December 2025 - Spectrum Development

[PATCH] Always use -W argument to execlineb
by Demi Marie Obenour 02 Feb '26

02 Feb '26

It's much better to fail if there is a problem than to silently have a bug, or worse a security hole. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/initramfs/etc/init | 2 +- host/initramfs/etc/probe | 2 +- host/rootfs/image/etc/init | 2 +- host/rootfs/image/etc/login | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty1/run | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty2/run | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty3/run | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty4/run | 2 +- .../etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/s6-svscan-log/run | 2 +- .../etc/s6-linux-init/run-image/service/serial-getty-generator/run | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/run | 2 +- .../image/etc/s6-linux-init/run-image/service/serial-getty/template/run | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/run | 2 +- .../run-image/service/vm-services/template/data/service/dbus/run | 2 +- .../service/vm-services/template/data/service/spectrum-router/run | 2 +- .../service/vm-services/template/data/service/vhost-user-fs/run | 2 +- .../service/vm-services/template/data/service/vhost-user-gpu/run | 2 +- .../template/data/service/xdg-desktop-portal-spectrum-host/run | 2 +- .../image/etc/s6-linux-init/run-image/service/vm-services/template/run | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/vmm/run | 2 +- host/rootfs/image/etc/s6-linux-init/scripts/rc.init | 2 +- host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown | 2 +- host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final | 2 +- host/rootfs/image/etc/s6-rc/systemd-udevd/run | 2 +- host/rootfs/image/etc/s6-rc/weston/run | 2 +- host/rootfs/image/etc/xdg/weston/autolaunch | 2 +- host/rootfs/image/usr/bin/assign-devices | 2 +- host/rootfs/image/usr/bin/create-vm-dependencies | 2 +- host/rootfs/image/usr/bin/run-appimage | 2 +- host/rootfs/image/usr/bin/run-vmm | 2 +- host/rootfs/image/usr/bin/vm-console | 2 +- host/rootfs/image/usr/bin/vm-import | 2 +- host/rootfs/image/usr/bin/vm-start | 2 +- host/rootfs/image/usr/bin/vm-stop | 2 +- host/rootfs/image/usr/bin/xdg-open | 2 +- host/rootfs/image/usr/libexec/net-add | 2 +- img/app/image/etc/mdev/iface | 2 +- img/app/image/etc/mdev/listen | 2 +- img/app/image/etc/mdev/virtiofs | 2 +- img/app/image/etc/mdev/wait | 2 +- img/app/image/etc/s6-linux-init/run-image/service/getty-hvc0/run | 2 +- .../etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run | 2 +- img/app/image/etc/s6-linux-init/scripts/rc.init | 2 +- img/app/image/etc/s6-linux-init/scripts/rc.shutdown | 2 +- img/app/image/etc/s6-linux-init/scripts/rc.shutdown.final | 2 +- img/app/image/etc/s6-rc/app/run | 2 +- img/app/image/etc/s6-rc/dbus-vsock/run | 2 +- img/app/image/etc/s6-rc/dbus/run | 2 +- img/app/image/etc/s6-rc/mdevd/run | 2 +- img/app/image/etc/s6-rc/pipewire/run | 2 +- img/app/image/etc/s6-rc/wayland-proxy-virtwl/run | 2 +- img/app/image/etc/s6-rc/wireplumber/run | 2 +- img/app/image/usr/bin/init | 2 +- img/app/scripts/start-virtiofsd.elb | 2 +- release/checks/integration/default.nix | 2 +- scripts/start-passt.elb | 2 +- scripts/with-taps.elb | 2 +- vm/app/gnome-text-editor.nix | 2 +- vm/sys/net/image/etc/init | 2 +- vm/sys/net/image/etc/mdev/iface | 2 +- vm/sys/net/image/etc/s6-linux-init/run-image/service/getty-hvc0/run | 2 +- vm/sys/net/image/etc/s6-linux-init/scripts/rc.init | 2 +- vm/sys/net/image/etc/s6-rc/dbus/run | 2 +- vm/sys/net/image/etc/s6-rc/mdevd/run | 2 +- 65 files changed, 65 insertions(+), 65 deletions(-) diff --git a/host/initramfs/etc/init b/host/initramfs/etc/init index 719488741b6d31564c2c17c0e41f15d16b1c0a08..f97d8616c82d7b26b27ab5444db87e51e74c654e 100755 --- a/host/initramfs/etc/init +++ b/host/initramfs/etc/init @@ -1,4 +1,4 @@ -#!/bin/execlineb -S0 +#!/bin/execlineb -WS0 # SPDX-FileCopyrightText: 2021-2022 Alyssa Ross <hi(a)alyssa.is> # SPDX-License-Identifier: EUPL-1.2+ diff --git a/host/initramfs/etc/probe b/host/initramfs/etc/probe index 013092b6dcc5b82db7302c1ae7e6d8a4f5a0b802..f1883890b447688e804f71baec978234493dcd92 100755 --- a/host/initramfs/etc/probe +++ b/host/initramfs/etc/probe @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/init b/host/rootfs/image/etc/init index 4085fa55545e7309004967e443e47fc2b82b0663..315e3b527508bda94c3092f97c0f5c033a30afd0 100755 --- a/host/rootfs/image/etc/init +++ b/host/rootfs/image/etc/init @@ -1,4 +1,4 @@ -#!/bin/execlineb -s0 +#!/bin/execlineb -Ws0 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/login b/host/rootfs/image/etc/login index 34ff3212fa644cfb6d0bfd8362be6a58b7fcaf12..0cf144dcfa6f011d1325ca04089f16d2889d70be 100755 --- a/host/rootfs/image/etc/login +++ b/host/rootfs/image/etc/login @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty1/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty1/run index 1ce0766c79b4afc038fbf3ea9bb777046226498b..c893c481f11a46dff9db808787c839b448064956 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty1/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty1/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty2/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty2/run index e619191005a47ddb8bf0ef68d304d8cf045d717a..4d2cd7172e887e90d9ce87489cdacf41e51f77e8 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty2/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty2/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty3/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty3/run index e3e0634ed011f4033b8546214b230c569458271b..06abf5422365ff4edc9379e5cbcab716e6830399 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty3/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty3/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty4/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty4/run index 9e1d46d2df934123e0469beddb218ee3fe90c6bc..3dd235fc93d403fc8971e923ec62cb025684b67a 