Let a machine say what it is for, and give Firefox its face back
Phase 4: the optional application categories, and the Firefox chrome. Everything Panama installed until now was what every machine gets, which meant a work laptop acquired emulators and a desktop that wanted Steam had to be told about it by hand. The interview now offers the categories in setup/packages/extras/ as a checklist -- gaming, creative, communication, virtualization -- and nothing is preselected, because a default here installs applications nobody chose on a machine whose owner answered a question they thought was about something else. A category is one file, and a category mixes both package managers because the applications do: Steam is in RPM Fusion, Slack publishes only a flatpak. So a bare line is a dnf package and a flatpak: line is a Flathub ID, and one file holds the whole answer rather than splitting each category across two. The menu is read from the directory rather than written down, so adding a category is adding a file. Every name in all four was resolved against the actual repositories before being written down, and the contract re-resolves them -- the point of admitting applications one at a time is that they stay installable, and a typo here fails on somebody else's machine, not this one. Firefox is declared, and its chrome is Edge-Frfox, vendored into config/firefox. sunhat carried that theme with no license and no attribution; it is MIT, and now it says so and says whose it is. It is the only piece of Panama's configuration that does not go to a path this repository chooses. Firefox owns the profile directory, names it with a random salt, and does not create one until the browser has been run -- so link-dotfiles finds or creates a profile and links both halves into it. Both, or neither works: chrome/ is the CSS and user.js sets the preference that makes Firefox read chrome/ at all, without which the theme is a directory of dead files. Two assumptions there were wrong, and the contract exists for both. Firefox has moved to the XDG directories -- the profile root is ~/.config/mozilla/firefox on this build, not ~/.mozilla/firefox, and writing to the wrong one themes nothing and says nothing about it. And -CreateProfile turns out to be non-interactive, so a fresh machine gets the theme on the first install rather than the second. The contract runs link-dotfiles for real against a throwaway home with no profile in it and looks at what came out; it was checked by pointing the search at the legacy path only and watching it fail. Also: the enrolment/enrollment spellings from the last commit are corrected. This repository is US-spelled everywhere else -- color 1131 times against colour never -- and consistency in prose is worth as much as it is in code. Claude-Session: https://claude.ai/code/session_01NvgBuSWB5sE43yWmg21ozj
This commit is contained in:
Gabriel Brown
Executable
+165
@@ -0,0 +1,165 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# The optional application categories: what the interview offers, and what
|
||||
# choosing one actually installs.
|
||||
#
|
||||
# The rules:
|
||||
#
|
||||
# 1. Every category the interview offers installs something. The menu is read
|
||||
# from the directory rather than written down, so an empty or missing file
|
||||
# is a checkbox that does nothing -- the same defect this repository has
|
||||
# refused to ship twice now.
|
||||
# 2. A `flatpak:` line reaches flatpak with the prefix removed, and never
|
||||
# reaches dnf. Getting this backwards installs nothing and says it did.
|
||||
# 3. Nothing is installed without being asked for. An extras loop that ran on
|
||||
# its own defaults would put Steam on a work laptop.
|
||||
# 4. Every name is a real package. The whole point of admitting applications
|
||||
# one at a time from dnf or Flathub is that they stay installable; a typo
|
||||
# here is a category that fails on somebody else's machine, not this one.
|
||||
# Checked against the actual repositories, and skipped when offline.
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
||||
installer="$repo_dir/setup/scripts/install-packages"
|
||||
interview="$repo_dir/setup/scripts/interview"
|
||||
extras_dir="$repo_dir/setup/packages/extras"
|
||||
|
||||
findings=()
|
||||
note() { findings+=("$1"); }
|
||||
|
||||
[[ -d "$extras_dir" ]] || { printf 'extras contract: no %s\n' "$extras_dir" >&2; exit 1; }
|
||||
|
||||
# ── 1. Every category is a real offer ────────────────────────────────────────
|
||||
|
||||
shopt -s nullglob
|
||||
categories=("$extras_dir"/*)
|
||||
(( ${#categories[@]} > 0 )) || note 'the extras directory is empty, so the checklist offers nothing'
|
||||
|
||||
for category in "${categories[@]}"; do
|
||||
name="$(basename "$category")"
|
||||
[[ -f "$category" ]] || { note "$name is not a file"; continue; }
|
||||
entries="$(sed 's/#.*//' "$category" | tr -d ' \t' | grep -cv '^$')"
|
||||
(( entries > 0 )) || note "the $name category installs nothing, so choosing it does nothing"
