- Spectrum Development - spectrum-os.org

Nixpkgs updates
by Yureka 09 Feb '26

09 Feb '26

My systems attempted to build a spectrum image against nixpkgs master last night, and failed because of pkgsMusl.netpbm and pkgsMusl.gdb, which are known blockers since the GCC 15 updates: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue%20state%3Aopen%20autho… - Yureka

3 2

[PATCH v2 0/5] Spectrum-installer
by Johannes Süllner 05 Feb '26

05 Feb '26

A custom graphical installer for Spectrum, written in Rust. It runs within the live system and uses 'systemd-repart'. The user selects a destination disk and confirms this selection. Then, 'systemd-repart' first creates a partition table on the destination disk and then copies the individual partitions of the live system to the destination disk, what means they are kind of resized in the process. This allows for having large A/B slots for Spectrum after the installation, while keeping the live image at the minimum size. The reason for writing a custom installer is that there are no image-based distributions using an installer that does not require an interpreter; something we want to avoid on the Spectrum host. There is a promising new installer in development for Gnome OS (https://gitlab.gnome.org/Teams/STF/setup) but it is still in an early stage and the actual installation is not implemented yet. Besides the boot partition and the A/B slots, the installer also creates a Btrfs home partition, taking up the remaining disk space. I included this for making it easier to test the update feature. There are a few things I still want to add to the installer at some future point. One thing is a check whether a possible destination device is suitable for a Spectrum installation, or e.g. too small. I currently plan to do so by running 'systemd-repart' in dry run mode on all possible devices on launch of the installer, what would need to be done asynchronously in a separate thread I think. Also, running 'systemd-repart' in an embedded terminal, as it's done right now, is something I'd like to change, as it feels somewhat hacky to me. v2: • Updated to iced v0.14 • Replaced the error log on the 'completion' page with a QR code containing the log. • Added the full discuss mailing list address to the error help message on the 'completion' page. • Added '-o pipefail' to shell call for 'systemd-repart' invocation. • Replaced 'lsblk' crate with 'blockdev' crate. • Wrapped usage of 'drives' crate in 'DestinationDevice'. • Replaced usage of 'libcosmicAppHook' in tools/spectrum-installer/default.nix • Updated tools/spectrum-installer/shell.nix • Updated cargo dependencies. • Removed fixed size of verity partition in release/live/Makefile • Added commit reverting the addition of the partition size parameter to make-gpt.sh v1: https://spectrum-os.org/lists/archives/spectrum-devel/20260104140102.106960… Signed-off-by: Johannes Süllner <johannes.suellner(a)mailbox.org> --- Johannes Süllner (5): tools: add spectrum-installer host/rootfs: integrate spectrum-installer release: drop combined and installer image release/live: remove B slot from live image and reduce Revert "scripts/make-gpt.sh: allow setting partition Documentation/development/uuid-reference.adoc | 22 - host/rootfs/default.nix | 4 +- host/rootfs/file-list.mk | 3 + .../spectrum-installer-as-root/notification-fd | 1 + .../notification-fd.license | 2 + .../service/spectrum-installer-as-root/run | 17 + host/rootfs/image/etc/s6-rc/weston/run | 1 + host/rootfs/image/etc/xdg/weston/weston.ini | 5 + .../image/usr/bin/spectrum-installer-as-root | 5 + pkgs/default.nix | 3 + release/checks/default.nix | 2 - release/checks/installer.nix | 16 - release/combined/default.nix | 123 - release/combined/eosimages.nix | 21 - release/combined/grub.cfg.in | 22 - release/combined/run-vm.nix | 31 - ...-disable-gpt-partition-attribute-55-check.patch | 37 - ...002-gpt-disable-partition-table-CRC-check.patch | 36 - .../app/0003-install-remove-Endless-OS-ad.patch | 99 - .../0004-finished-don-t-run-eos-diagnostics.patch | 44 - ...ed-promote-spectrum-not-the-Endless-forum.patch | 32 - release/installer/app/default.nix | 26 - release/installer/app/vendor-customer-support.ini | 5 - release/installer/configuration.nix | 69 - release/installer/default.nix | 22 - release/installer/run-vm.nix | 47 - release/installer/seat.rules | 9 - release/live/Makefile | 6 +- scripts/make-gpt.sh | 31 +- scripts/sfdisk-field.awk | 22 +- tools/spectrum-installer/Cargo.lock | 5182 ++++++++++++++++++++ tools/spectrum-installer/Cargo.lock.license | 2 + tools/spectrum-installer/Cargo.toml | 14 + tools/spectrum-installer/default.nix | 55 + .../spectrum-installer/res/installer_logo_mesh.svg | 85 + tools/spectrum-installer/res/repart.d/10-esp.conf | 8 + .../res/repart.d/20-verity-A.conf | 9 + .../res/repart.d/21-rootfs-A.conf | 9 + .../res/repart.d/30-verity-B.conf | 8 + .../res/repart.d/31-rootfs-B.conf | 8 + tools/spectrum-installer/res/repart.d/40-home.conf | 7 + tools/spectrum-installer/shell.nix | 28 + tools/spectrum-installer/src/destination_device.rs | 53 + tools/spectrum-installer/src/main.rs | 53 + tools/spectrum-installer/src/pages/completion.rs | 138 + tools/spectrum-installer/src/pages/confirmation.rs | 108 + .../spectrum-installer/src/pages/disk_selection.rs | 123 + tools/spectrum-installer/src/pages/installation.rs | 186 + tools/spectrum-installer/src/pages/layout.rs | 89 + tools/spectrum-installer/src/pages/mod.rs | 43 + tools/spectrum-installer/src/pages/welcome.rs | 62 + 51 files changed, 6328 insertions(+), 705 deletions(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/spectrum-installer-as-root/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/spectrum-installer-as-root/notification-fd.license create mode 100755 host/rootfs/image/etc/s6-linux-init/run-image/service/spectrum-installer-as-root/run create mode 100755 host/rootfs/image/usr/bin/spectrum-installer-as-root delete mode 100644 release/checks/installer.nix delete mode 100644 release/combined/default.nix delete mode 100644 release/combined/eosimages.nix delete mode 100644 release/combined/grub.cfg.in delete mode 100644 release/combined/run-vm.nix delete mode 100644 release/installer/app/0001-gpt-disable-gpt-partition-attribute-55-check.patch delete mode 100644 release/installer/app/0002-gpt-disable-partition-table-CRC-check.patch delete mode 100644 release/installer/app/0003-install-remove-Endless-OS-ad.patch delete mode 100644 release/installer/app/0004-finished-don-t-run-eos-diagnostics.patch delete mode 100644 release/installer/app/0005-finished-promote-spectrum-not-the-Endless-forum.patch delete mode 100644 release/installer/app/default.nix delete mode 100644 release/installer/app/vendor-customer-support.ini delete mode 100644 release/installer/configuration.nix delete mode 100644 release/installer/default.nix delete mode 100644 release/installer/run-vm.nix delete mode 100644 release/installer/seat.rules create mode 100644 tools/spectrum-installer/Cargo.lock create mode 100644 tools/spectrum-installer/Cargo.lock.license create mode 100644 tools/spectrum-installer/Cargo.toml create mode 100644 tools/spectrum-installer/default.nix create mode 100644 tools/spectrum-installer/res/installer_logo_mesh.svg create mode 100644 tools/spectrum-installer/res/repart.d/10-esp.conf create mode 100644 tools/spectrum-installer/res/repart.d/20-verity-A.conf create mode 100644 tools/spectrum-installer/res/repart.d/21-rootfs-A.conf create mode 100644 tools/spectrum-installer/res/repart.d/30-verity-B.conf create mode 100644 tools/spectrum-installer/res/repart.d/31-rootfs-B.conf create mode 100644 tools/spectrum-installer/res/repart.d/40-home.conf create mode 100644 tools/spectrum-installer/shell.nix create mode 100644 tools/spectrum-installer/src/destination_device.rs create mode 100644 tools/spectrum-installer/src/main.rs create mode 100644 tools/spectrum-installer/src/pages/completion.rs create mode 100644 tools/spectrum-installer/src/pages/confirmation.rs create mode 100644 tools/spectrum-installer/src/pages/disk_selection.rs create mode 100644 tools/spectrum-installer/src/pages/installation.rs create mode 100644 tools/spectrum-installer/src/pages/layout.rs create mode 100644 tools/spectrum-installer/src/pages/mod.rs create mode 100644 tools/spectrum-installer/src/pages/welcome.rs

2 7

[PATCH] Always use -W argument to execlineb
by Demi Marie Obenour 02 Feb '26

02 Feb '26

It's much better to fail if there is a problem than to silently have a bug, or worse a security hole. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/initramfs/etc/init | 2 +- host/initramfs/etc/probe | 2 +- host/rootfs/image/etc/init | 2 +- host/rootfs/image/etc/login | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty1/run | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty2/run | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty3/run | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty4/run | 2 +- .../etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/s6-svscan-log/run | 2 +- .../etc/s6-linux-init/run-image/service/serial-getty-generator/run | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/run | 2 +- .../image/etc/s6-linux-init/run-image/service/serial-getty/template/run | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/run | 2 +- .../run-image/service/vm-services/template/data/service/dbus/run | 2 +- .../service/vm-services/template/data/service/spectrum-router/run | 2 +- .../service/vm-services/template/data/service/vhost-user-fs/run | 2 +- .../service/vm-services/template/data/service/vhost-user-gpu/run | 2 +- .../template/data/service/xdg-desktop-portal-spectrum-host/run | 2 +- .../image/etc/s6-linux-init/run-image/service/vm-services/template/run | 2 +- host/rootfs/image/etc/s6-linux-init/run-image/service/vmm/run | 2 +- host/rootfs/image/etc/s6-linux-init/scripts/rc.init | 2 +- host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown | 2 +- host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final | 2 +- host/rootfs/image/etc/s6-rc/systemd-udevd/run | 2 +- host/rootfs/image/etc/s6-rc/weston/run | 2 +- host/rootfs/image/etc/xdg/weston/autolaunch | 2 +- host/rootfs/image/usr/bin/assign-devices | 2 +- host/rootfs/image/usr/bin/create-vm-dependencies | 2 +- host/rootfs/image/usr/bin/run-appimage | 2 +- host/rootfs/image/usr/bin/run-vmm | 2 +- host/rootfs/image/usr/bin/vm-console | 2 +- host/rootfs/image/usr/bin/vm-import | 2 +- host/rootfs/image/usr/bin/vm-start | 2 +- host/rootfs/image/usr/bin/vm-stop | 2 +- host/rootfs/image/usr/bin/xdg-open | 2 +- host/rootfs/image/usr/libexec/net-add | 2 +- img/app/image/etc/mdev/iface | 2 +- img/app/image/etc/mdev/listen | 2 +- img/app/image/etc/mdev/virtiofs | 2 +- img/app/image/etc/mdev/wait | 2 +- img/app/image/etc/s6-linux-init/run-image/service/getty-hvc0/run | 2 +- .../etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run | 2 +- img/app/image/etc/s6-linux-init/scripts/rc.init | 2 +- img/app/image/etc/s6-linux-init/scripts/rc.shutdown | 2 +- img/app/image/etc/s6-linux-init/scripts/rc.shutdown.final | 2 +- img/app/image/etc/s6-rc/app/run | 2 +- img/app/image/etc/s6-rc/dbus-vsock/run | 2 +- img/app/image/etc/s6-rc/dbus/run | 2 +- img/app/image/etc/s6-rc/mdevd/run | 2 +- img/app/image/etc/s6-rc/pipewire/run | 2 +- img/app/image/etc/s6-rc/wayland-proxy-virtwl/run | 2 +- img/app/image/etc/s6-rc/wireplumber/run | 2 +- img/app/image/usr/bin/init | 2 +- img/app/scripts/start-virtiofsd.elb | 2 +- release/checks/integration/default.nix | 2 +- scripts/start-passt.elb | 2 +- scripts/with-taps.elb | 2 +- vm/app/gnome-text-editor.nix | 2 +- vm/sys/net/image/etc/init | 2 +- vm/sys/net/image/etc/mdev/iface | 2 +- vm/sys/net/image/etc/s6-linux-init/run-image/service/getty-hvc0/run | 2 +- vm/sys/net/image/etc/s6-linux-init/scripts/rc.init | 2 +- vm/sys/net/image/etc/s6-rc/dbus/run | 2 +- vm/sys/net/image/etc/s6-rc/mdevd/run | 2 +- 65 files changed, 65 insertions(+), 65 deletions(-) diff --git a/host/initramfs/etc/init b/host/initramfs/etc/init index 719488741b6d31564c2c17c0e41f15d16b1c0a08..f97d8616c82d7b26b27ab5444db87e51e74c654e 100755 --- a/host/initramfs/etc/init +++ b/host/initramfs/etc/init @@ -1,4 +1,4 @@ -#!/bin/execlineb -S0 +#!/bin/execlineb -WS0 # SPDX-FileCopyrightText: 2021-2022 Alyssa Ross <hi(a)alyssa.is> # SPDX-License-Identifier: EUPL-1.2+ diff --git a/host/initramfs/etc/probe b/host/initramfs/etc/probe index 013092b6dcc5b82db7302c1ae7e6d8a4f5a0b802..f1883890b447688e804f71baec978234493dcd92 100755 --- a/host/initramfs/etc/probe +++ b/host/initramfs/etc/probe @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/init b/host/rootfs/image/etc/init index 4085fa55545e7309004967e443e47fc2b82b0663..315e3b527508bda94c3092f97c0f5c033a30afd0 100755 --- a/host/rootfs/image/etc/init +++ b/host/rootfs/image/etc/init @@ -1,4 +1,4 @@ -#!/bin/execlineb -s0 +#!/bin/execlineb -Ws0 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/login b/host/rootfs/image/etc/login index 34ff3212fa644cfb6d0bfd8362be6a58b7fcaf12..0cf144dcfa6f011d1325ca04089f16d2889d70be 100755 --- a/host/rootfs/image/etc/login +++ b/host/rootfs/image/etc/login @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty1/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty1/run index 1ce0766c79b4afc038fbf3ea9bb777046226498b..c893c481f11a46dff9db808787c839b448064956 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty1/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty1/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty2/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty2/run index e619191005a47ddb8bf0ef68d304d8cf045d717a..4d2cd7172e887e90d9ce87489cdacf41e51f77e8 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty2/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty2/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty3/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty3/run index e3e0634ed011f4033b8546214b230c569458271b..06abf5422365ff4edc9379e5cbcab716e6830399 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty3/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty3/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty4/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty4/run index 9e1d46d2df934123e0469beddb218ee3fe90c6bc..3dd235fc93d403fc8971e923ec62cb025684b67a 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty4/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/getty-tty4/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run index 228fc6a9f7f28f5226f46645f38f51b29a8a4580..327f4ccc5056e7ef87c089e666090307845cae3a 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-svscan-log/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-svscan-log/run index 8cc08c4c1932da13372778d0ebddfe2d75b1fab5..8f7bd889e50d76a49b98d8ba9e2c6172f287277c 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-svscan-log/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-svscan-log/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: ISC # SPDX-FileCopyrightText: Copyright (c) 2015-2024 Laurent Bercot <ska-skaware(a)skarnet.org> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty-generator/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty-generator/run index 8c1e2afab65c29cb2f067f9b5fd7e72f0e1404c0..8126869defb046bb0a2de6a8da625dbd1e52564f 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty-generator/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty-generator/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/run index 90417881eb43052aa5ea0afa3010706fb6f25a91..78f794202bf174f3c036f3e20755ac087a988277 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/template/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/template/run index da46511e8a28ecdbda0de762a19d6cf2f38a22a7..f3ed9a7f08e60206afd222f4fc02c5fb19527561 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/template/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/serial-getty/template/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021, 2024 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/run index 90417881eb43052aa5ea0afa3010706fb6f25a91..78f794202bf174f3c036f3e20755ac087a988277 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run index 13c7e95a0fc0e71b8c72cf9e432d10742cd8e2ef..47ba40683f9e5d341ccfa7a689320ed01184f4d2 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run index e15e5c793577df2b1b2fc56e8fe1685f3f150b6e..03092aa4c6e64018973f1623341199f11479c582 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run index 6bd69ad944a464294ad9a3268c8a63482c7e8040..602088fcf3b70660197e50540bb8e5e6eb8e865e 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run index 19d5a61388e6f49c7f722814d6de47227b02da01..5728791c35c1af9a9e4f2d56460721c8ee952f46 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run index dff1f81184033282f4c99969028d9d4c617e5850..0bb5e2751af9a2ae891166640e41ceae1054029a 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/run index e171f00dc5c0377c086c2304adb7e9b90d641194..1aab64dd73755a9ec61720027db9916a9dd3cf0c 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vmm/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vmm/run index 90417881eb43052aa5ea0afa3010706fb6f25a91..78f794202bf174f3c036f3e20755ac087a988277 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vmm/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vmm/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/scripts/rc.init b/host/rootfs/image/etc/s6-linux-init/scripts/rc.init index 37b293d474013b0f94c83a931af16fb23c11315b..f638e373589884acb959c868462fdf532380a851 100755 --- a/host/rootfs/image/etc/s6-linux-init/scripts/rc.init +++ b/host/rootfs/image/etc/s6-linux-init/scripts/rc.init @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2022, 2024 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown index 3b09c02dc5866e8e24284b29d4156bec0412a9f2..67602d6ba2d9a63fe2ec1967c7834d032dc5ed66 100755 --- a/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown +++ b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final index 7f48a65f1fbcfe435132394323730a27b172cb2e..2be3b8653a60c1fc749fbd3f06c5c84ed5ec5595 100755 --- a/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final +++ b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final @@ -1,3 +1,3 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run index 2d28d027f2bc787f0d4da21a112289c7b97929fa..aec6444e951503eae988e666b77fda8f2ae33d72 100644 --- a/host/rootfs/image/etc/s6-rc/systemd-udevd/run +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> s6-setlock /run/sd-notify-wrapper/systemd-udevd.lock diff --git a/host/rootfs/image/etc/s6-rc/weston/run b/host/rootfs/image/etc/s6-rc/weston/run index 251f5da4597a916c4e46a0dfd64cec261d519d23..ca7b7265b4cc331239af0792ceec8ab58e443dff 100644 --- a/host/rootfs/image/etc/s6-rc/weston/run +++ b/host/rootfs/image/etc/s6-rc/weston/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/xdg/weston/autolaunch b/host/rootfs/image/etc/xdg/weston/autolaunch index 7a85ae1ee3267fc968cf4948cd590337d67553a4..196c137769d3547a6ed5246d3bd1e85c9662efb6 100755 --- a/host/rootfs/image/etc/xdg/weston/autolaunch +++ b/host/rootfs/image/etc/xdg/weston/autolaunch @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/assign-devices b/host/rootfs/image/usr/bin/assign-devices index 58dd3cc0dfc3ceec4c82988755ed1ddbd224abfd..1c5ee8749e9880c88d346ee616163fb6b264f65f 100755 --- a/host/rootfs/image/usr/bin/assign-devices +++ b/host/rootfs/image/usr/bin/assign-devices @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/create-vm-dependencies b/host/rootfs/image/usr/bin/create-vm-dependencies index 8fb9f3ad859dddf212a67c0f05b079a5c414777c..1f7d63f47f71c3261dba4a6c8bfddde0dccf40bf 100755 --- a/host/rootfs/image/usr/bin/create-vm-dependencies +++ b/host/rootfs/image/usr/bin/create-vm-dependencies @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/run-appimage b/host/rootfs/image/usr/bin/run-appimage index f2fe7bc246b75ad4eb2d10613db250787a58046d..c121e635f0012fbc653d1cc40d872c75316d050d 100755 --- a/host/rootfs/image/usr/bin/run-appimage +++ b/host/rootfs/image/usr/bin/run-appimage @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm index ba8b59c2677408acdd01c2eda3cf2dd60992d881..52fbf37d3f46123c94422e7eaf39b64e7538daca 100755 --- a/host/rootfs/image/usr/bin/run-vmm +++ b/host/rootfs/image/usr/bin/run-vmm @@ -1,4 +1,4 @@ -#!/bin/execlineb -s0 +#!/bin/execlineb -Ws0 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/vm-console b/host/rootfs/image/usr/bin/vm-console index a0f5bbf1a3d25d3891fd47e8ba7c65e7ed91be33..27caccaab53c5be42646dd27acfaf1b463e585bd 100755 --- a/host/rootfs/image/usr/bin/vm-console +++ b/host/rootfs/image/usr/bin/vm-console @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021-2022 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/vm-import b/host/rootfs/image/usr/bin/vm-import index c1d1bbc106b8034c82c8e09c1bff81a06c233fe4..239af0b7c5806d364a5276c8aa3b56c07b5916e6 100755 --- a/host/rootfs/image/usr/bin/vm-import +++ b/host/rootfs/image/usr/bin/vm-import @@ -1,4 +1,4 @@ -#!/bin/execlineb -S2 +#!/bin/execlineb -WS2 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/vm-start b/host/rootfs/image/usr/bin/vm-start index 67480e5215d8a8260ce3f03c67f71ba8f210c291..379b32e83ce039f35555b7924c895bd3a02c4430 100755 --- a/host/rootfs/image/usr/bin/vm-start +++ b/host/rootfs/image/usr/bin/vm-start @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/vm-stop b/host/rootfs/image/usr/bin/vm-stop index 4c36be19dabad7c2671381aed87179b174ad9bbb..6fb6aaed46de684eb035243e4f7c79111e93bf8c 100755 --- a/host/rootfs/image/usr/bin/vm-stop +++ b/host/rootfs/image/usr/bin/vm-stop @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/bin/xdg-open b/host/rootfs/image/usr/bin/xdg-open index f0e93bc935b420f526ad004a96084830d9815bf0..4a4a118bfea249330ba23a74cab79a799e0ae070 100755 --- a/host/rootfs/image/usr/bin/xdg-open +++ b/host/rootfs/image/usr/bin/xdg-open @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2024 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/usr/libexec/net-add b/host/rootfs/image/usr/libexec/net-add index 2743b71d04be1471d531d9e51d783b98afd72a77..361f1e9063b75e8d0f4e296380f56fa8d7d930fb 100755 --- a/host/rootfs/image/usr/libexec/net-add +++ b/host/rootfs/image/usr/libexec/net-add @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021, 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/mdev/iface b/img/app/image/etc/mdev/iface index 1d81f2af0d68e62d34b975cc006b623cf3064c86..67eee84f07cc9ddbdaccf407eb40162398e277a9 100755 --- a/img/app/image/etc/mdev/iface +++ b/img/app/image/etc/mdev/iface @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2022, 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/mdev/listen b/img/app/image/etc/mdev/listen index ab50ee8c5ed1139d1129bac56afa7263af150745..932c380d68870ae83460f94621498bb80cefe20b 100755 --- a/img/app/image/etc/mdev/listen +++ b/img/app/image/etc/mdev/listen @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs index c1fd2834a1375676b94c6d25f0ed85202a466956..c35b20b858d96bfdebdef33afcc5b0ba25856ab7 100755 --- a/img/app/image/etc/mdev/virtiofs +++ b/img/app/image/etc/mdev/virtiofs @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022-2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/mdev/wait b/img/app/image/etc/mdev/wait index 6bddb303d2671ce4e5b8581cd81235d7404916e7..7b66810a6338b7ce67d058f81d0202109d903aac 100755 --- a/img/app/image/etc/mdev/wait +++ b/img/app/image/etc/mdev/wait @@ -1,4 +1,4 @@ -#!/bin/execlineb -S1 +#!/bin/execlineb -WS1 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-linux-init/run-image/service/getty-hvc0/run b/img/app/image/etc/s6-linux-init/run-image/service/getty-hvc0/run index 09fd0771a24ddad2e599ef170fd795891399e4e1..ecc689217a0eaf19ac8fae90db58af502db4aecb 100755 --- a/img/app/image/etc/s6-linux-init/run-image/service/getty-hvc0/run +++ b/img/app/image/etc/s6-linux-init/run-image/service/getty-hvc0/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run b/img/app/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run index 228fc6a9f7f28f5226f46645f38f51b29a8a4580..327f4ccc5056e7ef87c089e666090307845cae3a 100755 --- a/img/app/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run +++ b/img/app/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-linux-init/scripts/rc.init b/img/app/image/etc/s6-linux-init/scripts/rc.init index 762081f48ad8e69f8f1eab6e9da34f5a641fe70f..fcececa2db98f490882eaedda2b44eb84f7faa4d 100755 --- a/img/app/image/etc/s6-linux-init/scripts/rc.init +++ b/img/app/image/etc/s6-linux-init/scripts/rc.init @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2022 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/img/app/image/etc/s6-linux-init/scripts/rc.shutdown b/img/app/image/etc/s6-linux-init/scripts/rc.shutdown index 3b09c02dc5866e8e24284b29d4156bec0412a9f2..67602d6ba2d9a63fe2ec1967c7834d032dc5ed66 100755 --- a/img/app/image/etc/s6-linux-init/scripts/rc.shutdown +++ b/img/app/image/etc/s6-linux-init/scripts/rc.shutdown @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-linux-init/scripts/rc.shutdown.final b/img/app/image/etc/s6-linux-init/scripts/rc.shutdown.final index 7f48a65f1fbcfe435132394323730a27b172cb2e..2be3b8653a60c1fc749fbd3f06c5c84ed5ec5595 100755 --- a/img/app/image/etc/s6-linux-init/scripts/rc.shutdown.final +++ b/img/app/image/etc/s6-linux-init/scripts/rc.shutdown.final @@ -1,3 +1,3 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/app/run index e05d4fe4bf67bbc4d550a7f0fde941add45d298f..92aa013108cb2796ddbfd811bc3b265d57ece27b 100755 --- a/img/app/image/etc/s6-rc/app/run +++ b/img/app/image/etc/s6-rc/app/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021, 2024-2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-rc/dbus-vsock/run b/img/app/image/etc/s6-rc/dbus-vsock/run index 4733bae5ced206b8a5a3460a641d01af739a19b4..05b6eaff8baf55f0e437b27365b23f0219f3ea97 100755 --- a/img/app/image/etc/s6-rc/dbus-vsock/run +++ b/img/app/image/etc/s6-rc/dbus-vsock/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-rc/dbus/run b/img/app/image/etc/s6-rc/dbus/run index 031d730a6e0e311b8e0e6b8119a77bdfa9c1f423..73f5de35c0b15924768cfdb01179bd198e9ab059 100644 --- a/img/app/image/etc/s6-rc/dbus/run +++ b/img/app/image/etc/s6-rc/dbus/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023, 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-rc/mdevd/run b/img/app/image/etc/s6-rc/mdevd/run index 6dacb132862a48a0cc91edbcdea44b41c7327368..c476e5f73dacad1729ee59bcfeafe49ace58441f 100644 --- a/img/app/image/etc/s6-rc/mdevd/run +++ b/img/app/image/etc/s6-rc/mdevd/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/image/etc/s6-rc/pipewire/run b/img/app/image/etc/s6-rc/pipewire/run index 3925f0871502504e7cde118302b30355b27f88d2..a36c7b4fd0c555d9e3147db9b6e8a04a18dbd789 100644 --- a/img/app/image/etc/s6-rc/pipewire/run +++ b/img/app/image/etc/s6-rc/pipewire/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023-2025 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run b/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run index 86d7f639ad1a98073403295f6a3977dc4747faa0..7fa9d82c51a045305e27c188499773d51199b4bb 100755 --- a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run +++ b/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> # diff --git a/img/app/image/etc/s6-rc/wireplumber/run b/img/app/image/etc/s6-rc/wireplumber/run index a514c401beeeb8440b1b9a8db7f6261e9f4018fd..34cd7723e793b7a7cb0cdbd8f0d9d9c1209fbae2 100644 --- a/img/app/image/etc/s6-rc/wireplumber/run +++ b/img/app/image/etc/s6-rc/wireplumber/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/img/app/image/usr/bin/init b/img/app/image/usr/bin/init index aca6efa2b74d3872f123cfac13410ae9e81f905c..1f24ba57f9c5f196fdec74ca82a1f8586b73540f 100755 --- a/img/app/image/usr/bin/init +++ b/img/app/image/usr/bin/init @@ -1,4 +1,4 @@ -#!/bin/execlineb -s0 +#!/bin/execlineb -Ws0 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022, 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb index e4d265f047d51370cad5ff0ce4c8207e78f8b171..ce1a5cfaafb660e9ac2fd6b1a50c6e76f9c36bd8 100755 --- a/img/app/scripts/start-virtiofsd.elb +++ b/img/app/scripts/start-virtiofsd.elb @@ -1,4 +1,4 @@ -#!/usr/bin/env execlineb +#!/usr/bin/env -S execlineb -W # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022, 2024 Alyssa Ross <hi(a)alyssa.is> diff --git a/release/checks/integration/default.nix b/release/checks/integration/default.nix index f8aab8aa5b872475e916059362a9011340974d53..ca7b395418ef5c1ef766b18833038f4ebdd5d64c 100644 --- a/release/checks/integration/default.nix +++ b/release/checks/integration/default.nix @@ -10,7 +10,7 @@ let live = callSpectrumPackage ../../live {}; appimage = writeShellScript "test.appimage" '' - #!/bin/execlineb -P + #!/bin/execlineb -WP echo hello world ''; diff --git a/scripts/start-passt.elb b/scripts/start-passt.elb index f2c53f184d7f82c1741ced1a3ec08c75d78bc2cd..2df4cff53bbcf7a6a1c2e01ecc12e5826009082e 100755 --- a/scripts/start-passt.elb +++ b/scripts/start-passt.elb @@ -1,4 +1,4 @@ -#!/usr/bin/env execlineb +#!/usr/bin/env -S execlineb -W # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/scripts/with-taps.elb b/scripts/with-taps.elb index 82725ff599b8227d1d0d42d09cdacdd4b46d0344..7be9385520a95c8649843e3bab00e4f36d600641 100755 --- a/scripts/with-taps.elb +++ b/scripts/with-taps.elb @@ -1,4 +1,4 @@ -#!/usr/bin/env execlineb +#!/usr/bin/env -S execlineb -W # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/vm/app/gnome-text-editor.nix b/vm/app/gnome-text-editor.nix index 63f01f0d992bc1ce2679d12cff82bfa4596f5046..bd15fe5b22fba6e947449dc7378389e644d0305d 100644 --- a/vm/app/gnome-text-editor.nix +++ b/vm/app/gnome-text-editor.nix @@ -7,7 +7,7 @@ import ../../lib/call-package.nix ( callSpectrumPackage ../make-vm.nix {} { type = "nix"; run = writeScript "run-gnome-text-editor" '' - #!/bin/execlineb -P + #!/bin/execlineb -WP export GDK_DEBUG portals ${lib.getExe gnome-text-editor} ''; diff --git a/vm/sys/net/image/etc/init b/vm/sys/net/image/etc/init index 6424e221e0fb929e107271bd52b61706b9f1855e..7a1ccab51c840153ef43555cee0c5ca5d89a4775 100755 --- a/vm/sys/net/image/etc/init +++ b/vm/sys/net/image/etc/init @@ -1,4 +1,4 @@ -#!/bin/execlineb -s0 +#!/bin/execlineb -Ws0 # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022 Alyssa Ross <hi(a)alyssa.is> diff --git a/vm/sys/net/image/etc/mdev/iface b/vm/sys/net/image/etc/mdev/iface index da45ce92fd4034ebd16a0b7255bc61474716e41e..14ab140d174a913fea0f498d4531caeed434851a 100755 --- a/vm/sys/net/image/etc/mdev/iface +++ b/vm/sys/net/image/etc/mdev/iface @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> diff --git a/vm/sys/net/image/etc/s6-linux-init/run-image/service/getty-hvc0/run b/vm/sys/net/image/etc/s6-linux-init/run-image/service/getty-hvc0/run index a919fbe0d5719260599c76becfcba48880d56f83..850db9e7a0a8f077e4770b221761455930d96243 100755 --- a/vm/sys/net/image/etc/s6-linux-init/run-image/service/getty-hvc0/run +++ b/vm/sys/net/image/etc/s6-linux-init/run-image/service/getty-hvc0/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> diff --git a/vm/sys/net/image/etc/s6-linux-init/scripts/rc.init b/vm/sys/net/image/etc/s6-linux-init/scripts/rc.init index 4378400b0b34f12bfa6a994029546f9c38058d10..aa3d5bfcd786c594d0989e4a4ab54ee5845801cd 100755 --- a/vm/sys/net/image/etc/s6-linux-init/scripts/rc.init +++ b/vm/sys/net/image/etc/s6-linux-init/scripts/rc.init @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2022 Alyssa Ross <hi(a)alyssa.is> diff --git a/vm/sys/net/image/etc/s6-rc/dbus/run b/vm/sys/net/image/etc/s6-rc/dbus/run index 6e88e808552f4b391ee77046eef85bb18e029484..cae9868f0bfde0c9b23175b0dc667e899ab889a9 100644 --- a/vm/sys/net/image/etc/s6-rc/dbus/run +++ b/vm/sys/net/image/etc/s6-rc/dbus/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/vm/sys/net/image/etc/s6-rc/mdevd/run b/vm/sys/net/image/etc/s6-rc/mdevd/run index 6dacb132862a48a0cc91edbcdea44b41c7327368..c476e5f73dacad1729ee59bcfeafe49ace58441f 100644 --- a/vm/sys/net/image/etc/s6-rc/mdevd/run +++ b/vm/sys/net/image/etc/s6-rc/mdevd/run @@ -1,4 +1,4 @@ -#!/bin/execlineb -P +#!/bin/execlineb -WP # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> --- base-commit: a13d3403c1ddbb8dbbbdb05416350b2846162ed1 change-id: 20251203-execlineb-always-w-2ded1fea98d6 -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[PATCH] host/rootfs: Always fail if there is a globbing problem
by Demi Marie Obenour 02 Feb '26

02 Feb '26

Better to fail than to continue after an unknown problem has happened. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/image/etc/s6-rc/static-nodes/up | 2 +- host/rootfs/image/usr/bin/assign-devices | 2 +- host/rootfs/image/usr/bin/run-vmm | 2 +- host/rootfs/image/usr/bin/vm-import | 2 +- host/rootfs/image/usr/bin/vm-start | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/host/rootfs/image/etc/s6-rc/static-nodes/up b/host/rootfs/image/etc/s6-rc/static-nodes/up index e1bdd4061441b39d7b46575a05754331970b951e..66f4fa7954beffc201f0985b3be10bd6a98f1d3a 100644 --- a/host/rootfs/image/etc/s6-rc/static-nodes/up +++ b/host/rootfs/image/etc/s6-rc/static-nodes/up @@ -2,7 +2,7 @@ # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> pipeline { - elglob -0 modules_devname /lib/modules/*/modules.devname + elglob -w0 modules_devname /lib/modules/*/modules.devname /etc/parse-devname $modules_devname } diff --git a/host/rootfs/image/usr/bin/assign-devices b/host/rootfs/image/usr/bin/assign-devices index 58dd3cc0dfc3ceec4c82988755ed1ddbd224abfd..99988d64dbf2802cdbfd69c299f899ccbc1cf390 100755 --- a/host/rootfs/image/usr/bin/assign-devices +++ b/host/rootfs/image/usr/bin/assign-devices @@ -2,7 +2,7 @@ # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> -elglob -0 devices /sys/bus/pci/drivers/vfio-pci/????:??:??.? +elglob -w0 devices /sys/bus/pci/drivers/vfio-pci/????:??:??.? forx -pE device { $devices } # This script is designed to be re-entrant and called multiple times. diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm index ba8b59c2677408acdd01c2eda3cf2dd60992d881..1a09c93bd1ac121c72f8132393979bf03663f1c2 100755 --- a/host/rootfs/image/usr/bin/run-vmm +++ b/host/rootfs/image/usr/bin/run-vmm @@ -22,7 +22,7 @@ background -d { # Find any net-provider relationships this VM is involved in cd /run/vm/by-id - elglob -0 providers */config/providers/net/* + elglob -w0 providers */config/providers/net/* forx -pE path { $providers } backtick -E client_id { awk -v path=${path} -F / "BEGIN { split(path, p); print p[1] }" diff --git a/host/rootfs/image/usr/bin/vm-import b/host/rootfs/image/usr/bin/vm-import index c1d1bbc106b8034c82c8e09c1bff81a06c233fe4..06f90d83509c318bc364d9c0e111878235ae50d3 100755 --- a/host/rootfs/image/usr/bin/vm-import +++ b/host/rootfs/image/usr/bin/vm-import @@ -3,7 +3,7 @@ # SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> cd $2 -elglob -0 names * +elglob -w0 names * forx -po0 -E name { $names } diff --git a/host/rootfs/image/usr/bin/vm-start b/host/rootfs/image/usr/bin/vm-start index 67480e5215d8a8260ce3f03c67f71ba8f210c291..94d08437b75f59a728be0e8a1efbc5af3b44f6c5 100755 --- a/host/rootfs/image/usr/bin/vm-start +++ b/host/rootfs/image/usr/bin/vm-start @@ -7,7 +7,7 @@ foreground { s6-rc -bu change vm-env } foreground { redirfd -w 2 /dev/null cd /run/vm/by-id/${1}/config/providers/net - elglob -0 providers * + elglob -w0 providers * forx -pE provider { $providers } backtick -E provider_id { backtick -E id_path { readlink /run/vm/by-name/${provider} } --- base-commit: 92e219e7c08c479d216a46d2736ea9d229ff034d change-id: 20251203-globfail-41a5db0de497 -- Sincerely, Demi Marie Obenour (she/her/hers)

2 3

[PATCH www] Fix outdated links to external websites
by Johannes Süllner 02 Feb '26

02 Feb '26

The website of hazelnot has been offline since over 1 year, so remove the link. The documentation of Salt and Qubes moved to new locations. Signed-off-by: Johannes Süllner <johannes.suellner(a)mailbox.org> --- logo/index.html | 3 +-- motivation.html | 8 ++++---- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/logo/index.html b/logo/index.html index dd3ef31..f13c622 100644 --- a/logo/index.html +++ b/logo/index.html @@ -27,8 +27,7 @@ <img class="no-logo" srcset="logo400.png 400w" src="logo200.png" alt="" width="200" height="200" style="margin: 0 auto" loading="lazy" hidden> <p> -The Spectrum logo was designed -by <a href="https://hazelnot.xyz/">hazelnot</a>, and is released under +The Spectrum logo was designed by hazelnot, and is released under the <a href="https://creativecommons.org/publicdomain/zero/1.0/">Creative Commons Zero</a> license. diff --git a/motivation.html b/motivation.html index d38d410..beaae30 100644 --- a/motivation.html +++ b/motivation.html @@ -94,8 +94,8 @@ Qubes, however they are often hampered by usability issues: <li><p> Maintaining many different TemplateVMs with persistent state is difficult. (Qubes - can <a href="https://www.qubes-os.org/doc/salt/">use</a> - <a href="https://docs.saltstack.com/en/latest/">Salt</a> + can <a href="https://doc.qubes-os.org/en/latest/user/advanced-topics/salt.html">use</a> + <a href="https://docs.saltproject.io/en/latest/contents.html">Salt</a> to mitigate this.) </ul> @@ -104,10 +104,10 @@ Qubes, however they are often hampered by usability issues: It is important to note, however, that the Qubes developers have created utilities for using compartmentalized environments that could be very useful to other implementations. For example, -Qubes <a href="https://www.qubes-os.org/doc/copy-paste/">allows</a> +Qubes <a href="https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-copy-and-paste…">allows</a> clipboard data to be safely shared between isolated environments with explicit user action on both ends, -and <a href="https://www.qubes-os.org/doc/split-gpg/">Qubes Split +and <a href="https://doc.qubes-os.org/en/latest/user/security-in-qubes/split-gpg.html">Qubes Split GPG</a> allows one environment to perform operations using a GPG key stored in another environment, with permission granted on a per-operation basis. -- 2.51.2

2 1

[PATCH www] impressum: fix broken relative paths in subdirectories
by Angel J 02 Feb '26

02 Feb '26

Signed-off-by: Angel J <iamanaws(a)httpd.dev> --- logo/index.html | 2 +- software/cloud-hypervisor/index.html | 2 +- software/index.html | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/logo/index.html b/logo/index.html index 0750053..2471cf9 100644 --- a/logo/index.html +++ b/logo/index.html @@ -61,4 +61,4 @@ by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.</small> <p> -<a href="impressum.html" lang="de"><small>Impressum</small></a> +<a href="../impressum.html" lang="de"><small>Impressum</small></a> diff --git a/software/cloud-hypervisor/index.html b/software/cloud-hypervisor/index.html index 2fef585..0bda4a7 100644 --- a/software/cloud-hypervisor/index.html +++ b/software/cloud-hypervisor/index.html @@ -177,4 +177,4 @@ by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.</small> <p> -<a href="impressum.html" lang="de"><small>Impressum</small></a> +<a href="../../impressum.html" lang="de"><small>Impressum</small></a> diff --git a/software/index.html b/software/index.html index a05e177..2a8a852 100644 --- a/software/index.html +++ b/software/index.html @@ -38,4 +38,4 @@ by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.</small> <p> -<a href="impressum.html" lang="de"><small>Impressum</small></a> +<a href="../impressum.html" lang="de"><small>Impressum</small></a> -- 2.51.2

4 5

[PATCH] GPU acceleration
by Demi Marie Obenour 02 Feb '26

02 Feb '26

This exposes GPU acceleration to VMs via virtio-GPU native contexts on AMD and Qualcomm GPUs. Apple GPU support also exists but might require patches to virglrenderer that are not upstream yet. On a system with an AMD GPU, this has been tested by running vkcube in the VM. It reports that the AMD GPU is being used for rendering. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- I used an empty string for the hashes in 'gitfetch' and 'buildRustPackage'. This is, of course, incorrect. The correct value according to my own testing is "sha256-EOMkQ0aPRjsowdGuZjy5K1yKyKEzd5AVYxaECTz7n6k=" (git hash) and "sha256-k3dmxIuCQoOrn/VwauTdzuRw/XKQB6LPLgO5ql0rE7E=" (cargoHash). However, these should be validated before applying them, which is why I didn't include them in the patch themselves. This is a security precaution: anyone who wants to inject malicious content must serve it to multiple people, not just one. --- .../template/data/service/vhost-user-gpu/run | 2 +- img/app/Makefile | 2 +- img/app/default.nix | 14 ++++++++++++-- img/app/image/etc/mdev.conf | 1 + .../notification-fd | 0 .../notification-fd.license | 0 .../{wayland-proxy-virtwl => wl-cross-domain-proxy}/run | 17 +++++------------ .../type | 0 .../type.license | 0 9 files changed, 20 insertions(+), 16 deletions(-) diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run index fb9ac9971aef82dabe0b54c1299ac8c66d133eb5..87d72f55e293ea81b6f4aa12786a993bafc623e2 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run @@ -42,4 +42,4 @@ bwrap crosvm --no-syslog device gpu --fd 0 --wayland-sock $WAYLAND_DISPLAY - --params "{\"context-types\":\"cross-domain\"}" + --params "{\"context-types\":\"cross-domain:drm\"}" diff --git a/img/app/Makefile b/img/app/Makefile index 2e720a91b4cc98a780aae90435f018ba2dd2d965..d34bcf2604d43eaa55d9100711374eba689bfdce 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -77,7 +77,7 @@ start-vhost-user-gpu: $(CROSVM_DEVICE_GPU) \ --socket build/vhost-user-gpu.sock \ --wayland-sock "$$XDG_RUNTIME_DIR/$$WAYLAND_DISPLAY" \ - --params '{"context-types":"cross-domain"}' & + --params '{"context-types":"cross-domain:drm"}' & while ! [ -S build/vhost-user-gpu.sock ] && sleep .1; do :; done .PHONY: start-vhost-user-gpu diff --git a/img/app/default.nix b/img/app/default.nix index 71e6fa02e78553d027d59f5b2ff728830276d480..1ce32258edf3f0ae535e050745e60d1d193a838e 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -5,10 +5,20 @@ import ../../lib/call-package.nix ( { spectrum-app-tools, spectrum-build-tools, src, terminfo , lib, appimageTools, buildFHSEnv, runCommand, stdenvNoCC, writeClosure , erofs-utils, jq, s6-rc, util-linux, xorg -, cacert, linux_latest +, cacert, linux_latest, rustPlatform, fetchgit }: let + wl-cross-domain-proxy = rustPlatform.buildRustPackage rec { + pname = "wl-cross-domain-proxy"; + version = "0.0.0"; + src = fetchgit { + url = "https://codeberg.org/drakulix/wl-cross-domain-proxy"; + rev = "167b5ade788d297cd19929c2f367484a09a87316"; + hash = ""; + }; + cargoHash = ""; + }; kernelTarget = if stdenvNoCC.hostPlatform.isx86 then # vmlinux.bin is the stripped version of vmlinux. @@ -75,7 +85,6 @@ let pkgs.s6-rc pkgs.socat pkgs.systemd - pkgs.wayland-proxy-virtwl pkgs.wireplumber pkgs.xdg-desktop-portal pkgs.xdg-desktop-portal-gtk @@ -84,6 +93,7 @@ let kernel.modules spectrum-app-tools terminfo + wl-cross-domain-proxy ]; })).fhsenv; diff --git a/img/app/image/etc/mdev.conf b/img/app/image/etc/mdev.conf index 33a07d6b1001bd883a3d54e706bc2eb30ca32d0b..bdfdf4b1688dff612c8a5a219c6530c7434668e7 100644 --- a/img/app/image/etc/mdev.conf +++ b/img/app/image/etc/mdev.conf @@ -5,6 +5,7 @@ $INTERFACE=.* 0:0 0 ! +/etc/mdev/iface $MODALIAS=virtio:d0000001Av.* 0:0 0 ! +/etc/mdev/virtiofs dri/card0 user:user 660 +background { /etc/mdev/listen card0 } +dri/renderD128 user:user 660 +background { /etc/mdev/listen renderD128 } -SUBSYSTEM=sound;.* pipewire:pipewire 660 snd/controlC0 pipewire:pipewire 660 +background { /etc/mdev/listen controlC0 } diff --git a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/notification-fd b/img/app/image/etc/s6-rc/wl-cross-domain-proxy/notification-fd similarity index 100% rename from img/app/image/etc/s6-rc/wayland-proxy-virtwl/notification-fd rename to img/app/image/etc/s6-rc/wl-cross-domain-proxy/notification-fd diff --git a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/notification-fd.license b/img/app/image/etc/s6-rc/wl-cross-domain-proxy/notification-fd.license similarity index 100% rename from img/app/image/etc/s6-rc/wayland-proxy-virtwl/notification-fd.license rename to img/app/image/etc/s6-rc/wl-cross-domain-proxy/notification-fd.license diff --git a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run b/img/app/image/etc/s6-rc/wl-cross-domain-proxy/run similarity index 50% rename from img/app/image/etc/s6-rc/wayland-proxy-virtwl/run rename to img/app/image/etc/s6-rc/wl-cross-domain-proxy/run index 5d06b7aea93d790a0aff4c3aed0e821caddadfee..5ae3b96aa639053ff2f70e6b7ddc420fae3c53f1 100755 --- a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run +++ b/img/app/image/etc/s6-rc/wl-cross-domain-proxy/run @@ -1,19 +1,11 @@ #!/bin/execlineb -P # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> -# -# Directory creation (if it's copyrightable): -# SPDX-License-Identifier: MIT -# SPDX-FileCopyrightText: 2022 Unikie - -foreground { mkdir /tmp/.X11-unix } +# SPDX-FileCopyrightText: 2026 Demi Marie Obenour <demiobenour(a)gmail.com> s6-ipcserver-socketbinder -B /run/wayland fdmove -c 3 0 -s6-ipcserver-socketbinder -B /tmp/.X11-unix/X0 -fdmove -c 4 0 - redirfd -r 0 /dev/null # Notify readiness. @@ -21,11 +13,12 @@ if { fdmove 1 5 echo } fdclose 5 if { /etc/mdev/wait card0 } +if { /etc/mdev/wait renderD128 } -export LISTEN_FDS 2 -export LISTEN_FDNAMES wayland:x11 +export LISTEN_FDS 1 +export LISTEN_FDNAMES wayland getpid LISTEN_PID s6-setuidgid user -wayland-proxy-virtwl --virtio-gpu --x-display=0 +wl-cross-domain-proxy --listen-fd diff --git a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/type b/img/app/image/etc/s6-rc/wl-cross-domain-proxy/type similarity index 100% rename from img/app/image/etc/s6-rc/wayland-proxy-virtwl/type rename to img/app/image/etc/s6-rc/wl-cross-domain-proxy/type diff --git a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/type.license b/img/app/image/etc/s6-rc/wl-cross-domain-proxy/type.license similarity index 100% rename from img/app/image/etc/s6-rc/wayland-proxy-virtwl/type.license rename to img/app/image/etc/s6-rc/wl-cross-domain-proxy/type.license --- base-commit: 8a6e4f03951d80382e5dcf1a159d37dec8376a0b change-id: 20260120-gpu-accel-2-7eec0ac9b071 -- Sincerely, Demi Marie Obenour (she/her/hers)

2 4

[PATCH 1/2] host/rootfs: remove /proc/kcore bind mounts
by Alyssa Ross 01 Feb '26

01 Feb '26

Neither of these services run as root any more, so they don't have access to /proc/kcore any more regardless. (Also we don't have /proc/kcore on aarch64 so this previously errored there.) Fixes: 62590b8 ("host/rootfs: Sandbox crosvm") Fixes: ec47d36 ("host/rootfs: Sandbox Cloud Hypervisor") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- .../service/vm-services/template/data/service/vhost-user-gpu/run | 1 - host/rootfs/image/usr/bin/run-vmm | 1 - 2 files changed, 2 deletions(-) diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run index b1f9bac..e063a82 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run @@ -40,7 +40,6 @@ bwrap --tmpfs /proc/irq --remount-ro /proc/irq --ro-bind /dev/null /proc/timer_list - --ro-bind /dev/null /proc/kcore --ro-bind /dev/null /proc/kallsyms --ro-bind /dev/null /proc/sysrq-trigger -- diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm index 0640239..e30b14c 100755 --- a/host/rootfs/image/usr/bin/run-vmm +++ b/host/rootfs/image/usr/bin/run-vmm @@ -113,7 +113,6 @@ bwrap --tmpfs /proc/irq --remount-ro /proc/irq --ro-bind /dev/null /proc/timer_list - --ro-bind /dev/null /proc/kcore --ro-bind /dev/null /proc/kallsyms --ro-bind /dev/null /proc/sysrq-trigger -- base-commit: 6ceeb9b236cc50d2bba90068533ca1b7ff229c8b -- 2.51.0

