Merge pull request #11874 from acrogenesis/feature/usb-device-authorization

Require approval for new USB and Thunderbolt devices by default.

Reported-by: Jurre van Bergen me@jurrevanbergen.nl

migrations/1789433473.sh

@@ -0,0 +1,3 @@
+echo "Enable approval for newly connected USB devices"
+
+omarchy-setup-security-usb-authorization --yes

migrations/1790344599.sh

@@ -0,0 +1,2 @@
+echo "Require approval for new Thunderbolt accessories"
+omarchy-setup-security-thunderbolt-authorization --quiet

migrations/1790608617.sh

@@ -0,0 +1,7 @@
+echo "Repair USB approval prompts and enable portable device approvals"
+
+# Preserve an explicit opt-out. Existing users with an active/enabled daemon
+# need a working watcher even if their old checkout link has become dangling.
+if systemctl is-enabled --quiet usbguard.service || systemctl is-active --quiet usbguard.service; then
+  omarchy-setup-security-usb-authorization --yes
+fi