Build the Apple initramfs drop-ins on the HOOKS baseline, Apple only

docs/apple-silicon-trackpad.md

@@ -43,7 +43,7 @@ arrives for the node — so the trackpad stays dead for the session.
 
 `install/hardware/apple/fix-asahi-hid-race.sh` writes
 `/etc/mkinitcpio.conf.d/apple_hid_modules.conf`, which adds both drivers to
-`MODULES` on kernels that build them as modules:
+`MODULES` on kernels that build them as modules. On a Mac with `omarchy-mac-boot`, its `92-omarchy-mac-hid.conf` loads them instead, and the leaf writes nothing:
 
 ```
 for _omarchy_apple_hid_module in hid_apple hid_magicmouse; do

install/hardware/apple/fix-asahi-hid-race.sh

@@ -15,6 +15,10 @@
 # race.
 omarchy-hw-apple-silicon || return 0
 
+# omarchy-mac-boot's 92-omarchy-mac-hid.conf early-loads both drivers along with
+# the rest of the passphrase prompt's keyboard stack, so it is the one writer.
+[[ ! -f /etc/mkinitcpio.conf.d/92-omarchy-mac-hid.conf ]] || return 0
+
 echo "Detected Apple Silicon Mac: early-loading the Apple HID drivers"
 
 sudo mkdir -p /etc/mkinitcpio.conf.d

migrations/1788200001.sh

@@ -15,8 +15,8 @@ ready="${OMARCHY_APPLE_HID_READY:-/var/lib/omarchy/apple-hid-initramfs-ready}"
 [[ -f $ready ]] && exit 0
 
 # The leaf carries both the hardware gate and the drop-in content; sourcing it
-# keeps that to one copy. Anything that is not an Apple Silicon Mac writes
-# nothing and falls out below.
+# keeps that to one copy. Anything that is not an Apple Silicon Mac, or a Mac
+# whose omarchy-mac-boot loads the drivers, writes nothing and falls out below.
 [[ -f $conf ]] || source "$hid_race_script"
 [[ -f $conf ]] || exit 0
 

packages/omarchy-mac/boot/files/etc/mkinitcpio.conf.d/90-omarchy-mac.conf

@@ -1,18 +1,33 @@
-# Generated by the Omarchy Apple Silicon image builder.
-_omarchy_asahi_hooks=()
-_omarchy_asahi_added=false
-for _omarchy_asahi_hook in "${HOOKS[@]}"; do
-  if [[ $_omarchy_asahi_hook == asahi ]]; then
-    _omarchy_asahi_added=true
-  fi
-  if [[ $_omarchy_asahi_hook == filesystems && $_omarchy_asahi_added == false ]]; then
+# The asahi and firmware hooks go right before filesystems. Every
+# omarchy-mac-boot drop-in adds to the platform's HOOKS baseline
+# (00-omarchy-hooks.conf) and only on Apple Silicon: anywhere else the package
+# leaves the initramfs exactly as the baseline and the other drop-ins set it.
+# This package only installs on Macs, so a runtime too old to ship the detector
+# still gets the Apple hooks, and a detector that cannot place the machine
+# stops the build, as the baseline does. As there, the asahi hook marks an
+# Apple root off a Mac too, as in a VM.