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty4/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty4/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run index 228fc6a9f7f28f5226f46645f38f51b29a8a4580..327f4ccc5056e7ef87c089e666090307845cae3a 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-svscan-log/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-svscan-log/run index 8cc08c4c1932da13372778d0ebddfe2d75b1fab5..8f7bd889e50d76a49b98d8ba9e2c6172f287277c 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-svscan-log/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-svscan-log/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: ISC # SPDX-FileCopyrightText: Copyright (c) 2015-2024 Laurent Bercot <ska-skaware(a)skarnet.org> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty-generator/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty-generator/run index 8c1e2afab65c29cb2f067f9b5fd7e72f0e1404c0..8126869defb046bb0a2de6a8da625dbd1e52564f 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty-generator/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty-generator/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/run index 90417881eb43052aa5ea0afa3010706fb6f25a91..78f794202bf174f3c036f3e20755ac087a988277 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/template/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/template/run index da46511e8a28ecdbda0de762a19d6cf2f38a22a7..f3ed9a7f08e60206afd222f4fc02c5fb19527561 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/template/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/template/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021, 2024 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/run index 90417881eb43052aa5ea0afa3010706fb6f25a91..78f794202bf174f3c036f3e20755ac087a988277 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run index 13c7e95a0fc0e71b8c72cf9e432d10742cd8e2ef..47ba40683f9e5d341ccfa7a689320ed01184f4d2 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run index e15e5c793577df2b1b2fc56e8fe1685f3f150b6e..03092aa4c6e64018973f1623341199f11479c582 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run index 6bd69ad944a464294ad9a3268c8a63482c7e8040..602088fcf3b70660197e50540bb8e5e6eb8e865e 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run index 19d5a61388e6f49c7f722814d6de47227b02da01..5728791c35c1af9a9e4f2d56460721c8ee952f46 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run index dff1f81184033282f4c99969028d9d4c617e5850..0bb5e2751af9a2ae891166640e41ceae1054029a 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/run index e171f00dc5c0377c086c2304adb7e9b90d641194..1aab64dd73755a9ec61720027db9916a9dd3cf0c 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vmm/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vmm/run index 90417881eb43052aa5ea0afa3010706fb6f25a91..78f794202bf174f3c036f3e20755ac087a988277 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vmm/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vmm/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/scripts/rc.init b/host/rootfs/image/etc/s6-linux-init/scripts/rc.init index 37b293d474013b0f94c83a931af16fb23c11315b..f638e373589884acb959c868462fdf532380a851 100755 --- a/host/rootfs/image/etc/s6-linux-init/scripts/rc.init +++ b/host/rootfs/image/etc/s6-linux-init/scripts/rc.init @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2022, 2024 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown index 3b09c02dc5866e8e24284b29d4156bec0412a9f2..67602d6ba2d9a63fe2ec1967c7834d032dc5ed66 100755 --- a/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown +++ b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final index 7f48a65f1fbcfe435132394323730a27b172cb2e..2be3b8653a60c1fc749fbd3f06c5c84ed5ec5595 100755 --- a/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final +++ b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final @@ -1,3 +1,3 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run index 2d28d027f2bc787f0d4da21a112289c7b97929fa..aec6444e951503eae988e666b77fda8f2ae33d72 100644 --- a/host/rootfs/image/etc/s6-rc/systemd-udevd/run +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> s6-setlock /run/sd-notify-wrapper/systemd-udevd.lock diff --git a/host/rootfs/image/etc/s6-rc/weston/run b/host/rootfs/image/etc/s6-rc/weston/run index 251f5da4597a916c4e46a0dfd64cec261d519d23..ca7b7265b4cc331239af0792ceec8ab58e443dff 100644 --- a/host/rootfs/image/etc/s6-rc/weston/run +++ b/host/rootfs/image/etc/s6-rc/weston/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/xdg/weston/autolaunch b/host/rootfs/image/etc/xdg/weston/autolaunch index 7a85ae1ee3267fc968cf4948cd590337d67553a4..196c137769d3547a6ed5246d3bd1e85c9662efb6 100755 --- a/host/rootfs/image/etc/xdg/weston/autolaunch +++ b/host/rootfs/image/etc/xdg/weston/autolaunch @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/assign-devices b/host/rootfs/image/usr/bin/assign-devices index 58dd3cc0dfc3ceec4c82988755ed1ddbd224abfd..1c5ee8749e9880c88d346ee616163fb6b264f65f 100755 --- a/host/rootfs/image/usr/bin/assign-devices +++ b/host/rootfs/image/usr/bin/assign-devices @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/create-vm-dependencies b/host/rootfs/image/usr/bin/create-vm-dependencies index 8fb9f3ad859dddf212a67c0f05b079a5c414777c..1f7d63f47f71c3261dba4a6c8bfddde0dccf40bf 100755 --- a/host/rootfs/image/usr/bin/create-vm-dependencies +++ b/host/rootfs/image/usr/bin/create-vm-dependencies @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/run-appimage b/host/rootfs/image/usr/bin/run-appimage index f2fe7bc246b75ad4eb2d10613db250787a58046d..c121e635f0012fbc653d1cc40d872c75316d050d 100755 --- a/host/rootfs/image/usr/bin/run-appimage +++ b/host/rootfs/image/usr/bin/run-appimage @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm index ba8b59c2677408acdd01c2eda3cf2dd60992d881..52fbf37d3f46123c94422e7eaf39b64e7538daca 100755 --- a/host/rootfs/image/usr/bin/run-vmm +++ b/host/rootfs/image/usr/bin/run-vmm @@ -1,4 +1,4 @@ -#!