cups-browsed is the daemon that watches the network and creates print queues by itself. Hardening it took a root daemon with a predictable cache down to a confined service account, but a daemon that turns anything advertising itself on the network into a print queue is a lot of exposure for a convenience, so it comes out of the default install while that is reworked. Only the discovery half: CUPS itself stays and printing keeps working, with each printer added by hand in Print Settings.
The migration disables the unit before removing the package because that is the only order that works: pacman deletes the unit file but not the enable symlink, and once the unit is gone systemd can no longer resolve it by name to clean that up.
It then removes the queues discovery generated. cups-browsed keeps those when it stops, since KeepGeneratedQueuesOnShutdown defaults to Yes, and they route through its own implicitclass backend, which goes with the package, so they cannot print again. Idle ones go. A queue with jobs on it is left alone and named: implicitclass only needs cups-browsed to choose a destination, so a job already past that point finishes on its own, and deleting the queue would abort it. One printer's job does not hold up the removal. A printer added by hand has an ipp:// or usb:// device and is left where it is.
A queue whose jobs cannot be asked about is left alone rather than assumed idle, including one named so that lpstat would misread it -- "all" is its word for every destination, and a leading dash or a comma reads as another option or a list.
Where CUPS does not answer at all, or a queue will not delete, discovery is still stopped but the package stays and no marker is written. omarchy-migrate records a migration for the user as soon as it exits zero, so that is where the machine stays until someone removes the package by hand, and the message says so rather than implying a retry.
The queue list is read under LC_ALL=C because lpstat translates "device for", and captured rather than piped, so a cupsd it cannot reach is reported instead of reading like a machine with nothing to clean up.
It removes with plain pacman -R rather than omarchy-pkg-drop, which passes -n and would discard /etc/cups/cups-browsed.conf instead of keeping it as a .pacsave. A removal meant to be temporary should not delete the machine's copy of its own configuration. Without -s either, so it only ever removes the package it names: sweeping newly unneeded dependencies is nothing today, but it is not a promise a rolling dependency graph can keep.
Queue names come off the network, since cups-browsed names its queues after what the printer advertised. CUPS allows every printable character but space, tab, / and #, and lpstat and lpadmin take a destination as an option value, so a name with a leading dash or a comma is reported rather than passed to them and guessed at.
Migration state is per user, so a machine-wide marker records the one removal. Without it, an account whose first migration run came after someone deliberately reinstalled discovery would quietly take it back out again.
The install-time override for cups-browsed.conf now waits for cups-browsed rather than for CUPS. Guarding it on a file CUPS still ships would write a configuration file for a package nothing installed, and pacman would later land the package's own copy beside it as a .pacnew.
The hardened configuration stays in the tree. omarchy-settings still ships the cups-browsed.conf override, the sysusers account and the service drop-in, so they are what discovery returns onto.
Co-Authored-By: Codex XHigh <noreply@openai.com>
Remove legacy online installer entrypoints, collapse migrations for 4.0, and move setup responsibilities into target-side system, hardware, and user commands.
Drop online-git: the new world has a single package-backed install path
that's either online (pacman pulls from omacom-pkgs.org) or offline (ISO
chroot pulls from the bundled mirror). The git-clone-and-run-installer
path is gone — boot.sh becomes a thin bootstrap that installs the
omarchy-installer package and invokes its installer.
- install/helpers/mode.sh: two modes, validation message updated. Default
fallback is 'online' (the boot.sh path); OMARCHY_CHROOT_INSTALL=1 still
shims to offline, OMARCHY_ONLINE_INSTALL=true still shims to online.
- install/preflight/all.sh: first-run-mode + disable-mkinitcpio gated on
offline (offline is the from-scratch chroot path; online runs on an
existing system).
- install/preflight/pacman.sh: DELETED. boot.sh now handles repo config
before install.sh runs.
- install/packaging/all.sh: drop base.sh entirely. Both modes have
base packages installed via omarchy-installer's depends before
install.sh runs. base.sh remains on disk in case the ISO mirror build
flow wants to invoke it directly.
- install/helpers/chroot.sh, errors.sh, post-install/finished.sh,
config/mise-work.sh: rename mode checks to use online/offline.
