 60HE
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1300", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1300", MODE="0660", TAG+="uaccess"
+# Wooting 60HE Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1301", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1301", MODE="0660", TAG+="uaccess"
+# Wooting 60HE 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1302", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1302", MODE="0660", TAG+="uaccess"
+
+# Wooting 60HE update mode  
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="130f", MODE="0660", TAG+="uaccess"
+
+# Wooting 60HE (ARM)
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1310", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1310", MODE="0660", TAG+="uaccess"
+# Wooting 60HE (ARM) Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1311", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1311", MODE="0660", TAG+="uaccess"
+# Wooting 60HE (ARM) 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1312", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1312", MODE="0660", TAG+="uaccess"
+
+# Wooting 60HE (ARM) update mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="131f", MODE="0660", TAG+="uaccess"
--- a/system_files/shared/usr/lib/udev/rules.d/88-neutron_hifi_dac.rules
+++ b/system_files/shared/usr/lib/udev/rules.d/88-neutron_hifi_dac.rules
@ -0,0 +1,6 @@
+# Source: https://github.com/ublue-os/config/pull/285
+# Written by https://github.com/fiftydinar
+# Udev rule written for unprivileged access of Neutron HiFi DAC V1 functionality
+# https://neutronhifi.com/devices/dac/v1
+
+SUBSYSTEM=="usb", ATTRS{idVendor}=="1fc9", ATTRS{idProduct}=="82f9", MODE="0666"
--- a/system_files/shared/usr/lib/udev/rules.d/90-apple-superdrive.rules
+++ b/system_files/shared/usr/lib/udev/rules.d/90-apple-superdrive.rules
@ -0,0 +1,5 @@
+# Apple SuperDrive udev rule
+# Credits: @yookoala from GitHub
+# See: https://gist.github.com/yookoala/818c1ff057e3d965980b7fd3bf8f77a6
+
+ACTION=="add", ATTRS{idProduct}=="1500", ATTRS{idVendor}=="05ac", DRIVERS=="usb", RUN+="/usr/bin/sg_raw %r/sr%n EA 00 00 00 00 00 01"
--- a/system_files/shared/usr/lib/udev/rules.d/92-viia.rules
+++ b/system_files/shared/usr/lib/udev/rules.d/92-viia.rules
@ -0,0 +1,4 @@
+# Keychron keyboard hardware enablement
+# Created on https://github.com/ublue-os/config/pull/153
+# Written by https://github.com/atimeofday
+KERNEL=="hidraw*", SUBSYSTEM=="hidraw", MODE="0666", TAG+="uaccess", TAG+="udev-acl"
--- a/system_files/shared/usr/libexec/ublue-brew-trust-brewfile
+++ b/system_files/shared/usr/libexec/ublue-brew-trust-brewfile
@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Parses a Brewfile and trusts all declared taps via `brew trust --tap`.
+#
+# Usage: ublue-brew-trust-brewfile <path-to-Brewfile>
+
+set -euo pipefail
+
+brewfile="${1:?Usage: ublue-brew-trust-brewfile <path-to-Brewfile>}"
+
+if [[ ! -f "$brewfile" ]]; then
+  echo "ublue-brew-trust-brewfile: file not found: $brewfile" >&2
+  exit 1
+fi
+
+# Matches 'tap "foo/bar"'
+tap_pattern='^tap[[:space:]]+"([^"]+)"'
+
+while IFS= read -r line; do
+  if [[ "$line" =~ $tap_pattern ]]; then
+    tap="${BASH_REMATCH[1]}"
+    brew trust --tap "$tap"
+  fi
+done <"$brewfile"
--- a/system_files/shared/usr/share/color/icc/colord/framework13.icc
+++ b/system_files/shared/usr/share/color/icc/colord/framework13.icc
--- a/system_files/shared/usr/share/color/icc/colord/framework16.icc
+++ b/system_files/shared/usr/share/color/icc/colord/framework16.icc
--- a/system_files/shared/usr/share/fish/vendor_conf.d/fish_greeting.fish
+++ b/system_files/shared/usr/share/fish/vendor_conf.d/fish_greeting.fish
@ -0,0 +1,5 @@
+function fish_greeting
+    if test ! -e $HOME/.config/no-show-user-motd
+        ublue-motd
+    end
+end
--- a/system_files/shared/usr/share/fish/vendor_conf.d/ublue-fastfetch.fish
+++ b/system_files/shared/usr/share/fish/vendor_conf.d/ublue-fastfetch.fish
@ -0,0 +1,3 @@
+alias neofetch='ublue-fastfetch'
+alias neowofetch='ublue-fastfetch'
+alias fastfetch='ublue-fastfetch'
--- a/system_files/shared/usr/share/polkit-1/actions/org.ublue.privileged.user.setup.policy
+++ b/system_files/shared/usr/share/polkit-1/actions/org.ublue.privileged.user.setup.policy