/bin/execlineb -s0 +#!/bin/execlineb -Ws0 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/vm-console b/host/rootfs/image/usr/bin/vm-console index a0f5bbf1a3d25d3891fd47e8ba7c65e7ed91be33..27caccaab53c5be42646dd27acfaf1b463e585bd 100755 --- a/host/rootfs/image/usr/bin/vm-console +++ b/host/rootfs/image/usr/bin/vm-console @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021-2022 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/vm-import b/host/rootfs/image/usr/bin/vm-import index c1d1bbc106b8034c82c8e09c1bff81a06c233fe4..239af0b7c5806d364a5276c8aa3b56c07b5916e6 100755 --- a/host/rootfs/image/usr/bin/vm-import +++ b/host/rootfs/image/usr/bin/vm-import @@ -1,4 +1,4 @@ -#!/bin/execlineb -S2 +#!/bin/execlineb -WS2 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/vm-start b/host/rootfs/image/usr/bin/vm-start index 67480e5215d8a8260ce3f03c67f71ba8f210c291..379b32e83ce039f35555b7924c895bd3a02c4430 100755 --- a/host/rootfs/image/usr/bin/vm-start +++ b/host/rootfs/image/usr/bin/vm-start @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/vm-stop b/host/rootfs/image/usr/bin/vm-stop index 4c36be19dabad7c2671381aed87179b174ad9bbb..6fb6aaed46de684eb035243e4f7c79111e93bf8c 100755 --- a/host/rootfs/image/usr/bin/vm-stop +++ b/host/rootfs/image/usr/bin/vm-stop @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/xdg-open b/host/rootfs/image/usr/bin/xdg-open index f0e93bc935b420f526ad004a96084830d9815bf0..4a4a118bfea249330ba23a74cab79a799e0ae070 100755 --- a/host/rootfs/image/usr/bin/xdg-open +++ b/host/rootfs/image/usr/bin/xdg-open @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/libexec/net-add b/host/rootfs/image/usr/libexec/net-add index 2743b71d04be1471d531d9e51d783b98afd72a77..361f1e9063b75e8d0f4e296380f56fa8d7d930fb 100755 --- a/host/rootfs/image/usr/libexec/net-add +++ b/host/rootfs/image/usr/libexec/net-add @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021, 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/mdev/iface b/img/app/image/etc/mdev/iface index 1d81f2af0d68e62d34b975cc006b623cf3064c86..67eee84f07cc9ddbdaccf407eb40162398e277a9 100755 --- a/img/app/image/etc/mdev/iface +++ b/img/app/image/etc/mdev/iface @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2022, 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/mdev/listen b/img/app/image/etc/mdev/listen index ab50ee8c5ed1139d1129bac56afa7263af150745..932c380d68870ae83460f94621498bb80cefe20b 100755 --- a/img/app/image/etc/mdev/listen +++ b/img/app/image/etc/mdev/listen @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs index c1fd2834a1375676b94c6d25f0ed85202a466956..c35b20b858d96bfdebdef33afcc5b0ba25856ab7 100755 --- a/img/app/image/etc/mdev/virtiofs +++ b/img/app/image/etc/mdev/virtiofs @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022-2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/mdev/wait b/img/app/image/etc/mdev/wait index 6bddb303d2671ce4e5b8581cd81235d7404916e7..7b66810a6338b7ce67d058f81d0202109d903aac 100755 --- a/img/app/image/etc/mdev/wait +++ b/img/app/image/etc/mdev/wait @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-linux-init/run-image/service/getty-hvc0/run b/img/app/image/etc/s6-linux-init/run-image/service/getty-hvc0/run index 09fd0771a24ddad2e599ef170fd795891399e4e1..ecc689217a0eaf19ac8fae90db58af502db4aecb 100755 --- a/img/app/image/etc/s6-linux-init/run-image/service/getty-hvc0/run +++ b/img/app/image/etc/s6-linux-init/run-image/service/getty-hvc0/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run b/img/app/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run index 228fc6a9f7f28f5226f46645f38f51b29a8a4580..327f4ccc5056e7ef87c089e666090307845cae3a 100755 --- a/img/app/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run +++ b/img/app/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-linux-init/scripts/rc.init b/img/app/image/etc/s6-linux-init/scripts/rc.init index 762081f48ad8e69f8f1eab6e9da34f5a641fe70f..fcececa2db98f490882eaedda2b44eb84f7faa4d 100755 --- a/img/app/image/etc/s6-linux-init/scripts/rc.init +++ b/img/app/image/etc/s6-linux-init/scripts/rc.init @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2022 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/img/app/image/etc/s6-linux-init/scripts/rc.shutdown b/img/app/image/etc/s6-linux-init/scripts/rc.shutdown index 3b09c02dc5866e8e24284b29d4156bec0412a9f2..67602d6ba2d9a63fe2ec1967c7834d032dc5ed66 100755 --- a/img/app/image/etc/s6-linux-init/scripts/rc.shutdown +++ b/img/app/image/etc/s6-linux-init/scripts/rc.shutdown @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-linux-init/scripts/rc.shutdown.final b/img/app/image/etc/s6-linux-init/scripts/rc.shutdown.final index 7f48a65f1fbcfe435132394323730a27b172cb2e..2be3b8653a60c1fc749fbd3f06c5c84ed5ec5595 100755 --- a/img/app/image/etc/s6-linux-init/scripts/rc.shutdown.final +++ b/img/app/image/etc/s6-linux-init/scripts/rc.shutdown.final @@ -1,3 +1,3 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/app/run index e05d4fe4bf67bbc4d550a7f0fde941add45d298f..92aa013108cb2796ddbfd811bc3b265d57ece27b 100755 --- a/img/app/image/etc/s6-rc/app/run +++ b/img/app/image/etc/s6-rc/app/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021, 2024-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-rc/dbus-vsock/run b/img/app/image/etc/s6-rc/dbus-vsock/run index 4733bae5ced206b8a5a3460a641d01af739a19b4..05b6eaff8baf55f0e437b27365b23f0219f3ea97 100755 --- a/img/app/image/etc/s6-rc/dbus-vsock/run +++ b/img/app/image/etc/s6-rc/dbus-vsock/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-rc/dbus/run b/img/app/image/etc/s6-rc/dbus/run index 031d730a6e0e311b8e0e6b8119a77bdfa9c1f423..73f5de35c0b15924768cfdb01179bd198e9ab059 100644 --- a/img/app/image/etc/s6-rc/dbus/run +++ b/img/app/image/etc/s6-rc/dbus/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023, 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-rc/mdevd/run