Files
omarchy-pkgs/pkgbuilds/omarchy-dev/PKGBUILD
T
40ea1555f2 Ship the complete passwordless-sudo lifecycle in settings-dev (#645)
* Move the dev sudo grant lifecycle into omarchy-settings-dev

The hardened omarchy-sudo-passwordless publishes a grant only when its revocation hook is installed and no package transaction has left /run/omarchy-sudo-passwordless-package-removing behind. The hook sets that marker before every settings upgrade, and the settings scriptlets are what clear it, so shipping the hook alone let the first grant work and then refused every grant after the next update until a reboot.

omarchy-settings-dev now ships the command, omarchy-security-functions, the boot cleanup rule and the hook together, with the scriptlets from #257 that revoke before the package changes and clear the marker once no grant remains. omarchy-dev stops shipping the two helpers and requires the settings release that does: without it omarchy-update has no library to source.

Co-authored-by: Afonso Oliveira <afonso.oliveira707@gmail.com>

* Check that settings-dev registers the scriptlet the lifecycle test exercises

The lifecycle test reads the .install file directly, so it kept passing with the recipe's install= line gone, which is the one change that would strand the hook's marker again.

Co-Authored-By: Codex XHigh <noreply@openai.com>

* Keep omarchy-dev's settings dependency unversioned

The dev pair builds each package on its own against the published edge repository, in the PR build and in publish alike, so omarchy-dev cannot require a settings-dev release that only this change produces: the floor failed both omarchy-dev builds on this PR, and an exact pkgver match would fail the same way on every upstream pin bump. Nothing needs it. The upstream watch moves both pins together, publish stops the run before anything is published when one package fails, and a new settings-dev over an old runtime is refused on the files they would both own.

* Refuse settings-dev releases that predate the grant helper move

With the dependency unversioned, a new omarchy-dev could still install over a settings-dev that is held back or not yet published, removing omarchy-security-functions from both, and omarchy-update cannot start without it. A versioned conflict refuses that pairing at install time without constraining the per-package builds, which resolve only depends.

Co-Authored-By: Codex XHigh <noreply@openai.com>

* Require the security library as a capability instead of a version floor

The conflict named the last settings-dev release without the helpers, a version that moves with every upstream pin bump and settings-only pkgrel while this change waits to merge, and a rebase that kept a stale floor still passed the tests while the published release slipped past it. omarchy-settings-dev now provides omarchy-security-functions and omarchy-dev's package() requires it. makepkg checks only the top-level depends before building, so the per-package builds still resolve against the published repository, while pacman refuses a runtime without a settings release that ships the library, and pulls that release in when only the runtime is asked for.

Co-Authored-By: Codex XHigh <noreply@openai.com>

---------

Co-authored-by: Spencer Bull <spencer@omarchy.org>
Co-authored-by: Afonso Oliveira <afonso.oliveira707@gmail.com>
Co-authored-by: Codex XHigh <noreply@openai.com>
2026-10-11 09:56:47 -05:00

