tunaos.toml

# TunaOS primary configuration. Matrix ownership migration, phase 1.
# Edit this file; .github/build-config.yml is generated at setup.
# Package and branding migration: docs/PRIMARY-CONFIG-MIGRATION.md.

schema_version = 1

[build]
global_platforms = ["linux/amd64", "linux/arm64"]

# ── Grouped dedup ISOs (issue #455) ───────────────────────────────────────────
# Per-desktop-per-flavor ISOs are wasteful: all desktops on a variant share the
# same Enterprise-Linux base, so tacklebox `shared_store.dedup` packs several
# bootable environments into ONE combined squashfs (~80%+ dedup; an extra
# desktop adds ~300 MB rather than a whole new ISO). Each group below becomes a
# single ISO named `<variant>[-<suffix>].iso` whose systemd-boot menu lists
# every environment by title.
#
# `scripts/build-iso-group.sh` intersects each group's `flavors` with the
# variant's actual `build_image: true` flavors, so a variant that lacks a
# Variants that lack certain desktops simply get a smaller ISO — no group
# needs per-variant tailoring here.
[[iso_groups]]
# Desktop ISO group: boots GNOME NVIDIA by default, and embeds
# both NVIDIA and non-NVIDIA flavors in the offline store for installer auto-detection.
# Published as `<variant>.iso`.
suffix = ""
flavors = ["gnome-nvidia", "gnome-nvidia-hwe"]
offline_flavors = ["gnome", "gnome-hwe", "gnome-nvidia", "gnome-nvidia-hwe"]

[[iso_groups]]
# ONE ISO PER BASE+DESKTOP, each embedding its own NVIDIA and HWE flavors —
# the same shape as the GNOME group above, applied to the other four
# desktops. Published as `<variant>-<suffix>.iso`.
#
# This replaces a single `community` group that packed KDE, COSMIC, Niri and
# XFCE into ONE ISO and carried `publish: false`, on the reasoning that the
# browser ISO Builder covers the long tail on demand so a five-flavor
# offline store was not worth the storage. The cost argument was sound; the
# conclusion was not. A user who wants KDE should get a KDE ISO, not a
# four-desktop ISO or a browser build step, and one desktop's offline store
# is a fraction of four.
#
# Storage does not grow the way the old comment implied either: these are
# DEDUPLICATED groups over a shared squashfs, so a per-desktop ISO carries
# its own desktop plus the base layers it already shares with every other
# ISO of the same variant.
suffix = "kde"
flavors = ["kde-nvidia"]
offline_flavors = ["kde", "kde-hwe", "kde-nvidia"]

[[iso_groups]]
suffix = "cosmic"
flavors = ["cosmic-nvidia"]
offline_flavors = ["cosmic", "cosmic-hwe", "cosmic-nvidia"]

[[iso_groups]]
suffix = "niri"
flavors = ["niri-nvidia"]
offline_flavors = ["niri", "niri-hwe", "niri-nvidia"]

[[iso_groups]]
suffix = "xfce"
flavors = ["xfce-nvidia"]
offline_flavors = ["xfce", "xfce-hwe", "xfce-nvidia"]

# ── Sibling images ─────────────────────────────────────────────────────────
# TunaOS-family bootc images built in their OWN repositories with BuildStream
# on freedesktop-sdk. They are whole-OS products, not package sources, and
# they never enter the variant matrix below or green-criteria.yml: each repo
# runs its own build, live-ISO, plain-install and LUKS-install checks.
# .github/scripts/sibling-images-status.sh renders their latest main-branch
# build into the README next to the variant matrix so the family is visible
# in one place. `workflow` is the repo's SCHEDULED build workflow.
[[sibling_images]]
id = "tromso"
emoji = "🏔️"
description = "Tromsø: KDE Plasma 6 on freedesktop-sdk (BuildStream)"
image = "ghcr.io/tuna-os/tromso"
repo = "tuna-os/tromso"
workflow = "build-tromso-multirunner.yml"
desktops = ["KDE"]

[[sibling_images]]
id = "xfce-linux"
emoji = "🐭"
description = "XFCE Linux: XFCE Wayland on freedesktop-sdk (BuildStream)"
image = "ghcr.io/tuna-os/xfce-linux"
repo = "tuna-os/xfce-linux"
workflow = "build-multirunner.yml"
desktops = ["XFCE"]

# ── Tuna Desktop rollout ─────────────────────────────────────────────────────
# tuna-os/tuna-desktop ADR 0008: every variant gets a `tuna` flavor, or is
# recorded here as unsupported with its reason; a variant is never silently
# left out. `package_target` is the TunaOS factory target
# (tuna-os/tunaos-packages manifests/package-factory.yaml) that must publish
# tuna-desktop and the session's missing pieces for that base. `admitted`
# variants carry a `tuna` flavor below; `unsupported` ones must not until
# the reason is resolved. tests/test_tuna_admission.py enforces both.
# Per-variant evidence: tunaOS issues #3195-#3207 and tunaOS#2990 (marlin).
[tuna_rollout]

[tuna_rollout.marlin]
status = "admitted"
package_target = "arch"

[tuna_rollout.yellowfin]
status = "admitted"
package_target = "el10"

[tuna_rollout.albacore]
status = "admitted"
package_target = "el10"

[tuna_rollout.skipjack]
status = "admitted"
package_target = "el10"

[tuna_rollout.bonito]
status = "admitted"
package_target = "fedora"

[tuna_rollout.wahoo]
status = "admitted"
package_target = "eln"

[tuna_rollout.bonito-rawhide]
status = "admitted"
package_target = "rawhide"

[tuna_rollout.hummingbird]
status = "unsupported"
package_target = "hummingbird"
reason = "unsupported until package target hummingbird publishes tuna-desktop (tunaos-packages#832)"

[tuna_rollout.sailfin]
status = "admitted"
package_target = "opensuse"

[tuna_rollout.gurnard]
status = "unsupported"
package_target = "noble"
reason = "unsupported until package target noble publishes tuna-desktop (tunaos-packages#834), which waits for Ubuntu to publish rustc >= 1.92 for noble (gtk4-rs 0.11 needs it; noble's newest is rustc-1.91); the factory vendors no toolchain"

[tuna_rollout.grouper]
status = "admitted"
package_target = "ubuntu"
# The apt variants run dbus-daemon as the session bus, where activating the
# GNOME portal before the graphical session starts hangs instead of failing
# fast, and beta.1 then never starts graphical-session.target. Their portal
# check is blocked on the tuna-desktop session-start fix until a release
# ships it; the per-variant results are on tuna-desktop#577.
portals = "blocked on tuna-desktop session-start fix"

[tuna_rollout.flounder]
status = "admitted"
package_target = "trixie"
portals = "blocked on tuna-desktop session-start fix"

[tuna_rollout.flounder-sid]
status = "admitted"
package_target = "debian"
portals = "blocked on tuna-desktop session-start fix"

[tuna_rollout.guppy]
status = "unsupported"
package_target = "gentoo"
reason = "unsupported until package target gentoo publishes tuna-desktop (tunaos-packages#838)"

# Build stages (for reference — enforced by the workflow job graph):
#
#   Stage 1:  base
#                ├── Stage 2: base-hwe, base-nvidia
#                └── Stage 2: gnome, kde, niri
#                                ├── Stage 3: gnome-hwe, kde-hwe, niri-hwe   (layer on base-hwe)
#                                └── Stage 3: gnome-nvidia, kde-nvidia, niri-nvidia   (layer on base-nvidia)
#                                                └── Stage 4: gnome-nvidia-hwe  (layer on gnome-hwe)
#
# The `stage` field on each flavor tells generate_matrix which job matrix it belongs to:
#   stage: 1  → build_base      (no dependencies)
#   stage: 2  → build_stage2    (needs: build_base)
#   stage: 3  → build_stage3    (needs: build_stage2)
#   stage: 4  → build_stage4    (needs: build_stage3)
[variants]

[variants.yellowfin]
emoji = "🐠"
description = "Based on AlmaLinux Kitten 10"
base_image = "quay.io/almalinuxorg/almalinux-bootc:10-kitten@sha256:fabe22d605a5638cb1fbf2df38d6d9b9ace35f15cb1c10c7db87d475a039d58a"
# Friendly alias: same digest also published as ghcr.io/tuna-os/<alias>:<flavor>
aliases = ["almalinux-kitten"]
platforms = ["linux/amd64", "linux/amd64/v2", "linux/arm64"]

[[variants.yellowfin.flavors]]
# ── Stage 1 ────────────────────────────────────────────────────────────
id = "base"
stage = 1
build_image = true
build_iso = false
build_qcow2 = false

[[variants.yellowfin.flavors]]
# ── Stage 2 ────────────────────────────────────────────────────────────
id = "base-hwe"
stage = 2
build_image = true
build_iso = false
build_qcow2 = false

[[variants.yellowfin.flavors]]
id = "base-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 2
build_image = true
build_iso = false
build_qcow2 = false

[[variants.yellowfin.flavors]]
# Tuna Desktop (tuna_rollout above, tunaOS#3195): el10 package target.
# amd64 only: gtkgreet is published for EL10 x86_64 only, and the
# boot gate and session qualification run on amd64.
id = "tuna"
stage = 2
platforms = ["linux/amd64"]
build_image = true
build_iso = false
build_qcow2 = false
luks_e2e = false

[[variants.yellowfin.flavors]]
id = "gnome"
# GNOME 50 on EL10 comes from the tunaos-packages tier at
# repo.tunaos.org/gnome50/10-stream-x86_64 (manifests/desktops/
# gnome.yaml), which publishes x86_64 only (the aarch64 path 404s,
# 2026-09-03). The floor is GNOME 50 (gnome.yaml minimum_version), so
# an arm64 leg would be the base's 49 -- not allowed to ship -- and is
# not declared. Re-add linux/arm64 here the day the tier grows an
# aarch64 index, and delete the variant from
# tests/test_el10_gnome_comes_from_the_github_built_tier.py's pin set
# in the same change. Same shape as xfce below.
platforms = ["linux/amd64", "linux/amd64/v2"]
stage = 2
build_image = true
build_iso = true
build_qcow2 = true

[[variants.yellowfin.flavors]]
id = "cosmic"
# COSMIC on EL10 comes from the Tideforge tier at
# repo.tunaos.org/repo/10-stream-x86_64 (manifests/desktops/
# cosmic.yaml), which publishes x86_64 only -- same shape as xfce.
platforms = ["linux/amd64"]
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.yellowfin.flavors]]
id = "kde"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.yellowfin.flavors]]
id = "niri"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.yellowfin.flavors]]
id = "xfce"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false
# tunaOS xfce-wayland stack comes from repo.tunaos.org, which only
# publishes EL10 x86_64 packages — no aarch64 until the repo grows one.
platforms = ["linux/amd64", "linux/amd64/v2"]

[[variants.yellowfin.flavors]]
# ── Stage 3 ────────────────────────────────────────────────────────────
# HWE: no ISO — install the standard ISO then `bootc switch` to *-hwe
id = "gnome-hwe"
# Layers on gnome, which is amd64-only while the GNOME 50 tier has
# no aarch64 index (see gnome above).
platforms = ["linux/amd64", "linux/amd64/v2"]
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.yellowfin.flavors]]
# Apple Silicon (M1/M2, Asahi Linux) — overlay/asahi.sh, CentOS
# Hyperscale SIG packages-asahi (EXPERIMENTAL: kernel + glue only; boot
# payloads pending #777). aarch64 only; no ISO (asahi-installer path).
id = "gnome-asahi"
stage = 3
platforms = ["linux/arm64"]
# Off while gnome is amd64-only: this is the arm64 leg of gnome, and
# the GNOME 50 tier has no aarch64 index yet (see gnome above). Turn
# back on with the arm64 platform there.
build_image = false
build_iso = false
build_qcow2 = false

[[variants.yellowfin.flavors]]
id = "gnome-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.yellowfin.flavors]]
id = "gnome-nvidia-hwe"
# NOT built: this cell cannot mount its own root. See tunaOS#2518.
#
# It builds, signs and passes its desktop contract, then boots into an
# emergency shell:
#
#   mount: /sysroot: unknown filesystem type 'xfs'
#   Dependency failed for ostree-prepare-root.service
#
# `-hwe` selects the coreos-stable akmods bundle
# (scripts/build-image-inner.sh), so 10-kernel-swap.sh installs THAT
# bundle's kernel -- Fedora 43's -- into an EL10 userspace whose dracut
# is dracut-107-8.el10. That dracut leaves xfs out of the initramfs and
# says nothing about it. The non-HWE nvidia cells take 6.12.0-266.el10
# from the centos-10 bundle and boot, which is why only this
# combination is red, on all three EL10 variants at once.
#
# There is no EL10 HWE akmods bundle to switch to: the tag list on
# ghcr.io/ublue-os/akmods-nvidia-open stops at centos-10.
#
# Naming the filesystems in the dracut rebuild was tried and reverted
# (tunaOS#2517): `--filesystems` is strict, EL10 has no btrfs, and it
# broke every EL10 *-nvidia cell to repair this one.
#
# Re-declare the day an EL10 HWE bundle ships, or the day the fc43
# module tree is readable by EL10's dracut. The x86_64-only note below
# still applies when it comes back.
#
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 4
build_image = false
build_iso = false
build_qcow2 = false

[[variants.yellowfin.flavors]]
id = "cosmic-hwe"
# Layers on cosmic, which is amd64-only while the Tideforge COSMIC
# tier has no aarch64 index (see cosmic above).
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.yellowfin.flavors]]
id = "cosmic-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.yellowfin.flavors]]
id = "kde-hwe"
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.yellowfin.flavors]]
id = "kde-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.yellowfin.flavors]]
id = "niri-hwe"
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.yellowfin.flavors]]
id = "niri-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.yellowfin.flavors]]
id = "xfce-hwe"
stage = 3
build_image = true
build_iso = false
build_qcow2 = false
# tunaOS xfce-wayland stack comes from repo.tunaos.org, which only
# publishes EL10 x86_64 packages — no aarch64 until the repo grows one.
platforms = ["linux/amd64", "linux/amd64/v2"]

[[variants.yellowfin.flavors]]
id = "xfce-nvidia"
stage = 3
build_image = true
build_iso = true
build_qcow2 = false
# x86_64 only. The xfce-wayland repo constraint (no aarch64) applied
# already; the nvidia overlay narrows further — no amd64/v2, because
# Kitten v2 kernels are ARCH=x86_64_v2 and the akmods kmods are
# x86_64 builds, so the exact-EVR kmod install can never match there
# (overrides/nvidia/10-kernel-swap.sh hard-fails off x86_64).
platforms = ["linux/amd64"]

[variants.albacore]
emoji = "🐟"
description = "Based on AlmaLinux 10"
base_image = "quay.io/almalinuxorg/almalinux-bootc:10@sha256:f6d1c4c77d50fa52408550a16203aca6e3cf3eda623afbd16413dfa344e0cad0"
# Friendly alias: same digest also published as ghcr.io/tuna-os/<alias>:<flavor>
aliases = ["almalinux"]
platforms = ["linux/amd64", "linux/amd64/v2", "linux/arm64"]

[[variants.albacore.flavors]]
# ── Stage 1 ────────────────────────────────────────────────────────────
id = "base"
stage = 1
build_image = true
build_iso = false
build_qcow2 = false

[[variants.albacore.flavors]]
# ── Stage 2 ────────────────────────────────────────────────────────────
id = "base-hwe"
stage = 2
build_image = true
build_iso = false
build_qcow2 = false

[[variants.albacore.flavors]]
id = "base-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 2
build_image = true
build_iso = false
build_qcow2 = false

[[variants.albacore.flavors]]
# Tuna Desktop (tuna_rollout above, tunaOS#3196): el10 package target.
# amd64 only: gtkgreet is published for EL10 x86_64 only, and the
# boot gate and session qualification run on amd64.
id = "tuna"
stage = 2
platforms = ["linux/amd64"]
build_image = true
build_iso = false
build_qcow2 = false
luks_e2e = false

