Display arrangement persistence + centering fix, packaging hardening
- core/display.py: write_positions() persists Arrangement's drag-and-drop
layout into niri's config.kdl (one output { position x= y= } per output),
validated via `niri validate` on a temp copy with a .kdl.bak backup before
writing — same pattern as core/keybindings.py's rebind(). Previously the
page only ever called `niri msg output … position set`, which niri treats
as live-only and drops on the next login/reload.
- gui/pages/display.py: Arrangement's Apply now runs each output's `niri msg
output … position set` synchronously instead of queuing them all on the
single-shot ProcessRunner (which rejects a second run() while the first is
still async) — a 2-monitor apply previously moved only the first output
and silently dropped the rest. _dock_to_nearest keeps the free axis at the
dragged position (so a shorter display can sit vertically centered next to
a taller rotated one) rather than forcing corner alignment.
- core/panel.py, files/__init__.py: incidental fixes alongside the above.
- packaging/: signing-key generation script + build-user systemd setup for
the [tanin] AUR auto-rebuild pipeline; PKGBUILD bumped to pkgrel=5.
- src/taninux/browser/: new module for browser theme sync (Fuji accent).
This commit is contained in:
Executable
+95
@@ -0,0 +1,95 @@
|
||||
#!/usr/bin/env bash
|
||||
# One-time setup of the dedicated "tanin-build" account for the daily [tanin]
|
||||
# AUR rebuild, so the root-equivalent makechrootpkg/arch-nspawn/mkarchroot
|
||||
# sudo grant (tanin-aur-update.sudoers) lives on a locked system account
|
||||
# instead of the maintainer's own login ("karim"). Run as root (or via sudo)
|
||||
# on the machine that will run tanin-aur-update.timer.
|
||||
#
|
||||
# sudo ./setup-build-user.sh
|
||||
#
|
||||
# What it does:
|
||||
# 1) create the tanin-build system user, home /var/lib/tanin-build, locked
|
||||
# password (no interactive/SSH login — only systemd + sudo can act as it)
|
||||
# 2) clone/sync this checkout's packaging scripts into ~tanin-build/taninux,
|
||||
# because the systemd unit's %h paths resolve against tanin-build's home,
|
||||
# not /home/karim
|
||||
# 3) prepare ~tanin-build/.gnupg (mode 700) for the packager signing key
|
||||
# 4) install the sudoers drop-in + systemd unit/timer
|
||||
#
|
||||
# What it deliberately does NOT do:
|
||||
# - generate or import the signing key (packaging/gen-signing-key.sh is a
|
||||
# separate, explicit step — key material shouldn't be created as a side
|
||||
# effect of account provisioning)
|
||||
# - enable/start the timer (review Environment=GPGKEY=... in the unit first)
|
||||
set -euo pipefail
|
||||
|
||||
[ "$(id -u)" -eq 0 ] || { echo "!! run as root (sudo ./setup-build-user.sh)" >&2; exit 1; }
|
||||
|
||||
HERE="$(cd "$(dirname "$0")" && pwd)" # .../packaging/systemd
|
||||
ROOT="$(cd "$HERE/../.." && pwd)" # taninux checkout root
|
||||
BUILD_USER="tanin-build"
|
||||
BUILD_HOME="/var/lib/tanin-build"
|
||||
|
||||
echo "==> user: $BUILD_USER (system account, home=$BUILD_HOME)"
|
||||
if ! id "$BUILD_USER" >/dev/null 2>&1; then
|
||||
useradd --system --create-home --home-dir "$BUILD_HOME" \
|
||||
--shell /usr/bin/bash "$BUILD_USER"
|
||||
passwd --lock "$BUILD_USER" # no password login — only sudo (via the
|
||||
# NOPASSWD drop-in) and systemd User= can act as it
|
||||
else
|
||||
echo " already exists — skipping useradd"
|
||||
fi
|
||||
|
||||
echo "==> syncing packaging scripts to $BUILD_HOME/taninux"
|
||||
# The systemd unit uses %h-relative paths (ExecStart=%h/taninux/packaging/...),
|
||||
# which resolve against tanin-build's home — so a copy of the checkout (or at
|
||||
# least packaging/) has to live there too, owned by tanin-build, not karim.
|
||||
install -d -o "$BUILD_USER" -g "$BUILD_USER" "$BUILD_HOME/taninux"
|
||||
rsync -a --delete \
|
||||
--exclude '.git' --exclude 'iso/out' --exclude 'iso/build-profile' \
|
||||
"$ROOT/" "$BUILD_HOME/taninux/"
|
||||
chown -R "$BUILD_USER:$BUILD_USER" "$BUILD_HOME/taninux"
|
||||
echo " NOTE: re-run this script (or your own sync) after pulling changes —"
|
||||
echo " it is a one-shot copy, not a live checkout."
|
||||
|
||||
echo "==> GPG homedir for the packager key"
|
||||
install -d -m700 -o "$BUILD_USER" -g "$BUILD_USER" "$BUILD_HOME/.gnupg"
|
||||
cat <<EOT
|
||||
$BUILD_HOME/.gnupg is ready but EMPTY. The packager secret key created by
|
||||
packaging/gen-signing-key.sh must be imported here before the daily
|
||||
rebuild can sign anything, e.g. (as $BUILD_USER):
|
||||
sudo -u $BUILD_USER gpg --homedir $BUILD_HOME/.gnupg --import packager-secret.asc
|
||||
Trust implication: whoever can read $BUILD_HOME/.gnupg's secring can sign
|
||||
packages as TANINUX — keep its permissions at 700/600 and don't put it on
|
||||
a shared or less-trusted host than the maintainer's own signing machine.