b/img/app/image/etc/s6-rc/mdevd/run index 6dacb132862a48a0cc91edbcdea44b41c7327368..c476e5f73dacad1729ee59bcfeafe49ace58441f 100644 --- a/img/app/image/etc/s6-rc/mdevd/run +++ b/img/app/image/etc/s6-rc/mdevd/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-rc/pipewire/run b/img/app/image/etc/s6-rc/pipewire/run index 3925f0871502504e7cde118302b30355b27f88d2..a36c7b4fd0c555d9e3147db9b6e8a04a18dbd789 100644 --- a/img/app/image/etc/s6-rc/pipewire/run +++ b/img/app/image/etc/s6-rc/pipewire/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023-2025 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run b/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run index 86d7f639ad1a98073403295f6a3977dc4747faa0..7fa9d82c51a045305e27c188499773d51199b4bb 100755 --- a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run +++ b/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> # diff --git a/img/app/image/etc/s6-rc/wireplumber/run b/img/app/image/etc/s6-rc/wireplumber/run index a514c401beeeb8440b1b9a8db7f6261e9f4018fd..34cd7723e793b7a7cb0cdbd8f0d9d9c1209fbae2 100644 --- a/img/app/image/etc/s6-rc/wireplumber/run +++ b/img/app/image/etc/s6-rc/wireplumber/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/img/app/image/usr/bin/init b/img/app/image/usr/bin/init index aca6efa2b74d3872f123cfac13410ae9e81f905c..1f24ba57f9c5f196fdec74ca82a1f8586b73540f 100755 --- a/img/app/image/usr/bin/init +++ b/img/app/image/usr/bin/init @@ -1,4 +1,4 @@ -#!/bin/execlineb -s0 +#!/bin/execlineb -Ws0 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022, 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb index e4d265f047d51370cad5ff0ce4c8207e78f8b171..ce1a5cfaafb660e9ac2fd6b1a50c6e76f9c36bd8 100755 --- a/img/app/scripts/start-virtiofsd.elb +++ b/img/app/scripts/start-virtiofsd.elb @@ -1,4 +1,4 @@ -#!/usr/bin/env execlineb +#!/usr/bin/env -S execlineb -W # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022, 2024 Alyssa Ross <hi(a)alyssa.is> diff --git a/release/checks/integration/default.nix b/release/checks/integration/default.nix index f8aab8aa5b872475e916059362a9011340974d53..ca7b395418ef5c1ef766b18833038f4ebdd5d64c 100644 --- a/release/checks/integration/default.nix +++ b/release/checks/integration/default.nix @@ -10,7 +10,7 @@ let live = callSpectrumPackage ../../live {}; appimage = writeShellScript "test.appimage" '' - #!/bin/execlineb -P + #!/bin/execlineb -WP echo hello world ''; diff --git a/scripts/start-passt.elb b/scripts/start-passt.elb index f2c53f184d7f82c1741ced1a3ec08c75d78bc2cd..2df4cff53bbcf7a6a1c2e01ecc12e5826009082e 100755 --- a/scripts/start-passt.elb +++ b/scripts/start-passt.elb @@ -1,4 +1,4 @@ -#!/usr/bin/env execlineb +#!/usr/bin/env -S execlineb -W # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/scripts/with-taps.elb b/scripts/with-taps.elb index 82725ff599b8227d1d0d42d09cdacdd4b46d0344..7be9385520a95c8649843e3bab00e4f36d600641 100755 --- a/scripts/with-taps.elb +++ b/scripts/with-taps.elb @@ -1,4 +1,4 @@ -#!/usr/bin/env execlineb +#!/usr/bin/env -S execlineb -W # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/vm/app/gnome-text-editor.nix b/vm/app/gnome-text-editor.nix index 63f01f0d992bc1ce2679d12cff82bfa4596f5046..bd15fe5b22fba6e947449dc7378389e644d0305d 100644 --- a/vm/app/gnome-text-editor.nix +++ b/vm/app/gnome-text-editor.nix @@ -7,7 +7,7 @@ import ../../lib/call-package.nix ( callSpectrumPackage ../make-vm.nix {} { type = "nix"; run = writeScript "run-gnome-text-editor" '' - #!/bin/execlineb -P + #!/bin/execlineb -WP export GDK_DEBUG portals ${lib.getExe gnome-text-editor} ''; diff --git a/vm/sys/net/image/etc/init b/vm/sys/net/image/etc/init index 6424e221e0fb929e107271bd52b61706b9f1855e..7a1ccab51c840153ef43555cee0c5ca5d89a4775 100755 --- a/vm/sys/net/image/etc/init +++ b/vm/sys/net/image/etc/init @@ -1,4 +1,4 @@ -#!/bin/execlineb -s0 +#!/bin/execlineb -Ws0 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022 Alyssa Ross <hi(a)alyssa.is> diff --git a/vm/sys/net/image/etc/mdev/iface b/vm/sys/net/image/etc/mdev/iface index da45ce92fd4034ebd16a0b7255bc61474716e41e..14ab140d174a913fea0f498d4531caeed434851a 100755 --- a/vm/sys/net/image/etc/mdev/iface +++ b/vm/sys/net/image/etc/mdev/iface @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> diff --git a/vm/sys/net/image/etc/s6-linux-init/run-image/service/getty-hvc0/run b/vm/sys/net/image/etc/s6-linux-init/run-image/service/getty-hvc0/run index a919fbe0d5719260599c76becfcba48880d56f83..850db9e7a0a8f077e4770b221761455930d96243 100755 --- a/vm/sys/net/image/etc/s6-linux-init/run-image/service/getty-hvc0/run +++ b/vm/sys/net/image/etc/s6-linux-init/run-image/service/getty-hvc0/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/vm/sys/net/image/etc/s6-linux-init/scripts/rc.init b/vm/sys/net/image/etc/s6-linux-init/scripts/rc.init index 4378400b0b34f12bfa6a994029546f9c38058d10..aa3d5bfcd786c594d0989e4a4ab54ee5845801cd 100755 --- a/vm/sys/net/image/etc/s6-linux-init/scripts/rc.init +++ b/vm/sys/net/image/etc/s6-linux-init/scripts/rc.init @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2022 Alyssa Ross <hi(a)alyssa.is> diff --git a/vm/sys/net/image/etc/s6-rc/dbus/run b/vm/sys/net/image/etc/s6-rc/dbus/run index 6e88e808552f4b391ee77046eef85bb18e029484..cae9868f0bfde0c9b23175b0dc667e899ab889a9 100644 --- a/vm/sys/net/image/etc/s6-rc/dbus/run +++ b/vm/sys/net/image/etc/s6-rc/dbus/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/vm/sys/net/image/etc/s6-rc/mdevd/run b/vm/sys/net/image/etc/s6-rc/mdevd/run index 6dacb132862a48a0cc91edbcdea44b41c7327368..c476e5f73dacad1729ee59bcfeafe49ace58441f 100644 --- a/vm/sys/net/image/etc/s6-rc/mdevd/run +++ b/vm/sys/net/image/etc/s6-rc/mdevd/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> --- base-commit: a13d3403c1ddbb8dbbbdb05416350b2846162ed1 change-id: 20251203-execlineb-always-w-2ded1fea98d6 -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[PATCH] host/rootfs: Always fail if there is a globbing problem
by Demi Marie Obenour 02 Feb '26

