diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index d320f8c8..8a69e1ea 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -20,11 +20,6 @@ code. PKGBUILD and `hyprwm/aquamarine` v0.14.0 tarball (pinned in `guest/spec.json`) for factory builds. The finished guest holds aquamarine and Hyprtoolkit on `IgnorePkg` with Hyprland so updates cannot mix incompatible ABIs. -- **Hyprtoolkit** — BSD-3-Clause; the factory rebuilds the reviewed - `hyprwm/hyprtoolkit` v0.5.4 source using the Arch 0.5.4-6 recipe adapted for - aarch64 and package release 6.1, linked against aquamarine 0.14. Source, - recipe, packaging commit, and library hashes are pinned in `guest/spec.json`; - the package retains its upstream license. - **Glaze** — MIT; the pinned v7.2.0 headers are used by the Hyprland build, and their verified upstream license is retained in the rebuilt guest package. - **ANGLE, VirGLRenderer, libepoxy, SDL, libslirp, GLib, Pixman, and other QEMU diff --git a/docs/architecture.md b/docs/architecture.md index cff7429e..604ad8ef 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -203,11 +203,12 @@ creates the account on first boot. guarded rounded-border coverage patch for the VM graphics path, then held in the guest's immutable local repository. The factory rebuilds `aquamarine 0.15.1-1` from a reviewed Arch-derived PKGBUILD and upstream - tarball, then rebuilds Hyprtoolkit against its `libaquamarine.so=14` ABI, - matching Hyprland 0.56.2. Both packages are provided by the disposable - builder repository and held alongside Hyprland on guest `IgnorePkg`. - `hyprland-guiutils` is held with them so a rolling update cannot introduce - a dependency on a newer `libhyprtoolkit.so` ABI. + tarball, matching Hyprland 0.56.2's `libaquamarine.so=14` ABI. The + disposable builder repository provides it, and the guest holds it alongside + Hyprland on `IgnorePkg`. Hyprtoolkit 0.6.0 and `hyprland-guiutils` 0.2.2-4 + come from the locked mirror transaction, already built against that ABI, + and are held with them so a rolling update cannot introduce a dependency on + a newer `libhyprtoolkit.so` or `libaquamarine.so` ABI. Source and library hashes are verified, and build paths are remapped for repeatable output. The factory uses an official HTTPS ARM mirror and checks the complete transaction against its reviewed package lock before installing. diff --git a/guest/packages.lock.json b/guest/packages.lock.json index 67e3a2a3..572b8aa3 100644 --- a/guest/packages.lock.json +++ b/guest/packages.lock.json @@ -7,11 +7,11 @@ "adwaita-fonts": "51.0-2", "adwaita-icon-theme": "50.0-1", "adwaita-icon-theme-legacy": "46.2-3", - "alsa-card-profiles": "1:1.6.8-1", + "alsa-card-profiles": "1:1.6.9-1", "alsa-lib": "1.2.16.1-1", "alsa-topology-conf": "1.2.5.1-4", "alsa-ucm-conf": "1.2.16.1-1", - "aom": "3.15.0-1", + "aom": "3.15.1-1", "appstream": "1.2.0-1", "aquamarine": "0.15.1-1", "archlinux-keyring": "20260909-1", @@ -29,15 +29,15 @@ "bluez-libs": "5.87-2", "brotli": "1.2.0-1", "btop": "1.4.7-1", - "bubblewrap": "0.12.0-1", + "bubblewrap": "0.13.0-1", "bzip2": "1.0.8-6", "ca-certificates": "20240618-1", - "ca-certificates-mozilla": "3.129-1", + "ca-certificates-mozilla": "3.130-1", "ca-certificates-utils": "20240618-1", - "cairo": "1.18.4-1", + "cairo": "1.18.6-1", "cfitsio": "1:4.7.0-1", "chromium": "153.0.8010.36-1", - "coreutils": "9.11-2", + "coreutils": "9.12-2", "cpptrace": "1.0.4-2", "cryptsetup": "2.8.8-1", "curl": "8.22.0-1", @@ -61,17 +61,17 @@ "enchant": "2.8.21-1", "exempi": "2.6.6-3", "exiv2": "0.28.9-1", - "expat": "2.8.4-1", + "expat": "2.8.5-1", "eza": "0.23.5-2", "fakeroot": "1:1.37.2-3", - "fastfetch": "2.68.1-1", + "fastfetch": "2.69.0-1", "fcft": "3.3.3-1", - "fcitx5": "5.1.22-1", + "fcitx5": "5.1.23-1", "fcitx5-chewing": "5.1.13-1", "fcitx5-gtk": "5.1.7-1", - "fcitx5-qt": "5.1.15-1", + "fcitx5-qt": "5.1.16-1", "fd": "10.5.0-3", - "ffmpeg": "2:9.0.1-4", + "ffmpeg": "2:9.0.2-1", "fftw": "3.3.11-1", "file": "5.48-1", "filesystem": "2025.10.12-1", @@ -81,7 +81,7 @@ "foot": "1.28.0-2", "freeglut": "3.8.0-1", "freetype2": "2.14.3-1", - "fribidi": "1.0.16-2", + "fribidi": "1.0.17-1", "fuse-common": "3.18.3-1", "fuse3": "3.18.3-1", "fzf": "0.74.4-1", @@ -127,20 +127,20 @@ "gsettings-system-schemas": "50.1-1", "gsm": "1.0.24-1", "gssdp": "1.6.6-1", - "gst-plugins-bad-libs": "1.28.7-1", - "gst-plugins-base-libs": "1.28.7-1", - "gstreamer": "1.28.7-1", + "gst-plugins-bad-libs": "1.28.7-2", + "gst-plugins-base-libs": "1.28.7-2", + "gstreamer": "1.28.7-2", "gtest": "1.18.0-1", "gtk-update-icon-cache": "1:4.22.5-1", "gtk3": "1:3.24.52-1", "gtk4": "1:4.22.5-1", "guile": "3.0.11-1", - "gum": "2.0.1-1", + "gum": "2.0.2-1", "gupnp": "1:1.6.10-1", "gupnp-dlna": "0.12.0-5", "gupnp-igd": "1.6.0-2", "gvfs": "1.60.3-3", - "gzip": "1.14-2", + "gzip": "1.15-1", "harfbuzz": "14.5.0-1", "hdf5": "2.2.0-1", "hicolor-icon-theme": "0.18-1", @@ -151,21 +151,21 @@ "hyprcursor": "0.1.13-7", "hyprgraphics": "0.5.1-4", "hyprland": "0.56.2-3", - "hyprland-guiutils": "0.2.2-3", + "hyprland-guiutils": "0.2.2-4", "hyprlang": "0.6.8-5", "hyprpicker": "0.4.7-4", "hyprsunset": "0.4.0-3", - "hyprtoolkit": "0.5.4-6.2", + "hyprtoolkit": "0.6.0-1", "hyprutils": "0.14.2-1", "hyprwayland-scanner": "0.4.6-1", "hyprwire": "0.3.1-3", "iana-etc": "20260617-1", "icu": "78.3-1", - "imagemagick": "7.1.2.31-1", + "imagemagick": "7.1.2.32-1", "imath": "3.2.3-1", "imv": "5.0.1-2", "iniparser": "4.3.0-1", - "inotify-tools": "4.25.9.0-1", + "inotify-tools": "4.26.262-1", "iproute2": "7.2.0-1", "iptables": "1:1.8.13-1", "iputils": "20250605-1", @@ -233,7 +233,7 @@ "libdrm": "2.4.134-1", "libdvdnav": "7.0.0-1", "libdvdread": "7.1.1-1", - "libdwarf": "1:2.3.2-1", + "libdwarf": "1:2.3.3-1", "libebur128": "1.2.6-2", "libedit": "20260512_3.1-1", "libei": "1.6.0-1", @@ -258,7 +258,7 @@ "libgsf": "1.14.58-1", "libgudev": "238-3", "libgxps": "0.3.2-5", - "libheif": "1.23.4-1", + "libheif": "1.23.5-1", "libice": "1.1.2-1", "libidn2": "2.3.8-1", "libiec61883": "1.2.0-9", @@ -313,7 +313,7 @@ "libpciaccess": "0.19-1", "libpgm": "5.3.128-4", "libpipeline": "1.5.8-1", - "libpipewire": "1:1.6.8-1", + "libpipewire": "1:1.6.9-1", "libplacebo": "7.360.1-6", "libplist": "2.7.0-3", "libpng": "1.6.58-2", @@ -364,13 +364,13 @@ "libva": "2.24.1-1", "libvdpau": "1.5-4", "libverto": "0.3.2-6", - "libvips": "8.18.6-1", + "libvips": "8.18.7-1", "libvorbis": "1.3.7-4", "libvpx": "1.17.0-1", "libvterm": "0.3.3-2", "libwacom": "2.20.0-1", "libwebp": "1.6.0-2", - "libwireplumber": "0.5.17-1", + "libwireplumber": "0.5.17-2", "libx11": "1.8.13-1", "libxau": "1.0.12-1", "libxcb": "1.17.0-1", @@ -406,8 +406,8 @@ "libzip": "1.11.4-1", "licenses": "20240728-1", "lilv": "0.28.0-1", - "linux-aarch64": "7.2.6-1", - "linux-aarch64-headers": "7.2.6-1", + "linux-aarch64": "7.2.8-1", + "linux-aarch64-headers": "7.2.8-1", "linux-api-headers": "7.2-1", "llhttp": "9.3.1-1", "llvm-libs": "22.1.8-2", @@ -427,7 +427,7 @@ "mdadm": "4.6-2", "mesa": "1:26.2.3-1", "minizip": "1:1.3.2-3", - "mkinitcpio": "42-1", + "mkinitcpio": "42.1-1", "mkinitcpio-busybox": "1.36.1-1", "mobile-broadband-provider-info": "20251101-1", "mpdecimal": "4.0.1-3", @@ -450,7 +450,7 @@ "noto-fonts-emoji": "1:2.051-1", "npth": "1.8-1", "nspr": "4.40-1", - "nss": "3.129-1", + "nss": "3.130-1", "numactl": "2.0.19-1", "ocl-icd": "2.3.5-1", "omarchy-keyring": "20251027-1", @@ -458,10 +458,10 @@ "oniguruma": "6.9.10-1", "openal": "1.25.2-2", "opencore-amr": "0.1.6-2", - "openexr": "3.4.15-1", + "openexr": "3.5.1-1", "openh264": "2.6.0-2", "openjpeg2": "2.5.4-1", - "openjph": "0.31.0-1", + "openjph": "0.32.0-1", "openssh": "10.5p1-1", "openssl": "3.6.4-1", "opus": "1.6.1-1", @@ -474,21 +474,21 @@ "pam": "1.7.2-2", "pambase": "20260616-1", "pango": "1:1.58.2-1", - "parted": "3.7-1", + "parted": "3.8-1", "patch": "2.8-1", "pciutils": "3.15.0-1", "pcre": "8.45-5", "pcre2": "10.48-1", - "pcsclite": "2.5.1-1", + "pcsclite": "2.5.2-1", "perl": "5.42.2-2", "perl-error": "0.17030-3", "perl-mailtools": "2.22-3", "perl-timedate": "2.35-1", "pinentry": "1.3.3-1", - "pipewire": "1:1.6.8-1", - "pipewire-alsa": "1:1.6.8-1", - "pipewire-audio": "1:1.6.8-1", - "pipewire-pulse": "1:1.6.8-1", + "pipewire": "1:1.6.9-1", + "pipewire-alsa": "1:1.6.9-1", + "pipewire-audio": "1:1.6.9-1", + "pipewire-pulse": "1:1.6.9-1", "pixman": "0.46.4-1.1", "polkit": "127-3", "poppler": "26.08.0-1", @@ -499,7 +499,7 @@ "psmisc": "23.7-2", "pugixml": "1.16-1", "python": "3.14.7-1", - "python-dbus": "1.4.0-2", + "python-dbus": "1.5.0-1", "python-docopt": "0.6.2-15", "python-gobject": "3.56.3-1", "python-pyxdg": "0.28-7", @@ -544,10 +544,10 @@ "srt": "1.5.7-1", "starship": "1.26.0-1", "sudo": "1.9.17.p2-6", - "systemd": "261.3-1", - "systemd-libs": "261.3-1", - "systemd-resolvconf": "261.3-1", - "systemd-sysvcompat": "261.3-1", + "systemd": "262-1", + "systemd-libs": "262-1", + "systemd-resolvconf": "262-1", + "systemd-sysvcompat": "262-1", "tar": "1.35-5", "tinysparql": "3.11.1-1", "tmux": "3.7_c-1", @@ -571,8 +571,8 @@ "unibilium": "2.1.4-1", "unzip": "6.0-23", "upower": "1.91.4-1", - "util-linux": "2.42.3-1", - "util-linux-libs": "2.42.3-1", + "util-linux": "2.42.4-1", + "util-linux-libs": "2.42.4-1", "uwsm": "0.27.0-1", "v4l-utils": "1.32.0-2", "v4l2loopback-dkms": "0.15.4-2", @@ -586,7 +586,7 @@ "wayland": "1.26.0-1", "wayland-protocols": "1.49-1", "webrtc-audio-processing-1": "1.3-5", - "wireplumber": "0.5.17-1", + "wireplumber": "0.5.17-2", "wl-clipboard": "1:2.3.0-1", "woff2-font-awesome": "7.3.1-1", "wpa_supplicant": "2:2.12-1", diff --git a/guest/pinned-packages/README.md b/guest/pinned-packages/README.md index 5ed3b870..19da340b 100644 --- a/guest/pinned-packages/README.md +++ b/guest/pinned-packages/README.md @@ -17,14 +17,15 @@ The rounded-border backport still applies unchanged to the newer Hyprland. - `aquamarine/PKGBUILD` adapts the reviewed Arch `0.14.0-2` recipe for aquamarine `0.15.1-1` on