[[variants.albacore.flavors]]
id = "gnome"
# GNOME 50 on EL10 comes from the tunaos-packages tier at
# repo.tunaos.org/gnome50/10-stream-x86_64 (manifests/desktops/
# gnome.yaml), which publishes x86_64 only (the aarch64 path 404s,
# 2026-09-03). The floor is GNOME 50 (gnome.yaml minimum_version), so
# an arm64 leg would be the base's 49 -- not allowed to ship -- and is
# not declared. Re-add linux/arm64 here the day the tier grows an
# aarch64 index, and delete the variant from
# tests/test_el10_gnome_comes_from_the_github_built_tier.py's pin set
# in the same change. Same shape as xfce below.
platforms = ["linux/amd64", "linux/amd64/v2"]
stage = 2
build_image = true
build_iso = true
build_qcow2 = true

[[variants.albacore.flavors]]
id = "cosmic"
# COSMIC on EL10 comes from the Tideforge tier at
# repo.tunaos.org/repo/10-stream-x86_64 (manifests/desktops/
# cosmic.yaml), which publishes x86_64 only -- same shape as xfce.
platforms = ["linux/amd64"]
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.albacore.flavors]]
id = "kde"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.albacore.flavors]]
id = "niri"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.albacore.flavors]]
id = "xfce"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false
# tunaOS xfce-wayland stack comes from repo.tunaos.org, which only
# publishes EL10 x86_64 packages — no aarch64 until the repo grows one.
platforms = ["linux/amd64", "linux/amd64/v2"]

[[variants.albacore.flavors]]
# ── Stage 3 ────────────────────────────────────────────────────────────
# HWE: no ISO — install the standard ISO then `bootc switch` to *-hwe
id = "gnome-hwe"
# Layers on gnome, which is amd64-only while the GNOME 50 tier has
# no aarch64 index (see gnome above).
platforms = ["linux/amd64", "linux/amd64/v2"]
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.albacore.flavors]]
# Apple Silicon (M1/M2, Asahi Linux) — overlay/asahi.sh, CentOS
# Hyperscale SIG packages-asahi (EXPERIMENTAL: kernel + glue only; boot
# payloads pending #777). aarch64 only; no ISO (asahi-installer path).
id = "gnome-asahi"
stage = 3
platforms = ["linux/arm64"]
# Off while gnome is amd64-only: this is the arm64 leg of gnome, and
# the GNOME 50 tier has no aarch64 index yet (see gnome above). Turn
# back on with the arm64 platform there.
build_image = false
build_iso = false
build_qcow2 = false

[[variants.albacore.flavors]]
id = "gnome-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.albacore.flavors]]
id = "gnome-nvidia-hwe"
# NOT built: this cell cannot mount its own root. See tunaOS#2518.
#
# It builds, signs and passes its desktop contract, then boots into an
# emergency shell:
#
#   mount: /sysroot: unknown filesystem type 'xfs'
#   Dependency failed for ostree-prepare-root.service
#
# `-hwe` selects the coreos-stable akmods bundle
# (scripts/build-image-inner.sh), so 10-kernel-swap.sh installs THAT
# bundle's kernel -- Fedora 43's -- into an EL10 userspace whose dracut
# is dracut-107-8.el10. That dracut leaves xfs out of the initramfs and
# says nothing about it. The non-HWE nvidia cells take 6.12.0-266.el10
# from the centos-10 bundle and boot, which is why only this
# combination is red, on all three EL10 variants at once.
#
# There is no EL10 HWE akmods bundle to switch to: the tag list on
# ghcr.io/ublue-os/akmods-nvidia-open stops at centos-10.
#
# Naming the filesystems in the dracut rebuild was tried and reverted
# (tunaOS#2517): `--filesystems` is strict, EL10 has no btrfs, and it
# broke every EL10 *-nvidia cell to repair this one.
#
# Re-declare the day an EL10 HWE bundle ships, or the day the fc43
# module tree is readable by EL10's dracut. The x86_64-only note below
# still applies when it comes back.
#
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 4
build_image = false
build_iso = false
build_qcow2 = false

[[variants.albacore.flavors]]
id = "cosmic-hwe"
# Layers on cosmic, which is amd64-only while the Tideforge COSMIC
# tier has no aarch64 index (see cosmic above).
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.albacore.flavors]]
id = "cosmic-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.albacore.flavors]]
id = "kde-hwe"
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.albacore.flavors]]
id = "kde-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.albacore.flavors]]
id = "niri-hwe"
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.albacore.flavors]]
id = "niri-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.albacore.flavors]]
id = "xfce-hwe"
stage = 3
build_image = true
build_iso = false
build_qcow2 = false
# tunaOS xfce-wayland stack comes from repo.tunaos.org, which only
# publishes EL10 x86_64 packages — no aarch64 until the repo grows one.
platforms = ["linux/amd64", "linux/amd64/v2"]

[[variants.albacore.flavors]]
id = "xfce-nvidia"
stage = 3
build_image = true
build_iso = true
build_qcow2 = false
# x86_64 only. The xfce-wayland repo constraint (no aarch64) applied
# already; the nvidia overlay narrows further — no amd64/v2, because
# Kitten v2 kernels are ARCH=x86_64_v2 and the akmods kmods are
# x86_64 builds, so the exact-EVR kmod install can never match there
# (overrides/nvidia/10-kernel-swap.sh hard-fails off x86_64).
platforms = ["linux/amd64"]

[variants.skipjack]
emoji = "🍣"
description = "Based on CentOS Stream 10"
base_image = "quay.io/centos-bootc/centos-bootc:stream10@sha256:9aedf2d189b85c498697f9b83112c893b084d359268da7dd6d5d848478d260de"
# Friendly alias: same digest also published as ghcr.io/tuna-os/<alias>:<flavor>
aliases = ["centos"]
# Note: linux/amd64/v2 intentionally omitted — verify builder support before adding.
platforms = ["linux/amd64", "linux/arm64"]

[[variants.skipjack.flavors]]
# ── Stage 1 ────────────────────────────────────────────────────────────
id = "base"
stage = 1
build_image = true
build_iso = false
build_qcow2 = false

[[variants.skipjack.flavors]]
# ── Stage 2 ────────────────────────────────────────────────────────────
id = "base-hwe"
stage = 2
build_image = true
build_iso = false
build_qcow2 = false

[[variants.skipjack.flavors]]
id = "base-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 2
build_image = true
build_iso = false
build_qcow2 = false

[[variants.skipjack.flavors]]
# Tuna Desktop (tuna_rollout above, tunaOS#3197): el10 package target.
# amd64 only: gtkgreet is published for EL10 x86_64 only, and the
# boot gate and session qualification run on amd64.
id = "tuna"
stage = 2
platforms = ["linux/amd64"]
build_image = true
build_iso = false
build_qcow2 = false
luks_e2e = false

[[variants.skipjack.flavors]]
id = "gnome"
# GNOME 50 on EL10 comes from the tunaos-packages tier at
# repo.tunaos.org/gnome50/10-stream-x86_64 (manifests/desktops/
# gnome.yaml), which publishes x86_64 only (the aarch64 path 404s,
# 2026-09-03). The floor is GNOME 50 (gnome.yaml minimum_version), so
# an arm64 leg would be the base's 49 -- not allowed to ship -- and is
# not declared. Re-add linux/arm64 here the day the tier grows an
# aarch64 index, and delete the variant from
# tests/test_el10_gnome_comes_from_the_github_built_tier.py's pin set
# in the same change. Same shape as xfce below.
platforms = ["linux/amd64", "linux/amd64/v2"]
stage = 2
build_image = true
build_iso = true
build_qcow2 = true

[[variants.skipjack.flavors]]
id = "cosmic"
# COSMIC on EL10 comes from the Tideforge tier at
# repo.tunaos.org/repo/10-stream-x86_64 (manifests/desktops/
# cosmic.yaml), which publishes x86_64 only -- same shape as xfce.
platforms = ["linux/amd64"]
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.skipjack.flavors]]
id = "kde"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.skipjack.flavors]]
id = "niri"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.skipjack.flavors]]
id = "xfce"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false
# tunaOS xfce-wayland stack comes from repo.tunaos.org, which only
# publishes EL10 x86_64 packages — no aarch64 until the repo grows one.
platforms = ["linux/amd64"]

[[variants.skipjack.flavors]]
# ── Stage 3 ────────────────────────────────────────────────────────────
# HWE: no ISO — install the standard ISO then `bootc switch` to *-hwe
id = "gnome-hwe"
# Layers on gnome, which is amd64-only while the GNOME 50 tier has
# no aarch64 index (see gnome above).
platforms = ["linux/amd64", "linux/amd64/v2"]
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.skipjack.flavors]]
# Apple Silicon (M1/M2, Asahi Linux) — overlay/asahi.sh, CentOS
# Hyperscale SIG packages-asahi (EXPERIMENTAL: kernel + glue only; boot
# payloads pending #777). aarch64 only; no ISO (asahi-installer path).
id = "gnome-asahi"
stage = 3
platforms = ["linux/arm64"]
# Off while gnome is amd64-only: this is the arm64 leg of gnome, and
# the GNOME 50 tier has no aarch64 index yet (see gnome above). Turn
# back on with the arm64 platform there.
build_image = false
build_iso = false
build_qcow2 = false

[[variants.skipjack.flavors]]
id = "gnome-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.skipjack.flavors]]
# tunaOS#639 re-enabled this cell once the gnome-shell-49 vs
# gnome-shell-common-48 file conflict was fixed upstream
# (tuna-os/tunaos-packages#23). That fix held. What stops the cell now is
# unrelated and is described below.
id = "gnome-nvidia-hwe"
# NOT built: this cell cannot mount its own root. See tunaOS#2518.
#
# It builds, signs and passes its desktop contract, then boots into an
# emergency shell:
#
#   mount: /sysroot: unknown filesystem type 'xfs'
#   Dependency failed for ostree-prepare-root.service
#
# `-hwe` selects the coreos-stable akmods bundle
# (scripts/build-image-inner.sh), so 10-kernel-swap.sh installs THAT
# bundle's kernel -- Fedora 43's -- into an EL10 userspace whose dracut
# is dracut-107-8.el10. That dracut leaves xfs out of the initramfs and
# says nothing about it. The non-HWE nvidia cells take 6.12.0-266.el10
# from the centos-10 bundle and boot, which is why only this
# combination is red, on all three EL10 variants at once.
#
# There is no EL10 HWE akmods bundle to switch to: the tag list on
# ghcr.io/ublue-os/akmods-nvidia-open stops at centos-10.
#
# Naming the filesystems in the dracut rebuild was tried and reverted
# (tunaOS#2517): `--filesystems` is strict, EL10 has no btrfs, and it
# broke every EL10 *-nvidia cell to repair this one.
#
# Re-declare the day an EL10 HWE bundle ships, or the day the fc43
# module tree is readable by EL10's dracut. The x86_64-only note below
# still applies when it comes back.
#
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 4
build_image = false
build_iso = false
build_qcow2 = false

[[variants.skipjack.flavors]]
id = "cosmic-hwe"
# Layers on cosmic, which is amd64-only while the Tideforge COSMIC
# tier has no aarch64 index (see cosmic above).
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.skipjack.flavors]]
id = "cosmic-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.skipjack.flavors]]
id = "kde-hwe"
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.skipjack.flavors]]
id = "kde-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.skipjack.flavors]]
id = "niri-hwe"
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.skipjack.flavors]]
id = "niri-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

# ── Wahoo ────────────────────────────────────────────────────────────────
# Fedora ELN — the EL11 early-warning lane.
#
# ELN ("Extra Lifecycle Notes") is Fedora Rawhide's sources built with
# Enterprise Linux macros, buildroot and repo layout. Its os-release is
# already the thing this variant exists to preview:
#
#   ID=eln  VERSION_ID=11  ID_LIKE="rhel centos fedora"  VARIANT_ID=eln
#
# — measured on the pinned digest below, 2026-08-25. That is the same 11
# that c10s→c11s and almalinux-bootc:11-kitten will carry, months before
# either exists to build against. Yellowfin (Kitten 10), Albacore (Alma 10)
# and Skipjack (c10s) are all EL10; nothing in the matrix sees EL11 today,
# so an EL11 break surfaces the day a base flips, not before. That is the
# gap this fills, and it is why the variant is EL-family rather than a
# bonito flavor: ELN is upstream of every EL11 rebuild, not of Fedora 45.
#
# Upstream base availability (VARIANT-LIFECYCLE.md admission gate #3):
# registry.fedoraproject.org/eln-bootc is the image fedora-eln/eln#214
# asked for, and it exists — an OCI index carrying amd64, arm64, ppc64le
# and s390x, 480 packages, bootc-1.16.7, dnf5-5.4.3.0, kernel-7.3.0-rc.
# Both declared platforms are satisfied by the index AND by the desktop
# payload: gnome-shell/gdm/mutter/nautilus/gnome-control-center/
# mesa-dri-drivers all resolve on x86_64 and aarch64 (GNOME 51~beta,
# `dnf repoquery --forcearch=aarch64`, 2026-08-25) — the measurement
# hummingbird's arm64 legs skipped (#1755 §3).
#
# experimental: true — dispatch-only, no cron. The Q3 flavor freeze
# (VARIANT-LIFECYCLE.md §1, "no new flavors through 2026-09-30") is a
# CAPACITY gate, and a nightly EL11 lane is exactly the nightly capacity it
# protects while 13 variant workflows are still being brought back to
# green. Dispatch-only adds 0 nightly cells, 0 ISO cells and 0 boot-gate
# cells. It is not literally zero incremental CI: luks-e2e.yml builds its
# matrix from build_image with no experimental filter, so wahoo:gnome is one
# extra boot in the monthly sweep (`0 7 1 * *`) — counted rather than
# excluded, and pinned by tests/test_matrix_status.py's denominator.
# Promotion to a cron lane needs the capacity note the gate asks for.
[variants.wahoo]
emoji = "🎏"
upstream_track = "experimental"
description = "Based on Fedora ELN (EL11 preview, rolling)"
experimental = true
base_image = "registry.fedoraproject.org/eln-bootc:latest@sha256:c06226f1bab02f0fd27541aea58c7452acd4c8a32ff7654ff14e7b4ad56e9650"
# No alias: `eln` is Fedora's identifier for a moving development target,
# and an alias tag is a stability promise this lane deliberately does not
# make. Revisit if/when ELN gains a versioned publish.
platforms = ["linux/amd64", "linux/arm64"]

# Known gap, recorded here because it bounds what this lane may claim:
# ELN has NO working H.264/H.265 decoder (ffmpeg-free's only h264 entry
# is backed by the `noopenh264` stub, which encodes 0 bytes; RPM Fusion
# publishes no ELN branch). See docs/GREEN-MASTER-PLAN.md's wahoo section
# and the TUNAOS_CODEC_GAP marker in verify-desktop-experience.sh.
#
# Scope: every desktop ELN actually composes, and no others. GNOME 51~beta
# and COSMIC 1.6.0 come from eln-appstream/eln-extras; KDE comes from the
# `kde-desktop` group (86 entries, Plasma 6.7.4). Each was repodata-measured
# before its row was added — #858 is an image tagged for a desktop that
# contains no desktop, and the guard against it is measuring first.
#
# Niri and XFCE are deliberately NOT here and must not be added by analogy:
# ELN ships one package of the Niri stack (`swaybg`) and ZERO `xfce*`
# packages at all. Both need packages built before a row is honest —
# tracked in #2051 / #2052 and in tunaos-packages.
#
# No ISO and no qcow2 on any flavor — a preview lane publishes images to
# `bootc switch` onto, not installer media.
[[variants.wahoo.flavors]]
id = "base"
stage = 1
build_image = true
build_iso = false
build_qcow2 = false

[[variants.wahoo.flavors]]
id = "gnome"
stage = 2
build_image = true
build_iso = false
build_qcow2 = false

[[variants.wahoo.flavors]]
# COSMIC 1.6.0 from eln-extras — 23 of 24 manifest packages present
# (only cosmic-wallpapers absent). Notably needs NO extra repo, unlike
# the el10 section's x86_64-only repo.tunaos.org Tideforge tier, so it
# keeps arm64: ELN has fprintd-1.94.5-6.eln158 in eln-appstream (#2049).
id = "cosmic"
stage = 2
build_image = true
build_iso = false
build_qcow2 = false

[[variants.wahoo.flavors]]
# Plasma 6.7.4 via the eln-extras `kde-desktop` group; 16 of 23 explicit
# packages present, the seven misses are peripheral input/security-key
# extras carried as `optional:` (#2050).
id = "kde"
stage = 2
build_image = true
build_iso = false
build_qcow2 = false

