packaging/iso: uninstall safety, fail-closed AUR updates, no sshd on live ISO

- tanin-greet.install: post_remove restores the previous greetd config —
  removing the package no longer leaves greetd pointing at a dead binary
- aur-autoupdate: skip packages when the AUR RPC is unreachable instead of
  building blind (fail closed)
- build-tanin-repo: per-package makepkg logs instead of >/dev/null
- live ISO: drop sshd.service enablement (root has an empty password on the
  live medium); encoded in bootstrap-profile.sh so it survives re-bootstrap
- gtklock config: de-personalize hardcoded /home/karim path, mark as
  not-yet-packaged reference
- tanin-desktop PKGBUILD: correct stale AUR-vs-extra comments (gtklock,
  awww, cliphist are in extra), document the eww-git provides=eww contract
- docs/distribution.md: mark SigLevel TrustAll as temporary/insecure, add
  repo-signing TODO (repo-add -s, SigLevel Required), tick done roadmap items
- tanin-calendar + niri-config.kdl: pending session work

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/distribution.md

@@ -27,8 +27,8 @@ AUR/Binär-Pakete dürfen **nicht** nach `/home` schreiben. Daher:
 
 ## Phasen
 
-1. **Fundament** — `packaging/taninux/PKGBUILD` (fertig), LICENSE wählen,
+1. **Fundament** — `packaging/taninux/PKGBUILD` (fertig), LICENSE (✅ da,
-   `cd packaging/taninux && makepkg -si` lokal testen.
+   GPL-3.0-or-later), `cd packaging/taninux && makepkg -si` lokal testen.
 2. **Meta + Config** — `tanin-desktop` (Skelett da), `tanin-eww`, `tanin-setup`.
 3. **Eigenes Repo `[tanin]`**. Hosts:
    - **Code** → `git.openbureau.ch/karim/taninux` (PKGBUILD-`source`, woher `makepkg` klont)
@@ -47,11 +47,29 @@ AUR/Binär-Pakete dürfen **nicht** nach `/home` schreiben. Daher:
    `pacman.conf`-Snippet für User:
    ```ini
    [tanin]
-   SigLevel = Optional TrustAll       # später: Required + Key importieren
+   # TEMPORÄR + UNSICHER: TrustAll akzeptiert JEDES Paket ohne Signaturprüfung.
+   # Nur zum Bootstrappen, solange die DB noch nicht signiert ist. Sobald der
+   # Packager-Key steht -> auf "Required DatabaseOptional" umstellen (siehe unten).
+   SigLevel = Optional TrustAll
    Server = https://taninux.kgva.ch/$arch
    ```
-4. **Calamares / ISO** — `archiso`-Profil mit `[tanin]` vorkonfiguriert +
+
-   Calamares `packages`-Modul, das `tanin-desktop` installiert.
+   #### Repo-Signing (TODO)
+
+   Zielzustand (bevor das Repo öffentlich empfohlen wird):
+   1. Packager-GPG-Key erzeugen (`gpg --full-gen-key`) und öffentlich ablegen
+      (z. B. `taninux.kgva.ch/tanin.gpg`), damit User ihn importieren können.
+   2. DB **signiert** bauen: `repo-add -s tanin.db.tar.zst *.pkg.tar.zst`
+      (`-s` signiert DB + jedes hinzugefügte Paket mit dem Packager-Key).
+   3. Key beim User installieren (`pacman-key --add`, `pacman-key --lsign-key`)
+      und dann in `pacman.conf` scharfschalten:
+      ```ini
+      SigLevel = Required DatabaseOptional
+      ```
+      → jedes Paket muss signiert sein; die DB-Signatur ist optional.
+4. **Calamares / ISO** ✅ — `archiso`-Profil mit `[tanin]` vorkonfiguriert +
+   Calamares `packages`-Modul, das `tanin-desktop` installiert
+   (`iso/build-profile/`, gebaute ISO in `iso/out/`).
 
