Skip to content

Commit 943d2fc

Browse files
ryanrhughesryanrhughes
authored
Merge pull request omacom#9002 from acrogenesis/remove-legacy-installer-privileged-files
Repair legacy paths and privileged files left by retired installers
2 parents 625c4a1 + 58c399d commit 943d2fc

45 files changed

Lines changed: 3279 additions & 8 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎agents/skills/migrations.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ New migration format:
126126
- Start with an `echo` describing what the migration does.
127127
- Use `$OMARCHY_PATH` to reference the Omarchy directory.
128128
- Be idempotent. Check existing state before changing it.
129+
- Migrations are strictly ordered and synchronous. A migration that cannot finish must exit non-zero, remain pending, and stop the queue; never mark later migrations complete against state an earlier migration has not established.
129130
- Use helper commands such as `omarchy-cmd-present`, `omarchy-cmd-missing`,
130131
`omarchy-pkg-add`, `omarchy-pkg-drop`, `omarchy-pkg-present`, and
131132
`omarchy-pkg-missing` when appropriate.
@@ -165,3 +166,5 @@ omarchy-migrate
165166
Omarchy 4.0 is upgraded through `bin/omarchy-upgrade-to-quattro`, not through the
166167
normal migration runner. Do not add compatibility migrations for old installer
167168
layouts; put pre-4 package-layout transition work in the upgrade command instead.
169+
170+
Clearing a privileged file that a retired installer left on disk is the exception, and belongs in a migration whether or not that installer was part of a package layout transition. The upgrade command only runs on a machine still making the 3 to 4 crossing, so anything put there never reaches an install that crossed already, and it never runs at all for an installer that was retired on its own — while the file the installer wrote is still sitting on those machines. The upgrade command finishes by running `omarchy-migrate` (`run_post_upgrade_migrations`), so one migration reaches every population; a copy in the upgrade command would only be a second copy of the same predicate to keep correct. Such a migration must name the defect it clears and match what the old installer actually produced before deleting it. Leave safe administrator-authored files alone; if one still contains the vulnerable privileged action, preserve it under an inactive name rather than discarding custom content or leaving the action executable. A user config that depends on the same retired compatibility path may be repaired in that migration when doing so eliminates an overlapping migration, but only by matching and replacing the exact legacy path while preserving the rest of the file.

‎bin/omarchy-dns‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,9 @@ write_networkmanager_dns() {
149149
local servers="$1"
150150

151151
install -d -m 0755 "$(dirname "$NM_DNS_CONF")"
152+
# omarchy:heredoc-expands paths=none -- $servers is a normalized, single-line
153+
# DNS server list written as data, not a path or command; nothing user-writable
154+
# is resolved or executed from the root-owned drop-in.
152155
cat >"$NM_DNS_CONF" <<EOF
153156
# Managed by omarchy-dns. Remove this file or run omarchy dns DHCP to use DHCP DNS again.
154157
[global-dns]
@@ -302,6 +305,9 @@ Custom)
302305
split_dns_servers "$dns_servers"
303306
write_networkmanager_dns "$dns_servers"
304307
set_connection_dns "$ipv4_dns" "$ipv6_dns"
308+
# omarchy:heredoc-expands paths=none -- $dns_servers is a normalized,
309+
# single-line DNS server list; the //,/ turns its comma separators into the
310+
# spaces resolved.conf wants. It is written as data, not a path or command.
305311
tee /etc/systemd/resolved.conf >/dev/null <<EOF
306312
[Resolve]
307313
DNS=${dns_servers//,/ }

‎bin/omarchy-migrate‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -85,16 +85,16 @@ wait_for_pacman_transaction
8585
mkdir -p "$STATE_DIR"
8686
[[ -d $MIGRATIONS_DIR ]] || exit 0
8787

88-
while IFS=$'\t' read -r name file marker; do
88+
while IFS=$'\t' read -r name file marker <&3; do
8989
[[ -n $name ]] || continue
9090

9191
if [[ ! -f $marker ]]; then
9292
echo -e "\e[32m\nRunning migration (${name%.sh})\e[0m"
93-
OMARCHY_PATH="$OMARCHY_PATH" bash -euo pipefail "$file"
93+
OMARCHY_PATH="$OMARCHY_PATH" bash -euo pipefail "$file" 3<&-
9494
mkdir -p "$(dirname "$marker")"
9595
touch "$marker"
9696
fi
97-
done < <(migration_entries)
97+
done 3< <(migration_entries)
9898

9999
# Clear a login-time notification the user left sitting there and then resolved
100100
# by running migrations some other way. The substring matches both the current

‎bin/omarchy-provision-owner‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -788,7 +788,7 @@ configure_login() {
788788
# After=) is what makes it deterministic — no sleep/race against SDDM's startup.
789789
install_autologin_once_cleanup() {
790790
local unit=omarchy-provision-autologin-once.service
791-
cat >"/etc/systemd/system/$unit" <<UNIT
791+
sed "s|@UNIT@|$unit|g" >"/etc/systemd/system/$unit" <<'UNIT'
792792
[Unit]
793793
Description=Drop the first-boot autologin before the next login
794794
Before=display-manager.service
@@ -797,7 +797,7 @@ ConditionPathExists=/etc/sddm.conf.d/autologin.conf
797797
[Service]
798798
Type=oneshot
799799
ExecStart=/usr/bin/rm -f /etc/sddm.conf.d/autologin.conf
800-
ExecStartPost=/usr/bin/rm -f /etc/systemd/system/graphical.target.wants/$unit /etc/systemd/system/$unit
800+
ExecStartPost=/usr/bin/rm -f /etc/systemd/system/graphical.target.wants/@UNIT@ /etc/systemd/system/@UNIT@
801801
802802
[Install]
803803
WantedBy=graphical.target