[[variants.wahoo.flavors]]
# Tuna Desktop (tuna_rollout above, tunaOS#3198): eln package target,
# which publishes tuna-desktop and gtkgreet; amd64 only, like every
# tuna cell.
id = "tuna"
stage = 2
platforms = ["linux/amd64"]
build_image = true
build_iso = false
build_qcow2 = false
luks_e2e = false

[variants.bonito]
emoji = "🎣"
description = "Based on Fedora 44"
# Unpinned 2026-09-17. The note this replaces named the condition itself:
# "If quay GCs this one inside a day as well, that is the second strike and
# bonito should follow them to a bare tag." It did, and this is that.
#
# sha256:2c38c5f7… (tunaOS#2464) was GC'd within a day. sha256:4a460ed0…
# replaced it on 2026-09-12 and was GC'd between the green nightly of
# 2026-09-13 (run 34768771243) and the red one of 2026-09-14 (34871837299).
# Every Build Bonito since has died in the pull, all four retries:
#
#   Error: ... reading manifest sha256:4a460ed0… in quay.io/fedora/fedora-bootc:
#   manifest unknown
#
# Verified by direct registry query, not inferred:
#
#   GET /v2/fedora/fedora-bootc/manifests/sha256:4a460ed0…  -> 404
#   GET /v2/fedora/fedora-bootc/manifests/44                -> sha256:38ef702a…
#
# Two digests, two garbage collections, five days. quay does not retain
# replaced manifests for fedora-bootc even on a release tag, so :44 behaves
# like rawhide and tumbleweed below and gets their treatment. A digest that
# 404s buys no reproducibility — it buys a red base and all 16 cells behind
# it, because every downstream flavor pulls through this one line.
#
# check-base-image-pins.sh reports the new state as a declared one:
#   SKIP  (not digest-pinned)  quay.io/fedora/fedora-bootc:44
#
# Re-pin when quay retains replaced fedora-bootc manifests, or when the
# build resolves the tag once and threads that digest through every stage.
base_image = "quay.io/fedora/fedora-bootc:44"
# Friendly alias: same digest also published as ghcr.io/tuna-os/<alias>:<flavor>
aliases = ["fedora"]
akmods = "ublue-os"
# Note: linux/amd64/v2 intentionally omitted — verify builder support before adding.
platforms = ["linux/amd64", "linux/arm64"]

# Flavor strategy: Fedora ships the latest kernel and GNOME by default,
# so HWE layers are only provided for gnome (the primary desktop).
# GNOME 50 is EL10-specific and not needed on Fedora.
# gnome-nvidia-hwe (stage 4) omitted for now — kernel compatibility TBD.
[[variants.bonito.flavors]]
# ── Stage 1 ────────────────────────────────────────────────────────────
id = "base"
stage = 1
build_image = true
build_iso = false
build_qcow2 = false

[[variants.bonito.flavors]]
# ── Stage 2 ────────────────────────────────────────────────────────────
id = "base-hwe"
stage = 2
build_image = true
build_iso = false
build_qcow2 = false

[[variants.bonito.flavors]]
id = "base-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 2
build_image = true
build_iso = false
build_qcow2 = false

[[variants.bonito.flavors]]
# Tuna Desktop (tuna_rollout above, tunaOS#3199): fedora package
# target, which publishes tuna-desktop for x86_64 only.
id = "tuna"
stage = 2
platforms = ["linux/amd64"]
build_image = true
build_iso = false
build_qcow2 = false
luks_e2e = false

[[variants.bonito.flavors]]
id = "gnome"
stage = 2
build_image = true
build_iso = true
build_qcow2 = true

[[variants.bonito.flavors]]
id = "cosmic"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito.flavors]]
id = "kde"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito.flavors]]
id = "niri"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito.flavors]]
id = "xfce"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito.flavors]]
# ── Stage 3 ────────────────────────────────────────────────────────────
# HWE: no ISO — install the standard ISO then `bootc switch` to *-hwe
id = "gnome-hwe"
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.bonito.flavors]]
# Apple Silicon (M1/M2, Asahi Linux) — overlay/asahi.sh; aarch64 only.
# No ISO: Apple Silicon cannot external-boot; installs go through the
# asahi-installer path from macOS.
id = "gnome-asahi"
stage = 3
platforms = ["linux/arm64"]
build_image = true
build_iso = false
build_qcow2 = false

[[variants.bonito.flavors]]
# Intel Macs with Apple's T2 security chip. Fedora's t2linux stack is
# x86_64-only; no generic ISO may stand in for this profile because it
# lacks the T2 kernel. Bootsahi Legacy supplies its dedicated USB flow.
id = "gnome-t2"
stage = 3
platforms = ["linux/amd64"]
build_image = true
build_iso = false
build_qcow2 = false

[[variants.bonito.flavors]]
id = "gnome-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito.flavors]]
id = "cosmic-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito.flavors]]
id = "kde-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito.flavors]]
id = "niri-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito.flavors]]
id = "xfce-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

# ── Hummingbird ────────────────────────────────────────────────────────────
# Fedora Hummingbird: container-native, hardened bootc distribution
# (Konflux hermetic build model, CKI ARK kernel).
[variants.hummingbird]
emoji = "🐦"
upstream_track = "experimental"
# Rolling, security-hardened fork tracking Fedora RAWHIDE -- not Fedora 43,
# whatever the .fc43 dist tags suggest -- and shipping NO desktop upstream.
# The desktop flavors below are therefore a PORT onto a desktop-less base,
# not a rebuild of an existing one. Read docs/HUMMINGBIRD.md before
# reasoning about what its package set should contain.
description = "Fedora Hummingbird (hardened rolling Rawhide fork, bootc)"
base_image = "quay.io/hummingbird-community/bootc-os:latest@sha256:7197f14260120b815bbbaa13414c46b29415f6d879c45c8680b1916dfed0a815"
# amd64 only, because aarch64 has nothing to build FROM yet: the base
# stage's mandatory xfsprogs guard (build_scripts/10-base-packages.sh) has
# no repository that can satisfy it on arm64, so every hummingbird arm64
# leg dies before a desktop is ever considered.
#
#   ERROR: xfsprogs did not install — no enabled repo carries it;
#          bootc install to-disk cannot format the root without it.
#
# Measured against the live indexes rather than inferred, 2026-09-11
# (repo.tunaos.org/hummingbird/20251124-$basearch/repodata):
#
#   x86_64    13442 packages   xfsprogs: 1   malcontent: 2
#   aarch64    7177 packages   xfsprogs: 0   malcontent: 0
#
# The aarch64 rebuild wave is roughly half-published, and the same gap
# explains the flatpak breakage two lines further down that log ("nothing
# provides libmalcontent-0.so.0 needed by flatpak-1.17.3-1.bfin1.aarch64"):
# malcontent is an x86_64-only build in that snapshot too.
#
# This is the arch-honesty criterion, not a retreat: advertising an
# architecture whose base cannot resolve its mandatory packages scores an
# unsatisfiable cell red every night and tells a user the image exists.
#
# The direction of travel points the same way. As hummingbird takes more of
# its package set from projectbluefin/utah-packages, arm64 gets further out
# of reach, not closer: that repository is a SINGLE-manifest OCI image
# (measured 2026-09-11 — mediaType application/vnd.oci.image.manifest.v1+json,
# no manifest list, x86_64 only), which is already why hummingbird:gnome
# carries its own amd64 pin. A source that cannot be pulled for aarch64
# cannot supply an aarch64 image.
#
# Restore "linux/arm64" only alongside BOTH: the aarch64 snapshot carrying
# xfsprogs (the one-line curl above is the check) and an aarch64 build of
# whatever package source the variant is on by then. See
# docs/HUMMINGBIRD.md.
platforms = ["linux/amd64"]

[[variants.hummingbird.flavors]]
id = "base"
stage = 1
build_image = true
build_iso = true

[[variants.hummingbird.flavors]]
# GNOME remains amd64-only until its aarch64 source (utah-packages)
# publishes there. COSMIC's own 25 manifest packages did converge on
# aarch64 (2026-09-06) and this flavor inherits the variant platforms
# below — which are amd64-only today for a reason one layer down: the
# BASE cannot build on arm64 at all (see the platforms note above), so a
# desktop whose package set resolves still had nothing to layer onto.
# Both notes revert together.
id = "gnome"
stage = 2
platforms = ["linux/amd64"]
build_image = true
build_iso = true

[[variants.hummingbird.flavors]]
# kde and niri are DECLARED but not implemented for hummingbird, and
# advertising them costs the flavor that is.
#
# manifests/desktops/{kde,niri}.yaml have no `packages.hummingbird`
# section at all -- 0 packages, against gnome's 52 and cosmic's 23.
# install-desktop.sh routes hummingbird to that section by construction,
# so both flavors have never had a package set to install. Measured on
# run 32786338463: the two flavors with no manifest are exactly the two
# whose image builds failed.
#
#   kde   nothing provides libdouble-conversion.so.3 / libfbclient.so.2
#         needed by qt6-qtbase-*.hum1 from public-hummingbird -- an
#         UPSTREAM gap; those sonames are in no index, ours or theirs,
#         and no wave the factory is building supplies them.
#   niri  TUNAOS_BRANDING_FAIL -- dconf keyfiles written to
#         /etc/dconf/db/distro.d with no compiled database, because
#         `dconf update` is guarded on `command -v dconf` and dconf is
#         not installed when there is no package set to install it.
#
# Why this blocks GNOME. build_artifacts_s2 takes `needs: build_stage2`,
# a matrix job over every stage-2 flavor, so one failing leg skips every
# ISO in the stage -- gnome's included, however cleanly it built
# (tuna-os/tunaOS#2059). gnome is the only desktop with a passing
# installer-smoke cell anywhere in the matrix, so the flavors that were
# never implemented are blocking the one that works.
#
# Re-add each of these the moment it has a `packages.hummingbird`
# section, exactly as cosmic and gnome do. Nothing here is a judgement
# about wanting kde or niri on hummingbird; it is a statement that they
# do not exist yet and should not be advertised as though they do.
id = "cosmic"
stage = 2
build_image = true
build_iso = true

# ── Sailfin ──────────────────────────────────────────────────────────────
# Sailfin Tumbleweed: rolling-release, zypper-based.
[variants.sailfin]
emoji = "⛵"
upstream_track = "rolling"
description = "Based on openSUSE Tumbleweed (rolling)"
# NOT digest-pinned, for the same reason as bonito-rawhide below.
#
# Tumbleweed is a rolling snapshot and registry.opensuse.org garbage-
# collects the manifests it replaces, faster than the daily pin check can
# protect a pin. Measured, this time:
#
#   2026-09-11 ~17:00  tunaOS#2464 pins sha256:349094be… (alive, verified)
#   2026-09-12 00:22   check-base-image-pins run 34661427002: success
#   2026-09-12 21:28   build-sailfin run 34720071388:
#                        reading manifest sha256:349094be… : manifest unknown
#
# Under 28 hours from written to dead, and dead in the window BETWEEN the
# 22:20 check and the build it runs ahead of. That is not a pin the checker
# can save: the guard exists (it caught #1788, 24 cells across three
# variants) and it passed nine hours before the base died anyway.
#
# The base failure took all 7 sailfin cells with it, 6 of which had just
# gone green. A digest that cannot be fetched buys no reproducibility --
# only a guaranteed red base. The checker reports this as a declared state:
#
#   SKIP  (not digest-pinned)  registry.opensuse.org/opensuse/tumbleweed:latest
#
# Re-pin by digest only if registry.opensuse.org starts retaining replaced
# manifests, or if something resolves the tag once at build time and
# threads that one digest through every stage of the build.
base_image = "registry.opensuse.org/opensuse/tumbleweed:latest"
# Friendly alias: same digest also published as ghcr.io/tuna-os/<alias>:<flavor>
aliases = ["opensuse", "tumbleweed"]
platforms = ["linux/amd64"]

[[variants.sailfin.flavors]]
# base + gnome carry an arm64 leg solely as the parent chain for
# gnome-asahi (Tumbleweed is multiarch; bootc comes from zypper).
# Other DEs stay amd64 until someone asks for them on arm64.
id = "base"
stage = 1
platforms = ["linux/amd64", "linux/arm64"]
build_image = true

[[variants.sailfin.flavors]]
id = "gnome"
stage = 2
platforms = ["linux/amd64", "linux/arm64"]
build_image = true

[[variants.sailfin.flavors]]
# gnome-asahi: NOT declared, and not an oversight. Same call marlin and
# flounder already made above, for the same reason and on the same kind
# of evidence.
#
# The image builds, assembles, and signs. It then fails the Asahi
# manifest gate 8/37 (run 34750381815), and every one of those 8 is a
# package that OBS home:mrkcee does not ship. Read out of the RPM
# headers directly on 2026-09-13, not inferred:
#
#   kernel-asahi-7.1.13-3.2   2259 files, ZERO .dtb — the gate wants the
#                             ~50 Apple device trees real hardware needs
#   m1n1-1.6.1-2.1            16 files, zero .dtb
#   u-boot-asahi-2026.07-3.1  18 files, zero .dtb
#   asahi-scripts-20250713    21 files: asahi-diagnose and the dracut
#                             modules, but NO update-m1n1, no kernel
#                             install hook, no asahi-fwupdate
#   tiny-dfr                  "Package 'tiny-dfr' not found" — absent
#                             from the repo entirely, which is why
#                             asahi.sh already installs it best-effort
#
# So nothing in the stack provides the device trees, the boot-object
# updater, the firmware updater, or the touchbar daemon. This is not the
# gate reading an openSUSE layout wrong: grouper's gnome-asahi passes the
# identical gate 37/0 with macsmc.ko, 104 Apple DTBs, update-m1n1 and its
# hook, asahi-fwupdate, and tiny-dfr all present (run 34777822830). One
# packaging set is complete and the other is not.
#
# An image that cannot update its own boot object or load Apple firmware
# does not install on an M1. Declaring the cell advertises hardware
# support that does not exist and costs an arm64 build a night to
# re-establish that. Tracked in tunaOS#2492; re-declare the day
# home:mrkcee (or another source) ships the DTBs and asahi-scripts'
# missing half.
#
# base and gnome keep their arm64 legs: they are the parent chain, and
# dropping them would be a wider change than this evidence supports.
id = "kde"
stage = 2
build_image = true

[[variants.sailfin.flavors]]
id = "niri"
stage = 2
build_image = true

[[variants.sailfin.flavors]]
id = "xfce"
stage = 2
build_image = true

[[variants.sailfin.flavors]]
# COSMIC: newly buildable. Tumbleweed packages the session richly and the
# whole zypper list installs clean (exit 0), producing cosmic-comp and
# /usr/share/wayland-sessions/cosmic.desktop — both measured on a real
# install, not inferred. Note cosmic-settings and cosmic-greeter are NOT
# packaged on openSUSE; see the manifest for what is used instead.
id = "cosmic"
stage = 2
build_image = true

[[variants.sailfin.flavors]]
# Tuna Desktop (tuna_rollout above, tunaOS#3201): opensuse package
# target, signed index repo.tunaos.org/rpm/opensuse-tumbleweed.
id = "tuna"
stage = 2
platforms = ["linux/amd64"]
build_image = true
build_iso = false
build_qcow2 = false
luks_e2e = false

# ── Guppy ────────────────────────────────────────────────────────────────
# Guppy: source-based, emerge/portage. Compiles everything from source.
[variants.guppy]
emoji = "🌈"
upstream_track = "rolling"
description = "Based on Gentoo Linux (source-based)"
# Digest-pinned to match Containerfile.gentoo's FROM exactly. This value
# is not decorative: reusable-build-image.yml pre-pulls it to warm local
# storage before the build (a workaround for quay/docker CDN blob drops,
# #675). With a bare :latest here it warmed whatever latest happened to be
# while the Containerfile built from the pinned digest, so the pre-pull
# fetched an image the build never used and the workaround silently did
# nothing for guppy. Keep the two in lockstep when bumping.
base_image = "docker.io/gentoo/stage3:latest@sha256:916dc4d8cf38d316da9a838c2e20f32f16b7d4f21ef137b4682b66d68874c2c5"
# Friendly alias: same digest also published as ghcr.io/tuna-os/<alias>:<flavor>
aliases = ["gentoo"]
platforms = ["linux/amd64"]

