Build omarchy-mac and omarchy-mac-boot from omacom/omarchy-mac-pkgs

Both recipes pin omacom/omarchy-mac-pkgs main 4399105 and stage the
top-level omarchy-mac/ and omarchy-mac-boot/ directories, each tested
from its own copy. omarchy-mac 0.1.0-11 and omarchy-mac-boot 20261004-1
sort above edge and every lab candidate. They carry the depends and the
platform-root provide from #672 and #673 and drop the migration engine,
legacy files and the Apple setup core now owns.

pkgbuilds/omarchy-mac-boot/PKGBUILD

@@ -1,49 +1,50 @@
 # Maintainer: Marcelo Alcantara <maralc@gmail.com>
 # Recipe from maralcbr/omarchy-pkgs asahi-quattro pkgbuilds/omarchy-mac-boot
 # (20260921-10 at 0a55baeddecf59687c32b4bd4e1dee743605c183); the payload now
-# builds from packages/omarchy-mac/boot in omacom/omarchy-mac.
+# builds from omarchy-mac-boot/ in omacom/omarchy-mac-pkgs.
 
 pkgname=omarchy-mac-boot
 # pkgver is the UTC commit date of _commit, so it sorts above the fork's
 # 20260921-N. Reset pkgrel to 1 when pkgver changes; bump it to re-pin or
 # rebuild on the same day.
-pkgver=20260927
+pkgver=20261004
 pkgrel=1
 pkgdesc='Apple Silicon boot support for Omarchy: initramfs, in-place encryption, first boot and Limine activation'
 arch=('aarch64')
 groups=('omarchy-platform-apple-silicon')
-url='https://github.com/omacom/omarchy-mac'
+url='https://github.com/omacom/omarchy-mac-pkgs'
 license=('MIT')
 makedepends=('git')
 provides=('omarchy-apple-boot' 'omarchy-first-boot')
 conflicts=('omarchy-apple-boot' 'omarchy-first-boot')
 replaces=('omarchy-apple-boot' 'omarchy-first-boot')
 install=omarchy-mac-boot.install
-# An exact omarchy-mac commit, never a branch.
-_commit=ff7ce0d4dfaea9e17270b3061e642ee095b7b265
-source=("omarchy-mac::git+https://github.com/omacom/omarchy-mac.git#commit=${_commit}")
-sha256sums=('7530c284cd323d451540205c0a677c4e187070f0b8c4081a2e85f487f2ebb985')
+# An exact omarchy-mac-pkgs main commit, never a branch.
+_commit=43991059e17bb0ab7e0ecf0010aef1fa73c3e2c9
+source=("omarchy-mac-pkgs::git+https://github.com/omacom/omarchy-mac-pkgs.git#commit=${_commit}")
+sha256sums=('654f54364a675ae9aa03728c49e5558121a7be70d60226cd8fdd4f901b195ee1')
 
 prepare() {
-  # Staging must not be able to read the surrounding desktop source.
+  # Tests and staging must not be able to read the other package's tree.
   rm -rf "$srcdir/boot"
-  cp -a "$srcdir/omarchy-mac/packages/omarchy-mac/boot" "$srcdir/boot"
-  [[ $(git -C "$srcdir/omarchy-mac" rev-parse HEAD) == "$_commit" ]]
-  [[ $(TZ=UTC0 git -C "$srcdir/omarchy-mac" show -s --format=%cd --date=format-local:%Y%m%d HEAD) == "$pkgver" ]]
+  cp -a "$srcdir/omarchy-mac-pkgs/omarchy-mac-boot" "$srcdir/boot"
+  [[ $(git -C "$srcdir/omarchy-mac-pkgs" rev-parse HEAD) == "$_commit" ]]
+  [[ $(TZ=UTC0 git -C "$srcdir/omarchy-mac-pkgs" show -s --format=%cd --date=format-local:%Y%m%d HEAD) == "$pkgver" ]]
 }
 
-# The tests run in the checkout: some compare the payload with the desktop
-# source around it (the HOOKS baseline in etc/, the first-run user units and the
-# default package lists, from omacom/omarchy-mac#582 and #598).
 check() {
-  "$srcdir/omarchy-mac/packages/omarchy-mac/boot/test/all"
+  "$srcdir/boot/test/all"
 }
 
