Explain cli flags

fix: iso setup failing when password starts with dash(-)

README.md

@@ -8,7 +8,7 @@ See the ISO link on [omarchy.org](https://omarchy.org).
 
 ## Creating the ISO
 
-Run `./bin/omarchy-iso-make` and the output goes into `./release`.
+Run `./bin/omarchy-iso-make` and the output goes into `./release`. You can build from your local $OMARCHY_PATH for testing by using `--local-source` or from a checkout of the dev branch (instead of master) by using `--dev`.
 
 ### Environment Variables
 

bin/omarchy-iso-boot

@@ -2,7 +2,17 @@
 
 set -e
 
+ISO="$1"
+REUSE="$2"
+
 if [ $# -eq 0 ]; then
+  ISO=$(ls -t release/*.iso 2>/dev/null | gum choose --header "Select ISO to boot")
+  if gum confirm --default=false "Reuse existing disk?"; then
+    REUSE="reuse"
+  fi
+fi
+
+if [ -z "$ISO" ]; then
   echo "Usage: omarchy-iso-boot [release/omarchy.iso] [reuse]"
   echo "  SSH available at: ssh -p 2222 root@localhost (after installing openssh)"
   exit 1
@@ -13,7 +23,7 @@ if ! pacman -Q qemu-full >/dev/null || ! pacman -Q edk2-ovmf >/dev/null; then
 fi
 
 DISK="/tmp/omarchy-iso-boot.qcow2"
-if [[ ! -f $DISK || $2 != "reuse" ]]; then
+if [[ ! -f $DISK || $REUSE != "reuse" ]]; then
   qemu-img create -f qcow2 "$DISK" 20G
   cp /usr/share/edk2/x64/OVMF_VARS.4m.fd /tmp/OVMF_VARS.4m.fd
 fi
@@ -27,7 +37,7 @@ qemu-system-x86_64 \
   -drive if=pflash,format=raw,file=/tmp/OVMF_VARS.4m.fd \
   -drive file="$DISK",format=qcow2,if=none,id=drive0 \
   -device virtio-blk-pci,drive=drive0,bootindex=1 \
-  -drive file="$1",media=cdrom,if=none,format=raw,id=cdrom0 \
+  -drive file="$ISO",media=cdrom,if=none,format=raw,id=cdrom0 \
   -device ide-cd,drive=cdrom0,bootindex=2 \
   -device virtio-vga-gl \
   -display gtk,gl=on \

bin/omarchy-iso-make

@@ -15,9 +15,17 @@ while [[ $# -gt 0 ]]; do
     NO_BOOT_OFFER=1
     shift
     ;;
+  --local-source)
+    LOCAL_SOURCE=1
+    shift
+    ;;
+  --dev)
+    OMARCHY_INSTALLER_REF=dev
+    shift
+    ;;
   *)
     echo "Unknown option: $1"
-    echo "Usage: $0 [--no-cache] [--no-boot-offer]"
+    echo "Usage: $0 [--no-cache] [--no-boot-offer] [--local-source] [--dev]"
     exit 1
     ;;
   esac
@@ -49,6 +57,11 @@ DOCKER_ARGS=(
   -v "$BUILD_ROOT/configs:/configs:ro"
 )
 
+# Use local source of Omarchy from $OMARCHY_PATH instead of git checkout
+if [[ -n "${LOCAL_SOURCE-}" ]]; then
+  DOCKER_ARGS+=(-v "$OMARCHY_PATH:/omarchy:ro")
+fi
+
 # Use local pacman cache if you already have one on host to speed up repeat runs
 if [ -d "/var/cache/pacman/pkg" ]; then
   DOCKER_ARGS+=(-v "/var/cache/pacman/pkg:/var/cache/pacman/pkg")

