switched from deprecated hardened-chromium to trivalent
Some checks failed
ShellCheck / Shell syntax checker (push) Failing after 15s

This commit is contained in:
titanz 2025-01-26 18:31:19 +01:00
parent 31879f8d2f
commit eee17f033f
Signed by: titanz
GPG Key ID: EABC72179C71D4F5
17 changed files with 47 additions and 46 deletions

View File

@ -1,6 +1,6 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2022-2024 Thien Tran # Copyright (C) 2022-2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of
@ -61,7 +61,7 @@ umask 077
# Fix portals # Fix portals
sudo mkdir -p /etc/xdg-desktop-portal sudo mkdir -p /etc/xdg-desktop-portal
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/xdg-desktop-portal/portals.conf /etc/xdg-desktop-portal/portals.conf download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/xdg-desktop-portal/portals.conf /etc/xdg-desktop-portal/portals.conf
# Avoid phased updates # Avoid phased updates
download https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/apt.conf.d/99sane-upgrades /etc/apt/apt.conf.d/99sane-upgrades download https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/apt.conf.d/99sane-upgrades /etc/apt/apt.conf.d/99sane-upgrades
@ -139,5 +139,5 @@ sudo apt update
sudo apt install --no-install-recommends gnome-console flatpak qubes-ctap qubes-gpg-split -y sudo apt install --no-install-recommends gnome-console flatpak qubes-ctap qubes-gpg-split -y
# Flatpak update service # Flatpak update service
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/systemd/user/update-user-flatpaks.service /etc/systemd/user/update-user-flatpaks.service download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/systemd/user/update-user-flatpaks.service /etc/systemd/user/update-user-flatpaks.service
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/systemd/user/update-user-flatpaks.timer /etc/systemd/user/update-user-flatpaks.timer download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/systemd/user/update-user-flatpaks.timer /etc/systemd/user/update-user-flatpaks.timer

View File

@ -1,6 +1,6 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2022-2024 Thien Tran # Copyright (C) 2022-2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of
@ -28,4 +28,4 @@ download https://packages.element.io/debian/element-io-archive-keyring.gpg /usr/
download https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/refs/heads/main/etc/apt/sources.list.d/element-io.sources /etc/apt/sources.list.d/element-io.sources download https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/refs/heads/main/etc/apt/sources.list.d/element-io.sources /etc/apt/sources.list.d/element-io.sources
sudo apt update sudo apt update
sudo apt install -y element-desktop sudo apt install -y element-desktop

View File

@ -26,5 +26,5 @@ echo "deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --prin
sudo apt update sudo apt update
sudo apt install -y lokinet mullvad-browser resolvconf sudo apt install -y lokinet mullvad-browser resolvconf
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/systemd/system/lokinet-dns-fix.service /etc/systemd/system/lokinet-dns-fix.service download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/systemd/system/lokinet-dns-fix.service /etc/systemd/system/lokinet-dns-fix.service
sudo systemctl enable --now lokinet-dns-fix sudo systemctl enable --now lokinet-dns-fix

View File

@ -1,6 +1,6 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2022-2024 Thien Tran # Copyright (C) 2022-2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of
@ -28,4 +28,4 @@ curl -s --proxy http://127.0.0.1:8082 -L https://github.com/trustcrypto/OnlyKey-
sudo apt install gnome-disk-utility ./OnlyKey_5.5.0_amd64.deb sudo apt install gnome-disk-utility ./OnlyKey_5.5.0_amd64.deb
sudo systemctl disable --now hide-hardware-info.service sudo systemctl disable --now hide-hardware-info.service

View File

@ -1,6 +1,6 @@
#!/bin/bash #!/bin/bash
# Copyright (C) 2023-2024 Thien Tran # Copyright (C) 2023-2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of