3 8

Selkies/Webtop v4
by James Smith 16 Jan '26

16 Jan '26

ICYMI: https://www.linuxserver.io/blog/webtop-4-0-wayland-is-here-engage-the-reali… this really reminds me of qubes browser https://www.qubes-os.org/news/2018/01/22/qubes-air/ "Instead, she can access Qubes-as-a-Service with just a Web browser or a mobile app." Example nixos config running it 2yrs ago https://github.com/Ethorbit/nixos-configs/tree/5992e8b254593dd8587545f1a076… Source available at https://github.com/selkies-project/selkies https://github.com/selkies-project/docker-selkies-egl-desktop James Smith

1 0

[PATCH] release/checks/integration: fix race condition
by Alyssa Ross 15 Jan '26

15 Jan '26

By default, IPv6 addresses are in the tentative state and can't be bound to until the kernel has asychronously done Duplicate Address Detection. This was the cause of us needing to retry the bind, and sometimes even that wasn't enough. Since we're in a fresh network namespace, we know there can't be a duplicate address, so we can add the address with the IFA_F_NODAD flag to skip this and make the address available for binding immediately. We can't set that flag using the ioctl interface we were using before, so switch to netlink. This is slightly lazy netlink — we hardcode the index of the loopback address, and don't bother with extended errors — but I think that's fine for a test where readability is the most important thing. I've run the test 100 times with this change and didn't see any bind failures, which is a big improvement over the failure rate I was seeing before. Fixes: cdf1891e ("release/checks/integration: Adapt networking test for ipv6") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- release/checks/integration/networking.c | 89 +++++++++++++++++++------ 1 file changed, 70 insertions(+), 19 deletions(-) diff --git a/release/checks/integration/networking.c b/release/checks/integration/networking.c index 68f00b98..7d02f557 100644 --- a/release/checks/integration/networking.c +++ b/release/checks/integration/networking.c @@ -12,14 +12,14 @@ #include <arpa/inet.h> #include <net/if.h> -#include <sys/ioctl.h> +#include <sys/socket.h> +#include <linux/if_addr.h> #include <linux/ipv6.h> +#include <linux/rtnetlink.h> static int setup_server(void) { int fd; - struct ifreq ifr; - struct in6_ifreq ifr6; struct sockaddr_in6 addr = { .sin6_family = AF_INET6, @@ -27,30 +27,83 @@ static int setup_server(void) .sin6_addr = { .s6_addr = { 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02 } }, }; - sprintf(ifr.ifr_name, "lo"); + struct { + struct nlmsghdr nh; + struct ifaddrmsg ifa; + struct rtattr attr; + struct in6_addr addr; + } newaddr_req = { + { + .nlmsg_len = sizeof newaddr_req, + .nlmsg_type = RTM_NEWADDR, + .nlmsg_flags = NLM_F_ACK | NLM_F_REQUEST, + }, + { + .ifa_family = AF_INET6, + .ifa_prefixlen = 128, + .ifa_flags = IFA_F_NODAD, + .ifa_index = 1, + }, + { + .rta_len = sizeof newaddr_req.attr + sizeof newaddr_req.addr, + .rta_type = IFA_ADDRESS, + }, + addr.sin6_addr, + }; - ifr6.ifr6_ifindex = 1; - ifr6.ifr6_addr = addr.sin6_addr; - ifr6.ifr6_prefixlen = 128; + struct { + struct nlmsghdr nh; + struct ifinfomsg ifi; + } newlink_req = { + { + .nlmsg_len = sizeof newlink_req, + .nlmsg_type = RTM_NEWLINK, + .nlmsg_flags = NLM_F_ACK | NLM_F_REQUEST, + }, + { + .ifi_index = 1, + .ifi_flags = IFF_UP, + .ifi_change = IFF_UP, + }, + }; - if ((fd = socket(AF_INET6, SOCK_STREAM|SOCK_CLOEXEC, 0)) == -1) { + struct { + struct nlmsghdr nh; + struct nlmsgerr err; + } res; + + if ((fd = socket(AF_NETLINK, SOCK_DGRAM|SOCK_CLOEXEC, NETLINK_ROUTE)) == -1) { perror("socket"); exit(EXIT_FAILURE); } - if (ioctl(fd, SIOCGIFFLAGS, &ifr) == -1) { - perror("SIOCGIFFLAGS"); + if (send(fd, &newaddr_req, sizeof newaddr_req, 0) == -1) { + perror("send"); exit(EXIT_FAILURE); } - ifr.ifr_flags |= IFF_UP; - if (ioctl(fd, SIOCSIFFLAGS, &ifr) == -1) { - perror("SIOCSIFFLAGS"); + if (recv(fd, &res, sizeof res, 0) == -1) { + perror("recv"); exit(EXIT_FAILURE); } - if (ioctl(fd, SIOCSIFADDR, &ifr6) == -1) { - perror("SIOCSIFADDR"); + if (res.err.error) { + fprintf(stderr, "RTM_NEWADDR: %s", strerror(-res.err.error)); + exit(EXIT_FAILURE); + } + + if (send(fd, &newlink_req, sizeof newlink_req, 0) == -1) { + perror("send"); + exit(EXIT_FAILURE); + } + + if (recv(fd, &res, sizeof res, 0) == -1) { + perror("recv"); + exit(EXIT_FAILURE); + } + + if (res.err.error) { + fprintf(stderr, "RTM_NEWLINK: %s", strerror(-res.err.error)); exit(EXIT_FAILURE); } @@ -61,11 +114,9 @@ static int setup_server(void) exit(EXIT_FAILURE); } - int tries = 0; - while (bind(fd, &addr, sizeof addr) == -1) { + if (bind(fd, &addr, sizeof addr) == -1) { perror("bind"); - if (tries++ >= 5) - exit(EXIT_FAILURE); + exit(EXIT_FAILURE); } if (listen(fd, 1) == -1) { base-commit: 77f8d28f076b16a64faef83c5cf374995770ff70 -- 2.51.0

