[neon/neon/calamares-settings/Neon/unstable] oem-prepare: clean up and make oem install work properly

Wed Feb 18 22:57:51 GMT 2026

Git commit e676fe2d4e1f06428cf1c9b016ff039e957e1320 by Carlos De Maine.
Committed on 18/02/2026 at 22:57.
Pushed by carlosdem into branch 'Neon/unstable'.

clean up and make oem install work properly

A  +2    -0    oem-prepare/calamares/oem-prepare/modules/oemid.conf
M  +0    -11   oem-prepare/calamares/oem-prepare/prepare-system/calamares-oem-prepare-root
M  +1    -0    oem-prepare/calamares/oem-prepare/prepare-system/oem-cleanup
M  +11   -4    oem-prepare/calamares/oem-prepare/prepare-user/calamares-oem-prepare2
M  +5    -1    oem-prepare/calamares/oem-prepare/settings.conf
M  +3    -3    oem-prepare/usr/sbin/calamares-oem-uid
M  +12   -1    oem-prepare/usr/sbin/calamares-oem-uid-undo-and-configure

https://invent.kde.org/neon/neon/calamares-settings/-/commit/e676fe2d4e1f06428cf1c9b016ff039e957e1320

diff --git a/oem-prepare/calamares/oem-prepare/modules/oemid.conf b/oem-prepare/calamares/oem-prepare/modules/oemid.conf
new file mode 100644
index 0000000..e3ffa5b
--- /dev/null
+++ b/oem-prepare/calamares/oem-prepare/modules/oemid.conf
@@ -0,0 +1,2 @@
+---
+batch-identifier: ${NAME}-${VERSION}-${VESION_ID}-${DATE}
diff --git a/oem-prepare/calamares/oem-prepare/prepare-system/calamares-oem-prepare-root b/oem-prepare/calamares/oem-prepare/prepare-system/calamares-oem-prepare-root
index 7444cd4..1c08ae2 100755
--- a/oem-prepare/calamares/oem-prepare/prepare-system/calamares-oem-prepare-root
+++ b/oem-prepare/calamares/oem-prepare/prepare-system/calamares-oem-prepare-root
@@ -61,17 +61,6 @@ cp -a oem-config.target /lib/systemd/system
 /bin/systemctl enable oem-config.target
 /bin/systemctl set-default oem-config.target
 
-# NB: Mind the check in calamares-oem-prepare2 when changing this!
-cat << CONF >>/etc/polkit-1/localauthority/10-vendor.d/10-calamares-oem-config.pkla
-[Allow Calamares OEM Config]
-Identity=unix-user:oem
-Action=com.github.calamares.calamares.pkexec.run
-ResultAny=no
-ResultInactive=no
-ResultActive=yes
-CONF
-chmod 600 /etc/polkit-1/localauthority/10-vendor.d/10-calamares-oem-config.pkla
-
 ### from Ubuntu's oem-config
 # Machine-specific, so remove in case this system is going to be
 # cloned.  These will be regenerated on the first boot.
diff --git a/oem-prepare/calamares/oem-prepare/prepare-system/oem-cleanup b/oem-prepare/calamares/oem-prepare/prepare-system/oem-cleanup
index 9bda760..f9dfab9 100755
--- a/oem-prepare/calamares/oem-prepare/prepare-system/oem-cleanup
+++ b/oem-prepare/calamares/oem-prepare/prepare-system/oem-cleanup
@@ -13,6 +13,7 @@ pkill -u oem || true
 userdel --force --remove oem || true
 
 rm -f /etc/polkit-1/localauthority/10-vendor.d/10-calamares-oem-config.pkla
+rm -f /T/etc/polkit-1/localauthority/50-local.d/99-oem-nopasswd.pkla
 
 # This was already done by the undo module but since we'll now remove
 # oem-config we had better be certain this was called, otherwise the use
diff --git a/oem-prepare/calamares/oem-prepare/prepare-user/calamares-oem-prepare2 b/oem-prepare/calamares/oem-prepare/prepare-user/calamares-oem-prepare2
index fb41022..4184f9f 100755
--- a/oem-prepare/calamares/oem-prepare/prepare-user/calamares-oem-prepare2
+++ b/oem-prepare/calamares/oem-prepare/prepare-user/calamares-oem-prepare2
@@ -10,6 +10,11 @@ CALAMARES_DESKTOPFILE="/usr/share/applications/calamares.desktop"
 # Consistency check. The root portion will allow the oem user to run calamares via pkexec.
 # Ensure the relevant action is actually available on the system.
 # Otherwise there was a change in calamares that we need to adapt to.
+if [ "$(id -u)" -ne 1100 ]; then
+  kdialog --error "We are not running as UID $(id  -u) not our specified UID 1100. Please file a bug!"
+exit 1
+fi
+
 if ! pkaction | grep --quiet 'com.github.calamares.calamares.pkexec.run'; then
   kdialog --error "Failed to find installer polkit action. Please file a bug!"
   exit 1
@@ -33,9 +38,6 @@ pkexec /calamares/oem-prepare/prepare-system/calamares-oem-prepare-root
 mkdir -p ~/.config/autostart
 cp $CALAMARES_DESKTOPFILE ~/.config/autostart
 
