Display arrangement persistence + centering fix, packaging hardening
- core/display.py: write_positions() persists Arrangement's drag-and-drop
layout into niri's config.kdl (one output { position x= y= } per output),
validated via `niri validate` on a temp copy with a .kdl.bak backup before
writing — same pattern as core/keybindings.py's rebind(). Previously the
page only ever called `niri msg output … position set`, which niri treats
as live-only and drops on the next login/reload.
- gui/pages/display.py: Arrangement's Apply now runs each output's `niri msg
output … position set` synchronously instead of queuing them all on the
single-shot ProcessRunner (which rejects a second run() while the first is
still async) — a 2-monitor apply previously moved only the first output
and silently dropped the rest. _dock_to_nearest keeps the free axis at the
dragged position (so a shorter display can sit vertically centered next to
a taller rotated one) rather than forcing corner alignment.
- core/panel.py, files/__init__.py: incidental fixes alongside the above.
- packaging/: signing-key generation script + build-user systemd setup for
the [tanin] AUR auto-rebuild pipeline; PKGBUILD bumped to pkgrel=5.
- src/taninux/browser/: new module for browser theme sync (Fuji accent).
This commit is contained in:
@@ -1,6 +1,8 @@
|
||||
# pacman.conf for the LIVE system and (via unpackfs) the installed target.
|
||||
# [tanin]'s DB-signing key is imported into the keyring by customize_airootfs.sh,
|
||||
# so Optional TrustAll verifies cleanly here (unlike the build conf which uses Never).
|
||||
# [tanin]'s packager key is imported + locally signed into the keyring by
|
||||
# customize_airootfs.sh, so Required DatabaseOptional (every package must
|
||||
# carry a valid signature from a trusted key; the DB signature itself is
|
||||
# optional) verifies cleanly here.
|
||||
[options]
|
||||
HoldPkg = pacman glibc
|
||||
Architecture = auto
|
||||
@@ -21,5 +23,5 @@ Include = /etc/pacman.d/mirrorlist
|
||||
Include = /etc/pacman.d/mirrorlist
|
||||
|
||||
[tanin]