aarch64, with the new upstream archive checksum. -- `hyprtoolkit/PKGBUILD` adapts Arch `0.5.4-6` packaging for aarch64 and uses - package release `6.2` to distinguish the local rebuild. - -Packaging commits, recipe digests, upstream tarball digests, and reproduced -library digests are pinned in `guest/spec.json`. The factory builds aquamarine -first, installs that verified result in the disposable builder, then builds -Hyprtoolkit against `libaquamarine.so=14`. Random build paths are remapped out -of compiler output. Both package metadata and library digests are checked + +Hyprtoolkit 0.6.0 and `hyprland-guiutils` 0.2.2-4 come from the locked mirror +transaction: Arch Linux ARM builds them against `libaquamarine.so=14`, so they +no longer need a local rebuild. (The earlier Hyprtoolkit 0.5.4 rebuild stopped +resolving once the mirror dropped the matching `hyprland-guiutils` 0.2.2-3.) + +The packaging commit, recipe digest, upstream tarball digest, and reproduced +library digest are pinned in `guest/spec.json`. Random build paths are remapped +out of compiler output. Package metadata and the library digest are checked before publishing the temporary `[try-omarchy-abi-pins]` repository. The finished guest never receives that builder repository. It holds aquamarine diff --git a/guest/pinned-packages/hyprtoolkit/PKGBUILD b/guest/pinned-packages/hyprtoolkit/PKGBUILD deleted file mode 100644 index 33323655..00000000 --- a/guest/pinned-packages/hyprtoolkit/PKGBUILD +++ /dev/null @@ -1,50 +0,0 @@ -# Maintainer: Caleb Maclennan - -pkgname=hyprtoolkit -pkgver=0.5.4 -pkgrel=6.2 -pkgdesc='A modern C++ Wayland-native GUI toolkit' -arch=(x86_64 aarch64) -url="https://github.com/hyprwm/$pkgname" -license=(BSD-3-Clause) -depends=( - libgcc - libstdc++ - aquamarine libaquamarine.so - cairo libcairo.so - glib2 libglib-2.0.so - glibc # libc.so libm.so - hyprgraphics libhyprgraphics.so - hyprlang libhyprlang.so - hyprutils libhyprutils.so - iniparser libiniparser.so - libdrm # libdrm.so - libglvnd libEGL.so libOpenGL.so - libxkbcommon libxkbcommon.so - mesa # libgbm.so - pango libpango-1.0.so # libpango.so - pixman libpixman-1.so - wayland libwayland-client.so -) -makedepends=(cmake - hyprwayland-scanner) -provides=(libhyprtoolkit.so) -_archive="$pkgname-$pkgver" -source=("$url/archive/v$pkgver/$_archive.tar.gz") -sha256sums=('2fb59789f231c1c4e9154ceffc1e7524c0cae154807c0d57e6166806255b570f') - -build() { - cd "$_archive" - local cmake_options=( - -D CMAKE_BUILD_TYPE=None - -D CMAKE_INSTALL_PREFIX=/usr - ) - cmake -B build -W no-dev ${cmake_options[@]} - cmake --build build -} - -package() { - cd "$_archive" - DESTDIR="$pkgdir" cmake --install build - install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname/" LICENSE -} diff --git a/guest/scripts/build-pinned-abi-packages.sh b/guest/scripts/build-pinned-abi-packages.sh index 6820be3e..9dbceebd 100755 --- a/guest/scripts/build-pinned-abi-packages.sh +++ b/guest/scripts/build-pinned-abi-packages.sh @@ -1,6 +1,6 @@ #!