@ -15,7 +15,7 @@
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
-    <annotate key="org.freedesktop.policykit.exec.path">/usr/libexec/ublue-privileged-user-setup</annotate>
+    <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/ublue-privileged-setup</annotate>
  </action>

 </policyconfig>
--- a/system_files/shared/usr/share/polkit-1/rules.d/20-privileged-user-setup.rules
+++ b/system_files/shared/usr/share/polkit-1/rules.d/20-privileged-user-setup.rules
@ -0,0 +1,10 @@
+polkit.addRule(function(action,subject) {
+    if ( (action.id == "org.freedesktop.policykit.exec") &&
+         (action.lookup("program") == "/usr/bin/ublue-privileged-setup") &&
+         (subject.isInGroup("wheel") ) ) {
+      return polkit.Result.YES;
+    }
+
+    return polkit.Result.NOT_HANDLED;
+  }
+);
--- a/system_files/shared/usr/share/polkit-1/rules.d/org.debian.pcsc-lite.access_card.rules
+++ b/system_files/shared/usr/share/polkit-1/rules.d/org.debian.pcsc-lite.access_card.rules
@ -0,0 +1,16 @@
+// allow members of the wheel group to access gpg cards via pcscd service
+// this is needed for access to yubikey devices
+// installation details from https://github.com/drduh/YubiKey-Guide/issues/376
+
+polkit.addRule(function(action, subject) {
+        if (action.id == "org.debian.pcsc-lite.access_card" &&
+                subject.isInGroup("wheel")) {
+                return polkit.Result.YES;
+        }
+});
+polkit.addRule(function(action, subject) {
+        if (action.id == "org.debian.pcsc-lite.access_pcsc" &&
+                subject.isInGroup("wheel")) {
+                return polkit.Result.YES;
+        }
+});
--- a/system_files/shared/usr/share/ublue-os/bling/bling.fish
+++ b/system_files/shared/usr/share/ublue-os/bling/bling.fish
@ -0,0 +1,45 @@
+#!/usr/bin/env fish
+
+if status is-interactive
+    test "$BLING_SOURCED" = 1; and return; or set -g BLING_SOURCED 1
+
+    function __bling_abbr -d "Create an abbreviation or alias"
+        test "$BLING_USE_ABBR" != 0; and abbr -a $argv; or alias $argv
+    end
+
+    # ls aliases
+    if type -q eza
+        __bling_abbr ll 'eza -l --icons=auto --group-directories-first'
+        __bling_abbr l. 'eza -d .*'
+        __bling_abbr ls 'eza'
+        __bling_abbr l1 'eza -1'
+    end
+
+    # ugrep for grep
+    if type -q ug
+        __bling_abbr grep 'ug'
+        __bling_abbr egrep 'ug -E'
+        __bling_abbr fgrep 'ug -F'
+        __bling_abbr xzgrep 'ug -z'
+        __bling_abbr xzegrep 'ug -zE'
+        __bling_abbr xzfgrep 'ug -zF'
+    end
+
+    # bat for cat
+    if type -q bat
+        __bling_abbr cat 'bat --style=plain --pager=never'
+    end
+
+    type -q direnv; and direnv hook fish | source    
+
+    # Atuin shell integration is disabled by default
+    # The atuin binary is still installed and available for manual use
+    # To enable shell integration, uncomment the following line or add it to your config.fish:
+    # type -q atuin; and atuin init fish $ATUIN_INIT_FLAGS | source
+
+    type -q starship; and starship init fish | source 
+
+    type -q zoxide; and zoxide init fish | source 
+
+    type -q mise; and test "$MISE_FISH_AUTO_ACTIVATE" != 0; and mise activate fish | source
+end
--- a/system_files/shared/usr/share/ublue-os/bling/bling.sh
+++ b/system_files/shared/usr/share/ublue-os/bling/bling.sh
@ -0,0 +1,68 @@
+#!/usr/bin/env sh
+
+# KEEP THIS POSIX - Needs to work on Bash and ZSH
+
+# Check if bling has already been sourced so that we dont break atuin. https://github.com/atuinsh/atuin/issues/380#issuecomment-1594014644
+[ "${BLING_SOURCED:-0}" -eq 1 ] && return 
+BLING_SOURCED=1
+
+# ls aliases
+if [ "$(command -v eza)" ]; then
+    alias ll='eza -l --icons=auto --group-directories-first'
+    alias l.='eza -d .*'
+    alias ls='eza'
+    alias l1='eza -1'
+fi
+
+# ugrep for grep
+if [ "$(command -v ug)" ]; then
+    alias grep='ug'
+    alias egrep='ug -E'
+    alias fgrep='ug -F'
+    alias xzgrep='ug -z'
+    alias xzegrep='ug -zE'
+    alias xzfgrep='ug -zF'
+fi
+
+# bat for cat
+if [ "$(command -v bat)" ]; then
+    alias cat='bat --style=plain --pager=never'
+fi
+
+# set ATUIN_INIT_FLAGS in your ~/.bashrc before ublue-bling is sourced.