View File

@ -1,6 +1,6 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2022-2024 Thien Tran # Copyright (C) 2022-2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of
@ -24,4 +24,4 @@ download() {
unpriv curl -s --proxy http://127.0.0.1:8082 "${1}" | sudo tee "${2}" > /dev/null unpriv curl -s --proxy http://127.0.0.1:8082 "${1}" | sudo tee "${2}" > /dev/null
} }
sudo dnf install -y https://github.com/ente-io/photos-desktop/releases/download/v1.7.7/ente-1.7.7-x86_64.rpm sudo dnf install -y https://github.com/ente-io/photos-desktop/releases/download/v1.7.7/ente-1.7.7-x86_64.rpm

View File

@ -1,6 +1,6 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2022-2024 Thien Tran # Copyright (C) 2022-2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of
@ -66,14 +66,14 @@ sudo dconf update
# Fix portals # Fix portals
sudo mkdir -p /etc/xdg-desktop-portal sudo mkdir -p /etc/xdg-desktop-portal
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/xdg-desktop-portal/portals.conf /etc/xdg-desktop-portal/portals.conf download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/xdg-desktop-portal/portals.conf /etc/xdg-desktop-portal/portals.conf
# Setup ZRAM # Setup ZRAM
download https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/zram-generator.conf /etc/systemd/zram-generator.conf download https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/zram-generator.conf /etc/systemd/zram-generator.conf
# Flatpak update service # Flatpak update service
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/systemd/user/update-user-flatpaks.service /etc/systemd/user/update-user-flatpaks.service download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/systemd/user/update-user-flatpaks.service /etc/systemd/user/update-user-flatpaks.service
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/systemd/user/update-user-flatpaks.timer /etc/systemd/user/update-user-flatpaks.timer download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/systemd/user/update-user-flatpaks.timer /etc/systemd/user/update-user-flatpaks.timer
# Setup networking # Setup networking
# We don't need the usual mac address randomization and stuff here, because this template is not used for sys-net # We don't need the usual mac address randomization and stuff here, because this template is not used for sys-net

View File

@ -1,6 +1,6 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2022-2024 Thien Tran # Copyright (C) 2022-2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of
@ -33,11 +33,11 @@ sudo mkdir -p /etc/qubes-bind-dirs.d
echo 'binds+=( '\'''/etc/opt/ivpn/mutable''\'' )' | sudo tee /etc/qubes-bind-dirs.d/50_user.conf echo 'binds+=( '\'''/etc/opt/ivpn/mutable''\'' )' | sudo tee /etc/qubes-bind-dirs.d/50_user.conf
sudo mkdir -p /etc/systemd/system/systemd-resolved.service.d sudo mkdir -p /etc/systemd/system/systemd-resolved.service.d
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/systemd/system/systemd-resolved.service.d/override.conf /etc/systemd/system/systemd-resolved.service.d/override.conf download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/systemd/system/systemd-resolved.service.d/override.conf /etc/systemd/system/systemd-resolved.service.d/override.conf
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/systemd/system/dnat-to-ns.service /etc/systemd/system/dnat-to-ns.service download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/systemd/system/dnat-to-ns.service /etc/systemd/system/dnat-to-ns.service
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/systemd/system/dnat-to-ns.path /etc/systemd/system/dnat-to-ns.path download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/systemd/system/dnat-to-ns.path /etc/systemd/system/dnat-to-ns.path
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/systemd/system/dnat-to-ns-boot.service /etc/systemd/system/dnat-to-ns-boot.service download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/systemd/system/dnat-to-ns-boot.service /etc/systemd/system/dnat-to-ns-boot.service
sudo systemctl enable dnat-to-ns.path sudo systemctl enable dnat-to-ns.path
sudo systemctl enable dnat-to-ns-boot.service sudo systemctl enable dnat-to-ns-boot.service

View File

@ -1,6 +1,6 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2022-2024 Thien Tran # Copyright (C) 2022-2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of
@ -59,4 +59,4 @@ umask 077
# Run `systemctl --user enable --now pactl.service` in your appVM. # Run `systemctl --user enable --now pactl.service` in your appVM.
# For some uncomprehensible reason, manually enabling pipewire-pulse.service will not work for Edge audio. # For some uncomprehensible reason, manually enabling pipewire-pulse.service will not work for Edge audio.
# Using preset doesn't actually work :/ # Using preset doesn't actually work :/

