Merge quattro into hermes-agent
Catches the branch up on 94 commits so what lands here is reviewed against current quattro, and so #8611 contributes its own five files rather than dragging a partial catch-up in behind it.
This commit is contained in:
David Heinemeier Hansson committed
commit
2541eeee3d
115 files changed
+6771
-441
No files matched your search
@@ -0,0 +1,30 @@
|
||||
echo "Stop world-writable Chromium and Firefox policy directories"
|
||||
|
||||
source "$OMARCHY_PATH/install/helpers/browser-policy.sh"
|
||||
|
||||
repaired=0
|
||||
for dir in "${BROWSER_POLICY_MANAGED_DIRS[@]}"; do
|
||||
[[ -d $dir || -L $dir ]] || continue
|
||||
browser_policy_setup_dir "$dir"
|
||||
repaired=1
|
||||
done
|
||||
|
||||
# Repainting the policy color is cosmetic and the next theme change redoes it.
|
||||
# Under bash -euo pipefail a failure here would abort the migration before the
|
||||
# Firefox directories below are hardened, and the marker would never be written.
|
||||
if (( repaired )); then
|
||||
omarchy-theme-set-browser || true
|
||||
fi
|
||||
|
||||
for dir in "${BROWSER_POLICY_FIREFOX_DIRS[@]}"; do
|
||||
[[ -d $dir || -L $dir ]] || continue
|
||||
if browser_policy_firefox_hardened "$dir"; then
|
||||
browser_policy_purge_dir "$dir"
|
||||
continue
|
||||
fi
|
||||
browser_policy_setup_parent "$dir"
|
||||
browser_policy_purge_dir "$dir"
|
||||
if ! browser_policy_firefox_policy_file_ok "$dir/policies.json"; then
|
||||
browser_policy_install_firefox_policies "$dir"
|
||||
fi
|
||||
done
|
||||
@@ -0,0 +1,20 @@
|
||||
echo "Require signed packages from the Omarchy repository"
|
||||
|
||||
# The [omarchy] repo predates the Omarchy packaging key, so existing installs
|
||||
# carry a SigLevel override that also accepts unsigned packages. Packages are
|
||||
# signed now, so drop the override and let the repo inherit the global
|
||||
# SigLevel = Required DatabaseOptional like every other repo. Machine-wide and
|
||||
# self-detecting, so another user's rerun no-ops.
|
||||
omarchy_sig_override='SigLevel = Optional TrustAll'
|
||||
|
||||
if [[ -f /etc/pacman.conf ]] &&
|
||||
sed -n '/^\[omarchy\]/,/^\[/p' /etc/pacman.conf | grep -qxF "$omarchy_sig_override"; then
|
||||
# Requiring signatures with an untrusted packaging key would fail every
|
||||
# omarchy transaction, including the one that could repair it.
|
||||
if omarchy-pkg-missing omarchy-keyring ||
|
||||
! sudo pacman-key --list-keys 40DFB630FF42BCFFB047046CF0134EE680CAC571 &>/dev/null; then
|
||||
omarchy-update-keyring
|
||||
fi
|
||||
|
||||
sudo sed -i "/^\[omarchy\]/,/^\[/{/^$omarchy_sig_override$/d}" /etc/pacman.conf
|
||||
fi
|
||||
@@ -0,0 +1,18 @@
|
||||
echo "Skip Chromium's new first-run EULA on machines already on Quattro"