+# Atuin allows these flags: "--disable-up-arrow" and/or "--disable-ctrl-r"
+ATUIN_INIT_FLAGS="${ATUIN_INIT_FLAGS:-}"
+
+BLING_SHELL="$(basename "$(readlink /proc/$$/exe)")"
+
+# Initialize direnv before bash-preexec to avoid PROMPT_COMMAND conflicts
+# See: https://github.com/rcaloras/bash-preexec/pull/143
+if [ "${BLING_SHELL}" = "bash" ]; then
+    [ -f "/etc/profile.d/bash-preexec.sh" ] && . "/etc/profile.d/bash-preexec.sh"
+    [ -f "/usr/share/bash-prexec" ] && . "/usr/share/bash-prexec"
+    [ -f "/usr/share/bash-prexec.sh" ] && . "/usr/share/bash-prexec.sh"
+    [ -f "${HOMEBREW_PREFIX}/etc/profile.d/bash-preexec.sh" ] && . "${HOMEBREW_PREFIX}/etc/profile.d/bash-preexec.sh"
+fi
+
+[ "$(command -v direnv)" ] && eval "$(direnv hook "${BLING_SHELL}")"
+# Atuin shell integration is disabled by default
+# The atuin binary is still installed and available for manual use
+# To enable shell integration, uncomment the following line or add it to your shell config:
+# [ "$(command -v atuin)" ] && eval "$(atuin init "${BLING_SHELL}" ${ATUIN_INIT_FLAGS})"
+[ "$(command -v starship)" ] && eval "$(starship init "${BLING_SHELL}")"
+[ "$(command -v zoxide)" ] && eval "$(zoxide init "${BLING_SHELL}")"
+
+if command -v mise >/dev/null 2>&1; then
+  # Check for Bash
+  if [ "${BLING_SHELL}" = "bash" ]; then
+    if [ "$MISE_BASH_AUTO_ACTIVATE" != "0" ]; then
+      eval "$(mise activate bash)"
+    fi
+
+    # Check for Zsh
+  elif [ "${BLING_SHELL}" = "zsh" ]; then
+    if [ "$MISE_ZSH_AUTO_ACTIVATE" != "0" ]; then
+      eval "$(mise activate zsh)"
+    fi
+  fi
+fi
--- a/system_files/shared/usr/share/ublue-os/homebrew/ai-tools.Brewfile
+++ b/system_files/shared/usr/share/ublue-os/homebrew/ai-tools.Brewfile
@ -0,0 +1,25 @@
+tap "anomalyco/tap"
+tap "charmbracelet/tap"
+tap "ublue-os/tap"
+tap "ublue-os/experimental-tap"
+brew "aichat"
+brew "anomalyco/tap/opencode"
+brew "block-goose-cli"
+brew "charmbracelet/tap/crush"
+brew "gemini-cli"
+brew "kimi-cli"
+brew "llm"
+brew "llmfit"
+brew "mistral-vibe"
+brew "qwen-code"
+brew "ramalama"
+brew "ublue-os/tap/linux-mcp-server"
+brew "whisper-cpp"
+cask "claude-code"
+cask "codex"
+cask "copilot-cli"
+cask "ublue-os/tap/antigravity-linux" 
+cask "ublue-os/experimental-tap/opencode-desktop-linux"
+cask "ublue-os/tap/goose-linux"
+cask "ublue-os/tap/lm-studio-linux"
+flatpak "ai.jan.Jan"
--- a/system_files/shared/usr/share/ublue-os/homebrew/artwork.Brewfile
+++ b/system_files/shared/usr/share/ublue-os/homebrew/artwork.Brewfile
@ -0,0 +1,7 @@
+tap "ublue-os/tap"
+
+cask "aurora-wallpapers"
+cask "bazzite-wallpapers"
+cask "bluefin-wallpapers"
+cask "bluefin-wallpapers-extra"
+cask "framework-wallpapers"
--- a/system_files/shared/usr/share/ublue-os/homebrew/cli.Brewfile
+++ b/system_files/shared/usr/share/ublue-os/homebrew/cli.Brewfile
@ -0,0 +1,20 @@
+brew "atuin"
+brew "bat"
+brew "bash-preexec"
+brew "bbrew"
+brew "chezmoi"
+brew "direnv"
+brew "dysk"
+brew "eza"
+brew "fd"
+brew "gh"
+brew "podman-tui"
+brew "ripgrep"
+brew "starship"
+brew "tealdeer"
+brew "trash-cli"
+brew "uutils-coreutils"
+brew "ugrep"
+brew "yq"
+brew "zoxide"
+brew "mise"
--- a/system_files/shared/usr/share/ublue-os/homebrew/cncf.Brewfile
+++ b/system_files/shared/usr/share/ublue-os/homebrew/cncf.Brewfile
@ -0,0 +1,293 @@
+# CNCF Projects Brewfile
+# Generated from CNCF Landscape data
+# https://landscape.cncf.io/
+#
+# This Brewfile contains Homebrew formulas for CNCF projects organized by maturity level.
+# To install all formulas: brew bundle --file=cncf.Brewfile
+# To install specific sections, edit this file to comment out unwanted formulas.
+
+# === TAPS ===
+# Taps for CNCF projects not in homebrew-core
+tap "dapr/tap"
+tap "buildpacks/tap"
+tap "carvel-dev/carvel"
+tap "kitops-ml/kitops"
+tap "microcks/tap"
+tap "telepresenceio/telepresence"
+tap "k0sproject/tap"
+tap "kptdev/kpt", "https://github.com/kptdev/kpt.git"
+tap "wasmcloud/wasmcloud"
+tap "artifacthub/cmd"
+tap "pingcap/brew"
+# === GRADUATED PROJECTS ===
+
+# Argo
+brew "argo"
+brew "argocd"
+
+# Cilium
+brew "cilium-cli"
+
+# CoreDNS
+brew "coredns"
+
+# Crossplane
+brew "crossplane"
+
+# CubeFS
+# brew "cubefsctl" # No Homebrew formula found
+
+# Dapr
+brew "dapr/tap/dapr-cli"
+
+# CRI-O (via cri-tools)
+brew "cri-tools"
+
+# Dragonfly
+# brew "dragonfly" # P2P system (d7y) not available via brew. 'dragonfly' is DragonflyDB.
