diff --git a/pkgbuilds/cua-hyprland-plugin/PKGBUILD b/pkgbuilds/cua-hyprland-plugin/PKGBUILD index 6f9ac12a..cfcf4724 100644 --- a/pkgbuilds/cua-hyprland-plugin/PKGBUILD +++ b/pkgbuilds/cua-hyprland-plugin/PKGBUILD @@ -1,33 +1,36 @@ -# Separately reviewed download wrapper; original kit and source identity are unchanged. +# Verified upstream kit with a local package-revision profile; source/tooling are unchanged. # Normal reruns need a fresh build directory; makepkg -e reuses verified extracted trees. # Profile kit: original source bytes and separately committed packaging tooling. # shellcheck shell=bash disable=SC2034,SC2154 pkgname=cua-hyprland-plugin pkgver=0.26.1 -pkgrel=2 -pkgdesc='Cua input candidate for reviewed profile omarchy-stable-20260910' +pkgrel=3 +pkgdesc='Cua input candidate for reviewed profile omarchy-hyprland-0562r3' arch=('x86_64') url='https://github.com/trycua/cua' license=('MIT') -depends=('hyprland=0.56.2-2' 'aquamarine=0.15.0-2' 'glibc=2.44+r24+g16be1518495f-1' 'hyprcursor=0.1.13-7' 'hyprgraphics=0.5.1-4' 'hyprlang=0.6.8-5' 'hyprutils=0.14.2-1' 'libgcc=16.2.1+r23+gd564253eb6c8-1' 'libstdc++=16.2.1+r23+gd564253eb6c8-1' 'libxkbcommon=1.13.2-1' 'wayland=1.26.0-1' 'python>=3.11' 'binutils') +depends=('hyprland=0.56.2-3' 'aquamarine=0.15.0-2' 'glibc=2.44+r24+g16be1518495f-1' 'hyprcursor=0.1.13-7' 'hyprgraphics=0.5.1-4' 'hyprlang=0.6.8-5' 'hyprutils=0.14.2-1' 'libgcc=16.2.1+r23+gd564253eb6c8-1' 'libstdc++=16.2.1+r23+gd564253eb6c8-1' 'libxkbcommon=1.13.2-1' 'wayland=1.26.0-1' 'python>=3.11' 'binutils') makedepends=('cmake>=3.30' 'ninja' 'pkgconf' 'gcc') options=('!strip' '!debug' '!lto') _stem='cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7' _archive_sha256='47bca9e018f32f4fcfe683f91c7475c60368f3b65d318cc35c1f2de88a4ee9ab' -_kit_sha256='7beb736adfd334eed52e84070177634269e3a09f8bb25971b38606933ff4c997' -_profile_sha256='5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a' +_kit_sha256='1391084a903254fb16d251522dba41ae34a06cfa4b2f6b7ba91a3cceeb895921' +_profile_sha256='eebba812a7513b471cf8969364334a4bde1eaa9c4519157701c771c1b6cd1b07' _verifier_sha256='480f649cbd35a0ddc7f49dc0a3a44785402c9e0ec9653b0f8ea4965d52d7f900' _cxx="${CUA_RELEASE_CXX:-/usr/bin/g++}" _download_name='cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7-profile-omarchy-stable-20260910-kit-1.1.0-5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a-67f89ceb47edd973aa748820eadd02ddbfb3d3e4.tar.gz' _download_sha256='a89bfa7f6490f598719dfabdd2a5badc137e27b0764fd25e6a05e1f969433520' -source=('https://github.com/trycua/cua/releases/download/cua-hyprland-kit-v1.1.0-omarchy-stable-20260910/cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7-profile-omarchy-stable-20260910-kit-1.1.0-5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a-67f89ceb47edd973aa748820eadd02ddbfb3d3e4.tar.gz') +source=('https://github.com/trycua/cua/releases/download/cua-hyprland-kit-v1.1.0-omarchy-stable-20260910/cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7-profile-omarchy-stable-20260910-kit-1.1.0-5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a-67f89ceb47edd973aa748820eadd02ddbfb3d3e4.tar.gz' + 'PROFILE.json') noextract=("$_download_name") -sha256sums=('a89bfa7f6490f598719dfabdd2a5badc137e27b0764fd25e6a05e1f969433520') +sha256sums=('a89bfa7f6490f598719dfabdd2a5badc137e27b0764fd25e6a05e1f969433520' + 'eebba812a7513b471cf8969364334a4bde1eaa9c4519157701c771c1b6cd1b07') _verify_download() { - python3 -I - "$SRCDEST/$_download_name" "$_download_sha256" "$srcdir" "$1" <<'CUA_DOWNLOAD_PY' + python3 -I - "$SRCDEST/$_download_name" "$_download_sha256" "$srcdir" "$1" "$SRCDEST/PROFILE.json" <<'CUA_DOWNLOAD_PY' import hashlib import io +import json from pathlib import Path, PurePosixPath import sys import tarfile @@ -42,7 +45,7 @@ def require(condition, message): def