|
||||
done
|
||||
|
||||
# The menu has to come from the directory. A hardcoded list is one that goes
|
||||
# stale the first time a category is added.
|
||||
grep -q 'extras_dir' "$interview" \
|
||||
|| note 'the interview does not read the categories from the extras directory'
|
||||
grep -q 'gum choose --no-limit' "$interview" \
|
||||
|| note 'the interview does not offer the categories as a multiple-choice checklist'
|
||||
|
||||
# ── 2 & 3. What a chosen category actually installs ──────────────────────────
|
||||
|
||||
work="$(mktemp -d)"
|
||||
trap 'rm -rf "$work"' EXIT
|
||||
|
||||
filter="$(sed -n '/^packages_in()/,/^}/p' "$installer")"
|
||||
loop="$(sed -n '/^install_extra_category()/,/^}/p' "$installer")"
|
||||
[[ -n "$filter" && -n "$loop" ]] || {
|
||||
printf 'extras contract: install-packages no longer defines packages_in and install_extra_category\n' >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
stub_dir="$work/bin"
|
||||
mkdir -p "$stub_dir"
|
||||
calls="$work/calls"
|
||||
for command in dnf flatpak; do
|
||||
cat >"$stub_dir/$command" <<STUB
|
||||
#!/usr/bin/env bash
|
||||
printf '%s %s\n' "$command" "\$*" >>"$calls"
|
||||
STUB
|
||||
chmod +x "$stub_dir/$command"
|
||||
done
|
||||
cat >"$stub_dir/sudo" <<'STUB'
|
||||
#!/usr/bin/env bash
|
||||
exec "$@"
|
||||
STUB
|
||||
chmod +x "$stub_dir/sudo"
|
||||
|
||||
fixture="$work/mixed"
|
||||
cat >"$fixture" <<'LIST'
|
||||
# Both managers in one category, which is the case this format exists for.
|
||||
from-dnf
|
||||
flatpak:org.example.FromFlathub
|
||||
LIST
|
||||
|
||||
(
|
||||
PATH="$stub_dir:$PATH"
|
||||
log() { :; }
|
||||
eval "$filter"
|
||||
eval "$loop"
|
||||
install_extra_category "$fixture"
|
||||
)
|
||||
|
||||
recorded="$(cat "$calls" 2>/dev/null)"
|
||||
|
||||
grep -q 'dnf install -y from-dnf' <<<"$recorded" \
|
||||
|| note 'a bare line in a category is not installed with dnf'
|
||||
grep -q 'flatpak install -y flathub org.example.FromFlathub' <<<"$recorded" \
|
||||
|| note 'a flatpak: line does not reach flatpak with the prefix removed'
|
||||
if grep 'dnf install' <<<"$recorded" | grep -q 'flatpak:'; then
|
||||
note 'a flatpak: line is passed to dnf, which cannot install it'
|
||||
fi
|
||||
if grep 'flatpak install' <<<"$recorded" | grep -q 'from-dnf'; then
|
||||
note 'a dnf package is passed to flatpak'
|
||||
fi
|
||||
|
||||
# Choosing nothing installs nothing.
|
||||
: >"$calls"
|
||||
(
|
||||
PATH="$stub_dir:$PATH"
|
||||
PANAMA_PATH="$repo_dir"
|
||||
log() { :; }
|
||||
eval "$filter"
|
||||
eval "$loop"
|
||||
EXTRAS_DIR="$extras_dir"
|
||||
for extra in ${PANAMA_EXTRAS:-}; do
|
||||
[[ -f "$EXTRAS_DIR/$extra" ]] && install_extra_category "$EXTRAS_DIR/$extra"
|
||||
done
|
||||
)
|
||||
[[ -s "$calls" ]] && note 'with no categories chosen the installer still installed something'
