Repository navigation
Apple Silicon test candidate set pinned to #527, with its signing tool - #538
Merged
Merged
Conversation
The set pins omarchy, omarchy-settings, omarchy-mac and omarchy-mac-boot to omarchy-mac 073e489 (head of #527) plus the Aurora kernel, m1n1, U-Boot and gated Limine hook from their omacom/omarchy-pkgs pull request builds. Its files sit in a draft release of the owner's fork, outside every channel. tools/release/candidate-set signs it with a test lane key no keyring trusts and verifies it against a pinned fingerprint.
This was referenced Sep 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ticket 22. Stacked on #527 (base
mac/04-land-503).The first test candidate set for Apple Silicon image builds (ticket 23):
omarchy,omarchy-settings,omarchy-macandomarchy-mac-bootare all built from073e489b5b85, the head of Land #503 with the review fixes and the gap-audit merge blockers #527. The build runs on a GitHub arm64 runner on the owner's fork, on thelab/22-candidate-setbranch (run). It uses the existing recipes: omacom 4b60e4cd with the pkgs-aarch64 ARM patch, Install wf-recorder on Macs so screen recording works #626'somarchy-mac, and Screenshot Remap #65'somarchy-mac-bootadapted to Land #503 with the review fixes and the gap-audit merge blockers #527's payload layout. Thecheck()suites foromarchy-macandomarchy-mac-bootpassed, and the provenance markers equal the pinned commit.linux-auroraandlinux-aurora-headers7.1.12.aurora2-10 (Track upstream: aquamarine reads possibleCrtcs once (Type-C display rerouted to another CRTC stays dark until restart) #625),m1n1-auroraanduboot-asahi(Name Mac audio devices like macOS and hide DSP internals #627), and the Apple-gatedlimine-mkinitcpio-hook1.39.0-2 (Hand the Apple desktop leaves to omarchy-mac's setup #631) are the omacom/omarchy-pkgs pull request CI builds. Each one's artifact digest and recipe tree match its PR head.maralcbr/omarchy-pkgs, visible to collaborators only. There's no tag, no pacman database and no channel, and nothing is on omacom.manifest.jsonrecords every source, version, SHA-256 and the set digest (computed the same way asmac-release).tools/release/candidate-set sign|verify: signing uses a dedicated test lane key in its own GnuPG home, which no Omarchy keyring trusts. Verification trusts only a pinned fingerprint.Not signed yet. No test lane key existed. The only keys in the lanes are the owner's mx-mac release key and the omarchy-mac edge CI key, and neither may sign candidates. The owner signs with one command from this branch:
It creates the key on first use, uploads the signatures and receipt to the draft, and writes
signing.jsonbeside the manifest. Commit that file.Tested:
tools/release/test/candidate-setpasses 27 checks with a disposable key and a fakegh. Verification rejects a wrong or swapped key, a package signed by another key, a revoked key, a changed package, receipt or manifest, a missing signature and an extra release asset. On the real nine packages, a disposable key (not uploaded) signed and verified the set, and a one-byte change toomarchy-mac-bootfailed both the hash and the signature check.Second review: the review found no way past verification and no secret exposure in the lab workflow. It raised six low-severity items (revoked-key status, extra release assets, the order of an interrupted upload, a stale manifest field, README visibility wording, a hidden SRCINFO), and all six are fixed.