ZacharyZhang-NY/omarchy-pkgs
1
0 Fork 0
Code Issues Pull Requests Actions 10 Packages Projects Releases Wiki Activity

Drop setuid from chrome-sandbox and keep Obsidian's tests in its package

Browse Source 
Chromium sandboxes through unprivileged user namespaces on Arch-family
kernels, so the setuid-root helper is unnecessary. The watcher tests now run
from check() as checksummed package sources, leaving tests/ and the shared
Tests workflow untouched.
This commit is contained in:
Marcelo Alcantara committed 2026-09-24 16:05:38 +10:00
1 parent 94ce4e5a46
commit 2a47ad775b
6 files changed
+16 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

pkgbuilds/obsidian/README.md
+2 -2
View File
@@ -2,9 +2,9 @@
This is the canonical `obsidian` package, extracted from omacom/omarchy-pkgs #240 at `dcef132b2df11bb762e233ea8c6af3110f079b67`. It repackages the official ARM64 desktop tarball and preserves the original contributor attribution and Electron/Chromium license files.
The package owns the installed application bundle and Electron runtime. Obsidian's user-controlled in-app updater may separately update application code; no updater-disabling patch is applied. See https://obsidian.md/help/updates.
The package owns the installed application bundle and Electron runtime. `chrome-sandbox` is installed without setuid: Chromium's sandbox uses unprivileged user namespaces, which Arch-family kernels allow. A system that disables them must re-enable them rather than launch Obsidian with `--no-sandbox`. Obsidian's user-controlled in-app updater may separately update application code; no updater-disabling patch is applied. See https://obsidian.md/help/updates.
The package-local upstream hook selects stable desktop releases containing the exact ARM64 tarball, ignoring mobile-only tags. Missing SHA256 metadata on the selected desktop release fails rather than silently selecting an older installer. Run `python tests/obsidian-upstream.py` for offline tests. Upstream's scheduled sync opens or updates its normal review PR; maintainers need GitHub PR notifications enabled and should monitor failed sync runs too.
The package-local upstream hook selects stable desktop releases containing the exact ARM64 tarball, ignoring mobile-only tags. Missing SHA256 metadata on the selected desktop release fails rather than silently selecting an older installer. The offline tests in `test-upstream.py` run in the package's `check()`; run them directly with `python pkgbuilds/obsidian/test-upstream.py`. Upstream's scheduled sync opens or updates its normal review PR; maintainers need GitHub PR notifications enabled and should monitor failed sync runs too.
This package conflicts with `obsidian-appimage` and `obsidian-bin`. It does not automatically remove them or migrate users. Adoption in Omarchy Mac requires a separate change to the existing ARM preinstall/removal mappings. Do not modify vaults or user configuration as part of the package transaction.