|
||||
|
||||
# ── 4. Every name resolves ───────────────────────────────────────────────────
|
||||
#
|
||||
# Skipped rather than failed when the repositories cannot be reached, so this
|
||||
# contract stays runnable on a train.
|
||||
|
||||
if timeout 60 dnf list --available --quiet bash >/dev/null 2>&1; then
|
||||
for category in "${categories[@]}"; do
|
||||
[[ -f "$category" ]] || continue
|
||||
while read -r package; do
|
||||
[[ -n "$package" ]] || continue
|
||||
[[ "$package" == flatpak:* ]] && continue
|
||||
timeout 90 dnf list --quiet "$package" >/dev/null 2>&1 \
|
||||
|| note "$(basename "$category") names $package, which dnf cannot resolve"
|
||||
done < <(sed 's/#.*//' "$category" | tr -d ' \t' | grep -v '^$')
|
||||
done
|
||||
else
|
||||
printf 'extras contract: dnf is unreachable, so package names were not resolved\n' >&2
|
||||
fi
|
||||
|
||||
if timeout 60 flatpak remote-info flathub org.mozilla.firefox >/dev/null 2>&1; then
|
||||
for category in "${categories[@]}"; do
|
||||
[[ -f "$category" ]] || continue
|
||||
while read -r id; do
|
||||
[[ -n "$id" ]] || continue
|
||||
timeout 90 flatpak remote-info flathub "$id" >/dev/null 2>&1 \
|
||||
|| note "$(basename "$category") names $id, which is not on Flathub"
|
||||
done < <(sed 's/#.*//' "$category" | tr -d ' \t' | sed -n 's/^flatpak://p')
|
||||
done
|
||||
else
|
||||
printf 'extras contract: Flathub is unreachable, so flatpak IDs were not resolved\n' >&2
|
||||
fi
|
||||
|
||||
# ── Report ───────────────────────────────────────────────────────────────────
|
||||
|
||||
if (( ${#findings[@]} > 0 )); then
|
||||
mapfile -t findings < <(printf '%s\n' "${findings[@]}" | sort -u)
|
||||
printf 'extras contract: %d finding(s)\n' "${#findings[@]}" >&2
|
||||
printf ' - %s\n' "${findings[@]}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
printf 'extras contract: PASS (%d categories)\n' "${#categories[@]}"
|
||||
Executable
+99
@@ -0,0 +1,99 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# The Firefox chrome lands in the profile, on a machine that has never run
|
||||
# Firefox.
|
||||
#
|
||||
# This is the one piece of Panama's configuration that does not go to a path the
|
||||
# repository chooses. Firefox owns the profile directory, names it with a random
|
||||
# salt, and does not create it until the browser has been run once -- so the
|
||||
# usual "symlink config/dot/<name> to ~/.config/<name>" cannot reach it.
|
||||
#
|
||||
# Two things about that are easy to get wrong and were:
|
||||
#
|
||||
# 1. The profile root moved. A current Firefox keeps profiles under
|
||||
# ~/.config/mozilla/firefox and an older one under ~/.mozilla/firefox.
|
||||
# Writing to the wrong one silently themes nothing.
|
||||
# 2. Both halves have to land. chrome/ holds the CSS, and user.js sets
|
||||
# toolkit.legacyUserProfileCustomizations.stylesheets -- without which
|
||||
# Firefox never reads chrome/ at all, and the theme is a directory of dead
|
||||
# files.
|
||||
#
|
||||
# So this runs link-dotfiles for real against a throwaway HOME with no profile in
|
||||
# it, and looks at what came out. Nothing here touches the running machine.
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
||||
theme_dir="$repo_dir/config/firefox"
|
||||
|
||||
findings=()
|
||||
note() { findings+=("$1"); }
|
||||
|
||||
command -v firefox >/dev/null 2>&1 || {
|
||||
printf 'firefox chrome contract: firefox is not installed, so nothing was verified\n' >&2
|
||||
exit 0
|
||||
}
|
||||
|
||||
# ── The theme is whole ───────────────────────────────────────────────────────
|
||||
|
||||
[[ -f "$theme_dir/user.js" ]] || note 'config/firefox has no user.js, so Firefox would ignore chrome/ entirely'
|
||||
[[ -d "$theme_dir/chrome" ]] || note 'config/firefox has no chrome directory'
|
||||
[[ -f "$theme_dir/README.md" ]] || note 'the vendored theme records no provenance or licence'
|
||||
|
||||
grep -q 'toolkit.legacyUserProfileCustomizations.stylesheets' "$theme_dir/user.js" 2>/dev/null \
|
||||
|| note 'user.js does not enable userChrome.css, so none of the CSS is read'
