fll-live-boot (20260718.1) unstable; urgency=medium

  * fll.initramfs: key the persist COW dir by image_file (stable across
    rebuilds) instead of rootfs_uuid (random per build), so an upgrade
    can carry /etc forward into the same per-flavour dir.
  * fll_sshd: run only on the first pristine boot, gated on absence of
    the host key. Host keys and authorized_keys now persist via /etc, so
    enable sshd to autostart on later boots instead of regenerating host
    keys (slow on early boot) every time.
  * fll.initramfs: stop editing /etc/calamares at boot (pyfll now bakes
    it at build). Boot-time edits copied it into the persist overlay,
    where a stale copy shadowed an upgraded ISO's config.
  * fll_locales: make calamares geoip/guessLayout track the current boot
    (add when no lang=, remove when given) instead of a one-way append
    that persisted stale on persist media.
  * fll_desktop: set gdm3 WaylandEnable and sddm DisplayServer to match
    the booted session type both ways, not one-way toward x11 (persist
    kept a stale x11 setting for a later wayland boot).
  * fll_home: stop seeding root's dotfiles and .hushlogin at boot; bash
    completion is now enabled system-wide and .hushlogin created at
    build by pyfll.
  * fll_session_passwordless: disable KWallet for the passwordless
    plasma user. With no login password the wallet cannot be unlocked,
    so apps such as Chromium would otherwise stall on the wallet setup
    wizard.
  * fll_session_passwordless: apply the plasma passwordless tweaks
    (KWallet disable, screen-lock relaxation) to any *plasma* session,
    e.g. kodi-plasma-toggle.

 -- Kel Modderman <kelvmod@gmail.com>  Sat, 18 Jul 2026 19:22:15 +1000

fll-live-boot (20260715.1) unstable; urgency=medium

  * fll_sshd: new fll-live-initscripts oneshot providing non-root SSH
    access on the live media. Gated (ConditionPathExists) on a public
    key baked to /var/lib/fll/ssh_authorized_keys by pyfll's
    ssh_authorized_keys option; it installs the key as the live user's
    authorized_keys (0700/0600) and starts the otherwise-disabled sshd.
    Root stays out of scope.
  * fll-live-initscripts.postrm: on remove/purge, clean up the pyfll-
    baked /var/lib/fll/ssh_authorized_keys (and /var/lib/fll if empty) -
    it isn't dpkg-shipped, so dpkg won't remove it (matters when fll-
    live-initscripts is purged on a Calamares install).

 -- Kel Modderman <kelvmod@gmail.com>  Wed, 15 Jul 2026 18:09:12 +1000

fll-live-boot (20260714.1) unstable; urgency=medium

  * fll_desktop: host gtkgreet in cage alone. The greeter host
    compositor is independent of the launched session, so one kiosk host
    serves every spin; drops the sway fallback and its generated config.
  * fll_desktop: prefer any <session>-uwsm.desktop for the display
    manager session, not only hyprland/sway/labwc, so cage kiosk and
    future uwsm-managed sessions need no change here.
  * fll_locales: when comparing the country and language codes of LANG
    normalise case.
  * dracut/fll.conf: install to correct location allowing dracut to pick
    it up properly.
  * fll_desktop: prevent an invalid/unmatched desktop= cheatcode from
    aborting live user creation and falling back to defaults.
  * fll_login: correctly localise prompt.
  * fll.initramfs: append keyscript=/bin/cat to calamares'
    crypttabOptions only on initramfs-tools media, matching Calamares'
    own LUKS docs (dracut needs no such option)
  * extend Makefile LINT coverage to fll.initramfs, both fll.shutdown
    files, the initramfs-tools hook/script and the dracut module script;
    fix a type->command -v bashism this exposed in fll.initramfs;
    annotate fll_homectl's intentional STORAGE_ARGS word-split
  * fll.initramfs: fix fll_say printf-format misuse, force mkdir modes
    with chmod (mkdir -p -m is a no-op on an existing dir), add -p and
    failure messages to toram mkdir, capture LUKS unlock status
    explicitly, and validate username=/hostname= cheatcodes before use;
    fix the same jq string-interpolation bug in fll_homectl and
    fll_login (use jq --arg)
  * dracut fll.sh: set FLL_RC=0 directly instead of an indirect $?
    capture, ln -sf for idempotency; parameterize stop_debug_log's mount
    point in both the dracut and initramfs-tools copies so they stay
    byte-identical
  * fll_desktop: fix gdm3 sed injecting a stray whitespace/tab line into
    daemon.conf, quote the fragile greetd sed, which->command -v (also
    fll_login); fll_homectl: handle active state in the already-exists
    branch instead of falling through to homectl create
  * utils/Makefile: drop dead LIBS_BLKID/USE_LIBPIPELINE machinery
    (unused in the C source), CXXFLAGS from C compile/link rules,
    LDFLAGS from the compile-only rule; add .PHONY
  * fll-live-initscripts: depend on sudo, genuinely used (as -u) by
    fll_session_passwordless
  * drop libblkid-dev build-dep: fll_blockdev_detect.c never used it
    (blkid usages elsewhere are the util-linux command, not the library)
  * fll-live-initscripts.postrm: drop the dead rm -f /etc/default/fll-
    locales, nothing creates that file anymore
  * fll-snakeoil-cert.service: drop a trailing blank line
  * unify chrooted() across all four maintainer scripts to the already-
    fixed variant (container= env var check); distro-defaults.postinst
    and fll-live-initscripts-networkd-dummy.postinst still had the older
    version that missed nspawn --as-pid2 builds, fixed elsewhere in
    8d69b232 but never propagated here
  * fll_desktop: make the greetd default_session rewrite idempotent -
    anchor the sed to the first command line so a second run on persist
    media no longer overwrites the appended [initial_session] autologin
    command with the greeter command.
  * fll.initramfs: on every live-media setup failure, tear down all
    mounts and the LUKS mapper we opened (generalised
    fll_cleanup_mounts). Previously the readonly-rootfs, overlay and
    @home-bind failure exits left mounts behind, and the persist-btrfs
    failure exit left the unlocked fll-persist mapper open - leaked
    state that stalled boot to the media-detection timeout or blocked a
    retry.