 package() {
   # Runtime-only, so the builder stages and tests the payload without the
-  # desktop or a boot chain. 1.39.0-2 is the first limine-mkinitcpio-hook that
-  # leaves a Mac's /boot to mkinitcpio until Limine is activated.
+  # desktop. 1.39.0-2 is the first limine-mkinitcpio-hook that leaves a Mac's
+  # /boot to mkinitcpio until Limine is activated. update-m1n1 builds stage 2
+  # from m1n1 and U-Boot, so neither can be removed; m1n1 is the virtual name,
+  # leaving its provider (m1n1-aurora) to the image, as the kernel is. First
+  # boot populates the Asahi repository's keyring.
   depends=('omarchy' 'limine' 'limine-mkinitcpio-hook>=1.39.0-2' 'limine-snapper-sync' 'asahi-scripts'
+           'm1n1' 'uboot-asahi' 'asahi-alarm-keyring'
            'bash' 'binutils' 'btrfs-progs' 'coreutils' 'cpio' 'cryptsetup' 'diffutils' 'gawk' 'gnupg' 'grep'
            'gum' 'gzip' 'kbd' 'mkinitcpio' 'sed' 'systemd' 'util-linux')
 

pkgbuilds/omarchy-mac-boot/README.md

@@ -1,12 +1,12 @@
 # omarchy-mac-boot
 
-Apple Silicon boot support for Omarchy: the Mac mkinitcpio drop-ins and initcpio hooks, in-place LUKS conversion in the initramfs, vendor firmware in early boot, first boot of a Mac image, the Limine activation gate and the boot check. The source is `packages/omarchy-mac/boot/` in omacom/omarchy-mac, with its own tests. The recipe pins an exact omarchy-mac commit, copies that directory away from the surrounding desktop tree in `prepare()` and stages the package from the copy with its `install` script. `check()` runs its `test/all` in the full checkout instead, because some tests compare the payload with the desktop source around it (omacom/omarchy-mac#582 and #598). The recipe itself holds only metadata, `backup=` and the pacman scriptlet.
+Apple Silicon boot support for Omarchy: the Mac mkinitcpio drop-ins and initcpio hooks, in-place LUKS conversion in the initramfs, vendor firmware in early boot, first boot of a Mac image, the Limine activation gate and the boot check. The source is `omarchy-mac-boot/` in [omacom/omarchy-mac-pkgs](https://github.com/omacom/omarchy-mac-pkgs), with its own tests. The recipe pins an exact `main` commit, copies that directory away from the rest of the checkout in `prepare()`, runs its `test/all` from the copy in `check()` and stages the package from the copy with its `install` script. The recipe itself holds only metadata, `backup=` and the pacman scriptlet.
 
-It follows the fork recipe in maralcbr/omarchy-pkgs (`asahi-quattro`, `pkgbuilds/omarchy-mac-boot` at 20260921-10), which carried the payload as files in the recipe.
+It follows the fork recipe in maralcbr/omarchy-pkgs (`asahi-quattro`, `pkgbuilds/omarchy-mac-boot` at 20260921-10), which carried the payload as files in the recipe. Up to 20260927-1 it built from `packages/omarchy-mac/boot/` in omacom/omarchy-mac.
 
 ## Scope
 
-The package is aarch64-only and published to edge only. It widens to rc and stable only after M1 and M2 cold-boot qualification. It carries the Apple platform tag, `groups=('omarchy-platform-apple-silicon')`, which omarchy-settings' pacman platform guard uses to keep it off other machines once that guard ships (omacom/omarchy-mac#539, `docs/platform-guard.md`). Its only provides are the retired Apple-only names, and nothing generic depends on it or on them, so nothing generic can pull it onto non-Apple aarch64 machines. Its one Apple-only dependency, `asahi-scripts`, comes from the asahi-alarm repository that only the Apple profile configures.
+The package is aarch64-only and published to edge only. It widens to rc and stable only after M1 and M2 cold-boot qualification. It carries the Apple platform tag, `groups=('omarchy-platform-apple-silicon')`, which omarchy-settings' pacman platform guard uses to keep it off other machines once that guard ships (omacom/omarchy-mac#539, `docs/platform-guard.md`). Its only provides are the retired Apple-only names, and nothing generic depends on it or on them, so nothing generic can pull it onto non-Apple aarch64 machines. Its Apple-only dependencies come from the asahi-alarm repository that only the Apple profile configures: `asahi-scripts`; `m1n1` (the virtual name, leaving its provider `m1n1-aurora` to the image, as the kernel is) and `uboot-asahi`, which update-m1n1 builds stage 2 from; and `asahi-alarm-keyring`, which first boot populates.
 
 It requires `limine-mkinitcpio-hook` 1.39.0-2 or newer: that is the first build whose hooks leave a Mac's `/boot` to mkinitcpio until Limine is activated. With an older hook, Limine's kernel hook replaces mkinitcpio's by name, and this package's `limine-ready` gate stops it on a Mac that still boots GRUB, so a kernel update would never reach `/boot`.
 