[[variants.guppy.flavors]]
id = "base"
stage = 1
build_image = true

[[variants.guppy.flavors]]
# GNOME 50 comes from ::gentoo under ~amd64, and builds from source:
# the official binhost has only stable versions, which stop at 49.7.
# manifests/desktops/gnome.yaml emerge_accept_keywords has the package
# list. This flavor was off from 2026-09-11 to 2026-10-07 while
# ::gentoo topped out at 49.9, below the floor (tunaOS#2450).
id = "gnome"
stage = 2
build_image = true

[[variants.guppy.flavors]]
id = "kde"
stage = 2
build_image = true

[[variants.guppy.flavors]]
# XFCE: every atom in the emerge list was verified to exist in the Gentoo
# main tree before this was declared. The list previously named
# xfce-base/lightdm, which does not exist (it is x11-misc/lightdm) — so
# declaring this flavor earlier would have failed on an unresolvable atom.
id = "xfce"
stage = 2
build_image = true

# NOT declared, and not an oversight:
#   niri    — no ebuild in the Gentoo main tree at all. A search returns
#             only dev-ruby/niceogiri. Declaring it would publish an
#             installable image with no compositor, exactly as
#             flounder:niri did (tunaOS#915). It IS packaged in the
#             community GURU overlay (gui-wm/niri, ~amd64) — see
#             manifests/desktops/niri.yaml for the full finding. Not
#             enabled here: an untested source build, and ~amd64
#             keywording that can shift under guppy without warning.
#   cosmic  — same: no cosmic-comp or cosmic-session ebuild in the tree,
#             and cosmic.yaml has no emerge section.
# Both measured and tracked in tunaOS#923.
# Do not add either until the packages exist; the emerge path now fails
# loudly on an empty list rather than shipping a desktop-less image.
# ── Rawhide ────────────────────────────────────────────────────────────────
# Fedora Rawhide (rolling development branch). Uses the same Containerfile
# as bonito — Fedora bootc with the latest kernel and packages.
[variants.bonito-rawhide]
publish_name = "bonito"
tag_suffix = "rawhide"
emoji = "🐉"
upstream_track = "rolling"
description = "Based on Fedora Rawhide (rolling)"
# NOT digest-pinned, and this is the only base image here that is not.
#
# A digest pin on this tag is dead before the nightly that would use it.
# Measured 2026-09-11: the digest resolved at 12:55 was already 404 by
# 13:36 -- 41 minutes -- and `:rawhide` had moved on. It is not that the
# digest goes stale; quay garbage-collects the untagged manifest at once,
# so the pin does not resolve AT ALL:
#
#   Error: creating build container: ... reading manifest sha256:0d942e1b…
#   in quay.io/fedora/fedora-bootc: manifest unknown
#
# Compare fedora-bootc:44 in this same file, whose digest was still 200 in
# the same measurement. Stable tags are retained; Rawhide's are not.
#
# That makes repinning a fix with a one-hour half-life, and the repo's own
# safety net cannot close the gap either: check-base-image-pins.yml runs at
# 22:20 and the variant builds at 01:00, so the digest it verified is
# already gone by the time anything builds. scripts/check-base-image-pins.sh
# names this exact variant in its own history (#1788, 2026-08-16), because
# it keeps happening here and nowhere else for the same reason.
#
# So the tag is the honest reference. The point of bonito-rawhide is to
# track Rawhide, a target that moves several times a day; a digest that
# cannot be fetched buys no reproducibility, it only guarantees a red base
# every night and takes every downstream flavor with it. The pin checker
# already treats this as a declared state rather than an error, and says so
# per run:
#
#   SKIP  (not digest-pinned)  quay.io/fedora/fedora-bootc:rawhide
#
# Re-pin by digest only if quay starts retaining Rawhide manifests, or if
# something resolves the tag at build time and threads one digest through
# every stage of that build.
base_image = "quay.io/fedora/fedora-bootc:rawhide"
# Friendly alias: same digest also published as ghcr.io/tuna-os/<alias>:<flavor>
aliases = ["fedora"]
akmods = "ublue-os"
platforms = ["linux/amd64", "linux/arm64"]

[[variants.bonito-rawhide.flavors]]
id = "base"
stage = 1
build_image = true
build_iso = false
build_qcow2 = false

[[variants.bonito-rawhide.flavors]]
# Tuna Desktop (tuna_rollout above, tunaOS#3203): rawhide package
# target, repo.tunaos.org/rpm/rawhide (tunaos-packages#870). Published
# as bonito:tuna-rawhide.
id = "tuna"
stage = 2
platforms = ["linux/amd64"]
build_image = true
build_iso = false
build_qcow2 = false
luks_e2e = false

[[variants.bonito-rawhide.flavors]]
id = "base-hwe"
stage = 2
build_image = true
build_iso = false
build_qcow2 = false

[[variants.bonito-rawhide.flavors]]
id = "base-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 2
build_image = true
build_iso = false
build_qcow2 = false

[[variants.bonito-rawhide.flavors]]
id = "gnome"
stage = 2
build_image = true
build_iso = true
build_qcow2 = true

[[variants.bonito-rawhide.flavors]]
id = "cosmic"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito-rawhide.flavors]]
id = "kde"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito-rawhide.flavors]]
id = "niri"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito-rawhide.flavors]]
id = "xfce"
stage = 2
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito-rawhide.flavors]]
id = "gnome-hwe"
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.bonito-rawhide.flavors]]
id = "gnome-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito-rawhide.flavors]]
id = "cosmic-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito-rawhide.flavors]]
id = "kde-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito-rawhide.flavors]]
id = "niri-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.bonito-rawhide.flavors]]
id = "xfce-nvidia"
# x86_64 only: the akmods-nvidia-open kmods are x86_64 builds, so on
# any other platform the exact-EVR kmod install can never match and
# the overlay hard-fails (overrides/nvidia/10-kernel-swap.sh) rather
# than shipping a driverless "nvidia" image. Also excludes amd64/v2:
# Kitten v2 kernels are ARCH=x86_64_v2, which no published kmod
# matches. Same shape as bluefin's x86_64-only GDX.
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

# ── Ubuntu ───────────────────────────────────────────────────────────────
# RFC 010: Ubuntu 26.04 variant. x86_64-only.
# Desktops: gnome/kde/niri/xfce via the apt branches in build_scripts/*.sh
# (cosmic has no apt branch yet). No HWE/NVIDIA layers — Ubuntu ships its
# own kernel stack and the akmods images are RPM-only.
# ── elementary / Pantheon ──────────────────────────────────────────
# A SEPARATE variant rather than a grouper flavour, and the base image is
# why. Pantheon is absent from the Ubuntu archive entirely (verified on
# ubuntu:resolute with main+universe+restricted+multiverse enabled: gala,
# wingpanel, pantheon-session and switchboard all ABSENT, only `plank`
# present). It comes solely from ppa:elementary-os/stable, which publishes
# for **noble and jammy only** — nothing for resolute. grouper is Ubuntu
# 26.04, so Pantheon cannot be installed there at any version today.
#
# Revisit collapsing this into grouper when elementary publishes for 26.04.
[variants.gurnard]
emoji = "🤖"
description = "Based on Ubuntu 24.04 Noble Numbat with the Pantheon desktop"
base_image = "docker.io/library/ubuntu:noble@sha256:68ee22004a9109b44973313b02ff7b1de250f1de0f5ecb628d73f579aaff33ac"
# Friendly alias: same digest also published as ghcr.io/tuna-os/<alias>:<flavor>
aliases = ["elementary"]
platforms = ["linux/amd64", "linux/arm64"]

[[variants.gurnard.flavors]]
id = "base"
stage = 1
build_image = true

[[variants.gurnard.flavors]]
id = "pantheon"
stage = 2
build_image = true
build_iso = true

[variants.grouper]
emoji = "🪸"
description = "Based on Ubuntu 26.04 Resolute Raccoon"
base_image = "docker.io/library/ubuntu:resolute@sha256:c098726dd9b9733f3e885f8de0ef375206a311b0a317eadc40d347b1115fb944"
# Friendly alias: same digest also published as ghcr.io/tuna-os/<alias>:<flavor>
aliases = ["ubuntu"]
# Built directly from stock Ubuntu and bootcified in Containerfile.ubuntu
# (bootc from the tuna-os bootc-toolchain-sid oras artifact). See RFC 010.
# arm64: toolchain publishes latest-{amd64,arm64}; Containerfile.ubuntu is
# TARGETARCH-aware. Apple Silicon (Asahi) support gated behind
# ENABLE_ASAHI=1 (build_scripts/ubuntu-kernel.sh) — flavor wiring TBD.
platforms = ["linux/amd64", "linux/arm64"]

[[variants.grouper.flavors]]
id = "base"
stage = 1
build_image = true

[[variants.grouper.flavors]]
# Tuna Desktop (tuna_rollout above, tunaOS#3205): ubuntu package
# target, signed apt index repo.tunaos.org/tideforge/ubuntu. amd64
# only, like every tuna cell: the boot gate and the session
# qualification run on amd64.
id = "tuna"
stage = 2
platforms = ["linux/amd64"]
build_image = true
build_iso = false
build_qcow2 = false
luks_e2e = false

[[variants.grouper.flavors]]
id = "gnome"
stage = 2
build_image = true
build_iso = true

[[variants.grouper.flavors]]
# Apple Silicon (M1/M2, Asahi Linux) — full build with ENABLE_ASAHI=1
# (the kernel decision lives in Containerfile.ubuntu's base stage, so
# this is not an overlay). aarch64 only; no ISO (asahi-installer path).
#
# stage 3, NOT stage 1, and the distinction matters: `stage` is build
# ORDER, not parentage. This flavor has no PARENT_FLAVOR, so it still
# builds straight from base wherever it is placed — but at stage 1 it
# shared a matrix with base, and a stage does not advance until every
# cell in it passes. One arm64-only Apple Silicon flavor therefore gated
# gnome, kde, gnome-zfs, cosmic and xfce, which all live in stage 2:
# run 30688732984 promoted base and then never started them.
#
# Every other variant already places gnome-asahi at stage 3; grouper was
# the lone exception, because there asahi is a full build rather than an
# overlay and the stage number was read as "has no parent" rather than
# "runs first".
id = "gnome-asahi"
stage = 3
platforms = ["linux/arm64"]
build_image = true
build_iso = false

[[variants.grouper.flavors]]
# GNOME with ZFS-root support (prebuilt zfs.ko + zfs-dracut). ISO gated
# off until the install-to-filesystem ZFS-root path has a boot e2e (#625).
id = "gnome-zfs"
stage = 2
build_image = true
build_iso = false

[[variants.grouper.flavors]]
id = "kde"
stage = 2
build_image = true
build_iso = true

[[variants.grouper.flavors]]
# No niri — same reason as flounder and flounder-sid (#918): niri is not
# packaged for apt in Debian trixie, Debian sid or Ubuntu 26.04, and
# manifests/desktops/niri.yaml has no apt section. grouper is Ubuntu, so
# it was covered by that evidence but missed by the change.
#
# Nothing would have caught it either. With no packages.apt section the
# installer skips the install without error, and the apt path `exit 0`s
# before the shared tail — so the desktop experience contract never runs
# on an apt variant at all. That is the mechanism that published
# flounder:niri with no compositor (tunaOS#915); grouper:niri is not in
# the published set, so it evidently never completed, but the
# declaration was wrong either way.
# Packaging it ourselves is tunaos-packages#136. Do not re-add without it.
#
# COSMIC, by contrast, IS buildable here and is now declared. Ubuntu has
# no COSMIC in its own repos, but cosmic.yaml carries
# ppa:hepp3n/cosmic-epoch with condition: ubuntu, and install-desktop.sh
# adds a PPA when IS_UBUNTU — measured WITH the PPA enabled,
# cosmic-session, cosmic-comp, cosmic-settings and cosmic-greeter all
# resolve. (Measuring in a bare ubuntu container says nothing here: the
# installer adds repositories before it installs, so a probe that skips
# that step is answering a question about the wrong system.)
# amd64 only: ppa:hepp3n/cosmic-epoch publishes amd64 and amd64v3 and
# nothing else — no arm64 build of cosmic-session/cosmic-comp/etc exists
# for any series (Launchpad getPublishedBinaries). grouper otherwise
# builds both arches, so the arm64 job was the ONLY failure in run
# 31088031074 while amd64 built clean. Same shape as the amd64 cosmic
# pin on the EL10 variants for the x86_64-only Tideforge tier.
#
# This PPA dependency is tracked for removal in tunaOS#964 — see the
# status note at the top of manifests/desktops/cosmic.yaml's apt:
# block for exactly what has and hasn't landed on the Tideforge side.
id = "cosmic"
stage = 2
platforms = ["linux/amd64"]
build_image = true

[[variants.grouper.flavors]]
id = "xfce"
stage = 2
build_image = true
build_iso = true

# ── Arch Linux ─────────────────────────────────────────────────────────────
# Marlin: rolling-release Arch Linux on bootc. Uses Containerfile.arch
# which builds bootc from source (Arch doesn't package it yet) and sets
# up the ostree/composefs filesystem layout.
[variants.marlin]
emoji = "🚀"
upstream_track = "rolling"
description = "Based on Arch Linux (rolling)"
base_image = "docker.io/archlinux/archlinux:latest@sha256:24bd9134f828780b847419581105bd40b6dd9182ea7b12a0a0bb42b8562f9796"
# Friendly alias: same digest also published as ghcr.io/tuna-os/<alias>:<flavor>
aliases = ["arch", "archlinux"]
# arm64 legs use ghcr.io/tuna-os/archlinuxarm instead (docker.io/archlinux
# is x86_64-only) — see get-base-image.sh + build-archlinuxarm-base.yml
# (#778). Only the gnome-asahi parent chain builds arm64.
platforms = ["linux/amd64"]

[[variants.marlin.flavors]]
id = "base"
stage = 1
platforms = ["linux/amd64", "linux/arm64"]
build_image = true

[[variants.marlin.flavors]]
id = "gnome"
stage = 2
platforms = ["linux/amd64", "linux/arm64"]
build_image = true
build_iso = true

[[variants.marlin.flavors]]
# gnome-asahi: NOT declared, and not an oversight.
#
# The Asahi-ALARM repo's linux-asahi package is real (verified by
# downloading it directly: asahi-alarm/asahi-alarm release "aarch64",
# linux-asahi-7.1.5.asahi2-1-aarch64.pkg.tar.xz), but it ships only 5
# T8103 (M1) device trees — nowhere near the ~50 the asahi-verify
# harness requires for real hardware coverage — and is missing several
# Apple SoC kernel modules the harness checks for, most importantly
# asahi.ko itself (the GPU driver; appledrm.ko, the older
# display-only driver, IS present). The published
# ghcr.io/tuna-os/marlin:gnome-asahi tag scored 23/36 on the harness
# (run 31243787771, 2026-08-08) — an ordinary arm64 image with a
# differently-named kernel, not a bootable Apple Silicon image.
#
# tunaOS#911: "until fixed, [this] should stop being promoted rather
# than shipping as unbootable" — a user selecting it in the installer
# catalog gets a Mac that does not boot. Re-add once asahi-alarm's
# linux-asahi actually ships the missing modules and device trees, or
# once TunaOS has its own source of a complete Apple Silicon kernel
# for Arch. Same pattern as guppy's absent niri/cosmic flavors above.
id = "kde"
stage = 2
build_image = true
build_iso = true

[[variants.marlin.flavors]]
# Experimental admission #2990; signed tuna-desktop served install verified
# 2026-10-09 (tunaos-packages run 37881967008).
# Tuna Desktop, formerly Roost: this flavor was `roost` until
# tuna-os/tuna-desktop#536 renamed the project.
id = "tuna"
stage = 2
platforms = ["linux/amd64"]
# Owner decision: stop publishing the former roost tag immediately.
build_image = true
build_iso = false
build_qcow2 = false
# #2990 admission covers image/boot only, not installer expansion.
luks_e2e = false

[[variants.marlin.flavors]]
id = "cosmic"
stage = 2
build_image = true

[[variants.marlin.flavors]]
id = "niri"
stage = 2
build_image = true

[[variants.marlin.flavors]]
id = "xfce"
stage = 2
build_image = true

[[variants.marlin.flavors]]
# CachyOS kernel overlay on the Arch base — like -hwe/-nvidia elsewhere
# (Containerfile.overlay + build_scripts/cachyos.sh, stage 3 on the parent DE).
id = "gnome-cachyos"
stage = 3
build_image = true