-# Drop anything on the desktop. It'd show up in the oem-config session.
-rm -r ~/Desktop/*
-
 # Disable autolock. It makes no sense since the user wouldn't know the password.
 kwriteconfig6 --file kscreenlockerrc --group Daemon --key Autolock false
 # Disable session restore so we get a semi-prestine session
@@ -73,7 +75,12 @@ kpackagetool6 -t Plasma/LookAndFeel -i $PREPARE_DIR/oem-lnf
 
 /usr/lib/qt6/bin/qdbus org.kde.plasmashell /PlasmaShell org.kde.PlasmaShell.loadLookAndFeelDefaultLayout OEM
 
-sleep 8 # give plasma some time to rejigger
+# Drop anything on the desktop. It'd show up in the oem-config session.
+# this is moved to the end in so it fails after everything else if the
+# expected user id (uid) changes from under us again
+rm -r ~/Desktop/*
+
+sleep 10 # give plasma some time to rejigger
 
 # FIXME: change to shutdown maybe? or drop entirely. when a vendor switches into
 # config mode they will then want to distribute their image, so the reboot is
diff --git a/oem-prepare/calamares/oem-prepare/settings.conf b/oem-prepare/calamares/oem-prepare/settings.conf
index 4e3f2ab..c90b62d 100644
--- a/oem-prepare/calamares/oem-prepare/settings.conf
+++ b/oem-prepare/calamares/oem-prepare/settings.conf
@@ -79,4 +79,8 @@ sequence:
     - finished
 
 branding: neon
-prompt-install: false
+prompt-install: true
+dont-chroot: true
+oem-setup: true
+disable-cancel: true
+disable-cancel-during-exec: true
diff --git a/oem-prepare/usr/sbin/calamares-oem-uid b/oem-prepare/usr/sbin/calamares-oem-uid
index 915e7e3..0c67171 100755
--- a/oem-prepare/usr/sbin/calamares-oem-uid
+++ b/oem-prepare/usr/sbin/calamares-oem-uid
@@ -4,7 +4,7 @@
 
 # Hack...
 # Since calamares doesn't allow forcing a uid we'll implcitly move the
-# auto-ranges so the oem user is created at uid 900.
+# auto-ranges so the oem user is created at uid 1100.
 # This hack is undone in a module once the user was created.
 # This hack allows us to not break with the expecation that the default/first
 # user will be UID 1000.
@@ -15,5 +15,5 @@ ROOT=$1
 
 cp $ROOT/etc/login.defs $ROOT/etc/login.defs.oem
 
-sed -i 's%UID_MIN.*1000%UID_MIN 900%g' $ROOT/etc/login.defs
-sed -i 's%GID_MIN.*1000%GID_MIN 900%g' $ROOT/etc/login.defs
+sed -i 's%UID_MIN.*1000%UID_MIN 1100%g' $ROOT/etc/login.defs
+sed -i 's%GID_MIN.*1000%GID_MIN 1100%g' $ROOT/etc/login.defs
diff --git a/oem-prepare/usr/sbin/calamares-oem-uid-undo-and-configure b/oem-prepare/usr/sbin/calamares-oem-uid-undo-and-configure
index ac530a3..1f78635 100755
--- a/oem-prepare/usr/sbin/calamares-oem-uid-undo-and-configure
+++ b/oem-prepare/usr/sbin/calamares-oem-uid-undo-and-configure
@@ -16,8 +16,19 @@ mv $ROOT/etc/login.defs.oem $ROOT/etc/login.defs
 mkdir -p $ROOT/home/oem/Desktop
 ln -s ../../../calamares/oem-prepare/oem-prepare.desktop $ROOT/home/oem/Desktop/oem-prepare.desktop
 # Make sure the oem user (900) can clean up this file!
-chown -Rv 900 $ROOT/home/oem/Desktop/
+chown -Rv 1100 $ROOT/home/oem/Desktop/
 
 kwriteconfig6 --file $ROOT/etc/sddm.conf --group Autologin --key Relogin --type bool true
 kwriteconfig6 --file $ROOT/etc/sddm.conf --group Autologin --key User oem
 kwriteconfig6 --file $ROOT/etc/sddm.conf --group Autologin --key Session plasma.desktop
+
+# NB: Mind the check in calamares-oem-prepare2 when changing this!
+cat << CONF >>$ROOT/etc/polkit-1/localauthority/50-local.d/99-oem-nopasswd.pkla
+[oem User No Password]
+Identity=unix-user:oem
+Action=*
+ResultAny=yes
+ResultInactive=yes
+ResultActive=yes
+CONF
+chmod 664 $ROOT/etc/polkit-1/localauthority/50-local.d/99-oem-nopasswd.pkla