 ## Dark Mode / Portal (Session-Fix)
 

iso/bootstrap-profile.sh

@@ -38,6 +38,13 @@ install -m644 "$HERE/overrides/profiledef.sh" "$PROFILE/profiledef.sh"
 install -m644 "$HERE/overrides/pacman.conf"   "$PROFILE/pacman.conf"
 cp -rT "$HERE/overrides/airootfs" "$PROFILE/airootfs"
 
+echo "==> security: do NOT enable sshd on the live ISO"
+# releng ships root with an empty password AND enables sshd (PermitRootLogin yes)
+# -> open remote root on any network the live ISO joins. We don't need sshd for
+# the installer, so drop the wants-symlink. This is re-applied on every bootstrap
+# because build-profile is regenerated from releng above (authoritative fix).
+rm -f "$PROFILE/airootfs/etc/systemd/system/multi-user.target.wants/sshd.service"
+
 echo "==> profile ready: $PROFILE"
 WORK=/tmp/tanin-work
 if [ "${1:-}" = "--build" ]; then

iso/build-profile/airootfs/etc/systemd/system/multi-user.target.wants/sshd.service

@@ -1 +0,0 @@
-/usr/lib/systemd/system/sshd.service

packaging/aur-autoupdate.sh

@@ -67,7 +67,10 @@ should_build() {
   local p="$1"
   [[ "$p" == *-git ]] && return 0
   local rpc; rpc="$(aur_version "$p")"
-  [ -z "$rpc" ] && return 0                      # RPC down → build to be safe
+  if [ -z "$rpc" ]; then                         # RPC unreachable → fail closed
+    log "WARNING: AUR RPC unreachable for $p — skipping (won't build blind)"
+    return 1
+  fi
   local last; last="$(cat "$CACHE/$p.ver" 2>/dev/null || echo)"
   [ "$rpc" != "$last" ]
 }

packaging/build-tanin-repo.sh

@@ -13,7 +13,8 @@ set -uo pipefail
 HERE="$(cd "$(dirname "$0")" && pwd)"
 OUT="${TANIN_REPO_DIR:-$HOME/projects/tanin-repo}"
 DB="$OUT/tanin.db.tar.zst"
-mkdir -p "$OUT"
+LOGDIR="$OUT/logs"
+mkdir -p "$OUT" "$LOGDIR"
 
 # tanin-icons builds from the installed Adwaita theme -> needs librsvg + python.
 OWN_SIMPLE=(tanin-greet tanin-libadwaita tanin-setup tanin-eww tanin-icons tanin-desktop)
@@ -21,12 +22,14 @@ OWN_BUILD=(taninux)
 AUR_REBUILD=(eww-git tiramisu-git waypaper calamares librewolf-bin
              arch-update timeshift-autosnap xdg-terminal-exec paru)
 
+# makepkg output goes to a per-package log (console stays quiet); inspect the log
+# for warnings even on success. Log path is echoed so it's easy to find.
 build() {
-  local p="$1"
+  local p="$1" log="$LOGDIR/$p.log"
-  echo "==> building $p"
+  echo "==> building $p (log: $log)"
-  ( cd "$HERE/$p" && makepkg -d -f --noconfirm >/dev/null 2>&1 ) \
+  ( cd "$HERE/$p" && makepkg -d -f --noconfirm ) >"$log" 2>&1 \
     && cp "$HERE/$p/"*.pkg.tar.zst "$OUT/" 2>/dev/null \
-    && echo "   ok" || { echo "   FAILED ($p)"; return 1; }
+    && echo "   ok" || { echo "   FAILED ($p) — see $log"; return 1; }
 }
 
 for p in "${OWN_SIMPLE[@]}"; do build "$p"; done
@@ -39,6 +42,7 @@ for p in "${OWN_BUILD[@]}"; do
   fi
 done
 
+echo "** build logs (incl. makepkg warnings) in: $LOGDIR"
 echo "** AUR rebuilds TODO (not in official repos): ${AUR_REBUILD[*]}"
 echo "   build each with paru/makepkg and copy the .pkg.tar.zst into $OUT, then re-run."
 

