karim
faaba27ed4
- core/display.py: write_positions() persists Arrangement's drag-and-drop
layout into niri's config.kdl (one output { position x= y= } per output),
validated via `niri validate` on a temp copy with a .kdl.bak backup before
writing — same pattern as core/keybindings.py's rebind(). Previously the
page only ever called `niri msg output … position set`, which niri treats
as live-only and drops on the next login/reload.
- gui/pages/display.py: Arrangement's Apply now runs each output's `niri msg
output … position set` synchronously instead of queuing them all on the
single-shot ProcessRunner (which rejects a second run() while the first is
still async) — a 2-monitor apply previously moved only the first output
and silently dropped the rest. _dock_to_nearest keeps the free axis at the
dragged position (so a shorter display can sit vertically centered next to
a taller rotated one) rather than forcing corner alignment.
- core/panel.py, files/__init__.py: incidental fixes alongside the above.
- packaging/: signing-key generation script + build-user systemd setup for
the [tanin] AUR auto-rebuild pipeline; PKGBUILD bumped to pkgrel=5.
- src/taninux/browser/: new module for browser theme sync (Fuji accent).
93 lines
3.7 KiB
Bash
Executable File
93 lines
3.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Generate the TANINUX packager signing key — THE DISTRO'S ROOT OF TRUST.
|
|
#
|
|
# Run this ONCE, by the maintainer, on a trusted machine. The resulting key
|
|
# signs every [tanin] package (makepkg --sign) and the repo DB (repo-add -s);
|
|
# every user who runs `pacman-key --lsign-key <fingerprint>` is trusting this
|
|
# key to vouch for everything TANINUX ships. Guard the private key + its
|
|
# passphrase like the root of the distro, because that's what it is.
|
|
#
|
|
# ./gen-signing-key.sh # prompts for Name-Email + a
|
|
# # gpg-agent passphrase prompt
|
|
# NAME_EMAIL=pkg@taninux.example ./gen-signing-key.sh
|
|
#
|
|
# This script does NOT set GPGKEY / wire it into the build scripts — that's a
|
|
# manual step below, so a compromised shell env can't silently point the
|
|
# build at the wrong key.
|
|
set -euo pipefail
|
|
|
|
command -v gpg >/dev/null || { echo "!! gpg not found" >&2; exit 1; }
|
|
|
|
NAME_REAL="TANINUX Packager"
|
|
NAME_EMAIL="${NAME_EMAIL:-}"
|
|
EXPIRE="${EXPIRE:-2y}"
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
|
|
if [ -z "$NAME_EMAIL" ]; then
|
|
read -rp "Packager key Name-Email (placeholder, doesn't need to receive mail): " NAME_EMAIL
|
|
fi
|
|
[ -n "$NAME_EMAIL" ] || { echo "!! Name-Email is required" >&2; exit 1; }
|
|
|
|
echo "== generating: $NAME_REAL <$NAME_EMAIL> (Ed25519, expires in $EXPIRE) =="
|
|
echo " gpg will prompt (via pinentry/gpg-agent) for a passphrase — set a real one."
|
|
|
|
PARAMFILE="$(mktemp)"
|
|
trap 'rm -f "$PARAMFILE"' EXIT
|
|
cat > "$PARAMFILE" <<EOF
|
|
%ask-passphrase
|
|
Key-Type: eddsa
|
|
Key-Curve: ed25519
|
|
Key-Usage: sign
|
|
Name-Real: $NAME_REAL
|
|
Name-Email: $NAME_EMAIL
|
|
Expire-Date: $EXPIRE
|
|
%commit
|
|
EOF
|
|
|
|
gpg --batch --gen-key "$PARAMFILE"
|
|
|
|
FPR="$(gpg --list-keys --with-colons "$NAME_EMAIL" 2>/dev/null \
|
|
| awk -F: '/^fpr:/ { print $10; exit }')"
|
|
|
|
if [ -z "$FPR" ]; then
|
|
echo "!! key created but the fingerprint could not be auto-detected." >&2
|
|
echo " run: gpg --list-keys \"$NAME_EMAIL\"" >&2
|
|
exit 1
|
|
fi
|
|
|
|
cat <<EOT
|
|
|
|
============================================================
|
|
TANINUX packager key created
|
|
Fingerprint: $FPR
|
|
============================================================
|
|
|
|
Next steps (manual — nothing below runs automatically):
|
|
|
|
1) Export the PUBLIC key into the target keyring source, so
|
|
customize_airootfs.sh's \`pacman-key --add\` picks it up on the next ISO
|
|
build. Re-export replaces/updates the file (see the comment left in
|
|
customize_airootfs.sh for the matching --lsign-key line to add):
|
|
gpg --export "$FPR" > "$ROOT/iso/overrides/airootfs/etc/pacman.d/tanin-repo.gpg"
|
|
gpg --export "$FPR" > "$ROOT/iso/build-profile/airootfs/etc/pacman.d/tanin-repo.gpg"
|
|
|
|
2) Publish the public key for existing/new users to import (see the
|
|
Cutover section in docs/distribution.md), e.g.:
|
|
gpg --export "$FPR" > /path/to/served/tanin-repo.gpg
|
|
and record "$FPR" in docs/distribution.md's Cutover section.
|
|
|
|
3) Point the build scripts at it (build-tanin-repo.sh, finish-tanin-repo.sh,
|
|
aur-autoupdate.sh all read GPGKEY from the environment and refuse to
|
|
build unsigned if it's unset):
|
|
export GPGKEY="$FPR"
|
|
For the systemd-driven daily rebuild (packaging/systemd/tanin-aur-update.service,
|
|
running as the dedicated tanin-build user — see setup-build-user.sh),
|
|
set Environment=GPGKEY=$FPR in the unit, or an EnvironmentFile it reads,
|
|
and make sure GNUPGHOME for tanin-build actually holds this secret key.
|
|
|
|
4) BACK UP THE PRIVATE KEY (\`gpg --export-secret-keys $FPR\`) to an offline,
|
|
encrypted location. Losing it means re-keying the whole distro and
|
|
asking every user to re-import; leaking it means anyone can sign
|
|
packages TANINUX users will install as trusted.
|
|
EOT
|