bin/omarchy-iso-make-dev

@@ -1,3 +0,0 @@
-#!/bin/bash
-
-OMARCHY_INSTALLER_REF=dev omarchy-iso-make

bin/omarchy-iso-rclone-config

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+access_key=$(op read "op://Shared/Cloudflare Buckets/iso.omarchy.org/access_key_id" --account Omarchy)
+secret_access_key=$(op read "op://Shared/Cloudflare Buckets/iso.omarchy.org/secret_access_key" --account Omarchy)
+endpoint=$(op read "op://Shared/Cloudflare Buckets/iso.omarchy.org/endpoint" --account Omarchy)
+
+cat > ~/.config/rclone/rclone.conf << EOF
+[Omarchy]
+type = s3
+provider = Cloudflare
+access_key_id = $access_key
+secret_access_key = $secret_access_key
+endpoint = $endpoint
+EOF

bin/omarchy-iso-release

@@ -13,10 +13,6 @@ BULD_VERSION="$1"
 if [[ $1 != "--no-make" ]]; then
   echo -e "\e[32mMaking master ISO\e[0m"
   OMARCHY_INSTALLER_REF=master omarchy-iso-make --no-cache --no-boot-offer
-
-  echo -e "\e[32m\nMaking dev ISO\e[0m"
-
-  OMARCHY_INSTALLER_REF=dev omarchy-iso-make --no-cache --no-boot-offer
 else
   echo -e "\e[31mSkipping remaking ISOs\e[0m"
 fi
@@ -25,14 +21,11 @@ fi
 latest_master_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*x86_64-master.iso | head -n1)
 release_master_iso="$BUILD_RELEASE_PATH/omarchy-$BULD_VERSION.iso"
 cp "$latest_master_iso" "$release_master_iso"
+
 echo -e "\e[32mSigning master ISO\e[0m"
 omarchy-iso-sign "$release_master_iso"
-omarchy-iso-upload "$release_master_iso"
 
-# Sign and upload dev ISO
+master_sha=$(sha256sum "$release_master_iso")
-latest_dev_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*x86_64-dev.iso | head -n1)
+echo -e "\e[32mSHA256 for master ISO: $master_sha\e[0m"
-release_dev_iso="$BUILD_RELEASE_PATH/omarchy-$BULD_VERSION-dev.iso"
+
-cp "$latest_dev_iso" "$release_dev_iso"
+omarchy-iso-upload "$release_master_iso"
-echo -e "\e[32mSigning dev ISO\e[0m"
-omarchy-iso-sign "$release_dev_iso"
-omarchy-iso-upload "$release_dev_iso"

bin/omarchy-iso-sign

@@ -7,7 +7,7 @@ fi
 
 if ! pacman -Q gnupg >/dev/null; then
   sudo pacman -S --noconfirm --needed --quiet gnupg
-  echo "you'll need to generate a new key with: gpg --full-generate-key"
+  echo "You'll need to import key with: gpg --import path/to/signing-key.asc"
 fi
 
 gnupg_user_key=$(gpg --list-secret-keys --keyid-format=long | awk '/^[[:space:]]/{print $1; exit}')

bin/omarchy-iso-upload

@@ -6,7 +6,7 @@ if [ $# -eq 0 ]; then
 fi
 
 if [[ ! -f ~/.config/rclone/rclone.conf ]]; then
-  echo "You must first configure rclone with the R2 credentials: rclone config"
+  echo "You must first configure rclone with the R2 credentials: omarchy-iso-rclone-config"
   exit 1
 fi
 

builder/archinstall.packages

@@ -7,6 +7,7 @@ intel-ucode
 linux-firmware
 linux
 limine
+omarchy-keyring
 openssh
 pipewire
 snapper

builder/build-iso.sh

@@ -7,6 +7,11 @@ pacman-key --init
 pacman --noconfirm -Sy archlinux-keyring
 pacman --noconfirm -Sy archiso git sudo base-devel jq grub
 
+# Install omarchy-keyring for package verification during build
+# The [omarchy] repo is defined in /configs/pacman-online.conf with SigLevel = Optional TrustAll
+pacman --config /configs/pacman-online.conf --noconfirm -Sy omarchy-keyring
+pacman-key --populate omarchy
+
 # Setup build locations
 build_cache_dir="/var/cache"
 offline_mirror_dir="$build_cache_dir/airootfs/var/cache/omarchy/mirror/offline"
@@ -25,8 +30,12 @@ rm -rf "$build_cache_dir/airootfs/etc/xdg/reflector"
 # Bring in our configs
 cp -r /configs/* $build_cache_dir/
 