/bin/bash -# Rebuild the compatible aquamarine/Hyprtoolkit pair from verified source. +# Rebuild the reviewed aquamarine ABI pin from verified source. # Packages are exposed only through the disposable factory repository. set -euo pipefail @@ -89,17 +89,13 @@ trap cleanup EXIT install -d -m 0755 "$output_repo" [[ -z $(ls -A "$output_repo") ]] || fail "output repository must be empty" -# Install build dependencies before either ABI pin. Hyprtoolkit then builds -# against our verified aquamarine, never the incompatible mirror package. pacman -S --needed --noconfirm \ base-devel cmake hyprutils hyprwayland-scanner libdisplay-info libdrm libglvnd \ - libinput mesa pixman seatd systemd-libs wayland wayland-protocols \ - cairo glib2 hyprgraphics hyprlang iniparser libxkbcommon pango >/dev/null + libinput mesa pixman seatd systemd-libs wayland wayland-protocols >/dev/null -for name in aquamarine hyprtoolkit; do +for name in aquamarine; do case "$name" in aquamarine) expected_version=0.15.1; expected_pkgrel=1 ;; - hyprtoolkit) expected_version=0.5.4; expected_pkgrel=6.2 ;; esac mapfile -t metadata < <(python3 - "$spec" "$guest_dir" "$name" <<'PY' import json @@ -109,8 +105,8 @@ import sys spec = json.loads(pathlib.Path(sys.argv[1]).read_text()) guest = pathlib.Path(sys.argv[2]).resolve(strict=True) pins = spec.get("inputs", {}).get("abiPackagePins") -if pins != [{"name": "aquamarine", "version": "0.15.1-1"}, {"name": "hyprtoolkit", "version": "0.5.4-6.2"}]: - raise SystemExit("abiPackagePins must contain the reviewed compatible pair") +if pins != [{"name": "aquamarine", "version": "0.15.1-1"}]: + raise SystemExit("abiPackagePins must contain the reviewed aquamarine pin") component = spec["supplyChain"][sys.argv[3]] required = ( "version", diff --git a/guest/scripts/write-builder-pacman-conf.py b/guest/scripts/write-builder-pacman-conf.py index 8b5a84d1..95df156f 100755 --- a/guest/scripts/write-builder-pacman-conf.py +++ b/guest/scripts/write-builder-pacman-conf.py @@ -5,6 +5,8 @@ guest file. The builder config must: - expose ABI pins rebuilt from reviewed upstream source + Arch PKGBUILD - omit those pin names from IgnorePkg so pacstrap can install them once + - omit holds that only arrive as dependencies (DEPENDENCY_HOLDS): pacman + will not pull an ignored package in to satisfy another package - keep optional signed packageCachePins ahead of rolling mirrors - use the selected ARM mirror without changing the installed guest mirrors @@ -23,6 +25,10 @@ SECTION_RE = re.compile(r"^\[([A-Za-z0-9@._+-]+)\]$") +# Guest holds that the factory installs only as dependencies (Hyprland needs +# hyprland-guiutils, which needs Hyprtoolkit). The finished guest keeps them held. +DEPENDENCY_HOLDS = {"hyprland-guiutils", "hyprtoolkit"} + def fail(message: str) -> None: raise SystemExit(f"write-builder-pacman-conf: {message}") @@ -49,7 +55,7 @@ def load_abi_pins(spec: dict, lock_packages: dict[str, str]) -> list[dict]: fail(f"invalid abi package name: {name}") if not re.fullmatch(r"[A-Za-z0-9_.+:~-]+", version or ""): fail(f"invalid abi package version: {version}") - if name not in {"aquamarine", "hyprtoolkit"}: + if name not in {"aquamarine"}: fail(f"unsupported abi pin: {name}") component = supply.get(name) if not isinstance(component, dict): @@ -215,7 +221,7 @@ def main() -> None: disable_sandbox=args.disable_sandbox, abi_repo=abi_repo if pins else None, pinned_cache_repo=args.pinned_cache_repo, - drop_ignore={pin["name"] for pin in pins}, + drop_ignore={pin["name"] for pin in pins} | DEPENDENCY_HOLDS, repository_mirrors=repository_mirrors, ) diff --git a/guest/spec.json b/guest/spec.json index b0efbf0c..eebe29e7 100644 --- a/guest/spec.json +++ b/guest/spec.json @@ -52,7 +52,7 @@ "glazeUrl": "https://github.com/stephenberry/glaze/archive/refs/tags/v7.2.0.tar.gz", "glazeSha256": "17dba19ae63ae48f94994f00d49d5cb3c8f1306db1046c534c4828662490b7d4", "glazeLicenseSha256": "5d49e66411a0807a7c8d6b911b9a26b59e940c71aebe561a3ad8b0b80ac4b7b6", - "binarySha256": "34499692a552c4f36bce98b0efda02ebca00d2297c830b109b24ad6a64669645", + "binarySha256": "32bd58fd20883240eb7f1d85da0e7f64b1582c8ea3c18c947d98bc219964019d", "license": "BSD-3-Clause", "issue": "https://github.com/omacom/try-omarchy/issues/5", "buildPackages": { @@ -63,9 +63,9 @@ "gcc-libs": "16.1.1+r12+g301eb08fa2c5-1", "glibc": "2.43+r22+g8362e8ce10b2-2", "hyprland": "0.56.2-3", - "hyprland-protocols": "0.7.0-1", + "hyprland-protocols": "0.7.1-1", "make": "4.4.1-3", - "meson": "1.12.0-1", + "meson": "1.12.1-1", "ninja": "1.13.2-3", "pkgconf": "3.0.7-1", "xorgproto": "2025.1-1" @@ -192,19 +192,6 @@ } } }, - "hyprtoolkit": { - "version": "0.5.4", - "pkgrel": "6.2", - "repository": "https://github.com/hyprwm/hyprtoolkit", - "url": "https://github.com/hyprwm/hyprtoolkit/archive/v0.5.4/hyprtoolkit-0.5.4.tar.gz", - "sha256": "2fb59789f231c1c4e9154ceffc1e7524c0cae154807c0d57e6166806255b570f", - "pkgbuild": "pinned-packages/hyprtoolkit/PKGBUILD", - "pkgbuildSha256": "28c3dabce8c9553cfe283d23f568551d48efa7d51d14658cc8522d5473dd73a6", - "packagingRepository": "https://gitlab.archlinux.org/archlinux/packaging/packages/hyprtoolkit.git", - "packagingCommit": "1ed230388a2ccb2c857af980235cf25a4f86e39e", - "license": "BSD-3-Clause", - "binarySha256": "d901177e32b02d6769f5bcf118e43b22061a5a21a3aa77ee72469d4a2db85895" - }, "ghostty": { "version": "1.3.1", "pkgrel": "1", @@ -241,10 +228,6 @@ { "name": "aquamarine", "version": "0.15.1-1" - }, - { - "name": "hyprtoolkit", - "version": "0.5.4-6.2" } ] }, diff --git a/guest/tests/test_builder_pacman_conf.py b/guest/tests/test_builder_pacman_conf.py index 8e963f08..36158193 100644 --- a/guest/tests/test_builder_pacman_conf.py +++ b/guest/tests/test_builder_pacman_conf.py @@ -20,7 +20,7 @@ def setUp(self): self.spec = json.loads((GUEST / "spec.json").read_text()) self.lock = json.loads((GUEST / "packages.lock.json").read_text())["packages"] - def test_builder_exposes_pair_without_changing_guest_holds(self): + def test_builder_exposes_pin_without_changing_guest_holds(self): guest_config = GUEST / "pacman.aarch64.conf" original = guest_config.read_text() pins = builder.load_abi_pins(self.spec, self.lock) @@ -33,24 +33,29 @@ def test_builder_exposes_pair_without_changing_guest_holds(self): disable_sandbox=True, abi_repo=Path(directory) / "abi-repo", pinned_cache_repo=None, - drop_ignore={pin["name"] for pin in pins}, + drop_ignore={pin["name"] for pin in pins} | builder.DEPENDENCY_HOLDS, ) config = output.read_text() self.assertEqual(guest_config.read_text(), original) self.assertIn("hyprland aquamarine hyprtoolkit hyprland-guiutils\n", original) - self.assertIn("IgnorePkg = linux-aarch64 linux-aarch64-headers hyprland hyprland-guiutils\n", config) + # pacman will not install an ignored package to satisfy a dependency. + self.assertIn("IgnorePkg = linux-aarch64 linux-aarch64-headers