02 Feb '26

Better to fail than to continue after an unknown problem has happened. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/image/etc/s6-rc/static-nodes/up | 2 +- host/rootfs/image/usr/bin/assign-devices | 2 +- host/rootfs/image/usr/bin/run-vmm | 2 +- host/rootfs/image/usr/bin/vm-import | 2 +- host/rootfs/image/usr/bin/vm-start | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/host/rootfs/image/etc/s6-rc/static-nodes/up b/host/rootfs/image/etc/s6-rc/static-nodes/up index e1bdd4061441b39d7b46575a05754331970b951e..66f4fa7954beffc201f0985b3be10bd6a98f1d3a 100644 --- a/host/rootfs/image/etc/s6-rc/static-nodes/up +++ b/host/rootfs/image/etc/s6-rc/static-nodes/up @@ -2,7 +2,7 @@ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> pipeline { - elglob -0 modules_devname /lib/modules/*/modules.devname + elglob -w0 modules_devname /lib/modules/*/modules.devname /etc/parse-devname $modules_devname } diff --git a/host/rootfs/image/usr/bin/assign-devices b/host/rootfs/image/usr/bin/assign-devices index 58dd3cc0dfc3ceec4c82988755ed1ddbd224abfd..99988d64dbf2802cdbfd69c299f899ccbc1cf390 100755 --- a/host/rootfs/image/usr/bin/assign-devices +++ b/host/rootfs/image/usr/bin/assign-devices @@ -2,7 +2,7 @@ # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> -elglob -0 devices /sys/bus/pci/drivers/vfio-pci/????:??:??.? +elglob -w0 devices /sys/bus/pci/drivers/vfio-pci/????:??:??.? forx -pE device { $devices } # This script is designed to be re-entrant and called multiple times. diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm index ba8b59c2677408acdd01c2eda3cf2dd60992d881..1a09c93bd1ac121c72f8132393979bf03663f1c2 100755 --- a/host/rootfs/image/usr/bin/run-vmm +++ b/host/rootfs/image/usr/bin/run-vmm @@ -22,7 +22,7 @@ background -d { # Find any net-provider relationships this VM is involved in cd /run/vm/by-id - elglob -0 providers */config/providers/net/* + elglob -w0 providers */config/providers/net/* forx -pE path { $providers } backtick -E client_id { awk -v path=${path} -F / "BEGIN { split(path, p); print p[1] }" diff --git a/host/rootfs/image/usr/bin/vm-import b/host/rootfs/image/usr/bin/vm-import index c1d1bbc106b8034c82c8e09c1bff81a06c233fe4..06f90d83509c318bc364d9c0e111878235ae50d3 100755 --- a/host/rootfs/image/usr/bin/vm-import +++ b/host/rootfs/image/usr/bin/vm-import @@ -3,7 +3,7 @@ # SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> cd $2 -elglob -0 names * +elglob -w0 names * forx -po0 -E name { $names } diff --git a/host/rootfs/image/usr/bin/vm-start b/host/rootfs/image/usr/bin/vm-start index 67480e5215d8a8260ce3f03c67f71ba8f210c291..94d08437b75f59a728be0e8a1efbc5af3b44f6c5 100755 --- a/host/rootfs/image/usr/bin/vm-start +++ b/host/rootfs/image/usr/bin/vm-start @@ -7,7 +7,7 @@ foreground { s6-rc -bu change vm-env } foreground { redirfd -w 2 /dev/null cd /run/vm/by-id/${1}/config/providers/net - elglob -0 providers * + elglob -w0 providers * forx -pE provider { $providers } backtick -E provider_id { backtick -E id_path { readlink /run/vm/by-name/${provider} } --- base-commit: 92e219e7c08c479d216a46d2736ea9d229ff034d change-id: 20251203-globfail-41a5db0de497 -- Sincerely, Demi Marie Obenour (she/her/hers)