|
||||
|
||||
# Chromium 151 flipped MasterPrefs::eula_required from false to true, so an
|
||||
# unconfigured first run now stops on a blank terms-of-service dialog before the
|
||||
# browser opens. Omarchy answers that in the seed it writes next to the Chromium
|
||||
# binary, but that seed is only laid down by a fresh install and by the one-time
|
||||
# 3.x upgrade, so machines already on Quattro never receive it. Retrofit it here.
|
||||
#
|
||||
# The literal is deliberately duplicated rather than sourced: a migration repairs
|
||||
# the state of its own moment, and must not drift when the seed later changes.
|
||||
|
||||
chromium_prefs="/usr/lib/chromium/initial_preferences"
|
||||
chromium_seed='{"distribution":{"require_eula":false},"browser":{"theme":{"color_scheme":0,"color_scheme2":0}}}'
|
||||
|
||||
if [[ $(cat "$chromium_prefs" 2>/dev/null) != "$chromium_seed" ]]; then
|
||||
sudo mkdir -p "$(dirname "$chromium_prefs")"
|
||||
echo "$chromium_seed" | sudo tee "$chromium_prefs" >/dev/null
|
||||
fi
|
||||
@@ -0,0 +1,57 @@
|
||||
echo "Separate printer discovery from root and print-filter access"
|
||||
|
||||
machine_marker="${OMARCHY_CUPS_MIGRATION_MARKER:-/var/lib/omarchy/migrations/1787815267}"
|
||||
|
||||
[[ ! -e $machine_marker ]] || exit 0
|
||||
|
||||
# Existing releases allowed a desktop user or shared group named cups-browsed,
|
||||
# which systemd-sysusers would silently reuse for passwordless CUPS access.
|
||||
if omarchy-pkg-present cups; then
|
||||
cups_browsed_account=$(getent passwd cups-browsed || true)
|
||||
cups_browsed_group=$(getent group cups-browsed || true)
|
||||
|
||||
if [[ -n $cups_browsed_account || -n $cups_browsed_group ]]; then
|
||||
IFS=: read -r _ _ cups_browsed_uid cups_browsed_gid cups_browsed_description cups_browsed_home cups_browsed_shell <<<"$cups_browsed_account"
|
||||
IFS=: read -r _ _ cups_browsed_group_gid cups_browsed_group_members <<<"$cups_browsed_group"
|
||||
other_primary_user=$(getent passwd | awk -F: -v gid="$cups_browsed_gid" '$1 != "cups-browsed" && $4 == gid { print $1; exit }')
|
||||
|
||||
if [[ ! $cups_browsed_uid =~ ^[0-9]+$ || ! $cups_browsed_group_gid =~ ^[0-9]+$ ]] ||
|
||||
((cups_browsed_uid <= 0 || cups_browsed_uid >= 1000)) ||
|
||||
[[ $cups_browsed_gid != $cups_browsed_group_gid ]] ||
|
||||
[[ $cups_browsed_description != "CUPS printer discovery" || $cups_browsed_home != "/" || $cups_browsed_shell != "/usr/bin/nologin" ]] ||
|
||||
[[ -n $cups_browsed_group_members || -n $other_primary_user ]]; then
|
||||
echo "Cannot harden printer discovery: the existing cups-browsed user or group is not a dedicated system account." >&2
|
||||
false
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# CUPS-PDF accepts a job-controlled post-processing command in a backend that
|
||||
# CUPS launches as root. Native application print-to-file support replaces it.
|
||||
omarchy-pkg-drop cups-pdf
|
||||
|
||||
# system-config-printer uses this helper to request printer administration
|
||||
# through Polkit now that the desktop user's wheel group is no longer @SYSTEM.
|
||||
if omarchy-pkg-present cups; then
|
||||
omarchy-pkg-add cups-pk-helper
|
||||
fi
|
||||
|
||||
# Stop the root-running daemon before changing the authorization it relies on.
|
||||
if systemctl is-active --quiet cups-browsed.service 2>/dev/null; then
|
||||
sudo systemctl stop cups-browsed.service
|
||||
fi
|
||||
|
||||
if omarchy-pkg-present cups; then
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl try-reload-or-restart cups.service