Three modes the installer now branches on:
iso-chroot Running inside the new system's chroot from the ISO build.
pacman is configured by archinstall; systemd isn't running,
so service enables skip --now.
online-package Running on an existing Arch where the omarchy-* packages
are already installed. Skip base.sh and the bootstrap
preflight steps; only the per-host runtime ops in
config/login/post-install need to run.
online-git boot.sh path: clone into $HOME/.local/share/omarchy and
bootstrap everything from scratch.
install.sh derives OMARCHY_PATH from its own location, so the same script
works whether it's at /usr/share/omarchy/install.sh (package mode) or
$HOME/.local/share/omarchy/install.sh (git mode). install_mode_is helper
replaces direct ${OMARCHY_CHROOT_INSTALL:-} / ${OMARCHY_ONLINE_INSTALL:-}
checks in chroot.sh, finished.sh, errors.sh, mise-work.sh, preflight/pacman.sh.
Legacy vars still work through export_legacy_mode_flags, which sets
OMARCHY_CHROOT_INSTALL=1 / OMARCHY_ONLINE_INSTALL=true based on the
canonical mode for any caller that hasn't been updated.
bin/omarchy-install-mode prints the current mode for scripts/users that
need to introspect.
Smoke-tested all four entry paths (explicit mode, both legacy shims,
auto-detection from OMARCHY_PATH); each resolves correctly and the
legacy flags are exported in matching modes.
The package-installed paths live at /usr/share/omarchy; the script-install
paths live at ~/.local/share/omarchy. $OMARCHY_PATH is set by install.sh
during the install flow and by /etc/profile.d/omarchy.sh in package mode.
Scripts that hard-code the script-install path don't honour that and will
misbehave once shipped to /usr/bin.
16 files migrated via sed s|~/\.local/share/omarchy|$OMARCHY_PATH|g
and s|$HOME/\.local/share/omarchy|$OMARCHY_PATH|g:
bin/:
- omarchy-plymouth-{preview,reset,set}
- omarchy-refresh-{limine,plymouth}
- omarchy-reinstall-configs
- omarchy-show-logo
- omarchy-games-retro-install
- omarchy-install-gaming-battlenet
install/:
- config/branding.sh
- packaging/{fonts,icons}.sh
- post-install/{finished,pacman}.sh
- preflight/{migrations,pacman}.sh
Deliberately NOT migrated:
- bin/omarchy-dev-add-migration: uses 'cd ~/.local/share/omarchy' to
resolve a git repo for 'git log'. The packaged binary doesn't have a
git repo to read; this command only makes sense in dev mode where
the home path is the right one.
- bin/omarchy-install-browser:69: writes a string into a chromium
config file that chromium itself interprets; not a bash-resolved path.
- install/helpers/errors.sh:125: the boot.sh-style relaunch behaviour
needs a separate redesign.
* First swing at t2 support
* Remove unnecessary enables
* Trim up
* Trim
* Need to use official mirror until we have our own setup
* Use GitHub mirror for now
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Change lazyvim and asdcontrol to packages
* Remove asdcontrol and lazyvim
* Add lazyvim setup
* Don't trigger rebuild. We already rebuild later.
* Add new pacman.conf after install
* Update config to keep mirrors in mirrorlist
* Add lazyvim setup back
* Make webapp installer work with local images
* Update tuis to work offline
* Update pacman config situation
* Extract the reboot segment into its own file
* Explainer
* Can't return in executed scripts
* Add post-install
* Extract the reboot segment into its own file
* Fix rebase doubling up
* Add run wrapper function for feedback
* Redirect output to log
* Move gnome updates to first-run
* Add theme to first-run
* Updat to try to get logging working
* Create the file and give permissions
* Test gsettings
* Revert "Test gsettings"
This reverts commit 49c27d319407f6c95fcbb4c5a2646e54b50c9ab4.