hyprland\n", config) self.assertLess(config.index("[try-omarchy-abi-pins]"), config.index("[extra]")) self.assertIn("DisableSandbox\n", config) - def test_missing_toolkit_archive_is_rejected(self): + def test_missing_aquamarine_archive_is_rejected(self): pins = builder.load_abi_pins(self.spec, self.lock) with tempfile.TemporaryDirectory() as directory: repo = Path(directory) - (repo / "aquamarine-0.15.1-1-aarch64.pkg.tar.zst").touch() (repo / "try-omarchy-abi-pins.db.tar.gz").touch() - with self.assertRaisesRegex(SystemExit, "hyprtoolkit"): + with self.assertRaisesRegex(SystemExit, "aquamarine"): builder.ensure_abi_repo(pins, repo) + def test_toolkit_is_not_an_abi_pin(self): + self.spec["inputs"]["abiPackagePins"].append({"name": "hyprtoolkit", "version": "0.6.0-1"}) + with self.assertRaisesRegex(SystemExit, "unsupported abi pin: hyprtoolkit"): + builder.load_abi_pins(self.spec, self.lock) + def test_mirror_only_replaces_arm_mirrors_in_builder(self): guest_config = GUEST / "pacman.aarch64.conf" original = guest_config.read_text() @@ -105,8 +110,8 @@ def test_mirror_rejects_insecure_urls_and_configuration_injection(self): builder.main() self.assertFalse(output.exists()) - def test_mirror_toolkit_version_cannot_replace_the_reviewed_pin(self): - self.lock["hyprtoolkit"] = "0.5.4-6" + def test_mirror_aquamarine_version_cannot_replace_the_reviewed_pin(self): + self.lock["aquamarine"] = "0.15.0-1" with self.assertRaisesRegex(SystemExit, "does not match lock"): builder.load_abi_pins(self.spec, self.lock) diff --git a/guest/tests/verify.py b/guest/tests/verify.py index 42a258d0..cf72a38d 100755 --- a/guest/tests/verify.py +++ b/guest/tests/verify.py @@ -149,7 +149,7 @@ def main() -> None: ) abi_pins = spec["inputs"]["abiPackagePins"] check( - abi_pins == [{"name": "aquamarine", "version": "0.15.1-1"}, {"name": "hyprtoolkit", "version": "0.5.4-6.2"}], + abi_pins == [{"name": "aquamarine", "version": "0.15.1-1"}], "factory abi pins keep aquamarine on libaquamarine.so=14 for the locked Hyprland", ) aquamarine = spec.get("supplyChain", {}).get("aquamarine", {}) @@ -177,25 +177,10 @@ def main() -> None: and "pkgrel=1" in pkgbuild_text, "factory rebuilds aquamarine 0.15.1 from the reviewed Arch PKGBUILD and upstream tarball", ) - hyprtoolkit = spec.get("supplyChain", {}).get("hyprtoolkit", {}) - toolkit_recipe = GUEST / hyprtoolkit.get("pkgbuild", "") - check( - hyprtoolkit == { - "version": "0.5.4", - "pkgrel": "6.2", - "repository": "https://github.com/hyprwm/hyprtoolkit", - "url": "https://github.com/hyprwm/hyprtoolkit/archive/v0.5.4/hyprtoolkit-0.5.4.tar.gz", - "sha256": "2fb59789f231c1c4e9154ceffc1e7524c0cae154807c0d57e6166806255b570f", - "pkgbuild": "pinned-packages/hyprtoolkit/PKGBUILD", - "pkgbuildSha256": "28c3dabce8c9553cfe283d23f568551d48efa7d51d14658cc8522d5473dd73a6", - "packagingRepository": "https://gitlab.archlinux.org/archlinux/packaging/packages/hyprtoolkit.git", - "packagingCommit": "1ed230388a2ccb2c857af980235cf25a4f86e39e", - "license": "BSD-3-Clause", - "binarySha256": "d901177e32b02d6769f5bcf118e43b22061a5a21a3aa77ee72469d4a2db85895" -} - and toolkit_recipe.is_file() - and hashlib.sha256(toolkit_recipe.read_bytes()).hexdigest() == hyprtoolkit["pkgbuildSha256"], - "factory rebuilds Hyprtoolkit against the compatible aquamarine ABI", + check( + "hyprtoolkit" not