---
# yaml-language-server: $schema=https://schema.blue-build.org/module-list-v1.json
modules:
  - type: signing
  - type: files
    files:
      - source: base
        destination: /
  - type: systemd
    system:
      masked:
        - rpm-ostreed-automatic.timer
      enabled:
        - bootc-fetch-apply-updates.timer

  - type: justfiles
    source: ghcr.io/blue-build/modules:pr-498
    validate: true
    install: true
    include:
      - 30-secureboot.just

  - type: dnf
    repos:
      cleanup: true
      nonfree: negativo17
    install:
      skip-unavailable: true
      packages:
        - bootc
        - fedora-repos-archive
        - zstd
        - sbsign
        - alsa-firmware
        - apr
        - apr-util
        - distrobox
        - fdk-aac
        - ffmpeg
        - ffmpeg-libs
        - ffmpegthumbnailer
        - flatpak-spawn
        - fuse
        - fzf
        - grub2-tools-extra
        - google-noto-sans-balinese-fonts
        - google-noto-sans-cjk-fonts
        - google-noto-sans-javanese-fonts
        - google-noto-sans-sundanese-fonts
        - heif-pixbuf-loader
        - htop
        - intel-vaapi-driver
        - just
        - libavcodec
        - libcamera
        - libcamera-tools
        - libcamera-gstreamer
        - libcamera-ipa
        - libfdk-aac
        - libheif
        - libimobiledevice-utils
        - libratbag-ratbagd
        - libva-utils
        - lshw
        - mesa-libxatracker
        - net-tools
        - nvme-cli
        - nvtop
        - openrgb-udev-rules
        - openssl
        - oversteer-udev
        - pam-u2f
        - pam_yubico
        - pamu2fcfg
        - pipewire-libs-extra
        - pipewire-plugin-libcamera
        - powerstat
        - smartmontools
        - solaar-udev
        - squashfs-tools
        - symlinks
        - tcpdump
        - tmux
        - traceroute
        - usbmuxd
        - vim
        - wireguard-tools
        - wl-clipboard
        - xhost
        - xorg-x11-xauth
        - yubikey-manager
        - intel-gmmlib
        - libva-intel-media-driver
        - openssh-askpass
      exclude:
        - google-noto-sans-cjk-vf-fonts
        - default-fonts-cjk-sans
    remove:
      auto-remove: false
      packages:
        - fedora-flathub-remote
    replace:
      # mitigate upstream packaging bug: https://bugzilla.redhat.com/show_bug.cgi?id=2332429
      # swap the incorrectly installed OpenCL-ICD-Loader for ocl-icd, the expected package
      - from-repo: fedora
        install-weak-deps: false
        packages:
          - new: ocl-icd
            old: OpenCL-ICD-Loader

      # use override to replace mesa and others with less crippled versions
      - from-repo: fedora-multimedia
        install-weak-deps: false
        packages:
          - libva
          - intel-vpl-gpu-rt
          - intel-mediasdk
          - mesa-dri-drivers
          - mesa-filesystem
          - mesa-libEGL
          - mesa-libGL
          - mesa-libgbm
          - mesa-va-drivers
          - mesa-vulkan-drivers


  - type: script
    env:
      CSFG: /usr/lib/systemd/system-generators/coreos-sulogin-force-generator
    snippets:
      # Lock the drivers and kernel versions
      - dnf5 versionlock add kernel kernel-core kernel-modules kernel-modules-core kernel-modules-extra libva intel-gmmlib intel-vpl-gpu-rt intel-mediasdk libva-intel-media-driver mesa-dri-drivers mesa-filesystem mesa-libEGL mesa-libGL mesa-libgbm mesa-va-drivers mesa-vulkan-drivers

      # use CoreOS' generator for emergency/rescue boot
      # see detail: https://github.com/ublue-os/main/issues/653
      - curl -sSLo ${CSFG} https://raw.githubusercontent.com/coreos/fedora-coreos-config/refs/heads/stable/overlay.d/05core/usr/lib/systemd/system-generators/coreos-sulogin-force-generator
      - chmod +x ${CSFG}

      # Add SUDO_ASKPASS as a global environment
      - echo "SUDO_ASKPASS=/usr/libexec/openssh/ssh-askpass" >> /etc/environment