2 3

[PATCH www] Fix outdated links to external websites
by Johannes Süllner 02 Feb '26

02 Feb '26

The website of hazelnot has been offline since over 1 year, so remove the link. The documentation of Salt and Qubes moved to new locations. Signed-off-by: Johannes Süllner <johannes.suellner(a)mailbox.org> --- logo/index.html | 3 +-- motivation.html | 8 ++++---- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/logo/index.html b/logo/index.html index dd3ef31..f13c622 100644 --- a/logo/index.html +++ b/logo/index.html @@ -27,8 +27,7 @@ <img class="no-logo" srcset="logo400.png 400w" src="logo200.png" alt="" width="200" height="200" style="margin: 0 auto" loading="lazy" hidden> -The Spectrum logo was designed -by <a href="https://hazelnot.xyz/">hazelnot</a>, and is released under +The Spectrum logo was designed by hazelnot, and is released under the <a href="https://creativecommons.org/publicdomain/zero/1.0/">Creative Commons Zero</a> license. diff --git a/motivation.html b/motivation.html index d38d410..beaae30 100644 --- a/motivation.html +++ b/motivation.html @@ -94,8 +94,8 @@ Qubes, however they are often hampered by usability issues: <li> Maintaining many different TemplateVMs with persistent state is difficult. (Qubes - can <a href="https://www.qubes-os.org/doc/salt/">use</a> - <a href="https://docs.saltstack.com/en/latest/">Salt</a> + can <a href="https://doc.qubes-os.org/en/latest/user/advanced-topics/salt.html">use</a> + <a href="https://docs.saltproject.io/en/latest/contents.html">Salt</a> to mitigate this.) </ul> @@ -104,10 +104,10 @@ Qubes, however they are often hampered by usability issues: It is important to note, however, that the Qubes developers have created utilities for using compartmentalized environments that could be very useful to other implementations. For example, -Qubes <a href="https://www.qubes-os.org/doc/copy-paste/">allows</a> +Qubes <a href="https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-copy-and-paste…">allows</a> clipboard data to be safely shared between isolated environments with explicit user action on both ends, -and <a href="https://www.qubes-os.org/doc/split-gpg/">Qubes Split +and <a href="https://doc.qubes-os.org/en/latest/user/security-in-qubes/split-gpg.html">Qubes Split GPG</a> allows one environment to perform operations using a GPG key stored in another environment, with permission granted on a per-operation basis. -- 2.51.2

2 1

[PATCH www] impressum: fix broken relative paths in subdirectories
by Angel J 02 Feb '26

02 Feb '26

Signed-off-by: Angel J <iamanaws(a)httpd.dev> --- logo/index.html | 2 +- software/cloud-hypervisor/index.html | 2 +- software/index.html | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/logo/index.html b/logo/index.html index 0750053..2471cf9 100644 --- a/logo/index.html +++ b/logo/index.html @@ -61,4 +61,4 @@ by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. -<a href="impressum.html" lang="de">Impressum</a> +<a href="../impressum.html" lang="de">Impressum</a> diff --git a/software/cloud-hypervisor/index.html b/software/cloud-hypervisor/index.html index 2fef585..0bda4a7 100644 --- a/software/cloud-hypervisor/index.html +++ b/software/cloud-hypervisor/index.html @@ -177,4 +177,4 @@ by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. -<a href="impressum.html" lang="de">Impressum</a> +<a href="../../impressum.html" lang="de">Impressum</a> diff --git a/software/index.html b/software/index.html index a05e177..2a8a852 100644 --- a/software/index.html +++ b/software/index.html @@ -38,4 +38,4 @@ by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. -<a href="impressum.html" lang="de">Impressum</a> +<a href="../impressum.html" lang="de">Impressum</a> -- 2.51.2

4 5

[PATCH 1/2] host/rootfs: remove /proc/kcore bind mounts
by Alyssa Ross 01 Feb '26