|
||||
SigLevel = Optional TrustAll
|
||||
SigLevel = Required DatabaseOptional
|
||||
Server = https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch
|
||||
|
||||
@@ -6,7 +6,17 @@ set -e -u
|
||||
sed -i 's/#\(en_US\.UTF-8 UTF-8\)/\1/' /etc/locale.gen
|
||||
locale-gen
|
||||
|
||||
# --- trust the [tanin] DB-signing key (so Optional TrustAll verifies) ---
|
||||
# --- trust the [tanin] key(s) (so Required DatabaseOptional verifies) ---
|
||||
# tanin-repo.gpg currently holds Gitea's repo-DB-signing key (fingerprint
|
||||
# below), which covers the optional DB signature. Per-PACKAGE signatures
|
||||
# (now Required) are made by the packaging/gen-signing-key.sh packager key
|
||||
# instead, so after running that script ONCE:
|
||||
# 1) re-export tanin-repo.gpg to also contain the packager pubkey, e.g.
|
||||
# `gpg --export <gitea-fpr> <packager-fpr> > .../pacman.d/tanin-repo.gpg`
|
||||
# (see the exact steps gen-signing-key.sh prints), then
|
||||
# 2) add a second line here: `pacman-key --lsign-key <packager-fpr>`
|
||||
# — without step 2, Required package-signature checks will fail even though
|
||||
# the key is imported, because it isn't locally trusted yet.
|
||||
pacman-key --init
|
||||
pacman-key --populate archlinux
|
||||
pacman-key --add /etc/pacman.d/tanin-repo.gpg
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
# Build-time pacman.conf for mkarchiso (pulls live packages incl. tanin-desktop).
|
||||
# Replaces releng's pacman.conf. [tanin] is added so the airootfs can include
|
||||
# our packages. SigLevel=Never on [tanin] keeps the BUILD simple (no keyring
|
||||
# bootstrap during mkarchiso); the LIVE/target keyring trusts the key properly
|
||||
# (see airootfs/etc/pacman.conf + customize_airootfs.sh).
|
||||
# our packages.
|
||||
[options]
|
||||
HoldPkg = pacman glibc
|
||||
Architecture = auto
|
||||
@@ -21,5 +19,11 @@ Include = /etc/pacman.d/mirrorlist
|
||||
Include = /etc/pacman.d/mirrorlist
|
||||
|
||||
[tanin]
|
||||
SigLevel = Never
|
||||
# Required DatabaseOptional assumes packaging/gen-signing-key.sh has been run
|
||||
# and its packager pubkey is already trusted on THIS build host's own pacman
|
||||
# keyring (mkarchiso's pacstrap reads the host's /etc/pacman.d/gnupg, not the
|
||||
# airootfs's — that trust is set up separately by customize_airootfs.sh for
|
||||
# the live/target system). Until the key exists and is trusted here, building
|
||||
# will fail closed rather than pull unsigned [tanin] packages into the ISO.
|
||||
SigLevel = Required DatabaseOptional
|
||||
Server = https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch
|
||||
|
||||
@@ -1,6 +1,8 @@
|
||||
# pacman.conf for the LIVE system and (via unpackfs) the installed target.
|
||||
# [tanin]'s DB-signing key is imported into the keyring by customize_airootfs.sh,
|
||||
# so Optional TrustAll verifies cleanly here (unlike the build conf which uses Never).
|
||||
# [tanin]'s packager key is imported + locally signed into the keyring by
|
||||
# customize_airootfs.sh, so Required DatabaseOptional (every package must
|
||||
# carry a valid signature from a trusted key; the DB signature itself is
|
||||
# optional) verifies cleanly here.
|
||||
[options]
|
||||
HoldPkg = pacman glibc
|
||||
Architecture = auto
|
||||
@@ -21,5 +23,5 @@ Include = /etc/pacman.d/mirrorlist
|
||||
Include = /etc/pacman.d/mirrorlist
|
||||
|
||||
[tanin]
|
||||
SigLevel = Optional TrustAll
|
||||
SigLevel = Required DatabaseOptional
|
||||
Server = https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch
|
||||
|
||||
@@ -6,7 +6,17 @@ set -e -u
|
||||
sed -i 's/#\(en_US\.UTF-8 UTF-8\)/\1/' /etc/locale.gen
|
||||
locale-gen
|
||||
|
||||
# --- trust the [tanin] DB-signing key (so Optional TrustAll verifies) ---
|
||||
# --- trust the [tanin] key(s) (so Required DatabaseOptional verifies) ---
|
||||
# tanin-repo.gpg currently holds Gitea's repo-DB-signing key (fingerprint
|
||||
# below), which covers the optional DB signature. Per-PACKAGE signatures
|
||||
# (now Required) are made by the packaging/gen-signing-key.sh packager key
|
||||
# instead, so after running that script ONCE:
|
||||
# 1) re-export tanin-repo.gpg to also contain the packager pubkey, e.g.
|
||||
# `gpg --export <gitea-fpr> <packager-fpr> > .../pacman.d/tanin-repo.gpg`
|
||||
# (see the exact steps gen-signing-key.sh prints), then
|
||||
# 2) add a second line here: `pacman-key --lsign-key <packager-fpr>`
|
||||
# — without step 2, Required package-signature checks will fail even though
|
||||
# the key is imported, because it isn't locally trusted yet.
|
||||
pacman-key --init
|
||||
pacman-key --populate archlinux
|
||||
pacman-key --add /etc/pacman.d/tanin-repo.gpg
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
# Build-time pacman.conf for mkarchiso (pulls live packages incl. tanin-desktop).
|
||||
# Replaces releng's pacman.conf. [tanin] is added so the airootfs can include
|
||||
# our packages. SigLevel=Never on [tanin] keeps the BUILD simple (no keyring
|
||||
# bootstrap during mkarchiso); the LIVE/target keyring trusts the key properly
|
||||
# (see airootfs/etc/pacman.conf + customize_airootfs.sh).
|
||||
# our packages.
|
||||
[options]
|
||||
HoldPkg = pacman glibc
|
||||
Architecture = auto
|
||||
@@ -21,5 +19,11 @@ Include = /etc/pacman.d/mirrorlist
|
||||
Include = /etc/pacman.d/mirrorlist
|
||||
|
||||
[tanin]
|
||||
SigLevel = Never
|
||||
# Required DatabaseOptional assumes packaging/gen-signing-key.sh has been run
|
||||
# and its packager pubkey is already trusted on THIS build host's own pacman
|
||||
# keyring (mkarchiso's pacstrap reads the host's /etc/pacman.d/gnupg, not the
|
||||
# airootfs's — that trust is set up separately by customize_airootfs.sh for
|
||||
# the live/target system). Until the key exists and is trusted here, building
|
||||
# will fail closed rather than pull unsigned [tanin] packages into the ISO.
|
||||
SigLevel = Required DatabaseOptional
|
||||
Server = https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch
|
||||
|
||||
Reference in New Issue
Block a user