158 lines
5.9 KiB
Bash

# Maintainer: Ryan Hughes <ryan@omarchy.org>
pkgname='omarchy-dev'
pkgver=4.0.0.r6897.g4df5459
pkgrel=2
# Pinned by the upstream watch in .omarchy/package.json (bin/sync-upstream):
# every quattro tip becomes a commit pin here, so the package is versioned,
# checksummed and built exactly like a release, just more often. The r-number
# is the branch's total commit count, not the distance from the last tag: the
# published history used the total, and pacman must never see it go down.
_commit=4df545905d70b92d7c2dc62b339ff529d0075551
pkgdesc='Beautiful, modern, and opinionated Arch Linux by DHH (quattro branch tip)'
# The payload is architecture-independent, but the dependency set is not: the
# boot stack differs per architecture (see depends_x86_64 / depends_aarch64),
# and makepkg only honours arch-suffixed arrays on arch-specific packages.
arch=('x86_64' 'aarch64')
url='https://github.com/basecamp/omarchy'
license=('MIT')
provides=('omarchy')
conflicts=('omarchy')
# Hard depends: only packages whose removal would brick the desktop. The ISO
# pacstraps the full default install set from install/omarchy-base.packages.
depends=(
# Omarchy meta
'omarchy-keyring'
'omarchy-settings-dev'
# Wayland / Hyprland core
'hyprland'
'quickshell'
'uwsm'
'sddm'
'xdg-desktop-portal-hyprland'
# Audio / auth / portal essentials
'wireplumber'
'pipewire'
'gnome-keyring'
# Required by omarchy-* scripts and omarchy-shell
'gum'
'jq'
'git'
'perl' # /usr/bin/omarchy-shell invokes perl directly
# Update availability checks (checkupdates from pacman-contrib uses fakeroot)
'fakeroot'
'pacman-contrib'
# System font (UI assumes it)
'ttf-jetbrains-mono-nerd-basic'
)
# Bootloader stack. Lives here rather than on omarchy-settings because
# omarchy-settings is also installed into the live ISO env (for plymouth
# / /etc/skel seeding), where the limine-mkinitcpio-hook would fail with
# 'Cannot detect an ESP path' inside the chroot. The omarchy-settings
# config drop-ins under /etc/mkinitcpio.conf.d/, /etc/limine-entry-tool.d/,
# and /etc/snapper/config-templates/ only do anything when these are
# installed alongside.
depends_x86_64=(
'limine'
'limine-mkinitcpio-hook'
'limine-snapper-sync'
'snapper'
)
# Apple Silicon boots through m1n1 + GRUB from the Asahi packages and keeps
# Arch Linux ARM's kernel and boot layout, so the Limine/Snapper stack does not
# apply. Only Apple Silicon's Broadcom Wi-Fi needs iwd, and omarchy-mac depends
# on it. Elsewhere the package only renames the Wi-Fi interface to wlan0
# (80-iwd.link), and a saved connection tied to the old name stops connecting.
depends_aarch64=(
'networkmanager'
)
makedepends=(
'git'
)
# Source: the pinned quattro commit. Set OMARCHY_SRC=/path/to/checkout to
# build from a local source tree instead (mirrors omarchy-zsh/omarchy-fish DX);
# the arrays are emptied below so nothing is downloaded in that case.
source=("omarchy::git+https://github.com/basecamp/omarchy.git#commit=${_commit}")
sha256sums=('31bfb9dd158ead5bd6e740bb82df7f89532a587fdd84b1711ed3a5688c2cab48')
if [[ -n "${OMARCHY_SRC:-}" ]]; then
source=()
sha256sums=()
fi
prepare() {
if [[ -n "${OMARCHY_SRC:-}" ]]; then
rm -rf "$srcdir/omarchy"
mkdir -p "$srcdir/omarchy"
cp -a "${OMARCHY_SRC}/." "$srcdir/omarchy/"
fi
}
package() {
# omarchy-update cannot start without the library settings now ships. Set
# here, not above: makepkg checks only the top-level depends before
# building, against a repository that may not publish that settings yet.
depends+=('omarchy-security-functions')
cd "$srcdir/omarchy"
# Runtime binaries — ship everything in bin/ except the debug helpers
# that ship from omarchy-settings (needed before omarchy is installed,
# e.g. on the ISO live env), and the sudo grant helpers settings owns.
install -d "$pkgdir/usr/bin" "$pkgdir/usr/share/omarchy/bin"
for bin in bin/*; do
[[ -f $bin ]] || continue
local base
base=$(basename "$bin")
case "$base" in
omarchy-debug|omarchy-debug-idle|omarchy-upload-log|omarchy-sudo-passwordless|omarchy-security-functions)
continue
;;
esac
install -Dm755 "$bin" "$pkgdir/usr/bin/$base"
ln -s "/usr/bin/$base" "$pkgdir/usr/share/omarchy/bin/$base"
done
install -d "$pkgdir/usr/share/omarchy"
# Guard direct pacman upgrades from bypassing the Omarchy update pipeline,
# and pause Hyprland live config reloads while settings files are replaced.
# Ship hooks with their Exec targets so package skew cannot leave a broken
# hook pointing at a missing binary.
install -Dm644 default/libalpm/hooks/00-omarchy-update-guard.hook "$pkgdir/usr/share/libalpm/hooks/00-omarchy-update-guard.hook"
install -Dm644 default/libalpm/hooks/10-omarchy-hyprland-reload-pause.hook "$pkgdir/usr/share/libalpm/hooks/10-omarchy-hyprland-reload-pause.hook"
install -Dm644 default/libalpm/hooks/90-omarchy-hyprland-reload-resume.hook "$pkgdir/usr/share/libalpm/hooks/90-omarchy-hyprland-reload-resume.hook"
# Target-side setup scripts and package lists used by ISO finalization,
# first login, future users, migrations, and reinstall/reset commands.
cp -a install "$pkgdir/usr/share/omarchy/"
# Theme bundles for theme switching.
cp -a themes "$pkgdir/usr/share/omarchy/"
# Versioned migrations runner reads from this tree.
cp -a migrations "$pkgdir/usr/share/omarchy/"
# Fresh users created after install are already on the package layout in this
# build, so seed migration markers through /etc/skel. Existing users keep
# their own state and still run pending migrations on update.
if compgen -G 'migrations/*.sh' >/dev/null; then
install -d "$pkgdir/etc/skel/.local/state/omarchy/migrations"
for migration in migrations/*.sh; do
touch "$pkgdir/etc/skel/.local/state/omarchy/migrations/$(basename "$migration")"
done
fi
# Quickshell desktop shell tree.
cp -a shell "$pkgdir/usr/share/omarchy/"
# Runtime version file.
install -Dm644 version "$pkgdir/usr/share/omarchy/version"
}