omarchy-mac-boot 20260925-4: re-pin to quattro-upstream 84352fdb

[maralcbr]

Re-pin of omarchy-mac-boot to mainline: 20260925-4, built from omacom/omarchy-mac quattro-upstream at 84352fdb (its head, the #560 merge). It replaces the published 20260925-3 (#641, pinned to f7ea7ecc). The pin's UTC commit date is still 20260925, so per the recipe's rule pkgrel goes to 4 rather than resetting to 1 (20260925-1 would sort below -3). aarch64 and edge only, with the omarchy-platform-apple-silicon group tag.

Important

Publish order: this build must reach edge before any runtime that contains omacom/omarchy-mac#552 or #553 reaches Macs. That runtime's omarchy-lifecycle-dispatch requires reset-* and luks-slots on Apple Silicon, so factory reset, owner setup and omarchy-drive-password on the system disk fail on Macs whose omarchy-mac-boot lacks them. Nothing else in this pin needs a newer settings or runtime package.

What the new pin brings

Every boot-payload change in f7ea7ecc..84352fdb (packages/omarchy-mac/boot, 17 files):

• Use matching prebuilt images for package builds and publishing #552 (Apple factory reset through dispatch): the reset-prepare, reset-verify, reset-commit and reset-rollback entrypoints; reworked lib/factory-reset.sh (stuck factory-root binds detached, retried rollback covered); lib/provision.sh; test/mac-reset-test.sh.
• Carry PR build artifacts inside a tar so epoch package names survive #553 (recovery key and key slots): the luks-slots entrypoint; lib/provision.sh decides the recovery key, never keeps an unseen one, fails on an unreadable LUKS header and keeps encrypt.state on the kept slots; install and provision tests.
• [Intel Mac P08/packages] Consolidate FaceTime PCIe camera packages #556: omarchy-mac-encrypt.service sends its output to kmsg (StandardOutput/StandardError=kmsg) at SyslogLevel=notice, so journald forwards it; encrypt test. ([Intel Mac P08/packages] Consolidate FaceTime PCIe camera packages #556's drive-password discovery itself is runtime code.)
• strata: update to 0.19.0, skip two tests the build host cannot run #560 (snapshot restore check): /usr/bin/omarchy-mac-snapshot-check, linked as limine-snapper-sync's pre hook 04-omarchy-mac-snapshot-check and post hook 99-omarchy-mac-snapshot-check in /etc/boot/hooks; test/snapshot-check-test.sh.
• The boot README.md documents the above. Publish tested daily package builder images #551, Build PR tooling from the base branch tip, not the event's base sha #554, artifact-helpers: survive bash -e #555 and [Intel Mac P11/packages] Consolidate model-specific Cirrus audio packages #557 change nothing under packages/omarchy-mac/boot.
• linux-omarchy: carry ACPICA PCI bus fix for resume delays #544 is not in 84352fdb (still open), so 93-omarchy-mac-plymouth.conf still ships and no omarchy-mkinitcpio-hooks-baseline dependency applies.

Recipe changes

• Pin, pkgrel and the git source checksum, as in omarchy-mac-boot 20260925-3: re-pin to quattro-upstream f7ea7ecc #641.
• binutils dependency. The boot check and now the snapshot restore check read the kernel out of the Limine UKI with objcopy. mkinitcpio already pulls binutils in, so it changes no install.
• README: the publish-order note above, and backup= covers /etc files: the two hook symlinks stay out of it.

Testing

• bin/build --arch aarch64 --package omarchy-mac-boot in the aarch64 builder image: the checksum matched and check() passed (168 ok, 0 not ok, including the reset, luks-slots and snapshot-check suites). The checksum also matches git archive 84352fdb | sha256sum; the same method reproduces -3's.
• .PKGINFO against published -3: only the version and depend = binutils differ; 20 backup entries in both; scriptlet byte-identical; vercmp orders -4 above -3.
• pacman -Qlp -3 → -4: 83 → 92 entries, nothing removed. Added /usr/bin/omarchy-mac-snapshot-check, /usr/lib/omarchy/mac-boot/{luks-slots,reset-prepare,reset-verify,reset-commit,reset-rollback} (all 755) and /etc/boot/hooks/{pre.d/04,post.d/99}-omarchy-mac-snapshot-check (symlinks to the check). Changed: omarchy-mac-encrypt.service (a backup file; the initramfs hook rebuilds on upgrade), factory-reset.sh, provision.sh, boot-source-revision.
• The payload is byte-identical to the pin's install staging apart from boot-source-revision.
• namcap on -3 and -4: no new warnings apart from the usual "may not be needed" line for binutils, which it prints for every shell-tool dependency.
• Edge's limine-snapper-sync 1.32.0-1 runs /etc/boot/hooks/<pre|post>.d/* through symlinks. Every dependency resolves on edge/aarch64 plus ALARM (asahi-scripts from asahi-alarm, as before).
• bin/build-matrix still plans only aarch64 -> edge. PR CI is green, including the aarch64 build.

Note: the snapshot pre hook needs omarchy-hw-platform or omarchy-hw-apple-silicon to tell it's on a Mac, and without one it refuses the restore. mx-mac Macs have omarchy-hw-apple-silicon (checked on the M1 Pro); edge's stock omarchy 4.0.2-1 has neither, a gap that already affects omarchy-mac-limine-active at -3.

Second review: no defects. It independently confirmed the checksum, pkgver and head, that #544 is absent, that the package matches the install staging, that nothing is removed, the dependency and backup handling and the publish-order claim. Two wording fixes (the backup= scope and the drive-password case) are applied.

[github-actions]

Publish succeeded → live

Packages: omarchy-mac-boot (aarch64, PR artifact)

• edge/aarch64: omarchy-mac-boot-20260925-4-aarch64

Commit ab053e8 · run