+_omarchy_mac_platform=apple-silicon
+if command -v omarchy-hw-platform >/dev/null; then
+  _omarchy_mac_platform=$(omarchy-hw-platform) || return 1
+fi
+[[ " ${HOOKS[*]:-} " != *" asahi "* ]] || _omarchy_mac_platform=apple-silicon
+if [[ $_omarchy_mac_platform == apple-silicon ]]; then
+  _omarchy_asahi_hooks=()
+  _omarchy_asahi_added=false
+  for _omarchy_asahi_hook in "${HOOKS[@]}"; do
+    if [[ $_omarchy_asahi_hook == asahi ]]; then
+      _omarchy_asahi_added=true
+    fi
+    if [[ $_omarchy_asahi_hook == filesystems && $_omarchy_asahi_added == false ]]; then
+      _omarchy_asahi_hooks+=(asahi omarchy-vendorfw)
+      _omarchy_asahi_added=true
+    fi
+    _omarchy_asahi_hooks+=("$_omarchy_asahi_hook")
+  done
+  if [[ $_omarchy_asahi_added == false ]]; then
     _omarchy_asahi_hooks+=(asahi omarchy-vendorfw)
-    _omarchy_asahi_added=true
   fi
-  _omarchy_asahi_hooks+=("$_omarchy_asahi_hook")
-done
-if [[ $_omarchy_asahi_added == false ]]; then
-  _omarchy_asahi_hooks+=(asahi omarchy-vendorfw)
+  HOOKS=("${_omarchy_asahi_hooks[@]}")
+  unset _omarchy_asahi_hooks _omarchy_asahi_hook _omarchy_asahi_added
 fi
-HOOKS=("${_omarchy_asahi_hooks[@]}")
-unset _omarchy_asahi_hooks _omarchy_asahi_hook _omarchy_asahi_added
+unset _omarchy_mac_platform

packages/omarchy-mac/boot/files/etc/mkinitcpio.conf.d/91-omarchy-mac-encrypt.conf

@@ -1,90 +1,100 @@
 # Insert omarchy-mac-encrypt after vendorfw/block and sd-encrypt immediately
 # before filesystems, each only if that hook is absent. 90-omarchy-mac.conf
 # already put asahi and omarchy-vendorfw before filesystems; this drop-in is
-# sourced after it.
+# sourced after it. Apple Silicon only, like 90-omarchy-mac.conf.
 #
-# Both are systemd initrd units: the systemd hook replaces udev (mkinitcpio's
-# stock HOOKS line) and keymap/consolefont become sd-vconsole. A HOOKS line
-# carrying the busybox encrypt hook belongs to a Mac unlocked by cryptdevice=,
-# which sd-encrypt cannot parse: that line is left exactly as it is.
-_omarchy_mac_encrypt_hooks=()
-_omarchy_mac_encrypt_have_systemd=false
-_omarchy_mac_encrypt_have_vconsole=false
-_omarchy_mac_encrypt_have_encrypt=false
-for _omarchy_mac_encrypt_hook in "${HOOKS[@]}"; do
-  case $_omarchy_mac_encrypt_hook in
-    systemd) _omarchy_mac_encrypt_have_systemd=true ;;
-    sd-vconsole) _omarchy_mac_encrypt_have_vconsole=true ;;
-    encrypt) _omarchy_mac_encrypt_have_encrypt=true ;;
-  esac
-done
-if [[ $_omarchy_mac_encrypt_have_encrypt == false ]]; then
-for _omarchy_mac_encrypt_hook in "${HOOKS[@]}"; do
-  case $_omarchy_mac_encrypt_hook in
-    udev)
-      if [[ $_omarchy_mac_encrypt_have_systemd == false ]]; then
-        _omarchy_mac_encrypt_hooks+=(systemd)
-        _omarchy_mac_encrypt_have_systemd=true
+# Both are systemd initrd units. The Apple baseline is already a systemd line;
+# one that is not moves to it: the systemd hook replaces udev and
+# keymap/consolefont become sd-vconsole. A HOOKS line carrying the busybox
+# encrypt hook belongs to a Mac unlocked by cryptdevice=, which sd-encrypt
+# cannot parse: that line is left as it is, as the baseline leaves it (a legacy
+# install until ticket 45 moves it).