2 1

[PATCH 1/4] tools: add spectrum-installer
by Johannes Süllner 11 Jan '26

11 Jan '26

Written in Rust using the Iced GUI library. Uses `lsblk-rs` to offer a list of disks where the user can choose one to install Spectrum on. Uses `systemd-repart` for the installation, which is running in an embedded terminal window using `iced-term`. Signed-off-by: Johannes Süllner <johannes.suellner(a)mailbox.org> --- pkgs/default.nix | 1 + tools/spectrum-installer/Cargo.lock | 5106 +++++++++++++++++ tools/spectrum-installer/Cargo.lock.license | 2 + tools/spectrum-installer/Cargo.toml | 14 + tools/spectrum-installer/default.nix | 41 + .../res/installer_logo_mesh.svg | 85 + .../res/repart.d/10-esp.conf | 8 + .../res/repart.d/20-verity-A.conf | 9 + .../res/repart.d/21-rootfs-A.conf | 9 + .../res/repart.d/30-verity-B.conf | 8 + .../res/repart.d/31-rootfs-B.conf | 8 + .../res/repart.d/40-home.conf | 7 + tools/spectrum-installer/shell.nix | 30 + tools/spectrum-installer/src/main.rs | 52 + .../src/pages/completion.rs | 112 + .../src/pages/confirmation.rs | 108 + .../src/pages/disk_selection.rs | 134 + .../src/pages/installation.rs | 182 + tools/spectrum-installer/src/pages/layout.rs | 122 + tools/spectrum-installer/src/pages/mod.rs | 43 + tools/spectrum-installer/src/pages/welcome.rs | 62 + 21 files changed, 6143 insertions(+) create mode 100644 tools/spectrum-installer/Cargo.lock create mode 100644 tools/spectrum-installer/Cargo.lock.license create mode 100644 tools/spectrum-installer/Cargo.toml create mode 100644 tools/spectrum-installer/default.nix create mode 100644 tools/spectrum-installer/res/installer_logo_mesh.svg create mode 100644 tools/spectrum-installer/res/repart.d/10-esp.conf create mode 100644 tools/spectrum-installer/res/repart.d/20-verity-A.conf create mode 100644 tools/spectrum-installer/res/repart.d/21-rootfs-A.conf create mode 100644 tools/spectrum-installer/res/repart.d/30-verity-B.conf create mode 100644 tools/spectrum-installer/res/repart.d/31-rootfs-B.conf create mode 100644 tools/spectrum-installer/res/repart.d/40-home.conf create mode 100644 tools/spectrum-installer/shell.nix create mode 100644 tools/spectrum-installer/src/main.rs create mode 100644 tools/spectrum-installer/src/pages/completion.rs create mode 100644 tools/spectrum-installer/src/pages/confirmation.rs create mode 100644 tools/spectrum-installer/src/pages/disk_selection.rs create mode 100644 tools/spectrum-installer/src/pages/installation.rs create mode 100644 tools/spectrum-installer/src/pages/layout.rs create mode 100644 tools/spectrum-installer/src/pages/mod.rs create mode 100644 tools/spectrum-installer/src/pages/welcome.rs diff --git a/pkgs/default.nix b/pkgs/default.nix index 4dbdfee..a80c5b3 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -74,6 +74,7 @@ let ../release/live/build ../tools/mount-flatpak/target ../tools/router/target + ../tools/spectrum-installer/target ../tools/xdg-desktop-portal-spectrum-host/target ../vm/sys/net/build ])); diff --git a/tools/spectrum-installer/Cargo.lock b/tools/spectrum-installer/Cargo.lock new file mode 100644 index 0000000..4be50ef --- /dev/null +++ b/tools/spectrum-installer/Cargo.lock @@ -0,0 +1,5106 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 4 + +[[package]] +name = "ab_glyph" +version = "0.2.32" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "01c0457472c38ea5bd1c3b5ada5e368271cb550be7a4ca4a0b4634e9913f6cc2" +dependencies = [ + "ab_glyph_rasterizer", + "owned_ttf_parser", +] + +[[package]] +name = "ab_glyph_rasterizer" +version = "0.1.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "366ffbaa4442f4684d91e2cd7c5ea7c4ed8add41959a31447066e279e432b618" + +[[package]] +name = "adler2" +version = "2.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa" + +[[package]] +name = "ahash" +version = "0.7.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "891477e0c6a8957309ee5c45a6368af3ae14bb510732d2684ffa19af310920f9" +dependencies = [ + "getrandom 0.2.16", + "once_cell", + "version_check", +] + +[[package]] +name = "ahash" +version = "0.8.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75" +dependencies = [ + "cfg-if", + "getrandom 0.3.4", + "once_cell", + "version_check", + "zerocopy", +] + +[[package]] +name = "aho-corasick" +version = "1.1.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301" +dependencies = [ + "memchr", +] + +[[package]] +name = "alacritty_terminal" +version = "0.25.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "46319972e74179d707445f64aaa2893bbf6a111de3a9af29b7eb382f8b39e282" +dependencies = [ + "base64", + "bitflags 2.10.0", + "home", + "libc", + "log", + "miow", + "parking_lot 0.12.5", + "piper", + "polling 3.11.0", + "regex-automata", + "rustix 1.1.2", + "rustix-openpty", + "serde", + "signal-hook", + "unicode-width 0.2.2", + "vte", + "windows-sys 0.59.0", +] + +[[package]] +name = "aliasable" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "250f629c0161ad8107cf89319e990051fae62832fd343083bea452d93e2205fd" + +[[package]] +name = "allocator-api2" +version = "0.2.21" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923" + +[[package]] +name = "android-activity" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ef6978589202a00cd7e118380c448a08b6ed394c3a8df3a430d0898e3a42d046" +dependencies = [ + "android-properties", + "bitflags 2.10.0", + "cc", + "cesu8", + "jni", + "jni-sys", + "libc", + "log", + "ndk", + "ndk-context", + "ndk-sys 0.6.0+11769913", + "num_enum", + "thiserror 1.0.69", +] + +[[package]] +name = "android-properties" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc7eb209b1518d6bb87b283c20095f5228ecda460da70b44f0802523dea6da04" + +[[package]] +name = "android_system_properties" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311" +dependencies = [ + "libc", +] + +[[package]] +name = "anyhow" +version = "1.0.100" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61" + +[[package]] +name = "approx" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cab112f0a86d568ea0e627cc1d6be74a1e9cd55214684db5561995f6dad897c6" +dependencies = [ + "num-traits", +] + +[[package]] +name = "arrayref" +version = "0.3.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "76a2e8124351fda1ef8aaaa3bbd7ebbcb486bbcd4225aca0aa0d84bb2db8fecb" + +[[package]] +name = "arrayvec" +version = "0.7.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50" + +[[package]] +name = "as-raw-xcb-connection" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "175571dd1d178ced59193a6fc02dde1b972eb0bc56c892cde9beeceac5bf0f6b" + +[[package]] +name = "ash" +version = "0.37.3+1.3.251" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "39e9c3835d686b0a6084ab4234fcd1b07dbf6e4767dce60874b12356a25ecd4a" +dependencies = [ + "libloading 0.7.4", +] + +[[package]] +name = "async-broadcast" +version = "0.7.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532" +dependencies = [ + "event-listener 5.4.1", + "event-listener-strategy", + "futures-core", + "pin-project-lite", +] + +[[package]] +name = "async-channel" +version = "1.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "81953c529336010edd6d8e358f886d9581267795c61b19475b71314bffa46d35" +dependencies = [ + "concurrent-queue", + "event-listener 2.5.3", + "futures-core", +] + +[[package]] +name = "async-channel" +version = "2.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2" +dependencies = [ + "concurrent-queue", + "event-listener-strategy", + "futures-core", + "pin-project-lite", +] + +[[package]] +name = "async-executor" +version = "1.13.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "497c00e0fd83a72a79a39fcbd8e3e2f055d6f6c7e025f3b3d91f4f8e76527fb8" +dependencies = [ + "async-task", + "concurrent-queue", + "fastrand 2.3.0", + "futures-lite 2.6.1", + "pin-project-lite", + "slab", +] + +[[package]] +name = "async-fs" +version = "1.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "279cf904654eeebfa37ac9bb1598880884924aab82e290aa65c9e77a0e142e06" +dependencies = [ + "async-lock 2.8.0", + "autocfg", + "blocking", + "futures-lite 1.13.0", +] + +[[package]] +name = "async-fs" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8034a681df4aed8b8edbd7fbe472401ecf009251c8b40556b304567052e294c5" +dependencies = [ + "async-lock 3.4.1", + "blocking", + "futures-lite 2.6.1", +] + +[[package]] +name = "async-io" +version = "1.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0fc5b45d93ef0529756f812ca52e44c221b35341892d3dcc34132ac02f3dd2af" +dependencies = [ + "async-lock 2.8.0", + "autocfg", + "cfg-if", + "concurrent-queue", + "futures-lite 1.13.0", + "log", + "parking", + "polling 2.8.0", + "rustix 0.37.28", + "slab", + "socket2 0.4.10", + "waker-fn", +] + +[[package]] +name = "async-io" +version = "2.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "456b8a8feb6f42d237746d4b3e9a178494627745c3c56c6ea55d92ba50d026fc" +dependencies = [ + "autocfg", + "cfg-if", + "concurrent-queue", + "futures-io", + "futures-lite 2.6.1", + "parking", + "polling 3.11.0", + "rustix 1.1.2", + "slab", + "windows-sys 0.61.2", +] + +[[package]] +name = "async-lock" +version = "2.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "287272293e9d8c41773cec55e365490fe034813a2f172f502d6ddcf75b2f582b" +dependencies = [ + "event-listener 2.5.3", +] + +[[package]] +name = "async-lock" +version = "3.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5fd03604047cee9b6ce9de9f70c6cd540a0520c813cbd49bae61f33ab80ed1dc" +dependencies = [ + "event-listener 5.4.1", + "event-listener-strategy", + "pin-project-lite", +] + +[[package]] +name = "async-net" +version = "1.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0434b1ed18ce1cf5769b8ac540e33f01fa9471058b5e89da9e06f3c882a8c12f" +dependencies = [ + "async-io 1.13.0", + "blocking", + "futures-lite 1.13.0", +] + +[[package]] +name = "async-process" +version = "1.8.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ea6438ba0a08d81529c69b36700fa2f95837bfe3e776ab39cde9c14d9149da88" +dependencies = [ + "async-io 1.13.0", + "async-lock 2.8.0", + "async-signal", + "blocking", + "cfg-if", + "event-listener 3.1.0", + "futures-lite 1.13.0", + "rustix 0.38.44", + "windows-sys 0.48.0", +] + +[[package]] +name = "async-process" +version = "2.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75" +dependencies = [ + "async-channel 2.5.0", + "async-io 2.6.0", + "async-lock 3.4.1", + "async-signal", + "async-task", + "blocking", + "cfg-if", + "event-listener 5.4.1", + "futures-lite 2.6.1", + "rustix 1.1.2", +] + +[[package]] +name = "async-recursion" +version = "1.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "async-signal" +version = "0.2.13" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "43c070bbf59cd3570b6b2dd54cd772527c7c3620fce8be898406dd3ed6adc64c" +dependencies = [ + "async-io 2.6.0", + "async-lock 3.4.1", + "atomic-waker", + "cfg-if", + "futures-core", + "futures-io", + "rustix 1.1.2", + "signal-hook-registry", + "slab", + "windows-sys 0.61.2", +] + +[[package]] +name = "async-task" +version = "4.7.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de" + +[[package]] +name = "async-trait" +version = "0.1.89" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "atomic-waker" +version = "1.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0" + +[[package]] +name = "autocfg" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8" + +[[package]] +name = "base64" +version = "0.22.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" + +[[package]] +name = "bit-set" +version = "0.5.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1" +dependencies = [ + "bit-vec", +] + +[[package]] +name = "bit-vec" +version = "0.6.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb" + +[[package]] +name = "bit_field" +version = "0.10.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e4b40c7323adcfc0a41c4b88143ed58346ff65a288fc144329c5c45e05d70c6" + +[[package]] +name = "bitflags" +version = "1.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" + +[[package]] +name = "bitflags" +version = "2.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3" +dependencies = [ + "serde_core", +] + +[[package]] +name = "block" +version = "0.1.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0d8c1fef690941d3e7788d328517591fecc684c084084702d6ff1641e993699a" + +[[package]] +name = "block-buffer" +version = "0.10.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71" +dependencies = [ + "generic-array", +] + +[[package]] +name = "block2" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2c132eebf10f5cad5289222520a4a058514204aed6d791f1cf4fe8088b82d15f" +dependencies = [ + "objc2", +] + +[[package]] +name = "blocking" +version = "1.6.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e83f8d02be6967315521be875afa792a316e28d57b5a2d401897e2a7921b7f21" +dependencies = [ + "async-channel 2.5.0", + "async-task", + "futures-io", + "futures-lite 2.6.1", + "piper", +] + +[[package]] +name = "bumpalo" +version = "3.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43" + +[[package]] +name = "by_address" +version = "1.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "64fa3c856b712db6612c019f14756e64e4bcea13337a6b33b696333a9eaa2d06" + +[[package]] +name = "bytemuck" +version = "1.24.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1fbdf580320f38b612e485521afda1ee26d10cc9884efaaa750d383e13e3c5f4" +dependencies = [ + "bytemuck_derive", +] + +[[package]] +name = "bytemuck_derive" +version = "1.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f9abbd1bc6865053c427f7198e6af43bfdedc55ab791faed4fbd361d789575ff" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "byteorder" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b" + +[[package]] +name = "bytes" +version = "1.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3" + +[[package]] +name = "calloop" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b99da2f8558ca23c71f4fd15dc57c906239752dd27ff3c00a1d56b685b7cbfec" +dependencies = [ + "bitflags 2.10.0", + "log", + "polling 3.11.0", + "rustix 0.38.44", + "slab", + "thiserror 1.0.69", +] + +[[package]] +name = "calloop" +version = "0.14.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cb9f6e1368bd4621d2c86baa7e37de77a938adf5221e5dd3d6133340101b309e" +dependencies = [ + "bitflags 2.10.0", + "polling 3.11.0", + "rustix 1.1.2", + "slab", + "tracing", +] + +[[package]] +name = "calloop-wayland-source" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "95a66a987056935f7efce4ab5668920b5d0dac4a7c99991a67395f13702ddd20" +dependencies = [ + "calloop 0.13.0", + "rustix 0.38.44", + "wayland-backend", + "wayland-client", +] + +[[package]] +name = "calloop-wayland-source" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "138efcf0940a02ebf0cc8d1eff41a1682a46b431630f4c52450d6265876021fa" +dependencies = [ + "calloop 0.14.3", + "rustix 1.1.2", + "wayland-backend", + "wayland-client", +] + +[[package]] +name = "cc" +version = "1.2.47" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cd405d82c84ff7f35739f175f67d8b9fb7687a0e84ccdc78bd3568839827cf07" +dependencies = [ + "find-msvc-tools", + "jobserver", + "libc", + "shlex", +] + +[[package]] +name = "cesu8" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c" + +[[package]] +name = "cfg-if" +version = "1.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" + +[[package]] +name = "cfg_aliases" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e" + +[[package]] +name = "cfg_aliases" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" + +[[package]] +name = "chrono" +version = "0.4.42" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "145052bdd345b87320e369255277e3fb5152762ad123a901ef5c262dd38fe8d2" +dependencies = [ + "iana-time-zone", + "js-sys", + "num-traits", + "wasm-bindgen", + "windows-link", +] + +[[package]] +name = "clipboard-win" +version = "5.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4" +dependencies = [ + "error-code", +] + +[[package]] +name = "clipboard_macos" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9b7f4aaa047ba3c3630b080bb9860894732ff23e2aee290a418909aa6d5df38f" +dependencies = [ + "objc2", + "objc2-app-kit", + "objc2-foundation", +] + +[[package]] +name = "clipboard_wayland" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "003f886bc4e2987729d10c1db3424e7f80809f3fc22dbc16c685738887cb37b8" +dependencies = [ + "smithay-clipboard", +] + +[[package]] +name = "clipboard_x11" +version = "0.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4274ea815e013e0f9f04a2633423e14194e408a0576c943ce3d14ca56c50031c" +dependencies = [ + "thiserror 1.0.69", + "x11rb", +] + +[[package]] +name = "codespan-reporting" +version = "0.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3538270d33cc669650c4b093848450d380def10c331d38c768e34cac80576e6e" +dependencies = [ + "termcolor", + "unicode-width 0.1.14", +] + +[[package]] +name = "color_quant" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b" + +[[package]] +name = "com" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7e17887fd17353b65b1b2ef1c526c83e26cd72e74f598a8dc1bee13a48f3d9f6" +dependencies = [ + "com_macros", +] + +[[package]] +name = "com_macros" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d375883580a668c7481ea6631fc1a8863e33cc335bf56bfad8d7e6d4b04b13a5" +dependencies = [ + "com_macros_support", + "proc-macro2", + "syn 1.0.109", +] + +[[package]] +name = "com_macros_support" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ad899a1087a9296d5644792d7cb72b8e34c1bec8e7d4fbc002230169a6e8710c" +dependencies = [ + "proc-macro2", + "quote", + "syn 1.0.109", +] + +[[package]] +name = "combine" +version = "4.6.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd" +dependencies = [ + "bytes", + "memchr", +] + +[[package]] +name = "concurrent-queue" +version = "2.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973" +dependencies = [ + "crossbeam-utils", +] + +[[package]] +name = "core-foundation" +version = "0.9.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f" +dependencies = [ + "core-foundation-sys", + "libc", +] + +[[package]] +name = "core-foundation" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6" +dependencies = [ + "core-foundation-sys", + "libc", +] + +[[package]] +name = "core-foundation-sys" +version = "0.8.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b" + +[[package]] +name = "core-graphics" +version = "0.23.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c07782be35f9e1140080c6b96f0d44b739e2278479f64e02fdab4e32dfd8b081" +dependencies = [ + "bitflags 1.3.2", + "core-foundation 0.9.4", + "core-graphics-types 0.1.3", + "foreign-types", + "libc", +] + +[[package]] +name = "core-graphics" +version = "0.24.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fa95a34622365fa5bbf40b20b75dba8dfa8c94c734aea8ac9a5ca38af14316f1" +dependencies = [ + "bitflags 2.10.0", + "core-foundation 0.10.1", + "core-graphics-types 0.2.0", + "foreign-types", + "libc", +] + +[[package]] +name = "core-graphics-types" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "45390e6114f68f718cc7a830514a96f903cccd70d02a8f6d9f643ac4ba45afaf" +dependencies = [ + "bitflags 1.3.2", + "core-foundation 0.9.4", + "libc", +] + +[[package]] +name = "core-graphics-types" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3d44a101f213f6c4cdc1853d4b78aef6db6bdfa3468798cc1d9912f4735013eb" +dependencies = [ + "bitflags 2.10.0", + "core-foundation 0.10.1", + "libc", +] + +[[package]] +name = "cosmic-text" +version = "0.12.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "59fd57d82eb4bfe7ffa9b1cec0c05e2fd378155b47f255a67983cb4afe0e80c2" +dependencies = [ + "bitflags 2.10.0", + "fontdb", + "log", + "rangemap", + "rayon", + "rustc-hash 1.1.0", + "rustybuzz", + "self_cell", + "swash", + "sys-locale", + "ttf-parser 0.21.1", + "unicode-bidi", + "unicode-linebreak", + "unicode-script", + "unicode-segmentation", +] + +[[package]] +name = "cpufeatures" +version = "0.2.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280" +dependencies = [ + "libc", +] + +[[package]] +name = "crc32fast" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511" +dependencies = [ + "cfg-if", +] + +[[package]] +name = "crossbeam-deque" +version = "0.8.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51" +dependencies = [ + "crossbeam-epoch", + "crossbeam-utils", +] + +[[package]] +name = "crossbeam-epoch" +version = "0.9.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +dependencies = [ + "crossbeam-utils", +] + +[[package]] +name = "crossbeam-utils" +version = "0.8.21" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28" + +[[package]] +name = "crunchy" +version = "0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5" + +[[package]] +name = "crypto-common" +version = "0.1.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a" +dependencies = [ + "generic-array", + "typenum", +] + +[[package]] +name = "ctor-lite" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1f791803201ab277ace03903de1594460708d2d54df6053f2d9e82f592b19e3b" + +[[package]] +name = "cursor-icon" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f" + +[[package]] +name = "d3d12" +version = "0.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3e3d747f100290a1ca24b752186f61f6637e1deffe3bf6320de6fcb29510a307" +dependencies = [ + "bitflags 2.10.0", + "libloading 0.8.9", + "winapi", +] + +[[package]] +name = "dark-light" +version = "1.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2a76fa97167fa740dcdbfe18e8895601e1bc36525f09b044e00916e717c03a3c" +dependencies = [ + "dconf_rs", + "detect-desktop-environment", + "dirs", + "objc", + "rust-ini", + "web-sys", + "winreg", + "zbus", +] + +[[package]] +name = "dconf_rs" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7046468a81e6a002061c01e6a7c83139daf91b11c30e66795b13217c2d885c8b" + +[[package]] +name = "detect-desktop-environment" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "21d8ad60dd5b13a4ee6bd8fa2d5d88965c597c67bce32b5fc49c94f55cb50810" + +[[package]] +name = "digest" +version = "0.10.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" +dependencies = [ + "block-buffer", + "crypto-common", +] + +[[package]] +name = "dirs" +version = "4.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ca3aa72a6f96ea37bbc5aa912f6788242832f75369bdfdadcb0e38423f100059" +dependencies = [ + "dirs-sys", +] + +[[package]] +name = "dirs-sys" +version = "0.3.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1b1d1d91c932ef41c0f2663aa8b0ca0342d444d842c06914aa0a7e352d0bada6" +dependencies = [ + "libc", + "redox_users", + "winapi", +] + +[[package]] +name = "dispatch" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bd0c93bb4b0c6d9b77f4435b0ae98c24d17f1c45b2ff844c6151a07256ca923b" + +[[package]] +name = "dlib" +version = "0.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "330c60081dcc4c72131f8eb70510f1ac07223e5d4163db481a04a0befcffa412" +dependencies = [ + "libloading 0.8.9", +] + +[[package]] +name = "dlv-list" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0688c2a7f92e427f44895cd63841bff7b29f8d7a1648b9e7e07a4a365b2e1257" + +[[package]] +name = "downcast-rs" +version = "1.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2" + +[[package]] +name = "dpi" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76" + +[[package]] +name = "drm" +version = "0.12.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "98888c4bbd601524c11a7ed63f814b8825f420514f78e96f752c437ae9cbb5d1" +dependencies = [ + "bitflags 2.10.0", + "bytemuck", + "drm-ffi", + "drm-fourcc", + "rustix 0.38.44", +] + +[[package]] +name = "drm-ffi" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "97c98727e48b7ccb4f4aea8cfe881e5b07f702d17b7875991881b41af7278d53" +dependencies = [ + "drm-sys", + "rustix 0.38.44", +] + +[[package]] +name = "drm-fourcc" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0aafbcdb8afc29c1a7ee5fbe53b5d62f4565b35a042a662ca9fecd0b54dae6f4" + +[[package]] +name = "drm-sys" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fd39dde40b6e196c2e8763f23d119ddb1a8714534bf7d77fa97a65b0feda3986" +dependencies = [ + "libc", + "linux-raw-sys 0.6.5", +] + +[[package]] +name = "either" +version = "1.15.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719" + +[[package]] +name = "endi" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a3d8a32ae18130a3c84dd492d4215c3d913c3b07c6b63c2eb3eb7ff1101ab7bf" + +[[package]] +name = "enumflags2" +version = "0.7.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1027f7680c853e056ebcec683615fb6fbbc07dbaa13b4d5d9442b146ded4ecef" +dependencies = [ + "enumflags2_derive", + "serde", +] + +[[package]] +name = "enumflags2_derive" +version = "0.7.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "equivalent" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f" + +[[package]] +name = "errno" +version = "0.3.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" +dependencies = [ + "libc", + "windows-sys 0.61.2", +] + +[[package]] +name = "error-code" +version = "3.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dea2df4cf52843e0452895c455a1a2cfbb842a1e7329671acf418fdc53ed4c59" + +[[package]] +name = "etagere" +version = "0.2.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc89bf99e5dc15954a60f707c1e09d7540e5cd9af85fa75caa0b510bc08c5342" +dependencies = [ + "euclid", + "svg_fmt", +] + +[[package]] +name = "euclid" +version = "0.22.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ad9cdb4b747e485a12abb0e6566612956c7a1bafa3bdb8d682c5b6d403589e48" +dependencies = [ + "num-traits", +] + +[[package]] +name = "event-listener" +version = "2.5.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0" + +[[package]] +name = "event-listener" +version = "3.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d93877bcde0eb80ca09131a08d23f0a5c18a620b01db137dba666d18cd9b30c2" +dependencies = [ + "concurrent-queue", + "parking", + "pin-project-lite", +] + +[[package]] +name = "event-listener" +version = "5.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab" +dependencies = [ + "concurrent-queue", + "parking", + "pin-project-lite", +] + +[[package]] +name = "event-listener-strategy" +version = "0.5.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93" +dependencies = [ + "event-listener 5.4.1", + "pin-project-lite", +] + +[[package]] +name = "exr" +version = "1.74.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4300e043a56aa2cb633c01af81ca8f699a321879a7854d3896a0ba89056363be" +dependencies = [ + "bit_field", + "half", + "lebe", + "miniz_oxide", + "rayon-core", + "smallvec", + "zune-inflate", +] + +[[package]] +name = "fast-srgb8" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dd2e7510819d6fbf51a5545c8f922716ecfb14df168a3242f7d33e0239efe6a1" + +[[package]] +name = "fastrand" +version = "1.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be" +dependencies = [ + "instant", +] + +[[package]] +name = "fastrand" +version = "2.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be" + +[[package]] +name = "fdeflate" +version = "0.3.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c" +dependencies = [ + "simd-adler32", +] + +[[package]] +name = "find-msvc-tools" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3a3076410a55c90011c298b04d0cfa770b00fa04e1e3c97d3f6c9de105a03844" + +[[package]] +name = "flate2" +version = "1.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bfe33edd8e85a12a67454e37f8c75e730830d83e313556ab9ebf9ee7fbeb3bfb" +dependencies = [ + "crc32fast", + "miniz_oxide", +] + +[[package]] +name = "float_next_after" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8bf7cc16383c4b8d58b9905a8509f02926ce3058053c056376248d958c9df1e8" + +[[package]] +name = "font-types" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b3971f9a5ca983419cdc386941ba3b9e1feba01a0ab888adf78739feb2798492" +dependencies = [ + "bytemuck", +] + +[[package]] +name = "fontconfig-parser" +version = "0.5.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bbc773e24e02d4ddd8395fd30dc147524273a83e54e0f312d986ea30de5f5646" +dependencies = [ + "roxmltree", +] + +[[package]] +name = "fontdb" +version = "0.16.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b0299020c3ef3f60f526a4f64ab4a3d4ce116b1acbf24cdd22da0068e5d81dc3" +dependencies = [ + "fontconfig-parser", + "log", + "memmap2", + "slotmap", + "tinyvec", + "ttf-parser 0.20.0", +] + +[[package]] +name = "foreign-types" +version = "0.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965" +dependencies = [ + "foreign-types-macros", + "foreign-types-shared", +] + +[[package]] +name = "foreign-types-macros" +version = "0.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1a5c6c585bc94aaf2c7b51dd4c2ba22680844aba4c687be581871a6f518c5742" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "foreign-types-shared" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b" + +[[package]] +name = "futures" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876" +dependencies = [ + "futures-channel", + "futures-core", + "futures-executor", + "futures-io", + "futures-sink", + "futures-task", + "futures-util", +] + +[[package]] +name = "futures-channel" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10" +dependencies = [ + "futures-core", + "futures-sink", +] + +[[package]] +name = "futures-core" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e" + +[[package]] +name = "futures-executor" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f" +dependencies = [ + "futures-core", + "futures-task", + "futures-util", + "num_cpus", +] + +[[package]] +name = "futures-io" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6" + +[[package]] +name = "futures-lite" +version = "1.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "49a9d51ce47660b1e808d3c990b4709f2f415d928835a17dfd16991515c46bce" +dependencies = [ + "fastrand 1.9.0", + "futures-core", + "futures-io", + "memchr", + "parking", + "pin-project-lite", + "waker-fn", +] + +[[package]] +name = "futures-lite" +version = "2.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad" +dependencies = [ + "fastrand 2.3.0", + "futures-core", + "futures-io", + "parking", + "pin-project-lite", +] + +[[package]] +name = "futures-macro" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "futures-sink" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7" + +[[package]] +name = "futures-task" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988" + +[[package]] +name = "futures-util" +version = "0.3.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81" +dependencies = [ + "futures-channel", + "futures-core", + "futures-io", + "futures-macro", + "futures-sink", + "futures-task", + "memchr", + "pin-project-lite", + "pin-utils", + "slab", +] + +[[package]] +name = "generic-array" +version = "0.14.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" +dependencies = [ + "typenum", + "version_check", +] + +[[package]] +name = "gethostname" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1bd49230192a3797a9a4d6abe9b3eed6f7fa4c8a8a4947977c6f80025f92cbd8" +dependencies = [ + "rustix 1.1.2", + "windows-link", +] + +[[package]] +name = "getrandom" +version = "0.2.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592" +dependencies = [ + "cfg-if", + "libc", + "wasi", +] + +[[package]] +name = "getrandom" +version = "0.3.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" +dependencies = [ + "cfg-if", + "libc", + "r-efi", + "wasip2", +] + +[[package]] +name = "gif" +version = "0.13.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4ae047235e33e2829703574b54fdec96bfbad892062d97fed2f76022287de61b" +dependencies = [ + "color_quant", + "weezl", +] + +[[package]] +name = "gl_generator" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1a95dfc23a2b4a9a2f5ab41d194f8bfda3cabec42af4e39f08c339eb2a0c124d" +dependencies = [ + "khronos_api", + "log", + "xml-rs", +] + +[[package]] +name = "glam" +version = "0.25.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "151665d9be52f9bb40fc7966565d39666f2d1e69233571b71b87791c7e0528b3" + +[[package]] +name = "glow" +version = "0.13.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bd348e04c43b32574f2de31c8bb397d96c9fcfa1371bd4ca6d8bdc464ab121b1" +dependencies = [ + "js-sys", + "slotmap", + "wasm-bindgen", + "web-sys", +] + +[[package]] +name = "glutin_wgl_sys" +version = "0.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6c8098adac955faa2d31079b65dc48841251f69efd3ac25477903fc424362ead" +dependencies = [ + "gl_generator", +] + +[[package]] +name = "gpu-alloc" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fbcd2dba93594b227a1f57ee09b8b9da8892c34d55aa332e034a228d0fe6a171" +dependencies = [ + "bitflags 2.10.0", + "gpu-alloc-types", +] + +[[package]] +name = "gpu-alloc-types" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "98ff03b468aa837d70984d55f5d3f846f6ec31fe34bbb97c4f85219caeee1ca4" +dependencies = [ + "bitflags 2.10.0", +] + +[[package]] +name = "gpu-allocator" +version = "0.25.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6f56f6318968d03c18e1bcf4857ff88c61157e9da8e47c5f29055d60e1228884" +dependencies = [ + "log", + "presser", + "thiserror 1.0.69", + "winapi", + "windows", +] + +[[package]] +name = "gpu-descriptor" +version = "0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cc11df1ace8e7e564511f53af41f3e42ddc95b56fd07b3f4445d2a6048bc682c" +dependencies = [ + "bitflags 2.10.0", + "gpu-descriptor-types", + "hashbrown 0.14.5", +] + +[[package]] +name = "gpu-descriptor-types" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6bf0b36e6f090b7e1d8a4b49c0cb81c1f8376f72198c65dd3ad9ff3556b8b78c" +dependencies = [ + "bitflags 2.10.0", +] + +[[package]] +name = "guillotiere" +version = "0.6.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b62d5865c036cb1393e23c50693df631d3f5d7bcca4c04fe4cc0fd592e74a782" +dependencies = [ + "euclid", + "svg_fmt", +] + +[[package]] +name = "half" +version = "2.7.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b" +dependencies = [ + "cfg-if", + "crunchy", + "zerocopy", +] + +[[package]] +name = "hashbrown" +version = "0.12.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888" +dependencies = [ + "ahash 0.7.8", +] + +[[package]] +name = "hashbrown" +version = "0.14.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1" +dependencies = [ + "ahash 0.8.12", + "allocator-api2", +] + +[[package]] +name = "hashbrown" +version = "0.16.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100" + +[[package]] +name = "hassle-rs" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "af2a7e73e1f34c48da31fb668a907f250794837e08faa144fd24f0b8b741e890" +dependencies = [ + "bitflags 2.10.0", + "com", + "libc", + "libloading 0.8.9", + "thiserror 1.0.69", + "widestring", + "winapi", +] + +[[package]] +name = "heck" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8" + +[[package]] +name = "hermit-abi" +version = "0.3.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024" + +[[package]] +name = "hermit-abi" +version = "0.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c" + +[[package]] +name = "hex" +version = "0.4.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70" + +[[package]] +name = "hexf-parse" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dfa686283ad6dd069f105e5ab091b04c62850d3e4cf5d67debad1933f55023df" + +[[package]] +name = "home" +version = "0.5.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf" +dependencies = [ + "windows-sys 0.59.0", +] + +[[package]] +name = "iana-time-zone" +version = "0.1.64" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "33e57f83510bb73707521ebaffa789ec8caf86f9657cad665b092b581d40e9fb" +dependencies = [ + "android_system_properties", + "core-foundation-sys", + "iana-time-zone-haiku", + "js-sys", + "log", + "wasm-bindgen", + "windows-core 0.62.2", +] + +[[package]] +name = "iana-time-zone-haiku" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f" +dependencies = [ + "cc", +] + +[[package]] +name = "iced" +version = "0.13.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "88acfabc84ec077eaf9ede3457ffa3a104626d79022a9bf7f296093b1d60c73f" +dependencies = [ + "iced_core", + "iced_futures", + "iced_renderer", + "iced_widget", + "iced_winit", + "image", + "thiserror 1.0.69", +] + +[[package]] +name = "iced_aw" +version = "0.12.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "582c517a94ce3205da98e9c10b26bb71aa36b7d7d084441d826dc912711d1bac" +dependencies = [ + "cfg-if", + "chrono", + "getrandom 0.3.4", + "iced", + "iced_fonts 0.1.1", + "itertools", + "num-format", + "num-traits", + "web-time", +] + +[[package]] +name = "iced_core" +version = "0.13.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0013a238275494641bf8f1732a23a808196540dc67b22ff97099c044ae4c8a1c" +dependencies = [ + "bitflags 2.10.0", + "bytes", + "dark-light", + "glam", + "log", + "num-traits", + "once_cell", + "palette", + "rustc-hash 2.1.1", + "smol_str", + "thiserror 1.0.69", + "web-time", +] + +[[package]] +name = "iced_fonts" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "df7deb0800a850ee25c8a42559f72c0f249e577feb3aad37b9b65dc1e517e52a" +dependencies = [ + "iced_core", +] + +[[package]] +name = "iced_fonts" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7db9d45e87bc3ac22ff82e2d9dea9139f1c055137f1e0f39df3d68110fcee7a9" +dependencies = [ + "iced_core", + "iced_widget", +] + +[[package]] +name = "iced_futures" +version = "0.13.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0c04a6745ba2e80f32cf01e034fd00d853aa4f4cd8b91888099cb7aaee0d5d7c" +dependencies = [ + "futures", + "iced_core", + "log", + "rustc-hash 2.1.1", + "smol", + "tokio", + "wasm-bindgen-futures", + "wasm-timer", +] + +[[package]] +name = "iced_glyphon" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "41c3bb56f1820ca252bc1d0994ece33d233a55657c0c263ea7cb16895adbde82" +dependencies = [ + "cosmic-text", + "etagere", + "lru", + "rustc-hash 2.1.1", + "wgpu", +] + +[[package]] +name = "iced_graphics" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ba25a18cfa6d5cc160aca7e1b34f73ccdff21680fa8702168c09739767b6c66f" +dependencies = [ + "bitflags 2.10.0", + "bytemuck", + "cosmic-text", + "half", + "iced_core", + "iced_futures", + "image", + "kamadak-exif", + "log", + "lyon_path", + "once_cell", + "raw-window-handle", + "rustc-hash 2.1.1", + "thiserror 1.0.69", + "unicode-segmentation", +] + +[[package]] +name = "iced_renderer" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "73558208059f9e622df2bf434e044ee2f838ce75201a023cf0ca3e1244f46c2a" +dependencies = [ + "iced_graphics", + "iced_tiny_skia", + "iced_wgpu", + "log", + "thiserror 1.0.69", +] + +[[package]] +name = "iced_runtime" +version = "0.13.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "348b5b2c61c934d88ca3b0ed1ed913291e923d086a66fa288ce9669da9ef62b5" +dependencies = [ + "bytes", + "iced_core", + "iced_futures", + "raw-window-handle", + "thiserror 1.0.69", +] + +[[package]] +name = "iced_term" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a75dd9ece683674e3d83f422516b08978eead151acec63aa3360bc38b75338b7" +dependencies = [ + "alacritty_terminal", + "anyhow", + "iced", + "iced_core", + "iced_graphics", + "open", + "tokio", +] + +[[package]] +name = "iced_tiny_skia" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c625d368284fcc43b0b36b176f76eff1abebe7959dd58bd8ce6897d641962a50" +dependencies = [ + "bytemuck", + "cosmic-text", + "iced_graphics", + "kurbo", + "log", + "rustc-hash 2.1.1", + "softbuffer", + "tiny-skia", +] + +[[package]] +name = "iced_wgpu" +version = "0.13.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "15708887133671d2bcc6c1d01d1f176f43a64d6cdc3b2bf893396c3ee498295f" +dependencies = [ + "bitflags 2.10.0", + "bytemuck", + "futures", + "glam", + "guillotiere", + "iced_glyphon", + "iced_graphics", + "log", + "lyon", + "once_cell", + "rustc-hash 2.1.1", + "thiserror 1.0.69", + "wgpu", +] + +[[package]] +name = "iced_widget" +version = "0.13.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "81429e1b950b0e4bca65be4c4278fea6678ea782030a411778f26fa9f8983e1d" +dependencies = [ + "iced_renderer", + "iced_runtime", + "num-traits", + "once_cell", + "ouroboros", + "rustc-hash 2.1.1", + "thiserror 1.0.69", + "unicode-segmentation", +] + +[[package]] +name = "iced_winit" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f44cd4e1c594b6334f409282937bf972ba14d31fedf03c23aa595d982a2fda28" +dependencies = [ + "iced_futures", + "iced_graphics", + "iced_runtime", + "log", + "rustc-hash 2.1.1", + "thiserror 1.0.69", + "tracing", + "wasm-bindgen-futures", + "web-sys", + "winapi", + "window_clipboard", + "winit", +] + +[[package]] +name = "image" +version = "0.24.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5690139d2f55868e080017335e4b94cb7414274c74f1669c84fb5feba2c9f69d" +dependencies = [ + "bytemuck", + "byteorder", + "color_quant", + "exr", + "gif", + "jpeg-decoder", + "num-traits", + "png", + "qoi", + "tiff", +] + +[[package]] +name = "indexmap" +version = "2.12.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0ad4bb2b565bca0645f4d68c5c9af97fba094e9791da685bf83cb5f3ce74acf2" +dependencies = [ + "equivalent", + "hashbrown 0.16.1", +] + +[[package]] +name = "instant" +version = "0.1.13" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222" +dependencies = [ + "cfg-if", +] + +[[package]] +name = "io-lifetimes" +version = "1.0.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "eae7b9aee968036d54dce06cebaefd919e4472e753296daccd6d344e3e2df0c2" +dependencies = [ + "hermit-abi 0.3.9", + "libc", + "windows-sys 0.48.0", +] + +[[package]] +name = "is-docker" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "928bae27f42bc99b60d9ac7334e3a21d10ad8f1835a4e12ec3ec0464765ed1b3" +dependencies = [ + "once_cell", +] + +[[package]] +name = "is-wsl" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "173609498df190136aa7dea1a91db051746d339e18476eed5ca40521f02d7aa5" +dependencies = [ + "is-docker", + "once_cell", +] + +[[package]] +name = "itertools" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285" +dependencies = [ + "either", +] + +[[package]] +name = "itoa" +version = "1.0.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c" + +[[package]] +name = "jni" +version = "0.21.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97" +dependencies = [ + "cesu8", + "cfg-if", + "combine", + "jni-sys", + "log", + "thiserror 1.0.69", + "walkdir", + "windows-sys 0.45.0", +] + +[[package]] +name = "jni-sys" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130" + +[[package]] +name = "jobserver" +version = "0.1.34" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33" +dependencies = [ + "getrandom 0.3.4", + "libc", +] + +[[package]] +name = "jpeg-decoder" +version = "0.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "00810f1d8b74be64b13dbf3db89ac67740615d6c891f0e7b6179326533011a07" +dependencies = [ + "rayon", +] + +[[package]] +name = "js-sys" +version = "0.3.82" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b011eec8cc36da2aab2d5cff675ec18454fad408585853910a202391cf9f8e65" +dependencies = [ + "once_cell", + "wasm-bindgen", +] + +[[package]] +name = "kamadak-exif" +version = "0.5.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ef4fc70d0ab7e5b6bafa30216a6b48705ea964cdfc29c050f2412295eba58077" +dependencies = [ + "mutate_once", +] + +[[package]] +name = "khronos-egl" +version = "6.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6aae1df220ece3c0ada96b8153459b67eebe9ae9212258bb0134ae60416fdf76" +dependencies = [ + "libc", + "libloading 0.8.9", + "pkg-config", +] + +[[package]] +name = "khronos_api" +version = "3.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc" + +[[package]] +name = "kurbo" +version = "0.10.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1618d4ebd923e97d67e7cd363d80aef35fe961005cbbbb3d2dad8bdd1bc63440" +dependencies = [ + "arrayvec", + "smallvec", +] + +[[package]] +name = "lebe" +version = "0.5.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7a79a3332a6609480d7d0c9eab957bca6b455b91bb84e66d19f5ff66294b85b8" + +[[package]] +name = "libc" +version = "0.2.177" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976" + +[[package]] +name = "libloading" +version = "0.7.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f" +dependencies = [ + "cfg-if", + "winapi", +] + +[[package]] +name = "libloading" +version = "0.8.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55" +dependencies = [ + "cfg-if", + "windows-link", +] + +[[package]] +name = "libm" +version = "0.2.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de" + +[[package]] +name = "libredox" +version = "0.1.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "416f7e718bdb06000964960ffa43b4335ad4012ae8b99060261aa4a8088d5ccb" +dependencies = [ + "bitflags 2.10.0", + "libc", + "redox_syscall 0.5.18", +] + +[[package]] +name = "linux-raw-sys" +version = "0.3.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519" + +[[package]] +name = "linux-raw-sys" +version = "0.4.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab" + +[[package]] +name = "linux-raw-sys" +version = "0.6.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2a385b1be4e5c3e362ad2ffa73c392e53f031eaa5b7d648e64cd87f27f6063d7" + +[[package]] +name = "linux-raw-sys" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039" + +[[package]] +name = "lock_api" +version = "0.4.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965" +dependencies = [ + "scopeguard", +] + +[[package]] +name = "log" +version = "0.4.28" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432" + +[[package]] +name = "lru" +version = "0.12.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38" + +[[package]] +name = "lsblk" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "05f50cb1109b79638b78a02ac752040c3e6b649f06e00e4587660fd4408d6a26" +dependencies = [ + "paste", + "thiserror 2.0.17", +] + +[[package]] +name = "lyon" +version = "1.0.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dbcb7d54d54c8937364c9d41902d066656817dce1e03a44e5533afebd1ef4352" +dependencies = [ + "lyon_algorithms", + "lyon_tessellation", +] + +[[package]] +name = "lyon_algorithms" +version = "1.0.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f4c0829e28c4f336396f250d850c3987e16ce6db057ffe047ce0dd54aab6b647" +dependencies = [ + "lyon_path", + "num-traits", +] + +[[package]] +name = "lyon_geom" +version = "1.0.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e260b6de923e6e47adfedf6243013a7a874684165a6a277594ee3906021b2343" +dependencies = [ + "arrayvec", + "euclid", + "num-traits", +] + +[[package]] +name = "lyon_path" +version = "1.0.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1aeca86bcfd632a15984ba029b539ffb811e0a70bf55e814ef8b0f54f506fdeb" +dependencies = [ + "lyon_geom", + "num-traits", +] + +[[package]] +name = "lyon_tessellation" +version = "1.0.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f3f586142e1280335b1bc89539f7c97dd80f08fc43e9ab1b74ef0a42b04aa353" +dependencies = [ + "float_next_after", + "lyon_path", + "num-traits", +] + +[[package]] +name = "malloc_buf" +version = "0.0.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "62bb907fe88d54d8d9ce32a3cceab4218ed2f6b7d35617cafe9adf84e43919cb" +dependencies = [ + "libc", +] + +[[package]] +name = "memchr" +version = "2.7.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273" + +[[package]] +name = "memmap2" +version = "0.9.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "744133e4a0e0a658e1374cf3bf8e415c4052a15a111acd372764c55b4177d490" +dependencies = [ + "libc", +] + +[[package]] +name = "memoffset" +version = "0.9.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a" +dependencies = [ + "autocfg", +] + +[[package]] +name = "metal" +version = "0.27.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c43f73953f8cbe511f021b58f18c3ce1c3d1ae13fe953293e13345bf83217f25" +dependencies = [ + "bitflags 2.10.0", + "block", + "core-graphics-types 0.1.3", + "foreign-types", + "log", + "objc", + "paste", +] + +[[package]] +name = "miniz_oxide" +version = "0.8.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316" +dependencies = [ + "adler2", + "simd-adler32", +] + +[[package]] +name = "mio" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "69d83b0086dc8ecf3ce9ae2874b2d1290252e2a30720bea58a5c6639b0092873" +dependencies = [ + "libc", + "wasi", + "windows-sys 0.61.2", +] + +[[package]] +name = "miow" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "536bfad37a309d62069485248eeaba1e8d9853aaf951caaeaed0585a95346f08" +dependencies = [ + "windows-sys 0.61.2", +] + +[[package]] +name = "mutate_once" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "13d2233c9842d08cfe13f9eac96e207ca6a2ea10b80259ebe8ad0268be27d2af" + +[[package]] +name = "naga" +version = "0.19.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "50e3524642f53d9af419ab5e8dd29d3ba155708267667c2f3f06c88c9e130843" +dependencies = [ + "bit-set", + "bitflags 2.10.0", + "codespan-reporting", + "hexf-parse", + "indexmap", + "log", + "num-traits", + "rustc-hash 1.1.0", + "spirv", + "termcolor", + "thiserror 1.0.69", + "unicode-xid", +] + +[[package]] +name = "ndk" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4" +dependencies = [ + "bitflags 2.10.0", + "jni-sys", + "log", + "ndk-sys 0.6.0+11769913", + "num_enum", + "raw-window-handle", + "thiserror 1.0.69", +] + +[[package]] +name = "ndk-context" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b" + +[[package]] +name = "ndk-sys" +version = "0.5.0+25.2.9519653" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8c196769dd60fd4f363e11d948139556a344e79d451aeb2fa2fd040738ef7691" +dependencies = [ + "jni-sys", +] + +[[package]] +name = "ndk-sys" +version = "0.6.0+11769913" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873" +dependencies = [ + "jni-sys", +] + +[[package]] +name = "nix" +version = "0.29.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46" +dependencies = [ + "bitflags 2.10.0", + "cfg-if", + "cfg_aliases 0.2.1", + "libc", + "memoffset", +] + +[[package]] +name = "num-format" +version = "0.4.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a652d9771a63711fd3c3deb670acfbe5c30a4072e664d7a3bf5a9e1056ac72c3" +dependencies = [ + "arrayvec", + "itoa", +] + +[[package]] +name = "num-traits" +version = "0.2.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841" +dependencies = [ + "autocfg", + "libm", +] + +[[package]] +name = "num_cpus" +version = "1.17.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b" +dependencies = [ + "hermit-abi 0.5.2", + "libc", +] + +[[package]] +name = "num_enum" +version = "0.7.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b1207a7e20ad57b847bbddc6776b968420d38292bbfe2089accff5e19e82454c" +dependencies = [ + "num_enum_derive", + "rustversion", +] + +[[package]] +name = "num_enum_derive" +version = "0.7.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ff32365de1b6743cb203b710788263c44a03de03802daf96092f2da4fe6ba4d7" +dependencies = [ + "proc-macro-crate", + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "objc" +version = "0.2.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "915b1b472bc21c53464d6c8461c9d3af805ba1ef837e1cac254428f4a77177b1" +dependencies = [ + "malloc_buf", + "objc_exception", +] + +[[package]] +name = "objc-sys" +version = "0.3.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cdb91bdd390c7ce1a8607f35f3ca7151b65afc0ff5ff3b34fa350f7d7c7e4310" + +[[package]] +name = "objc2" +version = "0.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "46a785d4eeff09c14c487497c162e92766fbb3e4059a71840cecc03d9a50b804" +dependencies = [ + "objc-sys", + "objc2-encode", +] + +[[package]] +name = "objc2-app-kit" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e4e89ad9e3d7d297152b17d39ed92cd50ca8063a89a9fa569046d41568891eff" +dependencies = [ + "bitflags 2.10.0", + "block2", + "libc", + "objc2", + "objc2-core-data", + "objc2-core-image", + "objc2-foundation", + "objc2-quartz-core", +] + +[[package]] +name = "objc2-cloud-kit" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "74dd3b56391c7a0596a295029734d3c1c5e7e510a4cb30245f8221ccea96b009" +dependencies = [ + "bitflags 2.10.0", + "block2", + "objc2", + "objc2-core-location", + "objc2-foundation", +] + +[[package]] +name = "objc2-contacts" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a5ff520e9c33812fd374d8deecef01d4a840e7b41862d849513de77e44aa4889" +dependencies = [ + "block2", + "objc2", + "objc2-foundation", +] + +[[package]] +name = "objc2-core-data" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "617fbf49e071c178c0b24c080767db52958f716d9eabdf0890523aeae54773ef" +dependencies = [ + "bitflags 2.10.0", + "block2", + "objc2", + "objc2-foundation", +] + +[[package]] +name = "objc2-core-image" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "55260963a527c99f1819c4f8e3b47fe04f9650694ef348ffd2227e8196d34c80" +dependencies = [ + "block2", + "objc2", + "objc2-foundation", + "objc2-metal", +] + +[[package]] +name = "objc2-core-location" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "000cfee34e683244f284252ee206a27953279d370e309649dc3ee317b37e5781" +dependencies = [ + "block2", + "objc2", + "objc2-contacts", + "objc2-foundation", +] + +[[package]] +name = "objc2-encode" +version = "4.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33" + +[[package]] +name = "objc2-foundation" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0ee638a5da3799329310ad4cfa62fbf045d5f56e3ef5ba4149e7452dcf89d5a8" +dependencies = [ + "bitflags 2.10.0", + "block2", + "dispatch", + "libc", + "objc2", +] + +[[package]] +name = "objc2-link-presentation" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a1a1ae721c5e35be65f01a03b6d2ac13a54cb4fa70d8a5da293d7b0020261398" +dependencies = [ + "block2", + "objc2", + "objc2-app-kit", + "objc2-foundation", +] + +[[package]] +name = "objc2-metal" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dd0cba1276f6023976a406a14ffa85e1fdd19df6b0f737b063b95f6c8c7aadd6" +dependencies = [ + "bitflags 2.10.0", + "block2", + "objc2", + "objc2-foundation", +] + +[[package]] +name = "objc2-quartz-core" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e42bee7bff906b14b167da2bac5efe6b6a07e6f7c0a21a7308d40c960242dc7a" +dependencies = [ + "bitflags 2.10.0", + "block2", + "objc2", + "objc2-foundation", + "objc2-metal", +] + +[[package]] +name = "objc2-symbols" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0a684efe3dec1b305badae1a28f6555f6ddd3bb2c2267896782858d5a78404dc" +dependencies = [ + "objc2", + "objc2-foundation", +] + +[[package]] +name = "objc2-ui-kit" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b8bb46798b20cd6b91cbd113524c490f1686f4c4e8f49502431415f3512e2b6f" +dependencies = [ + "bitflags 2.10.0", + "block2", + "objc2", + "objc2-cloud-kit", + "objc2-core-data", + "objc2-core-image", + "objc2-core-location", + "objc2-foundation", + "objc2-link-presentation", + "objc2-quartz-core", + "objc2-symbols", + "objc2-uniform-type-identifiers", + "objc2-user-notifications", +] + +[[package]] +name = "objc2-uniform-type-identifiers" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "44fa5f9748dbfe1ca6c0b79ad20725a11eca7c2218bceb4b005cb1be26273bfe" +dependencies = [ + "block2", + "objc2", + "objc2-foundation", +] + +[[package]] +name = "objc2-user-notifications" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "76cfcbf642358e8689af64cee815d139339f3ed8ad05103ed5eaf73db8d84cb3" +dependencies = [ + "bitflags 2.10.0", + "block2", + "objc2", + "objc2-core-location", + "objc2-foundation", +] + +[[package]] +name = "objc_exception" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ad970fb455818ad6cba4c122ad012fae53ae8b4795f86378bce65e4f6bab2ca4" +dependencies = [ + "cc", +] + +[[package]] +name = "once_cell" +version = "1.21.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" + +[[package]] +name = "open" +version = "5.3.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "43bb73a7fa3799b198970490a51174027ba0d4ec504b03cd08caf513d40024bc" +dependencies = [ + "is-wsl", + "libc", + "pathdiff", +] + +[[package]] +name = "orbclient" +version = "0.3.49" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "247ad146e19b9437f8604c21f8652423595cf710ad108af40e77d3ae6e96b827" +dependencies = [ + "libredox", +] + +[[package]] +name = "ordered-multimap" +version = "0.4.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ccd746e37177e1711c20dd619a1620f34f5c8b569c53590a72dedd5344d8924a" +dependencies = [ + "dlv-list", + "hashbrown 0.12.3", +] + +[[package]] +name = "ordered-stream" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9aa2b01e1d916879f73a53d01d1d6cee68adbb31d6d9177a8cfce093cced1d50" +dependencies = [ + "futures-core", + "pin-project-lite", +] + +[[package]] +name = "ouroboros" +version = "0.18.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e0f050db9c44b97a94723127e6be766ac5c340c48f2c4bb3ffa11713744be59" +dependencies = [ + "aliasable", + "ouroboros_macro", + "static_assertions", +] + +[[package]] +name = "ouroboros_macro" +version = "0.18.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3c7028bdd3d43083f6d8d4d5187680d0d3560d54df4cc9d752005268b41e64d0" +dependencies = [ + "heck", + "proc-macro2", + "proc-macro2-diagnostics", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "owned_ttf_parser" +version = "0.25.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "36820e9051aca1014ddc75770aab4d68bc1e9e632f0f5627c4086bc216fb583b" +dependencies = [ + "ttf-parser 0.25.1", +] + +[[package]] +name = "palette" +version = "0.7.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4cbf71184cc5ecc2e4e1baccdb21026c20e5fc3dcf63028a086131b3ab00b6e6" +dependencies = [ + "approx", + "fast-srgb8", + "palette_derive", + "phf", +] + +[[package]] +name = "palette_derive" +version = "0.7.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f5030daf005bface118c096f510ffb781fc28f9ab6a32ab224d8631be6851d30" +dependencies = [ + "by_address", + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "parking" +version = "2.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba" + +[[package]] +name = "parking_lot" +version = "0.11.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99" +dependencies = [ + "instant", + "lock_api", + "parking_lot_core 0.8.6", +] + +[[package]] +name = "parking_lot" +version = "0.12.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a" +dependencies = [ + "lock_api", + "parking_lot_core 0.9.12", +] + +[[package]] +name = "parking_lot_core" +version = "0.8.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "60a2cfe6f0ad2bfc16aefa463b497d5c7a5ecd44a23efa72aa342d90177356dc" +dependencies = [ + "cfg-if", + "instant", + "libc", + "redox_syscall 0.2.16", + "smallvec", + "winapi", +] + +[[package]] +name = "parking_lot_core" +version = "0.9.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1" +dependencies = [ + "cfg-if", + "libc", + "redox_syscall 0.5.18", + "smallvec", + "windows-link", +] + +[[package]] +name = "paste" +version = "1.0.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a" + +[[package]] +name = "pathdiff" +version = "0.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3" + +[[package]] +name = "percent-encoding" +version = "2.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220" + +[[package]] +name = "phf" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078" +dependencies = [ + "phf_macros", + "phf_shared", +] + +[[package]] +name = "phf_generator" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d" +dependencies = [ + "phf_shared", + "rand", +] + +[[package]] +name = "phf_macros" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216" +dependencies = [ + "phf_generator", + "phf_shared", + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "phf_shared" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5" +dependencies = [ + "siphasher", +] + +[[package]] +name = "pin-project" +version = "1.1.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a" +dependencies = [ + "pin-project-internal", +] + +[[package]] +name = "pin-project-internal" +version = "1.1.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "pin-project-lite" +version = "0.2.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b" + +[[package]] +name = "pin-utils" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184" + +[[package]] +name = "piper" +version = "0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "96c8c490f422ef9a4efd2cb5b42b76c8613d7e7dfc1caf667b8a3350a5acc066" +dependencies = [ + "atomic-waker", + "fastrand 2.3.0", + "futures-io", +] + +[[package]] +name = "pkg-config" +version = "0.3.32" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c" + +[[package]] +name = "png" +version = "0.17.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "82151a2fc869e011c153adc57cf2789ccb8d9906ce52c0b39a6b5697749d7526" +dependencies = [ + "bitflags 1.3.2", + "crc32fast", + "fdeflate", + "flate2", + "miniz_oxide", +] + +[[package]] +name = "polling" +version = "2.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4b2d323e8ca7996b3e23126511a523f7e62924d93ecd5ae73b333815b0eb3dce" +dependencies = [ + "autocfg", + "bitflags 1.3.2", + "cfg-if", + "concurrent-queue", + "libc", + "log", + "pin-project-lite", + "windows-sys 0.48.0", +] + +[[package]] +name = "polling" +version = "3.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218" +dependencies = [ + "cfg-if", + "concurrent-queue", + "hermit-abi 0.5.2", + "pin-project-lite", + "rustix 1.1.2", + "windows-sys 0.61.2", +] + +[[package]] +name = "ppv-lite86" +version = "0.2.21" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9" +dependencies = [ + "zerocopy", +] + +[[package]] +name = "presser" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e8cf8e6a8aa66ce33f63993ffc4ea4271eb5b0530a9002db8455ea6050c77bfa" + +[[package]] +name = "proc-macro-crate" +version = "3.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983" +dependencies = [ + "toml_edit", +] + +[[package]] +name = "proc-macro2" +version = "1.0.103" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8" +dependencies = [ + "unicode-ident", +] + +[[package]] +name = "proc-macro2-diagnostics" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", + "version_check", + "yansi", +] + +[[package]] +name = "profiling" +version = "1.0.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3eb8486b569e12e2c32ad3e204dbaba5e4b5b216e9367044f25f1dba42341773" + +[[package]] +name = "qoi" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7f6d64c71eb498fe9eae14ce4ec935c555749aef511cca85b5568910d6e48001" +dependencies = [ + "bytemuck", +] + +[[package]] +name = "quick-xml" +version = "0.37.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "331e97a1af0bf59823e6eadffe373d7b27f485be8748f71471c662c1f269b7fb" +dependencies = [ + "memchr", +] + +[[package]] +name = "quote" +version = "1.0.42" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f" +dependencies = [ + "proc-macro2", +] + +[[package]] +name = "r-efi" +version = "5.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f" + +[[package]] +name = "rand" +version = "0.8.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404" +dependencies = [ + "libc", + "rand_chacha", + "rand_core", +] + +[[package]] +name = "rand_chacha" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88" +dependencies = [ + "ppv-lite86", + "rand_core", +] + +[[package]] +name = "rand_core" +version = "0.6.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c" +dependencies = [ + "getrandom 0.2.16", +] + +[[package]] +name = "range-alloc" +version = "0.1.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c3d6831663a5098ea164f89cff59c6284e95f4e3c76ce9848d4529f5ccca9bde" + +[[package]] +name = "rangemap" +version = "1.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "acbbbbea733ec66275512d0b9694f34102e7d5406fdbe2ad8d21b28dce92887c" + +[[package]] +name = "raw-window-handle" +version = "0.6.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539" + +[[package]] +name = "rayon" +version = "1.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "368f01d005bf8fd9b1206fb6fa653e6c4a81ceb1466406b81792d87c5677a58f" +dependencies = [ + "either", + "rayon-core", +] + +[[package]] +name = "rayon-core" +version = "1.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91" +dependencies = [ + "crossbeam-deque", + "crossbeam-utils", +] + +[[package]] +name = "read-fonts" +version = "0.22.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "69aacb76b5c29acfb7f90155d39759a29496aebb49395830e928a9703d2eec2f" +dependencies = [ + "bytemuck", + "font-types", +] + +[[package]] +name = "redox_syscall" +version = "0.2.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a" +dependencies = [ + "bitflags 1.3.2", +] + +[[package]] +name = "redox_syscall" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa" +dependencies = [ + "bitflags 1.3.2", +] + +[[package]] +name = "redox_syscall" +version = "0.5.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d" +dependencies = [ + "bitflags 2.10.0", +] + +[[package]] +name = "redox_users" +version = "0.4.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43" +dependencies = [ + "getrandom 0.2.16", + "libredox", + "thiserror 1.0.69", +] + +[[package]] +name = "regex-automata" +version = "0.4.13" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c" +dependencies = [ + "aho-corasick", + "memchr", + "regex-syntax", +] + +[[package]] +name = "regex-syntax" +version = "0.8.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58" + +[[package]] +name = "renderdoc-sys" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "19b30a45b0cd0bcca8037f3d0dc3421eaf95327a17cad11964fb8179b4fc4832" + +[[package]] +name = "roxmltree" +version = "0.20.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97" + +[[package]] +name = "rust-ini" +version = "0.18.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f6d5f2436026b4f6e79dc829837d467cc7e9a55ee40e750d716713540715a2df" +dependencies = [ + "cfg-if", + "ordered-multimap", +] + +[[package]] +name = "rustc-hash" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2" + +[[package]] +name = "rustc-hash" +version = "2.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d" + +[[package]] +name = "rustix" +version = "0.37.28" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "519165d378b97752ca44bbe15047d5d3409e875f39327546b42ac81d7e18c1b6" +dependencies = [ + "bitflags 1.3.2", + "errno", + "io-lifetimes", + "libc", + "linux-raw-sys 0.3.8", + "windows-sys 0.48.0", +] + +[[package]] +name = "rustix" +version = "0.38.44" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154" +dependencies = [ + "bitflags 2.10.0", + "errno", + "libc", + "linux-raw-sys 0.4.15", + "windows-sys 0.59.0", +] + +[[package]] +name = "rustix" +version = "1.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e" +dependencies = [ + "bitflags 2.10.0", + "errno", + "libc", + "linux-raw-sys 0.11.0", + "windows-sys 0.61.2", +] + +[[package]] +name = "rustix-openpty" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1de16c7c59892b870a6336f185dc10943517f1327447096bbb7bb32cd85e2393" +dependencies = [ + "errno", + "libc", + "rustix 1.1.2", +] + +[[package]] +name = "rustversion" +version = "1.0.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" + +[[package]] +name = "rustybuzz" +version = "0.14.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cfb9cf8877777222e4a3bc7eb247e398b56baba500c38c1c46842431adc8b55c" +dependencies = [ + "bitflags 2.10.0", + "bytemuck", + "libm", + "smallvec", + "ttf-parser 0.21.1", + "unicode-bidi-mirroring", + "unicode-ccc", + "unicode-properties", + "unicode-script", +] + +[[package]] +name = "same-file" +version = "1.0.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502" +dependencies = [ + "winapi-util", +] + +[[package]] +name = "scoped-tls" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294" + +[[package]] +name = "scopeguard" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" + +[[package]] +name = "sctk-adwaita" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b6277f0217056f77f1d8f49f2950ac6c278c0d607c45f5ee99328d792ede24ec" +dependencies = [ + "ab_glyph", + "log", + "memmap2", + "smithay-client-toolkit 0.19.2", + "tiny-skia", +] + +[[package]] +name = "self_cell" +version = "1.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "16c2f82143577edb4921b71ede051dac62ca3c16084e918bf7b40c96ae10eb33" + +[[package]] +name = "serde" +version = "1.0.228" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e" +dependencies = [ + "serde_core", + "serde_derive", +] + +[[package]] +name = "serde_core" +version = "1.0.228" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad" +dependencies = [ + "serde_derive", +] + +[[package]] +name = "serde_derive" +version = "1.0.228" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "serde_repr" +version = "0.1.20" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "sha1" +version = "0.10.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba" +dependencies = [ + "cfg-if", + "cpufeatures", + "digest", +] + +[[package]] +name = "shlex" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64" + +[[package]] +name = "signal-hook" +version = "0.3.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2" +dependencies = [ + "libc", + "signal-hook-registry", +] + +[[package]] +name = "signal-hook-registry" +version = "1.4.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b2a4719bff48cee6b39d12c020eeb490953ad2443b7055bd0b21fca26bd8c28b" +dependencies = [ + "libc", +] + +[[package]] +name = "simd-adler32" +version = "0.3.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe" + +[[package]] +name = "siphasher" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d" + +[[package]] +name = "skrifa" +version = "0.22.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e1c44ad1f6c5bdd4eefed8326711b7dbda9ea45dfd36068c427d332aa382cbe" +dependencies = [ + "bytemuck", + "read-fonts", +] + +[[package]] +name = "slab" +version = "0.4.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589" + +[[package]] +name = "slotmap" +version = "1.0.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dbff4acf519f630b3a3ddcfaea6c06b42174d9a44bc70c620e9ed1649d58b82a" +dependencies = [ + "version_check", +] + +[[package]] +name = "smallvec" +version = "1.15.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03" + +[[package]] +name = "smithay-client-toolkit" +version = "0.19.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3457dea1f0eb631b4034d61d4d8c32074caa6cd1ab2d59f2327bd8461e2c0016" +dependencies = [ + "bitflags 2.10.0", + "calloop 0.13.0", + "calloop-wayland-source 0.3.0", + "cursor-icon", + "libc", + "log", + "memmap2", + "rustix 0.38.44", + "thiserror 1.0.69", + "wayland-backend", + "wayland-client", + "wayland-csd-frame", + "wayland-cursor", + "wayland-protocols", + "wayland-protocols-wlr", + "wayland-scanner", + "xkeysym", +] + +[[package]] +name = "smithay-client-toolkit" +version = "0.20.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0512da38f5e2b31201a93524adb8d3136276fa4fe4aafab4e1f727a82b534cc0" +dependencies = [ + "bitflags 2.10.0", + "calloop 0.14.3", + "calloop-wayland-source 0.4.1", + "cursor-icon", + "libc", + "log", + "memmap2", + "rustix 1.1.2", + "thiserror 2.0.17", + "wayland-backend", + "wayland-client", + "wayland-csd-frame", + "wayland-cursor", + "wayland-protocols", + "wayland-protocols-experimental", + "wayland-protocols-misc", + "wayland-protocols-wlr", + "wayland-scanner", + "xkeysym", +] + +[[package]] +name = "smithay-clipboard" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "71704c03f739f7745053bde45fa203a46c58d25bc5c4efba1d9a60e9dba81226" +dependencies = [ + "libc", + "smithay-client-toolkit 0.20.0", + "wayland-backend", +] + +[[package]] +name = "smol" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "13f2b548cd8447f8de0fdf1c592929f70f4fc7039a05e47404b0d096ec6987a1" +dependencies = [ + "async-channel 1.9.0", + "async-executor", + "async-fs 1.6.0", + "async-io 1.13.0", + "async-lock 2.8.0", + "async-net", + "async-process 1.8.1", + "blocking", + "futures-lite 1.13.0", +] + +[[package]] +name = "smol_str" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dd538fb6910ac1099850255cf94a94df6551fbdd602454387d0adb2d1ca6dead" +dependencies = [ + "serde", +] + +[[package]] +name = "socket2" +version = "0.4.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9f7916fc008ca5542385b89a3d3ce689953c143e9304a9bf8beec1de48994c0d" +dependencies = [ + "libc", + "winapi", +] + +[[package]] +name = "socket2" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "17129e116933cf371d018bb80ae557e889637989d8638274fb25622827b03881" +dependencies = [ + "libc", + "windows-sys 0.60.2", +] + +[[package]] +name = "softbuffer" +version = "0.4.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "18051cdd562e792cad055119e0cdb2cfc137e44e3987532e0f9659a77931bb08" +dependencies = [ + "as-raw-xcb-connection", + "bytemuck", + "cfg_aliases 0.2.1", + "core-graphics 0.24.0", + "drm", + "fastrand 2.3.0", + "foreign-types", + "js-sys", + "log", + "memmap2", + "objc2", + "objc2-foundation", + "objc2-quartz-core", + "raw-window-handle", + "redox_syscall 0.5.18", + "rustix 0.38.44", + "tiny-xlib", + "wasm-bindgen", + "wayland-backend", + "wayland-client", + "wayland-sys", + "web-sys", + "windows-sys 0.59.0", + "x11rb", +] + +[[package]] +name = "spectrum-installer" +version = "0.1.0" +dependencies = [ + "iced", + "iced_aw", + "iced_fonts 0.2.1", + "iced_term", + "lsblk", +] + +[[package]] +name = "spirv" +version = "0.3.0+sdk-1.3.268.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "eda41003dc44290527a59b13432d4a0379379fa074b70174882adfbdfd917844" +dependencies = [ + "bitflags 2.10.0", +] + +[[package]] +name = "static_assertions" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f" + +[[package]] +name = "strict-num" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6637bab7722d379c8b41ba849228d680cc12d0a45ba1fa2b48f2a30577a06731" + +[[package]] +name = "svg_fmt" +version = "0.4.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0193cc4331cfd2f3d2011ef287590868599a2f33c3e69bc22c1a3d3acf9e02fb" + +[[package]] +name = "swash" +version = "0.1.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cbd59f3f359ddd2c95af4758c18270eddd9c730dde98598023cdabff472c2ca2" +dependencies = [ + "skrifa", + "yazi", + "zeno", +] + +[[package]] +name = "syn" +version = "1.0.109" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + +[[package]] +name = "syn" +version = "2.0.110" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a99801b5bd34ede4cf3fc688c5919368fea4e4814a4664359503e6015b280aea" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + +[[package]] +name = "sys-locale" +version = "0.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8eab9a99a024a169fe8a903cf9d4a3b3601109bcc13bd9e3c6fff259138626c4" +dependencies = [ + "libc", +] + +[[package]] +name = "tempfile" +version = "3.23.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16" +dependencies = [ + "fastrand 2.3.0", + "getrandom 0.3.4", + "once_cell", + "rustix 1.1.2", + "windows-sys 0.61.2", +] + +[[package]] +name = "termcolor" +version = "1.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755" +dependencies = [ + "winapi-util", +] + +[[package]] +name = "thiserror" +version = "1.0.69" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52" +dependencies = [ + "thiserror-impl 1.0.69", +] + +[[package]] +name = "thiserror" +version = "2.0.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8" +dependencies = [ + "thiserror-impl 2.0.17", +] + +[[package]] +name = "thiserror-impl" +version = "1.0.69" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "thiserror-impl" +version = "2.0.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "tiff" +version = "0.9.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ba1310fcea54c6a9a4fd1aad794ecc02c31682f6bfbecdf460bf19533eed1e3e" +dependencies = [ + "flate2", + "jpeg-decoder", + "weezl", +] + +[[package]] +name = "tiny-skia" +version = "0.11.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "83d13394d44dae3207b52a326c0c85a8bf87f1541f23b0d143811088497b09ab" +dependencies = [ + "arrayref", + "arrayvec", + "bytemuck", + "cfg-if", + "log", + "png", + "tiny-skia-path", +] + +[[package]] +name = "tiny-skia-path" +version = "0.11.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9c9e7fc0c2e86a30b117d0462aa261b72b7a99b7ebd7deb3a14ceda95c5bdc93" +dependencies = [ + "arrayref", + "bytemuck", + "strict-num", +] + +[[package]] +name = "tiny-xlib" +version = "0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0324504befd01cab6e0c994f34b2ffa257849ee019d3fb3b64fb2c858887d89e" +dependencies = [ + "as-raw-xcb-connection", + "ctor-lite", + "libloading 0.8.9", + "pkg-config", + "tracing", +] + +[[package]] +name = "tinyvec" +version = "1.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa" +dependencies = [ + "tinyvec_macros", +] + +[[package]] +name = "tinyvec_macros" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" + +[[package]] +name = "tokio" +version = "1.48.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ff360e02eab121e0bc37a2d3b4d4dc622e6eda3a8e5253d5435ecf5bd4c68408" +dependencies = [ + "bytes", + "libc", + "mio", + "parking_lot 0.12.5", + "pin-project-lite", + "signal-hook-registry", + "socket2 0.6.1", + "tokio-macros", + "windows-sys 0.61.2", +] + +[[package]] +name = "tokio-macros" +version = "2.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "toml_datetime" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f2cdb639ebbc97961c51720f858597f7f24c4fc295327923af55b74c3c724533" +dependencies = [ + "serde_core", +] + +[[package]] +name = "toml_edit" +version = "0.23.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6485ef6d0d9b5d0ec17244ff7eb05310113c3f316f2d14200d4de56b3cb98f8d" +dependencies = [ + "indexmap", + "toml_datetime", + "toml_parser", + "winnow", +] + +[[package]] +name = "toml_parser" +version = "1.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c0cbe268d35bdb4bb5a56a2de88d0ad0eb70af5384a99d648cd4b3d04039800e" +dependencies = [ + "winnow", +] + +[[package]] +name = "tracing" +version = "0.1.41" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0" +dependencies = [ + "log", + "pin-project-lite", + "tracing-attributes", + "tracing-core", +] + +[[package]] +name = "tracing-attributes" +version = "0.1.30" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "tracing-core" +version = "0.1.34" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678" +dependencies = [ + "once_cell", +] + +[[package]] +name = "ttf-parser" +version = "0.20.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "17f77d76d837a7830fe1d4f12b7b4ba4192c1888001c7164257e4bc6d21d96b4" + +[[package]] +name = "ttf-parser" +version = "0.21.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2c591d83f69777866b9126b24c6dd9a18351f177e49d625920d19f989fd31cf8" + +[[package]] +name = "ttf-parser" +version = "0.25.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d2df906b07856748fa3f6e0ad0cbaa047052d4a7dd609e231c4f72cee8c36f31" + +[[package]] +name = "typenum" +version = "1.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb" + +[[package]] +name = "uds_windows" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "89daebc3e6fd160ac4aa9fc8b3bf71e1f74fbf92367ae71fb83a037e8bf164b9" +dependencies = [ + "memoffset", + "tempfile", + "winapi", +] + +[[package]] +name = "unicode-bidi" +version = "0.3.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5" + +[[package]] +name = "unicode-bidi-mirroring" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "23cb788ffebc92c5948d0e997106233eeb1d8b9512f93f41651f52b6c5f5af86" + +[[package]] +name = "unicode-ccc" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1df77b101bcc4ea3d78dafc5ad7e4f58ceffe0b2b16bf446aeb50b6cb4157656" + +[[package]] +name = "unicode-ident" +version = "1.0.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5" + +[[package]] +name = "unicode-linebreak" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3b09c83c3c29d37506a3e260c08c03743a6bb66a9cd432c6934ab501a190571f" + +[[package]] +name = "unicode-properties" +version = "0.1.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d" + +[[package]] +name = "unicode-script" +version = "0.5.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9fb421b350c9aff471779e262955939f565ec18b86c15364e6bdf0d662ca7c1f" + +[[package]] +name = "unicode-segmentation" +version = "1.12.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493" + +[[package]] +name = "unicode-width" +version = "0.1.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af" + +[[package]] +name = "unicode-width" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254" + +[[package]] +name = "unicode-xid" +version = "0.2.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" + +[[package]] +name = "version_check" +version = "0.9.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a" + +[[package]] +name = "vte" +version = "0.15.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a5924018406ce0063cd67f8e008104968b74b563ee1b85dde3ed1f7cb87d3dbd" +dependencies = [ + "arrayvec", + "bitflags 2.10.0", + "cursor-icon", + "log", + "memchr", + "serde", +] + +[[package]] +name = "waker-fn" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "317211a0dc0ceedd78fb2ca9a44aed3d7b9b26f81870d485c07122b4350673b7" + +[[package]] +name = "walkdir" +version = "2.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b" +dependencies = [ + "same-file", + "winapi-util", +] + +[[package]] +name = "wasi" +version = "0.11.1+wasi-snapshot-preview1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" + +[[package]] +name = "wasip2" +version = "1.0.1+wasi-0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7" +dependencies = [ + "wit-bindgen", +] + +[[package]] +name = "wasm-bindgen" +version = "0.2.105" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "da95793dfc411fbbd93f5be7715b0578ec61fe87cb1a42b12eb625caa5c5ea60" +dependencies = [ + "cfg-if", + "once_cell", + "rustversion", + "wasm-bindgen-macro", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-futures" +version = "0.4.55" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "551f88106c6d5e7ccc7cd9a16f312dd3b5d36ea8b4954304657d5dfba115d4a0" +dependencies = [ + "cfg-if", + "js-sys", + "once_cell", + "wasm-bindgen", + "web-sys", +] + +[[package]] +name = "wasm-bindgen-macro" +version = "0.2.105" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "04264334509e04a7bf8690f2384ef5265f05143a4bff3889ab7a3269adab59c2" +dependencies = [ + "quote", + "wasm-bindgen-macro-support", +] + +[[package]] +name = "wasm-bindgen-macro-support" +version = "0.2.105" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "420bc339d9f322e562942d52e115d57e950d12d88983a14c79b86859ee6c7ebc" +dependencies = [ + "bumpalo", + "proc-macro2", + "quote", + "syn 2.0.110", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-shared" +version = "0.2.105" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "76f218a38c84bcb33c25ec7059b07847d465ce0e0a76b995e134a45adcb6af76" +dependencies = [ + "unicode-ident", +] + +[[package]] +name = "wasm-timer" +version = "0.2.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "be0ecb0db480561e9a7642b5d3e4187c128914e58aa84330b9493e3eb68c5e7f" +dependencies = [ + "futures", + "js-sys", + "parking_lot 0.11.2", + "pin-utils", + "wasm-bindgen", + "wasm-bindgen-futures", + "web-sys", +] + +[[package]] +name = "wayland-backend" +version = "0.3.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "673a33c33048a5ade91a6b139580fa174e19fb0d23f396dca9fa15f2e1e49b35" +dependencies = [ + "cc", + "downcast-rs", + "rustix 1.1.2", + "scoped-tls", + "smallvec", + "wayland-sys", +] + +[[package]] +name = "wayland-client" +version = "0.31.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c66a47e840dc20793f2264eb4b3e4ecb4b75d91c0dd4af04b456128e0bdd449d" +dependencies = [ + "bitflags 2.10.0", + "rustix 1.1.2", + "wayland-backend", + "wayland-scanner", +] + +[[package]] +name = "wayland-csd-frame" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "625c5029dbd43d25e6aa9615e88b829a5cad13b2819c4ae129fdbb7c31ab4c7e" +dependencies = [ + "bitflags 2.10.0", + "cursor-icon", + "wayland-backend", +] + +[[package]] +name = "wayland-cursor" +version = "0.31.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "447ccc440a881271b19e9989f75726d60faa09b95b0200a9b7eb5cc47c3eeb29" +dependencies = [ + "rustix 1.1.2", + "wayland-client", + "xcursor", +] + +[[package]] +name = "wayland-protocols" +version = "0.32.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "efa790ed75fbfd71283bd2521a1cfdc022aabcc28bdcff00851f9e4ae88d9901" +dependencies = [ + "bitflags 2.10.0", + "wayland-backend", + "wayland-client", + "wayland-scanner", +] + +[[package]] +name = "wayland-protocols-experimental" +version = "20250721.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "40a1f863128dcaaec790d7b4b396cc9b9a7a079e878e18c47e6c2d2c5a8dcbb1" +dependencies = [ + "bitflags 2.10.0", + "wayland-backend", + "wayland-client", + "wayland-protocols", + "wayland-scanner", +] + +[[package]] +name = "wayland-protocols-misc" +version = "0.3.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2dfe33d551eb8bffd03ff067a8b44bb963919157841a99957151299a6307d19c" +dependencies = [ + "bitflags 2.10.0", + "wayland-backend", + "wayland-client", + "wayland-protocols", + "wayland-scanner", +] + +[[package]] +name = "wayland-protocols-plasma" +version = "0.3.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a07a14257c077ab3279987c4f8bb987851bf57081b93710381daea94f2c2c032" +dependencies = [ + "bitflags 2.10.0", + "wayland-backend", + "wayland-client", + "wayland-protocols", + "wayland-scanner", +] + +[[package]] +name = "wayland-protocols-wlr" +version = "0.3.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "efd94963ed43cf9938a090ca4f7da58eb55325ec8200c3848963e98dc25b78ec" +dependencies = [ + "bitflags 2.10.0", + "wayland-backend", + "wayland-client", + "wayland-protocols", + "wayland-scanner", +] + +[[package]] +name = "wayland-scanner" +version = "0.31.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "54cb1e9dc49da91950bdfd8b848c49330536d9d1fb03d4bfec8cae50caa50ae3" +dependencies = [ + "proc-macro2", + "quick-xml", + "quote", +] + +[[package]] +name = "wayland-sys" +version = "0.31.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "34949b42822155826b41db8e5d0c1be3a2bd296c747577a43a3e6daefc296142" +dependencies = [ + "dlib", + "log", + "once_cell", + "pkg-config", +] + +[[package]] +name = "web-sys" +version = "0.3.82" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3a1f95c0d03a47f4ae1f7a64643a6bb97465d9b740f0fa8f90ea33915c99a9a1" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + +[[package]] +name = "web-time" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + +[[package]] +name = "weezl" +version = "0.1.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a28ac98ddc8b9274cb41bb4d9d4d5c425b6020c50c46f25559911905610b4a88" + +[[package]] +name = "wgpu" +version = "0.19.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cbd7311dbd2abcfebaabf1841a2824ed7c8be443a0f29166e5d3c6a53a762c01" +dependencies = [ + "arrayvec", + "cfg-if", + "cfg_aliases 0.1.1", + "js-sys", + "log", + "naga", + "parking_lot 0.12.5", + "profiling", + "raw-window-handle", + "smallvec", + "static_assertions", + "wasm-bindgen", + "wasm-bindgen-futures", + "web-sys", + "wgpu-core", + "wgpu-hal", + "wgpu-types", +] + +[[package]] +name = "wgpu-core" +version = "0.19.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "28b94525fc99ba9e5c9a9e24764f2bc29bad0911a7446c12f446a8277369bf3a" +dependencies = [ + "arrayvec", + "bit-vec", + "bitflags 2.10.0", + "cfg_aliases 0.1.1", + "codespan-reporting", + "indexmap", + "log", + "naga", + "once_cell", + "parking_lot 0.12.5", + "profiling", + "raw-window-handle", + "rustc-hash 1.1.0", + "smallvec", + "thiserror 1.0.69", + "web-sys", + "wgpu-hal", + "wgpu-types", +] + +[[package]] +name = "wgpu-hal" +version = "0.19.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bfabcfc55fd86611a855816326b2d54c3b2fd7972c27ce414291562650552703" +dependencies = [ + "android_system_properties", + "arrayvec", + "ash", + "bit-set", + "bitflags 2.10.0", + "block", + "cfg_aliases 0.1.1", + "core-graphics-types 0.1.3", + "d3d12", + "glow", + "glutin_wgl_sys", + "gpu-alloc", + "gpu-allocator", + "gpu-descriptor", + "hassle-rs", + "js-sys", + "khronos-egl", + "libc", + "libloading 0.8.9", + "log", + "metal", + "naga", + "ndk-sys 0.5.0+25.2.9519653", + "objc", + "once_cell", + "parking_lot 0.12.5", + "profiling", + "range-alloc", + "raw-window-handle", + "renderdoc-sys", + "rustc-hash 1.1.0", + "smallvec", + "thiserror 1.0.69", + "wasm-bindgen", + "web-sys", + "wgpu-types", + "winapi", +] + +[[package]] +name = "wgpu-types" +version = "0.19.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b671ff9fb03f78b46ff176494ee1ebe7d603393f42664be55b64dc8d53969805" +dependencies = [ + "bitflags 2.10.0", + "js-sys", + "web-sys", +] + +[[package]] +name = "widestring" +version = "1.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471" + +[[package]] +name = "winapi" +version = "0.3.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419" +dependencies = [ + "winapi-i686-pc-windows-gnu", + "winapi-x86_64-pc-windows-gnu", +] + +[[package]] +name = "winapi-i686-pc-windows-gnu" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6" + +[[package]] +name = "winapi-util" +version = "0.1.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" +dependencies = [ + "windows-sys 0.61.2", +] + +[[package]] +name = "winapi-x86_64-pc-windows-gnu" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f" + +[[package]] +name = "window_clipboard" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f6d692d46038c433f9daee7ad8757e002a4248c20b0a3fbc991d99521d3bcb6d" +dependencies = [ + "clipboard-win", + "clipboard_macos", + "clipboard_wayland", + "clipboard_x11", + "raw-window-handle", + "thiserror 1.0.69", +] + +[[package]] +name = "windows" +version = "0.52.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e48a53791691ab099e5e2ad123536d0fff50652600abaf43bbf952894110d0be" +dependencies = [ + "windows-core 0.52.0", + "windows-targets 0.52.6", +] + +[[package]] +name = "windows-core" +version = "0.52.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9" +dependencies = [ + "windows-targets 0.52.6", +] + +[[package]] +name = "windows-core" +version = "0.62.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb" +dependencies = [ + "windows-implement", + "windows-interface", + "windows-link", + "windows-result", + "windows-strings", +] + +[[package]] +name = "windows-implement" +version = "0.60.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "windows-interface" +version = "0.59.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "windows-link" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5" + +[[package]] +name = "windows-result" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5" +dependencies = [ + "windows-link", +] + +[[package]] +name = "windows-strings" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091" +dependencies = [ + "windows-link", +] + +[[package]] +name = "windows-sys" +version = "0.45.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0" +dependencies = [ + "windows-targets 0.42.2", +] + +[[package]] +name = "windows-sys" +version = "0.48.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9" +dependencies = [ + "windows-targets 0.48.5", +] + +[[package]] +name = "windows-sys" +version = "0.52.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d" +dependencies = [ + "windows-targets 0.52.6", +] + +[[package]] +name = "windows-sys" +version = "0.59.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b" +dependencies = [ + "windows-targets 0.52.6", +] + +[[package]] +name = "windows-sys" +version = "0.60.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb" +dependencies = [ + "windows-targets 0.53.5", +] + +[[package]] +name = "windows-sys" +version = "0.61.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc" +dependencies = [ + "windows-link", +] + +[[package]] +name = "windows-targets" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071" +dependencies = [ + "windows_aarch64_gnullvm 0.42.2", + "windows_aarch64_msvc 0.42.2", + "windows_i686_gnu 0.42.2", + "windows_i686_msvc 0.42.2", + "windows_x86_64_gnu 0.42.2", + "windows_x86_64_gnullvm 0.42.2", + "windows_x86_64_msvc 0.42.2", +] + +[[package]] +name = "windows-targets" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c" +dependencies = [ + "windows_aarch64_gnullvm 0.48.5", + "windows_aarch64_msvc 0.48.5", + "windows_i686_gnu 0.48.5", + "windows_i686_msvc 0.48.5", + "windows_x86_64_gnu 0.48.5", + "windows_x86_64_gnullvm 0.48.5", + "windows_x86_64_msvc 0.48.5", +] + +[[package]] +name = "windows-targets" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973" +dependencies = [ + "windows_aarch64_gnullvm 0.52.6", + "windows_aarch64_msvc 0.52.6", + "windows_i686_gnu 0.52.6", + "windows_i686_gnullvm 0.52.6", + "windows_i686_msvc 0.52.6", + "windows_x86_64_gnu 0.52.6", + "windows_x86_64_gnullvm 0.52.6", + "windows_x86_64_msvc 0.52.6", +] + +[[package]] +name = "windows-targets" +version = "0.53.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3" +dependencies = [ + "windows-link", + "windows_aarch64_gnullvm 0.53.1", + "windows_aarch64_msvc 0.53.1", + "windows_i686_gnu 0.53.1", + "windows_i686_gnullvm 0.53.1", + "windows_i686_msvc 0.53.1", + "windows_x86_64_gnu 0.53.1", + "windows_x86_64_gnullvm 0.53.1", + "windows_x86_64_msvc 0.53.1", +] + +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8" + +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8" + +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3" + +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53" + +[[package]] +name = "windows_aarch64_msvc" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43" + +[[package]] +name = "windows_aarch64_msvc" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc" + +[[package]] +name = "windows_aarch64_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469" + +[[package]] +name = "windows_aarch64_msvc" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006" + +[[package]] +name = "windows_i686_gnu" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f" + +[[package]] +name = "windows_i686_gnu" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e" + +[[package]] +name = "windows_i686_gnu" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b" + +[[package]] +name = "windows_i686_gnu" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3" + +[[package]] +name = "windows_i686_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66" + +[[package]] +name = "windows_i686_gnullvm" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c" + +[[package]] +name = "windows_i686_msvc" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060" + +[[package]] +name = "windows_i686_msvc" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406" + +[[package]] +name = "windows_i686_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66" + +[[package]] +name = "windows_i686_msvc" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2" + +[[package]] +name = "windows_x86_64_gnu" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36" + +[[package]] +name = "windows_x86_64_gnu" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e" + +[[package]] +name = "windows_x86_64_gnu" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78" + +[[package]] +name = "windows_x86_64_gnu" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499" + +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3" + +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc" + +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d" + +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1" + +[[package]] +name = "windows_x86_64_msvc" +version = "0.42.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0" + +[[package]] +name = "windows_x86_64_msvc" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538" + +[[package]] +name = "windows_x86_64_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" + +[[package]] +name = "windows_x86_64_msvc" +version = "0.53.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650" + +[[package]] +name = "winit" +version = "0.30.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c66d4b9ed69c4009f6321f762d6e61ad8a2389cd431b97cb1e146812e9e6c732" +dependencies = [ + "ahash 0.8.12", + "android-activity", + "atomic-waker", + "bitflags 2.10.0", + "block2", + "bytemuck", + "calloop 0.13.0", + "cfg_aliases 0.2.1", + "concurrent-queue", + "core-foundation 0.9.4", + "core-graphics 0.23.2", + "cursor-icon", + "dpi", + "js-sys", + "libc", + "memmap2", + "ndk", + "objc2", + "objc2-app-kit", + "objc2-foundation", + "objc2-ui-kit", + "orbclient", + "percent-encoding", + "pin-project", + "raw-window-handle", + "redox_syscall 0.4.1", + "rustix 0.38.44", + "sctk-adwaita", + "smithay-client-toolkit 0.19.2", + "smol_str", + "tracing", + "unicode-segmentation", + "wasm-bindgen", + "wasm-bindgen-futures", + "wayland-backend", + "wayland-client", + "wayland-protocols", + "wayland-protocols-plasma", + "web-sys", + "web-time", + "windows-sys 0.52.0", + "x11-dl", + "x11rb", + "xkbcommon-dl", +] + +[[package]] +name = "winnow" +version = "0.7.13" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf" +dependencies = [ + "memchr", +] + +[[package]] +name = "winreg" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "80d0f4e272c85def139476380b12f9ac60926689dd2e01d4923222f40580869d" +dependencies = [ + "winapi", +] + +[[package]] +name = "wit-bindgen" +version = "0.46.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59" + +[[package]] +name = "x11-dl" +version = "2.21.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "38735924fedd5314a6e548792904ed8c6de6636285cb9fec04d5b1db85c1516f" +dependencies = [ + "libc", + "once_cell", + "pkg-config", +] + +[[package]] +name = "x11rb" +version = "0.13.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9993aa5be5a26815fe2c3eacfc1fde061fc1a1f094bf1ad2a18bf9c495dd7414" +dependencies = [ + "as-raw-xcb-connection", + "gethostname", + "libc", + "libloading 0.8.9", + "once_cell", + "rustix 1.1.2", + "x11rb-protocol", +] + +[[package]] +name = "x11rb-protocol" +version = "0.13.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ea6fc2961e4ef194dcbfe56bb845534d0dc8098940c7e5c012a258bfec6701bd" + +[[package]] +name = "xcursor" +version = "0.3.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bec9e4a500ca8864c5b47b8b482a73d62e4237670e5b5f1d6b9e3cae50f28f2b" + +[[package]] +name = "xdg-home" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ec1cdab258fb55c0da61328dc52c8764709b249011b2cad0454c72f0bf10a1f6" +dependencies = [ + "libc", + "windows-sys 0.59.0", +] + +[[package]] +name = "xkbcommon-dl" +version = "0.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d039de8032a9a8856a6be89cea3e5d12fdd82306ab7c94d74e6deab2460651c5" +dependencies = [ + "bitflags 2.10.0", + "dlib", + "log", + "once_cell", + "xkeysym", +] + +[[package]] +name = "xkeysym" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b9cc00251562a284751c9973bace760d86c0276c471b4be569fe6b068ee97a56" + +[[package]] +name = "xml-rs" +version = "0.8.28" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3ae8337f8a065cfc972643663ea4279e04e7256de865aa66fe25cec5fb912d3f" + +[[package]] +name = "yansi" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049" + +[[package]] +name = "yazi" +version = "0.1.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c94451ac9513335b5e23d7a8a2b61a7102398b8cca5160829d313e84c9d98be1" + +[[package]] +name = "zbus" +version = "4.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bb97012beadd29e654708a0fdb4c84bc046f537aecfde2c3ee0a9e4b4d48c725" +dependencies = [ + "async-broadcast", + "async-executor", + "async-fs 2.2.0", + "async-io 2.6.0", + "async-lock 3.4.1", + "async-process 2.5.0", + "async-recursion", + "async-task", + "async-trait", + "blocking", + "enumflags2", + "event-listener 5.4.1", + "futures-core", + "futures-sink", + "futures-util", + "hex", + "nix", + "ordered-stream", + "rand", + "serde", + "serde_repr", + "sha1", + "static_assertions", + "tracing", + "uds_windows", + "windows-sys 0.52.0", + "xdg-home", + "zbus_macros", + "zbus_names", + "zvariant", +] + +[[package]] +name = "zbus_macros" +version = "4.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "267db9407081e90bbfa46d841d3cbc60f59c0351838c4bc65199ecd79ab1983e" +dependencies = [ + "proc-macro-crate", + "proc-macro2", + "quote", + "syn 2.0.110", + "zvariant_utils", +] + +[[package]] +name = "zbus_names" +version = "3.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4b9b1fef7d021261cc16cba64c351d291b715febe0fa10dc3a443ac5a5022e6c" +dependencies = [ + "serde", + "static_assertions", + "zvariant", +] + +[[package]] +name = "zeno" +version = "0.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dd15f8e0dbb966fd9245e7498c7e9e5055d9e5c8b676b95bd67091cd11a1e697" + +[[package]] +name = "zerocopy" +version = "0.8.28" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "43fa6694ed34d6e57407afbccdeecfa268c470a7d2a5b0cf49ce9fcc345afb90" +dependencies = [ + "zerocopy-derive", +] + +[[package]] +name = "zerocopy-derive" +version = "0.8.28" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c640b22cd9817fae95be82f0d2f90b11f7605f6c319d16705c459b27ac2cbc26" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] + +[[package]] +name = "zune-inflate" +version = "0.2.54" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "73ab332fe2f6680068f3582b16a24f90ad7096d5d39b974d1c0aff0125116f02" +dependencies = [ + "simd-adler32", +] + +[[package]] +name = "zvariant" +version = "4.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2084290ab9a1c471c38fc524945837734fbf124487e105daec2bb57fd48c81fe" +dependencies = [ + "endi", + "enumflags2", + "serde", + "static_assertions", + "zvariant_derive", +] + +[[package]] +name = "zvariant_derive" +version = "4.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "73e2ba546bda683a90652bac4a279bc146adad1386f25379cf73200d2002c449" +dependencies = [ + "proc-macro-crate", + "proc-macro2", + "quote", + "syn 2.0.110", + "zvariant_utils", +] + +[[package]] +name = "zvariant_utils" +version = "2.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c51bcff7cc3dbb5055396bcf774748c3dab426b4b8659046963523cee4808340" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.110", +] diff --git a/tools/spectrum-installer/Cargo.lock.license b/tools/spectrum-installer/Cargo.lock.license new file mode 100644 index 0000000..bfe02ea --- /dev/null +++ b/tools/spectrum-installer/Cargo.lock.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> diff --git a/tools/spectrum-installer/Cargo.toml b/tools/spectrum-installer/Cargo.toml new file mode 100644 index 0000000..4be4dcd --- /dev/null +++ b/tools/spectrum-installer/Cargo.toml @@ -0,0 +1,14 @@ +# SPDX-License-Identifier: CC0-1.0 +# SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +[package] +name = "spectrum-installer" +version = "0.1.0" +edition = "2024" + +[dependencies] +iced = { version = "0.13", features = ["image"] } +iced_aw = { version = "0.12", features = ["spinner"] } +iced_fonts = { version = "0.2", features = ["bootstrap"] } +iced_term = { version = "0.6" } +lsblk = { version = "0.6" } diff --git a/tools/spectrum-installer/default.nix b/tools/spectrum-installer/default.nix new file mode 100644 index 0000000..3ab028b --- /dev/null +++ b/tools/spectrum-installer/default.nix @@ -0,0 +1,41 @@ +# SPDX-FileCopyrightText: 2024 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2025-2026 Johannes Süllner <johannes.suellner(a)mailbox.org> +# SPDX-License-Identifier: MIT + +import ../../lib/call-package.nix ( +args@{ callPackage, config, src, lib, rustPlatform, libcosmicAppHook }: + +rustPlatform.buildRustPackage rec { + name = "spectrum-installer"; + + src = lib.fileset.toSource { + root = ../..; + fileset = lib.fileset.intersection args.src ./.; + }; + sourceRoot = "source/tools/spectrum-installer"; + + cargoLock.lockFile = ./Cargo.lock; + + nativeBuildInputs = [ libcosmicAppHook ]; + + icons = callPackage ( + { runCommand, inkscape }: + runCommand "spectrum_installer_icons" { + nativeBuildInputs = [ inkscape ]; + logoSvg = ./res/installer_logo_mesh.svg; + } '' + mkdir $out + inkscape -w 22 -h 22 -o $out/22x22.png "$logoSvg" + inkscape -w 400 -h 400 -o $out/400x400.png "$logoSvg" + '' + ) {}; + + postInstall = '' + mkdir -p "$out/share/spectrum-installer/repart.d" + for f in $(ls "./res/repart.d"); do + substitute "./res/repart.d/$f" "$out/share/spectrum-installer/repart.d/$f" --subst-var-by "version" "${config.version}" + done + install -D "${icons}/22x22.png" "$out/share/icons/hicolor/22x22/apps/${name}.png" + install -D "${icons}/400x400.png" "$out/share/icons/hicolor/400x400/apps/${name}.png" + ''; +}) (_: {}) diff --git a/tools/spectrum-installer/res/installer_logo_mesh.svg b/tools/spectrum-installer/res/installer_logo_mesh.svg new file mode 100644 index 0000000..1e25829 --- /dev/null +++ b/tools/spectrum-installer/res/installer_logo_mesh.svg @@ -0,0 +1,85 @@ + + + + + + +<svg xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 100 100"> + <defs> + <filter id="ring-shadow" x="-10" y="-10" width="120" height="120" color-interpolation-filters="sRGB"> + <feGaussianBlur in="SourceGraphic" stdDeviation="5" result="blur" /> + <feComposite in="SourceGraphic" in2="offset" operator="over" /> + </filter> + + <filter id="center-shadow" x="-10" y="-10" width="120" height="120" color-interpolation-filters="sRGB"> + <feFlood flood-opacity="1" flood-color="#DDD" result="flood" /> + <feComposite in="flood" in2="SourceGraphic" operator="in" result="composite1" /> + <feGaussianBlur in="composite1" stdDeviation="6" result="blur" /> + <feComposite in="SourceGraphic" in2="blur" operator="over" result="composite2" /> + </filter> + + <meshgradient id="ring-gradient" x="1.5" y="0.5"> + <meshrow> + <meshpatch> + <stop path="L 1 -0.36603" stop-color="red" /> + <stop path="L 0.5 0.5" stop-color="yellow" /> + <stop path="L 0.5 0.5" stop-color="yellow" /> + <stop path="L 1 0.5" stop-color="red" /> + </meshpatch> + <meshpatch> + <stop path="L 0 -0.36603" /> + <stop path="L 0.5 0.5" stop-color="lime" /> + <stop path="L 0.5 0.5" stop-color="lime" /> + </meshpatch> + <meshpatch> + <stop path="L -0.5 0.5" /> + <stop path="L 0.5 0.5" stop-color="cyan" /> + <stop path="L 0.5 0.5" stop-color="cyan" /> + </meshpatch> + <meshpatch> + <stop path="L 0 1.36603" /> + <stop path="L 0.5 0.5" stop-color="blue" /> + <stop path="L 0.5 0.5" stop-color="blue" /> + </meshpatch> + <meshpatch> + <stop path="L 1 1.36603" /> + <stop path="L 0.5 0.5" stop-color="magenta" /> + <stop path="L 0.5 0.5" stop-color="magenta" /> + </meshpatch> + <meshpatch> + <stop path="L 1.5 0.5" /> + <stop path="L 0.5 0.5" stop-color="red" /> + <stop path="L 0.5 0.5" stop-color="red" /> + </meshpatch> + </meshrow> + </meshgradient> + + <marker + style="overflow:visible" + id="ArrowWideRounded" + refX="0" + refY="0" + orient="auto-start-reverse" + markerWidth="1" + markerHeight="1" + viewBox="0 0 1 1" + preserveAspectRatio="xMidYMid" + markerUnits="strokeWidth"> + <path + style="fill:none;stroke:context-stroke;stroke-width:1;stroke-linecap:round" + d="M 3,-3 0,0 3,3" + transform="rotate(180,0.125,0)" /> + </marker> + </defs> + + <circle cx="50" cy="50" r="36" fill="none" stroke="url(#ring-gradient)" stroke-width="5" filter="url(#ring-shadow)" /> + + <circle cx="50" cy="50" r="27" fill="white" filter="url(#center-shadow)" /> + + <path + style="fill:none;stroke:#000000;stroke-width:4.5;stroke-linecap:round;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#ArrowWideRounded)" + d="M 50,29.5 V 54" /> + <path + style="fill:none;stroke:#000000;stroke-width:4.5;stroke-linecap:round;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1" + d="M 65.419353,63.617021 H 34.580646" /> +</svg> diff --git a/tools/spectrum-installer/res/repart.d/10-esp.conf b/tools/spectrum-installer/res/repart.d/10-esp.conf new file mode 100644 index 0000000..1f3c5fc --- /dev/null +++ b/tools/spectrum-installer/res/repart.d/10-esp.conf @@ -0,0 +1,8 @@ +# SPDX-License-Identifier: CC0-1.0 +# SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +[Partition] +Type=esp +SizeMinBytes=500M +SizeMaxBytes=500M +CopyBlocks=/dev/disk/by-designator/esp diff --git a/tools/spectrum-installer/res/repart.d/20-verity-A.conf b/tools/spectrum-installer/res/repart.d/20-verity-A.conf new file mode 100644 index 0000000..6e688e3 --- /dev/null +++ b/tools/spectrum-installer/res/repart.d/20-verity-A.conf @@ -0,0 +1,9 @@ +# SPDX-License-Identifier: CC0-1.0 +# SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +[Partition] +Type=root-verity +Label=Spectrum_@version@.verity +SizeMinBytes=162M +SizeMaxBytes=162M +CopyBlocks=auto diff --git a/tools/spectrum-installer/res/repart.d/21-rootfs-A.conf b/tools/spectrum-installer/res/repart.d/21-rootfs-A.conf new file mode 100644 index 0000000..9d5ea6b --- /dev/null +++ b/tools/spectrum-installer/res/repart.d/21-rootfs-A.conf @@ -0,0 +1,9 @@ +# SPDX-License-Identifier: CC0-1.0 +# SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +[Partition] +Type=root +Label=Spectrum_@version@ +SizeMinBytes=20G +SizeMaxBytes=20G +CopyBlocks=auto diff --git a/tools/spectrum-installer/res/repart.d/30-verity-B.conf b/tools/spectrum-installer/res/repart.d/30-verity-B.conf new file mode 100644 index 0000000..3721ff0 --- /dev/null +++ b/tools/spectrum-installer/res/repart.d/30-verity-B.conf @@ -0,0 +1,8 @@ +# SPDX-License-Identifier: CC0-1.0 +# SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +[Partition] +Type=root-verity +Label=_empty +SizeMinBytes=162M +SizeMaxBytes=162M diff --git a/tools/spectrum-installer/res/repart.d/31-rootfs-B.conf b/tools/spectrum-installer/res/repart.d/31-rootfs-B.conf new file mode 100644 index 0000000..84e9f57 --- /dev/null +++ b/tools/spectrum-installer/res/repart.d/31-rootfs-B.conf @@ -0,0 +1,8 @@ +# SPDX-License-Identifier: CC0-1.0 +# SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +[Partition] +Type=root +Label=_empty +SizeMinBytes=20G +SizeMaxBytes=20G diff --git a/tools/spectrum-installer/res/repart.d/40-home.conf b/tools/spectrum-installer/res/repart.d/40-home.conf new file mode 100644 index 0000000..c487d34 --- /dev/null +++ b/tools/spectrum-installer/res/repart.d/40-home.conf @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: CC0-1.0 +# SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +[Partition] +Type=home +SizeMinBytes=500M +Format=btrfs diff --git a/tools/spectrum-installer/shell.nix b/tools/spectrum-installer/shell.nix new file mode 100644 index 0000000..060009b --- /dev/null +++ b/tools/spectrum-installer/shell.nix @@ -0,0 +1,30 @@ +# SPDX-License-Identifier: MIT +# SPDX-FileCopyrightText: 2025 iced contributors + +# from https://github.com/iced-rs/iced/blob/master/DEPENDENCIES.md +# last updated 2025-11-11 + +{ pkgs ? import <nixpkgs> {} }: + +pkgs.mkShell rec { + buildInputs = with pkgs; [ + cargo + lldb + expat + fontconfig + freetype + freetype.dev + libGL + pkg-config + rustfmt + xorg.libX11 + xorg.libXcursor + xorg.libXi + xorg.libXrandr + wayland + libxkbcommon + ]; + + LD_LIBRARY_PATH = + builtins.foldl' (a: b: "${a}:${b}/lib") "${pkgs.vulkan-loader}/lib" buildInputs; +} diff --git a/tools/spectrum-installer/src/main.rs b/tools/spectrum-installer/src/main.rs new file mode 100644 index 0000000..2ca9dfa --- /dev/null +++ b/tools/spectrum-installer/src/main.rs @@ -0,0 +1,52 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +mod pages; + +use iced::Element; +use iced::Size; +use iced::Subscription; +use iced::Task; +use pages::Event; + +fn main() -> iced::Result { + iced::application( + "Spectrum installer", + SpectrumInstaller::update, + SpectrumInstaller::view, + ) + .window_size(Size::new(pages::WINDOW_WIDTH, pages::WINDOW_HEIGHT)) + .font(iced_fonts::BOOTSTRAP_FONT_BYTES) + .resizable(false) + .subscription(SpectrumInstaller::subscription) + .run() +} + +struct SpectrumInstaller { + current_page: Box<dyn pages::Page>, +} +impl Default for SpectrumInstaller { + fn default() -> Self { + Self { + current_page: Box::new(pages::INITAL_PAGE), + } + } +} + +impl SpectrumInstaller { + fn update(&mut self, event: pages::Event) -> Task<Event> { + let (maybe_new_page, task) = self.current_page.update(event); + if let Some(new_page) = maybe_new_page { + self.current_page = new_page; + } + task + } + + fn view(&self) -> Element<'_, pages::Event> { + self.current_page.view() + } + + fn subscription(&self) -> Subscription<pages::Event> { + self.current_page.subscription() + } +} diff --git a/tools/spectrum-installer/src/pages/completion.rs b/tools/spectrum-installer/src/pages/completion.rs new file mode 100644 index 0000000..2ea9734 --- /dev/null +++ b/tools/spectrum-installer/src/pages/completion.rs @@ -0,0 +1,112 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +use super::{ + BUTTON_TEXT_SIZE, Event, MARGIN_LR, MARGIN_VERTICAL, Page, TITLE_TEXT_SIZE, UpdateResult, + WINDOW_WIDTH, +}; +use crate::{center_horizontal_in_container, center_in_container}; +use iced::{ + Element, Task, + widget::{ + Scrollable, Space, column, + scrollable::{Direction, Scrollbar}, + text, + }, + window, +}; +use std::process::Command; + +const S6_HPR_PATH: &str = "/bin/s6-linux-init-hpr"; + +pub struct PageCompletion { + install_result: super::InstallResult, +} + +impl PageCompletion { + pub fn new(install_result: super::InstallResult) -> Self { + Self { install_result } + } +} + +#[derive(Clone, Debug)] +pub enum PageCompletionEvent { + Quit, + Poweroff, + Reboot, +} + +impl PageCompletion { + fn close(id: window::Id) -> Task<Event> { + window::close(id) + } + + fn spawn_s6_hpr(parameter: &str) { + let _ = Command::new(S6_HPR_PATH).arg(parameter).spawn(); + } +} + +impl Page for PageCompletion { + fn update(&mut self, event: Event) -> UpdateResult { + if let Event::PageCompletion(page_completion_event) = event { + match page_completion_event { + PageCompletionEvent::Quit => { + return (None, window::get_latest().and_then(Self::close)); + } + PageCompletionEvent::Poweroff => { + Self::spawn_s6_hpr("-p"); + } + PageCompletionEvent::Reboot => { + Self::spawn_s6_hpr("-r"); + } + } + }; + + (None, Task::none()) + } + + fn view(&self) -> Element<'_, Event> { + let main_element = match &self.install_result { + Ok(_) => { + center_in_container!(text("Spectrum installation succeeded!").size(TITLE_TEXT_SIZE)).into() + } + Err((code, log)) => { + column![ + Space::with_height(MARGIN_VERTICAL), + center_horizontal_in_container!(text("Spectrum installation failed :( ").size(TITLE_TEXT_SIZE)), + Space::with_height(MARGIN_VERTICAL), + center_horizontal_in_container!(Scrollable::new(text(format!("You can reach out to the team via Chat or the \"discuss\" mailing list.\n\ + See https://spectrum-os.org/doc/contributing/communication.html for details.\n\ + The following information may be relevant:\n\n\ + Error code: {}\n\nError log:\n{}", code, log))) + .width(WINDOW_WIDTH - 2.0 * MARGIN_LR) + .height(500) + .direction(Direction::Vertical(Scrollbar::new()))), + ] + .into() + } + }; + + super::layout::bottom_buttons_layout( + [ + vec![ + ( + text("Reboot").size(BUTTON_TEXT_SIZE).into(), + Some(Event::PageCompletion(PageCompletionEvent::Reboot)), + ), + ( + text("Poweroff").size(BUTTON_TEXT_SIZE).into(), + Some(Event::PageCompletion(PageCompletionEvent::Poweroff)), + ), + ], + vec![( + text("Quit installer, stay in live environment") + .size(BUTTON_TEXT_SIZE) + .into(), + Some(Event::PageCompletion(PageCompletionEvent::Quit)), + )], + ], + main_element, + ) + } +} diff --git a/tools/spectrum-installer/src/pages/confirmation.rs b/tools/spectrum-installer/src/pages/confirmation.rs new file mode 100644 index 0000000..25084b6 --- /dev/null +++ b/tools/spectrum-installer/src/pages/confirmation.rs @@ -0,0 +1,108 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +use super::{ + BUTTON_TEXT_SIZE, Event, MARGIN_LR, MARGIN_VERTICAL, Page, TITLE_TEXT_SIZE, UpdateResult, + WINDOW_WIDTH, +}; +use crate::center_horizontal_in_container; +use iced::{ + Length, Task, + widget::{Space, checkbox, column, container, text}, +}; +use lsblk::BlockDevice; + +pub struct PageConfirmation { + device: BlockDevice, + install_confirmed: bool, +} + +impl PageConfirmation { + pub fn new(device: BlockDevice) -> Self { + Self { + device, + install_confirmed: false, + } + } +} + +#[derive(Clone, Debug)] +pub enum PageConfirmationEvent { + Back, + ConfirmCheckboxToggled(bool), + StartInstallation, +} + +impl Page for PageConfirmation { + fn update(&mut self, event: Event) -> UpdateResult { + if let Event::PageConfirmation(page_event) = event { + match page_event { + PageConfirmationEvent::Back => { + return ( + Some(Box::new(super::disk_selection::PageDiskSelection::new())), + Task::none(), + ); + } + PageConfirmationEvent::ConfirmCheckboxToggled(bool) => { + self.install_confirmed = bool; + } + PageConfirmationEvent::StartInstallation => { + return ( + Some(Box::new(super::installation::PageInstallation::new( + self.device.clone(), + ))), + Task::none(), + ); + } + } + } + (None, Task::none()) + } + + fn view(&self) -> iced::Element<'_, Event> { + let main_content = column![ + Space::with_height(Length::Fill), + center_horizontal_in_container!(text("Confirm Installation").size(TITLE_TEXT_SIZE)), + Space::with_height(MARGIN_VERTICAL), + center_horizontal_in_container!(text( + "Erease all data on the following device and install Spectrum?" + )), + Space::with_height(MARGIN_VERTICAL), + center_horizontal_in_container!( + container(super::layout::disk_element(&self.device)) + .width(WINDOW_WIDTH - 2.0 * MARGIN_LR) + ), + Space::with_height(MARGIN_VERTICAL), + center_horizontal_in_container!( + checkbox( + format!("I understand all data on {} will be lost", self.device.name), + self.install_confirmed + ) + .on_toggle(|bool| Event::PageConfirmation( + PageConfirmationEvent::ConfirmCheckboxToggled(bool) + )) + ), + Space::with_height(Length::Fill), + ]; + + super::layout::bottom_buttons_layout( + [[ + ( + text("Back").size(BUTTON_TEXT_SIZE).into(), + Some(Event::PageConfirmation(PageConfirmationEvent::Back)), + ), + ( + text("Start installation").size(BUTTON_TEXT_SIZE).into(), + if self.install_confirmed { + Some(Event::PageConfirmation( + PageConfirmationEvent::StartInstallation, + )) + } else { + None + }, + ), + ]], + main_content.into(), + ) + } +} diff --git a/tools/spectrum-installer/src/pages/disk_selection.rs b/tools/spectrum-installer/src/pages/disk_selection.rs new file mode 100644 index 0000000..0d28022 --- /dev/null +++ b/tools/spectrum-installer/src/pages/disk_selection.rs @@ -0,0 +1,134 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +use super::{ + BUTTON_TEXT_SIZE, Event, MARGIN_LR, MARGIN_VERTICAL, Page, TITLE_TEXT_SIZE, UpdateResult, + WINDOW_WIDTH, +}; +use crate::center_horizontal_in_container; +use iced::{ + Length, Task, + widget::{ + Scrollable, Space, button, column, + scrollable::{Direction, Scrollbar}, + text, + }, +}; +use lsblk::BlockDevice; + +pub struct PageDiskSelection { + destination_device: Option<BlockDevice>, +} + +impl PageDiskSelection { + pub fn new() -> Self { + Self { + destination_device: None, + } + } +} + +#[derive(Clone, Debug)] +pub enum PageDiskSelectionEvent { + Back, + SelectDevice(BlockDevice), + ContinueWithDevice(BlockDevice), +} + +impl Page for PageDiskSelection { + fn update(&mut self, event: Event) -> UpdateResult { + if let Event::PageDiskSelection(page_disk_selection_event) = event { + match page_disk_selection_event { + PageDiskSelectionEvent::Back => { + return ( + Some(Box::new(super::welcome::PageWelcome::new())), + Task::none(), + ); + } + PageDiskSelectionEvent::SelectDevice(device) => { + self.destination_device = Some(device); + } + PageDiskSelectionEvent::ContinueWithDevice(device) => { + return ( + Some(Box::new(super::confirmation::PageConfirmation::new(device))), + Task::none(), + ); + } + } + } + (None, Task::none()) + } + + fn view(&self) -> iced::Element<'_, Event> { + let mut block_devices = BlockDevice::list().expect("Failed to get block devices"); + block_devices.sort_by_key(|device| device.name.clone()); + + let mut possible_block_devices = block_devices + .iter() + .filter(|device| { + BlockDevice::is_disk(device) + && !&device.name.starts_with("loop") + && !&device.name.starts_with("sr") + }) + .peekable(); + + let destinations: iced::Element<Event> = if possible_block_devices.peek().is_none() { + text("No applicable devices to install Spectrum to found.").into() + } else { + column(possible_block_devices.map(|device| { + button(super::layout::disk_element(&device)) + .on_press(Event::PageDiskSelection( + PageDiskSelectionEvent::SelectDevice(device.clone()), + )) + .width(WINDOW_WIDTH - 2.0 * MARGIN_LR) + .style({ + if self + .destination_device + .as_ref() + .is_some_and(|d| d.fullname == device.fullname) + { + button::success + } else { + button::primary + } + }) + .into() + })) + .spacing(8) + .into() + }; + + let main_content = column![ + Space::with_height(MARGIN_VERTICAL), + center_horizontal_in_container!( + text("Select the device to install Spectrum to").size(TITLE_TEXT_SIZE) + ), + Space::with_height(MARGIN_VERTICAL), + center_horizontal_in_container!( + Scrollable::new(destinations) + .height(Length::Fill) + .direction(Direction::Vertical(Scrollbar::new())) + ), + Space::with_height(MARGIN_VERTICAL), + ]; + + super::layout::bottom_buttons_layout( + [[ + ( + text("Back").size(BUTTON_TEXT_SIZE).into(), + Some(Event::PageDiskSelection(PageDiskSelectionEvent::Back)), + ), + ( + text("Next").size(BUTTON_TEXT_SIZE).into(), + match &self.destination_device { + None => None, + Some(device) => Some(Event::PageDiskSelection( + PageDiskSelectionEvent::ContinueWithDevice(device.clone()), + )), + }, + ), + ]], + main_content.into(), + ) + } +} diff --git a/tools/spectrum-installer/src/pages/installation.rs b/tools/spectrum-installer/src/pages/installation.rs new file mode 100644 index 0000000..16da197 --- /dev/null +++ b/tools/spectrum-installer/src/pages/installation.rs @@ -0,0 +1,182 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +use super::{ + BUTTON_TEXT_SIZE, Event, InstallResult, MARGIN_VERTICAL, Page, TITLE_TEXT_SIZE, UpdateResult, +}; +use crate::center_horizontal_in_container; +use iced::{ + Length, Subscription, Task, + widget::{Space, column, container, row, text}, +}; +use iced_aw::Spinner; +use iced_term::Terminal; +use lsblk::BlockDevice; +use std::fs; + +const RESULT_CODE_FILE: &str = "/tmp/spectrum-installer_result-code"; +const LOG_FILE: &str = "/tmp/spectrum-installer_log"; + +pub struct PageInstallation { + terminal: Option<Terminal>, + installation_completed: bool, + installation_result: Option<InstallResult>, +} + +impl PageInstallation { + pub fn new(device: BlockDevice) -> Self { + let term = Terminal::new( + 0, + iced_term::settings::Settings { + backend: iced_term::settings::BackendSettings { + program: String::from("/usr/bin/sh"), + args: Vec::from([ + String::from("-c"), + // Install enforcing a new partition table. + // HACK: Logging to /tmp as iced_term does not offer any other way of obtaining the commands result. + String::from( + [ + "( /usr/bin/systemd-repart \ + --definitions=/usr/share/spectrum-installer/repart.d \ + --empty=force \ + --dry-run=no ", + &device.fullname.display().to_string(), + "; echo $? > ", + RESULT_CODE_FILE, + ") 2>&1 | tee ", + LOG_FILE, + ] + .concat(), + ), + ]), + }, + ..Default::default() + }, + ); + + match term { + Ok(term) => Self { + terminal: Some(term), + installation_completed: false, + installation_result: None, + }, + Err(e) => Self { + terminal: None, + installation_completed: true, + installation_result: Some(Err((0, e.to_string()))), + }, + } + } +} + +#[derive(Clone, Debug)] +pub enum PageInstallationEvent { + Terminal(iced_term::Event), + Finish, +} + +impl Page for PageInstallation { + fn update(&mut self, event: Event) -> UpdateResult { + if let Event::PageInstallation(page_event) = event { + match page_event { + PageInstallationEvent::Finish => { + if let Some(installation_result) = self.installation_result.clone() { + return ( + Some(Box::new(super::completion::PageCompletion::new( + installation_result, + ))), + Task::none(), + ); + } + } + PageInstallationEvent::Terminal(iced_term::Event::BackendCall(_, cmd)) => { + if let Some(term) = &mut self.terminal { + match term.handle(iced_term::Command::ProxyToBackend(cmd)) { + iced_term::actions::Action::Shutdown => { + let code = fs::read_to_string(RESULT_CODE_FILE); + let log = fs::read_to_string(LOG_FILE); + self.installation_result = + if let (Ok(code_as_str), Ok(log)) = (code, log) { + if let Ok(code) = code_as_str.trim().parse::<u32>() { + self.installation_completed = true; + if code == 0 { + Some(Ok(log)) + } else { + Some(Err((code, log))) + } + } else { + None + } + } else { + None + }; + } + _ => {} + } + } + } + } + } + (None, Task::none()) + } + + fn subscription(&self) -> Subscription<Event> { + if let Some(term) = &self.terminal { + return Subscription::run_with_id(term.id, term.subscription()) + .map::<_, _>(|t| Event::PageInstallation(PageInstallationEvent::Terminal(t))); + } + + Subscription::none() + } + + fn view(&self) -> iced::Element<'_, Event> { + let title_row: iced::Element<Event> = if !self.installation_completed { + row![ + Spinner::new().height(25), + Space::with_width(MARGIN_VERTICAL), + text("Installing ...").size(TITLE_TEXT_SIZE) + ] + .into() + } else { + text( + if self.installation_result.as_ref().is_some_and(|r| r.is_ok()) { + "Installation completed." + } else { + "Installation failed." + }, + ) + .size(TITLE_TEXT_SIZE) + .into() + }; + + let installation_status: iced::Element<Event> = if let Some(term) = &self.terminal { + iced_term::TerminalView::show(term) + .map::<_>(|t| Event::PageInstallation(PageInstallationEvent::Terminal(t))) + .into() + } else { + text("Could not start installation.").into() + }; + + let main_content = column![ + Space::with_height(MARGIN_VERTICAL), + center_horizontal_in_container!(title_row), + Space::with_height(MARGIN_VERTICAL), + container(installation_status) + .width(Length::Fill) + .center_x(Length::Fill) + .height(Length::Fill), + ]; + + super::layout::bottom_buttons_layout( + [[( + text("Finish").size(BUTTON_TEXT_SIZE).into(), + if self.installation_completed { + Some(Event::PageInstallation(PageInstallationEvent::Finish)) + } else { + None + }, + )]], + main_content.into(), + ) + } +} diff --git a/tools/spectrum-installer/src/pages/layout.rs b/tools/spectrum-installer/src/pages/layout.rs new file mode 100644 index 0000000..e7095bd --- /dev/null +++ b/tools/spectrum-installer/src/pages/layout.rs @@ -0,0 +1,122 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +use iced::{ + Element, Length, + widget::{Button, Column, Row, button, column, container, row, text}, +}; +use iced_fonts::{BOOTSTRAP_FONT as ICON_FONT, Bootstrap as Icon}; +use lsblk::BlockDevice; + +use super::Event; + +#[macro_export] +macro_rules! center_horizontal_in_container { + ($e:expr) => { + iced::widget::container($e) + .width(iced::Length::Fill) + .center_x(iced::Length::Fill) + }; +} +#[macro_export] +macro_rules! center_in_container { + ($e:expr) => { + iced::widget::container($e) + .height(iced::Length::Fill) + .width(iced::Length::Fill) + .center_x(iced::Length::Fill) + .center_y(iced::Length::Fill) + }; +} + +const BOTTOM_BUTTON_SPACE: f32 = 2.0; +const BOTTOM_BUTTON_ROW_HEIGHT: f32 = 50.0; +const DISK_ICON_SIZE: u16 = 50; + +fn bottom_button<'a>( + button_content: Element<'a, Event>, + button_on_press: Option<Event>, +) -> Button<'a, Event> { + button( + center_in_container!(button_content) + .height(Length::Fill) + .center_y(Length::Fill), + ) + .on_press_maybe(button_on_press) + .width(Length::Fill) + .height(Length::Fill) +} + +pub fn bottom_buttons_layout<'a>( + button_matrix: impl IntoIterator< + Item = impl IntoIterator<Item = (Element<'a, Event>, Option<Event>)>, + >, + main_element: Element<'a, Event>, +) -> Element<'a, Event> { + let mut bottom_height = 0.0; + let mut bottom_element = Column::new().spacing(BOTTOM_BUTTON_SPACE); + for input_row in button_matrix.into_iter() { + let mut output_row = Row::new().spacing(BOTTOM_BUTTON_SPACE); + for (button_content, button_on_press) in input_row.into_iter() { + output_row = output_row.push(bottom_button(button_content, button_on_press)); + } + bottom_element = bottom_element.push(output_row); + bottom_height += BOTTOM_BUTTON_ROW_HEIGHT; + } + + column![ + center_horizontal_in_container!(main_element).height(Length::Fill), + container(bottom_element).height(bottom_height) + ] + .into() +} + +pub fn disk_element(device: &BlockDevice) -> Element<'static, Event> { + let icon: Element<Event> = text(Icon::Hdd.to_string()) + .font(ICON_FONT) + .size(DISK_ICON_SIZE) + .into(); + + let disk_size = if let Ok(Some(capacity)) = device.capacity() { + let mut size_factor: f32 = (capacity * 512) as f32; + let mut exponent = 0; // base = 1024 + while size_factor >= 1000.0 { + exponent += 1; + size_factor = size_factor / 1000.0; + } + let unit = match exponent { + 0 => "", + 1 => "K", + 2 => "M", + 3 => "G", + 4 => "T", + 5 => "P", + 6 => "E", + 7 => "Z", + 8 => "Y", + 9 => "R", + _ => "???", + }; + Ok(format!("{:.2} {}B", size_factor, unit)) + } else { + Err("Failed to get disk size") + }; + + let disk_id = if let Some(id) = &device.id { id } else { "" }; + + row![ + icon, + text(format!( + "{}\n{}\n{}", + device.fullname.display(), + disk_id, + if let Ok(size) = disk_size { + size + } else { + String::from("(unknown size)") + } + )) + ] + .spacing(8) + .into() +} diff --git a/tools/spectrum-installer/src/pages/mod.rs b/tools/spectrum-installer/src/pages/mod.rs new file mode 100644 index 0000000..cd020f1 --- /dev/null +++ b/tools/spectrum-installer/src/pages/mod.rs @@ -0,0 +1,43 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +use iced::{Subscription, Task}; + +mod completion; +mod confirmation; +mod disk_selection; +mod installation; +mod layout; +mod welcome; + +pub const WINDOW_WIDTH: f32 = 750.0; +pub const WINDOW_HEIGHT: f32 = 650.0; + +pub const MARGIN_VERTICAL: f32 = 25.0; +pub const MARGIN_LR: f32 = 15.0; +pub const BUTTON_TEXT_SIZE: u16 = 20; +pub const TITLE_TEXT_SIZE: u16 = 24; + +type UpdateResult = (Option<Box<dyn Page>>, Task<Event>); + +type InstallResult = Result<String, (u32, String)>; + +pub trait Page { + fn update(&mut self, event: Event) -> UpdateResult; + fn view(&self) -> iced::Element<'_, Event>; + fn subscription(&self) -> Subscription<Event> { + Subscription::none() + } +} + +#[derive(Clone, Debug)] +pub enum Event { + /* Pages are ordered as they appear during the installation. */ + PageWelcome(welcome::PageWelcomeEvent), + PageDiskSelection(disk_selection::PageDiskSelectionEvent), + PageConfirmation(confirmation::PageConfirmationEvent), + PageInstallation(installation::PageInstallationEvent), + PageCompletion(completion::PageCompletionEvent), +} + +pub const INITAL_PAGE: welcome::PageWelcome = welcome::PageWelcome {}; diff --git a/tools/spectrum-installer/src/pages/welcome.rs b/tools/spectrum-installer/src/pages/welcome.rs new file mode 100644 index 0000000..fb91fd1 --- /dev/null +++ b/tools/spectrum-installer/src/pages/welcome.rs @@ -0,0 +1,62 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Johannes Süllner <johannes.suellner(a)mailbox.org> + +use super::{BUTTON_TEXT_SIZE, Event, MARGIN_VERTICAL, Page, TITLE_TEXT_SIZE, UpdateResult}; +use crate::{center_horizontal_in_container, center_in_container}; +use iced::{ + Element, Length, Task, + widget::{Space, column, image, text}, +}; + +const LOGO_PATH_GLOBAL: &str = "/usr/share/icons/hicolor/400x400/apps/spectrum-installer.png"; +const LOGO_WIDTH: f32 = 400.0; + +pub struct PageWelcome {} + +impl PageWelcome { + pub fn new() -> Self { + Self {} + } +} + +#[derive(Clone, Debug)] +pub enum PageWelcomeEvent { + Continue, +} + +impl Page for PageWelcome { + fn update(&mut self, event: Event) -> UpdateResult { + if let Event::PageWelcome(page_welcome_event) = event { + match page_welcome_event { + PageWelcomeEvent::Continue => { + return ( + Some(Box::new(super::disk_selection::PageDiskSelection::new())), + Task::none(), + ); + } + } + } + (None, Task::none()) + } + + fn view(&self) -> Element<'_, Event> { + let button_content = text("Next").size(BUTTON_TEXT_SIZE); + + let main_content = column![ + Space::with_height(MARGIN_VERTICAL), + center_horizontal_in_container!( + text("Welcome to the installation of Spectrum!").size(TITLE_TEXT_SIZE) + ), + Space::with_height(MARGIN_VERTICAL), + center_in_container!(image(LOGO_PATH_GLOBAL).width(Length::Fixed(LOGO_WIDTH))) + ]; + + super::layout::bottom_buttons_layout( + [[( + button_content.into(), + Some(Event::PageWelcome(PageWelcomeEvent::Continue)), + )]], + main_content.into(), + ) + } +}