packaging/gtklock/config.ini

@@ -1,8 +1,16 @@
 # gtklock — TANINUX lockscreen config (Fuji greeter look).
 # glib keyfile format. gtklock is launched as: gtklock -d -c <this file>
+#
+# NOTE: this file is NOT yet wired into any package — it is a reference/template.
+# Nothing installs or reads it at the moment (see the tanin-desktop deps: gtklock
+# is pulled from extra, but no TANINUX package ships this config).
 [main]
-# stylesheet + wallpaper-as-css-background live next to this file
+# stylesheet + wallpaper-as-css-background live next to this file.
-style=/home/karim/.config/gtklock/gtklock.css
+# gtklock's keyfile does NOT expand ~ or $HOME reliably, so `style=` needs an
+# absolute path. Point it at the actual user's gtklock.css, e.g.
+#   style=/home/<user>/.config/gtklock/gtklock.css
+# (left commented on purpose — a hardcoded /home/<name> would only work for one user).
+#style=/home/<user>/.config/gtklock/gtklock.css
 # modules (system .so, suffix optional): user avatar+name, and power buttons
 modules=userinfo;powerbar
 # built-in clock — time over date, like the greeter's centre clock

packaging/tanin-calendar/PKGBUILD

@@ -1,20 +1,22 @@
 # Maintainer: Karim <karim@gabrielevarano.ch>
 #
-# tanin-calendar — TANINUX calendar app (GTK4 / libadwaita). A detailed agenda
+# tanin-calendar — TANINUX calendar app (native GTK4, libadwaita-free). A
-# over your calendars, read straight from Evolution Data Server (the same
+# sidebar + month/week/day calendar over your calendars, read straight from
-# backend GNOME Online Accounts feeds). Inherits the Fuji monochrome look from
+# Evolution Data Server (the same backend GNOME Online Accounts feeds). Uses
-# tanin-libadwaita. German UI.
+# the TANINUX design language (Iosevka chrome, Fuji accent) and tracks the live
+# accent via the global named colours. English UI, translatable via gettext.
 pkgname=tanin-calendar
 pkgver=0.1.0
 pkgrel=1
-pkgdesc="TANINUX calendar — GTK4/libadwaita agenda over Evolution Data Server (GNOME Online Accounts)"
+pkgdesc="TANINUX calendar — native GTK4 agenda over Evolution Data Server (GNOME Online Accounts)"
 arch=('any')
 url="https://taninux.kgva.ch"
 license=('GPL-3.0-or-later')
-depends=('python' 'python-gobject' 'gtk4' 'libadwaita'
+depends=('python' 'python-gobject' 'gtk4'
-         'evolution-data-server' 'adwaita-icon-theme')
+         'evolution-data-server' 'adwaita-icon-theme'
+         'ttc-iosevka-aile')
 optdepends=('gnome-online-accounts: add Google/Nextcloud/CalDAV calendars'
-            'tanin-libadwaita: Fuji monochrome theming for the app')
+            'taninux: live Fuji accent + light/dark theming for the app')
 
 package() {
   install -Dm755 "$startdir/tanin-calendar" \

packaging/tanin-calendar/ch.gabrielevarano.TaninCalendar.desktop

@@ -2,7 +2,7 @@
 Type=Application
 Name=Calendar
 Name[de]=Kalender
-Comment=Termine aus deinen Kalendern (Evolution Data Server)
+Comment=Events from your calendars (Evolution Data Server)
 Comment[de]=Termine aus deinen Kalendern (Evolution Data Server)
 Exec=tanin-calendar
 Icon=x-office-calendar

packaging/tanin-desktop/PKGBUILD

@@ -3,8 +3,9 @@
 # Metapackage: pulls the complete TANINUX (camel) desktop — niri + eww, managed
 # by the TANINUX apps. Own packages come from the [tanin] repo, everything else
 # from the official Arch repos. AUR-only runtime deps (eww, tiramisu, waypaper,
-# cliphist, librewolf-bin, arch-update, timeshift-autosnap, xdg-terminal-exec,
+# librewolf-bin, arch-update, timeshift-autosnap, xdg-terminal-exec, paru) are
-# paru) are rebuilt into [tanin] so this never hard-depends on the AUR.
+# rebuilt into [tanin] so this never hard-depends on the AUR. (cliphist, awww,
+# gtklock + its modules are in official extra -> pulled straight from Arch.)
 # Calamares just installs this package at the end.
 pkgname=tanin-desktop
 pkgver=0.2.0
@@ -40,8 +41,9 @@ depends=(
   'xdg-desktop-portal-gtk'         # Settings/Appearance portal (dark mode!)
   'xdg-desktop-portal-gnome'       # screencast backend recommended for niri
 