 -- Kel Modderman <kelvmod@gmail.com>  Tue, 14 Jul 2026 20:15:02 +1000

fll-live-boot (20260713.1) unstable; urgency=medium

  * fll_desktop: stop masking hypridle for the passwordless live user.
    hypridle's lock_cmd now self-guards on /run/fll/passwordless (in
    aptosid-settings-hyprland), so idle still powers the display off but
    never locks a user who cannot unlock.
  * fll_desktop: fall back to greetd's built-in agreety greeter when
    tuigreet is not installed. Use the full /usr/sbin/agreety path,
    since greetd runs the greeter through /bin/sh whose PATH omits
    /usr/sbin.
  * fll_desktop: add gtkgreet as a greetd greeter, hosted in cage or
    sway, ahead of tuigreet. Falls back to tuigreet, then agreety.

 -- Kel Modderman <kelvmod@gmail.com>  Mon, 13 Jul 2026 07:31:13 +1000

fll-live-boot (20260711.1) unstable; urgency=medium

  * fll-live-initramfs, fll-live-initscripts: fix the preinst chroot
    guard for pyfll builds. pyfll now builds with systemd-nspawn --as-
    pid2, where PID 1 lives inside the container and shares its root, so
    the classic chroot test no longer fires and installation was wrongly
    aborted. Detect the container via the $container env var nspawn
    exports, and always fall back to systemd-detect-virt.
  * fll_desktop: add Miriway as an LXQt Wayland compositor option.
  * fll_desktop: seed the live keyboard layout, aptosid wallpaper and
    cursor into the labwc, sway, wayfire and hyprland LXQt Wayland
    sessions, instead of relying on lxqt-wayland-session's $LANG-based
    guess and LXQt defaults.

 -- Kel Modderman <kelvmod@gmail.com>  Sat, 11 Jul 2026 12:39:51 +1000

fll-live-boot (20260709.1) unstable; urgency=medium

  * fll_desktop: the lxqt-wayland session runs labwc with -C
    ~/.config/labwc, so labwc never reads /etc/xdg/labwc/environment and
    the Bibata mouse cursor was lost. Seed ~/.config/labwc/environment
    from lxqt's session.conf [Mouse] section (XCURSOR_THEME,
    XCURSOR_SIZE) so the cursor matches the rest of the desktop.

 -- Kel Modderman <kelvmod@gmail.com>  Thu, 09 Jul 2026 22:10:39 +1000

fll-live-boot (20260708.1) unstable; urgency=medium

  * fll_desktop: drop the untested agreety, wlgreet and gtkgreet greetd
    greeters. tuigreet now handles all greetd sessions, including labwc.
  * fll_desktop: launch the Sway and labwc live sessions through uwsm
    (via aptosid-settings-{sway,labwc}'s *-uwsm.desktop files) as
    already done for Hyprland, so session-wide /etc/environment.d and
    /etc/xdg/uwsm/env variables -- notably the Qt kvantum dark style --
    reach the compositor. Generalised the greetd command and the
    display-manager session selection accordingly.

 -- Kel Modderman <kelvmod@gmail.com>  Wed, 08 Jul 2026 12:15:09 +1000

fll-live-boot (20260705.1) unstable; urgency=medium

  * fll_home: publish /run/fll/passwordless for the passwordless (non-homed)
    live user - the single marker session scripts read to relax lock/idle.
  * fll_desktop: mask hypridle.service when that marker is present, so the
    passwordless user's Hyprland session does not idle-lock behind hyprlock.
  * Deploy the 90-fll.rules passwordless polkit grant to /run only for the
    passwordless (non-homed) user, rather than shipping it active for every
    sudo-group member (which covered passworded homed users too).
  * Move the passwordless-user screen-lock relaxations (cinnamon, gnome, budgie,
    plasma, xfce, and now mate) out of fll_adduser into
    fll_session_passwordless, gated on the /run/fll/passwordless marker.
  * Inhibit auto-suspend for any live session (fll_inhibit_suspend via XDG
    autostart, gated on /run/fll), so it does not suspend mid-install.
  * fll_desktop: strip the .desktop suffix when writing Calamares'
    desktopFile, so the installer finds the session file instead of
    searching for <name>.desktop.desktop.