[[variants.marlin.flavors]]
id = "kde-cachyos"
stage = 3
build_image = true

[[variants.marlin.flavors]]
id = "cosmic-cachyos"
stage = 3
build_image = true

[[variants.marlin.flavors]]
id = "niri-cachyos"
stage = 3
build_image = true

[[variants.marlin.flavors]]
id = "xfce-cachyos"
stage = 3
build_image = true

[[variants.marlin.flavors]]
# NVIDIA overlay on the Arch base (tunaOS#624): nvidia-open-dkms via
# pacman + dkms, not akmods — Arch has no RPM/akmods concept at all.
# See build_scripts/overlay/overrides/nvidia-arch/20-nvidia.sh. No
# *-nvidia-hwe: marlin has no HWE kernel layer to begin with (Arch
# ships the latest kernel natively), so there is nothing to stack an
# nvidia overlay on top of beyond plain *-nvidia.
#
# platforms is pinned to linux/amd64 explicitly (not inherited from
# the variant default) on every *-nvidia flavor in this file — a
# test (tests/bats/test_nvidia_overlay.bats) asserts that directly,
# and nvidia-open-dkms/nvidia-utils only publish x86_64 builds.
id = "gnome-nvidia"
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.marlin.flavors]]
id = "kde-nvidia"
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.marlin.flavors]]
id = "cosmic-nvidia"
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.marlin.flavors]]
id = "niri-nvidia"
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.marlin.flavors]]
id = "xfce-nvidia"
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

# ── Debian ─────────────────────────────────────────────────────────────────
# Flounder: Debian Trixie (13) stable. Uses Containerfile.debian.
[variants.flounder]
emoji = "🐡"
description = "Based on Debian 13 Trixie (stable)"
base_image = "docker.io/library/debian:trixie@sha256:4c25275446ca371766b8b093c696782eabce06263fccacb8d5d813b3dc44b308"
# Friendly alias: same digest also published as ghcr.io/tuna-os/<alias>:<flavor>
aliases = ["debian"]
platforms = ["linux/amd64"]

[[variants.flounder.flavors]]
# base + gnome carry an arm64 leg solely as the parent chain for
# gnome-asahi (debian:trixie is multiarch; the bootc toolchain
# publishes latest-arm64). Other DEs stay amd64 for now.
id = "base"
stage = 1
platforms = ["linux/amd64", "linux/arm64"]
build_image = true

[[variants.flounder.flavors]]
id = "gnome"
stage = 2
platforms = ["linux/amd64", "linux/arm64"]
# Off: Debian 13 trixie ships GNOME 48.7 and the floor is 50
# (manifests/desktops/gnome.yaml minimum_version), so this flavor
# cannot ship a conforming desktop from its own base.
#
# Backporting was measured, not assumed. The sid -> trixie closure
# for GNOME 50 is 165 source packages, 122 of them Rust crates, and
# it pulls rustc 1.85 -> 1.95, debhelper 13 -> 14, systemd 257 ->
# 262 and three LLVM toolchains trixie does not have; the build
# order cannot even be computed, because gdk-pixbuf, glycin, mutter,
# nautilus and the rust-gdk4 crates form a build-dependency cycle.
# With only gnome-shell and mutter as roots it is still 151. For
# scale, the same engine says Ubuntu resolute needs 18 and Debian
# sid needs 1, and trixie-backports carries no GNOME stack at all.
# That is a partial distribution rebuild, not a desktop backport
# (tuna-os/tunaos-packages#687).
#
# Debian GNOME ships from flounder-sid, which has 50.4 natively and
# takes 51 within weeks of release. Turn this back on only after
# re-measuring: while trixie is frozen the number only grows.
build_image = false
build_iso = false

[[variants.flounder.flavors]]
# gnome-asahi: NOT declared, and not an oversight.
#
# build_scripts/overlay/asahi.sh's debian branch resolves a real
# linux-image-*-asahi package from the Bananas team's archive, but the
# published ghcr.io/tuna-os/flounder:gnome-asahi tag currently ships
# stock 6.12.100+deb13-arm64 — the purge-then-install of the asahi
# kernel never runs, because it is not even reached: this flavor's
# arm64 build fails outright at Containerfile.overlay's `pacman`
# detection step. That step uses bash-only `command -v pacman
# &>/dev/null` in a RUN instruction with no `bash -c` wrapper, so it
# runs under the image's default shell — dash on this (Debian) base,
# which does not understand `&>` and mis-parses it as `command -v
# pacman &` (backgrounded) `>/dev/null` (redirecting nothing), always
# entering the `then` branch and invoking a `pacman` that does not
# exist on Debian (build 93057902527, 2026-08-08: "pacman: not
# found", exit 127). Fixed in this same change (Containerfile.overlay
# now uses portable redirection), but with that fixed the harness
# still needs to confirm the Bananas kernel actually boots and covers
# real Apple Silicon hardware before this is safe to publish again —
# unverified as of this writing.
#
# tunaOS#911: "until fixed, [this] should stop being promoted rather
# than shipping as unbootable" — a user selecting it in the installer
# catalog gets a Mac that does not boot. Re-add once a build with the
# portability fix has actually produced and verified an asahi kernel
# here. Same pattern as guppy's absent niri/cosmic flavors elsewhere
# in this file.
id = "kde"
stage = 2
build_image = true
build_iso = true

[[variants.flounder.flavors]]
# No cosmic: COSMIC is not packaged in Debian AT ALL. Checked every
# suite via ftp-master's madison API (oldoldstable through unstable and
# experimental) for cosmic-session, cosmic-comp, cosmic-panel,
# cosmic-files, cosmic-term, cosmic-settings, cosmic-greeter and
# xdg-desktop-portal-cosmic — every one returns empty, while a control
# (kde-plasma-desktop) returns suites. The apt section of
# manifests/desktops/cosmic.yaml is served by ppa:hepp3n/cosmic-epoch,
# which is `condition: ubuntu` and publishes for resolute only, so on a
# Debian base the package list has no source at all:
#   E: Unable to locate package cosmic-comp   (and 18 more)
# flounder:cosmic, LUKS run 31087927879. Same reason niri is absent
# below; it fails louder only because apt exits 100 on an unknown name
# while niri.yaml had no apt section at all, so that one installed
# nothing and exited 0. Do not re-add without a Debian source for COSMIC.
#
# That Debian source is what tunaOS#964 is building — our own
# Tideforge-built debs, not another PPA (which wouldn't cover Debian
# anyway). See manifests/desktops/cosmic.yaml's apt: block for the
# current widen/publish status before re-adding this flavor.
# No niri: it is not packaged for apt in Debian trixie, Debian sid or
# Ubuntu 26.04 (all three checked), and manifests/desktops/niri.yaml
# has no apt section as a result. Building it produced a PUBLISHED,
# installable image with no compositor at all — `command -v niri` was
# empty in ghcr.io/tuna-os/flounder:niri. See tunaOS#915; packaging it
# ourselves is tracked in tunaos-packages#136 and needs a whole deb
# toolchain this org does not have yet. Do not re-add without one.
id = "xfce"
stage = 2
build_image = true

[[variants.flounder.flavors]]
# Tuna Desktop (tuna_rollout above, tunaOS#3206): trixie package
# target, signed apt index repo.tunaos.org/tideforge/debian-trixie.
id = "tuna"
stage = 2
platforms = ["linux/amd64"]
build_image = true
build_iso = false
build_qcow2 = false
luks_e2e = false

[[variants.flounder.flavors]]
# NVIDIA overlay on the Debian base (tunaOS#624): nvidia-driver via
# apt (official Debian non-free component, not a third-party repo) +
# dkms. See build_scripts/overlay/overrides/nvidia-debian/20-nvidia.sh.
# No *-nvidia-hwe: flounder has no HWE kernel layer (Debian ships one
# kernel per suite), so there is nothing to stack an nvidia overlay on
# top of beyond plain *-nvidia.
#
# platforms is pinned to linux/amd64 explicitly on every *-nvidia
# flavor in this file — asserted by
# tests/bats/test_nvidia_overlay.bats — matching nvidia-driver's own
# Debian archive coverage focus and this variant's amd64-only DE set.
id = "gnome-nvidia"
platforms = ["linux/amd64"]
stage = 3
# Off with its parent: a stage-3 overlay on gnome, which cannot
# meet the GNOME 50 floor from trixie (see above).
build_image = false
build_iso = false
build_qcow2 = false

[[variants.flounder.flavors]]
id = "kde-nvidia"
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = true
build_qcow2 = false

[[variants.flounder.flavors]]
id = "xfce-nvidia"
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

# Flounder-sid: Debian Sid (unstable/rolling).
[variants.flounder-sid]
publish_name = "flounder"
tag_suffix = "sid"
emoji = "☢️"
upstream_track = "rolling"
description = "Based on Debian Sid (unstable, rolling)"
base_image = "docker.io/library/debian:sid@sha256:92d7265e51d67d3a2094c1aad9faa88c74cf9d52e6c354200e429cd60237cc55"
# Friendly alias: same digest also published as ghcr.io/tuna-os/<alias>:<flavor>
aliases = ["debian"]
platforms = ["linux/amd64"]

[[variants.flounder-sid.flavors]]
id = "base"
stage = 1
build_image = true

[[variants.flounder-sid.flavors]]
# Tuna Desktop (tuna_rollout above, tunaOS#3207): debian package
# target, signed apt index repo.tunaos.org/tideforge/debian-sid.
# Published as flounder:tuna-sid.
id = "tuna"
stage = 2
platforms = ["linux/amd64"]
build_image = true
build_iso = false
build_qcow2 = false
luks_e2e = false

[[variants.flounder-sid.flavors]]
id = "gnome"
stage = 2
build_image = true

[[variants.flounder-sid.flavors]]
id = "kde"
stage = 2
build_image = true

[[variants.flounder-sid.flavors]]
# No cosmic — same reason as flounder above. The header on this variant
# used to read "Has latest COSMIC natively"; it does not. sid returns
# empty from madison for every cosmic binary, exactly like trixie.
# No niri — same reason as flounder above (absent from Debian sid too).
id = "xfce"
stage = 2
build_image = true

[[variants.flounder-sid.flavors]]
# NVIDIA overlay on the Debian sid base (tunaOS#624) — same mechanism
# as flounder above (apt non-free + dkms). No *-nvidia-hwe: sid has
# no HWE kernel layer, same reasoning as flounder. No ISOs: this
# variant does not build any today (rolling/unstable), so none of its
# base DE flavors set build_iso either — nvidia flavors match that.
#
# platforms is pinned to linux/amd64 explicitly on every *-nvidia
# flavor in this file — asserted by
# tests/bats/test_nvidia_overlay.bats.
id = "gnome-nvidia"
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.flounder-sid.flavors]]
id = "kde-nvidia"
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

[[variants.flounder-sid.flavors]]
id = "xfce-nvidia"
platforms = ["linux/amd64"]
stage = 3
build_image = true
build_iso = false
build_qcow2 = false

# Desktop policy: the same editable source as the build matrix.
[package_groups]

[package_groups.gnome-fedora]
required = [
  "ModemManager",
  "NetworkManager-adsl",
  "NetworkManager-wifi",
  "linux-firmware",
  "amd-gpu-firmware",
  "intel-gpu-firmware",
  "iwlwifi-mvm-firmware",
  "wireless-regdb",
  "iw",
  "NetworkManager-openconnect-gnome",
  "NetworkManager-openvpn-gnome",
  "NetworkManager-ppp",
  "NetworkManager-ssh-gnome",
  "NetworkManager-vpnc-gnome",
  "NetworkManager-wwan",
  "avahi",
  "dconf",
  "fprintd-pam",
  "gdm",
  "glib-networking",
  "gnome-backgrounds",
  "gnome-bluetooth",
  "gnome-browser-connector",
  "gnome-color-manager",
  "gnome-control-center",
  "gnome-disk-utility",
  "gnome-initial-setup",
  "gnome-remote-desktop",
  "gnome-session-wayland-session",
  "gnome-settings-daemon",
  "gnome-shell",
  "gnome-system-monitor",
  "gnome-user-docs",
  "gnome-user-share",
  "gvfs-afc",
  "gvfs-fuse",
  "gvfs-goa",
  "gvfs-gphoto2",
  "gvfs-mtp",
  "gvfs-smb",
  "librsvg2",
  "libsane-hpaio",
  "mesa-dri-drivers",
  "mesa-libEGL",
  "mesa-vulkan-drivers",
  "nautilus",
  "polkit",
  "ptyxis",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs-gtk",
  "yelp",
  "desktop-backgrounds-gnome",
  "pinentry-gnome3",
  "qadwaitadecorations-qt5",
  "evince-thumbnailer",
  "evince-previewer",
  "totem-video-thumbnailer",
]

[package_groups.cosmic-fedora]
required = [
  "dconf",
  "NetworkManager-wifi",
  "linux-firmware",
  "amd-gpu-firmware",
  "intel-gpu-firmware",
  "iwlwifi-mvm-firmware",
  "wireless-regdb",
  "iw",
  "cosmic-session",
  "cosmic-comp",
  "cosmic-panel",
  "cosmic-app-library",
  "cosmic-applets",
  "cosmic-bg",
  "cosmic-files",
  "cosmic-idle",
  "cosmic-launcher",
  "cosmic-notifications",
  "cosmic-osd",
  "cosmic-randr",
  "cosmic-screenshot",
  "cosmic-settings",
  "cosmic-settings-daemon",
  "cosmic-term",
  "cosmic-wallpapers",
  "cosmic-workspaces",
  "cosmic-greeter",
  "cosmic-icon-theme",
  "greetd",
  "xdg-desktop-portal-cosmic",
  "pop-icon-theme",
  "mesa-vulkan-drivers",
]
optional = [
  "cosmic-edit",
  "cosmic-store",
]

[desktops]

# COSMIC Desktop Manifest — Arch Linux / CachyOS
#
# Arch ships COSMIC in [extra], but two names differ from the Fedora set in
# cosmic.yaml: cosmic-term is `cosmic-terminal` and cosmic-edit is
# `cosmic-text-editor`. Using the Fedora names fails the whole build, because
# pacman aborts the transaction on the first unknown target — the same way an
# AUR-only package took marlin:kde down (tuna-os/tunaos-packages#126).
#
# Every package below was verified present in core/extra for x86_64.
[desktops.cosmic-arch]
display_manager = "greetd"
versionlock = []
after_install = [
  "tuna-flatpak-remote",
  "flatpak-preinstall",
  "cosmic-dock",
]

[desktops.cosmic-arch.packages]

[desktops.cosmic-arch.packages.pacman]
required = [
  "cosmic-session",
  "cosmic-comp",
  "cosmic-greeter",
  "greetd",
  "cosmic-panel",
  "cosmic-app-library",
  "cosmic-applets",
  "cosmic-bg",
  "cosmic-launcher",
  "cosmic-notifications",
  "cosmic-osd",
  "cosmic-workspaces",
  "cosmic-idle",
  "cosmic-settings",
  "cosmic-settings-daemon",
  "cosmic-randr",
  "cosmic-screenshot",
  "cosmic-files",
  "cosmic-terminal",
  "cosmic-text-editor",
  "cosmic-store",
  "cosmic-icon-theme",
  "cosmic-wallpapers",
  "pop-icon-theme",
  "xdg-desktop-portal-cosmic",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "networkmanager",
  "pipewire",
  "wireplumber",
  "flatpak",
  "wl-clipboard",
  "power-profiles-daemon",
  "fwupd",
  "plymouth",
  "vulkan-icd-loader",
  "vulkan-swrast",
]

[desktops.cosmic-arch.packages.cachyos]
required = [
  "linux-cachyos",
  "linux-cachyos-headers",
  "cachyos-settings",
]

[[desktops.cosmic-arch.packages.cachyos.repos]]
name = "cachyos"
url = "https://mirror.cachyos.org/repo/$arch/cachyos"

[[desktops.cosmic-arch.packages.cachyos.repos]]
name = "cachyos-extra"
url = "https://mirror.cachyos.org/repo/$arch/cachyos-extra"

# COSMIC Desktop Manifest
[desktops.cosmic]
display_manager = "greetd"
after_inline = [
  "compile-glib-schemas",
  "normalize-greetd-keyring-pam",
  "repair-cosmic-greeter-pam",
]
after_install = [
  "tuna-flatpak-remote",
  "greetd-system-integration",
  "greetd-gtkgreet",
  "flatpak-preinstall",
  "cosmic-dock",
]