+
+# Envoy
+brew "envoy"
+
+# Falco
+brew "falco"
+
+# Fluentd
+# Not available via brew
+# brew "td-agent" Warning: td-agent has been deprecated because it is discontinued upstream! It will be disabled on 2026-03-01.
+
+# Flux
+brew "flux"
+
+# Harbor
+brew "harbor-cli"
+
+# Helm
+brew "helm"
+
+# Istio
+brew "istioctl"
+
+# Jaeger
+# brew "jaeger" # No all-in-one formula. Use Docker or 'jaeger-client' lib.
+
+# KEDA
+# brew "keda" # Use Helm
+
+# Knative
+brew "kn"
+
+# KubeEdge
+# brew "kubeedge" # Use manual install (keadm)
+
+# Kubernetes
+brew "kubernetes-cli"
+brew "minikube"
+brew "kind"
+
+# Linkerd
+brew "linkerd"
+
+# Open Policy Agent (OPA)
+brew "opa"
+
+# Prometheus
+brew "prometheus"
+
+# SPIRE
+# brew "spire" # Use manual install (spire-server/agent)
+
+# Vitess
+brew "vitess"
+
+# cert-manager
+brew "cmctl"
+
+# containerd
+brew "nerdctl"
+
+# etcd
+brew "etcd"
+
+# in-toto
+# brew "in-toto" # Use pip install in-toto
+
+# === INCUBATING PROJECTS ===
+
+# Artifact Hub
+brew "artifacthub/cmd/ah"
+
+# Buildpacks
+brew "buildpacks/tap/pack"
+
+# Chaos Mesh
+# brew "chaos-mesh" # Use Helm
+
+# Cloud Custodian
+brew "c7n"
+
+# Container Network Interface (CNI)
+# brew "cni" # Manual install of plugins
+
+# Contour
+# brew "contour" # Use Helm/kubectl
+
+# Cortex
+brew "cortex"
+
+# Karmada
+brew "karmadactl"
+
+# Keycloak
+# brew "keycloak" # Use Docker or manual install
+
+# KubeVela
+brew "kubevela"
+
+# KubeVirt (virtctl)
+brew "virtctl"
+
+# Kubescape
+brew "kubescape"
+
+# Kyverno
+brew "kyverno"
+
+# Lima
+brew "lima"
+
+# Litmus
+brew "litmusctl"
+
+# Longhorn
+# brew "longhornctl" # Manual install or Krew
+
+# NATS
+brew "nats-server"
+
+# Notary Project
+brew "notation"
+
+# OpenCost
+# brew "opencost" # Use Helm
+
+# OpenFGA
+brew "openfga"
+
+# OpenTelemetry
+brew "opentelemetry-cpp"
+
+# Operator Framework
+brew "operator-sdk"
+
+# Thanos
+brew "thanos"
+
+# gRPC
+brew "grpc"
+
+# wasmCloud
+brew "wasmcloud/wasmcloud/wash"
+
+# === SANDBOX PROJECTS ===
+
+# Antrea
+# brew "antrea" # Use Helm. 'antctl' available via curl.
+
+# Atlantis
+brew "atlantis"
+
+# CDK for Kubernetes (CDK8s)
+brew "cdk8s"
+
+# Carvel
+brew  "carvel-dev/carvel/kwt"
+brew "carvel-dev/carvel/kctrl"
+brew "carvel-dev/carvel/ytt"
+brew "carvel-dev/carvel/kapp"
+brew "carvel-dev/carvel/kbld"
+brew "carvel-dev/carvel/imgpkg"
+brew "carvel-dev/carvel/vendir"
+
+# CloudNativePG
+brew "kubectl-cnpg"
+
+# DevSpace
+brew "devspace"
+
+# K8sGPT
+brew "k8sgpt"
+
+# KitOps
+brew "kitops-ml/kitops/kitops"
+
+# KubeArmor
+# brew "kubearmor" # Use karmor CLI via curl
+
+# Kuberhealthy
+# brew "kuberhealthy" # Use Helm
+
+# Kubewarden
+brew "kwctl"
+
+# Kuma
+brew "kumactl"
+
+# Kured
+# Kured
+# brew "kured" # Use Helm
+
+# Meshery
+brew "mesheryctl"
+
+# Microcks
+brew "microcks/tap/microcks-cli"
+
+# Porter
+brew "porter"
+
+# Telepresence
+brew "telepresenceio/telepresence/telepresence-oss"
+
+# Tremor
+# Tremor
+brew "tremor-runtime"
+
+# WasmEdge Runtime
+brew "wasmedge"
+
+# k0s
+brew "k0sproject/tap/k0sctl"
+
+# k3s (via k3d)
+brew "k3d"
+
+# k8gb
+# brew "k8gb" # Use Helm
+
+# ko
+brew "ko"
+
+# kpt
+brew "kptdev/kpt/kpt"
+
+# kube-vip
+# brew "kube-vip" # In-cluster deployment
+
+# === SUMMARY ===
+# Graduated: 31 formulas
+# Incubating: 25 formulas
+# Sandbox: 33 formulas
+# Total: 89 formulas
+
+# === FLATPAKS ===
+# Graphical tools for CNCF projects and cloud-native development
+
+# Headlamp (CNCF Sandbox) - Kubernetes UI
+flatpak "io.kinvolk.Headlamp"
+
+# OpenLens - Kubernetes IDE
+flatpak "dev.k8slens.OpenLens"
+
+# Podman Desktop - Container Management
+flatpak "io.podman_desktop.PodmanDesktop"
--- a/system_files/shared/usr/share/ublue-os/homebrew/experimental-ide.Brewfile
+++ b/system_files/shared/usr/share/ublue-os/homebrew/experimental-ide.Brewfile