-  # --- shell / eww stack (eww, tiramisu, waypaper, cliphist via [tanin]) ---
+  # --- shell / eww stack (eww/tiramisu/waypaper via [tanin]; cliphist from extra) ---
-  'eww'                            # bar/dock/panels/spotlight
+  'eww'                            # bar/dock/panels/spotlight — [tanin] ships eww-git,
+                                   #   which must `provides=(eww)` to satisfy this dep
   'tiramisu-git'                       # headless notification daemon -> eww UI
   'waypaper'                       # wallpaper (niri autostart: waypaper --restore)
   'awww'                           # 2nd wallpaper surface -> blurred niri Overview backdrop (place-within-backdrop)

packaging/tanin-eww/niri-config.kdl

@@ -14,11 +14,13 @@ input {
     mouse {}
 }
 
-// Outputs — scale 1.25 like the Hyprland setup. Mode omitted on purpose so niri
+// Outputs — scale 1.25 like the Hyprland setup. Mode is pinned explicitly:
-// picks the highest refresh rate automatically (144 Hz on DP-3). Positions are
+// niri's "preferred" mode on DP-3 is only 60 Hz, so omitting it left the
-// left to niri's auto-placement.
+// monitor at 59.951 Hz. We force the full 143.973 Hz panel rate (gaming).
+// Positions are left to niri's auto-placement.
 output "DP-3" {
     scale 1.25
+    mode "2560x1440@143.973"
 }
 output "HDMI-A-1" {
     scale 1.25
@@ -92,6 +94,18 @@ window-rule {
     clip-to-geometry true
 }
 
+// ---- Gaming: Spiele direkt im echten Vollbild öffnen ----------------------
+// Steam/Proton-Titel (app-id "steam_app_<id>") und gamescope gehen sofort
+// fullscreen auf — ohne Gaps, Rundungen oder geometry-clip (würde sonst die
+// Render-Surface beschneiden). Manuell jederzeit mit Mod+Shift+F umschaltbar.
+window-rule {
+    match app-id="^steam_app_"
+    match app-id="^gamescope$"
+    open-fullscreen true
+    geometry-corner-radius 0
+    clip-to-geometry false
+}
+
 // ---- geblurrtes Wallpaper im Overview-Backdrop ----------------------------
 // Zwei Wallpaper-Surfaces:
 //   * swaybg (namespace "wallpaper")   -> scharf auf dem Desktop (waypaper)

packaging/tanin-greet/tanin-greet.install

@@ -22,3 +22,21 @@ EOF
 post_upgrade() {
   _activate
 }
+
+# Package files (incl. the greeter binary greetd is pointed at) are gone by the
+# time post_remove runs, so restore the pre-tanin greetd config we backed up in
+# _activate — otherwise greetd keeps launching a deleted greeter and login breaks.
+post_remove() {
+  local dst=/etc/greetd/config.toml
+  if [ -e "$dst.tanin-bak" ]; then
+    mv -f "$dst.tanin-bak" "$dst"
+    echo ">> tanin-greet: restored the previous greetd config from $dst.tanin-bak" >&2
+  else
+    cat >&2 <<'EOF'
+!! tanin-greet: WARNING — /etc/greetd/config.toml still points at the TANINUX
+!! greeter, which was just REMOVED, and no backup (.tanin-bak) exists to restore.
+!! greetd will fail to start (no login) until you edit /etc/greetd/config.toml
+!! to reference an installed greeter (e.g. agreety) or disable greetd.
+EOF
+  fi
+}