3 8

Hang at boot on Dell Inspiron 15
by Demi Marie Obenour 11 Jan '26

11 Jan '26

I built a Spectrum OS image using https://github.com/DemiMarie/spectrum/tree/499323fa448406ec728b1f29a4bca6dc…. This is almost the same as Spectrum git main, and I am almost certain that the differences (visible on GitHub) are not related to this problem. Therefore, I'm reporting this as if it were a bug in Spectrum itself. The bug is pretty simple: on a Dell Inspiron 15, booting freezes forever. The last message from the kernel before it stops is: amdgpu 0000:03:00.0: [drm] fb0: amdgpudrmfb frame buffer device This machine has an AMD Ryzen 7000 series CPU with integrated graphics and a 512GB NVMe drive. The installation ISO was built by $ nix build --log-format bar-with-logs --file release/combined --out-link "path to Caddy web root" with a custom config.nix that I can also share if needed. It just specifies the update URL and signing key, though. The actual install ISO I built can be found at <https://test-spectrum-updater.devbydemi.com/demi/spectrum-updates/spectrum-…> (no authentication needed). This was built on (and is hosted by) a test server I don't particularly trust, so don't mount or boot it on a machine you care about outside of a VM with no GPU acceleration or other sandbox holes. To even install Spectrum, I had to kexec from the existing NixOS install because the firmware wouldn't boot the image off of the USB stick. I presume this is a firmware bug, which would not at all surprise me. I'm not sure how to go about diagnosing this. The hang happens after s6 gets started, but the boot is so fast that it is hard to tell if it has switched from the initramfs to the rootfs yet. In any case, it seems to happen before Weston gets a chance to produce any output on screen. Suggestions welcome! -- Sincerely, Demi Marie Obenour (she/her/hers)

2 3

[PATCH 0/4] Improve mount-flatpak
by Demi Marie Obenour 07 Jan '26

07 Jan '26

Patches 1 through 3 are all cleanups. Patch 4 adds a bunch of additional checks to improve error messages. It is also less clean code than the others. However, it is optional. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Demi Marie Obenour (4): tools: Use with_resolver_flags instead of mutation tools/mount-flatpak: Create utility function to open a subdirectory tools/mount-flatpak: Move more code to mount_commit() tools/mount-flatpak: Reasonableness checks on application IDs and paths tools/mount-flatpak/src/main.rs | 190 ++++++++++++++++++++++++++++------------ 1 file changed, 134 insertions(+), 56 deletions(-) --- base-commit: 92e219e7c08c479d216a46d2736ea9d229ff034d change-id: 20251202-better-mount-flatpak-cdf8db2ce7f4 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 7

Rapidly iterating OS changes on bare hardware
by Demi Marie Obenour 05 Jan '26

05 Jan '26

What is the best way to rapidly iterate changes to Spectrum on bare hardware? Having to do a full reinstall isn't fast. Is updating into the new version of Spectrum the best option? -- Sincerely, Demi Marie Obenour (she/her/hers)

1 0

dirlock: a tool to manage encrypted filesystems
by No Name 25 Dec '25

25 Dec '25

just thought yall would find this useful/interesting https://gitlab.steamos.cloud/holo/dirlock https://www.igalia.com/downloads/slides/albertogarcia-DirlockANewRustToolto… no name

1 0

[PATCH] host/rootfs: Sandbox Weston (almost) for real
by Demi Marie Obenour 16 Dec '25

16 Dec '25

The "almost" is because of the need for Weston to create /run/user/0/wayland-1. This can be fixed by passing the listening socket into Weston. Also Weston still runs as root and there is no seccomp filtering or MAC. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/image/etc/s6-rc/weston/run | 54 ++++++++++++++++++++++++++++++++-- 1 file changed, 52 insertions(+), 2 deletions(-) diff --git a/host/rootfs/image/etc/s6-rc/weston/run b/host/rootfs/image/etc/s6-rc/weston/run index 251f5da4597a916c4e46a0dfd64cec261d519d23..87579d1bddb4c191dda0c1659f88e74c178d13a1 100644 --- a/host/rootfs/image/etc/s6-rc/weston/run +++ b/host/rootfs/image/etc/s6-rc/weston/run @@ -18,5 +18,55 @@ redirfd -r 0 /dev/tty1 importas -i home HOME cd $home if { udevadm wait /dev/dri/card0 } -unshare --cgroup --ipc --net --uts -weston +bwrap + # no --unshare-net, breaks udev hotplug + --unshare-ipc + --unshare-uts + --unshare-cgroup + --cap-add CAP_SYS_TTY_CONFIG + --dev-bind /dev /dev + --bind /run /run + --ro-bind /etc /etc + --ro-bind /nix /nix + --ro-bind /usr /usr + --ro-bind /lib /lib + --ro-bind /bin /bin + --ro-bind /sbin /sbin + # For /run/seatd.sock + --tmpfs /run + # For OpenGL/Vulkan/etc + --ro-bind /run/opengl-driver /run/opengl-driver + # For udev + --ro-bind /run/udev /run/udev + --tmpfs /tmp + --tmpfs /dev/shm + # Filtered /proc (without nasty stuff) + --proc /proc + --ro-bind /proc/sys /proc/sys + --tmpfs /proc/scsi + --remount-ro /proc/scsi + --tmpfs /proc/acpi + --remount-ro /proc/acpi + --tmpfs /proc/fs + --remount-ro /proc/fs + --tmpfs /proc/irq + --remount-ro /proc/irq + --ro-bind /dev/null /proc/timer_list + --ro-bind /dev/null /proc/kcore + --ro-bind /dev/null /proc/kallsyms + --ro-bind /dev/null /proc/sysrq-trigger + --ro-bind /sys /sys + --dev /dev + # GPUs + --dev-bind /dev/dri /dev/dri + # Input devices + --dev-bind /dev/input /dev/input + # Virtual consoles + --dev-bind /dev/tty1 /dev/tty1 + --dev-bind /dev/tty0 /dev/tty0 + # Kernel console + --dev-bind /dev/console /dev/console + # So that Weston can create its listening socket + --bind /run/user/0 /run/user/0 + -- +/usr/bin/weston --- base-commit: 92e219e7c08c479d216a46d2736ea9d229ff034d change-id: 20251205-sandbox-weston-7bb8c5e0b55f -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[PATCH] release/update.nix: fix import of efi
by Alyssa Ross 16 Dec '25

16 Dec '25

import does not pass through custom configuration options. Fixes: 49f33a1 ("release: Create directory with system update") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- release/update.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/release/update.nix b/release/update.nix index 18a91ac..f6e7772 100644 --- a/release/update.nix +++ b/release/update.nix @@ -6,7 +6,7 @@ import ../lib/call-package.nix ( { callSpectrumPackage, config, runCommand, stdenv }: let - efi = import ../host/efi.nix {}; + efi = callSpectrumPackage ../host/efi.nix {}; in runCommand "spectrum-update-directory" { __structuredAttrs = true; base-commit: 6ceeb9b236cc50d2bba90068533ca1b7ff229c8b -- 2.51.0

3 2

The upcoming nixpkgs staging cycle
by Yureka 15 Dec '25

15 Dec '25

Hi, I attempted running the spectrum release checks on nixpkgs staging commit dc05cdb0ced63fee5124d22a5cc43a0eab3a23bb. I found the following build failures (all from the default glibc/non-cross package set) and reported them upstream: https://github.com/NixOS/nixpkgs/issues/470961 https://github.com/NixOS/nixpkgs/issues/470962 https://github.com/NixOS/nixpkgs/issues/470964 Kind regards, Yureka

3 2

[PATCH] host/roots: Sandbox xdg-desktop-portal-spectrum-host
by Demi Marie Obenour 15 Dec '25

15 Dec '25

It is quite possible that these Landlock rules are unnecessarily permissive, but all of the paths to which read and execute access is granted are part of the root filesystem and therefore assumed to be public knowledge. Removing access from any of them would only increase the risk of accidental breakage in the future, and would not provide any security improvements. seccomp *could* provide some improvements, but the effort needed is too high for now. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- .../template/data/service/xdg-desktop-portal-spectrum-host/run | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run index d2bf78cefc3837b5d5369dbab819606e71bf1fc5..c3d67b6520d490c71bdce0f1056b2960115108b3 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run @@ -12,4 +12,12 @@ s6-ipcserver-socketbinder -a 0700 /run/vm/by-id/${VM}/vsock_219 if { fdmove 1 3 echo } fdclose 3 +unshare -inu -- +setpriv + --landlock-access fs + --landlock-rule path-beneath:read-file,execute:/nix/store + --landlock-rule path-beneath:read-file,execute:/usr/bin + --landlock-rule path-beneath:read-file,execute:/usr/lib + --landlock-rule path-beneath:read-file:/run/vm/by-id/${VM}/portal-bus + -- xdg-desktop-portal-spectrum-host --- base-commit: 59cda41acc455513cf9936e99b8d97647955ac07 change-id: 20251212-sandbox-dbus-portal-4f98ba29c23a -- Sincerely, Demi Marie Obenour (she/her/hers)

4 12

[PATCH v2 1/7] host/rootfs: make fs root directories shared
by Alyssa Ross 14 Dec '25

14 Dec '25

We want every mount under here to show up inside the virtiofsd sandbox. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v2: no change host/rootfs/image/usr/bin/create-vm-dependencies | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/host/rootfs/image/usr/bin/create-vm-dependencies b/host/rootfs/image/usr/bin/create-vm-dependencies index 9e123fcf..6bf12d03 100755 --- a/host/rootfs/image/usr/bin/create-vm-dependencies +++ b/host/rootfs/image/usr/bin/create-vm-dependencies @@ -30,8 +30,8 @@ if { # Needs to be shared so that additional mounts under config/ (e.g. from # mount-flatpak) will be propagated into the virtiofsd sandbox. - if { mount --make-shared --rbind -o nofail /proc/self/fd/3/fs /run/fs/${1}/config } - if { mount --rbind -o ro /run/fs/${1} /run/fs/${1} } + if { mount --make-shared --rbind -o ro /run/fs/${1} /run/fs/${1} } + if { mount --rbind -o nofail /proc/self/fd/3/fs /run/fs/${1}/config } # Needs to be shared so that when xdg-document-portal mounts its fuse # filesystem at /run/doc/${1}/doc, it will propagate to /run/fs/${1}/doc. base-commit: 227a3ea149281b6dddb0c1ba70008fffb7404c1f -- 2.51.0

3 15

[PATCH] tools/xdg-desktop-portal-spectrum-host: landlock
by Alyssa Ross 14 Dec '25

14 Dec '25

This program doesn't do anything restricted by landlock, so we can just set up a maximally restrictive ruleset and be done with it. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- .../Cargo.lock | 32 +++++++++++++++++++ .../Cargo.toml | 1 + .../src/main.rs | 19 ++++++++++- 3 files changed, 51 insertions(+), 1 deletion(-) diff --git a/tools/xdg-desktop-portal-spectrum-host/Cargo.lock b/tools/xdg-desktop-portal-spectrum-host/Cargo.lock index d09e36ff..147a6b9a 100644 --- a/tools/xdg-desktop-portal-spectrum-host/Cargo.lock +++ b/tools/xdg-desktop-portal-spectrum-host/Cargo.lock @@ -513,6 +513,17 @@ dependencies = [ "hashbrown", ] +[[package]] +name = "landlock" +version = "0.4.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "49fefd6652c57d68aaa32544a4c0e642929725bdc1fd929367cdeb673ab81088" +dependencies = [ + "enumflags2", + "libc", + "thiserror", +] + [[package]] name = "libc" version = "0.2.178" @@ -767,6 +778,26 @@ dependencies = [ "windows-sys", ] +[[package]] +name = "thiserror" +version = "2.0.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8" +dependencies = [ + "thiserror-impl", +] + +[[package]] +name = "thiserror-impl" +version = "2.0.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + [[package]] name = "tinystr" version = "0.7.6" @@ -988,6 +1019,7 @@ dependencies = [ "async-executor", "async-io", "futures-lite", + "landlock", "percent-encoding", "rustix", "url", diff --git a/tools/xdg-desktop-portal-spectrum-host/Cargo.toml b/tools/xdg-desktop-portal-spectrum-host/Cargo.toml index 96459c82..7b177cbf 100644 --- a/tools/xdg-desktop-portal-spectrum-host/Cargo.toml +++ b/tools/xdg-desktop-portal-spectrum-host/Cargo.toml @@ -10,6 +10,7 @@ edition = "2024" async-executor = { version = "1.12.0", features = ["static"] } async-io = "2.3.2" futures-lite = "2.3.0" +landlock = "0.4.4" percent-encoding = "2.3.1" rustix = "0.38.34" url = "2.5.0" diff --git a/tools/xdg-desktop-portal-spectrum-host/src/main.rs b/tools/xdg-desktop-portal-spectrum-host/src/main.rs index 3fc49cf3..a8672197 100644 --- a/tools/xdg-desktop-portal-spectrum-host/src/main.rs +++ b/tools/xdg-desktop-portal-spectrum-host/src/main.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: EUPL-1.2+ -// SPDX-FileCopyrightText: 2024 Alyssa Ross <hi(a)alyssa.is> +// SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> mod documents; mod file_chooser; @@ -19,6 +19,10 @@ use async_executor::StaticExecutor; use async_io::Async; use futures_lite::prelude::*; use futures_lite::stream::StreamExt; +use landlock::{ + ABI, Access, AccessFs, AccessNet, CompatLevel, Compatible, Ruleset, RulesetAttr, RulesetError, + Scope, +}; use zbus::{AuthMechanism, Connection, MessageStream, connection}; use file_chooser::FileChooser; @@ -208,6 +212,17 @@ fn listening_vsock_path(connection: &UnixListener) -> Result<PathBuf, String> { Ok(OsString::from_vec(listening_addr).into()) } +fn set_up_landlock() -> Result<(), RulesetError> { + Ruleset::default() + .handle_access(AccessFs::from_all(ABI::V6))? + .handle_access(AccessNet::from_all(ABI::V6))? + .scope(Scope::from_all(ABI::V6))? + .create()? + .set_compatibility(CompatLevel::HardRequirement) + .restrict_self()?; + Ok(()) +} + fn read_argv() { let mut args = args_os(); args.next(); @@ -219,6 +234,8 @@ fn read_argv() { } fn run() -> Result<(), String> { + set_up_landlock().map_err(|e| format!("setting up landlock: {e}"))?; + read_argv(); async_io::block_on(EXECUTOR.run(async { base-commit: 073642b88d65fd3d5a10e45226cb8ba580ac7bd3 -- 2.51.0