@ -0,0 +1,15 @@
+tap "ublue-os/experimental-tap"
+cask "ublue-os/experimental-tap/cursor-linux"
+cask "ublue-os/experimental-tap/clion-linux"
+cask "ublue-os/experimental-tap/datagrip-linux"
+cask "ublue-os/experimental-tap/dataspell-linux"
+cask "ublue-os/experimental-tap/emacs-app-linux"
+cask "ublue-os/experimental-tap/goland-linux"
+cask "ublue-os/experimental-tap/intellij-idea-linux"
+cask "ublue-os/experimental-tap/phpstorm-linux"
+cask "ublue-os/experimental-tap/pycharm-linux"
+cask "ublue-os/experimental-tap/rider-linux"
+cask "ublue-os/experimental-tap/rubymine-linux"
+cask "ublue-os/experimental-tap/rustrover-linux"
+cask "ublue-os/experimental-tap/webstorm-linux"
+cask "ublue-os/experimental-tap/zed-linux"
--- a/system_files/shared/usr/share/ublue-os/homebrew/fonts.Brewfile
+++ b/system_files/shared/usr/share/ublue-os/homebrew/fonts.Brewfile
@ -0,0 +1,11 @@
+cask "font-caskaydia-mono-nerd-font"
+cask "font-comic-shanns-mono-nerd-font"
+cask "font-droid-sans-mono-nerd-font"
+cask "font-go-mono-nerd-font"
+cask "font-blex-mono-nerd-font"
+cask "font-sauce-code-pro-nerd-font"
+cask "font-source-code-pro"
+cask "font-ubuntu-nerd-font"
+cask "font-fira-code-nerd-font"
+cask "font-0xproto-nerd-font"
+cask "font-jetbrains-mono-nerd-font"
--- a/system_files/shared/usr/share/ublue-os/homebrew/ide.Brewfile
+++ b/system_files/shared/usr/share/ublue-os/homebrew/ide.Brewfile
@ -0,0 +1,10 @@
+tap "ublue-os/tap"
+cask "ublue-os/tap/visual-studio-code-linux"
+cask "ublue-os/tap/visual-studio-code-linux@insiders"
+cask "ublue-os/tap/vscodium-linux"
+cask "ublue-os/tap/antigravity-linux"
+cask "ublue-os/tap/jetbrains-toolbox-linux"
+brew "nvim"
+brew "micro" 
+brew "helix" 
+brew "devcontainer"
--- a/system_files/shared/usr/share/ublue-os/homebrew/k8s-tools.Brewfile
+++ b/system_files/shared/usr/share/ublue-os/homebrew/k8s-tools.Brewfile
@ -0,0 +1,14 @@
+tap "buildpacks/tap"
+brew "kind"
+brew "cdk8s"
+tap "k0sproject/tap"
+brew "k0sproject/tap/k0sctl"
+brew "k3sup"
+brew "dagger"
+brew "grype"
+brew "helm"
+brew "kubectl"
+brew "k9s"
+brew "kubectx"
+brew "buildpacks/tap/pack"
+brew "syft"
--- a/system_files/shared/usr/share/ublue-os/homebrew/swift.Brewfile
+++ b/system_files/shared/usr/share/ublue-os/homebrew/swift.Brewfile
@ -0,0 +1,9 @@
+# Swift Development Environment
+# Install with: ujust swift
+
+# Swift toolchain management (official Swift installer)
+brew "swiftly"
+
+# Code quality tools
+brew "swiftlint"
+brew "swiftformat"
--- a/system_files/shared/usr/share/ublue-os/just/00-entry.just
+++ b/system_files/shared/usr/share/ublue-os/just/00-entry.just
@ -7,10 +7,8 @@ _default:
    ujust --list --list-heading $'Available commands:\n' --list-prefix $' - '

 # Imports
-# specific to Aurora
 import "/usr/share/ublue-os/just/changelog.just"
 import "/usr/share/ublue-os/just/system.just"
-# shared with bluefin
 import "/usr/share/ublue-os/just/apps.just"
 import "/usr/share/ublue-os/just/default.just"
 import "/usr/share/ublue-os/just/shared.just"
--- a/system_files/shared/usr/share/ublue-os/just/apps.just
+++ b/system_files/shared/usr/share/ublue-os/just/apps.just
@ -0,0 +1,80 @@
+# vim: set ft=make :
+
+# alias for install-jetbrains-toolbox
+[group('Apps')]
+jetbrains-toolbox:
+    @ujust install-jetbrains-toolbox
+
+# Install JetBrains Toolbox | https://www.jetbrains.com/toolbox-app/
+[group('Apps')]
+install-jetbrains-toolbox:
+    #!/usr/bin/env bash
+    brew trust --tap ublue-os/homebrew-tap
+    brew tap ublue-os/homebrew-tap
+    brew install --cask jetbrains-toolbox-linux
+
+# Install OpenTabletDriver, an open source, cross-platform, user-mode tablet driver
+[group('Apps')]
+install-opentabletdriver:
+    #!/usr/bin/bash
+    gum confirm --affirmative="Install" --negative="Uninstall" "Installer for OpenTabletDriver"
+    EXIT_CODE="$?"