[desktops.cosmic.packages]

[desktops.cosmic.packages.apt]
required = [
  "cosmic-session",
  "cosmic-comp",
  "cosmic-panel",
  "cosmic-app-library",
  "cosmic-applets",
  "cosmic-bg",
  "cosmic-files",
  "cosmic-idle",
  "cosmic-launcher",
  "cosmic-notifications",
  "cosmic-osd",
  "cosmic-randr",
  "cosmic-screenshot",
  "cosmic-settings",
  "cosmic-settings-daemon",
  "cosmic-term",
  "cosmic-wallpapers",
  "cosmic-workspaces",
  "cosmic-icons",
  "pop-icon-theme",
  "cosmic-greeter",
  "greetd",
  "xdg-desktop-portal-cosmic",
  "mesa-vulkan-drivers",
]

[[desktops.cosmic.packages.apt.repos]]
name = "tideforge"
uri = "https://repo.tunaos.org/tideforge/ubuntu/"
suite = "./"
keyring_url = "https://repo.tunaos.org/tideforge/ubuntu/tideforge.gpg"
condition = "ubuntu"

[[desktops.cosmic.packages.apt.ppa]]
repo = "ppa:hepp3n/cosmic-epoch"
condition = "ubuntu"

[desktops.cosmic.packages.fedora]
include = [
  "cosmic-fedora",
]

[desktops.cosmic.packages.hummingbird]
include = [
  "cosmic-fedora",
]

[[desktops.cosmic.packages.hummingbird.repos]]
name = "tunaos-hummingbird"
baseurl = "https://repo.tunaos.org/hummingbird/20251124-$basearch/"
priority = 5

[desktops.cosmic.packages.eln]
required = [
  "dconf",
  "cosmic-session",
  "cosmic-comp",
  "cosmic-panel",
  "cosmic-app-library",
  "cosmic-applets",
  "cosmic-bg",
  "cosmic-files",
  "cosmic-idle",
  "cosmic-launcher",
  "cosmic-notifications",
  "cosmic-osd",
  "cosmic-randr",
  "cosmic-screenshot",
  "cosmic-settings",
  "cosmic-settings-daemon",
  "cosmic-term",
  "cosmic-workspaces",
  "cosmic-greeter",
  "cosmic-icon-theme",
  "greetd",
  "xdg-desktop-portal-cosmic",
  "pop-icon-theme",
  "mesa-vulkan-drivers",
]
optional = [
  "cosmic-wallpapers",
  "cosmic-edit",
  "cosmic-store",
]

[desktops.cosmic.packages.el10]
display_manager = "cosmic-greeter"
required = [
  "flatpak",
  "pipewire",
  "wireplumber",
  "wl-clipboard",
  "xdg-user-dirs",
  "zram-generator",
  "cosmic-session",
  "cosmic-comp",
  "cosmic-panel",
  "cosmic-app-library",
  "cosmic-applets",
  "cosmic-bg",
  "cosmic-files",
  "cosmic-idle",
  "cosmic-launcher",
  "cosmic-notifications",
  "cosmic-osd",
  "cosmic-randr",
  "cosmic-screenshot",
  "cosmic-settings",
  "cosmic-settings-daemon",
  "cosmic-term",
  "cosmic-wallpapers",
  "cosmic-workspaces",
  "cosmic-icon-theme",
  "xdg-desktop-portal-cosmic",
  "cosmic-greeter",
  "greetd",
  "gnome-keyring",
  "gnome-keyring-pam",
  "mesa-vulkan-drivers",
]
optional = [
  "brightnessctl",
  "playerctl",
  "cosmic-edit",
  "cosmic-store",
]

[[desktops.cosmic.packages.el10.repos]]
name = "tunaos-cosmic"
baseurl = "https://repo.tunaos.org/repo/10-stream-x86_64/"
priority = 10

[desktops.cosmic.packages.zypper]
required = [
  "cosmic-comp",
  "cosmic-session",
  "cosmic-panel",
  "cosmic-launcher",
  "cosmic-applets",
  "cosmic-bg",
  "cosmic-idle",
  "cosmic-notifications",
  "cosmic-osd",
  "cosmic-randr",
  "cosmic-workspaces",
  "cosmic-files",
  "cosmic-term",
  "cosmic-edit",
  "cosmic-store",
  "cosmic-screenshot",
  "cosmic-icons",
  "cosmic-wallpapers",
  "greetd",
  "gtkgreet",
  "cage",
  "xdg-desktop-portal",
  "xdg-desktop-portal-cosmic",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "gvfs",
  "gvfs-backends",
  "gvfs-fuse",
  "gnome-keyring",
  "gnome-keyring-pam",
  "pipewire",
  "pipewire-pulseaudio",
  "wireplumber",
  "pavucontrol",
  "wl-clipboard",
  "Mesa-dri",
  "Mesa-libEGL1",
  "libvulkan_lvp",
]

# GNOME Desktop Manifest — Arch Linux / CachyOS
[desktops.gnome-arch]
display_manager = "gdm"
versionlock = []
after_install = [
  "tuna-flatpak-remote",
  "flatpak-preinstall",
]

[desktops.gnome-arch.packages]

[desktops.gnome-arch.packages.pacman]
required = [
  "gdm",
  "gnome-shell",
  "gnome-control-center",
  "gnome-settings-daemon",
  "gnome-session",
  "gnome-backgrounds",
  "gnome-color-manager",
  "gnome-disk-utility",
  "gnome-system-monitor",
  "gnome-user-docs",
  "gnome-remote-desktop",
  "gnome-bluetooth-3.0",
  "gnome-browser-connector",
  "gnome-keyring",
  "nautilus",
  "ptyxis",
  "yelp",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs-gtk",
  "gvfs",
  "gvfs-mtp",
  "gvfs-smb",
  "gvfs-gphoto2",
  "gvfs-afc",
  "gvfs-goa",
  "gvfs-onedrive",
  "gst-thumbnailers",
  "evince",
  "networkmanager",
  "pipewire",
  "wireplumber",
  "flatpak",
  "wl-clipboard",
  "mesa",
  "vulkan-icd-loader",
  "xdg-user-dirs",
  "ttf-dejavu",
  "ttf-liberation",
  "noto-fonts",
  "noto-fonts-emoji",
  "ttf-jetbrains-mono-nerd",
]

[desktops.gnome-arch.packages.cachyos]
required = [
  "linux-cachyos",
  "linux-cachyos-headers",
  "cachyos-settings",
]

[[desktops.gnome-arch.packages.cachyos.repos]]
name = "cachyos"
url = "https://mirror.cachyos.org/repo/$arch/cachyos"

# GNOME Desktop Manifest — Debian override (see install-desktop.sh:
# <desktop>-debian.yaml beats <desktop>.yaml on Debian bases).
#
# The generic gnome.yaml apt list is Ubuntu-only (ubuntu-desktop-minimal
# does not exist in Debian). Debian's supported GNOME baseline is the
# gnome-core metapackage; pkg_install runs --no-install-recommends so
# the extras we actually want are listed explicitly.
[desktops.gnome-debian]
display_manager = "gdm3"
after_install = [
  "tuna-flatpak-remote",
  "flatpak-preinstall",
]

[desktops.gnome-debian.packages]

[desktops.gnome-debian.packages.apt]
required = [
  "gnome-core",
  "gnome-disk-utility",
  "gnome-system-monitor",
  "nautilus",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs-gtk",
  "libglib2.0-dev-bin",
]

# GNOME Desktop Manifest
[desktops.gnome]
display_manager = "gdm"
minimum_version = 50
emerge_accept_keywords = [
  "gnome-base/gdm",
  "gnome-base/gnome-control-center",
  "gnome-base/gnome-keyring",
  "gnome-base/gnome-session",
  "gnome-base/gnome-settings-daemon",
  "gnome-base/gnome-shell",
  "gnome-base/gsettings-desktop-schemas",
  "gui-libs/gtk",
  "gui-libs/libadwaita",
  "sys-apps/xdg-desktop-portal-gnome",
  "x11-wm/mutter",
]
versionlock = [
  "glib2",
  "fontconfig",
  "gdm",
  "gnome-shell",
  "mutter",
  "gnome-session-wayland-session",
  "gnome-settings-daemon",
  "gnome-control-center",
  "gsettings-desktop-schemas",
  "gtk4",
  "libadwaita",
  "pango",
  "xdg-desktop-portal",
  "xdg-desktop-portal-gnome",
]
after_install = [
  "tuna-flatpak-remote",
  "flatpak-preinstall",
]

[desktops.gnome.packages]

[desktops.gnome.packages.apt]
required = [
  "ubuntu-desktop-minimal",
  "gnome-session",
  "ubuntu-session",
  "gnome-browser-connector",
  "gnome-disk-utility",
  "gnome-system-monitor",
  "gnome-user-docs",
  "nautilus",
  "yelp",
  "plymouth-theme-spinner",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs-gtk",
  "gnome-keyring",
  "libpam-gnome-keyring",
]

[desktops.gnome.packages.fedora]
include = [
  "gnome-fedora",
]
optional = [
  "gvfs-afp",
  "gvfs-archive",
]
exclude = [
  "PackageKit",
  "PackageKit-command-not-found",
  "gnome-software",
  "gnome-software-fedora-langpacks",
]

[desktops.gnome.packages.hummingbird]
include = [
  "gnome-fedora",
]

[[desktops.gnome.packages.hummingbird.repos]]
name = "tunaos-hummingbird"
baseurl = "https://repo.tunaos.org/hummingbird/20251124-$basearch/"
priority = 5

[[desktops.gnome.packages.hummingbird.repos]]
name = "utah-packages"
baseurl = "file:///run/utah-packages"
priority = 4
unsigned = true

[desktops.gnome.packages.eln]
required = [
  "ModemManager",
  "NetworkManager-adsl",
  "NetworkManager-openvpn-gnome",
  "NetworkManager-ppp",
  "NetworkManager-wwan",
  "avahi",
  "dconf",
  "fprintd-pam",
  "gdm",
  "glib-networking",
  "gnome-bluetooth",
  "gnome-browser-connector",
  "gnome-color-manager",
  "gnome-control-center",
  "gnome-disk-utility",
  "gnome-initial-setup",
  "gnome-keyring",
  "gnome-keyring-pam",
  "gnome-remote-desktop",
  "gnome-session-wayland-session",
  "gnome-settings-daemon",
  "gnome-shell",
  "gnome-system-monitor",
  "gnome-user-docs",
  "gvfs-fuse",
  "gvfs-goa",
  "gvfs-gphoto2",
  "gvfs-mtp",
  "gvfs-smb",
  "librsvg2",
  "libsane-hpaio",
  "mesa-dri-drivers",
  "mesa-libEGL",
  "mesa-vulkan-drivers",
  "nautilus",
  "polkit",
  "ptyxis",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs-gtk",
  "yelp",
  "desktop-backgrounds-gnome",
  "pinentry-gnome3",
]
optional = [
  "NetworkManager-openconnect-gnome",
  "NetworkManager-ssh-gnome",
  "NetworkManager-vpnc-gnome",
  "evince-previewer",
  "evince-thumbnailer",
  "gnome-backgrounds",
  "gnome-user-share",
  "gvfs-afc",
  "qadwaitadecorations-qt5",
  "totem-video-thumbnailer",
  "gvfs-afp",
  "gvfs-archive",
]
exclude = [
  "PackageKit",
  "PackageKit-command-not-found",
  "gnome-software",
  "gnome-software-fedora-langpacks",
]

[desktops.gnome.packages.el10]
before_install = [
  "upgrade-el10-gnome-runtime",
  "install-el10-gnome-compat",
  "remove-el10-gnome-shell-common",
]
groups = [
  "Common NetworkManager submodules",
  "Core",
  "Fonts",
  "Guest Desktop Agents",
  "Hardware Support",
  "Printing Client",
  "Standard",
  "Workstation product core",
]
group_options = "--nobest --allowerasing"
group_exclude = [
  "PackageKit",
  "PackageKit-command-not-found",
]
required = [
  "gdm",
  "glib2",
  "gnome-bluetooth",
  "gnome-color-manager",
  "gnome-control-center",
  "gnome-initial-setup",
  "gnome-remote-desktop",
  "gnome-session-wayland-session",
  "gnome-settings-daemon",
  "gnome-shell",
  "gnome-shell-common",
  "gnome-user-docs",
  "gvfs-fuse",
  "gvfs-goa",
  "gvfs-gphoto2",
  "gvfs-mtp",
  "gvfs-smb",
  "libsane-hpaio",
  "nautilus",
  "dbus-daemon",
  "orca",
  "ptyxis",
  "sane-backends-drivers-scanners",
  "xdg-desktop-portal-gnome",
  "xdg-user-dirs-gtk",
  "yelp-tools",
  "gnome-disk-utility",
  "NetworkManager-adsl",
]
exclude = [
  "gnome-software",
  "gnome-extensions-app",
  "PackageKit",
  "PackageKit-command-not-found",
  "gnome-software-fedora-langpacks",
]

[[desktops.gnome.packages.el10.repos]]
name = "gnome50-el10-packages"
baseurl = "file:///run/gnome50-el10-packages"
priority = 1
unsigned = true

[desktops.gnome.packages.zypper]
required = [
  "patterns-gnome-gnome",
  "patterns-gnome-gnome_basis",
  "gdm",
  "gnome-session",
  "gnome-settings-daemon",
  "gnome-control-center",
  "gnome-browser-connector",
  "gnome-menus",
  "gnome-backgrounds",
  "nautilus",
  "gvfs",
  "gvfs-backends",
  "gvfs-fuse",
  "gnome-keyring",
  "gnome-keyring-pam",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs-gtk",
  "ModemManager",
  "NetworkManager-openvpn",
  "NetworkManager-openconnect",
  "NetworkManager-vpnc",
  "gnome-bluetooth",
  "power-profiles-daemon",
  "switcheroo-control",
  "fwupd",
  "fprintd-pam",
  "gnome-color-manager",
  "gnome-disk-utility",
  "simple-scan",
  "gnome-initial-setup",
  "gnome-software",
  "gnome-system-monitor",
  "gnome-console",
  "gnome-text-editor",
  "gnome-calculator",
  "gnome-font-viewer",
  "gnome-characters",
  "gnome-logs",
  "loupe",
  "evince",
  "file-roller",
  "baobab",
  "seahorse",
  "gnome-online-accounts",
  "gnome-remote-desktop",
  "gnome-user-share",
  "localsearch",
  "tinysparql",
  "orca",
  "yelp",
  "gnome-user-docs",
  "Mesa-dri",
  "Mesa-libEGL1",
  "Mesa-vulkan-device-select",
  "librsvg-2-2",
  "glib-networking",
  "avahi",
  "dconf",
  "polkit",
  "pinentry-gnome3",
]

[desktops.gnome.packages.emerge]
required = [
  "gnome-base/gnome-light",
  "gnome-base/gdm",
  "gnome-base/dconf",
]

# KDE Plasma Desktop Manifest — Arch Linux / CachyOS
# Pacman package names differ from RPM/apt names.
[desktops.kde-arch]
display_manager = "sddm"
versionlock = []
disable_desktop_files = [
  "org.kde.discover.desktop",
  "org.kde.discover.urlhandler.desktop",
]
after_install = [
  "tuna-flatpak-remote",
  "kcm-ublue",
  "flatpak-preinstall",
]

[desktops.kde-arch.packages]

[desktops.kde-arch.packages.pacman]
required = [
  "plasma-desktop",
  "sddm",
  "dolphin",
  "konsole",
  "kate",
  "ark",
  "kdeconnect",
  "xdg-desktop-portal-kde",
  "qt6-wayland",
  "qt5-wayland",
  "ksshaskpass",
  "ksystemlog",
  "libratbag",
  "solaar",
  "pam-u2f",
  "yubikey-manager",
  "nvtop",
  "networkmanager",
  "pipewire",
  "wireplumber",
  "xdg-user-dirs",
  "flatpak",
  "wl-clipboard",
  "power-profiles-daemon",
  "fwupd",
  "plymouth",
]

[desktops.kde-arch.packages.cachyos]
required = [
  "linux-cachyos",
  "linux-cachyos-headers",
  "cachyos-settings",
  "cachyos-keyring",
  "cachyos-mirrorlist",
]