2 1

[PATCH 1/2] tools: start-vmm: output serial to VM directory
by Alyssa Ross 14 Dec '25

14 Dec '25

When we run the VMM as non-root, it shouldn't be able to create files directly under /run, so this needs to go somewhere else. Really this should probably be going through s6-log, but I think it makes sense to revisit that after we have persistent storage figured out, so that we can get lots out of RAM. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- release/checks/integration/networking.c | 2 +- release/checks/integration/portal.c | 2 +- tools/start-vmm/lib.rs | 2 +- tools/start-vmm/tests/vm_command-basic.rs | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/release/checks/integration/networking.c b/release/checks/integration/networking.c index 078e31fc..c3d873f5 100644 --- a/release/checks/integration/networking.c +++ b/release/checks/integration/networking.c @@ -153,7 +153,7 @@ void test(struct config c) "s6-rc -bu change vmm-env && " "vm-import user /run/mnt/vms && " "vm-start \"$(basename \"$(readlink /run/vm/by-name/user.nc)\")\" && " - "tail -Fc +0 /run/log/current /run/*.log &\n", + "tail -Fc +0 /run/log/current /run/vm/by-id/*/serial &\n", vm_console_writer(vm)) == EOF) { fputs("error writing to console\n", stderr); exit(EXIT_FAILURE); diff --git a/release/checks/integration/portal.c b/release/checks/integration/portal.c index 6ba5654a..9af225e5 100644 --- a/release/checks/integration/portal.c +++ b/release/checks/integration/portal.c @@ -17,7 +17,7 @@ void test(struct config c) "mount \"$(findfs UUID=a7834806-2f82-4faf-8ac4-4f8fd8a474ca)\" /run/mnt && " "s6-rc -bu change vmm-env && " "vm-import user /run/mnt/vms && " - "(tail -Fc +0 /run/*.log &) && " + "(tail -Fc +0 /run/vm/by-id/*/serial &) && " "s6-svc -O /run/vm/by-name/user.portal/service && " "vm-start \"$(basename \"$(readlink /run/vm/by-name/user.portal)\")\" && " "s6-svwait -d /run/vm/by-name/user.portal/service\n", diff --git a/tools/start-vmm/lib.rs b/tools/start-vmm/lib.rs index dfbca8d8..a536f0f6 100644 --- a/tools/start-vmm/lib.rs +++ b/tools/start-vmm/lib.rs @@ -160,7 +160,7 @@ pub fn vm_config(vm_dir: &Path) -> Result<VmConfig, String> { }, serial: ConsoleConfig { mode: "File", - file: Some(format!("/run/{vm_name}.log")), + file: Some(format!("/run/vm/by-id/{vm_name}/serial")), }, vsock: VsockConfig { cid: 3, diff --git a/tools/start-vmm/tests/vm_command-basic.rs b/tools/start-vmm/tests/vm_command-basic.rs index 95c43f86..2e9ad0c7 100644 --- a/tools/start-vmm/tests/vm_command-basic.rs +++ b/tools/start-vmm/tests/vm_command-basic.rs @@ -40,7 +40,7 @@ fn main() -> std::io::Result<()> { assert_eq!(config.memory.size, 0x40000000); assert!(config.memory.shared); assert_eq!(config.serial.mode, "File"); - assert_eq!(config.serial.file.unwrap(), "/run/testvm.log"); + assert_eq!(config.serial.file.unwrap(), "/run/vm/by-id/testvm/serial"); assert_eq!(config.vsock.cid, 3); assert_eq!(config.vsock.socket, "/run/vsock/testvm/vsock"); base-commit: 227a3ea149281b6dddb0c1ba70008fffb7404c1f -- 2.51.0

2 3

[PATCH] host/rootfs: add mount-userdata command
by Alyssa Ross 14 Dec '25

14 Dec '25

We shouldn't leave it to the user to manually mount user data partitions. We want to ensure restrictive mount flags are set, and be able to do other operations around the mounting. It's also nice to have a single place where all user data partitions can be mounted. I've taken inspiration from the FHS in using /media for this. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- .../development/persistent-storage.adoc | 19 ++++++++++----- .../using-spectrum/creating-custom-vms.adoc | 5 ++-- .../using-spectrum/vm-file-access.adoc | 4 ++-- host/rootfs/Makefile | 2 +- host/rootfs/file-list.mk | 1 + host/rootfs/image/etc/fstab | 11 +++++---- host/rootfs/image/usr/bin/mount-userdata | 24 +++++++++++++++++++ 7 files changed, 50 insertions(+), 16 deletions(-) create mode 100755 host/rootfs/image/usr/bin/mount-userdata diff --git a/Documentation/development/persistent-storage.adoc b/Documentation/development/persistent-storage.adoc index 12426b46..c4bcc163 100644 --- a/Documentation/development/persistent-storage.adoc +++ b/Documentation/development/persistent-storage.adoc @@ -2,7 +2,7 @@ :page-parent: Development :page-nav_order: 2 -// SPDX-FileCopyrightText: 2024 Alyssa Ross <hi(a)alyssa.is> +// SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> // SPDX-License-Identifier: GFDL-1.3-no-invariants-or-later OR CC-BY-SA-4.0 Spectrum's root filesystem is immutable, so if you want to be able to @@ -10,8 +10,15 @@ persist data between sessions, you'll need to create a persistent storage partition. Spectrum comes with `cryptsetup`, and in future is likely to assume that btrfs-specific features are available. -Conventionally, the persistent storage partition is mounted on /ext -after booting. It's not mounted automatically, because generally the -partition should be encrypted, meaning a key has to be supplied to -mount it anyway, and because there might be multiple persistent data -partitions to choose from. +Persistent storage can be mounted as follows: + +[source,shell] +---- +cryptsetup open /dev/sda1 userdata +mount-userdata /dev/mapper/userdata +---- + +It's not mounted automatically, because generally the partition should +be encrypted, meaning a key has to be supplied to mount it anyway, and +because there might be multiple persistent data partitions to choose +from. diff --git a/Documentation/using-spectrum/creating-custom-vms.adoc b/Documentation/using-spectrum/creating-custom-vms.adoc index a397ac50..1eca7f36 100644 --- a/Documentation/using-spectrum/creating-custom-vms.adoc +++ b/Documentation/using-spectrum/creating-custom-vms.adoc @@ -13,8 +13,9 @@ configurations are directories under a dedicated parent directory, and the name of each configuration directory determines the name of the VM. After mounting the persistent storage partition, the configured VMs can be made available by running `vm-import user -/ext/vms`, replacing /ext/vms with the directory containing the VM -definitions. +/media/4e43cdc2-82b2-4d94-8a90-b6c6189312d2/vms`, replacing +/media/4e43cdc2-82b2-4d94-8a90-b6c6189312d2/vms with the directory +containing the VM definitions. The directory can contain the following files: diff --git a/Documentation/using-spectrum/vm-file-access.adoc b/Documentation/using-spectrum/vm-file-access.adoc index 1b4fe9a5..a079cfe8 100644 --- a/Documentation/using-spectrum/vm-file-access.adoc +++ b/Documentation/using-spectrum/vm-file-access.adoc @@ -48,7 +48,7 @@ can be bind-mounted into it: + [listing] [source,shell] -echo "Hello, world!" > /ext/example.txt +echo "Hello, world!" > /media/4e43cdc2-82b2-4d94-8a90-b6c6189312d2/example.txt 2. Create an empty file to bind mount over: + @@ -60,5 +60,5 @@ touch /run/vm/by-name/user.appvm-example/fs/example.txt + [listing] [source,shell] -mount --rbind /ext/example.txt /run/vm/by-name/user.appvm-example/fs/example.txt +mount --rbind /media/4e43cdc2-82b2-4d94-8a90-b6c6189312d2/example.txt /run/vm/by-name/user.appvm-example/fs/example.txt ==== diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index 7bec1259..211fb5dd 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -33,8 +33,8 @@ DIRS = \ etc/s6-linux-init/run-image/user \ etc/s6-linux-init/run-image/vm/by-id \ etc/s6-linux-init/run-image/vm/by-name \ - ext \ home \ + media \ proc \ run \ sys \ diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index f69775d2..6bf40ff8 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -56,6 +56,7 @@ FILES = \ image/etc/xdg/weston/weston.ini \ image/usr/bin/assign-devices \ image/usr/bin/create-vm-dependencies \ + image/usr/bin/mount-userdata \ image/usr/bin/root-terminal \ image/usr/bin/run-appimage \ image/usr/bin/run-flatpak \ diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab index 5c23a374..18bb5e45 100644 --- a/host/rootfs/image/etc/fstab +++ b/host/rootfs/image/etc/fstab @@ -1,7 +1,8 @@ # SPDX-License-Identifier: CC0-1.0 # SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi(a)alyssa.is> -proc /proc proc nosuid,nodev,noexec 0 0 -devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 -tmpfs /dev/shm tmpfs nosuid,nodev 0 0 -sysfs /sys sysfs nosuid,nodev,noexec 0 0 -tmpfs /tmp tmpfs nosuid,nodev 0 0 +proc /proc proc nosuid,nodev,noexec 0 0 +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 +tmpfs /media tmpfs nosuid,nodev,noexec,nosymfollow,mode=755 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 +tmpfs /tmp tmpfs nosuid,nodev 0 0 diff --git a/host/rootfs/image/usr/bin/mount-userdata b/host/rootfs/image/usr/bin/mount-userdata new file mode 100755 index 00000000..e4a873c0 --- /dev/null +++ b/host/rootfs/image/usr/bin/mount-userdata @@ -0,0 +1,24 @@ +#!/bin/execlineb -W +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +backtick -D "" uuid { + importas -Siu 1 + blkid -o value -s UUID $1 +} + +multisubstitute { + importas -Siu 0 + importas -Siu 1 + importas -Siu uuid +} + +case $uuid { + "" { + fdmove -c 1 2 + printf "%s: '%s' does not have a UUID\n" $0 $1 + } +} + +if { mount -m -o nosuid,nodev,noexec,nosymfollow -- $1 /media/${uuid} } +printf "%s\n" /media/${uuid} base-commit: 1afc3a7042ee1c40b6d2e564219be31ea8f1017f -- 2.51.0

3 4

[PATCH v3 1/3] tools/router: use socket activation
by Alyssa Ross 14 Dec '25

14 Dec '25

This means we can use readiness notification to wait until the sockets are created without having to add special functionality for that to the router program, and also means we can do extra system-specific setup to the sockets, like changing their owners, outside of the router. Since the socket paths were the only arguments taken by the router, this also lets us drop the clap dependency entirely. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v3: • use anyhow::bail • set sockets to non-blocking in router v2: https://spectrum-os.org/lists/archives/spectrum-devel/20251209110503.674499… host/rootfs/file-list.mk | 1 + .../service/spectrum-router/notification-fd | 1 + .../spectrum-router/notification-fd.license | 2 + .../template/data/service/spectrum-router/run | 21 ++- tools/router/Cargo.lock | 148 ++++++++++++------ tools/router/Cargo.toml | 2 +- tools/router/src/main.rs | 40 +++-- 7 files changed, 141 insertions(+), 74 deletions(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce8..5a043b7b 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -28,6 +28,7 @@ FILES = \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down \ + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd new file mode 100644 index 00000000..7ed6ff82 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd @@ -0,0 +1 @@ +5 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license new file mode 100644 index 00000000..0d3d47ca --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run index 3ba35def..dc1ef900 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run @@ -1,14 +1,30 @@ #!/bin/execlineb -P # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> importas -i VM VM +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-driver.sock +fdmove -c 3 0 + +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-app.sock +fdmove -c 4 0 + +# Notify readiness. +if { + fdmove -c 5 1 + echo +} + +redirfd -r 0 /dev/null + bwrap --unshare-all --unshare-user --dev-bind / / --setenv RUST_LOG spectrum-router=debug,info + --setenv LISTEN_FDS 2 --tmpfs /tmp --dev /dev --tmpfs /dev/shm @@ -19,6 +35,7 @@ bwrap --ro-bind /lib /lib --bind /run/vm/by-id/${VM} /run/vm/by-id/${VM} -- + +getpid LISTEN_PID + spectrum-router - --app-listen-path /run/vm/by-id/${VM}/router-app.sock - --driver-listen-path /run/vm/by-id/${VM}/router-driver.sock diff --git a/tools/router/Cargo.lock b/tools/router/Cargo.lock index 60d7657b..d0d105aa 100644 --- a/tools/router/Cargo.lock +++ b/tools/router/Cargo.lock @@ -113,6 +113,12 @@ dependencies = [ "wyz", ] +[[package]] +name = "bumpalo" +version = "3.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43" + [[package]] name = "bytes" version = "1.11.0" @@ -120,44 +126,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3" [[package]] -name = "clap" -version = "4.5.53" +name = "cfg-if" +version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c9e340e012a1bf4935f5282ed1436d1489548e8f72308207ea5df0e23d2d03f8" -dependencies = [ - "clap_builder", - "clap_derive", -] - -[[package]] -name = "clap_builder" -version = "4.5.53" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d76b5d13eaa18c901fd2f7fca939fefe3a0727a953561fefdf3b2922b8569d00" -dependencies = [ - "anstream", - "anstyle", - "clap_lex", - "strsim", -] - -[[package]] -name = "clap_derive" -version = "4.5.49" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a0b5487afeab2deb2ff4e03a807ad1a03ac532ff5a2cee5d86884440c7f7671" -dependencies = [ - "heck", - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "clap_lex" -version = "0.7.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d" +checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "colorchoice" @@ -263,12 +235,6 @@ dependencies = [ "slab", ] -[[package]] -name = "heck" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" - [[package]] name = "is_terminal_polyfill" version = "1.70.2" @@ -299,12 +265,33 @@ dependencies = [ "syn", ] +[[package]] +name = "js-sys" +version = "0.3.83" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "464a3709c7f55f1f721e5389aa6ea4e3bc6aba669353300af094b29ffbdde1d8" +dependencies = [ + "once_cell", + "wasm-bindgen", +] + [[package]] name = "libc" version = "0.2.177" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976" +[[package]] +name = "listenfd" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b87bc54a4629b4294d0b3ef041b64c40c611097a677d9dc07b2c67739fe39dba" +dependencies = [ + "libc", + "uuid", + "winapi", +] + [[package]] name = "log" version = "0.4.28" @@ -328,6 +315,12 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "once_cell" +version = "1.21.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" + [[package]] name = "once_cell_polyfill" version = "1.70.2" @@ -420,6 +413,12 @@ version = "0.8.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58" +[[package]] +name = "rustversion" +version = "1.0.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" + [[package]] name = "serde_core" version = "1.0.228" @@ -462,9 +461,9 @@ version = "0.1.0" dependencies = [ "anyhow", "arrayvec", - "clap", "env_logger", "futures-util", + "listenfd", "log", "tokio", "tokio-stream", @@ -474,12 +473,6 @@ dependencies = [ "zerocopy", ] -[[package]] -name = "strsim" -version = "0.11.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" - [[package]] name = "syn" version = "2.0.111" @@ -608,6 +601,16 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" +[[package]] +name = "uuid" +version = "1.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + [[package]] name = "vhost-device-net" version = "0.1.1" @@ -666,6 +669,51 @@ version = "0.11.1+wasi-snapshot-preview1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" +[[package]] +name = "wasm-bindgen" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0d759f433fa64a2d763d1340820e46e111a7a5ab75f993d1852d70b03dbb80fd" +dependencies = [ + "cfg-if", + "once_cell", + "rustversion", + "wasm-bindgen-macro", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-macro" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "48cb0d2638f8baedbc542ed444afc0644a29166f1595371af4fecf8ce1e7eeb3" +dependencies = [ + "quote", + "wasm-bindgen-macro-support", +] + +[[package]] +name = "wasm-bindgen-macro-support" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cefb59d5cd5f92d9dcf80e4683949f15ca4b511f4ac0a6e14d4e1ac60c6ecd40" +dependencies = [ + "bumpalo", + "proc-macro2", + "quote", + "syn", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-shared" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cbc538057e648b67f72a982e708d485b2efa771e1ac05fec311f9f63e5800db4" +dependencies = [ + "unicode-ident", +] + [[package]] name = "winapi" version = "0.3.9" diff --git a/tools/router/Cargo.toml b/tools/router/Cargo.toml index 0b969113..cfdf3527 100644 --- a/tools/router/Cargo.toml +++ b/tools/router/Cargo.toml @@ -8,7 +8,6 @@ edition = "2024" [dependencies] anyhow = "1.0.100" -clap = { version = "4.5.45", features = ["derive"] } env_logger = "0.11.8" log = { version = "0.4.27", features = ["release_max_level_debug"] } vhost-device-net = "0.1.0" @@ -19,3 +18,4 @@ tokio-stream = "0.1.17" arrayvec = "0.7.6" vm-memory = "0.16" tokio-util = "0.7.17" +listenfd = "1.0.2" diff --git a/tools/router/src/main.rs b/tools/router/src/main.rs index e3aca65a..3b26ddb0 100644 --- a/tools/router/src/main.rs +++ b/tools/router/src/main.rs @@ -1,47 +1,45 @@ // SPDX-License-Identifier: EUPL-1.2+ // SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> pub(crate) mod packet; pub(crate) mod protocol; mod router; mod upstream; -use std::path::PathBuf; - use packet::*; use router::{InterfaceId, Router}; use upstream::Upstream; -use clap::Parser; +use anyhow::bail; use futures_util::{SinkExt, TryStreamExt}; +use listenfd::ListenFd; use log::{error, info}; use tokio::net::UnixListener; use vhost_device_net::{IncomingPacket, VhostDeviceNet}; use vm_memory::GuestMemoryMmap; -#[derive(Parser, Debug)] -#[command()] //version = None, about = None, long_about = None)] -struct Args { - #[arg(long)] - driver_listen_path: PathBuf, - #[arg(long)] - app_listen_path: PathBuf, -} - fn main() -> anyhow::Result<()> { env_logger::init(); - let args = Args::parse(); - for path in [&args.driver_listen_path, &args.app_listen_path] { - let _ = std::fs::remove_file(path); - } - - run_router(args) + run_router() } #[tokio::main(flavor = "current_thread")] -async fn run_router(args: Args) -> anyhow::Result<()> { - let app_listener = UnixListener::bind(&args.app_listen_path)?; - let driver_listener = UnixListener::bind(&args.driver_listen_path)?; +async fn run_router() -> anyhow::Result<()> { + let mut listenfd = ListenFd::from_env(); + + let Some(driver_listener) = listenfd.take_unix_listener(0)? else { + bail!("not activated with driver socket"); + }; + let Some(app_listener) = listenfd.take_unix_listener(1)? else { + bail!("not activated with app socket"); + }; + + driver_listener.set_nonblocking(true)?; + app_listener.set_nonblocking(true)?; + + let driver_listener = UnixListener::from_std(driver_listener)?; + let app_listener = UnixListener::from_std(app_listener)?; let mut router = Router::<GuestMemoryMmap>::new(InterfaceId::Upstream); -- 2.51.0

2 5

[PATCH 1/4] host/rootfs: make fs root directories shared
by Alyssa Ross 13 Dec '25

13 Dec '25

We want every mount under here to show up inside the virtiofsd sandbox. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/image/usr/bin/create-vm-dependencies | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/host/rootfs/image/usr/bin/create-vm-dependencies b/host/rootfs/image/usr/bin/create-vm-dependencies index 9e123fcf..6bf12d03 100755 --- a/host/rootfs/image/usr/bin/create-vm-dependencies +++ b/host/rootfs/image/usr/bin/create-vm-dependencies @@ -30,8 +30,8 @@ if { # Needs to be shared so that additional mounts under config/ (e.g. from # mount-flatpak) will be propagated into the virtiofsd sandbox. - if { mount --make-shared --rbind -o nofail /proc/self/fd/3/fs /run/fs/${1}/config } - if { mount --rbind -o ro /run/fs/${1} /run/fs/${1} } + if { mount --make-shared --rbind -o ro /run/fs/${1} /run/fs/${1} } + if { mount --rbind -o nofail /proc/self/fd/3/fs /run/fs/${1}/config } # Needs to be shared so that when xdg-document-portal mounts its fuse # filesystem at /run/doc/${1}/doc, it will propagate to /run/fs/${1}/doc. base-commit: ce1cfde4bf845cb1104e0eddc4128a2c3d517fb0 -- 2.51.0

2 5

[PATCH 1/2] img/app: change virtio-fs tag to "host"
by Alyssa Ross 12 Dec '25

12 Dec '25

It doesn't seem likely to me that we'll have multiple virtio-fs devices from the host, so let's use something a bit more clear and precise. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- Documentation/using-spectrum/creating-custom-vms.adoc | 2 +- img/app/Makefile | 4 ++-- img/app/image/etc/mdev/virtiofs | 2 +- img/app/scripts/start-virtiofsd.elb | 2 +- release/checks/wayland/default.nix | 4 ++-- tools/start-vmm/lib.rs | 2 +- tools/start-vmm/tests/vm_command-basic.rs | 2 +- 7 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Documentation/using-spectrum/creating-custom-vms.adoc b/Documentation/using-spectrum/creating-custom-vms.adoc index a397ac50..8d915e1a 100644 --- a/Documentation/using-spectrum/creating-custom-vms.adoc +++ b/Documentation/using-spectrum/creating-custom-vms.adoc @@ -91,7 +91,7 @@ should configure `eth0` with the IPv4 address `100.64.165.70` (because === Filesystem Every VM has a virtio-fs device that exposes the /run/vm/by-id/_VM -ID_/fs directory on the host, with the tag "virtiofs0". The VM cannot +ID_/fs directory on the host, with the tag "host". The VM cannot write directly into that directory, but it's possible to create a subdirectory on the host and bind mount a directory from a writeable filesystem into it to provide the VM with access to shared storage. diff --git a/img/app/Makefile b/img/app/Makefile index 7354f892..69c85bba 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -99,7 +99,7 @@ run-qemu: $(imgdir)/appvm/blk/root.img start-vhost-user-net start-virtiofsd -netdev vhost-user,id=net0,chardev=vhost-user-net \ -device virtio-net,netdev=net0,mac=02:00:00:00:00:01 \ -chardev socket,id=virtiofsd,path=build/virtiofsd.sock \ - -device vhost-user-fs-pci,chardev=virtiofsd,tag=virtiofs0 \ + -device vhost-user-fs-pci,chardev=virtiofsd,tag=host \ -device virtio-gpu-rutabaga-pci,cross-domain=on,hostmem=8G \ -audio driver=pipewire,model=virtio \ -object memory-backend-memfd,id=mem,size=256M,share=on \ @@ -117,7 +117,7 @@ run-cloud-hypervisor: $(imgdir)/appvm/blk/root.img start-vhost-user-gpu start-vh --api-socket path=build/vmm.sock \ --memory size=1G,shared=on \ --disk path=$(imgdir)/appvm/blk/root.img,readonly=on \ - --fs tag=virtiofs0,socket=build/virtiofsd.sock \ + --fs tag=host,socket=build/virtiofsd.sock \ --gpu socket=build/vhost-user-gpu.sock \ --vsock cid=3,socket=build/vsock.sock \ --net mac=02:00:00:00:00:01,vhost_user=on,socket=build/vhost-user-net.sock \ diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs index b6e505bc..bda77483 100755 --- a/img/app/image/etc/mdev/virtiofs +++ b/img/app/image/etc/mdev/virtiofs @@ -7,6 +7,6 @@ background { # virtiofs filesystems, so we only supported a single, hardcoded # filesystem tag for now. if { mkdir -p /run/virtiofs/virtiofs0 } - if { mount -t virtiofs -o nodev virtiofs0 /run/virtiofs/virtiofs0 } + if { mount -t virtiofs -o nodev host /run/virtiofs/virtiofs0 } /etc/mdev/listen virtiofs0 } diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb index fa3a234e..9efb436b 100755 --- a/img/app/scripts/start-virtiofsd.elb +++ b/img/app/scripts/start-virtiofsd.elb @@ -11,5 +11,5 @@ background { if { importas -Si CONFIG mount --rbind -- ${CONFIG}/fs build/fs/config } unshare --map-user 1000 --map-group 1000 importas -SsD virtiofsd VIRTIOFSD - $VIRTIOFSD --fd 0 --shared-dir build/fs --tag virtiofs0 + $VIRTIOFSD --fd 0 --shared-dir build/fs --tag host } diff --git a/release/checks/wayland/default.nix b/release/checks/wayland/default.nix index a053e605..55c7d6d1 100644 --- a/release/checks/wayland/default.nix +++ b/release/checks/wayland/default.nix @@ -32,7 +32,7 @@ testers.nixosTest ({ lib, pkgs, ... }: { systemd.services.cloud-hypervisor = { after = [ "crosvm-gpu.service" "weston.service" ]; requires = [ "crosvm-gpu.service" "weston.service" ]; - serviceConfig.ExecStart = "${lib.getExe pkgs.cloud-hypervisor} --memory shared=on --disk path=${appvm}/lib/spectrum/img/appvm/blk/root.img,readonly=on --cmdline \"console=ttyS0 root=PARTLABEL=root\" --fs socket=/run/virtiofsd.sock,tag=virtiofs0 --gpu socket=/run/crosvm-gpu.sock --vsock cid=3,socket=/run/vsock.sock --serial tty --console null --kernel ${appvm}/lib/spectrum/img/appvm/vmlinux"; + serviceConfig.ExecStart = "${lib.getExe pkgs.cloud-hypervisor} --memory shared=on --disk path=${appvm}/lib/spectrum/img/appvm/blk/root.img,readonly=on --cmdline \"console=ttyS0 root=PARTLABEL=root\" --fs socket=/run/virtiofsd.sock,tag=host --gpu socket=/run/crosvm-gpu.sock --vsock cid=3,socket=/run/vsock.sock --serial tty --console null --kernel ${appvm}/lib/spectrum/img/appvm/vmlinux"; }; systemd.services.crosvm = { @@ -79,7 +79,7 @@ testers.nixosTest ({ lib, pkgs, ... }: { }; systemd.services.virtiofsd = { - serviceConfig.ExecStart = "${lib.getExe pkgs.virtiofsd} --fd 3 --shared-dir /shared --tag virtiofs0"; + serviceConfig.ExecStart = "${lib.getExe pkgs.virtiofsd} --fd 3 --shared-dir /shared --tag host"; serviceConfig.Restart = "on-success"; requires = [ "shared-config.mount" ]; after = [ "shared-config.mount" ]; diff --git a/tools/start-vmm/lib.rs b/tools/start-vmm/lib.rs index b44e0375..4b2aedda 100644 --- a/tools/start-vmm/lib.rs +++ b/tools/start-vmm/lib.rs @@ -81,7 +81,7 @@ pub fn vm_config(vm_dir: &Path) -> Result<VmConfig, String> { Err(e) => return Err(format!("reading directory {blk_dir:?}: {e}")), }, fs: [FsConfig { - tag: "virtiofs0", + tag: "host", socket: format!( "/run/service/vm-services/instance/{vm_name}/data/service/vhost-user-fs/env/virtiofsd.sock" ), diff --git a/tools/start-vmm/tests/vm_command-basic.rs b/tools/start-vmm/tests/vm_command-basic.rs index 866a6e19..533e2d2d 100644 --- a/tools/start-vmm/tests/vm_command-basic.rs +++ b/tools/start-vmm/tests/vm_command-basic.rs @@ -28,7 +28,7 @@ fn main() -> std::io::Result<()> { assert!(disk1.readonly); assert_eq!(config.fs.len(), 1); let fs1 = &config.fs[0]; - assert_eq!(fs1.tag, "virtiofs0"); + assert_eq!(fs1.tag, "host"); let expected = "/run/service/vm-services/instance/testvm/data/service/vhost-user-fs/env/virtiofsd.sock"; assert_eq!(fs1.socket, expected); base-commit: 814a589b2b0fb4eeed06e1a1a9ce536f6b5ee91d -- 2.51.0

1 1

[PATCH v2 1/8] host/rootfs: create dbus socket externally
by Alyssa Ross 12 Dec '25

12 Dec '25

This is the first step towards running dbus as non-root. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v2: no change .../template/data/service/dbus/notification-fd | 2 +- .../data/service/dbus/notification-fd.license | 2 +- .../vm-services/template/data/service/dbus/run | 13 +++++++++++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd index 00750edc..b8626c4c 100644 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd @@ -1 +1 @@ -3 +4 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license index 5a406331..0d3d47ca 100644 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license @@ -1,2 +1,2 @@ SPDX-License-Identifier: CC0-1.0 -SPDX-FileCopyrightText: 2022 Alyssa Ross <hi(a)alyssa.is> +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run index 40b75355..365e1697 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run @@ -4,10 +4,19 @@ importas -i VM VM +s6-ipcserver-socketbinder -B /run/vm/by-id/${VM}/portal-bus + +fdmove -c 3 0 +redirfd -r 0 /dev/null + nsenter --mount=/run/vm/by-id/${VM}/mount unshare --cgroup --ipc --net --uts + +export LISTEN_FDS 1 +getpid LISTEN_PID + dbus-daemon --config-file /usr/share/dbus-1/session.conf - --print-address 3 - --address unix:path=/run/vm/by-id/${VM}/portal-bus + --print-address 4 + --address systemd: base-commit: e32cdde75ef9ec554c1c40bba7f4a75dcaaa779f -- 2.51.0

2 8

[PATCH 1/8] host/rootfs: create dbus socket externally
by Alyssa Ross 12 Dec '25

12 Dec '25

This is the first step towards running dbus as non-root. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- .../template/data/service/dbus/notification-fd | 2 +- .../data/service/dbus/notification-fd.license | 2 +- .../vm-services/template/data/service/dbus/run | 13 +++++++++++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd index 00750edc..b8626c4c 100644 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd @@ -1 +1 @@ -3 +4 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license index 5a406331..0d3d47ca 100644 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license @@ -1,2 +1,2 @@ SPDX-License-Identifier: CC0-1.0 -SPDX-FileCopyrightText: 2022 Alyssa Ross <hi(a)alyssa.is> +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run index 40b75355..365e1697 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run @@ -4,10 +4,19 @@ importas -i VM VM +s6-ipcserver-socketbinder -B /run/vm/by-id/${VM}/portal-bus + +fdmove -c 3 0 +redirfd -r 0 /dev/null + nsenter --mount=/run/vm/by-id/${VM}/mount unshare --cgroup --ipc --net --uts + +export LISTEN_FDS 1 +getpid LISTEN_PID + dbus-daemon --config-file /usr/share/dbus-1/session.conf - --print-address 3 - --address unix:path=/run/vm/by-id/${VM}/portal-bus + --print-address 4 + --address systemd: -- 2.51.0

2 20

[PATCH] Set restrictive mount options
by Alyssa Ross 11 Dec '25

11 Dec '25

These are mostly copied from systemd, so should be pretty safe in terms of compatibility. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/initramfs/etc/fstab | 8 ++++---- host/initramfs/etc/init | 2 +- host/rootfs/image/etc/fstab | 12 ++++++------ img/app/image/etc/fstab | 12 ++++++------ img/app/image/etc/mdev/virtiofs | 2 +- img/app/image/etc/s6-rc/app/run | 4 ++-- img/app/scripts/start-virtiofsd.elb | 2 +- vm/app/systemd-sysupdate/download-update | 2 +- vm/sys/net/image/etc/fstab | 12 ++++++------ 9 files changed, 28 insertions(+), 28 deletions(-) diff --git a/host/initramfs/etc/fstab b/host/initramfs/etc/fstab index 3dfb05ab..9f43a1a9 100644 --- a/host/initramfs/etc/fstab +++ b/host/initramfs/etc/fstab @@ -1,5 +1,5 @@ # SPDX-License-Identifier: CC0-1.0 -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> -devtmpfs /dev devtmpfs defaults 0 0 -proc /proc proc defaults 0 0 -sysfs /sys sysfs defaults 0 0 +# SPDX-FileCopyrightText: 2021-2025 Alyssa Ross <hi(a)alyssa.is> +devtmpfs /dev devtmpfs nosuid 0 0 +proc /proc proc nosuid,nodev,noexec 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 diff --git a/host/initramfs/etc/init b/host/initramfs/etc/init index 71948874..723d2e1b 100755 --- a/host/initramfs/etc/init +++ b/host/initramfs/etc/init @@ -42,7 +42,7 @@ if { background { rm /dev/rootfs /dev/verity } -if { mount /dev/mapper/root-verity /mnt/root } +if { mount -o nosuid,nodev /dev/mapper/root-verity /mnt/root } wait { $mdevd_pid } if { mount --move /proc /mnt/root/proc } diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab index 6230d910..5c23a374 100644 --- a/host/rootfs/image/etc/fstab +++ b/host/rootfs/image/etc/fstab @@ -1,7 +1,7 @@ # SPDX-License-Identifier: CC0-1.0 -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> -proc /proc proc defaults 0 0 -devpts /dev/pts devpts gid=5,mode=620 0 0 -tmpfs /dev/shm tmpfs defaults 0 0 -sysfs /sys sysfs defaults 0 0 -tmpfs /tmp tmpfs defaults 0 0 +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi(a)alyssa.is> +proc /proc proc nosuid,nodev,noexec 0 0 +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 +tmpfs /tmp tmpfs nosuid,nodev 0 0 diff --git a/img/app/image/etc/fstab b/img/app/image/etc/fstab index 2dd1f4d8..5f78ab87 100644 --- a/img/app/image/etc/fstab +++ b/img/app/image/etc/fstab @@ -1,8 +1,8 @@ # SPDX-License-Identifier: CC0-1.0 # SPDX-FileCopyrightText: 2020-2022, 2025 Alyssa Ross <hi(a)alyssa.is> -proc /proc proc defaults 0 0 -devpts /dev/pts devpts gid=5,mode=620 0 0 -tmpfs /dev/shm tmpfs defaults 0 0 -sysfs /sys sysfs defaults 0 0 -tmpfs /tmp tmpfs defaults 0 0 -tmpfs /home/user tmpfs mode=0700,uid=1000,gid=1000 0 0 +proc /proc proc nosuid,nodev,noexec 0 0 +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 +tmpfs /tmp tmpfs nosuid,nodev 0 0 +tmpfs /home/user tmpfs nodev,mode=0700,uid=1000,gid=1000 0 0 diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs index c1fd2834..b6e505bc 100755 --- a/img/app/image/etc/mdev/virtiofs +++ b/img/app/image/etc/mdev/virtiofs @@ -7,6 +7,6 @@ background { # virtiofs filesystems, so we only supported a single, hardcoded # filesystem tag for now. if { mkdir -p /run/virtiofs/virtiofs0 } - if { mount -t virtiofs virtiofs0 /run/virtiofs/virtiofs0 } + if { mount -t virtiofs -o nodev virtiofs0 /run/virtiofs/virtiofs0 } /etc/mdev/listen virtiofs0 } diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/app/run index 0ba1f374..997897de 100755 --- a/img/app/image/etc/s6-rc/app/run +++ b/img/app/image/etc/s6-rc/app/run @@ -17,7 +17,7 @@ foreground { if { modprobe loop } if { backtick -E offset { /run/virtiofs/virtiofs0/config/run --appimage-offset } - mount -o offset=${offset} /run/virtiofs/virtiofs0/config/run /mnt + mount -o offset=${offset},nodev /run/virtiofs/virtiofs0/config/run /mnt } s6-setuidgid user export APPIMAGE /run/virtiofs/virtiofs0/config/run @@ -42,7 +42,7 @@ foreground { nix { if { mount -t overlay - -o ro,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store + -o ro,nosuid,nodev,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store store /nix/store } diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb index e4d265f0..cedce9ae 100755 --- a/img/app/scripts/start-virtiofsd.elb +++ b/img/app/scripts/start-virtiofsd.elb @@ -6,7 +6,7 @@ s6-ipcserver-socketbinder -B build/virtiofsd.sock background { if { mkdir -p build/fs } unshare -rUm - if { mount -t tmpfs fs build/fs } + if { mount -t tmpfs -o nosuid,nodev fs build/fs } if { mkdir build/fs/config } if { importas -Si CONFIG mount --rbind -- ${CONFIG}/fs build/fs/config } importas -SsD virtiofsd VIRTIOFSD diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update index facf7f52..b397f238 100755 --- a/vm/app/systemd-sysupdate/download-update +++ b/vm/app/systemd-sysupdate/download-update @@ -5,7 +5,7 @@ export LC_ALL C export LANGUAGE C unshare -mr -if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } +if { mount -toverlay -o nosuid,nodev,lowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX } # Not a useless use of cat: if there are NUL bytes in the URL # busybox's awk might misbehave. diff --git a/vm/sys/net/image/etc/fstab b/vm/sys/net/image/etc/fstab index a0b62fa5..4c240544 100644 --- a/vm/sys/net/image/etc/fstab +++ b/vm/sys/net/image/etc/fstab @@ -1,8 +1,8 @@ # SPDX-License-Identifier: CC0-1.0 -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> -proc /proc proc defaults 0 0 -devpts /dev/pts devpts gid=5,mode=620 0 0 -tmpfs /dev/shm tmpfs defaults 0 0 -sysfs /sys sysfs defaults 0 0 -bpffs /sys/fs/bpf bpf defaults 0 0 +proc /proc proc nosuid,nodev,noexec 0 0 +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 +bpffs /sys/fs/bpf bpf nosuid,nodev,noexec,mode=700 0 0 base-commit: e32cdde75ef9ec554c1c40bba7f4a75dcaaa779f -- 2.51.0

3 4

[PATCH 1/2] host/rootfs: add root-terminal s6-sudod service
by Alyssa Ross 10 Dec '25

10 Dec '25

This will be needed as an interim measure to allow Weston itself to be run as non-root, without the user losing access to root entirely in the graphical environment. Currently, only root can access this service, so it's redundant, but we can later make the socket accessible to Weston's user. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/file-list.mk | 3 +++ .../service/root-terminal/notification-fd | 1 + .../service/root-terminal/notification-fd.license | 2 ++ .../run-image/service/root-terminal/run | 15 +++++++++++++++ host/rootfs/image/etc/xdg/weston/weston.ini | 4 ++-- host/rootfs/image/usr/bin/root-terminal | 5 +++++ 6 files changed, 28 insertions(+), 2 deletions(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd.license create mode 100755 host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run create mode 100755 host/rootfs/image/usr/bin/root-terminal diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index 6ab78e6b..f69775d2 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -15,6 +15,8 @@ FILES = \ image/etc/s6-linux-init/run-image/service/getty-tty2/run \ image/etc/s6-linux-init/run-image/service/getty-tty3/run \ image/etc/s6-linux-init/run-image/service/getty-tty4/run \ + image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd \ + image/etc/s6-linux-init/run-image/service/root-terminal/run \ image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd \ image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run \ image/etc/s6-linux-init/run-image/service/s6-svscan-log/notification-fd \ @@ -54,6 +56,7 @@ FILES = \ image/etc/xdg/weston/weston.ini \ image/usr/bin/assign-devices \ image/usr/bin/create-vm-dependencies \ + image/usr/bin/root-terminal \ image/usr/bin/run-appimage \ image/usr/bin/run-flatpak \ image/usr/bin/run-vmm \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd new file mode 100644 index 00000000..00750edc --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd @@ -0,0 +1 @@ +3 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd.license new file mode 100644 index 00000000..0d3d47ca --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run new file mode 100755 index 00000000..67ccfb45 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run @@ -0,0 +1,15 @@ +#!/bin/execlineb -PW +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +s6-ipcserver-socketbinder -a 0700 /run/root-terminal + +fdmove 1 3 +s6-ipcserverd -1P + +exec -c +/bin/export PATH /usr/bin +/bin/export WAYLAND_DISPLAY "" +s6-sudod +cd / +weston-terminal diff --git a/host/rootfs/image/etc/xdg/weston/weston.ini b/host/rootfs/image/etc/xdg/weston/weston.ini index a1f630cf..a4763c6d 100644 --- a/host/rootfs/image/etc/xdg/weston/weston.ini +++ b/host/rootfs/image/etc/xdg/weston/weston.ini @@ -6,8 +6,8 @@ path=/etc/xdg/weston/autolaunch [launcher] icon=/usr/share/weston/icon_terminal.png -displayname=Terminal -path=/bin/weston-terminal +displayname=Root Terminal +path=/bin/root-terminal [launcher] icon=/usr/share/icons/hicolor/20x20/apps/com.system76.CosmicFiles.png diff --git a/host/rootfs/image/usr/bin/root-terminal b/host/rootfs/image/usr/bin/root-terminal new file mode 100755 index 00000000..4f2874d1 --- /dev/null +++ b/host/rootfs/image/usr/bin/root-terminal @@ -0,0 +1,5 @@ +#!/bin/execlineb -Ws0 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +s6-sudo -- /run/root-terminal $@ -- 2.51.0

3 7

[PATCH 1/2] host/rootfs: atomically delete VM directories
by Alyssa Ross 10 Dec '25

10 Dec '25

Create a hidden empty directory, swap it with the original one, then remove both. Teach lsvm to ignore both hidden and empty directories, and now we no longer have a race where lsvm would get confused if a VM directory was in the process of being recursively removed when it looked at it. Fixes: b51a97f ("host/rootfs: add run-appimage program") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/image/usr/bin/run-appimage | 7 ++++++- host/rootfs/image/usr/bin/run-flatpak | 7 ++++++- tools/lsvm.rs | 19 ++++++++++++++----- 3 files changed, 26 insertions(+), 7 deletions(-) diff --git a/host/rootfs/image/usr/bin/run-appimage b/host/rootfs/image/usr/bin/run-appimage index 36f57b85..d61a79c6 100755 --- a/host/rootfs/image/usr/bin/run-appimage +++ b/host/rootfs/image/usr/bin/run-appimage @@ -43,4 +43,9 @@ if { s6-instance-delete /run/service/vm-services $id } if { umount ${dir}/mount } # mount namespace if { umount ${dir}/mount } # private bind mount -rm -r $dir /run/configs/${id} + +# Atomically swap the VM directory with an empty one, which will be ignored by +# lsvm, then remove it, so we never have half a VM directory. +if { mkdir /run/vm/by-id/.${id} } +if { exch /run/vm/by-id/.${id} $dir } +background { rm -rf /run/vm/by-id/.${id} $dir } diff --git a/host/rootfs/image/usr/bin/run-flatpak b/host/rootfs/image/usr/bin/run-flatpak index 2ef20433..6be21075 100755 --- a/host/rootfs/image/usr/bin/run-flatpak +++ b/host/rootfs/image/usr/bin/run-flatpak @@ -45,4 +45,9 @@ if { s6-instance-delete -- /run/service/vm-services $id } if { umount ${dir}/mount } # mount namespace if { umount ${dir}/mount } # private bind mount -rm -r $dir /run/configs/${id} + +# Atomically swap the VM directory with an empty one, which will be ignored by +# lsvm, then remove it, so we never have half a VM directory. +if { mkdir /run/vm/by-id/.${id} } +if { exch /run/vm/by-id/.${id} $dir } +background { rm -rf /run/vm/by-id/.${id} $dir } diff --git a/tools/lsvm.rs b/tools/lsvm.rs index 8f98e4f6..5d67ac6f 100644 --- a/tools/lsvm.rs +++ b/tools/lsvm.rs @@ -81,12 +81,21 @@ fn run() -> Result<(), String> { for entry in read_dir("/run/vm/by-id").map_err(|e| format!("reading /run/vm/by-id: {e}"))? { let entry = entry.map_err(|e| format!("iterating /run/vm/by-id: {e}"))?; - if entry - .file_type() - .map_err(|e| format!("getting type of {:?}: {e}", entry.path()))? - .is_dir() + if !entry.file_name().as_bytes().starts_with(b".") + && entry + .file_type() + .map_err(|e| format!("getting type of {:?}: {e}", entry.path()))? + .is_dir() { - names.insert(entry.file_name(), Vec::new()); + let path = entry.path(); + if path + .read_dir() + .map_err(|e| format!("reading {path:?}: {e}"))? + .next() + .is_some() + { + names.insert(entry.file_name(), Vec::new()); + } } } -- 2.51.0

1 1

[PATCH v2 1/6] host/rootfs: make passwd and group links into /run
by Alyssa Ross 09 Dec '25

09 Dec '25

This will allow us to give shadow's useradd /run as a prefix, and have it be able to add users at runtime. Reviewed-by: Demi Marie Obenour <demiobenour(a)gmail.com> Signed-off-by: Alyssa Ross <hi(a)alyssa.is> Message-ID: <20251209085628.603316-1-hi(a)alyssa.is> --- v2: use relative paths for symlink targets v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251209085628.603316… host/rootfs/file-list.mk | 6 ++++-- host/rootfs/image/etc/group | 16 +--------------- host/rootfs/image/etc/passwd | 2 +- .../etc/{ => s6-linux-init/run-image/etc}/group | 0 .../run-image/etc}/group.license | 0 .../etc/{ => s6-linux-init/run-image/etc}/passwd | 0 .../run-image/etc}/passwd.license | 0 7 files changed, 6 insertions(+), 18 deletions(-) mode change 100644 => 120000 host/rootfs/image/etc/group mode change 100644 => 120000 host/rootfs/image/etc/passwd copy host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/group (100%) rename host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/group.license (100%) copy host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/passwd (100%) rename host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/passwd.license (100%) diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce8..6ab78e6b 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -4,13 +4,13 @@ FILES = \ image/etc/fonts/fonts.conf \ image/etc/fstab \ - image/etc/group \ image/etc/init \ image/etc/login \ image/etc/parse-devname \ - image/etc/passwd \ image/etc/s6-linux-init/env/WAYLAND_DISPLAY \ image/etc/s6-linux-init/env/XDG_RUNTIME_DIR \ + image/etc/s6-linux-init/run-image/etc/group \ + image/etc/s6-linux-init/run-image/etc/passwd \ image/etc/s6-linux-init/run-image/service/getty-tty1/run \ image/etc/s6-linux-init/run-image/service/getty-tty2/run \ image/etc/s6-linux-init/run-image/service/getty-tty3/run \ @@ -68,6 +68,8 @@ FILES = \ LINKS = \ image/bin \ + image/etc/group \ + image/etc/passwd \ image/etc/s6-linux-init/run-image/opengl-driver \ image/etc/s6-linux-init/run-image/service/vmm/template/run \ image/lib \ diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group deleted file mode 100644 index e3ade468..00000000 --- a/host/rootfs/image/etc/group +++ /dev/null @@ -1,15 +0,0 @@ -root:x:0:root -clock:x:1: -dialout:x:2: -kmem:x:3: -input:x:4: -tty:x:5: -video:x:6: -render:x:7: -sgx:x:8: -audio:x:9: -lp:x:10: -disk:x:11: -cdrom:x:12: -tape:x:13: -kvm:x:14: diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group new file mode 120000 index 00000000..8dba62ad --- /dev/null +++ b/host/rootfs/image/etc/group @@ -0,0 +1 @@ +../run/etc/group \ No newline at end of file diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/passwd deleted file mode 100644 index 29f3b252..00000000 --- a/host/rootfs/image/etc/passwd +++ /dev/null @@ -1 +0,0 @@ -root:x:0:0:System administrator:/:/bin/sh diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/passwd new file mode 120000 index 00000000..1429c284 --- /dev/null +++ b/host/rootfs/image/etc/passwd @@ -0,0 +1 @@ +../run/etc/passwd \ No newline at end of file diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/s6-linux-init/run-image/etc/group similarity index 100% copy from host/rootfs/image/etc/group copy to host/rootfs/image/etc/s6-linux-init/run-image/etc/group diff --git a/host/rootfs/image/etc/group.license b/host/rootfs/image/etc/s6-linux-init/run-image/etc/group.license similarity index 100% rename from host/rootfs/image/etc/group.license rename to host/rootfs/image/etc/s6-linux-init/run-image/etc/group.license diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd similarity index 100% copy from host/rootfs/image/etc/passwd copy to host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd diff --git a/host/rootfs/image/etc/passwd.license b/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd.license similarity index 100% rename from host/rootfs/image/etc/passwd.license rename to host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd.license -- 2.51.0