View File

@ -1,6 +1,6 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2024 Thien Tran # Copyright (C) 2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of

View File

@ -1,6 +1,6 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2022-2024 Thien Tran # Copyright (C) 2022-2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of
@ -33,11 +33,11 @@ sudo mkdir -p /etc/qubes-bind-dirs.d
echo 'binds+=( '\'''/etc/mullvad-vpn''\'' )' | sudo tee /etc/qubes-bind-dirs.d/50_user.conf echo 'binds+=( '\'''/etc/mullvad-vpn''\'' )' | sudo tee /etc/qubes-bind-dirs.d/50_user.conf
sudo mkdir -p /etc/systemd/system/systemd-resolved.service.d sudo mkdir -p /etc/systemd/system/systemd-resolved.service.d
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/systemd/system/systemd-resolved.service.d/override.conf /etc/systemd/system/systemd-resolved.service.d/override.conf download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/systemd/system/systemd-resolved.service.d/override.conf /etc/systemd/system/systemd-resolved.service.d/override.conf
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/systemd/system/dnat-to-ns.service /etc/systemd/system/dnat-to-ns.service download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/systemd/system/dnat-to-ns.service /etc/systemd/system/dnat-to-ns.service
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/systemd/system/dnat-to-ns.path /etc/systemd/system/dnat-to-ns.path download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/systemd/system/dnat-to-ns.path /etc/systemd/system/dnat-to-ns.path
sudo systemctl enable dnat-to-ns.path sudo systemctl enable dnat-to-ns.path
# Follow these instructions on how to set up the ProxyVM: https://privsec.dev/posts/qubes/using-mullvad-vpn-on-qubes-os/#creating-the-proxyvm # Follow these instructions on how to set up the ProxyVM: https://privsec.dev/posts/qubes/using-mullvad-vpn-on-qubes-os/#creating-the-proxyvm

View File

@ -1,6 +1,6 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2022-2024 Thien Tran # Copyright (C) 2022-2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of
@ -26,4 +26,4 @@ download() {
sudo dnf install -y android-tools mediawriter gnome-disk-utility sudo dnf install -y android-tools mediawriter gnome-disk-utility
# In the dispvm template, delete ~/.config/autostart/nw.desktop to prevent the OnlyKey app from automatically starting. # In the dispvm template, delete ~/.config/autostart/nw.desktop to prevent the OnlyKey app from automatically starting.

View File

@ -1,6 +1,7 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2024 Thien Tran # Copyright (C) 2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of
@ -24,9 +25,9 @@ download() {
unpriv curl -s --proxy http://127.0.0.1:8082 "${1}" | sudo tee "${2}" > /dev/null unpriv curl -s --proxy http://127.0.0.1:8082 "${1}" | sudo tee "${2}" > /dev/null
} }
sudo https_proxy=127.0.0.1:8082 dnf copr enable secureblue/hardened-chromium -y sudo https_proxy=127.0.0.1:8082 dnf copr enable secureblue/trivalent -y
sudo dnf config-manager setopt fedora-cisco-openh264.enabled=1 rpmfusion-free.enabled=1 rpmfusion-free-updates.enabled=1 rpmfusion-nonfree.enabled=1 rpmfusion-nonfree-updates.enabled=1 sudo dnf config-manager setopt fedora-cisco-openh264.enabled=1 rpmfusion-free.enabled=1 rpmfusion-free-updates.enabled=1 rpmfusion-nonfree.enabled=1 rpmfusion-nonfree-updates.enabled=1
sudo dnf install -y ffmpeg hardened-chromium sudo dnf install -y ffmpeg trivalent
sudo dnf update @multimedia --setopt="install_weak_deps=False" --exclude=PackageKit-gstreamer-plugin sudo dnf update @multimedia --setopt="install_weak_deps=False" --exclude=PackageKit-gstreamer-plugin
umask 022 umask 022
@ -50,4 +51,4 @@ umask 077
# Run `systemctl --user enable --now pactl.service` in your appVM. # Run `systemctl --user enable --now pactl.service` in your appVM.
# For some uncomprehensible reason, manually enabling pipewire-pulse.service will not work for Edge audio. # For some uncomprehensible reason, manually enabling pipewire-pulse.service will not work for Edge audio.
# Using preset doesn't actually work :/ # Using preset doesn't actually work :/