|
||||
EOT
|
||||
|
||||
echo "==> makepkg env"
|
||||
install -d -m755 -o "$BUILD_USER" -g "$BUILD_USER" "$BUILD_HOME/.cache" "$BUILD_HOME/.config"
|
||||
|
||||
echo "==> installing sudoers drop-in"
|
||||
install -m440 "$HERE/tanin-aur-update.sudoers" /etc/sudoers.d/tanin-aur-update
|
||||
visudo -cf /etc/sudoers.d/tanin-aur-update
|
||||
|
||||
echo "==> installing systemd unit + timer (SYSTEM units — the .service sets"
|
||||
echo " User=/Group=$BUILD_USER itself, so it must run under the system"
|
||||
echo " manager, not --user; that's also what makes the sudo NOPASSWD"
|
||||
echo " grant for tanin-build actually apply)"
|
||||
install -m644 "$HERE/tanin-aur-update.service" /etc/systemd/system/
|
||||
install -m644 "$HERE/tanin-aur-update.timer" /etc/systemd/system/
|
||||
systemctl daemon-reload
|
||||
|
||||
cat <<EOT
|
||||
|
||||
== setup done ==
|
||||
Still TODO before the timer can run for real:
|
||||
1) packaging/gen-signing-key.sh (if not already done), then import the
|
||||
secret key into $BUILD_HOME/.gnupg as shown above.
|
||||
2) sudo systemctl edit tanin-aur-update.service
|
||||
and set Environment=GPGKEY=<fingerprint> (or uncomment it in
|
||||
/etc/systemd/system/tanin-aur-update.service directly).
|
||||
3) sudo -u $BUILD_USER $BUILD_HOME/taninux/packaging/aur-autoupdate.sh setup
|
||||
(one-time: installs devtools + creates the makechrootpkg chroot —
|
||||
needs the sudo grant just installed, so run this AFTER step 4 too)
|
||||
4) sudo systemctl enable --now tanin-aur-update.timer
|
||||
EOT
|
||||
@@ -1,13 +1,25 @@
|
||||
[Unit]
|
||||
Description=TANINUX [tanin] repo — daily AUR rebuild
|
||||
Documentation=file:%h/projects/taninux/packaging/aur-autoupdate.sh
|
||||
Documentation=file:%h/taninux/packaging/aur-autoupdate.sh
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
# Adjust the path if your checkout lives elsewhere.
|
||||
ExecStart=%h/projects/taninux/packaging/aur-autoupdate.sh run
|
||||
# Dedicated, locked build account (see setup-build-user.sh) — NOT the human
|
||||
# "karim" account. Isolates the root-equivalent makechrootpkg/arch-nspawn/
|
||||
# mkarchroot sudo grant (tanin-aur-update.sudoers) off the personal login.
|
||||
User=tanin-build
|
||||
Group=tanin-build
|
||||
# %h now resolves against tanin-build's home (/var/lib/tanin-build by
|
||||
# setup-build-user.sh), NOT /home/karim — so this checkout must live there
|
||||
# too (setup-build-user.sh clones/syncs it in). Adjust if it lives elsewhere.
|
||||
ExecStart=%h/taninux/packaging/aur-autoupdate.sh run
|
||||
# The packager signing key: GPGKEY must be set, and GNUPGHOME (default
|
||||
# %h/.gnupg = /var/lib/tanin-build/.gnupg) must actually contain that secret
|
||||
# key for tanin-build — see gen-signing-key.sh + setup-build-user.sh.
|
||||
# Environment=GPGKEY=<packager key fingerprint, from gen-signing-key.sh>
|
||||
# Environment=GNUPGHOME=%h/.gnupg # only needed if it's not already the default
|
||||
# Be a good citizen — this is a background rebuild, not interactive work.
|
||||
Nice=15
|
||||
IOSchedulingClass=idle
|
||||
|
||||
@@ -2,6 +2,12 @@
|
||||
# Install: sudo install -m440 tanin-aur-update.sudoers /etc/sudoers.d/tanin-aur-update
|
||||
# Validate: sudo visudo -cf /etc/sudoers.d/tanin-aur-update
|
||||
#
|
||||
# Replace "karim" if the timer runs as a different user. These are exactly the
|
||||
# helpers devtools' makechrootpkg shells out to as root; nothing broader.
|
||||
karim ALL=(root) NOPASSWD: /usr/bin/makechrootpkg, /usr/bin/arch-nspawn, /usr/bin/mkarchroot
|
||||
# Subject is "tanin-build", a dedicated, locked (no password login) system
|
||||
# account created by setup-build-user.sh — NOT the human "karim" account.
|
||||
# makechrootpkg/arch-nspawn/mkarchroot are effectively unrestricted root (they
|
||||
# bind-mount, chroot, and run arbitrary PKGBUILD-controlled commands as root),
|
||||
# so this NOPASSWD grant is root-equivalent. Keeping it on a dedicated build
|
||||
# account rather than the personal login means a compromised AUR PKGBUILD (or
|
||||
# a bug in this pipeline) can't NOPASSWD-root the maintainer's own account —
|
||||
# it's contained to whatever tanin-build can already reach.
|
||||
tanin-build ALL=(root) NOPASSWD: /usr/bin/makechrootpkg, /usr/bin/arch-nspawn, /usr/bin/mkarchroot
|
||||
|
||||
Reference in New Issue
Block a user