Gabriel Brown
c02329ac3c
The launcher's Copy Password command, built alone and last as the plan required, because every line of it is the security design: the secret travels rbw to wl-copy through a pipe -- never argv, never a file -- and the copy carries wl-clipboard's --sensitive hint, which vicinae's clipboard history documents it ignores. That claim was not taken on faith: a plain probe landed in the live history database and a sensitive one did not, before any of this was written. A transient timer clears the clipboard after thirty seconds. An unconfigured rbw gets a setup message; a vault that locks between list and get gets an honest failure instead of an empty copy claiming success. rbw joins desktop-packages, and the contract pins the whole journey with a stub vault, including that the secret never appears on a command line.
90 lines
2.6 KiB
Plaintext
90 lines
2.6 KiB
Plaintext
adw-gtk3-theme
|
|
akmods
|
|
alsa-plugins-pulseaudio
|
|
cascadiamono-nerd-fonts
|
|
decibels
|
|
# The Wayland build specifically; the x11 one cannot inject into this session.
|
|
# Its config is linked by link-dotfiles.
|
|
espanso-wayland
|
|
desktop-file-utils
|
|
dnf-plugins-core
|
|
ffmpeg
|
|
firamono-nerd-fonts
|
|
# A second engine to check pages against; Helium is the daily driver. Its
|
|
# chrome is themed from config/firefox, which link-dotfiles places into the
|
|
# profile.
|
|
firefox
|
|
fuse-libs
|
|
# Ghostty and its config in config/dot/ghostty are linked by link-dotfiles.
|
|
ghostty
|
|
# The Calendar agenda opens events in this; see CalendarAgenda.qml.
|
|
gnome-calendar
|
|
# NOT GNOME-session residue. Panama's own Settings hands off to this for the
|
|
# panels it deliberately does not own -- Online Accounts, Color, Sound, Network,
|
|
# Keyboard, Privacy, Wellbeing, Accessibility, and the System panel for users,
|
|
# date and time, region and remote desktop. See the allow-list in
|
|
# services/SystemSettings.qml, which is what decides.
|
|
gnome-control-center
|
|
# install-hardware sets the nouveau blacklist and nvidia-drm.modeset with
|
|
# grubby, which replaces an argument it already set rather than appending a
|
|
# second copy -- the reason that stage needs no editor.
|
|
grubby
|
|
gstreamer1-plugin-fmp4
|
|
gstreamer1-plugin-gif
|
|
gstreamer1-plugin-gtk4
|
|
gstreamer1-plugin-hsv
|
|
gstreamer1-plugin-json
|
|
gstreamer1-plugin-libav
|
|
gstreamer1-plugin-mp4
|
|
gstreamer1-plugin-openh264
|
|
gstreamer1-plugins-bad-free-devel
|
|
gstreamer1-plugins-good
|
|
gstreamer1-plugins-good-extras
|
|
gstreamer1-plugins-good-gtk
|
|
gstreamer1-plugins-good-qt
|
|
gstreamer1-plugins-good-qt6
|
|
hipblas
|
|
jetbrainsmono-nerd-fonts
|
|
kernel-devel
|
|
lame
|
|
lame-devel
|
|
libva-devel
|
|
libva-utils
|
|
libxcrypt-compat
|
|
loupe
|
|
mesa-libGL-devel
|
|
mesa-libGLU
|
|
mesa-libOpenCL
|
|
mokutil
|
|
mozilla-openh264
|
|
# Arial, Georgia and Times, so web pages that assume them render correctly.
|
|
mscore-fonts
|
|
nautilus
|
|
nautilus-extensions
|
|
nautilus-python
|
|
# Ships both the Nautilus "Open in Terminal" extension and its gsettings
|
|
# schema. Panama used to copy its own fork of the extension over the same
|
|
# path, which left a fresh machine with the extension and no schema -- and
|
|
# the fork had drifted 63 lines behind the packaged one.
|
|
nautilus-open-any-terminal
|
|
nextcloud-client
|
|
openssl-devel
|
|
opus-devel
|
|
papers
|
|
python3-dnf-plugin-versionlock
|
|
# The launcher's Copy Password command; talks to the same Bitwarden account
|
|
# the desktop app signs into. See panama-pick.
|
|
rbw
|
|
rocm-opencl
|
|
# The Snapshots page is snapper end to end; see scripts/panama-snapshots.
|
|
snapper
|
|
sushi
|
|
# Fonts the desktop names by family and would otherwise render as tofu.
|
|
# VictorMono is required: it draws every glyph in the shell.
|
|
victormono-nerd-fonts
|
|
wine
|
|
wine-core
|
|
wine-mono
|
|
winetricks
|
|
xdg-utils
|