in spec.get("supplyChain", {}) + and not (GUEST / "pinned-packages/hyprtoolkit").exists(), + "factory takes Hyprtoolkit from the locked mirror transaction", ) builder_conf_writer = read(GUEST / "scripts/write-builder-pacman-conf.py") build_aquamarine = read(GUEST / "scripts/build-pinned-abi-packages.sh") @@ -634,7 +619,7 @@ def main() -> None: "glazeUrl": "https://github.com/stephenberry/glaze/archive/refs/tags/v7.2.0.tar.gz", "glazeSha256": "17dba19ae63ae48f94994f00d49d5cb3c8f1306db1046c534c4828662490b7d4", "glazeLicenseSha256": "5d49e66411a0807a7c8d6b911b9a26b59e940c71aebe561a3ad8b0b80ac4b7b6", - "binarySha256": "34499692a552c4f36bce98b0efda02ebca00d2297c830b109b24ad6a64669645", + "binarySha256": "32bd58fd20883240eb7f1d85da0e7f64b1582c8ea3c18c947d98bc219964019d", "license": "BSD-3-Clause", "issue": "https://github.com/omacom/try-omarchy/issues/5", "buildPackages": { @@ -645,9 +630,9 @@ def main() -> None: "gcc-libs": "16.1.1+r12+g301eb08fa2c5-1", "glibc": "2.43+r22+g8362e8ce10b2-2", "hyprland": "0.56.2-3", - "hyprland-protocols": "0.7.0-1", + "hyprland-protocols": "0.7.1-1", "make": "4.4.1-3", - "meson": "1.12.0-1", + "meson": "1.12.1-1", "ninja": "1.13.2-3", "pkgconf": "3.0.7-1", "xorgproto": "2025.1-1", diff --git a/macos/run-qemu-gpu.sh b/macos/run-qemu-gpu.sh index 47ac536f..a54ca1f5 100755 --- a/macos/run-qemu-gpu.sh +++ b/macos/run-qemu-gpu.sh @@ -565,7 +565,6 @@ if ( supply_chain_keys = { "ghostty", "aquamarine", - "hyprtoolkit", "archLinuxArmPackagesCommit", "archLinuxArmPackagesRepository", "hyprland", @@ -633,7 +632,7 @@ exact_keys( hyprland_identity = hashlib.sha256( json.dumps(hyprland, ensure_ascii=True, sort_keys=True, separators=(",", ":")).encode("utf-8") ).hexdigest() -if hyprland_identity != "f41042613023280c808d5bf6258f2f71c1b20d0755f894b53e77defe97db42a7": +if hyprland_identity != "f19c72c09c010b2ef5ae3ea3d79155d56ff9c78822e6d26f74db6a2d1feaf5eb": fail("factory Hyprland component is not the reviewed rounded-border build") aquamarine = exact_keys( supply_chain.get("aquamarine"), @@ -666,25 +665,6 @@ if aquamarine != { "binarySha256": "1fb6a90079a1f5620f9441d3e8a92426d21c6bbbab2f1ac070651425dae4129d", }: fail("factory aquamarine component is not the reviewed libaquamarine.so=14 rebuild") -hyprtoolkit = exact_keys( - supply_chain.get("hyprtoolkit"), - set(aquamarine), - "build spec hyprtoolkit component", -) -if hyprtoolkit != { - "version": "0.5.4", - "pkgrel": "6.2", - "repository": "https://github.com/hyprwm/hyprtoolkit", - "url": "https://github.com/hyprwm/hyprtoolkit/archive/v0.5.4/hyprtoolkit-0.5.4.tar.gz", - "sha256": "2fb59789f231c1c4e9154ceffc1e7524c0cae154807c0d57e6166806255b570f", - "pkgbuild": "pinned-packages/hyprtoolkit/PKGBUILD", - "pkgbuildSha256": "28c3dabce8c9553cfe283d23f568551d48efa7d51d14658cc8522d5473dd73a6", - "packagingRepository": "https://gitlab.archlinux.org/archlinux/packaging/packages/hyprtoolkit.git", - "packagingCommit": "1ed230388a2ccb2c857af980235cf25a4f86e39e", - "license": "BSD-3-Clause", - "binarySha256": "d901177e32b02d6769f5bcf118e43b22061a5a21a3aa77ee72469d4a2db85895" -}: - fail("factory hyprtoolkit component is not the reviewed libaquamarine.so=14 rebuild") mise = exact_keys( supply_chain.get("mise"), {"binarySha256", "license", "reportedVersion", "sha256", "url", "version"},