‎bin/omarchy-setup-security-fingerprint‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,9 @@ setup_pam_config() {
4141
fi
4242
else
4343
echo "Creating polkit configuration with fingerprint authentication..."
44+
# omarchy:heredoc-expands paths=none -- $fprintd_gate is the literal PAM
45+
# line defined above, shared with the two sed insertions so the gate cannot
46+
# drift between files. The only path in it is the fixed /usr/bin one.
4447
sudo tee /etc/pam.d/polkit-1 >/dev/null <<EOF
4548
$fprintd_gate
4649
auth sufficient pam_fprintd.so

‎bin/omarchy-upgrade-to-quattro‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -597,6 +597,9 @@ preserve_kernel_cmdline_root() {
597597
fi
598598

599599
log "Preserving the kernel cmdline root parameters in $default_conf"
600+
# omarchy:heredoc-expands paths=none -- ${boot_params[*]} is the kernel
601+
# cmdline fragment assembled above from findmnt output (root=, rootflags=),
602+
# not a filesystem path this script controls.
600603
as_root tee -a "$default_conf" >/dev/null <<EOF
601604
# Written by omarchy-upgrade-to-quattro. The += drop-ins in
602605
# /etc/limine-entry-tool.d/ stop limine-entry-tool from reading
@@ -1187,11 +1190,19 @@ ensure_sleep_lock_service() {
11871190
}
11881191

11891192
run_post_upgrade_migrations() {
1190-
PATH="$package_path" command -v omarchy-migrate >/dev/null 2>&1 || return 0
1193+
local pending_status
11911194

11921195
log "Running Omarchy migrations"
11931196
if ! run_as_user_omarchy OMARCHY_UPGRADE_TO_QUATTRO_LIVE=1 omarchy-migrate; then
1194-
warn "Could not run Omarchy migrations; the user may be prompted to run them after login."
1197+
fail "Omarchy migrations did not complete. Fix the error above and rerun the upgrade before rebooting."
1198+
fi
1199+
if run_as_user_omarchy omarchy-migrate --pending >/dev/null; then
1200+
fail "Omarchy migrations are still pending. Rerun the upgrade before rebooting."
1201+
else
1202+
pending_status=$?
1203+
if (( pending_status != 1 )); then
1204+
fail "Could not verify that Omarchy migrations completed. Rerun the upgrade before rebooting."
1205+
fi
11951206
fi
11961207
}
11971208

@@ -1395,6 +1406,9 @@ EOF
13951406
autologin_user=$(as_root awk -F= '/^User=/ { print $2; exit }' /etc/sddm.conf.d/autologin.conf 2>/dev/null || true)
13961407
fi
13971408
[[ -n ${autologin_user:-} ]] || autologin_user="$target_user"
1409+
# omarchy:heredoc-expands paths=none -- $autologin_user is a username, read
1410+
# back from the root-owned drop-in or falling back to $target_user. Same
1411+
# mechanism as the old getty override: a name expands, no path does.
13981412
cat <<EOF | as_root tee /etc/sddm.conf.d/autologin.conf >/dev/null
13991413
[Autologin]
14001414
User=$autologin_user
@@ -1405,6 +1419,8 @@ EOF
14051419
fi
14061420

14071421
as_root install -d -m 0755 -o sddm -g sddm /var/lib/sddm 2>/dev/null || as_root install -d -m 0755 /var/lib/sddm
1422+
# omarchy:heredoc-expands paths=none -- $target_user is a username, not a
1423+
# path; SDDM's state file records who logged in last.
14081424
cat <<EOF | as_root tee /var/lib/sddm/state.conf >/dev/null
14091425
[Last]
14101426
Session=omarchy.desktop
@@ -2358,8 +2374,8 @@ run_as_user_omarchy omarchy-bar defaults ||
23582374
cleanup_retired_services
23592375
ensure_sleep_lock_service
23602376
remove_retired_default_packages
2361-
run_post_upgrade_migrations
23622377
run_final_system_package_upgrade
2378+
run_post_upgrade_migrations
23632379
run_post_upgrade_update_steps
23642380
refresh_current_theme_after_upgrade
23652381
# Do not force-reload Hyprland in the live upgraded session. The legacy

‎bin/omarchy-windows-vm‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -691,6 +691,10 @@ write_compose_atomically() (
691691
esc_password=${esc_password//\$/\$\$}
692692

693693
tmp=$(mktemp "$RUNTIME_DIR/.compose.XXXXXX") || exit 1
694+
# omarchy:heredoc-expands paths=EXPECTED_STORAGE,EXPECTED_SHARED -- both are
695+
# root-protected anchors derived from the authenticated caller uid and bound
696+
# to source inodes that were opened and validated before this compose is
697+
# written. The remaining expansions are revalidated scalar settings.
694698
cat >"$tmp" <<EOF || exit 1
695699
services:
696700
windows:

0 commit comments

Comments
 (0)