digest(data): return hashlib.sha256(data).hexdigest() -archive, checksum, srcdir, mode = sys.argv[1:] +archive, checksum, srcdir, mode, profile_path = sys.argv[1:] archive, srcdir = Path(archive), Path(srcdir) require(mode in {'check', 'extract'}, 'invalid kit verification mode') require(archive.is_file() and not archive.is_symlink(), 'outer archive must be a regular file') @@ -58,6 +61,35 @@ with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as contents: require(digest(content) == expected[member.name], 'outer kit member checksum mismatch') payload[member.name] = content require(payload.keys() == expected.keys(), 'outer kit inventory mismatch') +# Arch's -3 package has the same compositor and all 498 headers/pkg-config +# files as -2. Derive a version-only profile with the original source/tooling +# and byte checks intact; record its own profile and kit provenance digests. +profile_data = Path(profile_path).read_bytes() +require(digest(profile_data) == 'eebba812a7513b471cf8969364334a4bde1eaa9c4519157701c771c1b6cd1b07', + 'local profile checksum mismatch') +profile = json.loads(payload['PROFILE.json']) +profile.update(profile_id='omarchy-hyprland-0562r3', package_release=3) +profile['hyprland']['package_version'] = '0.56.2-3' +require(json.loads(profile_data) == profile, 'local profile changes more than the reviewed package revision') +payload['PROFILE.json'] = profile_data +provenance = json.loads(payload['KIT-PROVENANCE.json']) +provenance['profile_sha256'] = digest(profile_data) +payload['KIT-PROVENANCE.json'] = (json.dumps(provenance, sort_keys=True, indent=2) + '\n').encode() +recipe = payload['PKGBUILD'].decode() +for old, new in [('pkgrel=2\n', 'pkgrel=3\n'), ('omarchy-stable-20260910', profile['profile_id']), + ('hyprland=0.56.2-2', 'hyprland=0.56.2-3'), + ('5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a', digest(profile_data)), + ('7beb736adfd334eed52e84070177634269e3a09f8bb25971b38606933ff4c997', digest(payload['KIT-PROVENANCE.json']))]: + recipe = recipe.replace(old, new) +payload['PKGBUILD'] = recipe.encode() +payload['SHA256SUMS'] = ''.join(f'{digest(body)} {name}\n' for name, body in sorted(payload.items()) + if name != 'SHA256SUMS').encode() +expected.update({'PROFILE.json': 'eebba812a7513b471cf8969364334a4bde1eaa9c4519157701c771c1b6cd1b07', + 'KIT-PROVENANCE.json': '1391084a903254fb16d251522dba41ae34a06cfa4b2f6b7ba91a3cceeb895921', + 'PKGBUILD': '4c5ef50c5a8d556d461afe283b13b228fb09d2558b37fb76257e13e25846325b', + 'SHA256SUMS': '2ea22af60f8c86df588fd7db103d9f444d9ac4018b704a48ddff2545ff7ce999'}) +for name, content in payload.items(): + require(digest(content) == expected[name], 'derived kit checksum mismatch: ' + name) require(srcdir.is_dir() and not srcdir.is_symlink(), 'srcdir must be a real directory') kit, source = srcdir / 'cua-profile-kit', srcdir / stem if mode == 'extract': diff --git a/pkgbuilds/cua-hyprland-plugin/PROFILE.json b/pkgbuilds/cua-hyprland-plugin/PROFILE.json new file mode 100644 index 00000000..ec78d11e --- /dev/null +++ b/pkgbuilds/cua-hyprland-plugin/PROFILE.json @@ -0,0 +1,40 @@ +{ + "architecture": "x86_64", + "compiler": { + "comment": "GCC: (GNU) 16.2.1 20260810", + "sha256": "f04191f6a7b2cd7d9a62e1745872b8a6088791e5af6955488c69c9b2c4668bc9", + "version": "16.2.1 20260810" + }, + "hyprland": { + "header_version": "0.56.2", + "headers_sha256": "88a6875af00203627b264a5c1f9908781be4ad8d9cee4e577fef174e72dd0e28", + "package_version": "0.56.2-3", + "sha256": "da8fcacf347bcbed83edc40108c6e2298da095e22246bd764e9bb382786cebb2" + }, + "kit_version": "1.1.0", + "package_release": 