2 11

[PATCH 1/3] tools/router: use socket activation
by Alyssa Ross 09 Dec '25

09 Dec '25

This means we can use readiness notification to wait until the sockets are created without having to add special functionality for that to the router program, and also means we can do extra system-specific setup to the sockets, like changing their owners, outside of the router. Since the socket paths were the only arguments taken by the router, this also lets us drop the clap dependency entirely. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/file-list.mk | 1 + .../service/spectrum-router/notification-fd | 1 + .../spectrum-router/notification-fd.license | 2 + .../template/data/service/spectrum-router/run | 19 +++ tools/router/Cargo.lock | 148 ++++++++++++------ tools/router/Cargo.toml | 2 +- tools/router/src/main.rs | 37 ++--- 7 files changed, 138 insertions(+), 72 deletions(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce..5a043b7 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -28,6 +28,7 @@ FILES = \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down \ + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd new file mode 100644 index 0000000..7ed6ff8 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd @@ -0,0 +1 @@ +5 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license new file mode 100644 index 0000000..0d3d47c --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run index 3ba35de..61375ca 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run @@ -1,14 +1,30 @@ #!/bin/execlineb -P # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> importas -i VM VM +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-driver.sock +fdmove -c 3 0 + +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-app.sock +fdmove -c 4 0 + +# Notify readiness. +if { + fdmove -c 5 1 + echo +} + +redirfd -r 0 /dev/null + bwrap --unshare-all --unshare-user --dev-bind / / --setenv RUST_LOG spectrum-router=debug,info + --setenv LISTEN_FDS 2 --tmpfs /tmp --dev /dev --tmpfs /dev/shm @@ -19,6 +35,9 @@ bwrap --ro-bind /lib /lib --bind /run/vm/by-id/${VM} /run/vm/by-id/${VM} -- + +getpid LISTEN_PID + spectrum-router --app-listen-path /run/vm/by-id/${VM}/router-app.sock --driver-listen-path /run/vm/by-id/${VM}/router-driver.sock diff --git a/tools/router/Cargo.lock b/tools/router/Cargo.lock index 60d7657..d0d105a 100644 --- a/tools/router/Cargo.lock +++ b/tools/router/Cargo.lock @@ -113,6 +113,12 @@ dependencies = [ "wyz", ] +[[package]] +name = "bumpalo" +version = "3.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43" + [[package]] name = "bytes" version = "1.11.0" @@ -120,44 +126,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3" [[package]] -name = "clap" -version = "4.5.53" +name = "cfg-if" +version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c9e340e012a1bf4935f5282ed1436d1489548e8f72308207ea5df0e23d2d03f8" -dependencies = [ - "clap_builder", - "clap_derive", -] - -[[package]] -name = "clap_builder" -version = "4.5.53" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d76b5d13eaa18c901fd2f7fca939fefe3a0727a953561fefdf3b2922b8569d00" -dependencies = [ - "anstream", - "anstyle", - "clap_lex", - "strsim", -] - -[[package]] -name = "clap_derive" -version = "4.5.49" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a0b5487afeab2deb2ff4e03a807ad1a03ac532ff5a2cee5d86884440c7f7671" -dependencies = [ - "heck", - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "clap_lex" -version = "0.7.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d" +checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "colorchoice" @@ -263,12 +235,6 @@ dependencies = [ "slab", ] -[[package]] -name = "heck" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" - [[package]] name = "is_terminal_polyfill" version = "1.70.2" @@ -299,12 +265,33 @@ dependencies = [ "syn", ] +[[package]] +name = "js-sys" +version = "0.3.83" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "464a3709c7f55f1f721e5389aa6ea4e3bc6aba669353300af094b29ffbdde1d8" +dependencies = [ + "once_cell", + "wasm-bindgen", +] + [[package]] name = "libc" version = "0.2.177" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976" +[[package]] +name = "listenfd" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b87bc54a4629b4294d0b3ef041b64c40c611097a677d9dc07b2c67739fe39dba" +dependencies = [ + "libc", + "uuid", + "winapi", +] + [[package]] name = "log" version = "0.4.28" @@ -328,6 +315,12 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "once_cell" +version = "1.21.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" + [[package]] name = "once_cell_polyfill" version = "1.70.2" @@ -420,6 +413,12 @@ version = "0.8.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58" +[[package]] +name = "rustversion" +version = "1.0.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" + [[package]] name = "serde_core" version = "1.0.228" @@ -462,9 +461,9 @@ version = "0.1.0" dependencies = [ "anyhow", "arrayvec", - "clap", "env_logger", "futures-util", + "listenfd", "log", "tokio", "tokio-stream", @@ -474,12 +473,6 @@ dependencies = [ "zerocopy", ] -[[package]] -name = "strsim" -version = "0.11.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" - [[package]] name = "syn" version = "2.0.111" @@ -608,6 +601,16 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" +[[package]] +name = "uuid" +version = "1.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + [[package]] name = "vhost-device-net" version = "0.1.1" @@ -666,6 +669,51 @@ version = "0.11.1+wasi-snapshot-preview1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" +[[package]] +name = "wasm-bindgen" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0d759f433fa64a2d763d1340820e46e111a7a5ab75f993d1852d70b03dbb80fd" +dependencies = [ + "cfg-if", + "once_cell", + "rustversion", + "wasm-bindgen-macro", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-macro" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "48cb0d2638f8baedbc542ed444afc0644a29166f1595371af4fecf8ce1e7eeb3" +dependencies = [ + "quote", + "wasm-bindgen-macro-support", +] + +[[package]] +name = "wasm-bindgen-macro-support" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cefb59d5cd5f92d9dcf80e4683949f15ca4b511f4ac0a6e14d4e1ac60c6ecd40" +dependencies = [ + "bumpalo", + "proc-macro2", + "quote", + "syn", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-shared" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cbc538057e648b67f72a982e708d485b2efa771e1ac05fec311f9f63e5800db4" +dependencies = [ + "unicode-ident", +] + [[package]] name = "winapi" version = "0.3.9" diff --git a/tools/router/Cargo.toml b/tools/router/Cargo.toml index 0b96911..cfdf352 100644 --- a/tools/router/Cargo.toml +++ b/tools/router/Cargo.toml @@ -8,7 +8,6 @@ edition = "2024" [dependencies] anyhow = "1.0.100" -clap = { version = "4.5.45", features = ["derive"] } env_logger = "0.11.8" log = { version = "0.4.27", features = ["release_max_level_debug"] } vhost-device-net = "0.1.0" @@ -19,3 +18,4 @@ tokio-stream = "0.1.17" arrayvec = "0.7.6" vm-memory = "0.16" tokio-util = "0.7.17" +listenfd = "1.0.2" diff --git a/tools/router/src/main.rs b/tools/router/src/main.rs index e3aca65..a96d511 100644 --- a/tools/router/src/main.rs +++ b/tools/router/src/main.rs @@ -1,47 +1,42 @@ // SPDX-License-Identifier: EUPL-1.2+ // SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> pub(crate) mod packet; pub(crate) mod protocol; mod router; mod upstream; -use std::path::PathBuf; - use packet::*; use router::{InterfaceId, Router}; use upstream::Upstream; -use clap::Parser; +use anyhow::anyhow; use futures_util::{SinkExt, TryStreamExt}; +use listenfd::ListenFd; use log::{error, info}; use tokio::net::UnixListener; use vhost_device_net::{IncomingPacket, VhostDeviceNet}; use vm_memory::GuestMemoryMmap; -#[derive(Parser, Debug)] -#[command()] //version = None, about = None, long_about = None)] -struct Args { - #[arg(long)] - driver_listen_path: PathBuf, - #[arg(long)] - app_listen_path: PathBuf, -} - fn main() -> anyhow::Result<()> { env_logger::init(); - let args = Args::parse(); - for path in [&args.driver_listen_path, &args.app_listen_path] { - let _ = std::fs::remove_file(path); - } - - run_router(args) + run_router() } #[tokio::main(flavor = "current_thread")] -async fn run_router(args: Args) -> anyhow::Result<()> { - let app_listener = UnixListener::bind(&args.app_listen_path)?; - let driver_listener = UnixListener::bind(&args.driver_listen_path)?; +async fn run_router() -> anyhow::Result<()> { + let mut listenfd = ListenFd::from_env(); + + let Some(driver_listener) = listenfd.take_unix_listener(0)? else { + return Err(anyhow!("not activated with driver socket")); + }; + let Some(app_listener) = listenfd.take_unix_listener(1)? else { + return Err(anyhow!("not activated with app socket")); + }; + + let driver_listener = UnixListener::from_std(driver_listener)?; + let app_listener = UnixListener::from_std(app_listener)?; let mut router = Router::<GuestMemoryMmap>::new(InterfaceId::Upstream); base-commit: 04b6183cbbb624996cf848ee248be6dd719ace23 -- 2.51.0

2 9

[PATCH] host/rootfs: Sandbox crosvm
by Demi Marie Obenour 09 Dec '25

09 Dec '25

This means that a breach of crosvm is not guaranteed to be fatal. The Wayland socket is still only accessible by root, so crosvm must run as root. The known container escape via /proc/self/exe is blocked by bwrap being on a read-only filesystem. Container escapes via /proc are blocked by remounting /proc read-only. Crosvm does not have CAP_SYS_ADMIN so it cannot change mounts. The two remaining steps are: - Run crosvm as an unprivileged user. - Enable seccomp to block most system calls. The latter should be done from within crosvm itself. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/default.nix | 6 +++--- .../template/data/service/vhost-user-gpu/run | 17 ++++++++++++++++- 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index b441a517f3bbb78f84d8566ca6dfd9181d0302be..81e12b6c2e98ca789d2d14e56dd2b7175296c1e8 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -10,7 +10,7 @@ pkgsMusl.callPackage ( { spectrum-host-tools , lib, stdenvNoCC, nixos, runCommand, writeClosure, erofs-utils, s6-rc -, busybox, cloud-hypervisor, cosmic-files, crosvm, cryptsetup +, bubblewrap, busybox, cloud-hypervisor, cosmic-files, crosvm, cryptsetup , dejavu_fonts, dbus, execline, foot, fuse3, iproute2, inotify-tools , jq, kmod, mdevd, mesa, s6, s6-linux-init, socat, systemd , util-linuxMinimal, virtiofsd, westonLite, xdg-desktop-portal @@ -25,8 +25,8 @@ let trivial; packages = [ - btrfs-progs cloud-hypervisor cosmic-files crosvm cryptsetup dbus - execline fuse3 inotify-tools iproute2 jq kmod mdevd s6 s6-linux-init + bubblewrap btrfs-progs cloud-hypervisor cosmic-files crosvm cryptsetup + dbus execline fuse3 inotify-tools iproute2 jq kmod mdevd s6 s6-linux-init s6-rc socat spectrum-host-tools util-linuxMinimal virtiofsd xdg-desktop-portal-spectrum-host diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run index 0b4f6a00bc7aed0e721454d584d3bcd47fb18e2a..4838199a859cfadb45c23fb314f4651c6a6b3041 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run @@ -1,10 +1,25 @@ #!/bin/execlineb -P # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> s6-ipcserver -1a 0700 -C 1 -b 1 env/crosvm.sock -crosvm --no-syslog device gpu +bwrap + --unshare-all + --unshare-user + --bind /run/user/0/wayland-1 /run/user/0/wayland-1 + --ro-bind /usr /usr + --ro-bind /lib /lib + --tmpfs /tmp + --dev /dev + --tmpfs /dev/shm + --ro-bind /nix /nix + --disable-userns + --proc /proc + --remount-ro /proc + -- + crosvm --no-syslog device gpu --fd 0 --wayland-sock /run/user/0/wayland-1 --params "{\"context-types\":\"cross-domain\"}" --- base-commit: 965f5706764edb1b4fea147683b5ab803dd6df5e change-id: 20251129-sandbox-5a42a6a41b59 -- Sincerely, Demi Marie Obenour (she/her/hers)

4 36

[PATCH v2 1/3] tools/router: use socket activation
by Alyssa Ross 09 Dec '25

09 Dec '25

This means we can use readiness notification to wait until the sockets are created without having to add special functionality for that to the router program, and also means we can do extra system-specific setup to the sockets, like changing their owners, outside of the router. Since the socket paths were the only arguments taken by the router, this also lets us drop the clap dependency entirely. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> Message-ID: <20251209003813.553461-1-hi(a)alyssa.is> --- v2: stop passing obsolete arguments to router v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251209003813.553461… host/rootfs/file-list.mk | 1 + .../service/spectrum-router/notification-fd | 1 + .../spectrum-router/notification-fd.license | 2 + .../template/data/service/spectrum-router/run | 21 ++- tools/router/Cargo.lock | 148 ++++++++++++------ tools/router/Cargo.toml | 2 +- tools/router/src/main.rs | 37 ++--- 7 files changed, 138 insertions(+), 74 deletions(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce8..5a043b7b 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -28,6 +28,7 @@ FILES = \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down \ + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd new file mode 100644 index 00000000..7ed6ff82 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd @@ -0,0 +1 @@ +5 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license new file mode 100644 index 00000000..0d3d47ca --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run index 3ba35def..dc1ef900 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run @@ -1,14 +1,30 @@ #!/bin/execlineb -P # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> importas -i VM VM +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-driver.sock +fdmove -c 3 0 + +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-app.sock +fdmove -c 4 0 + +# Notify readiness. +if { + fdmove -c 5 1 + echo +} + +redirfd -r 0 /dev/null + bwrap --unshare-all --unshare-user --dev-bind / / --setenv RUST_LOG spectrum-router=debug,info + --setenv LISTEN_FDS 2 --tmpfs /tmp --dev /dev --tmpfs /dev/shm @@ -19,6 +35,7 @@ bwrap --ro-bind /lib /lib --bind /run/vm/by-id/${VM} /run/vm/by-id/${VM} -- + +getpid LISTEN_PID + spectrum-router - --app-listen-path /run/vm/by-id/${VM}/router-app.sock - --driver-listen-path /run/vm/by-id/${VM}/router-driver.sock diff --git a/tools/router/Cargo.lock b/tools/router/Cargo.lock index 60d7657b..d0d105aa 100644 --- a/tools/router/Cargo.lock +++ b/tools/router/Cargo.lock @@ -113,6 +113,12 @@ dependencies = [ "wyz", ] +[[package]] +name = "bumpalo" +version = "3.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43" + [[package]] name = "bytes" version = "1.11.0" @@ -120,44 +126,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3" [[package]] -name = "clap" -version = "4.5.53" +name = "cfg-if" +version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c9e340e012a1bf4935f5282ed1436d1489548e8f72308207ea5df0e23d2d03f8" -dependencies = [ - "clap_builder", - "clap_derive", -] - -[[package]] -name = "clap_builder" -version = "4.5.53" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d76b5d13eaa18c901fd2f7fca939fefe3a0727a953561fefdf3b2922b8569d00" -dependencies = [ - "anstream", - "anstyle", - "clap_lex", - "strsim", -] - -[[package]] -name = "clap_derive" -version = "4.5.49" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a0b5487afeab2deb2ff4e03a807ad1a03ac532ff5a2cee5d86884440c7f7671" -dependencies = [ - "heck", - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "clap_lex" -version = "0.7.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d" +checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "colorchoice" @@ -263,12 +235,6 @@ dependencies = [ "slab", ] -[[package]] -name = "heck" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" - [[package]] name = "is_terminal_polyfill" version = "1.70.2" @@ -299,12 +265,33 @@ dependencies = [ "syn", ] +[[package]] +name = "js-sys" +version = "0.3.83" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "464a3709c7f55f1f721e5389aa6ea4e3bc6aba669353300af094b29ffbdde1d8" +dependencies = [ + "once_cell", + "wasm-bindgen", +] + [[package]] name = "libc" version = "0.2.177" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976" +[[package]] +name = "listenfd" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b87bc54a4629b4294d0b3ef041b64c40c611097a677d9dc07b2c67739fe39dba" +dependencies = [ + "libc", + "uuid", + "winapi", +] + [[package]] name = "log" version = "0.4.28" @@ -328,6 +315,12 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "once_cell" +version = "1.21.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" + [[package]] name = "once_cell_polyfill" version = "1.70.2" @@ -420,6 +413,12 @@ version = "0.8.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58" +[[package]] +name = "rustversion" +version = "1.0.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" + [[package]] name = "serde_core" version = "1.0.228" @@ -462,9 +461,9 @@ version = "0.1.0" dependencies = [ "anyhow", "arrayvec", - "clap", "env_logger", "futures-util", + "listenfd", "log", "tokio", "tokio-stream", @@ -474,12 +473,6 @@ dependencies = [ "zerocopy", ] -[[package]] -name = "strsim" -version = "0.11.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" - [[package]] name = "syn" version = "2.0.111" @@ -608,6 +601,16 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" +[[package]] +name = "uuid" +version = "1.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + [[package]] name = "vhost-device-net" version = "0.1.1" @@ -666,6 +669,51 @@ version = "0.11.1+wasi-snapshot-preview1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" +[[package]] +name = "wasm-bindgen" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0d759f433fa64a2d763d1340820e46e111a7a5ab75f993d1852d70b03dbb80fd" +dependencies = [ + "cfg-if", + "once_cell", + "rustversion", + "wasm-bindgen-macro", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-macro" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "48cb0d2638f8baedbc542ed444afc0644a29166f1595371af4fecf8ce1e7eeb3" +dependencies = [ + "quote", + "wasm-bindgen-macro-support", +] + +[[package]] +name = "wasm-bindgen-macro-support" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cefb59d5cd5f92d9dcf80e4683949f15ca4b511f4ac0a6e14d4e1ac60c6ecd40" +dependencies = [ + "bumpalo", + "proc-macro2", + "quote", + "syn", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-shared" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cbc538057e648b67f72a982e708d485b2efa771e1ac05fec311f9f63e5800db4" +dependencies = [ + "unicode-ident", +] + [[package]] name = "winapi" version = "0.3.9" diff --git a/tools/router/Cargo.toml b/tools/router/Cargo.toml index 0b969113..cfdf3527 100644 --- a/tools/router/Cargo.toml +++ b/tools/router/Cargo.toml @@ -8,7 +8,6 @@ edition = "2024" [dependencies] anyhow = "1.0.100" -clap = { version = "4.5.45", features = ["derive"] } env_logger = "0.11.8" log = { version = "0.4.27", features = ["release_max_level_debug"] } vhost-device-net = "0.1.0" @@ -19,3 +18,4 @@ tokio-stream = "0.1.17" arrayvec = "0.7.6" vm-memory = "0.16" tokio-util = "0.7.17" +listenfd = "1.0.2" diff --git a/tools/router/src/main.rs b/tools/router/src/main.rs index e3aca65a..a96d5114 100644 --- a/tools/router/src/main.rs +++ b/tools/router/src/main.rs @@ -1,47 +1,42 @@ // SPDX-License-Identifier: EUPL-1.2+ // SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> pub(crate) mod packet; pub(crate) mod protocol; mod router; mod upstream; -use std::path::PathBuf; - use packet::*; use router::{InterfaceId, Router}; use upstream::Upstream; -use clap::Parser; +use anyhow::anyhow; use futures_util::{SinkExt, TryStreamExt}; +use listenfd::ListenFd; use log::{error, info}; use tokio::net::UnixListener; use vhost_device_net::{IncomingPacket, VhostDeviceNet}; use vm_memory::GuestMemoryMmap; -#[derive(Parser, Debug)] -#[command()] //version = None, about = None, long_about = None)] -struct Args { - #[arg(long)] - driver_listen_path: PathBuf, - #[arg(long)] - app_listen_path: PathBuf, -} - fn main() -> anyhow::Result<()> { env_logger::init(); - let args = Args::parse(); - for path in [&args.driver_listen_path, &args.app_listen_path] { - let _ = std::fs::remove_file(path); - } - - run_router(args) + run_router() } #[tokio::main(flavor = "current_thread")] -async fn run_router(args: Args) -> anyhow::Result<()> { - let app_listener = UnixListener::bind(&args.app_listen_path)?; - let driver_listener = UnixListener::bind(&args.driver_listen_path)?; +async fn run_router() -> anyhow::Result<()> { + let mut listenfd = ListenFd::from_env(); + + let Some(driver_listener) = listenfd.take_unix_listener(0)? else { + return Err(anyhow!("not activated with driver socket")); + }; + let Some(app_listener) = listenfd.take_unix_listener(1)? else { + return Err(anyhow!("not activated with app socket")); + }; + + let driver_listener = UnixListener::from_std(driver_listener)?; + let app_listener = UnixListener::from_std(app_listener)?; let mut router = Router::<GuestMemoryMmap>::new(InterfaceId::Upstream); -- 2.51.0

2 3

[PATCH 1/5] host/rootfs: make passwd and group links into /run
by Alyssa Ross 09 Dec '25

09 Dec '25

This will allow us to give shadow's useradd /run as a prefix, and have it be able to add users at runtime. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/file-list.mk | 6 ++++-- host/rootfs/image/etc/group | 16 +--------------- host/rootfs/image/etc/passwd | 2 +- .../etc/{ => s6-linux-init/run-image/etc}/group | 0 .../run-image/etc}/group.license | 0 .../etc/{ => s6-linux-init/run-image/etc}/passwd | 0 .../run-image/etc}/passwd.license | 0 7 files changed, 6 insertions(+), 18 deletions(-) mode change 100644 => 120000 host/rootfs/image/etc/group mode change 100644 => 120000 host/rootfs/image/etc/passwd copy host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/group (100%) rename host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/group.license (100%) copy host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/passwd (100%) rename host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/passwd.license (100%) diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce..6ab78e6 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -4,13 +4,13 @@ FILES = \ image/etc/fonts/fonts.conf \ image/etc/fstab \ - image/etc/group \ image/etc/init \ image/etc/login \ image/etc/parse-devname \ - image/etc/passwd \ image/etc/s6-linux-init/env/WAYLAND_DISPLAY \ image/etc/s6-linux-init/env/XDG_RUNTIME_DIR \ + image/etc/s6-linux-init/run-image/etc/group \ + image/etc/s6-linux-init/run-image/etc/passwd \ image/etc/s6-linux-init/run-image/service/getty-tty1/run \ image/etc/s6-linux-init/run-image/service/getty-tty2/run \ image/etc/s6-linux-init/run-image/service/getty-tty3/run \ @@ -68,6 +68,8 @@ FILES = \ LINKS = \ image/bin \ + image/etc/group \ + image/etc/passwd \ image/etc/s6-linux-init/run-image/opengl-driver \ image/etc/s6-linux-init/run-image/service/vmm/template/run \ image/lib \ diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group deleted file mode 100644 index e3ade46..0000000 --- a/host/rootfs/image/etc/group +++ /dev/null @@ -1,15 +0,0 @@ -root:x:0:root -clock:x:1: -dialout:x:2: -kmem:x:3: -input:x:4: -tty:x:5: -video:x:6: -render:x:7: -sgx:x:8: -audio:x:9: -lp:x:10: -disk:x:11: -cdrom:x:12: -tape:x:13: -kvm:x:14: diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group new file mode 120000 index 0000000..a9b248e --- /dev/null +++ b/host/rootfs/image/etc/group @@ -0,0 +1 @@ +/run/etc/group \ No newline at end of file diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/passwd deleted file mode 100644 index 29f3b25..0000000 --- a/host/rootfs/image/etc/passwd +++ /dev/null @@ -1 +0,0 @@ -root:x:0:0:System administrator:/:/bin/sh diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/passwd new file mode 120000 index 0000000..889bb76 --- /dev/null +++ b/host/rootfs/image/etc/passwd @@ -0,0 +1 @@ +/run/etc/passwd \ No newline at end of file diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/s6-linux-init/run-image/etc/group similarity index 100% copy from host/rootfs/image/etc/group copy to host/rootfs/image/etc/s6-linux-init/run-image/etc/group diff --git a/host/rootfs/image/etc/group.license b/host/rootfs/image/etc/s6-linux-init/run-image/etc/group.license similarity index 100% rename from host/rootfs/image/etc/group.license rename to host/rootfs/image/etc/s6-linux-init/run-image/etc/group.license diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd similarity index 100% copy from host/rootfs/image/etc/passwd copy to host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd diff --git a/host/rootfs/image/etc/passwd.license b/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd.license similarity index 100% rename from host/rootfs/image/etc/passwd.license rename to host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd.license base-commit: d0efa283216ebc503b4b715c051518ae7dbd8409 -- 2.51.0

2 14

[PATCH] host/rootfs: Sandbox Cloud Hypervisor
by Demi Marie Obenour 09 Dec '25

09 Dec '25

It only needs access to a small number of resources. Unfortunately, it needs access to /dev/vfio right now. This should be fixed by using file descriptor passing instead. Also, Cloud Hypervisor should not run as root. Cloud Hypervisor needs to be able to lock memory. Running in a user namespace prevents it from using CAP_IPC_LOCK. Therefore, it is necessary to increase RLIMIT_MLOCK before running Cloud Hypervisor. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/image/usr/bin/run-vmm | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm index ba8b59c2677408acdd01c2eda3cf2dd60992d881..24c3d607bfcf6fea6196b61d2941141486d33fd6 100755 --- a/host/rootfs/image/usr/bin/run-vmm +++ b/host/rootfs/image/usr/bin/run-vmm @@ -52,5 +52,36 @@ unexport ! fdmove -c 3 0 redirfd -r 0 /dev/null +s6-softlimit -H -l 18446744073709551615 if { udevadm wait /dev/kvm } -cloud-hypervisor --api-socket fd=3 +bwrap + --unshare-all + --unshare-user + --dev /dev + --dev-bind /dev/kvm /dev/kvm + --dev-bind /dev/vfio /dev/vfio + --tmpfs /dev/shm + --tmpfs /tmp + --tmpfs /var/tmp + --ro-bind /etc /etc + --ro-bind /lib /lib + --ro-bind /nix /nix + --ro-bind /usr /usr + --ro-bind /sys /sys + --bind /run /run + --proc /proc + --ro-bind /proc/sys /proc/sys + --tmpfs /proc/scsi + --remount-ro /proc/scsi + --tmpfs /proc/acpi + --remount-ro /proc/acpi + --tmpfs /proc/fs + --remount-ro /proc/fs + --tmpfs /proc/irq + --remount-ro /proc/irq + --ro-bind /dev/null /proc/timer_list + --ro-bind /dev/null /proc/kcore + --ro-bind /dev/null /proc/kallsyms + --ro-bind /dev/null /proc/sysrq-trigger + -- + cloud-hypervisor --api-socket fd=3 --- base-commit: 92e219e7c08c479d216a46d2736ea9d229ff034d change-id: 20251206-b4-sandbox-9be7e5ed9926 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 5

[PATCH v2 1/2] vm/app/systemd-sysupdate: fix mounting overlay
by Alyssa Ross 09 Dec '25

09 Dec '25

This assumed it would be run as root, so has been broken since we stopped running application scripts as root inside img/app VMs. Reported-by: Johannes Süllner <johannes.suellner(a)mailbox.org> Link: https://matrix.to/#/!xSysqhzbOZImdvGpix:fairydust.space/$9psDI3BIP00EIzW-qO… Fixes: 8bfcbf9 ("img/app: run applications as non-root") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v2: remove redundant -U flag v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251208154738.300709… vm/app/systemd-sysupdate/download-update | 1 + 1 file changed, 1 insertion(+) diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update index eada41c..f8f5aed 100755 --- a/vm/app/systemd-sysupdate/download-update +++ b/vm/app/systemd-sysupdate/download-update @@ -3,6 +3,7 @@ # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> export LC_ALL C export LANGUAGE C +unshare -mr if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX } # Not a useless use of cat: if there are NUL bytes in the URL base-commit: 5104fa720ce8b00612c5487fc47124fbf99e58c6 -- 2.51.0

2 3

[PATCH] img/app: fix running AppImages
by Alyssa Ross 09 Dec '25

09 Dec '25

The non-root user that applications run as can't mount FUSE filesystems. I don't want to introduce setuid or an IPC service just for running AppImages, although we could revisit if we find that applications themselves rely on being able to mount FUSE filesystems. For now, it'll be more efficient to use the in-kernel squashfs implementation anyway. We do need to set a few environment variables normally set by the AppImage runtime, but as far as I can tell it doesn't do much more than this that applications could rely on. This only works for type 2 AppImages, but I expect that's just about every AppImage nowadays, and if turns out not to be it shouldn't be too hard to support type 1. Fixes: 8bfcbf9 ("img/app: run applications as non-root") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- img/app/Makefile | 2 +- img/app/image/etc/s6-rc/app/run | 11 +++++++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/img/app/Makefile b/img/app/Makefile index ddfc8ef..7354f89 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -30,7 +30,7 @@ $(imgdir)/appvm/blk/root.img: ../../scripts/make-gpt.sh ../../scripts/sfdisk-fie build/rootfs.erofs:root:5460386f-2203-4911-8694-91400125c604:root mv $@.tmp $@ -DIRS = dev home/user run proc sys tmp \ +DIRS = dev home/user run mnt proc sys tmp \ etc/s6-linux-init/run-image/pipewire \ etc/s6-linux-init/run-image/service \ etc/s6-linux-init/run-image/user \ diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/app/run index e05d4fe..e691a63 100755 --- a/img/app/image/etc/s6-rc/app/run +++ b/img/app/image/etc/s6-rc/app/run @@ -14,10 +14,17 @@ foreground { withstdinas -E type case $type { appimage { - if { modprobe fuse } + if { modprobe loop } + if { + backtick -E offset { /run/virtiofs/virtiofs0/config/run --appimage-offset } + mount -o offset=${offset} /run/virtiofs/virtiofs0/config/run /mnt + } s6-setuidgid user + export APPIMAGE /run/virtiofs/virtiofs0/config/run + export APPDIR /mnt + export ARGV0 /mnt/AppRun export LD_LIBRARY_PATH /lib64 - /run/virtiofs/virtiofs0/config/run + /mnt/AppRun } flatpak { s6-envdir -fnL /run/virtiofs/virtiofs0/config/params base-commit: 5104fa720ce8b00612c5487fc47124fbf99e58c6 -- 2.51.0

3 3

[PATCH] img/app: fix X11
by Alyssa Ross 09 Dec '25

09 Dec '25

Xwayland only accepts connections from the user it's running as. It is started by wayland-proxy-virtwl, which does not allow passing extra options, so we can't change its authentication method. Therefore, the only way for X11 to work with the current software is to run wayland-proxy-virtwl as the same user as the application. I expect that in the near future, we will use xwayland-satellite instead of the built-in Xwayland translation in wayland-proxy-virtwl. When that happens, we can run the stub compositor as its own user again. Fixes: cb27e3a ("img/app: wayland-proxy-virtwl: run as non-root") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- img/app/image/etc/group | 1 - img/app/image/etc/mdev.conf | 2 +- img/app/image/etc/passwd | 1 - img/app/image/etc/s6-rc/wayland-proxy-virtwl/run | 2 +- 4 files changed, 2 insertions(+), 4 deletions(-) diff --git a/img/app/image/etc/group b/img/app/image/etc/group index b2c3a2e..e84da60 100644 --- a/img/app/image/etc/group +++ b/img/app/image/etc/group @@ -1,4 +1,3 @@ -wayland:x:1:wayland wireplumber:x:2:wireplumber pipewire:x:3:pipewire user:x:1000:user diff --git a/img/app/image/etc/mdev.conf b/img/app/image/etc/mdev.conf index d4cd825..33a07d6 100644 --- a/img/app/image/etc/mdev.conf +++ b/img/app/image/etc/mdev.conf @@ -4,7 +4,7 @@ -$MODALIAS=.* 0:0 0 ! +importas -Siu MODALIAS modprobe -q $MODALIAS $INTERFACE=.* 0:0 0 ! +/etc/mdev/iface $MODALIAS=virtio:d0000001Av.* 0:0 0 ! +/etc/mdev/virtiofs -dri/card0 wayland:wayland 660 +background { /etc/mdev/listen card0 } +dri/card0 user:user 660 +background { /etc/mdev/listen card0 } -SUBSYSTEM=sound;.* pipewire:pipewire 660 snd/controlC0 pipewire:pipewire 660 +background { /etc/mdev/listen controlC0 } diff --git a/img/app/image/etc/passwd b/img/app/image/etc/passwd index 08324b0..425908e 100644 --- a/img/app/image/etc/passwd +++ b/img/app/image/etc/passwd @@ -1,5 +1,4 @@ root:x:0:0:System administrator:/run/root:/bin/sh -wayland:x:1:1:wayland-proxy-virtwl service user:/:/usr/bin/nologin wireplumber:x:2:2:WirePlumber service user:/:/usr/bin/nologin pipewire:x:3:3:PipeWire service user:/:/usr/bin/nologin user:x:1000:1000:Spectrum application user:/home/user:/bin/sh diff --git a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run b/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run index 86d7f63..5d06b7a 100755 --- a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run +++ b/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run @@ -26,6 +26,6 @@ export LISTEN_FDS 2 export LISTEN_FDNAMES wayland:x11 getpid LISTEN_PID -s6-setuidgid wayland +s6-setuidgid user wayland-proxy-virtwl --virtio-gpu --x-display=0 base-commit: 5104fa720ce8b00612c5487fc47124fbf99e58c6 -- 2.51.0

3 2

[REGRESSION] Networking for Firefox broken on second VM run
by Alyssa Ross 09 Dec '25

09 Dec '25

Since we introduced the userspace router, if I start the Firefox VM, quit Firefox, wait for the VM to shut down, and then start it again, networking no longer works, and I see repeating log lines like this: 2025-12-09 09:13:29.147240893 [2025-12-09T09:13:29Z WARN spectrum_router::router] interface App(0) has been blocked for 1 sec, dropping packet Full reproduction steps: 1. cd host/rootfs 2. nix-shell --run 'make clean && make run' 3. Start Firefox VM with vm-start 4. See that networking works 5. Quit Firefox and wait a few seconds for VM to stop 6. Start Firefox VM with vm-start again 7. No more networking, and log lines like the above

1 2

[PATCH] img/app: Delete dependency on nonexistent nftables service
by Demi Marie Obenour 09 Dec '25

09 Dec '25

This file was not included in the application image. Fixes: dcee941 ("vm/sys/net: integrate xdp-forwarder") Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables | 0 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables b/img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables deleted file mode 100644 index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..0000000000000000000000000000000000000000 --- base-commit: 44f32b7a4b3cfbb4046447318e6753dd0eb71add change-id: 20251201-fix-file-list-3fdfd53bd150 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 2

[PATCH] vm/sys/net: start nftables service
by Yureka Lilian 09 Dec '25

09 Dec '25

This was supposed to be here all along to ensure the net-vm does not create any traffic on any interfaces except for the xdp-forwarder setup. Fixes: dcee941 ("vm/sys/net: integrate xdp-forwarder") Signed-off-by: Yureka Lilian <yureka(a)cyberchaos.dev> --- vm/sys/net/file-list.mk | 1 + vm/sys/net/image/etc/s6-rc/mdevd/dependencies.d/nftables | 0 2 files changed, 1 insertion(+) create mode 100644 vm/sys/net/image/etc/s6-rc/mdevd/dependencies.d/nftables diff --git a/vm/sys/net/file-list.mk b/vm/sys/net/file-list.mk index 7cc3520..dfea2a8 100644 --- a/vm/sys/net/file-list.mk +++ b/vm/sys/net/file-list.mk @@ -26,6 +26,7 @@ S6_RC_FILES = \ image/etc/s6-rc/mdevd-coldplug/dependencies.d/mdevd \ image/etc/s6-rc/mdevd-coldplug/type \ image/etc/s6-rc/mdevd-coldplug/up \ + image/etc/s6-rc/mdevd/dependencies.d/nftables \ image/etc/s6-rc/mdevd/notification-fd \ image/etc/s6-rc/mdevd/run \ image/etc/s6-rc/mdevd/type \ diff --git a/vm/sys/net/image/etc/s6-rc/mdevd/dependencies.d/nftables b/vm/sys/net/image/etc/s6-rc/mdevd/dependencies.d/nftables new file mode 100644 index 0000000..e69de29 -- 2.51.2

3 2

[PATCH] host/rootfs: Set no_new_privs in PID 1
by Demi Marie Obenour 08 Dec '25

08 Dec '25

This prevents any program on the host from gaining privileges via execve(), ever. There are currently no such programs on the host so this should be a no-op for now. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/image/etc/init | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/host/rootfs/image/etc/init b/host/rootfs/image/etc/init index 4085fa55545e7309004967e443e47fc2b82b0663..e9938acec866045962a8ead096d199cbd3792469 100755 --- a/host/rootfs/image/etc/init +++ b/host/rootfs/image/etc/init @@ -2,4 +2,4 @@ # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022 Alyssa Ross <hi(a)alyssa.is> -/bin/s6-linux-init -c /etc/s6-linux-init -s /run/param -- $@ +/usr/bin/setpriv --no-new-privs -- /bin/s6-linux-init -c /etc/s6-linux-init -s /run/param -- $@ --- base-commit: 92e219e7c08c479d216a46d2736ea9d229ff034d change-id: 20251205-no-new-privs-2f22088c0736 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 2

[PATCH] vm/app/systemd-sysupdate: fix mounting overlay
by Alyssa Ross 08 Dec '25

08 Dec '25

This assumed it would be run as root, so has been broken since we stopped running application scripts as root inside img/app VMs. Reported-by: Johannes Süllner <johannes.suellner(a)mailbox.org> Link: https://matrix.to/#/!xSysqhzbOZImdvGpix:fairydust.space/$9psDI3BIP00EIzW-qO… Fixes: 8bfcbf9 ("img/app: run applications as non-root") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- vm/app/systemd-sysupdate/download-update | 1 + 1 file changed, 1 insertion(+) diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update index eada41c..335e389 100755 --- a/vm/app/systemd-sysupdate/download-update +++ b/vm/app/systemd-sysupdate/download-update @@ -3,6 +3,7 @@ # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> export LC_ALL C export LANGUAGE C +unshare -rUm if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX } # Not a useless use of cat: if there are NUL bytes in the URL base-commit: 9f33ec29d39df59589ed7c1b85d54e116e135df8 -- 2.51.0

2 6

[REGRESSION] VMs can't be rebooted
by Alyssa Ross 07 Dec '25

07 Dec '25

Since a655117 ("tools: start-vmm: enable Cloud Hypervisor landlock"), it's not possible to reboot a VM: ~ # ch-remote --api-socket /run/vm/by-id/dLPcEC/vmm reboot [2025-12-07T13:04:25Z ERROR cloud_hypervisor] Fatal error: HttpApiClient(ServerResponse(InternalServerError, Some("[\"Error from API\",\"The VM could not reboot\",\"Error creating console devices\",\"Error creating console device\",\"Permission denied (os error 13)\"]"))) Error: ch-remote exited with the following chain of errors: 0: http client error 1: Server responded with InternalServerError 2: Error from API 3: The VM could not reboot 4: Error creating console devices 5: Error creating console device 6: Permission denied (os error 13) I've opened an upstream bug reported about this: https://github.com/cloud-hypervisor/cloud-hypervisor/issues/7547

1 0

[PATCH] release/live: fix Makefile dependency being missing in Nix shell
by Johannes Süllner 06 Dec '25

06 Dec '25

In commit a6d872ae, a Btrfs userdata partition was added to the live VM that can be startet with `make run`. The Makefile creates this partition and therefor requires `btrfs-progs`. --- release/live/shell.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/release/live/shell.nix b/release/live/shell.nix index e542793..a52c9b1 100644 --- a/release/live/shell.nix +++ b/release/live/shell.nix @@ -2,7 +2,7 @@ # SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi(a)alyssa.is> import ../../lib/call-package.nix ( -{ callSpectrumPackage, config, stdenv, qemu_kvm }: +{ callSpectrumPackage, config, stdenv, btrfs-progs, qemu_kvm }: let efi = callSpectrumPackage ../../host/efi.nix {}; @@ -11,7 +11,7 @@ in (callSpectrumPackage ./. {}).overrideAttrs ( { nativeBuildInputs ? [], env ? {}, ... }: { - nativeBuildInputs = nativeBuildInputs ++ [ qemu_kvm ]; + nativeBuildInputs = nativeBuildInputs ++ [ btrfs-progs qemu_kvm ]; env = env // { OVMF_CODE = "${qemu_kvm}/share/qemu/edk2-${stdenv.hostPlatform.qemuArch}-code.fd"; -- 2.51.2

3 3

Test for portals passes even when file portal is broken
by Demi Marie Obenour 06 Dec '25

06 Dec '25

While trying to sandbox the file chooser portal, I broke it. This caused files not to be saved, resulting in silent data loss. Unfortunately, the integration test still passed. Is this a bug in the test? Is there a better alternative to manual testing? -- Sincerely, Demi Marie Obenour (she/her/hers)

3 10

[PATCH] host/rootfs: create groups assumed by udev
by Alyssa Ross 05 Dec '25

05 Dec '25

We don't really care about these groups, but if they don't exist, udev will also not apply the "other" modes from rules, leaving e.g. /dev/kvm root-only when it should be globally read/write. tty is set to 5, conforming with the systemd convention. Link: https://systemd.io/UIDS-GIDS/ Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- Demi, this should avoid the need to add a udev rule for /dev/kvm. host/rootfs/image/etc/group | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group index 18acc30..e3ade46 100644 --- a/host/rootfs/image/etc/group +++ b/host/rootfs/image/etc/group @@ -1 +1,15 @@ root:x:0:root +clock:x:1: +dialout:x:2: +kmem:x:3: +input:x:4: +tty:x:5: +video:x:6: +render:x:7: +sgx:x:8: +audio:x:9: +lp:x:10: +disk:x:11: +cdrom:x:12: +tape:x:13: +kvm:x:14: base-commit: a13d3403c1ddbb8dbbbdb05416350b2846162ed1 -- 2.51.0

3 4

[PATCH] host/rootfs: Add scripts to access a VM by name
by Demi Marie Obenour 05 Dec '25

05 Dec '25

This is much more convenient than having to find a VM's ID. In the future, the programs that take a VM ID should be the suffixed ones, but this change avoids having to change any tests and so is simpler. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/file-list.mk | 3 +++ host/rootfs/image/usr/bin/vm-console-by-name | 9 +++++++++ host/rootfs/image/usr/bin/vm-start-by-name | 9 +++++++++ host/rootfs/image/usr/bin/vm-stop-by-name | 9 +++++++++ 4 files changed, 30 insertions(+) diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce87f4685eda26382b4e0b0b6fd21025c7a..fd21034320a3de6f96a8eb229214b041612709e8 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -59,9 +59,12 @@ FILES = \ image/usr/bin/run-vmm \ image/usr/bin/spectrum-update \ image/usr/bin/vm-console \ + image/usr/bin/vm-console-by-name \ image/usr/bin/vm-import \ image/usr/bin/vm-start \ + image/usr/bin/vm-start-by-name \ image/usr/bin/vm-stop \ + image/usr/bin/vm-stop-by-name \ image/usr/bin/xdg-open \ image/usr/libexec/net-add \ image/usr/share/dbus-1/services/org.freedesktop.portal.Documents.service diff --git a/host/rootfs/image/usr/bin/vm-console-by-name b/host/rootfs/image/usr/bin/vm-console-by-name new file mode 100755 index 0000000000000000000000000000000000000000..a302b463ef1bd2c9ae180b6b2b9eae45a26856d6 --- /dev/null +++ b/host/rootfs/image/usr/bin/vm-console-by-name @@ -0,0 +1,9 @@ +#!/bin/execlineb -WS1 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +# SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi(a)alyssa.is> +backtick -E vm_id { + backtick -E id_path { readlink /run/vm/by-name/${1} } + basename -- $id_path +} +vm-console $vm_id diff --git a/host/rootfs/image/usr/bin/vm-start-by-name b/host/rootfs/image/usr/bin/vm-start-by-name new file mode 100755 index 0000000000000000000000000000000000000000..438a4a4610ddc9dea3394503e8d5e635468fbddd --- /dev/null +++ b/host/rootfs/image/usr/bin/vm-start-by-name @@ -0,0 +1,9 @@ +#!/bin/execlineb -WS1 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +# SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi(a)alyssa.is> +backtick -E vm_id { + backtick -E id_path { readlink /run/vm/by-name/${1} } + basename -- $id_path +} +vm-start $vm_id diff --git a/host/rootfs/image/usr/bin/vm-stop-by-name b/host/rootfs/image/usr/bin/vm-stop-by-name new file mode 100755 index 0000000000000000000000000000000000000000..07ca686b5ace86aceb0fdc0f9ace8ff3859f2b37 --- /dev/null +++ b/host/rootfs/image/usr/bin/vm-stop-by-name @@ -0,0 +1,9 @@ +#!/bin/execlineb -WS1 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +# SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi(a)alyssa.is> +backtick -E vm_id { + backtick -E id_path { readlink /run/vm/by-name/${1} } + basename -- $id_path +} +vm-stop $vm_id --- base-commit: a13d3403c1ddbb8dbbbdb05416350b2846162ed1 change-id: 20251201-vm-ops-by-name-6a5cb600f726 -- Sincerely, Demi Marie Obenour (she/her/hers)

1 0

[PATCH 01/13] pkgs: gtk3: backport fix for unset XDG_RUNTIME_DIR
by Alyssa Ross 02 Dec '25

02 Dec '25

As part of running services as different users we'll be giving services dedicated places to put their sockets, rather than a single shared directory they all need to be able to write to. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- pkgs/gtk3/default.nix | 13 +++++++++++++ pkgs/overlay.nix | 2 ++ 2 files changed, 15 insertions(+) create mode 100644 pkgs/gtk3/default.nix diff --git a/pkgs/gtk3/default.nix b/pkgs/gtk3/default.nix new file mode 100644 index 0000000..72445c9 --- /dev/null +++ b/pkgs/gtk3/default.nix @@ -0,0 +1,13 @@ +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> +# SPDX-License-Identifier: MIT + +import ../../lib/overlay-package.nix [ "gtk3" ] ({ final, super }: + +super.gtk3.overrideAttrs ({ patches ? [], ... }: { + patches = patches ++ [ + (final.fetchpatch { + url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/8569e206badbee1b27ff0e27316391b…"; + hash = "sha256-OdBhCGtz+3HS8LRhp+GCj3dL4pntybiI9b3A3kc5+OY="; + }) + ]; +})) diff --git a/pkgs/overlay.nix b/pkgs/overlay.nix index 0ca196c..0910bf3 100644 --- a/pkgs/overlay.nix +++ b/pkgs/overlay.nix @@ -4,5 +4,7 @@ (final: super: { cloud-hypervisor = import ./cloud-hypervisor { inherit final super; }; + gtk3 = import ./gtk3 { inherit final super; }; + skawarePackages = import ./skaware-packages { inherit final super; }; }) base-commit: c43e5c63a028994d5f66a15db19f415bf3cb7736 -- 2.51.0

3 30

[PATCH] host/rootfs: Add scripts to access a VM by name
by Demi Marie Obenour 01 Dec '25

01 Dec '25

This is much more convenient than having to find a VM's ID. In the future, the programs that take a VM ID should be the suffixed ones, but this change avoids having to change any tests and so is simpler. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/file-list.mk | 3 +++ host/rootfs/image/usr/bin/vm-console-by-name | 9 +++++++++ host/rootfs/image/usr/bin/vm-start-by-name | 9 +++++++++ host/rootfs/image/usr/bin/vm-stop-by-name | 9 +++++++++ 4 files changed, 30 insertions(+) diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce87f4685eda26382b4e0b0b6fd21025c7a..fd21034320a3de6f96a8eb229214b041612709e8 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -59,9 +59,12 @@ FILES = \ image/usr/bin/run-vmm \ image/usr/bin/spectrum-update \ image/usr/bin/vm-console \ + image/usr/bin/vm-console-by-name \ image/usr/bin/vm-import \ image/usr/bin/vm-start \ + image/usr/bin/vm-start-by-name \ image/usr/bin/vm-stop \ + image/usr/bin/vm-stop-by-name \ image/usr/bin/xdg-open \ image/usr/libexec/net-add \ image/usr/share/dbus-1/services/org.freedesktop.portal.Documents.service diff --git a/host/rootfs/image/usr/bin/vm-console-by-name b/host/rootfs/image/usr/bin/vm-console-by-name new file mode 100755 index 0000000000000000000000000000000000000000..a302b463ef1bd2c9ae180b6b2b9eae45a26856d6 --- /dev/null +++ b/host/rootfs/image/usr/bin/vm-console-by-name @@ -0,0 +1,9 @@ +#!/bin/execlineb -WS1 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +# SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi(a)alyssa.is> +backtick -E vm_id { + backtick -E id_path { readlink /run/vm/by-name/${1} } + basename -- $id_path +} +vm-console $vm_id diff --git a/host/rootfs/image/usr/bin/vm-start-by-name b/host/rootfs/image/usr/bin/vm-start-by-name new file mode 100755 index 0000000000000000000000000000000000000000..438a4a4610ddc9dea3394503e8d5e635468fbddd --- /dev/null +++ b/host/rootfs/image/usr/bin/vm-start-by-name @@ -0,0 +1,9 @@ +#!/bin/execlineb -WS1 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +# SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi(a)alyssa.is> +backtick -E vm_id { + backtick -E id_path { readlink /run/vm/by-name/${1} } + basename -- $id_path +} +vm-start $vm_id diff --git a/host/rootfs/image/usr/bin/vm-stop-by-name b/host/rootfs/image/usr/bin/vm-stop-by-name new file mode 100755 index 0000000000000000000000000000000000000000..07ca686b5ace86aceb0fdc0f9ace8ff3859f2b37 --- /dev/null +++ b/host/rootfs/image/usr/bin/vm-stop-by-name @@ -0,0 +1,9 @@ +#!/bin/execlineb -WS1 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +# SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi(a)alyssa.is> +backtick -E vm_id { + backtick -E id_path { readlink /run/vm/by-name/${1} } + basename -- $id_path +} +vm-stop $vm_id --- base-commit: 44f32b7a4b3cfbb4046447318e6753dd0eb71add change-id: 20251201-vm-ops-by-name-6a5cb600f726 -- Sincerely, Demi Marie Obenour (she/her/hers)

1 0

[PATCH v2 1/6] img/app: install fuse3 globally
by Alyssa Ross 01 Dec '25

01 Dec '25

AppImage (and in-development Flatpak) VMs complain about this being absent and portals don't work without it, even though Nix VMs work fine. I suppose it's a packaging difference. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v2: no change v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251201044534.977524… img/app/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/img/app/default.nix b/img/app/default.nix index 6490ac2..1eb3c9b 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -65,6 +65,7 @@ let pkgs.cacert pkgs.dejavu_fonts pkgs.execline + pkgs.fuse3 pkgs.kmod pkgs.mdevd pkgs.pipewire base-commit: a6d872aea26311a590e90dc08d59105a2165d80b -- 2.51.0

3 13

[PATCH 1/5] img/app: install fuse3 globally
by Alyssa Ross 01 Dec '25

01 Dec '25

AppImage (and in-development Flatpak) VMs complain about this being absent and portals don't work without it, even though Nix VMs work fine. I suppose it's a packaging difference. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- img/app/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/img/app/default.nix b/img/app/default.nix index 6490ac2..1eb3c9b 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -65,6 +65,7 @@ let pkgs.cacert pkgs.dejavu_fonts pkgs.execline + pkgs.fuse3 pkgs.kmod pkgs.mdevd pkgs.pipewire base-commit: cf131bd816a34095af34345f0e5f148c47268a04 -- 2.51.0

2 10

[REGRESSION] "Save link as…" in Firefox no longer works
by Alyssa Ross 01 Dec '25

01 Dec '25

I've been testing on the Krita downloads page (it's my normal way of testing running AppImages). No more portal save dialog, just nothing. 636a47c9243a8cf0387b6e2e4fbb7d8972e501f4 is the first bad commit commit 636a47c9243a8cf0387b6e2e4fbb7d8972e501f4 Author: Alyssa Ross <hi(a)alyssa.is> Date: Wed Sep 10 22:06:34 2025 +0200 lib/nixpkgs.default.nix: update to nixos-unstable-small Signed-off-by: Alyssa Ross <hi(a)alyssa.is> host/initramfs/default.nix | 3 ++- host/rootfs/default.nix | 2 +- img/app/default.nix | 2 +- lib/nixpkgs.default.nix | 4 ++-- vm/sys/net/default.nix | 2 +- 5 files changed, 7 insertions(+), 6 deletions(-) So needs a Nixpkgs bisection.