* Stop logging
* Add time outputs to end of logs
* Rearrange some scripts to cleanup
* Cleanup
* Add timing to run script
* Don't enable multilib for offline
* Add prebuild ruby
* Try spinner setup
* Prevent exit 1 due to grep not matching
* Update limine config to work for USB installs as well
* Add offline install to env report
* Fix grep pipefailure
* Update logs exports to work with subshells
* Fix backward logic
* Attempt to fix logging again
* Export chrootable for subshells
* Clean up outputs
* Move chrootable up
* Source chroot instead
* Changes for logging
* Center up reboot notice
* Update fixed paths
* Update trap
* Revert reverting precompiled ruby due to issues
* Revert "Revert reverting precompiled ruby due to issues"
This reverts commit c159e7dc51cfdd2fb750c49c66bc4468e1208446.
* Remove junk to cleanup fixed paths now that we have relative
* Add git branch check to transition beta to main
* Log output
* Add time output on summary screen
* We don't need sudo here
* Add ansi helpers to make code cleaner
* Add dry-run helpers for testing
* Split out some common / reused items
* Add log output function
* Use gum log to output cleaner
* Cleanup
* Update trap with options
* Fix reboot and pad it
* Cleanup
* Add dry-run for testing
* Use default $PADDING for gum
* More styles
* Styles and really exit
* Update to new format
* Add ansi vars
* Update log output to prevent flickering
* Fix logo exporting
* Trap updates
* Add exit handler
* Prevent double-trapping
* Update traps
* Consolidate logic
* Update reboot to work in chroot
* Eliminate double-guard
* Attempt to speed up by removing mkinitcpio hooks
* Add multilib for nvidia users
* Add back wireless-regdom
* Remove dryrun items
* Fix to be offline
* Set fonts for plymouth to solve freetype2 issue
* Required -y to run
* Update omarchy-refresh-plymouth to account for limine changes
* Update omarchy-refresh-plymouth to account for limine changes (#1575)
* Required -y to run
* Update omarchy-refresh-plymouth to account for limine changes
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Update modes
* Remove direct executions of .sh files
* Add variable safety
* Add omarchy-upload-log
* Add broadcome fix for MBP
* Prevent printing on screen when rebooting
* Make packages list universal
* Rename
* Remove retry message
* Fix packages target
* Add system info to upload
* Update variable name
* Remove unnecessary executable statuses
* Remove gesture default
* Add bcm4360 fix to install
* Add useful debug info
* Add OMARCHY_PATH
* Only look locally offline
* Rename / rearrange files
* Export so they're available to subshells
* Update for alternate
* Rearrange
* Log install time if no arch
* Add limine to packages list
* Update comments
* Update sizing method
* Update mode switcher
* Move icons to be embedded in installer
* Set install mode to online
* shebang and sudo
* Remove deleted branch check
* Elim banners
* Elim verbosity
* Rename LOG_FILE
* Multilib on by default
* Flip to positive
* Switch to gnome-theme.sh for first run
* Elim ansi-codes helper
* Move guard up to be the first thing that's hit
* Extract a couple of functions
* Trim
* Trim
* Move back to trap
* Update to single gum file
* Just show total
* Pulled function to a helper
* Extract explaining function
* Use complete conditional flows where possible
* Reference variable close to its use
* Use modern bash conditional syntax
* Comment before function
* Use a simpler shared exit headline
Doesn't matter how we stopped, just that we did
* CRs
* Keep constants together
* Style on comment
* Explain QR Code
* Modern bash conditional and use lowercase for all local variables
* Use bash calculation syntax for numbers
* Use calculation syntax where possible
* cleanup was not intention revealing enough imo
* Spacing
* Retry won't produce something different in offline mode
* Not needed
* Use modern bash conditional style
* String-wrapping not needed in [[ ]]
* Might as well use constants for all of these
* Don't need the wrapping
* Move the output saving into where we're working with it
* Not needed as long as we just source this
* Gum is a helper
* Slim down logging setup
* Reflect broader scope of work
* Everything should live in file
* Simpler
* Ordering
* Style
* Better separation of concerns
* Stop pretending these are meant to run directly
* Move all packaging execution together
* No longer used in an offline centric setup
* None of these are directly executable any more either
* Modern bash conditional
* Better name
* Explain what's going on
* Use modern bash conditional
* Use modern bash styule
* No need for bashing
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: DoppioJP <jakub@doppio.jp>
Ryan Hughes