+_omarchy_mac_platform=apple-silicon
+if command -v omarchy-hw-platform >/dev/null; then
+  _omarchy_mac_platform=$(omarchy-hw-platform) || return 1
+fi
+[[ " ${HOOKS[*]:-} " != *" asahi "* ]] || _omarchy_mac_platform=apple-silicon
+if [[ $_omarchy_mac_platform == apple-silicon ]]; then
+  _omarchy_mac_encrypt_hooks=()
+  _omarchy_mac_encrypt_have_systemd=false
+  _omarchy_mac_encrypt_have_vconsole=false
+  _omarchy_mac_encrypt_have_encrypt=false
+  for _omarchy_mac_encrypt_hook in "${HOOKS[@]}"; do
+    case $_omarchy_mac_encrypt_hook in
+      systemd) _omarchy_mac_encrypt_have_systemd=true ;;
+      sd-vconsole) _omarchy_mac_encrypt_have_vconsole=true ;;
+      encrypt) _omarchy_mac_encrypt_have_encrypt=true ;;
+    esac
+  done
+  if [[ $_omarchy_mac_encrypt_have_encrypt == false ]]; then
+    for _omarchy_mac_encrypt_hook in "${HOOKS[@]}"; do
+      case $_omarchy_mac_encrypt_hook in
+        udev)
+          if [[ $_omarchy_mac_encrypt_have_systemd == false ]]; then
+            _omarchy_mac_encrypt_hooks+=(systemd)
+            _omarchy_mac_encrypt_have_systemd=true
+          fi
+          ;;
+        keymap|consolefont)
+          if [[ $_omarchy_mac_encrypt_have_vconsole == false ]]; then
+            _omarchy_mac_encrypt_hooks+=(sd-vconsole)
+            _omarchy_mac_encrypt_have_vconsole=true
+          fi
+          ;;
+        *) _omarchy_mac_encrypt_hooks+=("$_omarchy_mac_encrypt_hook") ;;
+      esac
+    done
+    if [[ $_omarchy_mac_encrypt_have_systemd == false ]]; then
+      if [[ ${_omarchy_mac_encrypt_hooks[0]:-} == base ]]; then
+        _omarchy_mac_encrypt_hooks=(base systemd "${_omarchy_mac_encrypt_hooks[@]:1}")
+      else
+        _omarchy_mac_encrypt_hooks=(systemd "${_omarchy_mac_encrypt_hooks[@]}")
       fi
-      ;;
-    keymap|consolefont)
-      if [[ $_omarchy_mac_encrypt_have_vconsole == false ]]; then
-        _omarchy_mac_encrypt_hooks+=(sd-vconsole)
-        _omarchy_mac_encrypt_have_vconsole=true
+    fi
+    HOOKS=("${_omarchy_mac_encrypt_hooks[@]}")
+    _omarchy_mac_encrypt_hooks=()
+    _omarchy_mac_encrypt_have_ours=false
+    _omarchy_mac_encrypt_have_sd=false
+    _omarchy_mac_encrypt_added_ours=false
+    _omarchy_mac_encrypt_added_sd=false
+    for _omarchy_mac_encrypt_hook in "${HOOKS[@]}"; do
+      if [[ $_omarchy_mac_encrypt_hook == omarchy-mac-encrypt ]]; then
+        _omarchy_mac_encrypt_have_ours=true
       fi
-      ;;
-    *) _omarchy_mac_encrypt_hooks+=("$_omarchy_mac_encrypt_hook") ;;
-  esac
-done
-if [[ $_omarchy_mac_encrypt_have_systemd == false ]]; then
-  if [[ ${_omarchy_mac_encrypt_hooks[0]:-} == base ]]; then
-    _omarchy_mac_encrypt_hooks=(base systemd "${_omarchy_mac_encrypt_hooks[@]:1}")
-  else
-    _omarchy_mac_encrypt_hooks=(systemd "${_omarchy_mac_encrypt_hooks[@]}")
-  fi
-fi
-HOOKS=("${_omarchy_mac_encrypt_hooks[@]}")
-_omarchy_mac_encrypt_hooks=()
-_omarchy_mac_encrypt_have_ours=false
-_omarchy_mac_encrypt_have_sd=false
-_omarchy_mac_encrypt_added_ours=false
-_omarchy_mac_encrypt_added_sd=false
-for _omarchy_mac_encrypt_hook in "${HOOKS[@]}"; do
-  if [[ $_omarchy_mac_encrypt_hook == omarchy-mac-encrypt ]]; then
-    _omarchy_mac_encrypt_have_ours=true
-  fi
-  if [[ $_omarchy_mac_encrypt_hook == sd-encrypt ]]; then
-    _omarchy_mac_encrypt_have_sd=true
-  fi