|
||||
fi
|
||||
|
||||
# Resume on whether the unit is enabled, not on whether it was running when this
|
||||
# run started: an interrupted earlier run leaves it stopped, and a retry that
|
||||
# recomputed that would skip the restart and still write the marker below. A
|
||||
# masked or disabled unit reports not-enabled and is left alone.
|
||||
if systemctl is-enabled --quiet cups-browsed.service 2>/dev/null; then
|
||||
sudo systemctl restart cups-browsed.service
|
||||
fi
|
||||
|
||||
sudo install -Dm644 /dev/null "$machine_marker"
|
||||
@@ -0,0 +1,72 @@
|
||||
echo "Temporarily remove automatic printer discovery"
|
||||
|
||||
machine_marker="${OMARCHY_CUPS_BROWSED_REMOVAL_MARKER:-/var/lib/omarchy/migrations/1788009111}"
|
||||
|
||||
[[ ! -e $machine_marker ]] || exit 0
|
||||
omarchy-pkg-present cups-browsed || exit 0
|
||||
|
||||
# Check the full removal transaction before changing the service or queues.
|
||||
pacman -Rs --print cups-browsed >/dev/null
|
||||
|
||||
# Disable the unit while its package still owns the unit file so systemd can
|
||||
# remove the enable symlink cleanly.
|
||||
if systemctl is-enabled --quiet cups-browsed.service 2>/dev/null; then
|
||||
sudo systemctl disable --now cups-browsed.service >/dev/null
|
||||
elif systemctl is-active --quiet cups-browsed.service 2>/dev/null; then
|
||||
sudo systemctl stop cups-browsed.service >/dev/null
|
||||
fi
|
||||
|
||||
# cups-browsed leaves its implicitclass queues behind when stopped. Remove idle
|
||||
# discovery queues before removing the backend they require, but leave queues
|
||||
# with jobs for the user to resolve.
|
||||
#
|
||||
# A healthy CUPS server with no configured printers reports this condition on
|
||||
# stderr and exits 1. Treat that as an empty queue list; every other failure
|
||||
# keeps the migration pending so it can be retried.
|
||||
if queue_report=$(LC_ALL=C lpstat -v 2>&1); then
|
||||
:
|
||||
elif [[ $queue_report == "lpstat: No destinations added." ]]; then
|
||||
queue_report=""
|
||||
else
|
||||
printf '%s\n' "$queue_report" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
generated_queues=$(printf '%s\n' "$queue_report" |
|
||||
sed -n 's|^device for \(.*\): implicitclass://.*|\1|p')
|
||||
|
||||
while IFS= read -r queue; do
|
||||
[[ -n $queue ]] || continue
|
||||
|
||||
if ! reject_error=$(sudo cupsreject -r "Printer discovery has been removed from Omarchy" "$queue" 2>&1); then
|
||||
if LC_ALL=C lpstat -p "$queue" >/dev/null 2>&1; then
|
||||
printf '%s\n' "$reject_error" >&2
|
||||
exit 1
|
||||
else
|
||||
continue
|
||||
fi
|
||||
fi
|
||||
|
||||
if job_report=$(LC_ALL=C lpstat -o "$queue" 2>&1); then
|
||||
[[ -z $job_report ]] || continue
|
||||
elif LC_ALL=C lpstat -p "$queue" >/dev/null 2>&1; then
|
||||
printf '%s\n' "$job_report" >&2
|
||||
exit 1
|
||||
else
|
||||
# The queue disappeared after the initial snapshot, which is already the
|
||||
# desired state.
|
||||
continue
|
||||
fi
|
||||
|
||||
if ! delete_error=$(sudo lpadmin -x "$queue" 2>&1); then
|
||||
# Treat a concurrent disappearance as success. A queue that still exists
|
||||
# means CUPS did not complete the deletion, so retry the migration later.
|
||||
if LC_ALL=C lpstat -p "$queue" >/dev/null 2>&1; then
|
||||
printf '%s\n' "$delete_error" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
done <<<"$generated_queues"
|
||||
|
||||
omarchy-pkg-drop cups-browsed >/dev/null
|
||||
sudo install -Dm644 /dev/null "$machine_marker"
|
||||
Reference in new issue
Block a user