Merge quattro into hermes-agent

Catches the branch up on 94 commits so what lands here is reviewed against
current quattro, and so #8611 contributes its own five files rather than
dragging a partial catch-up in behind it.

install/config/all.sh

@@ -1,4 +1,5 @@
 run_logged "$OMARCHY_INSTALL/config/theme-system.sh"
+run_logged "$OMARCHY_INSTALL/config/browser-policy.sh"
 run_logged "$OMARCHY_INSTALL/config/increase-lockout-limit.sh"
 run_logged "$OMARCHY_INSTALL/config/lockscreen-pam.sh"
 run_logged "$OMARCHY_INSTALL/config/fix-powerprofilesctl-shebang.sh"

install/config/browser-policy.sh

@@ -0,0 +1,2 @@
+source "$OMARCHY_PATH/install/helpers/browser-policy.sh"
+browser_policy_setup_dir /etc/chromium/policies/managed

install/config/enable-services.sh

@@ -1,16 +1,14 @@
 # Enable services only. Installs are followed by reboot, so don't start/reload
 # daemons mid-install. UFW and hardware-gated services stay in their own scripts.
 systemctl enable cups.service
-systemctl enable cups-browsed.service
 systemctl enable avahi-daemon.service
 systemctl enable linux-modules-cleanup.service
 systemctl enable docker.socket
 systemctl enable systemd-resolved.service
 systemctl enable NetworkManager.service
-# Don't let network-online.target (pulled in by cups-browsed) hold up
-# graphical.target waiting for DHCP/Wi-Fi association. Nothing in the session
-# needs to block on the network. Mirrors the systemd-networkd-wait-online mask
-# in install/hardware/network.sh.
+# Don't let network-online.target hold up graphical.target waiting for
+# DHCP/Wi-Fi association. Nothing in the session needs to block on the network.
+# Mirrors the systemd-networkd-wait-online mask in install/hardware/network.sh.
 systemctl mask NetworkManager-wait-online.service
 systemctl enable power-profiles-daemon.service
 systemctl enable sddm.service

install/config/theme-system.sh

@@ -6,11 +6,8 @@ ln -snf /usr/share/icons/Adwaita/symbolic/actions/go-next-symbolic.svg \
           /usr/share/icons/Yaru/scalable/actions/go-next-symbolic.svg
 gtk-update-icon-cache /usr/share/icons/Yaru &>/dev/null || true
 
-# Chromium policy directory for theme
-mkdir -p /etc/chromium/policies/managed
-chmod a+rw /etc/chromium/policies/managed
-
-# Default Chromium to follow system appearance ("device") instead of dark
+# Seed Chromium's first run: follow system appearance ("device") instead of dark,
+# and skip the terms-of-service dialog Chromium 151 turned on by default.
 mkdir -p /usr/lib/chromium
-echo '{"browser":{"theme":{"color_scheme":0,"color_scheme2":0}}}' > \
+echo '{"distribution":{"require_eula":false},"browser":{"theme":{"color_scheme":0,"color_scheme2":0}}}' > \
   /usr/lib/chromium/initial_preferences

install/helpers/as-root.sh

@@ -0,0 +1,7 @@
+as_root() {
+  if (( EUID == 0 )); then
+    "$@"
+  else
+    sudo "$@"
+  fi
+}