01 Feb '26

Neither of these services run as root any more, so they don't have access to /proc/kcore any more regardless. (Also we don't have /proc/kcore on aarch64 so this previously errored there.) Fixes: 62590b8 ("host/rootfs: Sandbox crosvm") Fixes: ec47d36 ("host/rootfs: Sandbox Cloud Hypervisor") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- .../service/vm-services/template/data/service/vhost-user-gpu/run | 1 - host/rootfs/image/usr/bin/run-vmm | 1 - 2 files changed, 2 deletions(-) diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run index b1f9bac..e063a82 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run @@ -40,7 +40,6 @@ bwrap --tmpfs /proc/irq --remount-ro /proc/irq --ro-bind /dev/null /proc/timer_list - --ro-bind /dev/null /proc/kcore --ro-bind /dev/null /proc/kallsyms --ro-bind /dev/null /proc/sysrq-trigger -- diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm index 0640239..e30b14c 100755 --- a/host/rootfs/image/usr/bin/run-vmm +++ b/host/rootfs/image/usr/bin/run-vmm @@ -113,7 +113,6 @@ bwrap --tmpfs /proc/irq --remount-ro /proc/irq --ro-bind /dev/null /proc/timer_list - --ro-bind /dev/null /proc/kcore --ro-bind /dev/null /proc/kallsyms --ro-bind /dev/null /proc/sysrq-trigger -- base-commit: 6ceeb9b236cc50d2bba90068533ca1b7ff229c8b -- 2.51.0

3 8

[PATCH] release/checks/integration: fix race condition
by Alyssa Ross 15 Jan '26

15 Jan '26

By default, IPv6 addresses are in the tentative state and can't be bound to until the kernel has asychronously done Duplicate Address Detection. This was the cause of us needing to retry the bind, and sometimes even that wasn't enough. Since we're in a fresh network namespace, we know there can't be a duplicate address, so we can add the address with the IFA_F_NODAD flag to skip this and make the address available for binding immediately. We can't set that flag using the ioctl interface we were using before, so switch to netlink. This is slightly lazy netlink — we hardcode the index of the loopback address, and don't bother with extended errors — but I think that's fine for a test where readability is the most important thing. I've run the test 100 times with this change and didn't see any bind failures, which is a big improvement over the failure rate I was seeing before. Fixes: cdf1891e ("release/checks/integration: Adapt networking test for ipv6") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- release/checks/integration/networking.c | 89 +++++++++++++++++++------ 1 file changed, 70 insertions(+), 19 deletions(-) diff --git a/release/checks/integration/networking.c b/release/checks/integration/networking.c index 68f00b98..7d02f557 100644 --- a/release/checks/integration/networking.c +++ b/release/checks/integration/networking.c @@ -12,14 +12,14 @@ #include <arpa/inet.h> #include <net/if.h> -#include <sys/ioctl.h> +#include <sys/socket.h> +#include <linux/if_addr.h> #include <linux/ipv6.h> +#include <linux/rtnetlink.h> static int setup_server(void) { int fd; - struct ifreq ifr; - struct in6_ifreq ifr6; struct sockaddr_in6 addr = { .sin6_family = AF_INET6, @@ -27,30 +27,83 @@ static int setup_server(void) .sin6_addr = { .s6_addr = { 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02 } }, }; - sprintf(ifr.ifr_name, "lo"); + struct { + struct nlmsghdr nh; + struct ifaddrmsg ifa; + struct rtattr attr; + struct in6_addr addr; + } newaddr_req = { + { + .nlmsg_len = sizeof newaddr_req, + .nlmsg_type = RTM_NEWADDR, + .nlmsg_flags = NLM_F_ACK | NLM_F_REQUEST, + }, + { + .ifa_family = AF_INET6, + .ifa_prefixlen = 128, + .ifa_flags = IFA_F_NODAD, + .ifa_index = 1, + }, + { + .rta_len = sizeof newaddr_req.attr + sizeof newaddr_req.addr, + .rta_type = IFA_ADDRESS, + }, + addr.sin6_addr, + }; - ifr6.ifr6_ifindex = 1; - ifr6.ifr6_addr = addr.sin6_addr; - ifr6.ifr6_prefixlen = 128; + struct { + struct nlmsghdr nh; + struct ifinfomsg ifi; + } newlink_req = { + { + .nlmsg_len = sizeof newlink_req, + .nlmsg_type = RTM_NEWLINK, + .nlmsg_flags = NLM_F_ACK | NLM_F_REQUEST, + }, + { + .ifi_index = 1, + .ifi_flags = IFF_UP, + .ifi_change = IFF_UP, + }, + }; - if ((fd = socket(AF_INET6, SOCK_STREAM|SOCK_CLOEXEC, 0)) == -1) { + struct { + struct nlmsghdr nh; + struct nlmsgerr err; + } res; + + if ((fd = socket(AF_NETLINK, SOCK_DGRAM|SOCK_CLOEXEC, NETLINK_ROUTE)) == -1) { perror("socket"); exit(EXIT_FAILURE); } - if (ioctl(fd, SIOCGIFFLAGS, &ifr) == -1) { - perror("SIOCGIFFLAGS"); + if (send(fd, &newaddr_req, sizeof newaddr_req, 0) == -1) { + perror("send"); exit(EXIT_FAILURE); } - ifr.ifr_flags |= IFF_UP; - if (ioctl(fd, SIOCSIFFLAGS, &ifr) == -1) { - perror("SIOCSIFFLAGS"); + if (recv(fd, &res, sizeof res, 0) == -1) { + perror("recv"); exit(EXIT_FAILURE); } - if (ioctl(fd, SIOCSIFADDR, &ifr6) == -1) { - perror("SIOCSIFADDR"); + if (res.err.error) { + fprintf(stderr, "RTM_NEWADDR: %s", strerror(-res.err.error)); + exit(EXIT_FAILURE); + } + + if (send(fd, &newlink_req, sizeof newlink_req, 0) == -1) { + perror("send"); + exit(EXIT_FAILURE); + } + + if (recv(fd, &res, sizeof res, 0) == -1) { + perror("recv"); + exit(EXIT_FAILURE); + } + + if (res.err.error) { + fprintf(stderr, "RTM_NEWLINK: %s", strerror(-res.err.error)); exit(EXIT_FAILURE); } @@ -61,11 +114,9 @@ static int setup_server(void) exit(EXIT_FAILURE); } - int tries = 0; - while (bind(fd, &addr, sizeof addr) == -1) { + if (bind(fd, &addr, sizeof addr) == -1) { perror("bind"); - if (tries++ >= 5) - exit(EXIT_FAILURE); + exit(EXIT_FAILURE); } if (listen(fd, 1) == -1) { base-commit: 77f8d28f076b16a64faef83c5cf374995770ff70 -- 2.51.0