+
+    if [ "${EXIT_CODE}" == 0 ] ; then
+      echo "Installing OpenTabletDriver..."
+
+      OTD_TMPDIR="$(mktemp -d)"
+
+      curl -s "https://api.github.com/repos/OpenTabletDriver/OpenTabletDriver/releases/latest" \
+        | jq -r '.assets[] | select(.name | test("opentabletdriver.*tar.gz$")) | .browser_download_url' \
+        | xargs curl -L -s \
+        | tar --strip-components=1 -xvzf - -C "${OTD_TMPDIR}"
+
+      # https://opentabletdriver.net/Wiki/Documentation/RequiredPermissions
+      sudo cp "${OTD_TMPDIR}/etc/udev/rules.d/70-opentabletdriver.rules" /etc/udev/rules.d/71-opentabletdriver.rules
+      echo -ne "blacklist hid_uclogic\nblacklist wacom\n" | sudo tee /etc/modprobe.d/blacklist-opentabletdriver.conf
+      rm -rf "${OTD_TMPDIR}"
+
+      flatpak --system install -y flathub net.opentabletdriver.OpenTabletDriver
+
+      mkdir -p "$HOME/.config/systemd/user"
+      curl -s "https://raw.githubusercontent.com/flathub/net.opentabletdriver.OpenTabletDriver/refs/heads/master/scripts/opentabletdriver.service" > "$HOME/.config/systemd/user/opentabletdriver.service"
+
+      systemctl --user daemon-reload
+      systemctl enable --user --now opentabletdriver.service
+    elif [ "${EXIT_CODE}" == 1 ] ; then
+      echo "Uninstalling OpenTabletDriver..."
+      sudo rm -f /etc/modprobe.d/blacklist-opentabletdriver.rules /etc/udev/rules.d/71-opentabletdriver.rules
+      flatpak --system remove -y flathub net.opentabletdriver.OpenTabletDriver
+    fi
+
+# Install applications from curated Brewfiles (includes full-desktop.Brewfile with GNOME Circle apps)
+bbrew:
+    #!/usr/bin/env bash
+    if ! command -v bbrew &>/dev/null ; then
+        if gum confirm "Bold Brew is not installed, would you like to install it?" ; then
+            set -e
+            brew trust --tap Valkyrie00/homebrew-bbrew
+            brew install Valkyrie00/homebrew-bbrew/bbrew
+            set +e
+        else
+            exit 0
+        fi
+    fi
+    echo "Note: Some of these take a while to load, we'll keep working on it."
+    CHOSEN="$(gum choose $(find "/usr/share/ublue-os/homebrew"/*.Brewfile -exec basename '{}' '.Brewfile' ';'))"
+    BREWFILE="/usr/share/ublue-os/homebrew/${CHOSEN}.Brewfile"
+    /usr/libexec/ublue-brew-trust-brewfile "$BREWFILE"
+    bbrew -f "$BREWFILE"
+
+cncf:
+    #!/usr/bin/env bash
+    if ! command -v bbrew &>/dev/null ; then
+        if gum confirm "Bold Brew is not installed, would you like to install it?" ; then
+            brew install bbrew
+        else
+            exit 0
+        fi
+    fi
+    /usr/libexec/ublue-brew-trust-brewfile "/usr/share/ublue-os/homebrew/cncf.Brewfile"
+    bbrew -f "/usr/share/ublue-os/homebrew/cncf.Brewfile"
--- a/system_files/shared/usr/share/ublue-os/just/default.just
+++ b/system_files/shared/usr/share/ublue-os/just/default.just
@ -0,0 +1,191 @@
+# vim: set ft=make :
+
+uid := `id -u`
+shell := `grep :$(id -u): /etc/passwd | cut -d: -f7`
+
+# Boot into this device's BIOS/UEFI screen
+bios:
+    #!/usr/bin/bash
+    if [ ! -d /sys/firmware/efi ]; then
+      echo "Rebooting to legacy BIOS from OS is not supported."