3, + "profile_id": "omarchy-hyprland-0562r3", + "runtime": { + "basename": "libstdc++.so.6.0.36", + "packages": { + "aquamarine": "0.15.0-2", + "glibc": "2.44+r24+g16be1518495f-1", + "hyprcursor": "0.1.13-7", + "hyprgraphics": "0.5.1-4", + "hyprlang": "0.6.8-5", + "hyprutils": "0.14.2-1", + "libgcc": "16.2.1+r23+gd564253eb6c8-1", + "libstdc++": "16.2.1+r23+gd564253eb6c8-1", + "libxkbcommon": "1.13.2-1", + "wayland": "1.26.0-1" + }, + "sha256": "f5fc7380f2ae46fa4053a64be04e7b98109f1066a4bbfff3c37042488aa0be0e" + }, + "schema": 2, + "source": { + "archive_sha256": "47bca9e018f32f4fcfe683f91c7475c60368f3b65d318cc35c1f2de88a4ee9ab", + "driver_version": "0.26.1", + "manifest_sha256": "54f514664c84e1358a435f29cd6befd5661b0b133d76997191c000b10f021a75", + "revision": "cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7" + } +} diff --git a/pkgbuilds/cua-hyprland-plugin/README.md b/pkgbuilds/cua-hyprland-plugin/README.md index 01171a81..15820ef3 100644 --- a/pkgbuilds/cua-hyprland-plugin/README.md +++ b/pkgbuilds/cua-hyprland-plugin/README.md @@ -12,12 +12,28 @@ It is not a repackaging of the unmodified 0.24.0 plugin. The qualified Driver pairing is `cua-driver-bin 0.27.0-1`, with input protocol v3. Driver 0.27.0 contains the bounded stale-geometry retry validated with this pinned module; its production plugin source is unchanged from the source used here. Discovery protocol v2 is separate. A newer Driver release is a changed pairing and requires affected replay before promotion. -Profile `omarchy-stable-20260910`, kit `1.1.0`, and package release `2` pin: +Profile `omarchy-hyprland-0562r3`, kit tooling `1.1.0`, and package release `3` pin: -- Hyprland `0.56.2-2`, headers `0.56.2`, and measured executable/header hashes. +- Hyprland `0.56.2-3`, headers `0.56.2`, and measured executable/header hashes. - GCC `16.2.1 20260810`, including compiler bytes and emitted ELF identity. - Shared runtime `libstdc++.so.6.0.36`, its bytes, and exact ABI package versions. +This profile derives from Cua's `omarchy-stable-20260910` profile. Arch's +Hyprland `-3` package splits out `hyprpm` and changes package dependencies; +its compositor executable and all 498 header/pkg-config files are byte-identical +to `-2`. Both executables have SHA-256 +`da8fcacf347bcbed83edc40108c6e2298da095e22246bd764e9bb382786cebb2`. +The checked-in `PROFILE.json` changes only the profile name, package release, +and exact Hyprland package version. Compiler, runtime, source, executable, +and header identities remain unchanged. The download wrapper verifies the +original kit before deriving the updated profile, recipe, and provenance, +then verifies every derived member against its recorded digest. + +The native qualification below was recorded with package release `2` and +Hyprland `-2`. This packaging update does not claim a new application or +Driver replay. The `-3` dependency must reach a destination channel before +this artifact can be installed there; publication still follows edge → RC → stable. + The generated `PKGBUILD` identifies the immutable kit download, outer checksum, and member checksums. The kit records the full source and tooling revisions, profile digest, and source archive/manifest digests. Do not infer compatibility @@ -109,13 +125,13 @@ configuration edits, or hot replacement. Save your work and exit Hyprland before installing, replacing, or removing the package. Install the exact reviewed package from a text console, then start a -fresh session. Before loading, run the consumer check with the independently -reviewed kit-provenance digest from the qualification record: +fresh session. Before loading, run the consumer check with this package's derived +kit-provenance digest: ```sh python3 /usr/share/cua-hyprland-plugin/profile_verify.py \ --kit /usr/share/cua-hyprland-plugin \ - --kit-sha256 7beb736adfd334eed52e84070177634269e3a09f8bb25971b38606933ff4c997 \ + --kit-sha256 1391084a903254fb16d251522dba41ae34a06cfa4b2f6b7ba91a3cceeb895921 \ --consumer /usr/lib/cua/hyprland/cua-hyprland-plugin.so ```