@@ -16,7 +16,9 @@ From the source that drops the boot package's own Plymouth fragment (omacom/omar
 
 ## Publish order
 
-A new pin publishes on merge, so check what the pinned source needs first:
+A new pin publishes on merge, so check what the pinned source needs first. The rules name omacom/omarchy-mac pull requests; omacom/omarchy-mac-pkgs keeps their history, and every pin from it includes all of them.
+
+- **Runtime.** Publish with or before the runtime that needs it. The runtime from omacom/omarchy#13362 requires `setup-boot` (omacom/omarchy-mac#635) and `update-takeover` (#636) through `omarchy-lifecycle-dispatch`, calls `luks-slots --owner` (#659) before any drive password change, and no longer adds a recovery key, which the boot check accepts only from #657 on. With an older boot package, hardware setup, updates that take over unowned files, drive password changes and the boot check fail on Apple Silicon.
 
 - **Settings baseline.** A pin that includes omacom/omarchy-mac#544 (no `93-omarchy-mac-plymouth.conf`) needs omarchy-settings with the HOOKS baseline (omacom/omarchy-mac#542) published on aarch64, and providing `omarchy-mkinitcpio-hooks-baseline`. Publish that first; otherwise this build cannot be installed.
 - **Update verification.** A pin that includes omacom/omarchy-mac#543 (`/usr/lib/omarchy/mac-boot/update-verify`) must publish before any runtime that carries #543. Otherwise that runtime blocks every update on Macs whose `omarchy-mac-boot` predates it.
@@ -26,6 +28,8 @@ A new pin publishes on merge, so check what the pinned source needs first:
 
 ## Transition
 
+- **From omacom/omarchy-mac-pkgs (20261004-1).** The package no longer carries the migration engine: `omarchy-mac-migrate`, `/usr/lib/omarchy/mac-boot/migrate`, the `migrate-*.sh` modules and `omarchy-mac-migrate-verify.service`. pacman removes them on upgrade. Converting a fork or mx-mac Mac is a separate migration script. A Mac stopped between a migration's reboot and its verification (`/var/lib/omarchy-mac/migration/reboot-pending`) must finish it before this upgrade: afterwards its enable link dangles and nothing verifies that boot.
+
 - It provides, conflicts with and replaces `omarchy-apple-boot` and `omarchy-first-boot`. The scriptlet moves a pending `omarchy-first-boot` marker to `omarchy-mac-first-boot`, drops the replaced unit's dangling enable link and points at a customised `90-omarchy-asahi.conf.pacsave`.
 - `pkgver` is the UTC commit date of the pin, so any pin from `20260925` on upgrades the fork's `20260921-10` on mx-mac Macs. The files the fork shipped that the source no longer does (the image finalize tools, the upstream ARM repository key and the GRUB snapshot-menu hook) are removed by that upgrade.
 - `backup=` covers every `/etc` file and `/usr/lib/omarchy/initcpio`. It includes `/etc/default/update-m1n1`, which pins update-m1n1's device-tree order to the C locale. On a Mac that already has its own unowned copy, pacman keeps it and installs the shipped one as `.pacnew`. The snapshot restore hooks in `/etc/boot/hooks` are symlinks to `/usr/bin/omarchy-mac-snapshot-check`, not files, so they stay out of it.
@@ -34,7 +38,9 @@ A new pin publishes on merge, so check what the pinned source needs first:
 
 Updates are reviewed pins, never a branch:
 
-1. Set `_commit` to the full omarchy-mac SHA and `pkgver` to its UTC commit date (`TZ=UTC0 git show -s --format=%cd --date=format-local:%Y%m%d <sha>`); `prepare()` checks both.
+1. Set `_commit` to the full omacom/omarchy-mac-pkgs `main` SHA and `pkgver` to its UTC commit date (`TZ=UTC0 git show -s --format=%cd --date=format-local:%Y%m%d <sha>`); `prepare()` checks both.
 2. Reset `pkgrel` to 1 when `pkgver` changes; bump it for a second pin on the same date or a rebuild.
 3. Refresh `sha256sums` with `makepkg -g`.
-4. Check the pin against [Publish order](#publish-order). Before the first pin that includes omacom/omarchy-mac#567 publishes, `omarchy-mac` must be published at or past #535, or re-pinned in the same pull request.
+4. Check the pin against [Publish order](#publish-order). `omarchy-mac` must be published at or past omacom/omarchy-mac#535, or re-pinned in the same pull request.
+
+`20261004-1` sorts above edge's `20260927-1` and every lab candidate up to `20260928-3`.