[[desktops.kde-arch.packages.cachyos.repos]]
name = "cachyos"
url = "https://mirror.cachyos.org/repo/$arch/cachyos"

[[desktops.kde-arch.packages.cachyos.repos]]
name = "cachyos-extra"
url = "https://mirror.cachyos.org/repo/$arch/cachyos-extra"

# KDE Plasma Desktop Manifest — Debian
# Uses the same apt path as Ubuntu but with Debian-specific package names.
[desktops.kde-debian]
display_manager = "sddm"
versionlock = []
disable_desktop_files = [
  "org.kde.discover.desktop",
]
after_install = [
  "tuna-flatpak-remote",
  "flatpak-preinstall",
]

[desktops.kde-debian.packages]

[desktops.kde-debian.packages.apt]
required = [
  "kde-plasma-desktop",
  "sddm",
  "dolphin",
  "konsole",
  "kate",
  "ark",
  "kdeconnect",
  "xdg-desktop-portal-kde",
  "qt6-wayland",
  "network-manager",
  "pipewire",
  "wireplumber",
  "flatpak",
  "fwupd",
  "plymouth",
  "power-profiles-daemon",
]

# KDE Plasma Desktop Manifest
# Declares what goes into a KDE image — packages, services, config.
# The generic installer (install-desktop.sh) reads this and applies it.
[desktops.kde]
display_manager = "sddm"
versionlock = [
  "plasma-desktop",
  "qt6-*",
]
disable_desktop_files = [
  "org.kde.discover.desktop",
  "org.kde.discover.urlhandler.desktop",
]
after_install = [
  "tuna-flatpak-remote",
  "kcm-ublue",
  "flatpak-preinstall",
]

[desktops.kde.packages]

[desktops.kde.packages.apt]
required = [
  "kde-plasma-desktop",
  "sddm",
  "dolphin",
  "konsole",
  "kate",
  "ark",
  "kdeconnect",
  "xdg-desktop-portal-kde",
  "qt6-wayland",
]

[desktops.kde.packages.fedora]
groups = [
  "kde-desktop",
]
required = [
  "sddm",
  "dolphin",
  "konsole",
  "kate",
  "ark",
  "plasma-discover",
  "kde-connect",
  "xdg-desktop-portal-kde",
  "qt5-qtwayland",
  "qt6-qtwayland",
  "ksshaskpass",
  "ksystemlog",
  "input-remapper",
  "evtest",
  "tesseract",
  "libratbag-ratbagd",
  "solaar-udev",
  "openrgb-udev-rules",
  "pam-u2f",
  "pam_yubico",
  "pamu2fcfg",
  "yubikey-manager",
  "nvtop",
]
exclude = [
  "PackageKit",
  "PackageKit-command-not-found",
]

[desktops.kde.packages.eln]
display_manager = "plasmalogin"
groups = [
  "kde-desktop",
]
required = [
  "dolphin",
  "konsole",
  "kate",
  "ark",
  "plasma-discover",
  "kde-connect",
  "xdg-desktop-portal-kde",
  "qt5-qtwayland",
  "qt6-qtwayland",
  "ksshaskpass",
  "ksystemlog",
  "tesseract",
  "pam-u2f",
  "pam_yubico",
  "nvtop",
]
optional = [
  "input-remapper",
  "evtest",
  "libratbag-ratbagd",
  "solaar-udev",
  "openrgb-udev-rules",
  "pamu2fcfg",
  "yubikey-manager",
]
exclude = [
  "PackageKit",
  "PackageKit-command-not-found",
]

[desktops.kde.packages.el10]
groups = [
  "KDE Plasma Workspaces",
  "Common NetworkManager submodules",
  "Core",
  "Fonts",
  "Guest Desktop Agents",
  "Hardware Support",
  "Printing Client",
  "Standard",
]
group_options = "--nobest"
group_exclude = [
  "plasma-discover",
  "plasma-discover-notifier",
  "plasma-nm-vpnc",
  "pinentry-qt",
  "plasma-workspace-wayland",
  "plasma-workspace-geolocation",
  "plasma-drkonqi",
]
required = [
  "plasma-desktop",
  "plasma-workspace",
  "sddm",
  "dolphin",
  "konsole",
  "kate",
  "ark",
  "xdg-desktop-portal-kde",
  "qt5-qtwayland",
  "qt6-qtwayland",
]
exclude = [
  "PackageKit",
  "PackageKit-command-not-found",
]
optional = [
  "kde-connect",
  "ksshaskpass",
  "ksystemlog",
  "input-remapper",
  "evtest",
  "tesseract",
  "libratbag-ratbagd",
  "solaar-udev",
  "openrgb-udev-rules",
  "pam-u2f",
  "pam_yubico",
  "pamu2fcfg",
  "yubikey-manager",
  "nvtop",
]
optional_group = [
  "fcitx5",
  "fcitx5-chewing",
  "fcitx5-chinese-addons",
  "fcitx5-gtk",
  "fcitx5-hangul",
  "fcitx5-m17n",
  "fcitx5-mozc",
  "fcitx5-qt",
  "fcitx5-sayura",
  "fcitx5-unikey",
  "kcm-fcitx5",
]

[desktops.kde.packages.zypper]
required = [
  "patterns-kde-kde",
  "patterns-kde-kde_plasma",
  "sddm",
  "dolphin",
  "konsole",
  "kate",
  "ark",
  "gwenview",
  "okular",
  "spectacle",
  "kcalc",
  "filelight",
  "kfind",
  "kwalletmanager",
  "khelpcenter",
  "kdeconnect-kde",
  "partitionmanager",
  "plasma6-nm",
  "plasma6-pa",
  "plasma6-systemmonitor",
  "plasma6-disks",
  "plasma6-firewall",
  "plasma6-thunderbolt",
  "bluedevil6",
  "kdeplasma6-addons",
  "plasma6-workspace-wallpapers",
  "xdg-desktop-portal",
  "xdg-desktop-portal-kde6",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "xdg-user-dirs-gtk",
  "kio-extras",
  "kdegraphics-thumbnailers",
  "ffmpegthumbs",
  "kf6-kimageformats",
  "kdenetwork-filesharing",
  "gvfs",
  "gvfs-backends",
  "gvfs-fuse",
  "NetworkManager-openvpn",
  "NetworkManager-openconnect",
  "NetworkManager-vpnc",
  "power-profiles-daemon",
  "switcheroo-control",
  "fwupd",
  "Mesa-dri",
  "Mesa-libEGL1",
]

[desktops.kde.packages.emerge]
required = [
  "kde-plasma/plasma-meta",
  "x11-misc/sddm",
  "kde-apps/dolphin",
  "kde-apps/konsole",
  "kde-apps/kate",
  "kde-apps/ark",
]

# niri Desktop Manifest — Arch Linux / CachyOS
#
# niri.yaml builds the Fedora set out of three COPRs (yalter/niri-git,
# avengemedia/danklinux, avengemedia/dms-git). Arch ships niri itself in
# [extra], so no third-party repo is needed here — but the DankMaterialShell
# pieces (quickshell, dms, dms-greeter) have no Arch equivalent in the official
# repos, so this is a plain niri session rather than a DMS one.
#
# Two name differences from the Fedora list: SwayNotificationCenter is `swaync`
# and adw-gtk3-theme is `adw-gtk-theme`.
#
# Every package below was verified present in core/extra for x86_64.

# GREETER: there is no DMS greeter here, but there IS an official graphical one.
#
# This file used to claim "Arch has no official equivalent" and left greetd on
# its packaged config. That config runs `agreety --cmd /bin/sh`, and agreety is
# NOT part of Arch's greetd package: it ships in greetd-agreety, which nothing
# installed. So greetd came up pointed at a binary that was not on the image:
#
#   $ pacman -Ql greetd | grep bin/
#   greetd /usr/bin/greetd          <- and nothing else
#   $ pacman -F usr/bin/agreety
#   usr/bin/agreety is owned by extra/greetd-agreety
#
# With Restart=always in the packaged unit that is a restart loop, not the text
# prompt the old comment assumed. Arch does carry the same fallback stack
# openSUSE uses, greetd-gtkgreet (/usr/bin/gtkgreet) and cage, both in
# [extra], so wire that up instead, via the shared greetd-gtkgreet.sh below.
#
# Still absent, and still a real gap: the DankMaterialShell session (quickshell,
# dms, dms-greeter) has no official Arch packaging, so this is a plain niri
# session with a gtkgreet login rather than a DMS one.
[desktops.niri-arch]
display_manager = "greetd"
versionlock = []
after_install = [
  "tuna-flatpak-remote",
  "greetd-gtkgreet",
  "flatpak-preinstall",
]

[desktops.niri-arch.packages]

[desktops.niri-arch.packages.pacman]
required = [
  "niri",
  "greetd",
  "greetd-gtkgreet",
  "cage",
  "xwayland-satellite",
  "waybar",
  "fuzzel",
  "swaync",
  "swaylock",
  "swayidle",
  "swaybg",
  "cliphist",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "xdg-user-dirs-gtk",
  "polkit-gnome",
  "gnome-keyring",
  "wl-clipboard",
  "networkmanager",
  "pipewire",
  "wireplumber",
  "pavucontrol",
  "brightnessctl",
  "playerctl",
  "blueman",
  "power-profiles-daemon",
  "fwupd",
  "plymouth",
  "nautilus",
  "flatpak",
  "adw-gtk-theme",
  "papirus-icon-theme",
  "vulkan-icd-loader",
  "vulkan-swrast",
]

[desktops.niri-arch.packages.cachyos]
required = [
  "linux-cachyos",
  "linux-cachyos-headers",
  "cachyos-settings",
]

[[desktops.niri-arch.packages.cachyos.repos]]
name = "cachyos"
url = "https://mirror.cachyos.org/repo/$arch/cachyos"

[[desktops.niri-arch.packages.cachyos.repos]]
name = "cachyos-extra"
url = "https://mirror.cachyos.org/repo/$arch/cachyos-extra"

# Niri (Tiling Wayland Compositor) + DMS Desktop Manifest
[desktops.niri]
display_manager = "greetd"
versionlock = [
  "glib2",
]
after_inline = [
  "compile-glib-schemas",
  "normalize-greetd-keyring-pam",
]
after_install = [
  "tuna-flatpak-remote",
  "greetd-gtkgreet",
  "dms-qml-payload",
  "flatpak-preinstall",
]

[desktops.niri.packages]

[desktops.niri.packages.fedora]
required = [
  "greetd",
  "greetd-selinux",
  "swaylock",
  "SwayNotificationCenter",
  "waybar",
  "fuzzel",
  "swayidle",
  "swaybg",
  "wl-clipboard",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "pipewire",
  "wireplumber",
  "NetworkManager-tui",
  "brightnessctl",
  "playerctl",
  "blueman",
  "pavucontrol",
  "gnome-keyring",
  "gnome-keyring-pam",
  "nautilus",
  "adw-gtk3-theme",
  "papirus-icon-theme",
  "mesa-vulkan-drivers",
]
optional = [
  "polkit-gnome",
]

[[desktops.niri.packages.fedora.copr]]
repo = "yalter/niri-git"
packages = [
  "niri",
]

[[desktops.niri.packages.fedora.copr]]
repo = "avengemedia/danklinux"
packages = [
  "quickshell-git",
  "dms-greeter",
]

[[desktops.niri.packages.fedora.copr]]
repo = "avengemedia/dms-git"
packages = [
  "dms",
  "dms-cli",
]

[desktops.niri.packages.el10]
required = [
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "pipewire",
  "wireplumber",
  "polkit-kde",
  "NetworkManager-tui",
  "nautilus",
  "pavucontrol",
  "gnome-keyring",
  "gnome-keyring-pam",
  "papirus-icon-theme",
  "mesa-vulkan-drivers",
]

[[desktops.niri.packages.el10.copr]]
repo = "yalter/niri-git"
packages = [
  "niri",
]

[[desktops.niri.packages.el10.copr]]
repo = "yselkowitz/wlroots-epel"
packages = [
  "swaylock",
  "SwayNotificationCenter",
  "waybar",
  "fuzzel",
  "swayidle",
  "wl-clipboard",
  "brightnessctl",
  "playerctl",
]

[[desktops.niri.packages.el10.copr]]
repo = "yselkowitz/cosmic-epel"
packages = [
  "greetd",
  "greetd-selinux",
  "adw-gtk3-theme",
]
options = "--nobest --allowerasing"

[[desktops.niri.packages.el10.copr]]
repo = "avengemedia/danklinux"
packages = [
  "quickshell-git",
  "dms-greeter",
]

[[desktops.niri.packages.el10.copr]]
repo = "avengemedia/dms-git"
packages = [
  "dms",
  "dms-cli",
]
options = "--enablerepo=copr:copr.fedorainfracloud.org:yselkowitz:cosmic-epel"

[desktops.niri.packages.zypper]
required = [
  "niri",
  "greetd",
  "gtkgreet",
  "cage",
  "swaybg",
  "xwayland-satellite",
  "waybar",
  "fuzzel",
  "SwayNotificationCenter",
  "swayidle",
  "swaylock",
  "wl-clipboard",
  "alacritty",
  "nautilus",
  "gvfs",
  "gvfs-backends",
  "gvfs-fuse",
  "gnome-keyring",
  "gnome-keyring-pam",
  "polkit-gnome",
  "xdg-desktop-portal",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "pipewire",
  "pipewire-pulseaudio",
  "wireplumber",
  "pavucontrol",
  "NetworkManager-applet",
  "blueman",
  "brightnessctl",
  "playerctl",
  "papirus-icon-theme",
  "adwaita-icon-theme",
  "Mesa-dri",
  "Mesa-libEGL1",
  "libvulkan_lvp",
]

# Pantheon Desktop Manifest (elementary OS)
#
# Pantheon is NOT in the Ubuntu archive. Verified against ubuntu:resolute with
# main+universe+restricted+multiverse all enabled: gala, wingpanel,
# pantheon-session and switchboard are all ABSENT; only `plank` exists. The
# desktop comes exclusively from elementary's own PPA.
#
# That PPA publishes for **noble (24.04) and jammy (22.04) only** — there is
# nothing for resolute (26.04). This is why Pantheon is a variant on a noble
# base rather than a grouper flavour: grouper is Ubuntu 26.04, where this
# desktop cannot be installed at all today.
#
# Every package name below was verified published for noble via the Launchpad
# API (getPublishedBinaries, exact_match, status=Published) rather than
# guessed. Names in this ecosystem are not guessable — the reverse-DNS
# `io.elementary.*` scheme is used for some components and bare names for
# others, and several obvious guesses resolve to nothing:
#   pantheon-desktop            -> does not exist
#   pantheon-session            -> does not exist (see io.elementary.session)
#   io.elementary.files         -> not published for noble in this PPA
#   pantheon-session-settings   -> not published for noble in this PPA
# Do not add an unverified name here. An unresolvable name is what shipped a
# desktop-less image in tunaos-packages#132.
[desktops.pantheon]
display_manager = "lightdm"
after_install = [
  "tuna-flatpak-remote",
  "flatpak-preinstall",
]

[desktops.pantheon.packages]

[desktops.pantheon.packages.apt]
required = [
  "gala",
  "io.elementary.wingpanel",
  "wingpanel",
  "io.elementary.greeter",
  "pantheon-agent-polkit",
  "elementary-default-settings",
  "elementary-icon-theme",
  "io.elementary.terminal",
  "io.elementary.settings-daemon",
  "pantheon-xsession-settings",
  "lightdm",
  "xserver-xorg",
  "accountsservice",
  "xdg-desktop-portal",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs-gtk",
  "gnome-keyring",
  "gvfs",
  "gvfs-backends",
  "gvfs-fuse",
]

[[desktops.pantheon.packages.apt.ppa]]
repo = "ppa:elementary-os/stable"
condition = "ubuntu"

# Tuna Desktop (formerly Roost, renamed in tuna-desktop#536) on every TunaOS
# variant with a published package target (tuna-desktop ADR 0008, epic #577).
# Marlin was the first cell (tunaOS#2990); its Containerfile installs the
# in-house Tideforge key/repository and qualifies this package so official
# packages stay first. tuna-desktop provides roost and ships its compat
# names, so nothing here may name the old `roost` package.
#
# Variants without a cell are recorded with their reason under
# `unsupported_flavors` in .github/build-config.yml.
[desktops.tuna]
display_manager = "greetd"
versionlock = []
after_install = [
  "tuna-flatpak-remote",
  "greetd-system-integration",
  "greetd-gtkgreet",
  "flatpak-preinstall",
]