+      exit 1
+    fi
+
+    if gum confirm "Reboot into BIOS?" ; then
+      systemctl reboot --firmware-setup
+    fi
+
+# Show BIOS info
+bios-info:
+    #!/usr/bin/bash
+    sudo bash <<'EOF'
+    echo "Manufacturer: $(dmidecode -s baseboard-manufacturer)"
+    echo "Product Name: $(dmidecode -s baseboard-product-name)"
+    echo "Version: $(dmidecode -s bios-version)"
+    echo "Release Date: $(dmidecode -s bios-release-date)"
+    EOF
+
+clean-system:
+    #!/usr/bin/bash
+    if gum confirm "Prune all Podman images and volumes?"; then
+        echo "Images that would be pruned:"
+        podman image ls --filter dangling=true --format "{{{{.Repository}}}}:{{{{.Tag}}}}  {{{{.ID}}}}" 2>/dev/null | head -20
+        echo "Volumes that would be pruned:"
+        podman volume ls --filter dangling=true --quiet 2>/dev/null | head -20
+        if gum confirm "Proceed with pruning Podman images and volumes?"; then
+            podman image prune -af
+            podman volume prune -f
+        fi
+    fi
+
+    if command -v docker >/dev/null 2>&1; then
+      if gum confirm "Prune all Docker images and volumes?"; then
+        echo "Images that would be pruned:"
+        docker image ls --filter dangling=true --format "{{{{.Repository}}}}:{{{{.Tag}}}}  {{{{.ID}}}}" 2>/dev/null | head -20
+        echo "Volumes that would be pruned:"
+        docker volume ls --filter dangling=true --quiet 2>/dev/null | head -20
+        if gum confirm "Proceed with pruning Docker images and volumes?"; then
+            docker image prune -af
+            docker volume prune -f
+        fi
+      fi
+    fi
+
+    flatpak uninstall --unused
+    rpm-ostree cleanup -bm
+    if [ -x /home/linuxbrew/.linuxbrew/bin/brew ]; then
+        brew autoremove
+        brew cleanup
+    fi
+
+# Show all messages from this boot
+logs-this-boot:
+    sudo journalctl --no-hostname -b 0
+
+# Show all messages from last boot
+logs-last-boot:
+    sudo journalctl --no-hostname -b -1
+
+# Enroll Nvidia driver & KMOD signing key for secure boot - Enter password "universalblue" if prompted
+enroll-secure-boot-key:
+    #!/usr/bin/bash
+    ENROLLMENT_PASSWORD="universalblue"
+    sudo bash <<EOF
+    mokutil --timeout -1
+    echo -e "$ENROLLMENT_PASSWORD\n$ENROLLMENT_PASSWORD" | mokutil --import "/etc/pki/akmods/certs/akmods-ublue.der"
+    EOF
+    echo 'At next reboot, the mokutil UEFI menu UI will be displayed (*QWERTY* keyboard input and navigation).\nThen, select "Enroll MOK", and input "universalblue" as the password'
+
+# Toggle display of the user-motd in terminal
+toggle-user-motd:
+    #!/usr/bin/bash
+    if [ -e "${HOME}/.config/no-show-user-motd" ] ; then
+      if gum confirm "Would you like to enable the MOTD?" ; then
+        rm -f "${HOME}/.config/no-show-user-motd"
+        echo "MOTD will now be shown on login."
+        exit 0
+      fi
+    fi
+    if gum confirm "Would you like to disable the MOTD?" ; then
+      mkdir -p "${HOME}/.config"
+      touch "${HOME}/.config/no-show-user-motd"
+      echo "MOTD will not be shown anymore."
+      exit 0
+    fi
+
+# Check for local overrides
+check-local-overrides:
+    #!/usr/bin/bash
+    RESET="\x1b[0m"
+    if [ "${NO_COLOR}" == 1 ]; then
+        BLUE_COLOR=""
+        GREEN_COLOR=""
+        YELLOW_COLOR=""
+    else
+        BLUE_COLOR="${BLUE_COLOR:-\x1b[38;5;117m}"
+        GREEN_COLOR="${GREEN_COLOR:-\x1b[38;5;85m}"
+        YELLOW_COLOR="${YELLOW_COLOR:-\x1b[93m}"
+    fi
+
+    diff -qr \
+      --suppress-common-lines \
+      --color="always" \
+      --exclude "passwd*" \
+      --exclude "group*" \
+      --exclude="subgid*" \
+      --exclude="subuid*" \
+      --exclude="machine-id" \
+      --exclude="adjtime" \
+      --exclude="fstab" \
+      --exclude="system-connections" \
+      --exclude="shadow*" \
+      --exclude="gshadow*" \
+      --exclude="ssh_host*" \
+      --exclude="cmdline" \
+      --exclude="crypttab" \
+      --exclude="hostname" \
+      --exclude="localtime" \
+      --exclude="locale*" \
+      --exclude="*lock" \
+      --exclude=".updated" \
+      --exclude="*LOCK" \
+      --exclude="vconsole*" \
+      --exclude="00-keyboard.conf" \
+      --exclude="grub" \
+      --exclude="system.control*" \
+      --exclude="cdi" \
+      --exclude="default.target" \
+      /usr/etc /etc 2>/dev/null | sed \
+          -e '/Binary\ files\ /d ; /Common subdirectories/d' \
+          -e "/Files/ s/^/${BLUE_COLOR}&/g" \
+          -e "/Files/ s/\$/&${RESET}/g" \
+          -e "/Only in/ s/^/${GREEN_COLOR}&/g" \
+          -e "/Only in/ s/\$/&${RESET}/g" \
+          -e "s/\:.*/${RESET}${YELLOW_COLOR}&${RESET}/g"
+
+# Gather device info to a pastebin
+device-info:
+    #!/usr/bin/bash
+    if ! gum confirm "Submit information to the CentOS pastebin?" ; then
+        exit 0
+    fi
+
+    cat &> /tmp/deviceinfo-out <<EOF
+    --#--# sudo bootc status --verbose:
+    $(sudo bootc status --verbose)
+    --#--# fpaste --sysinfo --printonly:
+    $(fpaste --sysinfo --printonly)
+    --#--# flatpak list --columns=application,version,options:
+    $(flatpak list --columns=application,version,options)
+    EOF
+
+    cat /tmp/deviceinfo-out | fpaste
+
+# Measure Idle Power Draw
+check-idle-power-draw:
+    #!/usr/bin/bash
+    if ! command -v powerstat ; then
+        echo "Powerstat is not available"
+        exit 1
+    fi
+    sudo powerstat -a -r
+
+# Run a one minute system benchmark
+[group('System')]
+benchmark:
+    #!/usr/bin/env bash
+    if ! command -v "stress-ng" ; then
+        if gum confirm "Stress does not seem to be on your path, do you wish to install it?" ; then
+            set -eu
+            brew install stress-ng
+            brew link stress-ng
+            set +eu
+        else
+            exit 0
+        fi
+    fi
+
+    echo "Running a 1 minute benchmark ..."