 -- Kel Modderman <kelvmod@gmail.com>  Sun, 05 Jul 2026 13:56:52 +1000

fll-live-boot (20260704.1) unstable; urgency=medium

  * fll_desktop: write the Hyprland uwsm keyboard drop-in via the shared
    aptosid-settings-hyprland keyboard-env helper instead of inlining it, so
    the live media and the calamares post-install path use identical logic.

 -- Kel Modderman <kelvmod@gmail.com>  Sat, 04 Jul 2026 12:40:38 +1000

fll-live-boot (20260703.1) unstable; urgency=medium

  * fll_desktop: adapt hyprland setup to the Lua config required since
    Hyprland 0.55. Launch Hyprland as a uwsm-managed systemd session: the
    greetd session runs "uwsm start hyprland.desktop", and sddm/gdm3/lightdm
    are pointed at the hyprland-uwsm.desktop session (falling back to plain
    hyprland when the hyprland package does not provide it). Stop seeding
    /etc/skel for Hyprland: it now reads its default config from
    /etc/xdg/hypr, and the live keyboard layout is passed via XKB_DEFAULT_* in
    a /etc/xdg/uwsm/env-hyprland.d drop-in instead of being sed'd into the
    config.

 -- Kel Modderman <kelvmod@gmail.com>  Fri, 03 Jul 2026 20:54:19 +1000

fll-live-boot (20260630.1) unstable; urgency=medium

  * refind can't unlock an encrypted /boot, so hide calamares encryption.

 -- Kel Modderman <kelvmod@gmail.com>  Tue, 30 Jun 2026 13:03:56 +1000

fll-live-boot (20260624.1) unstable; urgency=medium

  * Enlarge the calamares EFI System Partition to 1GiB for systemd-boot
    installs, which store kernels and initrds on the ESP (BLS); grub and
    refind keep the calamares default.

 -- Kel Modderman <kelvmod@gmail.com>  Wed, 24 Jun 2026 22:40:03 +1000

fll-live-boot (20260623.2) unstable; urgency=medium

  * restrict dh_fixperms override for arch-indep (fails for --binary-arch
    builds).

 -- Stefan Lippers-Hollmann <s.l-h@gmx.de>  Tue, 23 Jun 2026 20:32:31 +0200

fll-live-boot (20260623.1) unstable; urgency=medium

  * Merge the fll-live-initramfs and fll-live-initscripts source packages into
    a single source package, fll-live-boot. The two were intrinsically coupled:
    the fll-live-utils binary package (fll_blockdev_detect and fll_login) was
    built by fll-live-initscripts but consumed only by fll-live-initramfs. The
    same set of binary packages is still produced (distro-defaults,
    fll-live-initramfs, fll-live-initscripts,
    fll-live-initscripts-networkd-dummy and fll-live-utils), so installations
    are unaffected.
  * Source tree reorganised into initramfs/, initscripts/ and utils/ subtrees.
  * fll-live-initramfs: depend on fll-live-utils explicitly. It bakes
    fll_blockdev_detect into the generated initramfs and rewrites the live
    getty to call fll_login, but previously relied on fll-live-initscripts to
    pull fll-live-utils in.
  * fll-live-initscripts: drop the dependency on fll-live-utils. None of its
    own scripts use fll_blockdev_detect or fll_login; the dependency now lives
    on fll-live-initramfs where those binaries are actually consumed.
  * fll-live-utils: install fll_login and fll_blockdev_detect to
    /usr/libexec/fll/ instead of /usr/bin; they are internal helpers, not user
    commands. The live getty ExecStart in fll.initramfs is updated for
    fll_login, and the initramfs-tools and dracut hooks are updated to copy
    fll_blockdev_detect from its new location (it still lands at /usr/bin
    inside the initramfs, where the boot scripts call it by name).
  * Drop the fll_blockdev_detect and fll_login manpages, and with them the
    asciidoc-base, docbook, docbook-xml, docbook-xsl, xsltproc and libxml2-utils
    build dependencies. Both are internal helpers only ever run from the
    initramfs.
  * distro-defaults and fll-live-initscripts-networkd-dummy: make the
    chrooted() build-environment guard nspawn-aware (matching the preinst), so
    their postinst configuration also runs inside systemd-nspawn containers and
    not just bind-mount chroots.
  * Remove a stale "dh_installsystemd --name=fll-live" call from debian/rules;
    that unit was purged long ago, leaving the call a no-op.

 -- Kel Modderman <kelvmod@gmail.com>  Tue, 23 Jun 2026 12:21:11 +1000