-done
-for _omarchy_mac_encrypt_hook in "${HOOKS[@]}"; do
-  if [[ $_omarchy_mac_encrypt_hook == sd-encrypt && $_omarchy_mac_encrypt_have_ours == false &&
-        $_omarchy_mac_encrypt_added_ours == false ]]; then
-    _omarchy_mac_encrypt_hooks+=(omarchy-mac-encrypt)
-    _omarchy_mac_encrypt_added_ours=true
-  fi
-  if [[ $_omarchy_mac_encrypt_hook == filesystems ]]; then
+      if [[ $_omarchy_mac_encrypt_hook == sd-encrypt ]]; then
+        _omarchy_mac_encrypt_have_sd=true
+      fi
+    done
+    for _omarchy_mac_encrypt_hook in "${HOOKS[@]}"; do
+      if [[ $_omarchy_mac_encrypt_hook == sd-encrypt && $_omarchy_mac_encrypt_have_ours == false &&
+            $_omarchy_mac_encrypt_added_ours == false ]]; then
+        _omarchy_mac_encrypt_hooks+=(omarchy-mac-encrypt)
+        _omarchy_mac_encrypt_added_ours=true
+      fi
+      if [[ $_omarchy_mac_encrypt_hook == filesystems ]]; then
+        if [[ $_omarchy_mac_encrypt_have_ours == false && $_omarchy_mac_encrypt_added_ours == false ]]; then
+          _omarchy_mac_encrypt_hooks+=(omarchy-mac-encrypt)
+          _omarchy_mac_encrypt_added_ours=true
+        fi
+        if [[ $_omarchy_mac_encrypt_have_sd == false && $_omarchy_mac_encrypt_added_sd == false ]]; then
+          _omarchy_mac_encrypt_hooks+=(sd-encrypt)
+          _omarchy_mac_encrypt_added_sd=true
+        fi
+      fi
+      _omarchy_mac_encrypt_hooks+=("$_omarchy_mac_encrypt_hook")
+    done
     if [[ $_omarchy_mac_encrypt_have_ours == false && $_omarchy_mac_encrypt_added_ours == false ]]; then
       _omarchy_mac_encrypt_hooks+=(omarchy-mac-encrypt)
-      _omarchy_mac_encrypt_added_ours=true
     fi
     if [[ $_omarchy_mac_encrypt_have_sd == false && $_omarchy_mac_encrypt_added_sd == false ]]; then
       _omarchy_mac_encrypt_hooks+=(sd-encrypt)
-      _omarchy_mac_encrypt_added_sd=true
     fi
+    HOOKS=("${_omarchy_mac_encrypt_hooks[@]}")
   fi
-  _omarchy_mac_encrypt_hooks+=("$_omarchy_mac_encrypt_hook")
-done
-if [[ $_omarchy_mac_encrypt_have_ours == false && $_omarchy_mac_encrypt_added_ours == false ]]; then
-  _omarchy_mac_encrypt_hooks+=(omarchy-mac-encrypt)
-fi
-if [[ $_omarchy_mac_encrypt_have_sd == false && $_omarchy_mac_encrypt_added_sd == false ]]; then
-  _omarchy_mac_encrypt_hooks+=(sd-encrypt)
-fi
-HOOKS=("${_omarchy_mac_encrypt_hooks[@]}")
+  unset _omarchy_mac_encrypt_hooks _omarchy_mac_encrypt_hook \
+    _omarchy_mac_encrypt_have_ours _omarchy_mac_encrypt_have_sd \
+    _omarchy_mac_encrypt_added_ours _omarchy_mac_encrypt_added_sd \
+    _omarchy_mac_encrypt_have_systemd _omarchy_mac_encrypt_have_vconsole \
+    _omarchy_mac_encrypt_have_encrypt
 fi
-unset _omarchy_mac_encrypt_hooks _omarchy_mac_encrypt_hook \
-  _omarchy_mac_encrypt_have_ours _omarchy_mac_encrypt_have_sd \
-  _omarchy_mac_encrypt_added_ours _omarchy_mac_encrypt_added_sd \
-  _omarchy_mac_encrypt_have_systemd _omarchy_mac_encrypt_have_vconsole \
-  _omarchy_mac_encrypt_have_encrypt
+unset _omarchy_mac_platform

packages/omarchy-mac/boot/files/etc/mkinitcpio.conf.d/92-omarchy-mac-hid.conf

@@ -11,18 +11,26 @@
 #
 # mkinitcpio fails the whole image over a MODULES entry it cannot find, or a
 # built-in it reports as "(builtin)". Each name is added only when modinfo
-# returns a real path. Ending on unset keeps the exit status zero.
