Merge pull request #436 from omacom/fix/cua-hyprland-pkgrel-3

Accept Hyprland 0.56.2-3 in the Cua plugin profile
2026-09-13 23:54:33 -07:00
commit de4880081d
@@ -1,33 +1,36 @@
-# Separately reviewed download wrapper; original kit and source identity are unchanged.
+# Verified upstream kit with a local package-revision profile; source/tooling are unchanged.
 # Normal reruns need a fresh build directory; makepkg -e reuses verified extracted trees.
 # Profile kit: original source bytes and separately committed packaging tooling.
 # shellcheck shell=bash disable=SC2034,SC2154
 pkgname=cua-hyprland-plugin
 pkgver=0.26.1
-pkgrel=2
-pkgdesc='Cua input candidate for reviewed profile omarchy-stable-20260910'
+pkgrel=3
+pkgdesc='Cua input candidate for reviewed profile omarchy-hyprland-0562r3'
 arch=('x86_64')
 url='https://github.com/trycua/cua'
 license=('MIT')
-depends=('hyprland=0.56.2-2' 'aquamarine=0.15.0-2' 'glibc=2.44+r24+g16be1518495f-1' 'hyprcursor=0.1.13-7' 'hyprgraphics=0.5.1-4' 'hyprlang=0.6.8-5' 'hyprutils=0.14.2-1' 'libgcc=16.2.1+r23+gd564253eb6c8-1' 'libstdc++=16.2.1+r23+gd564253eb6c8-1' 'libxkbcommon=1.13.2-1' 'wayland=1.26.0-1' 'python>=3.11' 'binutils')
+depends=('hyprland=0.56.2-3' 'aquamarine=0.15.0-2' 'glibc=2.44+r24+g16be1518495f-1' 'hyprcursor=0.1.13-7' 'hyprgraphics=0.5.1-4' 'hyprlang=0.6.8-5' 'hyprutils=0.14.2-1' 'libgcc=16.2.1+r23+gd564253eb6c8-1' 'libstdc++=16.2.1+r23+gd564253eb6c8-1' 'libxkbcommon=1.13.2-1' 'wayland=1.26.0-1' 'python>=3.11' 'binutils')
 makedepends=('cmake>=3.30' 'ninja' 'pkgconf' 'gcc')
 options=('!strip' '!debug' '!lto')
 _stem='cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7'
 _archive_sha256='47bca9e018f32f4fcfe683f91c7475c60368f3b65d318cc35c1f2de88a4ee9ab'
-_kit_sha256='7beb736adfd334eed52e84070177634269e3a09f8bb25971b38606933ff4c997'
-_profile_sha256='5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a'
+_kit_sha256='1391084a903254fb16d251522dba41ae34a06cfa4b2f6b7ba91a3cceeb895921'
+_profile_sha256='eebba812a7513b471cf8969364334a4bde1eaa9c4519157701c771c1b6cd1b07'
 _verifier_sha256='480f649cbd35a0ddc7f49dc0a3a44785402c9e0ec9653b0f8ea4965d52d7f900'
 _cxx="${CUA_RELEASE_CXX:-/usr/bin/g++}"
 _download_name='cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7-profile-omarchy-stable-20260910-kit-1.1.0-5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a-67f89ceb47edd973aa748820eadd02ddbfb3d3e4.tar.gz'
 _download_sha256='a89bfa7f6490f598719dfabdd2a5badc137e27b0764fd25e6a05e1f969433520'
-source=('https://github.com/trycua/cua/releases/download/cua-hyprland-kit-v1.1.0-omarchy-stable-20260910/cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7-profile-omarchy-stable-20260910-kit-1.1.0-5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a-67f89ceb47edd973aa748820eadd02ddbfb3d3e4.tar.gz')
+source=('https://github.com/trycua/cua/releases/download/cua-hyprland-kit-v1.1.0-omarchy-stable-20260910/cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7-profile-omarchy-stable-20260910-kit-1.1.0-5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a-67f89ceb47edd973aa748820eadd02ddbfb3d3e4.tar.gz'
+        'PROFILE.json')
 noextract=("$_download_name")
-sha256sums=('a89bfa7f6490f598719dfabdd2a5badc137e27b0764fd25e6a05e1f969433520')
+sha256sums=('a89bfa7f6490f598719dfabdd2a5badc137e27b0764fd25e6a05e1f969433520'
+            'eebba812a7513b471cf8969364334a4bde1eaa9c4519157701c771c1b6cd1b07')