install/helpers/browser-policy.sh

@@ -0,0 +1,168 @@
+# Chromium-family machine policy is mandatory for every profile. Directories
+# stay 0755 root:root; omarchy-theme-set-browser-policy is the privileged
+# write for color.json.
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/as-root.sh"
+
+BROWSER_POLICY_MANAGED_DIRS=(
+  /etc/chromium/policies/managed
+  /etc/opt/chrome/policies/managed
+  /etc/opt/edge/policies/managed
+  /etc/brave/policies/managed
+)
+
+# Ancestors of the managed dirs, shortest first. A writable or attacker-owned
+# parent can rename the leaf aside; install -d follows a planted symlink.
+BROWSER_POLICY_PARENT_DIRS=(
+  /etc/chromium
+  /etc/chromium/policies
+  /etc/opt/chrome
+  /etc/opt/chrome/policies
+  /etc/opt/edge
+  /etc/opt/edge/policies
+  /etc/brave
+  /etc/brave/policies
+)
+
+BROWSER_POLICY_FIREFOX_DIRS=(
+  /usr/lib/firefox/distribution
+  /opt/zen-browser/distribution
+)
+
+BROWSER_POLICY_DEFAULT_COLOR="#1c2027"
+
+browser_policy_purge_dir() {
+  local dir=$1
+
+  as_root find "$dir" -mindepth 1 -maxdepth 1 ! -user root -exec rm -rf -- {} +
+}
+
+browser_policy_parent_hardened() {
+  local dir=$1
+
+  [[ -d $dir && ! -L $dir ]] || return 1
+  [[ $(stat -c '%a' "$dir") == "755" ]] || return 1
+  [[ $(stat -c '%U' "$dir") == "root" ]] || return 1
+}
+
+browser_policy_dir_hardened() {
+  browser_policy_parent_hardened "$1"
+}
+
+browser_policy_parents_hardened() {
+  local dir=$1
+  local parent
+
+  for parent in "${BROWSER_POLICY_PARENT_DIRS[@]}"; do
+    [[ $dir == "$parent"/* ]] || continue
+    [[ -e $parent || -L $parent ]] || continue
+    browser_policy_parent_hardened "$parent" || return 1
+  done
+}
+
+browser_policy_setup_parent() {
+  local dir=$1
+
+  if [[ -L $dir || ( -e $dir && ! -d $dir ) ]]; then
+    as_root rm -rf -- "$dir"
+  fi
+  as_root install -d -m 0755 -o root -g root "$dir"
+}
+
+browser_policy_setup_parents_for() {
+  local dir=$1
+  local parent
+
+  for parent in "${BROWSER_POLICY_PARENT_DIRS[@]}"; do
+    [[ $dir == "$parent"/* ]] || continue
+    browser_policy_setup_parent "$parent"
+  done
+}
+
+browser_policy_setup_dir() {
+  local dir=$1
+
+  browser_policy_setup_parents_for "$dir"
+  browser_policy_setup_parent "$dir"
+  browser_policy_purge_dir "$dir"
+}
+
+# Themes are user-installed. Accept only three 0-255 components.
+browser_policy_theme_hex() {
+  local theme_rgb=$1
+
+  if [[ $theme_rgb =~ ^[[:space:]]*([0-9]{1,3})[[:space:]]*,[[:space:]]*([0-9]{1,3})[[:space:]]*,[[:space:]]*([0-9]{1,3})[[:space:]]*$ ]] &&
+    (( 10#${BASH_REMATCH[1]} < 256 && 10#${BASH_REMATCH[2]} < 256 && 10#${BASH_REMATCH[3]} < 256 )); then
+    printf '#%02x%02x%02x' "$((10#${BASH_REMATCH[1]}))" "$((10#${BASH_REMATCH[2]}))" "$((10#${BASH_REMATCH[3]}))"
+    return
+  fi
+
+  printf '%s' "$BROWSER_POLICY_DEFAULT_COLOR"
+}
+
+browser_policy_install_color() {
+  local policy_dir=$1
+  local hex=$2
+  local dest=$policy_dir/color.json
+  local tmp
+
+  [[ -d $policy_dir && ! -L $policy_dir ]] || return 0
+  [[ $hex =~ ^#[0-9a-f]{6}$ ]] || return 1
+
+  tmp=$(mktemp) || return 1
+  printf '{"BrowserThemeColor": "%s", "BrowserColorScheme": "device"}\n' "$hex" >"$tmp"
+
+  if [[ -L $dest || -d $dest ]]; then
+    if ! rm -rf -- "$dest" 2>/dev/null; then
+      rm -f "$tmp"
+      return 1
+    fi
+  fi
+
+  if install -m 0644 -T "$tmp" "$dest" 2>/dev/null; then
+    rm -f "$tmp"
+    return 0
+  fi
+
+  rm -f "$tmp"
+  return 1
+}
+
+browser_policy_firefox_policy_file_ok() {
+  local file=$1
+  local mode
+  local group_write
+  local other_write
+
+  [[ -f $file && ! -L $file ]] || return 1
+  [[ $(stat -c '%U' "$file") == "root" ]] || return 1
+  mode=$(stat -c '%a' "$file")
+  group_write=$((8#${mode: -2:1}))
+  other_write=$((8#${mode: -1}))
+  (( (group_write & 2) == 0 && (other_write & 2) == 0 ))
+}
+
+browser_policy_firefox_hardened() {
+  local dir=$1
+
+  [[ -d $dir && ! -L $dir ]] || return 1
+  [[ $(stat -c '%a' "$dir") == "755" ]] || return 1
+  [[ $(stat -c '%U' "$dir") == "root" ]] || return 1
+  browser_policy_firefox_policy_file_ok "$dir/policies.json"
+}
+
+browser_policy_install_firefox_policies() {
+  local distribution_dir=$1
+  local policies=${2:-$OMARCHY_PATH/default/firefox/policies.json}
+
+  as_root install -m 644 -o root -g root -T "$policies" "$distribution_dir/policies.json"
+}
+
+browser_policy_setup_firefox_distribution() {
+  local distribution_dir=$1
+  local policies=${2:-$OMARCHY_PATH/default/firefox/policies.json}
+
+  browser_policy_setup_parent "$distribution_dir"
+  browser_policy_purge_dir "$distribution_dir"
+  browser_policy_install_firefox_policies "$distribution_dir" "$policies"
+}