-# Clone Omarchy itself
+# Setup Omarchy itself
-git clone -b $OMARCHY_INSTALLER_REF https://github.com/$OMARCHY_INSTALLER_REPO.git "$build_cache_dir/airootfs/root/omarchy"
+if [[ -d /omarchy ]]; then
+  cp -rp /omarchy "$build_cache_dir/airootfs/root/omarchy"
+else
+  git clone -b $OMARCHY_INSTALLER_REF https://github.com/$OMARCHY_INSTALLER_REPO.git "$build_cache_dir/airootfs/root/omarchy"
+fi
 
 # Make log uploader available in the ISO too
 mkdir -p "$build_cache_dir/airootfs/usr/local/bin/"
@@ -58,7 +67,7 @@ mkdir -p "$build_cache_dir/airootfs/opt/packages/"
 cp "/tmp/$NODE_FILENAME" "$build_cache_dir/airootfs/opt/packages/"
 
 # Add our additional packages to packages.x86_64
-arch_packages=(linux-t2 git gum jq openssl plymouth tzupdate)
+arch_packages=(linux-t2 git gum jq openssl plymouth tzupdate omarchy-keyring)
 printf '%s\n' "${arch_packages[@]}" >>"$build_cache_dir/packages.x86_64"
 
 # Build list of all the packages needed for the offline mirror

configs/airootfs/root/.automated_script.sh

@@ -22,7 +22,11 @@ install_arch() {
   touch /var/log/omarchy-install.log
 
   start_log_output
-  install_base_system 2>&1 | sed -u 's/\x1b\[[0-9;]*[a-zA-Z]//g' >>/var/log/omarchy-install.log
+
+  # Set CURRENT_SCRIPT for the trap to display better when nothing is returned for some reason
+  CURRENT_SCRIPT="install_base_system"
+  install_base_system > >(sed -u 's/\x1b\[[0-9;]*[a-zA-Z]//g' >>/var/log/omarchy-install.log) 2>&1
+  unset CURRENT_SCRIPT
   stop_log_output
 }
 
@@ -67,6 +71,7 @@ install_base_system() {
   # Initialize and populate the keyring
   pacman-key --init
   pacman-key --populate archlinux
+  pacman-key --populate omarchy
 
   # Sync the offline database so pacman can find packages
   pacman -Sy --noconfirm

configs/airootfs/root/configurator

@@ -121,7 +121,7 @@ user_form() {
   done
 
   # Hash the password using yescrypt
-  password_hash=$(openssl passwd -6 "$password")
+  password_hash=$(printf '%s' "$password" | openssl passwd -6 -stdin)
 
   full_name=$(gum input --placeholder "Used for git authentication (hit return to skip)" --prompt.foreground="#845DF9" --prompt "Full name> ")
   email_address=$(gum input --placeholder "Used for git authentication (hit return to skip)" --prompt.foreground="#845DF9" --prompt "Email address> ")
@@ -383,7 +383,8 @@ cat <<-_EOF_ >user_configuration.json
     },
     "packages": [
         "base-devel",
-        "git"
+        "git",
+        "omarchy-keyring"
     ],
     "profile_config": {
         "gfx_driver": null,

configs/pacman-online.conf

@@ -14,21 +14,15 @@ SigLevel    = Required DatabaseOptional
 LocalFileSigLevel = Optional
 
 [core]
-Server = https://mirror.omarchy.org/$repo/os/$arch
+Server = https://stable-mirror.omarchy.org/$repo/os/$arch
-Server = https://mirror.rackspace.com/archlinux/$repo/os/$arch
-Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
 
 [extra]
-Server = https://mirror.omarchy.org/$repo/os/$arch
+Server = https://stable-mirror.omarchy.org/$repo/os/$arch
-Server = https://mirror.rackspace.com/archlinux/$repo/os/$arch
-Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
 
 [multilib]
-Server = https://mirror.omarchy.org/$repo/os/$arch
+Server = https://stable-mirror.omarchy.org/$repo/os/$arch
-Server = https://mirror.rackspace.com/archlinux/$repo/os/$arch
-Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
 
 [omarchy]