[desktops.tuna.packages]

[desktops.tuna.packages.pacman]
required = [
  "tunaos/tuna-desktop=1.0.0beta.1-1",
  "greetd",
  "greetd-gtkgreet",
  "cage",
  "xorg-xwayland",
  "ibus",
  "orca",
  "gnome-shell",
  "gnome-settings-daemon",
  "gnome-control-center",
  "gnome-keyring",
  "evolution-data-server",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "gvfs",
  "nautilus",
  "ptyxis",
  "networkmanager",
  "libsecret",
  "pipewire",
  "wireplumber",
  "gst-plugin-pipewire",
  "gst-plugins-good",
  "power-profiles-daemon",
  "upower",
  "flatpak",
  "plymouth",
  "adwaita-icon-theme",
  "noto-fonts",
  "noto-fonts-emoji",
  "ttf-dejavu",
  "ttf-liberation",
]

[desktops.tuna.packages.el10]
display_manager = "greetd"
required = [
  "tuna-desktop-1.0.0~beta.1-1.el10",
  "dbus-tools",
  "orca",
  "greetd",
  "gtkgreet",
  "cage",
  "xorg-x11-server-Xwayland",
  "ibus",
  "gnome-shell",
  "gnome-settings-daemon",
  "gnome-control-center",
  "gnome-keyring",
  "evolution-data-server",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "gvfs",
  "nautilus",
  "ptyxis",
  "NetworkManager",
  "libsecret",
  "pipewire",
  "wireplumber",
  "pipewire-gstreamer",
  "gstreamer1-plugins-good",
  "upower",
  "flatpak",
  "plymouth",
  "adwaita-icon-theme",
  "google-noto-sans-fonts",
  "google-noto-color-emoji-fonts",
  "dejavu-sans-fonts",
  "liberation-fonts",
]

[[desktops.tuna.packages.el10.repos]]
name = "tunaos-el10"
baseurl = "https://repo.tunaos.org/repo/10/x86_64/"
priority = 100

[[desktops.tuna.packages.el10.repos]]
name = "tunaos-xfce"
baseurl = "https://repo.tunaos.org/xfce/10-stream-x86_64/"
priority = 100

[desktops.tuna.packages.fedora]
display_manager = "greetd"
required = [
  "tuna-desktop-1.0.0~beta.1-1.fc44",
  "dbus-tools",
  "orca",
  "greetd",
  "gtkgreet",
  "cage",
  "xorg-x11-server-Xwayland",
  "ibus",
  "gnome-shell",
  "gnome-settings-daemon",
  "gnome-control-center",
  "gnome-keyring",
  "evolution-data-server",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "gvfs",
  "nautilus",
  "ptyxis",
  "NetworkManager",
  "libsecret",
  "pipewire",
  "wireplumber",
  "pipewire-gstreamer",
  "gstreamer1-plugins-good",
  "tuned-ppd",
  "upower",
  "flatpak",
  "plymouth",
  "adwaita-icon-theme",
  "google-noto-sans-fonts",
  "google-noto-color-emoji-fonts",
  "dejavu-sans-fonts",
  "liberation-fonts",
]

[[desktops.tuna.packages.fedora.repos]]
name = "tunaos-fedora"
baseurl = "https://repo.tunaos.org/xfce/44-x86_64/"
priority = 100

[desktops.tuna.packages.eln]
display_manager = "greetd"
required = [
  "tuna-desktop-1.0.0~beta.1-1.eln159",
  "dbus-tools",
  "orca",
  "greetd",
  "gtkgreet",
  "cage",
  "xorg-x11-server-Xwayland",
  "ibus",
  "gnome-shell",
  "gnome-settings-daemon",
  "gnome-control-center",
  "gnome-keyring",
  "evolution-data-server",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "gvfs",
  "nautilus",
  "ptyxis",
  "NetworkManager",
  "libsecret",
  "pipewire",
  "wireplumber",
  "pipewire-gstreamer",
  "gstreamer1-plugins-good",
  "tuned-ppd",
  "upower",
  "flatpak",
  "plymouth",
  "adwaita-icon-theme",
  "google-noto-sans-fonts",
  "google-noto-color-emoji-fonts",
  "dejavu-sans-fonts",
  "liberation-fonts",
]

[[desktops.tuna.packages.eln.repos]]
name = "tunaos-eln"
baseurl = "https://repo.tunaos.org/rpm/eln/x86_64/"
priority = 100

[desktops.tuna.packages.rawhide]
display_manager = "greetd"
required = [
  "tuna-desktop-1.0.0~beta.1-1.fc46",
  "dbus-tools",
  "orca",
  "greetd",
  "gtkgreet",
  "cage",
  "xorg-x11-server-Xwayland",
  "ibus",
  "gnome-shell",
  "gnome-settings-daemon",
  "gnome-control-center",
  "gnome-keyring",
  "evolution-data-server",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "gvfs",
  "nautilus",
  "ptyxis",
  "NetworkManager",
  "libsecret",
  "pipewire",
  "wireplumber",
  "pipewire-gstreamer",
  "gstreamer1-plugins-good",
  "tuned-ppd",
  "upower",
  "flatpak",
  "plymouth",
  "adwaita-icon-theme",
  "google-noto-sans-fonts",
  "google-noto-color-emoji-fonts",
  "dejavu-sans-fonts",
  "liberation-fonts",
]

[[desktops.tuna.packages.rawhide.repos]]
name = "tunaos-rawhide"
baseurl = "https://repo.tunaos.org/rpm/rawhide/x86_64/"
priority = 100

[desktops.tuna.packages.apt]
required = [
  "tuna-desktop=1.0.0~beta.1-1",
  "orca",
  "greetd",
  "gtkgreet",
  "cage",
  "xwayland",
  "ibus",
  "gnome-shell",
  "gnome-settings-daemon",
  "gnome-control-center",
  "gnome-keyring",
  "libpam-gnome-keyring",
  "evolution-data-server",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "gvfs",
  "nautilus",
  "ptyxis",
  "network-manager",
  "libsecret-1-0",
  "pipewire",
  "wireplumber",
  "gstreamer1.0-pipewire",
  "gstreamer1.0-plugins-good",
  "power-profiles-daemon",
  "upower",
  "flatpak",
  "plymouth",
  "adwaita-icon-theme",
  "fonts-noto-core",
  "fonts-noto-color-emoji",
  "fonts-dejavu-core",
  "fonts-liberation",
]

[[desktops.tuna.packages.apt.repos]]
name = "tideforge"
uri = "https://repo.tunaos.org/tideforge/ubuntu/"
suite = "./"
keyring_url = "https://repo.tunaos.org/tideforge/ubuntu/tideforge.gpg"
condition = "ubuntu"

[[desktops.tuna.packages.apt.repos]]
name = "tideforge"
uri = "https://repo.tunaos.org/tideforge/debian-sid/"
suite = "./"
keyring_url = "https://repo.tunaos.org/tideforge/debian-sid/tideforge.gpg"
condition = "debian-sid"

[[desktops.tuna.packages.apt.repos]]
name = "tideforge"
uri = "https://repo.tunaos.org/tideforge/debian-trixie/"
suite = "./"
keyring_url = "https://repo.tunaos.org/tideforge/debian-trixie/tideforge.gpg"
condition = "debian-trixie"

[desktops.tuna.packages.zypper]
display_manager = "greetd"
required = [
  "tuna-desktop-1.0.0~beta.1-1",
  "dbus-1-tools",
  "orca",
  "greetd",
  "gtkgreet",
  "cage",
  "xwayland",
  "ibus",
  "gnome-shell",
  "gnome-shell-calendar",
  "gnome-settings-daemon",
  "gnome-control-center",
  "gnome-keyring",
  "gnome-keyring-pam",
  "evolution-data-server",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "gvfs",
  "nautilus",
  "ptyxis",
  "NetworkManager",
  "libsecret-1-0",
  "pipewire",
  "wireplumber",
  "gstreamer-plugin-pipewire",
  "gstreamer-plugins-good",
  "power-profiles-daemon",
  "upower",
  "flatpak",
  "plymouth",
  "adwaita-icon-theme",
  "google-noto-sans-fonts",
  "google-noto-coloremoji-fonts",
  "dejavu-fonts",
  "liberation-fonts",
]

[[desktops.tuna.packages.zypper.repos]]
name = "tunaos-opensuse"
baseurl = "https://repo.tunaos.org/rpm/opensuse-tumbleweed/x86_64/"

# XFCE Desktop Manifest — Arch Linux / CachyOS
#
# xfce.yaml installs Fedora's `xfce-desktop` group. Arch has an `xfce4` group
# too, but groups expand to whatever the mirror holds on the day and pacman
# --noconfirm takes all of it, so the set is listed explicitly here instead —
# a build should not change shape because a group gained a member upstream.
#
# Note this is the X11 xfwm4 session. tunaOS prefers a Wayland compositor for
# XFCE where one exists (xfwl4/labwc, see live-iso/common/src/desktop-xfce.sh),
# and Arch has no xfwl4 package — so on marlin, XFCE is X11 only until
# tuna-os/tunaos-packages#123 lands.
#
# Every package below was verified present in core/extra for x86_64.
[desktops.xfce-arch]
display_manager = "gdm"
versionlock = []
after_install = [
  "tuna-flatpak-remote",
  "flatpak-preinstall",
]

[desktops.xfce-arch.packages]

[desktops.xfce-arch.packages.pacman]
required = [
  "xfce4-session",
  "xfwm4",
  "xfce4-panel",
  "xfce4-settings",
  "xfce4-appfinder",
  "xfconf",
  "xfdesktop",
  "gdm",
  "xfce4-power-manager",
  "xfce4-notifyd",
  "xfce4-screenshooter",
  "xfce4-taskmanager",
  "xfce4-pulseaudio-plugin",
  "thunar",
  "thunar-volman",
  "thunar-archive-plugin",
  "xfce4-terminal",
  "mousepad",
  "ristretto",
  "file-roller",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "xdg-user-dirs-gtk",
  "network-manager-applet",
  "networkmanager",
  "pipewire",
  "wireplumber",
  "flatpak",
  "wl-clipboard",
  "power-profiles-daemon",
  "fwupd",
  "plymouth",
]

[desktops.xfce-arch.packages.cachyos]
required = [
  "linux-cachyos",
  "linux-cachyos-headers",
  "cachyos-settings",
]

[[desktops.xfce-arch.packages.cachyos.repos]]
name = "cachyos"
url = "https://mirror.cachyos.org/repo/$arch/cachyos"

[[desktops.xfce-arch.packages.cachyos.repos]]
name = "cachyos-extra"
url = "https://mirror.cachyos.org/repo/$arch/cachyos-extra"

# XFCE Desktop Manifest — Debian override.
#
# Debian sid's gdm3 pulls the GNOME stack. During the GNOME 50→51
# transition, sid's libgjs0 explicitly Breaks the available gnome-shell,
# which makes an otherwise independent XFCE build impossible to resolve.
# XFCE does not require GNOME or gdm3, so use LightDM on Debian bases.
[desktops.xfce-debian]
display_manager = "lightdm"
after_install = [
  "tuna-flatpak-remote",
  "flatpak-preinstall",
]

[desktops.xfce-debian.packages]

[desktops.xfce-debian.packages.apt]
required = [
  "xfce4",
  "xfce4-goodies",
  "lightdm",
  "lightdm-gtk-greeter",
  "xserver-xorg",
  "accountsservice",
  "xdg-desktop-portal-gtk",
  "thunar",
  "mousepad",
]

# XFCE 4.20 Desktop Manifest (Wayland — xfwl4 compositor)
[desktops.xfce]
display_manager = "gdm"
versionlock = [
  "glib2",
]
after_install = [
  "xfce-greeter",
  "xfwm4-theme",
  "tuna-flatpak-remote",
  "flatpak-preinstall",
]

[desktops.xfce.packages]

[desktops.xfce.packages.fedora]
groups = [
  "xfce-desktop",
]
required = [
  "gdm",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs-gtk",
  "thunar",
  "mousepad",
  "ristretto",
  "xfce4-terminal",
]
optional = [
  "xfce4-wayland",
]

[desktops.xfce.packages.el10]
display_manager = "greetd"
required = [
  "xfwl4",
  "xfce4-session",
  "xfce4-panel",
  "xfce4-settings",
  "xfdesktop",
  "thunar",
  "tumbler",
  "xfce4-terminal",
  "xfce4-appfinder",
  "xfce4-notifyd",
  "xfce4-power-manager",
  "xfce4-screenshooter",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs-gtk",
]
optional = [
  "xfce4-whiskermenu-plugin",
  "xfce4-clipman-plugin",
  "mousepad",
  "ristretto",
]

[[desktops.xfce.packages.el10.repos]]
name = "tunaos-xfce"
baseurl = "https://repo.tunaos.org/xfce/10-stream-x86_64/"
priority = 10

[[desktops.xfce.packages.el10.copr]]
repo = "yselkowitz/cosmic-epel"
packages = [
  "greetd",
  "greetd-selinux",
]
options = "--nobest --allowerasing"

[desktops.xfce.packages.apt]
required = [
  "xfce4",
  "xfce4-goodies",
  "gdm3",
  "xdg-desktop-portal-gtk",
  "thunar",
  "mousepad",
]

[desktops.xfce.packages.zypper]
display_manager = "lightdm"
required = [
  "patterns-xfce-xfce",
  "patterns-xfce-xfce_basis",
  "lightdm",
  "lightdm-gtk-greeter",
  "thunar",
  "thunar-volman",
  "thunar-archive-plugin",
  "tumbler",
  "engrampa",
  "xfce4-terminal",
  "mousepad",
  "ristretto",
  "xfce4-screenshooter",
  "xfce4-taskmanager",
  "xfce4-appfinder",
  "xfce4-notifyd",
  "xfce4-power-manager",
  "xfce4-clipman-plugin",
  "xfce4-whiskermenu-plugin",
  "xfce4-pulseaudio-plugin",
  "xfce4-battery-plugin",
  "gvfs",
  "gvfs-backends",
  "gvfs-fuse",
  "xdg-desktop-portal",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "xdg-user-dirs-gtk",
  "NetworkManager-applet",
  "blueman",
  "pavucontrol",
  "gnome-keyring",
  "gnome-keyring-pam",
  "polkit-gnome",
  "Mesa-dri",
  "Mesa-libEGL1",
  "adwaita-icon-theme",
]

[desktops.xfce.packages.emerge]
required = [
  "xfce-base/xfce4-meta",
  "x11-misc/lightdm",
  "xfce-base/thunar",
  "xfce-base/tumbler",
  "x11-terms/xfce4-terminal",
  "sys-apps/xdg-desktop-portal",
  "sys-apps/xdg-desktop-portal-gtk",
  "gnome-base/gvfs",
  "gnome-base/gnome-keyring",
]

# Marlin GDM override from aa9810e9 (tunaOS#3438). The generated -arch
# adapter takes precedence over tuna.yaml on pacman bases. Other tuna
# profiles retain greetd. Package order and beta pin are unchanged.
[desktops.tuna-arch]
display_manager = "gdm"
versionlock = []
after_install = ["tuna-flatpak-remote", "flatpak-preinstall"]

[desktops.tuna-arch.packages.pacman]
required = [
  "tunaos/tuna-desktop=1.0.0beta.1-1",
  "gdm",
  "xorg-xwayland",
  "ibus",
  "orca",
  "gnome-shell",
  "gnome-settings-daemon",
  "gnome-control-center",
  "gnome-keyring",
  "evolution-data-server",
  "xdg-desktop-portal-gnome",
  "xdg-desktop-portal-gtk",
  "xdg-user-dirs",
  "gvfs",
  "nautilus",
  "ptyxis",
  "networkmanager",
  "libsecret",
  "pipewire",
  "wireplumber",
  "gst-plugin-pipewire",
  "gst-plugins-good",
  "power-profiles-daemon",
  "upower",
  "flatpak",
  "plymouth",
  "adwaita-icon-theme",
  "noto-fonts",
  "noto-fonts-emoji",
  "ttf-dejavu",
  "ttf-liberation",
]