View File

@ -1,6 +1,6 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2022-2024 Thien Tran # Copyright (C) 2022-2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of
@ -24,4 +24,4 @@ download() {
unpriv curl -s --proxy http://127.0.0.1:8082 "${1}" | sudo tee "${2}" > /dev/null unpriv curl -s --proxy http://127.0.0.1:8082 "${1}" | sudo tee "${2}" > /dev/null
} }
sudo dnf install -y keepassxc sudo dnf install -y keepassxc

View File

@ -1,6 +1,6 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2022-2024 Thien Tran # Copyright (C) 2022-2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of
@ -66,4 +66,4 @@ echo 'libhardened_malloc.so' | sudo tee /etc/ld.so.preload
sudo chmod 644 /etc/ld.so.preload sudo chmod 644 /etc/ld.so.preload
# Prepare for SELinux # Prepare for SELinux
sudo touch /.autorelabel sudo touch /.autorelabel

View File

@ -1,6 +1,6 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2022-2024 Thien Tran # Copyright (C) 2022-2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of
@ -34,10 +34,10 @@ download https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main
# Theming # Theming
sudo mkdir -p /etc/gtk-3.0 sudo mkdir -p /etc/gtk-3.0
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/gtk-3.0/settings.ini /etc/gtk-3.0/settings.ini download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development /etc/gtk-3.0/settings.ini/etc/gtk-3.0/settings.ini
sudo mkdir -p /etc/gtk-4.0 sudo mkdir -p /etc/gtk-4.0
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/gtk-4.0/settings.ini /etc/gtk-4.0/settings.ini download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/gtk-4.0/settings.ini /etc/gtk-4.0/settings.ini
# Networking # Networking
download https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/NetworkManager/conf.d/00-macrandomize.conf /etc/NetworkManager/conf.d/00-macrandomize.conf download https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/NetworkManager/conf.d/00-macrandomize.conf /etc/NetworkManager/conf.d/00-macrandomize.conf

View File

@ -1,6 +1,6 @@
#!/bin/sh #!/bin/sh
# Copyright (C) 2022-2024 Thien Tran # Copyright (C) 2022-2024 Lukas Raub
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may not # Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of # use this file except in compliance with the License. You may obtain a copy of
@ -52,10 +52,10 @@ sudo systemctl enable --now hide-hardware-info.service
echo 'ConnectionPadding 1' | sudo tee /usr/local/etc/torrc.d/50_user.conf echo 'ConnectionPadding 1' | sudo tee /usr/local/etc/torrc.d/50_user.conf
# Theming # Theming
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/environment /etc/environment download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/environment /etc/environment
sudo mkdir -p /etc/gtk-3.0 sudo mkdir -p /etc/gtk-3.0
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/gtk-3.0/settings.ini /etc/gtk-3.0/settings.ini download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/gtk-3.0/settings.ini /etc/gtk-3.0/settings.ini
sudo mkdir -p /etc/gtk-4.0 sudo mkdir -p /etc/gtk-4.0
download https://raw.githubusercontent.com/TommyTran732/QubesOS-Scripts/main/etc/gtk-4.0/settings.ini /etc/gtk-4.0/settings.ini download https://git.conorz.at/titanz/QubesOS-Scripts/raw/branch/development/etc/gtk-4.0/settings.ini /etc/gtk-4.0/settings.ini