 _verify_download() {
-  python3 -I - "$SRCDEST/$_download_name" "$_download_sha256" "$srcdir" "$1" <<'CUA_DOWNLOAD_PY'
+  python3 -I - "$SRCDEST/$_download_name" "$_download_sha256" "$srcdir" "$1" "$SRCDEST/PROFILE.json" <<'CUA_DOWNLOAD_PY'
 import hashlib
 import io
+import json
 from pathlib import Path, PurePosixPath
 import sys
 import tarfile
@@ -42,7 +45,7 @@ def require(condition, message):
 def digest(data):
    return hashlib.sha256(data).hexdigest()

-archive, checksum, srcdir, mode = sys.argv[1:]
+archive, checksum, srcdir, mode, profile_path = sys.argv[1:]
 archive, srcdir = Path(archive), Path(srcdir)
 require(mode in {'check', 'extract'}, 'invalid kit verification mode')
 require(archive.is_file() and not archive.is_symlink(), 'outer archive must be a regular file')
@@ -58,6 +61,35 @@ with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as contents:
        require(digest(content) == expected[member.name], 'outer kit member checksum mismatch')
        payload[member.name] = content
 require(payload.keys() == expected.keys(), 'outer kit inventory mismatch')
+# Arch's -3 package has the same compositor and all 498 headers/pkg-config
+# files as -2. Derive a version-only profile with the original source/tooling
+# and byte checks intact; record its own profile and kit provenance digests.
+profile_data = Path(profile_path).read_bytes()
+require(digest(profile_data) == 'eebba812a7513b471cf8969364334a4bde1eaa9c4519157701c771c1b6cd1b07',
+        'local profile checksum mismatch')
+profile = json.loads(payload['PROFILE.json'])
+profile.update(profile_id='omarchy-hyprland-0562r3', package_release=3)
+profile['hyprland']['package_version'] = '0.56.2-3'
+require(json.loads(profile_data) == profile, 'local profile changes more than the reviewed package revision')
+payload['PROFILE.json'] = profile_data
+provenance = json.loads(payload['KIT-PROVENANCE.json'])
+provenance['profile_sha256'] = digest(profile_data)
+payload['KIT-PROVENANCE.json'] = (json.dumps(provenance, sort_keys=True, indent=2) + '\n').encode()
+recipe = payload['PKGBUILD'].decode()
+for old, new in [('pkgrel=2\n', 'pkgrel=3\n'), ('omarchy-stable-20260910', profile['profile_id']),
+                 ('hyprland=0.56.2-2', 'hyprland=0.56.2-3'),
+                 ('5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a', digest(profile_data)),
+                 ('7beb736adfd334eed52e84070177634269e3a09f8bb25971b38606933ff4c997', digest(payload['KIT-PROVENANCE.json']))]:
+    recipe = recipe.replace(old, new)
+payload['PKGBUILD'] = recipe.encode()
+payload['SHA256SUMS'] = ''.join(f'{digest(body)}  {name}\n' for name, body in sorted(payload.items())
+                              if name != 'SHA256SUMS').encode()
+expected.update({'PROFILE.json': 'eebba812a7513b471cf8969364334a4bde1eaa9c4519157701c771c1b6cd1b07',
+                 'KIT-PROVENANCE.json': '1391084a903254fb16d251522dba41ae34a06cfa4b2f6b7ba91a3cceeb895921',
+                 'PKGBUILD': '4c5ef50c5a8d556d461afe283b13b228fb09d2558b37fb76257e13e25846325b',
+                 'SHA256SUMS': '2ea22af60f8c86df588fd7db103d9f444d9ac4018b704a48ddff2545ff7ce999'})
+for name, content in payload.items():
+    require(digest(content) == expected[name], 'derived kit checksum mismatch: ' + name)
 require(srcdir.is_dir() and not srcdir.is_symlink(), 'srcdir must be a real directory')
 kit, source = srcdir / 'cua-profile-kit', srcdir / stem
 if mode == 'extract':
@@ -0,0 +1,40 @@
+{
+  "architecture": "x86_64",
+  "compiler": {
+    "comment": "GCC: (GNU) 16.2.1 20260810",
+    "sha256": "f04191f6a7b2cd7d9a62e1745872b8a6088791e5af6955488c69c9b2c4668bc9",
+    "version": "16.2.1 20260810"
+  },
+  "hyprland": {
+    "header_version": "0.56.2",
+    "headers_sha256": "88a6875af00203627b264a5c1f9908781be4ad8d9cee4e577fef174e72dd0e28",
+    "package_version": "0.56.2-3",
+    "sha256": "da8fcacf347bcbed83edc40108c6e2298da095e22246bd764e9bb382786cebb2"
+  },
+  "kit_version": "1.1.0",
+  "package_release": 3,
+  "profile_id": "omarchy-hyprland-0562r3",
+  "runtime": {
+    "basename": "libstdc++.so.6.0.36",
+    "packages": {
+      "aquamarine": "0.15.0-2",
+      "glibc": "2.44+r24+g16be1518495f-1",
+      "hyprcursor": "0.1.13-7",
+      "hyprgraphics": "0.5.1-4",
+      "hyprlang": "0.6.8-5",
+      "hyprutils": "0.14.2-1",
+      "libgcc": "16.2.1+r23+gd564253eb6c8-1",
+      "libstdc++": "16.2.1+r23+gd564253eb6c8-1",
+      "libxkbcommon": "1.13.2-1",
+      "wayland": "1.26.0-1"
+    },
+    "sha256": "f5fc7380f2ae46fa4053a64be04e7b98109f1066a4bbfff3c37042488aa0be0e"
+  },
+  "schema": 2,
+  "source": {
+    "archive_sha256": "47bca9e018f32f4fcfe683f91c7475c60368f3b65d318cc35c1f2de88a4ee9ab",
+    "driver_version": "0.26.1",
+    "manifest_sha256": "54f514664c84e1358a435f29cd6befd5661b0b133d76997191c000b10f021a75",
+    "revision": "cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7"
+  }
+}
@@ -12,12 +12,28 @@ It is not a repackaging of the unmodified 0.24.0 plugin.