install/omarchy-base.packages

@@ -17,9 +17,8 @@ chromium
 clang
 cliamp
 cups
-cups-browsed
 cups-filters
-cups-pdf
+cups-pk-helper
 ddcutil
 docker
 docker-buildx

install/post-install/pacman.sh

@@ -3,11 +3,11 @@
 cp -f "$OMARCHY_PATH/default/pacman/pacman-${OMARCHY_MIRROR:-stable}.conf" /etc/pacman.conf
 cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-${OMARCHY_MIRROR:-stable}" /etc/pacman.d/mirrorlist
 
-# omarchy-settings skips this override until cups-browsed is actually present
-# to avoid pacman creating cups-browsed.conf.pacnew during ISO package install.
-if [[ -f $OMARCHY_PATH/etc-overrides/cups-cups-browsed.conf && -d /etc/cups ]]; then
-  cp -f "$OMARCHY_PATH/etc-overrides/cups-cups-browsed.conf" /etc/cups/cups-browsed.conf
-  rm -f /etc/cups/cups-browsed.conf.pacnew
+# Wait for CUPS to own the file, the way omarchy-settings does, so pacman does
+# not turn the override into a .pacnew during ISO package installation.
+if [[ -f $OMARCHY_PATH/etc-overrides/cups-cups-files.conf && -f /etc/cups/cups-files.conf ]]; then
+  install -m 0640 -o root -g cups "$OMARCHY_PATH/etc-overrides/cups-cups-files.conf" /etc/cups/cups-files.conf
+  rm -f /etc/cups/cups-files.conf.pacnew
 fi
 
 source "$OMARCHY_INSTALL/hardware/pacman.sh"

install/provisioning/setup-form.sh

@@ -79,7 +79,7 @@ Turkish|trq
 Ukrainian|ua'
 
 OMARCHY_USERNAME_PATTERN='^[a-z_][a-z0-9_-]*[$]?$'
-OMARCHY_RESERVED_USERNAMES='^(root|bin|daemon|mail|ftp|http|nobody|dbus|systemd-coredump|systemd-network|systemd-oom|systemd-journal-remote|systemd-resolve|systemd-timesync|tss|uuidd|alpm|git|avahi|cups|lp|_talkd|polkitd|rtkit|qemu|brltty|gluster|rpc|libvirt-qemu|pcscd|nvidia-persistenced|sddm)$'
+OMARCHY_RESERVED_USERNAMES='^(root|bin|daemon|mail|ftp|http|nobody|dbus|systemd-coredump|systemd-network|systemd-oom|systemd-journal-remote|systemd-resolve|systemd-timesync|tss|uuidd|alpm|git|avahi|cups|cups-browsed|lp|_talkd|polkitd|rtkit|qemu|brltty|gluster|rpc|libvirt-qemu|pcscd|nvidia-persistenced|sddm)$'
 OMARCHY_HOSTNAME_PATTERN='^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$'
 OMARCHY_HOSTNAME_DEFAULT='omarchy'