-
-for _omarchy_mac_hid_module in \
-    hid_apple hid_magicmouse dockchannel-hid usbhid \
-    spi-apple spi-hid-apple spi-hid-apple-of \
-    apple-dockchannel apple-rtkit-helper thunderbolt thunderbolt_apple; do
-  _omarchy_mac_hid_path=$(modinfo -k "${KERNELVERSION:-$(uname -r)}" -F filename \
-    "$_omarchy_mac_hid_module" 2>/dev/null) || continue
-  [[ $_omarchy_mac_hid_path == /* ]] || continue
-  MODULES+=("$_omarchy_mac_hid_module")
-done
-unset _omarchy_mac_hid_module _omarchy_mac_hid_path
+# returns a real path. Ending on unset keeps the exit status zero. Apple
+# Silicon only, like 90-omarchy-mac.conf.
+_omarchy_mac_platform=apple-silicon
+if command -v omarchy-hw-platform >/dev/null; then
+  _omarchy_mac_platform=$(omarchy-hw-platform) || return 1
+fi
+[[ " ${HOOKS[*]:-} " != *" asahi "* ]] || _omarchy_mac_platform=apple-silicon
+if [[ $_omarchy_mac_platform == apple-silicon ]]; then
+  for _omarchy_mac_hid_module in \
+      hid_apple hid_magicmouse dockchannel-hid usbhid \
+      spi-apple spi-hid-apple spi-hid-apple-of \
+      apple-dockchannel apple-rtkit-helper thunderbolt thunderbolt_apple; do
+    _omarchy_mac_hid_path=$(modinfo -k "${KERNELVERSION:-$(uname -r)}" -F filename \
+      "$_omarchy_mac_hid_module" 2>/dev/null) || continue
+    [[ $_omarchy_mac_hid_path == /* ]] || continue
+    MODULES+=("$_omarchy_mac_hid_module")
+  done
+  unset _omarchy_mac_hid_module _omarchy_mac_hid_path
+fi
+unset _omarchy_mac_platform
 
 # MTP trackpad firmware (apple/tpmtfw-<board>.bin) is not a MODULES entry.
 # omarchy-vendorfw-initrd.service unpacks ESP vendorfw/firmware.cpio onto

packages/omarchy-mac/boot/files/etc/mkinitcpio.conf.d/94-omarchy-mac-vconsole.conf

@@ -1,28 +1,33 @@
 # The disk passphrase prompt types with the owner's keyboard layout, as on
 # x86 Omarchy: sd-vconsole loads KEYMAP on the console (systemd-ask-password)
-# and /etc/vconsole.conf gives Plymouth its XKBLAYOUT. The aarch64
-# omarchy-settings drops upstream's omarchy_hooks.conf, so this drop-in
-# carries its guard: a layout that does not type Latin letters stays out of
-# the initramfs, because a Latin passphrase would be untypeable in it
-# (upstream #6229). The prompt then uses the kernel's US map, which is what
-# such a passphrase was typed with.
+# and /etc/vconsole.conf gives Plymouth its XKBLAYOUT. omarchy_hooks.conf
+# bundles that file on every platform, and only for a layout that types Latin
+# letters: anything else would make a Latin passphrase untypeable (upstream
+# #6229). The Apple baseline carries sd-vconsole unconditionally, so this
+# drop-in applies the same guard to the hook, and the prompt then uses the
+# kernel's US map, which is what such a passphrase was typed with. Apple
+# Silicon only, like 90-omarchy-mac.conf.
 #
 # A systemd HOOKS line gets sd-vconsole exactly once, after keyboard (or
 # after systemd without one); keymap and consolefont are its busybox
 # counterparts and never belong on such a line. A busybox line (a Mac
-# unlocked by cryptdevice=, which 91 leaves alone) keeps its hooks; it only
-# gets the file for Plymouth, as upstream does.
-# No vconsole.conf is the kernel's US map: sd-vconsole stays, nothing to bundle.