1 0

[PATCH 0/7] System updates based on systemd-sysupdate
by Demi Marie Obenour 30 Nov '25

30 Nov '25

This implements updates via systemd-sysupdate. See individual commit messages for details. There are major changes to the image build process. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Demi Marie Obenour (7): host/rootfs: Use full util-linux and systemd release/combined: Compress installation image tools: Add directory checker for updates Adjust partition layout to support updates release: add install step Factor out dm-verity build rules Support updates via systemd-sysupdate host/initramfs/Makefile | 17 ++-- host/initramfs/default.nix | 2 + host/initramfs/etc/init | 17 ++-- host/initramfs/etc/probe | 20 +++-- host/initramfs/shell.nix | 1 + host/rootfs/Makefile | 54 ++++++------- host/rootfs/default.nix | 64 +++++++-------- host/rootfs/file-list.mk | 5 ++ host/rootfs/image/etc/fstab | 1 + .../image/etc/sysupdate.d/50-verity.transfer | 21 +++++ host/rootfs/image/etc/sysupdate.d/60-root.transfer | 21 +++++ .../image/etc/sysupdate.d/70-kernel.transfer | 25 ++++++ host/rootfs/image/usr/bin/run-update | 54 +++++++++++++ host/rootfs/image/usr/bin/update | 56 +++++++++++++ host/rootfs/image/usr/bin/vm-start | 25 +++++- host/rootfs/os-release.in | 13 +++ host/rootfs/os-release.in.license | 2 + host/rootfs/shell.nix | 3 +- img/app/Makefile | 2 +- img/app/default.nix | 5 +- lib/kcmdline-utils.mk | 8 ++ lib/verity.mk | 18 +++++ lib/version.nix | 15 ++++ release/checks/integration/default.nix | 2 +- release/checks/integration/meson.build | 2 +- release/checks/no-roothash.nix | 2 +- release/combined/eosimages.nix | 16 ++-- release/live/Makefile | 46 +++++------ release/live/default.nix | 17 ++-- release/live/shell.nix | 4 +- scripts/format-uuid.awk | 35 ++++++++ scripts/format-uuid.sh | 1 + scripts/make-gpt.bash | 72 +++++++++++++++++ scripts/make-gpt.sh | 67 +-------------- scripts/make-live-image.sh | 41 ++++++++++ scripts/sfdisk-field.awk | 3 +- tools/default.nix | 1 + tools/meson.build | 1 + tools/updates-dir-check/meson.build | 4 + tools/updates-dir-check/updates-dir-check.c | 94 ++++++++++++++++++++++ update-signing-keys.gpg | 1 + update-signing-keys.gpg.license | 2 + update-url | 1 + update-url.license | 2 + version | 1 + version.license | 2 + vm/app/sysupdate.d/50-verity.transfer | 18 +++++ vm/app/sysupdate.d/60-root.transfer | 18 +++++ vm/app/sysupdate.d/70-kernel.transfer | 18 +++++ vm/app/updates.nix | 57 +++++++++++++ vm/sys/net/Makefile | 2 +- vm/sys/net/default.nix | 5 +- 52 files changed, 782 insertions(+), 202 deletions(-) --- base-commit: 11c411139e006ddf6ce074c22c30a0bb9b6fb76e change-id: 20250928-updates-92e99849e231 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 176

[PATCH v3 1/3] tools/mount-flatpak: init
by Alyssa Ross 30 Nov '25

30 Nov '25

I tried to build this with Meson, but pathrs depends on thiserror, which tries to read OUT_DIR, and support for setting that isn't currently in a Meson release, and requires nightly Rust, so build with Cargo for now and we can revisit that later. Link: https://github.com/mesonbuild/meson/pull/15148 Link: https://github.com/rust-lang/rust/issues/118372 Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v3: Take the user data partition root and path to the Flatpak repository within it as separate parameters, to avoid calling Root::open() on an untrusted path. Suggested by Demi out of band. v2: https://spectrum-os.org/lists/archives/spectrum-devel/20251124194846.16338-… LICENSES/MPL-2.0.txt | 373 +++++++++++++++++++++++++ pkgs/default.nix | 1 + tools/mount-flatpak/Cargo.lock | 238 ++++++++++++++++ tools/mount-flatpak/Cargo.lock.license | 2 + tools/mount-flatpak/Cargo.toml | 11 + tools/mount-flatpak/config | 7 + tools/mount-flatpak/default.nix | 25 ++ tools/mount-flatpak/src/keyfile.rs | 189 +++++++++++++ tools/mount-flatpak/src/main.rs | 252 +++++++++++++++++ tools/mount-flatpak/src/metadata.rs | 19 ++ 10 files changed, 1117 insertions(+) create mode 100644 LICENSES/MPL-2.0.txt create mode 100644 tools/mount-flatpak/Cargo.lock create mode 100644 tools/mount-flatpak/Cargo.lock.license create mode 100644 tools/mount-flatpak/Cargo.toml create mode 100644 tools/mount-flatpak/config create mode 100644 tools/mount-flatpak/default.nix create mode 100644 tools/mount-flatpak/src/keyfile.rs create mode 100644 tools/mount-flatpak/src/main.rs create mode 100644 tools/mount-flatpak/src/metadata.rs diff --git a/LICENSES/MPL-2.0.txt b/LICENSES/MPL-2.0.txt new file mode 100644 index 0000000..d0a1fa1 --- /dev/null +++ b/LICENSES/MPL-2.0.txt @@ -0,0 +1,373 @@ +Mozilla Public License Version 2.0 +================================== + +1. Definitions +-------------- + +1.1. "Contributor" + means each individual or legal entity that creates, contributes to + the creation of, or owns Covered Software. + +1.2. "Contributor Version" + means the combination of the Contributions of others (if any) used + by a Contributor and that particular Contributor's Contribution. + +1.3. "Contribution" + means Covered Software of a particular Contributor. + +1.4. "Covered Software" + means Source Code Form to which the initial Contributor has attached + the notice in Exhibit A, the Executable Form of such Source Code + Form, and Modifications of such Source Code Form, in each case + including portions thereof. + +1.5. "Incompatible With Secondary Licenses" + means + + (a) that the initial Contributor has attached the notice described + in Exhibit B to the Covered Software; or + + (b) that the Covered Software was made available under the terms of + version 1.1 or earlier of the License, but not also under the + terms of a Secondary License. + +1.6. "Executable Form" + means any form of the work other than Source Code Form. + +1.7. "Larger Work" + means a work that combines Covered Software with other material, in + a separate file or files, that is not Covered Software. + +1.8. "License" + means this document. + +1.9. "Licensable" + means having the right to grant, to the maximum extent possible, + whether at the time of the initial grant or subsequently, any and + all of the rights conveyed by this License. + +1.10. "Modifications" + means any of the following: + + (a) any file in Source Code Form that results from an addition to, + deletion from, or modification of the contents of Covered + Software; or + + (b) any new file in Source Code Form that contains any Covered + Software. + +1.11. "Patent Claims" of a Contributor + means any patent claim(s), including without limitation, method, + process, and apparatus claims, in any patent Licensable by such + Contributor that would be infringed, but for the grant of the + License, by the making, using, selling, offering for sale, having + made, import, or transfer of either its Contributions or its + Contributor Version. + +1.12. "Secondary License" + means either the GNU General Public License, Version 2.0, the GNU + Lesser General Public License, Version 2.1, the GNU Affero General + Public License, Version 3.0, or any later versions of those + licenses. + +1.13. "Source Code Form" + means the form of the work preferred for making modifications. + +1.14. "You" (or "Your") + means an individual or a legal entity exercising rights under this + License. For legal entities, "You" includes any entity that + controls, is controlled by, or is under common control with You. For + purposes of this definition, "control" means (a) the power, direct + or indirect, to cause the direction or management of such entity, + whether by contract or otherwise, or (b) ownership of more than + fifty percent (50%) of the outstanding shares or beneficial + ownership of such entity. + +2. License Grants and Conditions +-------------------------------- + +2.1. Grants + +Each Contributor hereby grants You a world-wide, royalty-free, +non-exclusive license: + +(a) under intellectual property rights (other than patent or trademark) + Licensable by such Contributor to use, reproduce, make available, + modify, display, perform, distribute, and otherwise exploit its + Contributions, either on an unmodified basis, with Modifications, or + as part of a Larger Work; and + +(b) under Patent Claims of such Contributor to make, use, sell, offer + for sale, have made, import, and otherwise transfer either its + Contributions or its Contributor Version. + +2.2. Effective Date + +The licenses granted in Section 2.1 with respect to any Contribution +become effective for each Contribution on the date the Contributor first +distributes such Contribution. + +2.3. Limitations on Grant Scope + +The licenses granted in this Section 2 are the only rights granted under +this License. No additional rights or licenses will be implied from the +distribution or licensing of Covered Software under this License. +Notwithstanding Section 2.1(b) above, no patent license is granted by a +Contributor: + +(a) for any code that a Contributor has removed from Covered Software; + or + +(b) for infringements caused by: (i) Your and any other third party's + modifications of Covered Software, or (ii) the combination of its + Contributions with other software (except as part of its Contributor + Version); or + +(c) under Patent Claims infringed by Covered Software in the absence of + its Contributions. + +This License does not grant any rights in the trademarks, service marks, +or logos of any Contributor (except as may be necessary to comply with +the notice requirements in Section 3.4). + +2.4. Subsequent Licenses + +No Contributor makes additional grants as a result of Your choice to +distribute the Covered Software under a subsequent version of this +License (see Section 10.2) or under the terms of a Secondary License (if +permitted under the terms of Section 3.3). + +2.5. Representation + +Each Contributor represents that the Contributor believes its +Contributions are its original creation(s) or it has sufficient rights +to grant the rights to its Contributions conveyed by this License. + +2.6. Fair Use + +This License is not intended to limit any rights You have under +applicable copyright doctrines of fair use, fair dealing, or other +equivalents. + +2.7. Conditions + +Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted +in Section 2.1. + +3. Responsibilities +------------------- + +3.1. Distribution of Source Form + +All distribution of Covered Software in Source Code Form, including any +Modifications that You create or to which You contribute, must be under +the terms of this License. You must inform recipients that the Source +Code Form of the Covered Software is governed by the terms of this +License, and how they can obtain a copy of this License. You may not +attempt to alter or restrict the recipients' rights in the Source Code +Form. + +3.2. Distribution of Executable Form + +If You distribute Covered Software in Executable Form then: + +(a) such Covered Software must also be made available in Source Code + Form, as described in Section 3.1, and You must inform recipients of + the Executable Form how they can obtain a copy of such Source Code + Form by reasonable means in a timely manner, at a charge no more + than the cost of distribution to the recipient; and + +(b) You may distribute such Executable Form under the terms of this + License, or sublicense it under different terms, provided that the + license for the Executable Form does not attempt to limit or alter + the recipients' rights in the Source Code Form under this License. + +3.3. Distribution of a Larger Work + +You may create and distribute a Larger Work under terms of Your choice, +provided that You also comply with the requirements of this License for +the Covered Software. If the Larger Work is a combination of Covered +Software with a work governed by one or more Secondary Licenses, and the +Covered Software is not Incompatible With Secondary Licenses, this +License permits You to additionally distribute such Covered Software +under the terms of such Secondary License(s), so that the recipient of +the Larger Work may, at their option, further distribute the Covered +Software under the terms of either this License or such Secondary +License(s). + +3.4. Notices + +You may not remove or alter the substance of any license notices +(including copyright notices, patent notices, disclaimers of warranty, +or limitations of liability) contained within the Source Code Form of +the Covered Software, except that You may alter any license notices to +the extent required to remedy known factual inaccuracies. + +3.5. Application of Additional Terms + +You may choose to offer, and to charge a fee for, warranty, support, +indemnity or liability obligations to one or more recipients of Covered +Software. However, You may do so only on Your own behalf, and not on +behalf of any Contributor. You must make it absolutely clear that any +such warranty, support, indemnity, or liability obligation is offered by +You alone, and You hereby agree to indemnify every Contributor for any +liability incurred by such Contributor as a result of warranty, support, +indemnity or liability terms You offer. You may include additional +disclaimers of warranty and limitations of liability specific to any +jurisdiction. + +4. Inability to Comply Due to Statute or Regulation +--------------------------------------------------- + +If it is impossible for You to comply with any of the terms of this +License with respect to some or all of the Covered Software due to +statute, judicial order, or regulation then You must: (a) comply with +the terms of this License to the maximum extent possible; and (b) +describe the limitations and the code they affect. Such description must +be placed in a text file included with all distributions of the Covered +Software under this License. Except to the extent prohibited by statute +or regulation, such description must be sufficiently detailed for a +recipient of ordinary skill to be able to understand it. + +5. Termination +-------------- + +5.1. The rights granted under this License will terminate automatically +if You fail to comply with any of its terms. However, if You become +compliant, then the rights granted under this License from a particular +Contributor are reinstated (a) provisionally, unless and until such +Contributor explicitly and finally terminates Your grants, and (b) on an +ongoing basis, if such Contributor fails to notify You of the +non-compliance by some reasonable means prior to 60 days after You have +come back into compliance. Moreover, Your grants from a particular +Contributor are reinstated on an ongoing basis if such Contributor +notifies You of the non-compliance by some reasonable means, this is the +first time You have received notice of non-compliance with this License +from such Contributor, and You become compliant prior to 30 days after +Your receipt of the notice. + +5.2. If You initiate litigation against any entity by asserting a patent +infringement claim (excluding declaratory judgment actions, +counter-claims, and cross-claims) alleging that a Contributor Version +directly or indirectly infringes any patent, then the rights granted to +You by any and all Contributors for the Covered Software under Section +2.1 of this License shall terminate. + +5.3. In the event of termination under Sections 5.1 or 5.2 above, all +end user license agreements (excluding distributors and resellers) which +have been validly granted by You or Your distributors under this License +prior to termination shall survive termination. + +************************************************************************ +* * +* 6. Disclaimer of Warranty * +* ------------------------- * +* * +* Covered Software is provided under this License on an "as is" * +* basis, without warranty of any kind, either expressed, implied, or * +* statutory, including, without limitation, warranties that the * +* Covered Software is free of defects, merchantable, fit for a * +* particular purpose or non-infringing. The entire risk as to the * +* quality and performance of the Covered Software is with You. * +* Should any Covered Software prove defective in any respect, You * +* (not any Contributor) assume the cost of any necessary servicing, * +* repair, or correction. This disclaimer of warranty constitutes an * +* essential part of this License. No use of any Covered Software is * +* authorized under this License except under this disclaimer. * +* * +************************************************************************ + +************************************************************************ +* * +* 7. Limitation of Liability * +* -------------------------- * +* * +* Under no circumstances and under no legal theory, whether tort * +* (including negligence), contract, or otherwise, shall any * +* Contributor, or anyone who distributes Covered Software as * +* permitted above, be liable to You for any direct, indirect, * +* special, incidental, or consequential damages of any character * +* including, without limitation, damages for lost profits, loss of * +* goodwill, work stoppage, computer failure or malfunction, or any * +* and all other commercial damages or losses, even if such party * +* shall have been informed of the possibility of such damages. This * +* limitation of liability shall not apply to liability for death or * +* personal injury resulting from such party's negligence to the * +* extent applicable law prohibits such limitation. Some * +* jurisdictions do not allow the exclusion or limitation of * +* incidental or consequential damages, so this exclusion and * +* limitation may not apply to You. * +* * +************************************************************************ + +8. Litigation +------------- + +Any litigation relating to this License may be brought only in the +courts of a jurisdiction where the defendant maintains its principal +place of business and such litigation shall be governed by laws of that +jurisdiction, without reference to its conflict-of-law provisions. +Nothing in this Section shall prevent a party's ability to bring +cross-claims or counter-claims. + +9. Miscellaneous +---------------- + +This License represents the complete agreement concerning the subject +matter hereof. If any provision of this License is held to be +unenforceable, such provision shall be reformed only to the extent +necessary to make it enforceable. Any law or regulation which provides +that the language of a contract shall be construed against the drafter +shall not be used to construe this License against a Contributor. + +10. Versions of the License +--------------------------- + +10.1. New Versions + +Mozilla Foundation is the license steward. Except as provided in Section +10.3, no one other than the license steward has the right to modify or +publish new versions of this License. Each version will be given a +distinguishing version number. + +10.2. Effect of New Versions + +You may distribute the Covered Software under the terms of the version +of the License under which You originally received the Covered Software, +or under the terms of any subsequent version published by the license +steward. + +10.3. Modified Versions + +If you create software not governed by this License, and you want to +create a new license for such software, you may create and use a +modified version of this License if you rename the license and remove +any references to the name of the license steward (except to note that +such modified license differs from this License). + +10.4. Distributing Source Code Form that is Incompatible With Secondary +Licenses + +If You choose to distribute Source Code Form that is Incompatible With +Secondary Licenses under the terms of this version of the License, the +notice described in Exhibit B of this License must be attached. + +Exhibit A - Source Code Form License Notice +------------------------------------------- + + This Source Code Form is subject to the terms of the Mozilla Public + License, v. 2.0. If a copy of the MPL was not distributed with this + file, You can obtain one at https://mozilla.org/MPL/2.0/. + +If it is not possible or desirable to put the notice in a particular +file, then You may include the notice in a location (such as a LICENSE +file in a relevant directory) where a recipient would be likely to look +for such a notice. + +You may add additional accurate notices of copyright ownership. + +Exhibit B - "Incompatible With Secondary Licenses" Notice +--------------------------------------------------------- + + This Source Code Form is "Incompatible With Secondary Licenses", as + defined by the Mozilla Public License, v. 2.0. diff --git a/pkgs/default.nix b/pkgs/default.nix index cc60228..6829185 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -36,6 +36,7 @@ let path: (import path { inherit (self) callPackage; }).override; rootfs = self.callSpectrumPackage ../host/rootfs {}; + mount-flatpak = self.callSpectrumPackage ../tools/mount-flatpak {}; spectrum-build-tools = self.callSpectrumPackage ../tools { appSupport = false; buildSupport = true; diff --git a/tools/mount-flatpak/Cargo.lock b/tools/mount-flatpak/Cargo.lock new file mode 100644 index 0000000..8cb5663 --- /dev/null +++ b/tools/mount-flatpak/Cargo.lock @@ -0,0 +1,238 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 4 + +[[package]] +name = "bitflags" +version = "2.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3" + +[[package]] +name = "cfg-if" +version = "1.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" + +[[package]] +name = "either" +version = "1.15.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719" + +[[package]] +name = "errno" +version = "0.3.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" +dependencies = [ + "libc", + "windows-sys", +] + +[[package]] +name = "fastrand" +version = "2.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be" + +[[package]] +name = "getrandom" +version = "0.3.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" +dependencies = [ + "cfg-if", + "libc", + "r-efi", + "wasip2", +] + +[[package]] +name = "itertools" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285" +dependencies = [ + "either", +] + +[[package]] +name = "libc" +version = "0.2.177" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976" + +[[package]] +name = "linux-raw-sys" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039" + +[[package]] +name = "memchr" +version = "2.7.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273" + +[[package]] +name = "mount-flatpak" +version = "0.0.0" +dependencies = [ + "libc", + "pathrs", + "rustix", +] + +[[package]] +name = "once_cell" +version = "1.21.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" + +[[package]] +name = "pathrs" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c63f58f2463b3eecc7d285eace144d8c4820631d018d927049f8569be4b3b1a4" +dependencies = [ + "bitflags", + "itertools", + "libc", + "memchr", + "once_cell", + "rustix", + "rustversion", + "static_assertions", + "tempfile", + "thiserror", +] + +[[package]] +name = "proc-macro2" +version = "1.0.103" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8" +dependencies = [ + "unicode-ident", +] + +[[package]] +name = "quote" +version = "1.0.42" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f" +dependencies = [ + "proc-macro2", +] + +[[package]] +name = "r-efi" +version = "5.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f" + +[[package]] +name = "rustix" +version = "1.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e" +dependencies = [ + "bitflags", + "errno", + "libc", + "linux-raw-sys", + "windows-sys", +] + +[[package]] +name = "rustversion" +version = "1.0.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" + +[[package]] +name = "static_assertions" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f" + +[[package]] +name = "syn" +version = "2.0.111" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "390cc9a294ab71bdb1aa2e99d13be9c753cd2d7bd6560c77118597410c4d2e87" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + +[[package]] +name = "tempfile" +version = "3.23.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16" +dependencies = [ + "fastrand", + "getrandom", + "once_cell", + "rustix", + "windows-sys", +] + +[[package]] +name = "thiserror" +version = "2.0.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8" +dependencies = [ + "thiserror-impl", +] + +[[package]] +name = "thiserror-impl" +version = "2.0.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + +[[package]] +name = "unicode-ident" +version = "1.0.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5" + +[[package]] +name = "wasip2" +version = "1.0.1+wasi-0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7" +dependencies = [ + "wit-bindgen", +] + +[[package]] +name = "windows-link" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5" + +[[package]] +name = "windows-sys" +version = "0.61.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc" +dependencies = [ + "windows-link", +] + +[[package]] +name = "wit-bindgen" +version = "0.46.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59" diff --git a/tools/mount-flatpak/Cargo.lock.license b/tools/mount-flatpak/Cargo.lock.license new file mode 100644 index 0000000..d705e97 --- /dev/null +++ b/tools/mount-flatpak/Cargo.lock.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2024 Alyssa Ross <hi(a)alyssa.is> diff --git a/tools/mount-flatpak/Cargo.toml b/tools/mount-flatpak/Cargo.toml new file mode 100644 index 0000000..670be2f --- /dev/null +++ b/tools/mount-flatpak/Cargo.toml @@ -0,0 +1,11 @@ +# SPDX-License-Identifier: CC0-1.0 +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +[package] +name = "mount-flatpak" +edition = "2024" + +[dependencies] +libc = "0.2.177" +pathrs = "0.2.1" +rustix = "1.1.2" diff --git a/tools/mount-flatpak/config b/tools/mount-flatpak/config new file mode 100644 index 0000000..b3c2bee --- /dev/null +++ b/tools/mount-flatpak/config @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: CC0-1.0 +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +[core] +repo_version=1 +mode=bare-user-only +min-free-space-size=500MB diff --git a/tools/mount-flatpak/default.nix b/tools/mount-flatpak/default.nix new file mode 100644 index 0000000..f364fd7 --- /dev/null +++ b/tools/mount-flatpak/default.nix @@ -0,0 +1,25 @@ +# SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> +# SPDX-License-Identifier: MIT + +import ../../lib/call-package.nix ( +{ src, lib, rustPlatform }: + +rustPlatform.buildRustPackage { + name = "mount-flatpak"; + + src = lib.fileset.toSource { + root = ../..; + fileset = lib.fileset.intersection src ./.; + }; + sourceRoot = "source/tools/mount-flatpak"; + + cargoLock.lockFile = ./Cargo.lock; + + env = { + MOUNT_FLATPAK_CONFIG_PATH = "${placeholder "out"}/share/spectrum/flatpak-config"; + }; + + postInstall = '' + install -Dm 0755 config $MOUNT_FLATPAK_CONFIG_PATH + ''; +}) (_: {}) diff --git a/tools/mount-flatpak/src/keyfile.rs b/tools/mount-flatpak/src/keyfile.rs new file mode 100644 index 0000000..fa746b3 --- /dev/null +++ b/tools/mount-flatpak/src/keyfile.rs @@ -0,0 +1,189 @@ +// Copyright 2021 System76 <info(a)system76.com> +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> +// SPDX-License-Identifier: MPL-2.0 + +// Adapted from freedesktop-desktop-entry 0.7.19. + +use std::collections::BTreeMap; +use std::fmt::{self, Display, Formatter}; + +type Group = BTreeMap<String, String>; + +#[derive(Debug)] +pub enum DecodeError { + KeyValueWithoutAGroup, + InvalidKey, + InvalidValue, +} + +impl Display for DecodeError { + fn fmt(&self, f: &mut Formatter) -> fmt::Result { + match self { + Self::KeyValueWithoutAGroup => write!(f, "key/value without a group"), + Self::InvalidKey => write!(f, "invalid key"), + Self::InvalidValue => write!(f, "invalid value"), + } + } +} + +pub fn parse(input: &str) -> Result<BTreeMap<String, Group>, DecodeError> { + let mut groups = BTreeMap::default(); + let mut active_group: Option<ActiveGroup> = None; + let mut active_keys: Option<ActiveKeys> = None; + + for line in input.lines() { + process_line(line, &mut groups, &mut active_group, &mut active_keys)?; + } + + if let Some(active_keys) = active_keys.take() { + match &mut active_group { + Some(active_group) => { + active_group + .group + .insert(active_keys.key_name, active_keys.value); + } + None => return Err(DecodeError::KeyValueWithoutAGroup), + } + } + + if let Some(mut group) = active_group.take() { + groups + .entry(group.group_name) + .or_default() + .append(&mut group.group); + } + + Ok(groups) +} + +struct ActiveGroup { + group_name: String, + group: Group, +} + +struct ActiveKeys { + key_name: String, + value: String, +} + +#[inline(never)] +fn process_line( + line: &str, + groups: &mut BTreeMap<String, Group>, + active_group: &mut Option<ActiveGroup>, + active_keys: &mut Option<ActiveKeys>, +) -> Result<(), DecodeError> { + if line.trim().is_empty() || line.starts_with('#') { + return Ok(()); + } + + let line_bytes = line.as_bytes(); + + // if group + if line_bytes[0] == b'[' { + if let Some(end) = line_bytes[1..].iter().rposition(|&b| b == b']') { + let group_name = &line[1..end + 1]; + + if let Some(active_keys) = active_keys.take() { + match active_group { + Some(active_group) => { + active_group + .group + .insert(active_keys.key_name, active_keys.value); + } + None => return Err(DecodeError::KeyValueWithoutAGroup), + } + } + + if let Some(mut group) = active_group.take() { + groups + .entry(group.group_name) + .or_default() + .append(&mut group.group); + } + + active_group.replace(ActiveGroup { + group_name: group_name.to_string(), + group: Group::default(), + }); + } + } + // else, if value + else if let Some(delimiter) = line_bytes.iter().position(|&b| b == b'=') { + let key = &line[..delimiter]; + let value = format_value(&line[delimiter + 1..])?; + + if key.is_empty() { + return Err(DecodeError::InvalidKey); + } + + if let Some(active_keys) = active_keys.take() { + match active_group { + Some(active_group) => { + active_group + .group + .insert(active_keys.key_name, active_keys.value); + } + None => return Err(DecodeError::KeyValueWithoutAGroup), + } + } + active_keys.replace(ActiveKeys { + key_name: key.trim().to_string(), + value, + }); + } + Ok(()) +} + +// https://specifications.freedesktop.org/desktop-entry-spec/latest/value-type… +#[inline] +fn format_value(input: &str) -> Result<String, DecodeError> { + let input = if let Some(input) = input.strip_prefix(" ") { + input + } else { + input + }; + + let mut res = String::with_capacity(input.len()); + + let mut last: usize = 0; + + for (i, v) in input.as_bytes().iter().enumerate() { + if *v != b'\\' { + continue; + } + + // edge case for // + if last > i { + continue; + } + + // when there is an \ at the end + if input.len() <= i + 1 { + return Err(DecodeError::InvalidValue); + } + + if last < i { + res.push_str(&input[last..i]); + } + + last = i + 2; + + match input.as_bytes()[i + 1] { + b's' => res.push(' '), + b'n' => res.push('\n'), + b't' => res.push('\t'), + b'r' => res.push('\r'), + b'\\' => res.push('\\'), + _ => { + return Err(DecodeError::InvalidValue); + } + } + } + + if last < input.len() { + res.push_str(&input[last..input.len()]); + } + + Ok(res) +} diff --git a/tools/mount-flatpak/src/main.rs b/tools/mount-flatpak/src/main.rs new file mode 100644 index 0000000..fd2f74f --- /dev/null +++ b/tools/mount-flatpak/src/main.rs @@ -0,0 +1,252 @@ +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> +// SPDX-License-Identifier: EUPL-1.2+ + +mod keyfile; +mod metadata; + +use std::borrow::Cow; +use std::env::{ArgsOs, args_os}; +use std::ffi::OsStr; +use std::io; +use std::os::unix::prelude::*; +use std::path::{Path, PathBuf}; +use std::process::exit; + +use pathrs::Root; +use pathrs::flags::{OpenFlags, ResolverFlags}; +use rustix::fs::{CWD, FileType, fstat}; +use rustix::mount::{MoveMountFlags, OpenTreeFlags, move_mount, open_tree}; + +use metadata::extract_runtime; + +fn ex_usage() -> ! { + eprintln!("Usage: mount-flatpak installation app"); + exit(1); +} + +fn run(mut args: ArgsOs) -> Result<(), String> { + let Some(user_data_path) = args.next().map(PathBuf::from) else { + ex_usage(); + }; + let Some(installation_path) = args.next().map(PathBuf::from) else { + ex_usage(); + }; + let Some(app) = args.next() else { + ex_usage(); + }; + if args.next().is_some() { + ex_usage(); + } + + let mut source_installation_dir = Root::open(&user_data_path) + .map_err(|e| format!("opening source flatpak installation: {e}"))?; + source_installation_dir.set_resolver_flags(ResolverFlags::NO_SYMLINKS); + + std::fs::create_dir("flatpak") + .map_err(|e| format!("creating target flatpak installation: {e}"))?; + + let target_installation_dir = open_tree( + CWD, + "flatpak", + OpenTreeFlags::OPEN_TREE_CLONE + | OpenTreeFlags::OPEN_TREE_CLOEXEC + | OpenTreeFlags::AT_RECURSIVE, + ) + .map_err(|e| format!("opening target flatpak installation: {e}"))?; + let mut target_installation_dir = Root::from_fd(target_installation_dir); + target_installation_dir.set_resolver_flags(ResolverFlags::NO_SYMLINKS); + + let mut full_app_path = installation_path.join("app"); + full_app_path.push(&app); + full_app_path.push("current"); + let arch_and_branch = source_installation_dir + .readlink(&full_app_path) + .map_err(|e| format!("reading current app arch and branch: {e}"))?; + let mut components = arch_and_branch.components(); + let arch = components.next().unwrap().as_os_str(); + let branch = components.as_path().as_os_str(); + if branch.is_empty() { + return Err("can't infer branch from \"current\" link".to_string()); + } + + full_app_path.pop(); + full_app_path.push(&arch_and_branch); + full_app_path.push("active"); + let commit = source_installation_dir + .readlink(&full_app_path) + .map_err(|e| format!("reading active app commit: {e}"))? + .into_os_string(); + + full_app_path.pop(); + full_app_path.push(&commit); + let source_app_dir = source_installation_dir + .resolve(&full_app_path) + .map_err(|e| format!("opening source app directory: {e}"))?; + + let metadata = source_installation_dir + .resolve(full_app_path.join("metadata")) + .map_err(|e| format!("resolving app metadata: {e}"))?; + + let metadata_stat = + fstat(&metadata).map_err(|e| format!("checking app metadata is a regular file: {e}"))?; + let metadata_type = FileType::from_raw_mode(metadata_stat.st_mode); + if !metadata_type.is_file() { + let e = format!("type of app metadata is {metadata_type:?}, not RegularFile"); + return Err(e); + } + let metadata = metadata + .reopen(OpenFlags::O_RDONLY) + .map_err(|e| format!("opening app metadata: {e}"))?; + + let runtime = + extract_runtime(metadata).map_err(|e| format!("reading runtime from metadata: {e}"))?; + + let mut full_runtime_path = installation_path.join("runtime"); + full_runtime_path.push(runtime); + full_runtime_path.push("active"); + let runtime_commit = source_installation_dir + .readlink(&full_runtime_path) + .map_err(|e| format!("reading active runtime commit: {e}"))? + .into_os_string(); + + full_runtime_path.pop(); + full_runtime_path.push(&runtime_commit); + let source_runtime_dir = source_installation_dir + .resolve(&full_runtime_path) + .map_err(|e| format!("opening source runtime directory: {e}"))?; + + let target_app_dir = target_installation_dir + .mkdir_all(&full_app_path, &PermissionsExt::from_mode(0o700)) + .map_err(|e| format!("creating target app directory: {e}"))?; + let target_runtime_dir = target_installation_dir + .mkdir_all(&full_runtime_path, &PermissionsExt::from_mode(0o700)) + .map_err(|e| format!("creating target runtime directory: {e}"))?; + + let source_app_tree = open_tree( + &source_app_dir, + "", + OpenTreeFlags::AT_EMPTY_PATH + | OpenTreeFlags::OPEN_TREE_CLONE + | OpenTreeFlags::OPEN_TREE_CLOEXEC + | OpenTreeFlags::AT_RECURSIVE, + ) + .map_err(|e| format!("cloning source app tree: {e}"))?; + let source_runtime_tree = open_tree( + &source_runtime_dir, + "", + OpenTreeFlags::AT_EMPTY_PATH + | OpenTreeFlags::OPEN_TREE_CLONE + | OpenTreeFlags::OPEN_TREE_CLOEXEC + | OpenTreeFlags::AT_RECURSIVE, + ) + .map_err(|e| format!("cloning source runtime tree: {e}"))?; + + move_mount( + source_app_tree, + "", + target_app_dir, + "", + MoveMountFlags::MOVE_MOUNT_F_EMPTY_PATH | MoveMountFlags::MOVE_MOUNT_T_EMPTY_PATH, + ) + .map_err(|e| format!("mounting app directory: {e}"))?; + move_mount( + source_runtime_tree, + "", + target_runtime_dir, + "", + MoveMountFlags::MOVE_MOUNT_F_EMPTY_PATH | MoveMountFlags::MOVE_MOUNT_T_EMPTY_PATH, + ) + .map_err(|e| format!("mounting runtime directory: {e}"))?; + + target_installation_dir + .mkdir_all("repo/objects", &PermissionsExt::from_mode(0o700)) + .map_err(|e| format!("creating repo/objects: {e}"))?; + target_installation_dir + .mkdir_all("repo/tmp/cache", &PermissionsExt::from_mode(0o700)) + .map_err(|e| format!("creating repo/tmp/cache: {e}"))?; + let config_target = target_installation_dir + .create_file( + "repo/config", + OpenFlags::O_WRONLY | OpenFlags::O_CLOEXEC, + &PermissionsExt::from_mode(0o700), + ) + .map_err(|e| format!("creating repo/config: {e}"))?; + let config_source_path = env!("MOUNT_FLATPAK_CONFIG_PATH"); + let config_source = open_tree( + CWD, + config_source_path, + OpenTreeFlags::OPEN_TREE_CLONE | OpenTreeFlags::OPEN_TREE_CLOEXEC, + ) + .map_err(|e| format!("opening {config_source_path}: {e}"))?; + move_mount( + config_source, + "", + config_target, + "", + MoveMountFlags::MOVE_MOUNT_F_EMPTY_PATH | MoveMountFlags::MOVE_MOUNT_T_EMPTY_PATH, + ) + .map_err(|e| format!("mounting config: {e}"))?; + + let mut attr = libc::mount_attr { + attr_clr: libc::MOUNT_ATTR_NOSYMFOLLOW, + attr_set: libc::MOUNT_ATTR_RDONLY | libc::MOUNT_ATTR_NODEV, + propagation: 0, + userns_fd: 0, + }; + let empty = b"\0"; + // SAFETY: we pass a valid FD, and a valid mutable pointer with the correct size. + unsafe { + let r = libc::syscall( + libc::SYS_mount_setattr, + target_installation_dir.as_fd(), + empty.as_ptr() as *const libc::c_char, + (libc::AT_EMPTY_PATH | libc::AT_RECURSIVE) as libc::c_uint, + &mut attr as *mut libc::mount_attr, + size_of::<libc::mount_attr>() as libc::size_t, + ); + if r == -1 { + return Err(format!( + "setting target mount attributes: {}", + io::Error::last_os_error() + )); + } + } + move_mount( + target_installation_dir, + "", + CWD, + "flatpak", + MoveMountFlags::MOVE_MOUNT_F_EMPTY_PATH, + ) + .map_err(|e| format!("mounting target installation dir: {e}"))?; + + std::fs::create_dir("params").map_err(|e| format!("creating params directory: {e}"))?; + std::fs::write("params/id", app.as_bytes()).map_err(|e| format!("writing params/id: {e}"))?; + std::fs::write("params/commit", commit.as_bytes()) + .map_err(|e| format!("writing params/commit: {e}"))?; + std::fs::write("params/arch", arch.as_bytes()) + .map_err(|e| format!("writing params/arch: {e}"))?; + std::fs::write("params/branch", branch.as_bytes()) + .map_err(|e| format!("writing params/branch: {e}"))?; + std::fs::write("params/runtime-commit", runtime_commit.as_bytes()) + .map_err(|e| format!("writing params/runtime-commit: {e}"))?; + + Ok(()) +} + +fn main() { + let mut args = args_os(); + + let prog_name = args + .next() + .as_ref() + .map(Path::new) + .and_then(Path::file_name) + .map_or(Cow::Borrowed("mount-flatpak"), OsStr::to_string_lossy) + .into_owned(); + + if let Err(e) = run(args) { + eprintln!("{prog_name}: {e}"); + exit(1); + } +} diff --git a/tools/mount-flatpak/src/metadata.rs b/tools/mount-flatpak/src/metadata.rs new file mode 100644 index 0000000..dfc05b1 --- /dev/null +++ b/tools/mount-flatpak/src/metadata.rs @@ -0,0 +1,19 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +use std::fs::File; +use std::io::read_to_string; + +use crate::keyfile::parse; + +pub fn extract_runtime(mut metadata: File) -> Result<String, String> { + let metadata = read_to_string(&mut metadata).map_err(|e| e.to_string())?; + let group = parse(&metadata).map_err(|e| e.to_string())?; + let application = group + .get("Application") + .ok_or_else(|| "Application group missing".to_string())?; + Ok(application + .get("runtime") + .ok_or_else(|| "runtime property missing".to_string())? + .clone()) +} base-commit: 4200cea7eb31f5b8d35bf4c00b879aa25cf1fb90 -- 2.51.0

2 6

[PATCH v4 00/10] spectrum-router
by Yureka Lilian 30 Nov '25

30 Nov '25

Just a few tiny things I forgot in the last series. Changes since v3: - Remove leftover c-lib target from start-vmm meson.build - Update Rust dependencies including tokio-vhost & vhost-device-net Yureka Lilian (10): release/checks/integration: temporarily disable networking tests vm/sys/net: remove connman pkgs: temporarily disable mailutils tests vm/sys/net: integrate xdp-forwarder vm/sys/net: add iwd tools: add spectrum-router host: integrate router img/app: change to ipv6 nameserver release/checks/integration: Adapt networking test for ipv6 release/checks/integration: reenable networking tests host/rootfs/default.nix | 4 +- host/rootfs/file-list.mk | 2 + .../data/service/spectrum-router/down | 0 .../template/data/service/spectrum-router/run | 9 + host/rootfs/image/usr/bin/run-vmm | 21 +- host/rootfs/image/usr/bin/vm-import | 13 - img/app/image/etc/mdev/iface | 19 +- img/app/image/etc/resolv.conf | 2 +- .../etc/s6-rc/mdevd/dependencies.d/nftables | 0 pkgs/default.nix | 2 + pkgs/overlay.nix | 4 + release/checks/integration/default.nix | 2 +- release/checks/integration/networking.c | 33 +- tools/router/Cargo.lock | 807 ++++++++++++++++++ tools/router/Cargo.lock.license | 2 + tools/router/Cargo.toml | 21 + tools/router/default.nix | 18 + tools/router/src/main.rs | 73 ++ tools/router/src/packet.rs | 187 ++++ tools/router/src/protocol.rs | 65 ++ tools/router/src/router.rs | 147 ++++ tools/router/src/upstream.rs | 175 ++++ tools/start-vmm/ch.rs | 66 +- tools/start-vmm/lib.rs | 73 +- tools/start-vmm/meson.build | 9 +- tools/start-vmm/net-util.c | 39 - tools/start-vmm/net-util.h | 6 - tools/start-vmm/net.c | 55 -- tools/start-vmm/net.rs | 11 - tools/start-vmm/tests/meson.build | 5 - .../start-vmm/tests/tap_open-name-too-long.c | 20 - tools/start-vmm/tests/tap_open.c | 28 - vm/sys/net/Makefile | 2 +- vm/sys/net/default.nix | 15 +- vm/sys/net/file-list.mk | 3 - vm/sys/net/image/etc/fstab | 2 + vm/sys/net/image/etc/mdev/iface | 28 +- vm/sys/net/image/etc/nftables.conf | 16 +- vm/sys/net/image/etc/s6-rc/connman/run | 19 - vm/sys/net/image/etc/s6-rc/connman/type | 1 - .../net/image/etc/s6-rc/connman/type.license | 2 - 41 files changed, 1640 insertions(+), 366 deletions(-) rename vm/sys/net/image/etc/s6-rc/connman/dependencies.d/dbus => host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down (100%) create mode 100755 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run create mode 100644 img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables create mode 100644 tools/router/Cargo.lock create mode 100644 tools/router/Cargo.lock.license create mode 100644 tools/router/Cargo.toml create mode 100644 tools/router/default.nix create mode 100644 tools/router/src/main.rs create mode 100644 tools/router/src/packet.rs create mode 100644 tools/router/src/protocol.rs create mode 100644 tools/router/src/router.rs create mode 100644 tools/router/src/upstream.rs delete mode 100644 tools/start-vmm/net-util.c delete mode 100644 tools/start-vmm/net-util.h delete mode 100644 tools/start-vmm/net.c delete mode 100644 tools/start-vmm/tests/tap_open-name-too-long.c delete mode 100644 tools/start-vmm/tests/tap_open.c delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/run delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type.license -- 2.51.2

2 20

[PATCH v2] release/checks/integration: handle partial sends
by Alyssa Ross 30 Nov '25

30 Nov '25

Sometimes we see a test failure that looks like this: unexpected connection data: qemu-system-aarch64: terminating on signal 15 from pid 184 () I think this is because, now that the nc command in the networking integration test has a timeout, it's possible for it to time out after having opened the connection, but before having written all its input to it. Therefore, ignore connections that send a prefix of the expected data (including nothing), and just wait for the next connection rather than failing if that happens. Closes: https://spectrum-os.org/lists/archives/spectrum-devel/875xbl33vw.fsf@alyssa… Fixes: c61b297 ("release/checks/integration: add nc timeout") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v2: close connections when finished reading. v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251129163521.717709… release/checks/integration/networking.c | 50 +++++++++++++++---------- 1 file changed, 31 insertions(+), 19 deletions(-) diff --git a/release/checks/integration/networking.c b/release/checks/integration/networking.c index 97d7895..df76ec5 100644 --- a/release/checks/integration/networking.c +++ b/release/checks/integration/networking.c @@ -57,32 +57,44 @@ static int setup_server(void) static void expect_connection(int listener) { - int conn_fd; - FILE *conn; + int conn, r; char msg[7]; size_t len; - fputs("waiting for server connection\n", stderr); - if ((conn_fd = accept(listener, nullptr, nullptr)) == -1) { - perror("accept"); - exit(EXIT_FAILURE); - } - fputs("accepted connection!\n", stderr); - if (!(conn = fdopen(conn_fd, "r"))) { - perror("fdopen(server connection)"); - exit(EXIT_FAILURE); - } + for (;;) { + len = 0; - len = fread(msg, 1, sizeof msg, conn); - if (len != 6 || memcmp("hello\n", msg, 6)) { - if (ferror(conn)) - perror("fread(server connection)"); - else + fputs("waiting for server connection\n", stderr); + if ((conn = accept(listener, nullptr, nullptr)) == -1) { + perror("accept"); + exit(EXIT_FAILURE); + } + fputs("accepted connection!\n", stderr); + + for (;;) { + r = read(conn, msg + len, sizeof msg - len); + if (r == -1) { + perror("read"); + exit(EXIT_FAILURE); + } + if (r == 0) + break; + len += r; + } + close(conn); + + if (memcmp("hello\n", msg, len) || len > 6) { fprintf(stderr, "unexpected connection data: %.*s", (int)len, msg); - exit(EXIT_FAILURE); + exit(EXIT_FAILURE); + } + + // If connection was disconnect partway through, try again. + if (len < 6) + continue; + + return; } - fclose(conn); } static void drain_connections(int listener) base-commit: 067c6a5d50971242f9cb8ac0ac76e20d88a9b5c1 -- 2.51.0

3 2

[PATCH v3 00/10] spectrum-router
by Yureka Lilian 29 Nov '25

29 Nov '25

Changes since v2: - net-vm: Ensure nftables service is started by making it a dependency of mdev - integration tests: initialize ifr6 at the start - rootfs: Start spectrum-router in run-vmm, not start-vmm - start-vmm: More cleanups of no-longer-needed code - remove unnecessary if {} block in img/app/image/etc/mdev/iface - move disabling mailutils package tests to a separate commit - disable networking integration tests for the duration of the patch series - changed spectrum-router log level to a more reasonable value - router: Add timeouts for waiting for RX buffers Please remind me if I forgot to address any review comments. host/rootfs/default.nix | 4 +- host/rootfs/file-list.mk | 2 + .../data/service/spectrum-router/down | 0 .../template/data/service/spectrum-router/run | 9 + host/rootfs/image/usr/bin/run-vmm | 21 +- host/rootfs/image/usr/bin/vm-import | 13 - img/app/image/etc/mdev/iface | 19 +- img/app/image/etc/resolv.conf | 2 +- .../etc/s6-rc/mdevd/dependencies.d/nftables | 0 pkgs/default.nix | 2 + pkgs/overlay.nix | 4 + release/checks/integration/default.nix | 2 +- release/checks/integration/networking.c | 33 +- tools/router/Cargo.lock | 807 ++++++++++++++++++ tools/router/Cargo.lock.license | 2 + tools/router/Cargo.toml | 21 + tools/router/default.nix | 18 + tools/router/src/main.rs | 73 ++ tools/router/src/packet.rs | 187 ++++ tools/router/src/protocol.rs | 65 ++ tools/router/src/router.rs | 147 ++++ tools/router/src/upstream.rs | 175 ++++ tools/start-vmm/ch.rs | 66 +- tools/start-vmm/lib.rs | 73 +- tools/start-vmm/meson.build | 2 +- tools/start-vmm/net-util.c | 39 - tools/start-vmm/net-util.h | 6 - tools/start-vmm/net.c | 55 -- tools/start-vmm/net.rs | 11 - tools/start-vmm/tests/meson.build | 5 - .../start-vmm/tests/tap_open-name-too-long.c | 20 - tools/start-vmm/tests/tap_open.c | 28 - vm/sys/net/Makefile | 2 +- vm/sys/net/default.nix | 15 +- vm/sys/net/file-list.mk | 3 - vm/sys/net/image/etc/fstab | 2 + vm/sys/net/image/etc/mdev/iface | 28 +- vm/sys/net/image/etc/nftables.conf | 16 +- vm/sys/net/image/etc/s6-rc/connman/run | 19 - vm/sys/net/image/etc/s6-rc/connman/type | 1 - .../net/image/etc/s6-rc/connman/type.license | 2 - 41 files changed, 1639 insertions(+), 360 deletions(-) rename vm/sys/net/image/etc/s6-rc/connman/dependencies.d/dbus => host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down (100%) create mode 100755 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run create mode 100644 img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables create mode 100644 tools/router/Cargo.lock create mode 100644 tools/router/Cargo.lock.license create mode 100644 tools/router/Cargo.toml create mode 100644 tools/router/default.nix create mode 100644 tools/router/src/main.rs create mode 100644 tools/router/src/packet.rs create mode 100644 tools/router/src/protocol.rs create mode 100644 tools/router/src/router.rs create mode 100644 tools/router/src/upstream.rs delete mode 100644 tools/start-vmm/net-util.c delete mode 100644 tools/start-vmm/net-util.h delete mode 100644 tools/start-vmm/net.c delete mode 100644 tools/start-vmm/tests/tap_open-name-too-long.c delete mode 100644 tools/start-vmm/tests/tap_open.c delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/run delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type.license -- 2.51.2

1 10

[PATCH] host/rootfs: reap sd-notify-adapter
by Alyssa Ross 29 Nov '25

29 Nov '25

systemd-udevd won't reap children, so we double fork so that pid 1 reaps sd-notify-adapter when it exits. Link: https://matrix.to/#/!xSysqhzbOZImdvGpix:fairydust.space/$QL6VucG9rlw_H9iQY9… Fixes: ced08f7 ("host/rootfs: Switch to systemd-udevd") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/image/etc/s6-rc/systemd-udevd/run | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run index fff0d47..2d28d02 100644 --- a/host/rootfs/image/etc/s6-rc/systemd-udevd/run +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run @@ -3,7 +3,7 @@ # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> s6-setlock /run/sd-notify-wrapper/systemd-udevd.lock s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd.sock -background { +background -d { fdmove 1 3 sd-notify-adapter } base-commit: aa5ab817d6eb990683a88893a6375acef7a585aa -- 2.51.0