+    trap popd EXIT
+    pushd "$(mktemp -d)"
+    stress-ng --matrix 0 -t 1m --times
--- a/system_files/shared/usr/share/ublue-os/just/shared.just
+++ b/system_files/shared/usr/share/ublue-os/just/shared.just
@ -0,0 +1,22 @@
+# vim: set ft=make :
+
+# Toggle LUKS auto-unlock via TPM2
+[group('System')]
+toggle-tpm2:
+    @/usr/bin/luks-tpm2-autounlock
+
+# Factory reset this device (experimental)
+[group('System')]
+powerwash:
+    #!/usr/bin/bash
+    FIRST_CONFIRMATION=$(gum choose --header='Warning: This is an experimental feature that will reset this device to its factory state.' "No" "Yes - wipe this machine")
+    if [[ "$FIRST_CONFIRMATION" != "Yes - wipe this machine" ]]; then
+        echo "Powerwash cancelled."
+        exit 0
+    fi
+    SECOND_CONFIRMATION=$(gum choose --header='Are you sure?' "No" "Yes - wipe this machine")
+    if [[ "$SECOND_CONFIRMATION" != "Yes - wipe this machine" ]]; then
+        echo "Powerwash cancelled."
+        exit 0
+    fi
+    sudo bootc install reset --experimental
--- a/system_files/shared/usr/share/ublue-os/just/update.just
+++ b/system_files/shared/usr/share/ublue-os/just/update.just
@ -0,0 +1,64 @@
+# vim: set ft=make :
+
+alias upgrade := update
+
+# Update system, flatpaks and homebrew packages all at once
+update:
+    #!/usr/bin/bash
+    if systemctl cat -- uupd.timer &> /dev/null; then
+        SERVICE="uupd.service"
+    else
+        SERVICE="rpm-ostreed-automatic.service"
+    fi
+    if systemctl is-active --quiet "$SERVICE"; then
+        echo "automatic updates are currently running, use \`journalctl -fexu $SERVICE\` to see logs"
+        exit 1
+    fi
+    if command -v rpm-ostree >/dev/null 2>&1 && [ -f /etc/rpm-ostreed.conf ] && grep -q -E -e "^[[:space:]]*LockLayering[[:space:]]*=[[:space:]]*true([[:space:]]*(#.*)?)?$" /etc/rpm-ostreed.conf ; then
+        sudo bootc upgrade
+    else
+        rpm-ostree upgrade
+    fi
+    # rpm-ostree used due to bootc upgrade not supporting local layered packages
+    # Updates system Flatpaks
+    if flatpak remotes | grep -q system; then
+        flatpak update -y
+    fi
+    # Update user Flatpaks
+    if flatpak remotes | grep -q user; then
+        flatpak update --user -y
+    fi
+    # Guard Brew if the user does not own brew/doesn't exist
+    if [[ -O /var/home/linuxbrew/.linuxbrew/bin/brew ]]; then
+        # Upgrade will run brew update if needed
+        /var/home/linuxbrew/.linuxbrew/bin/brew upgrade -y
+    fi
+
+alias auto-update := toggle-updates
+
+# Turn automatic updates on or off
+toggle-updates ACTION="prompt":
+    #!/usr/bin/bash
+    CURRENT_STATE="disabled"
+    if systemctl is-enabled -q rpm-ostreed-automatic.timer; then
+        CURRENT_STATE="enabled"
+    elif systemctl is-enabled -q uupd.timer; then
+        CURRENT_STATE="enabled"
+    fi
+
+    echo "Automatic updates are currently ${CURRENT_STATE}"
+    SELECTED_OPTION="$(gum choose --header="Toggle automatic updates?" "Enable" "Disable" "Cancel")"
+    [[ "${SELECTED_OPTION}" == "Cancel" || "${SELECTED_OPTION}" == "" ]] && exit 0
+
+    if systemctl cat -- uupd.timer &> /dev/null; then
+        TIMER="uupd.timer"
+    else
+        TIMER="rpm-ostreed-automatic.timer"
+    fi
+    if [ "${SELECTED_OPTION}" == "Enable" ] ; then
+        sudo systemctl enable "$TIMER"
+        echo "Updates have been enabled"
+    elif [ "${SELECTED_OPTION}" == "Disable" ] ; then
+        sudo systemctl disable "$TIMER"
+        echo "Updates have been disabled"
+    fi
				`@ -1 +0,0 @@`
				`Subproject commit 81fae1734f0d909e6d8b3d6d3695cbaf1f7ed1f2`