2 1

[PATCH 0/4] Improve mount-flatpak
by Demi Marie Obenour 07 Jan '26

07 Jan '26

Patches 1 through 3 are all cleanups. Patch 4 adds a bunch of additional checks to improve error messages. It is also less clean code than the others. However, it is optional. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Demi Marie Obenour (4): tools: Use with_resolver_flags instead of mutation tools/mount-flatpak: Create utility function to open a subdirectory tools/mount-flatpak: Move more code to mount_commit() tools/mount-flatpak: Reasonableness checks on application IDs and paths tools/mount-flatpak/src/main.rs | 190 ++++++++++++++++++++++++++++------------ 1 file changed, 134 insertions(+), 56 deletions(-) --- base-commit: 92e219e7c08c479d216a46d2736ea9d229ff034d change-id: 20251202-better-mount-flatpak-cdf8db2ce7f4 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 7

dirlock: a tool to manage encrypted filesystems
by No Name 25 Dec '25

25 Dec '25

just thought yall would find this useful/interesting https://gitlab.steamos.cloud/holo/dirlock https://www.igalia.com/downloads/slides/albertogarcia-DirlockANewRustToolto… no name

1 0

[PATCH] host/rootfs: Sandbox Weston (almost) for real
by Demi Marie Obenour 16 Dec '25

16 Dec '25

The "almost" is because of the need for Weston to create /run/user/0/wayland-1. This can be fixed by passing the listening socket into Weston. Also Weston still runs as root and there is no seccomp filtering or MAC. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/image/etc/s6-rc/weston/run | 54 ++++++++++++++++++++++++++++++++-- 1 file changed, 52 insertions(+), 2 deletions(-) diff --git a/host/rootfs/image/etc/s6-rc/weston/run b/host/rootfs/image/etc/s6-rc/weston/run index 251f5da4597a916c4e46a0dfd64cec261d519d23..87579d1bddb4c191dda0c1659f88e74c178d13a1 100644 --- a/host/rootfs/image/etc/s6-rc/weston/run +++ b/host/rootfs/image/etc/s6-rc/weston/run @@ -18,5 +18,55 @@ redirfd -r 0 /dev/tty1 importas -i home HOME cd $home if { udevadm wait /dev/dri/card0 } -unshare --cgroup --ipc --net --uts -weston +bwrap + # no --unshare-net, breaks udev hotplug + --unshare-ipc + --unshare-uts + --unshare-cgroup + --cap-add CAP_SYS_TTY_CONFIG + --dev-bind /dev /dev + --bind /run /run + --ro-bind /etc /etc + --ro-bind /nix /nix + --ro-bind /usr /usr + --ro-bind /lib /lib + --ro-bind /bin /bin + --ro-bind /sbin /sbin + # For /run/seatd.sock + --tmpfs /run + # For OpenGL/Vulkan/etc + --ro-bind /run/opengl-driver /run/opengl-driver + # For udev + --ro-bind /run/udev /run/udev + --tmpfs /tmp + --tmpfs /dev/shm + # Filtered /proc (without nasty stuff) + --proc /proc + --ro-bind /proc/sys /proc/sys + --tmpfs /proc/scsi + --remount-ro /proc/scsi + --tmpfs /proc/acpi + --remount-ro /proc/acpi + --tmpfs /proc/fs + --remount-ro /proc/fs + --tmpfs /proc/irq + --remount-ro /proc/irq + --ro-bind /dev/null /proc/timer_list + --ro-bind /dev/null /proc/kcore + --ro-bind /dev/null /proc/kallsyms + --ro-bind /dev/null /proc/sysrq-trigger + --ro-bind /sys /sys + --dev /dev + # GPUs + --dev-bind /dev/dri /dev/dri + # Input devices + --dev-bind /dev/input /dev/input + # Virtual consoles + --dev-bind /dev/tty1 /dev/tty1 + --dev-bind /dev/tty0 /dev/tty0 + # Kernel console + --dev-bind /dev/console /dev/console + # So that Weston can create its listening socket + --bind /run/user/0 /run/user/0 + -- +/usr/bin/weston --- base-commit: 92e219e7c08c479d216a46d2736ea9d229ff034d change-id: 20251205-sandbox-weston-7bb8c5e0b55f -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[PATCH] release/update.nix: fix import of efi
by Alyssa Ross 16 Dec '25

16 Dec '25

import does not pass through custom configuration options. Fixes: 49f33a1 ("release: Create directory with system update") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- release/update.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/release/update.nix b/release/update.nix index 18a91ac..f6e7772 100644 --- a/release/update.nix +++ b/release/update.nix @@ -6,7 +6,7 @@ import ../lib/call-package.nix ( { callSpectrumPackage, config, runCommand, stdenv }: let - efi = import ../host/efi.nix {}; + efi = callSpectrumPackage ../host/efi.nix {}; in runCommand "spectrum-update-directory" { __structuredAttrs = true; base-commit: 6ceeb9b236cc50d2bba90068533ca1b7ff229c8b -- 2.51.0

3 2