-_omarchy_mac_vconsole_latin=true
-if [[ -f /etc/vconsole.conf ]]; then
-  _omarchy_mac_vconsole_layout=$(unset XKBLAYOUT; . /etc/vconsole.conf 2>/dev/null; printf '%s' "${XKBLAYOUT:-}")
-  case ${_omarchy_mac_vconsole_layout%%,*} in
-    af | am | ara | bd | bg | by | et | ge | gr | il | in | iq | ir | kg | kh | kz | la | lk | mk | mm | mn | mv | np | rs | ru | sy | th | tj | ua)
-      _omarchy_mac_vconsole_latin=false ;;
-  esac
+# unlocked by cryptdevice=, which 91 leaves alone) keeps its hooks.
+# No vconsole.conf is the kernel's US map: sd-vconsole stays.
+_omarchy_mac_platform=apple-silicon
+if command -v omarchy-hw-platform >/dev/null; then
+  _omarchy_mac_platform=$(omarchy-hw-platform) || return 1
 fi
+[[ " ${HOOKS[*]:-} " != *" asahi "* ]] || _omarchy_mac_platform=apple-silicon
+if [[ $_omarchy_mac_platform == apple-silicon && " ${HOOKS[*]} " == *" systemd "* ]]; then
+  _omarchy_mac_vconsole_latin=true
+  if [[ -f /etc/vconsole.conf ]]; then
+    _omarchy_mac_vconsole_layout=$(unset XKBLAYOUT; . /etc/vconsole.conf 2>/dev/null; printf '%s' "${XKBLAYOUT:-}")
+    case ${_omarchy_mac_vconsole_layout%%,*} in
+      af | am | ara | bd | bg | by | et | ge | gr | il | in | iq | ir | kg | kh | kz | la | lk | mk | mm | mn | mv | np | rs | ru | sy | th | tj | ua)
+        _omarchy_mac_vconsole_latin=false ;;
+    esac
+  fi
 
-if [[ " ${HOOKS[*]} " == *" systemd "* ]]; then
   _omarchy_mac_vconsole_hooks=()
   _omarchy_mac_vconsole_anchor=systemd
   [[ " ${HOOKS[*]} " != *" keyboard "* ]] || _omarchy_mac_vconsole_anchor=keyboard
@@ -37,10 +42,7 @@ if [[ " ${HOOKS[*]} " == *" systemd "* ]]; then
     fi
   done
   HOOKS=("${_omarchy_mac_vconsole_hooks[@]}")
+  unset _omarchy_mac_vconsole_latin _omarchy_mac_vconsole_layout _omarchy_mac_vconsole_hooks \
+    _omarchy_mac_vconsole_anchor _omarchy_mac_vconsole_hook
 fi
-
-if [[ $_omarchy_mac_vconsole_latin == true && -f /etc/vconsole.conf ]]; then
-  FILES+=(/etc/vconsole.conf)
-fi
-unset _omarchy_mac_vconsole_latin _omarchy_mac_vconsole_layout _omarchy_mac_vconsole_hooks \
-  _omarchy_mac_vconsole_anchor _omarchy_mac_vconsole_hook
+unset _omarchy_mac_platform

packages/omarchy-mac/boot/files/usr/share/libalpm/hooks/91-omarchy-mac-boot-initramfs.hook

@@ -5,7 +5,6 @@ Operation = Upgrade
 Target = etc/mkinitcpio.conf.d/90-omarchy-mac.conf
 Target = etc/mkinitcpio.conf.d/91-omarchy-mac-encrypt.conf
 Target = etc/mkinitcpio.conf.d/92-omarchy-mac-hid.conf
-Target = etc/mkinitcpio.conf.d/93-omarchy-mac-plymouth.conf
 Target = etc/mkinitcpio.conf.d/94-omarchy-mac-vconsole.conf
 Target = etc/initcpio/install/*
 Target = usr/lib/initcpio/install/*

packages/omarchy-mac/boot/test/helpers/omarchy-hw-platform

@@ -0,0 +1,5 @@
+#!/bin/bash
+# Stands in for omarchy's detector, which this package's tests run without.
+# Unset is an Apple Silicon Mac; "fail" is a detector that cannot place the machine.
+[[ ${OMARCHY_TEST_HW_PLATFORM-} != fail ]] || exit 1
+printf '%s\n' "${OMARCHY_TEST_HW_PLATFORM-apple-silicon}"