|
||||
|
||||
# userChrome.css imports custom.css last so local changes need not touch the
|
||||
# vendored files. The import resolving to nothing is legal CSS and therefore
|
||||
# silent, which is exactly why it is worth checking.
|
||||
if grep -q 'custom.css' "$theme_dir/chrome/userChrome.css" 2>/dev/null; then
|
||||
[[ -f "$theme_dir/chrome/custom.css" ]] \
|
||||
|| note 'userChrome.css imports custom.css, which does not exist'
|
||||
fi
|
||||
|
||||
# ── A real run, into a throwaway home ────────────────────────────────────────
|
||||
|
||||
fake_home="$(mktemp -d)"
|
||||
trap 'rm -rf "$fake_home"' EXIT
|
||||
|
||||
HOME="$fake_home" XDG_CONFIG_HOME="$fake_home/.config" PANAMA_PATH="$repo_dir" \
|
||||
MOZ_HEADLESS=1 timeout 300 bash "$repo_dir/setup/scripts/link-dotfiles" >/dev/null 2>&1
|
||||
|
||||
profiles_ini="$(find "$fake_home" -name profiles.ini -print -quit 2>/dev/null)"
|
||||
if [[ -z "$profiles_ini" ]]; then
|
||||
note 'no Firefox profile was created, so a fresh machine gets no chrome until the second install'
|
||||
else
|
||||
root="$(dirname "$profiles_ini")"
|
||||
|
||||
linked=0
|
||||
while read -r profile; do
|
||||
[[ -d "$profile" ]] || continue
|
||||
linked=1
|
||||
for piece in chrome user.js; do
|
||||
if [[ ! -e "$profile/$piece" ]]; then
|
||||
note "$piece never reached the profile at $(basename "$profile")"
|
||||
elif [[ ! -L "$profile/$piece" ]]; then
|
||||
note "$piece in the profile is not a link to the repository, so updates will not reach it"
|
||||
elif [[ "$(readlink -f "$profile/$piece")" != "$(readlink -f "$theme_dir/$piece")" ]]; then
|
||||
note "$piece in the profile points somewhere other than config/firefox"
|
||||
fi
|
||||
done
|
||||
done < <(awk -F= -v root="$root" '
|
||||
/^\[/ { relative = 1; next }
|
||||
/^IsRelative=/ { relative = $2; next }
|
||||
/^Path=/ { print (relative == 1 ? root "/" $2 : $2) }
|
||||
' "$profiles_ini")
|
||||
|
||||
(( linked == 1 )) || note 'profiles.ini lists no profile directory that exists'
|
||||
fi
|
||||
|
||||
# ── Report ───────────────────────────────────────────────────────────────────
|
||||
|
||||
if (( ${#findings[@]} > 0 )); then
|
||||
mapfile -t findings < <(printf '%s\n' "${findings[@]}" | sort -u)
|
||||
printf 'firefox chrome contract: %d finding(s)\n' "${#findings[@]}" >&2
|
||||
printf ' - %s\n' "${findings[@]}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
printf 'firefox chrome contract: PASS\n'
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# This stage cannot be verified the way the rest of Panama is. It installs a
|
||||
# proprietary driver, rewrites kernel arguments and queues a Secure Boot
|
||||
# enrolment, and the machine it was written on is an AMD desktop with no NVIDIA
|
||||
# enrollment, and the machine it was written on is an AMD desktop with no NVIDIA
|
||||
# card in it. Running it to see what happens is not available.
|
||||
#
|
||||
# So every privileged command it can reach is stood in on PATH, and the contract
|
||||
@@ -132,19 +132,19 @@ hash='$6$notarealsalt$notarealhashvalue'
|
||||
mok="$(run_stage PANAMA_MOK_HASH="$hash" PANAMA_MOK_CERT="$cert")"
|
||||
|
||||
called "$mok" 'mokutil --import' \
|
||||
|| note 'a recorded MOK hash does not queue an enrolment'
|
||||
|| note 'a recorded MOK hash does not queue an enrollment'
|
||||
called "$mok" -- '--hash-file' \
|
||||
|| note 'the enrolment does not pass a hash file, so mokutil would prompt for a password'
|
||||
|| note 'the enrollment does not pass a hash file, so mokutil would prompt for a password'
|
||||
if grep -qF -- "$hash" <<<"$mok"; then
|
||||
note 'the MOK hash is passed on a command line where any process can read it'
|
||||
fi
|
||||
|
||||
# No certificate means akmods never generated a key. Requesting enrolment of a
|
||||
# No certificate means akmods never generated a key. Requesting enrollment of a
|
||||
# key that does not exist is worse than skipping: it queues a prompt at the next
|
||||
# boot for nothing.
|
||||
without_cert="$(run_stage PANAMA_MOK_HASH="$hash" PANAMA_MOK_CERT="$work/absent.der")"
|
||||
if called "$without_cert" 'mokutil --import'; then
|
||||
note 'enrolment is requested even with no akmods certificate to enrol'
|
||||
note 'enrollment is requested even with no akmods certificate to enroll'
|
||||
fi
|
||||
|
||||
# ── 4. Removal is honest about what it removes ───────────────────────────────
|
||||
|
||||
Reference in New Issue
Block a user