 The qualified Driver pairing is `cua-driver-bin 0.27.0-1`, with input protocol v3. Driver 0.27.0 contains the bounded stale-geometry retry validated with this pinned module; its production plugin source is unchanged from the source used here. Discovery protocol v2 is separate. A newer Driver release is a changed pairing and requires affected replay before promotion.

-Profile `omarchy-stable-20260910`, kit `1.1.0`, and package release `2` pin:
+Profile `omarchy-hyprland-0562r3`, kit tooling `1.1.0`, and package release `3` pin:

- Hyprland `0.56.2-2`, headers `0.56.2`, and measured executable/header hashes.
+- Hyprland `0.56.2-3`, headers `0.56.2`, and measured executable/header hashes.
 - GCC `16.2.1 20260810`, including compiler bytes and emitted ELF identity.
 - Shared runtime `libstdc++.so.6.0.36`, its bytes, and exact ABI package versions.

+This profile derives from Cua's `omarchy-stable-20260910` profile. Arch's
+Hyprland `-3` package splits out `hyprpm` and changes package dependencies;
+its compositor executable and all 498 header/pkg-config files are byte-identical
+to `-2`. Both executables have SHA-256
+`da8fcacf347bcbed83edc40108c6e2298da095e22246bd764e9bb382786cebb2`.
+The checked-in `PROFILE.json` changes only the profile name, package release,
+and exact Hyprland package version. Compiler, runtime, source, executable,
+and header identities remain unchanged. The download wrapper verifies the
+original kit before deriving the updated profile, recipe, and provenance,
+then verifies every derived member against its recorded digest.
+
+The native qualification below was recorded with package release `2` and
+Hyprland `-2`. This packaging update does not claim a new application or
+Driver replay. The `-3` dependency must reach a destination channel before
+this artifact can be installed there; publication still follows edge → RC → stable.
+
 The generated `PKGBUILD` identifies the immutable kit download, outer checksum,
 and member checksums. The kit records the full source and tooling revisions,
 profile digest, and source archive/manifest digests. Do not infer compatibility
@@ -109,13 +125,13 @@ configuration edits, or hot replacement.

 Save your work and exit Hyprland before installing, replacing, or removing the
 package. Install the exact reviewed package from a text console, then start a
-fresh session. Before loading, run the consumer check with the independently
-reviewed kit-provenance digest from the qualification record:
+fresh session. Before loading, run the consumer check with this package's derived
+kit-provenance digest:

 ```sh
 python3 /usr/share/cua-hyprland-plugin/profile_verify.py \
  --kit /usr/share/cua-hyprland-plugin \
-  --kit-sha256 7beb736adfd334eed52e84070177634269e3a09f8bb25971b38606933ff4c997 \
+  --kit-sha256 1391084a903254fb16d251522dba41ae34a06cfa4b2f6b7ba91a3cceeb895921 \
  --consumer /usr/lib/cua/hyprland/cua-hyprland-plugin.so
 ```