2 1

[PATCH] release/checks/integration: handle partial sends
by Alyssa Ross 29 Nov '25

29 Nov '25

Sometimes we see a test failure that looks like this: unexpected connection data: qemu-system-aarch64: terminating on signal 15 from pid 184 () I think this is because, now that the nc command in the networking integration test has a timeout, it's possible for it to time out after having opened the connection, but before having written all its input to it. Therefore, ignore connections that send a prefix of the expected data (including nothing), and just wait for the next connection rather than failing if that happens. Closes: https://spectrum-os.org/lists/archives/spectrum-devel/875xbl33vw.fsf@alyssa… Fixes: c61b297 ("release/checks/integration: add nc timeout") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- Please test! It's difficult to know if I've solved the problem for real, since it happens transiently. release/checks/integration/networking.c | 49 +++++++++++++++---------- 1 file changed, 30 insertions(+), 19 deletions(-) diff --git a/release/checks/integration/networking.c b/release/checks/integration/networking.c index 97d7895..a445af1 100644 --- a/release/checks/integration/networking.c +++ b/release/checks/integration/networking.c @@ -57,32 +57,43 @@ static int setup_server(void) static void expect_connection(int listener) { - int conn_fd; - FILE *conn; + int conn, r; char msg[7]; size_t len; - fputs("waiting for server connection\n", stderr); - if ((conn_fd = accept(listener, nullptr, nullptr)) == -1) { - perror("accept"); - exit(EXIT_FAILURE); - } - fputs("accepted connection!\n", stderr); - if (!(conn = fdopen(conn_fd, "r"))) { - perror("fdopen(server connection)"); - exit(EXIT_FAILURE); - } + for (;;) { + len = 0; - len = fread(msg, 1, sizeof msg, conn); - if (len != 6 || memcmp("hello\n", msg, 6)) { - if (ferror(conn)) - perror("fread(server connection)"); - else + fputs("waiting for server connection\n", stderr); + if ((conn = accept(listener, nullptr, nullptr)) == -1) { + perror("accept"); + exit(EXIT_FAILURE); + } + fputs("accepted connection!\n", stderr); + + for (;;) { + r = read(conn, msg + len, sizeof msg - len); + if (r == -1) { + perror("read"); + exit(EXIT_FAILURE); + } + if (r == 0) + break; + len += r; + } + + if (memcmp("hello\n", msg, len) || len > 6) { fprintf(stderr, "unexpected connection data: %.*s", (int)len, msg); - exit(EXIT_FAILURE); + exit(EXIT_FAILURE); + } + + // If connection was disconnect partway through, try again. + if (len < 6) + continue; + + return; } - fclose(conn); } static void drain_connections(int listener) base-commit: 067c6a5d50971242f9cb8ac0ac76e20d88a9b5c1 -- 2.51.0

2 2

[PATCH v2 0/7] spectrum-router
by Yureka Lilian 29 Nov '25

29 Nov '25

Changes since v1 (non-exhaustive): - Use spectrum-router from pkgsMusl - Refactor router into smaller modules - Parse router advertisements from upstream interfaces - Select active upstream interface based on router advertisements - Assign guest mac addresses based hash of vm id - Fix race condition when assigning driver-router interface - Temporarily disable re-write of mac addresses which would be needed for wifi. It will be added back inside the xdp-forwarder in a future patch. and completely new patches: - Change nameserver & default route in app-vm template - Fix integration tests - Leave dbus in net-vm and add iwd for testing Yureka Lilian (7): vm/sys/net: remove connman vm/sys/net: integrate xdp-forwarder vm/sys/net: add iwd tools: add spectrum-router host: integrate router img/app: change to ipv6 nameserver checks/integration: Adapt networking test for ipv6 host/rootfs/default.nix | 4 +- host/rootfs/file-list.mk | 3 + .../data/service/spectrum-router/down | 0 .../template/data/service/spectrum-router/run | 13 + .../image/usr/bin/assign-driver-router-iface | 11 + host/rootfs/image/usr/bin/run-vmm | 12 +- host/rootfs/image/usr/bin/vm-import | 13 - img/app/image/etc/mdev/iface | 17 - img/app/image/etc/resolv.conf | 2 +- pkgs/default.nix | 2 + pkgs/overlay.nix | 1 + release/checks/integration/default.nix | 2 +- release/checks/integration/networking.c | 32 +- tools/router/Cargo.lock | 807 ++++++++++++++++++ tools/router/Cargo.lock.license | 2 + tools/router/Cargo.toml | 21 + tools/router/default.nix | 18 + tools/router/src/main.rs | 73 ++ tools/router/src/packet.rs | 187 ++++ tools/router/src/protocol.rs | 65 ++ tools/router/src/router.rs | 133 +++ tools/router/src/upstream.rs | 170 ++++ tools/start-vmm/ch.rs | 38 +- tools/start-vmm/lib.rs | 76 +- tools/start-vmm/meson.build | 2 +- tools/start-vmm/net-util.c | 39 - tools/start-vmm/net-util.h | 6 - tools/start-vmm/net.c | 55 -- tools/start-vmm/net.rs | 11 - tools/start-vmm/tests/meson.build | 5 - .../start-vmm/tests/tap_open-name-too-long.c | 20 - tools/start-vmm/tests/tap_open.c | 28 - vm/sys/net/Makefile | 2 +- vm/sys/net/default.nix | 15 +- vm/sys/net/file-list.mk | 3 - vm/sys/net/image/etc/fstab | 2 + vm/sys/net/image/etc/mdev/iface | 28 +- vm/sys/net/image/etc/nftables.conf | 16 +- vm/sys/net/image/etc/s6-rc/connman/run | 19 - vm/sys/net/image/etc/s6-rc/connman/type | 1 - .../net/image/etc/s6-rc/connman/type.license | 2 - 41 files changed, 1627 insertions(+), 329 deletions(-) rename vm/sys/net/image/etc/s6-rc/connman/dependencies.d/dbus => host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down (100%) create mode 100755 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run create mode 100755 host/rootfs/image/usr/bin/assign-driver-router-iface create mode 100644 tools/router/Cargo.lock create mode 100644 tools/router/Cargo.lock.license create mode 100644 tools/router/Cargo.toml create mode 100644 tools/router/default.nix create mode 100644 tools/router/src/main.rs create mode 100644 tools/router/src/packet.rs create mode 100644 tools/router/src/protocol.rs create mode 100644 tools/router/src/router.rs create mode 100644 tools/router/src/upstream.rs delete mode 100644 tools/start-vmm/net-util.c delete mode 100644 tools/start-vmm/net-util.h delete mode 100644 tools/start-vmm/net.c delete mode 100644 tools/start-vmm/tests/tap_open-name-too-long.c delete mode 100644 tools/start-vmm/tests/tap_open.c delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/run delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type.license -- 2.51.2

3 18

[PATCH 1/2] scripts/make-gpt.sh: set -o pipefail
by Alyssa Ross 29 Nov '25

29 Nov '25

Wasn't POSIX at the time this script was originally written! Suggested-by: Demi Marie Obenour <demiobenour(a)gmail.com> Link: https://spectrum-os.org/lists/archives/spectrum-devel/20251127174054.205683… Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- scripts/make-gpt.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/make-gpt.sh b/scripts/make-gpt.sh index 3cae441..e39828b 100755 --- a/scripts/make-gpt.sh +++ b/scripts/make-gpt.sh @@ -1,4 +1,4 @@ -#!/bin/sh -eu +#!/bin/sh -- # # SPDX-FileCopyrightText: 2021-2023 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2022 Unikie @@ -6,6 +6,8 @@ # # usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL]]... +set -euo pipefail + ONE_MiB=1048576 # Prints the number of 1MiB blocks required to store the file named base-commit: d76e9b29aea9f31238d07e21db50d3fe6a80da5a -- 2.51.0

2 3

[PATCH v2] scripts/make-gpt.sh: allow setting partition size
by Alyssa Ross 28 Nov '25

28 Nov '25

We want non-minimally-sized partitions to leave space for updates. All such partitions will also be labelled, so we can just add another optional field at the end. Since we don't parse partition specifications in sh, we can't keep a running total any more, so instead we just go through the table at the end and add up all the sizes, taking advantage of our knowledge that the size will always be the last thing in each line in our tables. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> Message-ID: <20251127174054.2056835-2-hi(a)alyssa.is> --- v2: fix conflicts after applying Demi's optimization, and avoid awk to sum partition sizes, taking inspiration from the same. v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251127174054.205683… scripts/make-gpt.sh | 30 ++++++++++++++++++------------ scripts/sfdisk-field.awk | 22 +++++++++++++++++----- 2 files changed, 35 insertions(+), 17 deletions(-) diff --git a/scripts/make-gpt.sh b/scripts/make-gpt.sh index 3cae441..cb19868 100755 --- a/scripts/make-gpt.sh +++ b/scripts/make-gpt.sh @@ -1,10 +1,10 @@ #!/bin/sh -eu # -# SPDX-FileCopyrightText: 2021-2023 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2021-2023, 2025 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2022 Unikie # SPDX-License-Identifier: EUPL-1.2+ # -# usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL]]... +# usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL[:PARTMiB]]]... ONE_MiB=1048576 @@ -33,21 +33,27 @@ scriptsDir="$(dirname "$0")" out="$1" shift -nl=' -' -table="label: gpt" +table=$(for partition; do + awk -f "$scriptsDir/sfdisk-field.awk" \ + -v partition="$partition" \ + -v size="$(sizeMiB "${partition%%:*}")" +done) # Keep 1MiB free at the start, and 1MiB free at the end. -gptBytes=$((ONE_MiB * 2)) -for partition; do - sizeMiB="$(sizeMiB "${partition%%:*}")" - table="$table${nl}size=${sizeMiB}MiB,$(awk -f "$scriptsDir/sfdisk-field.awk" -v partition="$partition")" - gptBytes="$((gptBytes + sizeMiB * ONE_MiB))" -done +gptMiB=2 +while read -r partition; do + # Here we rely on sfdisk-field.awk always putting size last. + : $((gptMiB += ${partition##*=})) +done <<EOF +$table +EOF rm -f "$out" -truncate -s "$gptBytes" "$out" +truncate -s "${gptMiB}M" "$out" + sfdisk --no-reread --no-tell-kernel "$out" <<EOF +label: gpt +sector-size: $ONE_MiB $table EOF diff --git a/scripts/sfdisk-field.awk b/scripts/sfdisk-field.awk index e13c86d..78b438e 100644 --- a/scripts/sfdisk-field.awk +++ b/scripts/sfdisk-field.awk @@ -1,7 +1,7 @@ #!/usr/bin/awk -f # # SPDX-License-Identifier: EUPL-1.2+ -# SPDX-FileCopyrightText: 2022, 2024 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2022, 2024-2025 Alyssa Ross <hi(a)alyssa.is> BEGIN { types["root.aarch64"] = "b921b045-1df0-41c3-af44-4c6f280d3fae" @@ -9,12 +9,11 @@ BEGIN { types["verity.aarch64"] = "df3300ce-d69f-4c92-978c-9bfb0f38d820" types["verity.x86_64"] = "2c7357ed-ebd2-46d9-aec1-23d437ec2bf5" - # Field #1 is the partition path, which make-gpt.sh will turn into - # the size field. Since it's handled elsewhere, we skip that - # first field. + # Field #1 is the partition path, which is read by make-gpt.sh + # but not relevant for running sfdisk, so skip it. skip=1 - split("type uuid name", keys) + split("type uuid name size", keys) split(partition, fields, ":") arch = ENVIRON["ARCH"] @@ -31,8 +30,21 @@ BEGIN { if (keys[n - skip] == "type") { if (uuid = types[fields[n] "." arch]) fields[n] = uuid + } else if (keys[n - skip] == "size") { + if (fields[n] < size) { + printf "%s MiB partition content is too big for %s MiB partition\n", + size, fields[n] > "/dev/stderr" + exit 1 + } + + size = fields[n] + continue # Handled at the end. } printf "%s=%s,", keys[n - skip], fields[n] } + + # Always output a size field, either supplied in input or + # default value of the size variable. + printf "size=%s\n", size } base-commit: 1970f432152730ec19bf97a8db4613a591ee00be -- 2.51.0

2 7

[PATCH] scripts/make-gpt.sh: allow setting partition size
by Alyssa Ross 28 Nov '25

28 Nov '25

We want non-minimally-sized partitions to leave space for updates. All such partitions will also be labelled, so we can just add another optional field at the end. Since we don't parse partition specifications in sh, we can't keep a running total any more, so instead we just go through the table at the end and add up all the sizes, taking advantage of our knowledge that the size will always be the last thing in each line in our tables. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- This is an alternative to Demi's implementation[1], which required Bash features. [1]: https://spectrum-os.org/lists/archives/spectrum-devel/20251126-updates-v5-3… scripts/make-gpt.sh | 28 +++++++++++++++------------- scripts/sfdisk-field.awk | 22 +++++++++++++++++----- 2 files changed, 32 insertions(+), 18 deletions(-) diff --git a/scripts/make-gpt.sh b/scripts/make-gpt.sh index 96f0d2c..07eac50 100755 --- a/scripts/make-gpt.sh +++ b/scripts/make-gpt.sh @@ -1,10 +1,10 @@ #!/bin/sh -eu # -# SPDX-FileCopyrightText: 2021-2023 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2021-2023, 2025 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2022 Unikie # SPDX-License-Identifier: EUPL-1.2+ # -# usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL]]... +# usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL[:PARTMiB]]]... ONE_MiB=1048576 @@ -28,7 +28,8 @@ fillPartition() { lseek -S 1 "$start" cat "$3" 1<>"$1" } -# Prints the partition path from a PATH:PARTTYPE[:PARTUUID[:PARTLABEL]] string. +# Prints the partition path from a +# PATH:PARTTYPE[:PARTUUID[:PARTLABEL[:PARTMiB]]] string. partitionPath() { awk -F: '{print $1}' <<EOF $1 @@ -40,21 +41,22 @@ scriptsDir="$(dirname "$0")" out="$1" shift -nl=' -' -table="label: gpt" +table=$(for partition; do + awk -f "$scriptsDir/sfdisk-field.awk" \ + -v partition="$partition" \ + -v size="$(sizeMiB "$(partitionPath "$partition")")" +done) # Keep 1MiB free at the start, and 1MiB free at the end. -gptBytes=$((ONE_MiB * 2)) -for partition; do - sizeMiB="$(sizeMiB "$(partitionPath "$partition")")" - table="$table${nl}size=${sizeMiB}MiB,$(awk -f "$scriptsDir/sfdisk-field.awk" -v partition="$partition")" - gptBytes="$((gptBytes + sizeMiB * ONE_MiB))" -done +# Here we rely on sfdisk-field.awk always putting size last +gptMiB=$(printf "%s\n" "$table" | awk -F= '{size += $NF} END {print size + 2}') rm -f "$out" -truncate -s "$gptBytes" "$out" +truncate -s "${gptMiB}M" "$out" + sfdisk --no-reread --no-tell-kernel "$out" <<EOF +label: gpt +sector-size: $ONE_MiB $table EOF diff --git a/scripts/sfdisk-field.awk b/scripts/sfdisk-field.awk index e13c86d..78b438e 100644 --- a/scripts/sfdisk-field.awk +++ b/scripts/sfdisk-field.awk @@ -1,7 +1,7 @@ #!/usr/bin/awk -f # # SPDX-License-Identifier: EUPL-1.2+ -# SPDX-FileCopyrightText: 2022, 2024 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2022, 2024-2025 Alyssa Ross <hi(a)alyssa.is> BEGIN { types["root.aarch64"] = "b921b045-1df0-41c3-af44-4c6f280d3fae" @@ -9,12 +9,11 @@ BEGIN { types["verity.aarch64"] = "df3300ce-d69f-4c92-978c-9bfb0f38d820" types["verity.x86_64"] = "2c7357ed-ebd2-46d9-aec1-23d437ec2bf5" - # Field #1 is the partition path, which make-gpt.sh will turn into - # the size field. Since it's handled elsewhere, we skip that - # first field. + # Field #1 is the partition path, which is read by make-gpt.sh + # but not relevant for running sfdisk, so skip it. skip=1 - split("type uuid name", keys) + split("type uuid name size", keys) split(partition, fields, ":") arch = ENVIRON["ARCH"] @@ -31,8 +30,21 @@ BEGIN { if (keys[n - skip] == "type") { if (uuid = types[fields[n] "." arch]) fields[n] = uuid + } else if (keys[n - skip] == "size") { + if (fields[n] < size) { + printf "%s MiB partition content is too big for %s MiB partition\n", + size, fields[n] > "/dev/stderr" + exit 1 + } + + size = fields[n] + continue # Handled at the end. } printf "%s=%s,", keys[n - skip], fields[n] } + + # Always output a size field, either supplied in input or + # default value of the size variable. + printf "size=%s\n", size } base-commit: c43e5c63a028994d5f66a15db19f415bf3cb7736 -- 2.51.0

2 2

[PATCH] host: Configure s6-linux-init-shutdownd
by Johannes Süllner 28 Nov '25

28 Nov '25

Makes shutdown and reboot of the Spectrum host using `s6-linux-init-hpr` possible. Before, it would fail with "fatal: unable to talk to shutdownd: Operation not permitted". Pretty much just copied from commit 18b19f4dfdb1376d90f70f526052011502b97c40, where this was added to application VMs, but not to the host. Signed-off-by: Johannes Süllner <johannes.suellner(a)mailbox.org> --- host/rootfs/Makefile | 4 +++- host/rootfs/file-list.mk | 4 ++++ .../service/s6-linux-init-shutdownd/notification-fd | 1 + .../service/s6-linux-init-shutdownd/notification-fd.license | 2 ++ .../run-image/service/s6-linux-init-shutdownd/run | 5 +++++ host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown | 5 +++++ .../rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final | 3 +++ 7 files changed, 23 insertions(+), 1 deletion(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd.license create mode 100755 host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run create mode 100755 host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown create mode 100755 host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index d528b12..5e90255 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -37,7 +37,9 @@ DIRS = \ run \ sys -FIFOS = etc/s6-linux-init/run-image/service/s6-svscan-log/fifo +FIFOS = \ + etc/s6-linux-init/run-image/service/s6-svscan-log/fifo \ + etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/fifo BUILD_FILES = build/etc/s6-rc diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index 7625c54..613a9e7 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -15,6 +15,8 @@ FILES = \ image/etc/s6-linux-init/run-image/service/getty-tty2/run \ image/etc/s6-linux-init/run-image/service/getty-tty3/run \ image/etc/s6-linux-init/run-image/service/getty-tty4/run \ + image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd \ + image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run \ image/etc/s6-linux-init/run-image/service/s6-svscan-log/notification-fd \ image/etc/s6-linux-init/run-image/service/s6-svscan-log/run \ image/etc/s6-linux-init/run-image/service/serial-getty-generator/run \ @@ -37,6 +39,8 @@ FILES = \ image/etc/s6-linux-init/run-image/service/vmm/run \ image/etc/s6-linux-init/run-image/service/vmm/template/notification-fd \ image/etc/s6-linux-init/scripts/rc.init \ + image/etc/s6-linux-init/scripts/rc.shutdown \ + image/etc/s6-linux-init/scripts/rc.shutdown.final \ image/etc/udev/rules.d/99-spectrum.rules \ image/etc/xdg/weston/autolaunch \ image/etc/xdg/weston/weston.ini \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd new file mode 100644 index 0000000..00750ed --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd @@ -0,0 +1 @@ +3 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd.license new file mode 100644 index 0000000..a941ca4 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run new file mode 100755 index 0000000..228fc6a --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run @@ -0,0 +1,5 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> + +s6-linux-init-shutdownd -Bc /etc/s6-linux-init diff --git a/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown new file mode 100755 index 0000000..3b09c02 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown @@ -0,0 +1,5 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> + +s6-rc -Dbav2 change diff --git a/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final new file mode 100755 index 0000000..7f48a65 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final @@ -0,0 +1,3 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> -- 2.50.1

2 1

[PATCH 0/2] Move verity and EFI creation to separate Nix derivations
by Demi Marie Obenour 28 Nov '25

28 Nov '25

This doesn't have any functional change, other than to use the read builtin instead of a cat command in a shell script. However, it does make the code much cleaner and more reusable. For instance, one can easily build just the verity image or just the UKI. This will be used by the Nix code that generates an update package. The update package needs the root filesystem, the verity superblock, and the UKI. It doesn't need the installer or the live image. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Demi Marie Obenour (2): Create Nix derivation for building verity images Move UKI creation to a separate derivation host/efi.nix | 46 ++++++++++++++++++++++++++++++++++++++++++++++ host/initramfs/Makefile | 25 +++++-------------------- host/initramfs/shell.nix | 4 +++- host/rootfs/Makefile | 24 +++++------------------- host/rootfs/shell.nix | 3 +++ host/verity.nix | 19 +++++++++++++++++++ lib/common.mk | 1 - pkgs/default.nix | 2 ++ release/live/Makefile | 37 +++++-------------------------------- release/live/default.nix | 22 +++++++--------------- 10 files changed, 95 insertions(+), 88 deletions(-) --- base-commit: 43a8c81c58d73967635f57fdd84734d44120bc39 change-id: 20251105-refactor-verity-9c8ca37e021a -- Sincerely, Demi Marie Obenour (she/her/hers)

3 41

[REGRESSION] Backspace no longer works in host/rootfs make run virtiocon0
by Alyssa Ross 28 Nov '25

28 Nov '25

Bisected to the following range: 1e9c681 lib/nixpkgs.default.nix: update to nixos-unstable-small f41b4ab tools: move lsvm out of subdirectory 5ad749b tools: enable clippy::ptr-as-ptr lint a4d7aa9 tools: enable clippy::map-unwrap-or lint 3451250 host/rootfs: group VMM-backing services 99f09ab pkgs: remove dbus overlay Most likely something in the Nixpkgs upgrade. Needs further bisection. To reproduce: cd host/rootfs nix-shell --run 'make clean && make run' View → virtiocon0 Wait for kernel messages to finish Try typing, see that backspace doesn't work

1 6

[PATCH 1/3] host/rootfs: get rid of pkgsGui
by Alyssa Ross 28 Nov '25

28 Nov '25

The original purpose of pkgsGui was to have a dynamically linked package set that used libudev-zero. Now we don't use libudev-zero on the host, so it's no longer necessary. The one remaining override can be moved into the overlay until it's upstreamed[1]. Link: https://gitlab.freedesktop.org/accountsservice/accountsservice/-/merge_requ… [1] Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/default.nix | 31 +++++++++++-------------------- pkgs/overlay.nix | 6 ++++++ 2 files changed, 17 insertions(+), 20 deletions(-) diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index f7974a4..2af6cbe 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -18,19 +18,10 @@ pkgsStatic.callPackage ( let inherit (nixosAllHardware.config.hardware) firmware; inherit (lib) - concatMapStringsSep concatStrings escapeShellArgs fileset optionalAttrs - mapAttrsToList systems trivial; + concatMapStringsSep concatStrings escapeShellArgs fileset mapAttrsToList + trivial; - pkgsGui = pkgsMusl.extend ( - _: super: - (optionalAttrs (systems.equals pkgsMusl.stdenv.hostPlatform super.stdenv.hostPlatform) { - flatpak = super.flatpak.override { - withMalcontent = false; - }; - }) - ); - - foot = pkgsGui.foot.override { allowPgo = false; }; + foot = pkgsMusl.foot.override { allowPgo = false; }; packages = [ cloud-hypervisor cryptsetup dbus execline inotify-tools iproute2 @@ -42,8 +33,8 @@ let extraConfig = builtins.readFile ./busybox-config; }) - # Take kmod from pkgsGui since we use pkgsGui.kmod.lib below anyway. - ] ++ (with pkgsGui; [ cosmic-files crosvm foot fuse3 kmod systemd ]); + # Take kmod from pkgsMusl since we use pkgsMusl.kmod.lib below anyway. + ] ++ (with pkgsMusl; [ cosmic-files crosvm foot fuse3 kmod systemd ]); nixosAllHardware = nixos ({ modulesPath, ... }: { imports = [ (modulesPath + "/profiles/all-hardware.nix") ]; @@ -64,7 +55,7 @@ let # https://inbox.vuxu.org/musl/20251017-dlopen-use-rpath-of-caller-dso-v1-1-46… usrPackages = [ appvm kernel.modules firmware netvm - ] ++ (with pkgsGui; [ dejavu_fonts kmod.lib mesa westonLite ]); + ] ++ (with pkgsMusl; [ dejavu_fonts kmod.lib mesa westonLite ]); appvms = { appvm-firefox = callSpectrumPackage ../../vm/app/firefox.nix {}; @@ -88,16 +79,16 @@ let # Weston doesn't support SVG icons. inkscape -w 20 -h 20 \ -o $out/usr/share/icons/hicolor/20x20/apps/com.system76.CosmicFiles.png \ - ${pkgsGui.cosmic-files}/share/icons/hicolor/24x24/apps/com.system76.CosmicFiles.svg + ${pkgsMusl.cosmic-files}/share/icons/hicolor/24x24/apps/com.system76.CosmicFiles.svg ln -st $out/usr/bin \ ${concatMapStringsSep " " (p: "${p}/bin/*") packages} \ - ${pkgsGui.xdg-desktop-portal}/libexec/xdg-document-portal \ - ${pkgsGui.xdg-desktop-portal-gtk}/libexec/xdg-desktop-portal-gtk + ${pkgsMusl.xdg-desktop-portal}/libexec/xdg-document-portal \ + ${pkgsMusl.xdg-desktop-portal-gtk}/libexec/xdg-desktop-portal-gtk ln -st $out/usr/share/dbus-1 \ ${dbus}/share/dbus-1/session.conf ln -st $out/usr/share/dbus-1/services \ - ${pkgsGui.xdg-desktop-portal-gtk}/share/dbus-1/services/org.freedesktop.impl.portal.desktop.gtk.service + ${pkgsMusl.xdg-desktop-portal-gtk}/share/dbus-1/services/org.freedesktop.impl.portal.desktop.gtk.service ${concatStrings (mapAttrsToList (name: path: '' ln -s ${path} $out/usr/lib/spectrum/vm/${name} @@ -138,7 +129,7 @@ stdenvNoCC.mkDerivation { dontFixup = true; passthru = { - inherit appvm firmware kernel nixosAllHardware packagesSysroot pkgsGui; + inherit appvm firmware kernel nixosAllHardware packagesSysroot; }; meta = with lib; { diff --git a/pkgs/overlay.nix b/pkgs/overlay.nix index 0ca196c..fdddae0 100644 --- a/pkgs/overlay.nix +++ b/pkgs/overlay.nix @@ -4,5 +4,11 @@ (final: super: { cloud-hypervisor = import ./cloud-hypervisor { inherit final super; }; + flatpak = super.flatpak.override ( + final.lib.optionalAttrs final.stdenv.hostPlatform.isMusl { + withMalcontent = false; + } + ); + skawarePackages = import ./skaware-packages { inherit final super; }; }) base-commit: c43e5c63a028994d5f66a15db19f415bf3cb7736 -- 2.51.0

2 4

[PATCH 1/5] pkgs: mdevd: backport bugfix
by Alyssa Ross 26 Nov '25

26 Nov '25

Without this, we can't tell mdevd to leave permissions of device nodes created by devtmpfs alone. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- pkgs/overlay.nix | 2 ++ pkgs/skaware-packages/default.nix | 15 +++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 pkgs/skaware-packages/default.nix diff --git a/pkgs/overlay.nix b/pkgs/overlay.nix index 2987e7c..b3dfcc1 100644 --- a/pkgs/overlay.nix +++ b/pkgs/overlay.nix @@ -5,4 +5,6 @@ cloud-hypervisor = import ./cloud-hypervisor { inherit final super; }; dbus = import ./dbus { inherit final super; }; + + skawarePackages = import ./skaware-packages { inherit final super; }; }) diff --git a/pkgs/skaware-packages/default.nix b/pkgs/skaware-packages/default.nix new file mode 100644 index 0000000..f0d924b --- /dev/null +++ b/pkgs/skaware-packages/default.nix @@ -0,0 +1,15 @@ +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> +# SPDX-License-Identifier: MIT + +import ../../lib/overlay-package.nix [ "skawarePackages" ] ({ final, super }: + +super.skawarePackages.overrideScope (_: prev: { + mdevd = prev.mdevd.overrideAttrs ({ patches ? [], ... }: { + patches = patches ++ [ + (final.fetchpatch { + url = "https://git.skarnet.org/cgi-bin/cgit.cgi/mdevd/patch/?id=252f241e425bf09ddf…"; + hash = "sha256-0tEC+yJGyPapsxBqzBXPztF3bl7OwjVAGjhNXtwZQ0g="; + }) + ]; + }); +})) -- 2.51.0

2 9

[PATCH v1 RFC 0/4] spectrum-router
by Yureka Lilian 26 Nov '25

26 Nov '25

A first version of the spectrum user-space router & its integration into the spectrum system. Many details of the router itself are not yet finalized, and the main focus of this patch series is getting feedback on the integration into the spectrum system. Yureka Lilian (4): vm/sys/net: remove connman & dbus vm/sys/net: integrate xdp-forwarder tools: add spectrum-router host: integrate router host/rootfs/default.nix | 4 +- host/rootfs/file-list.mk | 2 + .../data/service/spectrum-router/down | 0 .../template/data/service/spectrum-router/run | 13 + host/rootfs/image/usr/bin/run-vmm | 12 - host/rootfs/image/usr/bin/vm-import | 13 - pkgs/default.nix | 2 + pkgs/overlay.nix | 1 + tools/router/Cargo.lock | 785 ++++++++++++++++++ tools/router/Cargo.toml | 18 + tools/router/default.nix | 18 + tools/router/src/main.rs | 235 ++++++ tools/start-vmm/ch.rs | 40 +- tools/start-vmm/lib.rs | 68 +- tools/start-vmm/meson.build | 2 +- tools/start-vmm/net-util.c | 39 - tools/start-vmm/net-util.h | 6 - tools/start-vmm/net.c | 55 -- tools/start-vmm/net.rs | 10 - tools/start-vmm/tests/meson.build | 5 - .../start-vmm/tests/tap_open-name-too-long.c | 20 - tools/start-vmm/tests/tap_open.c | 28 - vm/sys/net/Makefile | 2 +- vm/sys/net/default.nix | 15 +- vm/sys/net/file-list.mk | 13 +- vm/sys/net/image/etc/dbus-1/system.conf | 8 - vm/sys/net/image/etc/fstab | 2 + vm/sys/net/image/etc/mdev/iface | 27 +- vm/sys/net/image/etc/nftables.conf | 16 +- vm/sys/net/image/etc/s6-rc/connman/run | 19 - vm/sys/net/image/etc/s6-rc/connman/type | 1 - .../net/image/etc/s6-rc/connman/type.license | 2 - .../net/image/etc/s6-rc/dbus/notification-fd | 1 - .../etc/s6-rc/dbus/notification-fd.license | 2 - vm/sys/net/image/etc/s6-rc/dbus/run | 10 - vm/sys/net/image/etc/s6-rc/dbus/type | 1 - vm/sys/net/image/etc/s6-rc/dbus/type.license | 2 - .../image/etc/s6-rc/ok-all/contents.d/sysctl | 0 vm/sys/net/image/etc/s6-rc/sysctl/type | 1 - .../net/image/etc/s6-rc/sysctl/type.license | 2 - vm/sys/net/image/etc/s6-rc/sysctl/up | 4 - vm/sys/net/image/etc/sysctl.conf | 4 - 42 files changed, 1157 insertions(+), 351 deletions(-) rename vm/sys/net/image/etc/s6-rc/connman/dependencies.d/dbus => host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down (100%) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run create mode 100644 tools/router/Cargo.lock create mode 100644 tools/router/Cargo.toml create mode 100644 tools/router/default.nix create mode 100644 tools/router/src/main.rs delete mode 100644 tools/start-vmm/net-util.c delete mode 100644 tools/start-vmm/net-util.h delete mode 100644 tools/start-vmm/net.c delete mode 100644 tools/start-vmm/tests/tap_open-name-too-long.c delete mode 100644 tools/start-vmm/tests/tap_open.c delete mode 100644 vm/sys/net/image/etc/dbus-1/system.conf delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/run delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type.license delete mode 100644 vm/sys/net/image/etc/s6-rc/dbus/notification-fd delete mode 100644 vm/sys/net/image/etc/s6-rc/dbus/notification-fd.license delete mode 100644 vm/sys/net/image/etc/s6-rc/dbus/run delete mode 100644 vm/sys/net/image/etc/s6-rc/dbus/type delete mode 100644 vm/sys/net/image/etc/s6-rc/dbus/type.license delete mode 100644 vm/sys/net/image/etc/s6-rc/ok-all/contents.d/sysctl delete mode 100644 vm/sys/net/image/etc/s6-rc/sysctl/type delete mode 100644 vm/sys/net/image/etc/s6-rc/sysctl/type.license delete mode 100644 vm/sys/net/image/etc/s6-rc/sysctl/up delete mode 100644 vm/sys/net/image/etc/sysctl.conf -- 2.51.2

4 11

Can't get minijail0 working without bind-mounting /
by Demi Marie Obenour 24 Nov '25

24 Nov '25

I'm trying to get minijail0 to work without bind-mounting /, and I'm running into lots of problems. So far: - Unprivileged user namespaces fail due to -EPERM in a mount syscall. - Mounting a tmpfs over / always causes the program to be executed to not be found. - `sudo ./minijail0.sh -v --profile=minimalistic-mountns /bin/ls` works, but doesn't actually do any sandboxing as it bind-mounts `/`. Are there examples of how to use minijail0 properly? Alternatively, can I use it purely for seccomp and Landlock, and use bubblewrap to handle namespacing? -- Sincerely, Demi Marie Obenour (she/her/hers)

2 2

[PATCH v2 1/3] tools/mount-flatpak: init
by Alyssa Ross 24 Nov '25

24 Nov '25

I tried to build this with Meson, but pathrs depends on thiserror, which tries to read OUT_DIR, and support for setting that isn't currently in a Meson release, and requires nightly Rust, so build with Cargo for now and we can revisit that later. Link: https://github.com/mesonbuild/meson/pull/15148 Link: https://github.com/rust-lang/rust/issues/118372 Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v2: • rewrite in Rust using pathrs. This prevents every important mistake Demi identified last time, except for: • check metadata is a regular file before opening for reading v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251113120452.65711-… LICENSES/MPL-2.0.txt | 373 +++++++++++++++++++++++++ pkgs/default.nix | 1 + tools/mount-flatpak/Cargo.lock | 238 ++++++++++++++++ tools/mount-flatpak/Cargo.lock.license | 2 + tools/mount-flatpak/Cargo.toml | 11 + tools/mount-flatpak/config | 7 + tools/mount-flatpak/default.nix | 25 ++ tools/mount-flatpak/src/keyfile.rs | 189 +++++++++++++ tools/mount-flatpak/src/main.rs | 249 +++++++++++++++++ tools/mount-flatpak/src/metadata.rs | 19 ++ 10 files changed, 1114 insertions(+) create mode 100644 LICENSES/MPL-2.0.txt create mode 100644 tools/mount-flatpak/Cargo.lock create mode 100644 tools/mount-flatpak/Cargo.lock.license create mode 100644 tools/mount-flatpak/Cargo.toml create mode 100644 tools/mount-flatpak/config create mode 100644 tools/mount-flatpak/default.nix create mode 100644 tools/mount-flatpak/src/keyfile.rs create mode 100644 tools/mount-flatpak/src/main.rs create mode 100644 tools/mount-flatpak/src/metadata.rs diff --git a/LICENSES/MPL-2.0.txt b/LICENSES/MPL-2.0.txt new file mode 100644 index 0000000..d0a1fa1 --- /dev/null +++ b/LICENSES/MPL-2.0.txt @@ -0,0 +1,373 @@ +Mozilla Public License Version 2.0 +================================== + +1. Definitions +-------------- + +1.1. "Contributor" + means each individual or legal entity that creates, contributes to + the creation of, or owns Covered Software. + +1.2. "Contributor Version" + means the combination of the Contributions of others (if any) used + by a Contributor and that particular Contributor's Contribution. + +1.3. "Contribution" + means Covered Software of a particular Contributor. + +1.4. "Covered Software" + means Source Code Form to which the initial Contributor has attached + the notice in Exhibit A, the Executable Form of such Source Code + Form, and Modifications of such Source Code Form, in each case + including portions thereof. + +1.5. "Incompatible With Secondary Licenses" + means + + (a) that the initial Contributor has attached the notice described + in Exhibit B to the Covered Software; or + + (b) that the Covered Software was made available under the terms of + version 1.1 or earlier of the License, but not also under the + terms of a Secondary License. + +1.6. "Executable Form" + means any form of the work other than Source Code Form. + +1.7. "Larger Work" + means a work that combines Covered Software with other material, in + a separate file or files, that is not Covered Software. + +1.8. "License" + means this document. + +1.9. "Licensable" + means having the right to grant, to the maximum extent possible, + whether at the time of the initial grant or subsequently, any and + all of the rights conveyed by this License. + +1.10. "Modifications" + means any of the following: + + (a) any file in Source Code Form that results from an addition to, + deletion from, or modification of the contents of Covered + Software; or + + (b) any new file in Source Code Form that contains any Covered + Software. + +1.11. "Patent Claims" of a Contributor + means any patent claim(s), including without limitation, method, + process, and apparatus claims, in any patent Licensable by such + Contributor that would be infringed, but for the grant of the + License, by the making, using, selling, offering for sale, having + made, import, or transfer of either its Contributions or its + Contributor Version. + +1.12. "Secondary License" + means either the GNU General Public License, Version 2.0, the GNU + Lesser General Public License, Version 2.1, the GNU Affero General + Public License, Version 3.0, or any later versions of those + licenses. + +1.13. "Source Code Form" + means the form of the work preferred for making modifications. + +1.14. "You" (or "Your") + means an individual or a legal entity exercising rights under this + License. For legal entities, "You" includes any entity that + controls, is controlled by, or is under common control with You. For + purposes of this definition, "control" means (a) the power, direct + or indirect, to cause the direction or management of such entity, + whether by contract or otherwise, or (b) ownership of more than + fifty percent (50%) of the outstanding shares or beneficial + ownership of such entity. + +2. License Grants and Conditions +-------------------------------- + +2.1. Grants + +Each Contributor hereby grants You a world-wide, royalty-free, +non-exclusive license: + +(a) under intellectual property rights (other than patent or trademark) + Licensable by such Contributor to use, reproduce, make available, + modify, display, perform, distribute, and otherwise exploit its + Contributions, either on an unmodified basis, with Modifications, or + as part of a Larger Work; and + +(b) under Patent Claims of such Contributor to make, use, sell, offer + for sale, have made, import, and otherwise transfer either its + Contributions or its Contributor Version. + +2.2. Effective Date + +The licenses granted in Section 2.1 with respect to any Contribution +become effective for each Contribution on the date the Contributor first +distributes such Contribution. + +2.3. Limitations on Grant Scope + +The licenses granted in this Section 2 are the only rights granted under +this License. No additional rights or licenses will be implied from the +distribution or licensing of Covered Software under this License. +Notwithstanding Section 2.1(b) above, no patent license is granted by a +Contributor: + +(a) for any code that a Contributor has removed from Covered Software; + or + +(b) for infringements caused by: (i) Your and any other third party's + modifications of Covered Software, or (ii) the combination of its + Contributions with other software (except as part of its Contributor + Version); or + +(c) under Patent Claims infringed by Covered Software in the absence of + its Contributions. + +This License does not grant any rights in the trademarks, service marks, +or logos of any Contributor (except as may be necessary to comply with +the notice requirements in Section 3.4). + +2.4. Subsequent Licenses + +No Contributor makes additional grants as a result of Your choice to +distribute the Covered Software under a subsequent version of this +License (see Section 10.2) or under the terms of a Secondary License (if +permitted under the terms of Section 3.3). + +2.5. Representation + +Each Contributor represents that the Contributor believes its +Contributions are its original creation(s) or it has sufficient rights +to grant the rights to its Contributions conveyed by this License. + +2.6. Fair Use + +This License is not intended to limit any rights You have under +applicable copyright doctrines of fair use, fair dealing, or other +equivalents. + +2.7. Conditions + +Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted +in Section 2.1. + +3. Responsibilities +------------------- + +3.1. Distribution of Source Form + +All distribution of Covered Software in Source Code Form, including any +Modifications that You create or to which You contribute, must be under +the terms of this License. You must inform recipients that the Source +Code Form of the Covered Software is governed by the terms of this +License, and how they can obtain a copy of this License. You may not +attempt to alter or restrict the recipients' rights in the Source Code +Form. + +3.2. Distribution of Executable Form + +If You distribute Covered Software in Executable Form then: + +(a) such Covered Software must also be made available in Source Code + Form, as described in Section 3.1, and You must inform recipients of + the Executable Form how they can obtain a copy of such Source Code + Form by reasonable means in a timely manner, at a charge no more + than the cost of distribution to the recipient; and + +(b) You may distribute such Executable Form under the terms of this + License, or sublicense it under different terms, provided that the + license for the Executable Form does not attempt to limit or alter + the recipients' rights in the Source Code Form under this License. + +3.3. Distribution of a Larger Work + +You may create and distribute a Larger Work under terms of Your choice, +provided that You also comply with the requirements of this License for +the Covered Software. If the Larger Work is a combination of Covered +Software with a work governed by one or more Secondary Licenses, and the +Covered Software is not Incompatible With Secondary Licenses, this +License permits You to additionally distribute such Covered Software +under the terms of such Secondary License(s), so that the recipient of +the Larger Work may, at their option, further distribute the Covered +Software under the terms of either this License or such Secondary +License(s). + +3.4. Notices + +You may not remove or alter the substance of any license notices +(including copyright notices, patent notices, disclaimers of warranty, +or limitations of liability) contained within the Source Code Form of +the Covered Software, except that You may alter any license notices to +the extent required to remedy known factual inaccuracies. + +3.5. Application of Additional Terms + +You may choose to offer, and to charge a fee for, warranty, support, +indemnity or liability obligations to one or more recipients of Covered +Software. However, You may do so only on Your own behalf, and not on +behalf of any Contributor. You must make it absolutely clear that any +such warranty, support, indemnity, or liability obligation is offered by +You alone, and You hereby agree to indemnify every Contributor for any +liability incurred by such Contributor as a result of warranty, support, +indemnity or liability terms You offer. You may include additional +disclaimers of warranty and limitations of liability specific to any +jurisdiction. + +4. Inability to Comply Due to Statute or Regulation +--------------------------------------------------- + +If it is impossible for You to comply with any of the terms of this +License with respect to some or all of the Covered Software due to +statute, judicial order, or regulation then You must: (a) comply with +the terms of this License to the maximum extent possible; and (b) +describe the limitations and the code they affect. Such description must +be placed in a text file included with all distributions of the Covered +Software under this License. Except to the extent prohibited by statute +or regulation, such description must be sufficiently detailed for a +recipient of ordinary skill to be able to understand it. + +5. Termination +-------------- + +5.1. The rights granted under this License will terminate automatically +if You fail to comply with any of its terms. However, if You become +compliant, then the rights granted under this License from a particular +Contributor are reinstated (a) provisionally, unless and until such +Contributor explicitly and finally terminates Your grants, and (b) on an +ongoing basis, if such Contributor fails to notify You of the +non-compliance by some reasonable means prior to 60 days after You have +come back into compliance. Moreover, Your grants from a particular +Contributor are reinstated on an ongoing basis if such Contributor +notifies You of the non-compliance by some reasonable means, this is the +first time You have received notice of non-compliance with this License +from such Contributor, and You become compliant prior to 30 days after +Your receipt of the notice. + +5.2. If You initiate litigation against any entity by asserting a patent +infringement claim (excluding declaratory judgment actions, +counter-claims, and cross-claims) alleging that a Contributor Version +directly or indirectly infringes any patent, then the rights granted to +You by any and all Contributors for the Covered Software under Section +2.1 of this License shall terminate. + +5.3. In the event of termination under Sections 5.1 or 5.2 above, all +end user license agreements (excluding distributors and resellers) which +have been validly granted by You or Your distributors under this License +prior to termination shall survive termination. + +************************************************************************ +* * +* 6. Disclaimer of Warranty * +* ------------------------- * +* * +* Covered Software is provided under this License on an "as is" * +* basis, without warranty of any kind, either expressed, implied, or * +* statutory, including, without limitation, warranties that the * +* Covered Software is free of defects, merchantable, fit for a * +* particular purpose or non-infringing. The entire risk as to the * +* quality and performance of the Covered Software is with You. * +* Should any Covered Software prove defective in any respect, You * +* (not any Contributor) assume the cost of any necessary servicing, * +* repair, or correction. This disclaimer of warranty constitutes an * +* essential part of this License. No use of any Covered Software is * +* authorized under this License except under this disclaimer. * +* * +************************************************************************ + +************************************************************************ +* * +* 7. Limitation of Liability * +* -------------------------- * +* * +* Under no circumstances and under no legal theory, whether tort * +* (including negligence), contract, or otherwise, shall any * +* Contributor, or anyone who distributes Covered Software as * +* permitted above, be liable to You for any direct, indirect, * +* special, incidental, or consequential damages of any character * +* including, without limitation, damages for lost profits, loss of * +* goodwill, work stoppage, computer failure or malfunction, or any * +* and all other commercial damages or losses, even if such party * +* shall have been informed of the possibility of such damages. This * +* limitation of liability shall not apply to liability for death or * +* personal injury resulting from such party's negligence to the * +* extent applicable law prohibits such limitation. Some * +* jurisdictions do not allow the exclusion or limitation of * +* incidental or consequential damages, so this exclusion and * +* limitation may not apply to You. * +* * +************************************************************************ + +8. Litigation +------------- + +Any litigation relating to this License may be brought only in the +courts of a jurisdiction where the defendant maintains its principal +place of business and such litigation shall be governed by laws of that +jurisdiction, without reference to its conflict-of-law provisions. +Nothing in this Section shall prevent a party's ability to bring +cross-claims or counter-claims. + +9. Miscellaneous +---------------- + +This License represents the complete agreement concerning the subject +matter hereof. If any provision of this License is held to be +unenforceable, such provision shall be reformed only to the extent +necessary to make it enforceable. Any law or regulation which provides +that the language of a contract shall be construed against the drafter +shall not be used to construe this License against a Contributor. + +10. Versions of the License +--------------------------- + +10.1. New Versions + +Mozilla Foundation is the license steward. Except as provided in Section +10.3, no one other than the license steward has the right to modify or +publish new versions of this License. Each version will be given a +distinguishing version number. + +10.2. Effect of New Versions + +You may distribute the Covered Software under the terms of the version +of the License under which You originally received the Covered Software, +or under the terms of any subsequent version published by the license +steward. + +10.3. Modified Versions + +If you create software not governed by this License, and you want to +create a new license for such software, you may create and use a +modified version of this License if you rename the license and remove +any references to the name of the license steward (except to note that +such modified license differs from this License). + +10.4. Distributing Source Code Form that is Incompatible With Secondary +Licenses + +If You choose to distribute Source Code Form that is Incompatible With +Secondary Licenses under the terms of this version of the License, the +notice described in Exhibit B of this License must be attached. + +Exhibit A - Source Code Form License Notice +------------------------------------------- + + This Source Code Form is subject to the terms of the Mozilla Public + License, v. 2.0. If a copy of the MPL was not distributed with this + file, You can obtain one at https://mozilla.org/MPL/2.0/. + +If it is not possible or desirable to put the notice in a particular +file, then You may include the notice in a location (such as a LICENSE +file in a relevant directory) where a recipient would be likely to look +for such a notice. + +You may add additional accurate notices of copyright ownership. + +Exhibit B - "Incompatible With Secondary Licenses" Notice +--------------------------------------------------------- + + This Source Code Form is "Incompatible With Secondary Licenses", as + defined by the Mozilla Public License, v. 2.0. diff --git a/pkgs/default.nix b/pkgs/default.nix index cc60228..6829185 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -36,6 +36,7 @@ let path: (import path { inherit (self) callPackage; }).override; rootfs = self.callSpectrumPackage ../host/rootfs {}; + mount-flatpak = self.callSpectrumPackage ../tools/mount-flatpak {}; spectrum-build-tools = self.callSpectrumPackage ../tools { appSupport = false; buildSupport = true; diff --git a/tools/mount-flatpak/Cargo.lock b/tools/mount-flatpak/Cargo.lock new file mode 100644 index 0000000..8cb5663 --- /dev/null +++ b/tools/mount-flatpak/Cargo.lock @@ -0,0 +1,238 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 4 + +[[package]] +name = "bitflags" +version = "2.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3" + +[[package]] +name = "cfg-if" +version = "1.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" + +[[package]] +name = "either" +version = "1.15.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719" + +[[package]] +name = "errno" +version = "0.3.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" +dependencies = [ + "libc", + "windows-sys", +] + +[[package]] +name = "fastrand" +version = "2.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be" + +[[package]] +name = "getrandom" +version = "0.3.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" +dependencies = [ + "cfg-if", + "libc", + "r-efi", + "wasip2", +] + +[[package]] +name = "itertools" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285" +dependencies = [ + "either", +] + +[[package]] +name = "libc" +version = "0.2.177" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976" + +[[package]] +name = "linux-raw-sys" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039" + +[[package]] +name = "memchr" +version = "2.7.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273" + +[[package]] +name = "mount-flatpak" +version = "0.0.0" +dependencies = [ + "libc", + "pathrs", + "rustix", +] + +[[package]] +name = "once_cell" +version = "1.21.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" + +[[package]] +name = "pathrs" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c63f58f2463b3eecc7d285eace144d8c4820631d018d927049f8569be4b3b1a4" +dependencies = [ + "bitflags", + "itertools", + "libc", + "memchr", + "once_cell", + "rustix", + "rustversion", + "static_assertions", + "tempfile", + "thiserror", +] + +[[package]] +name = "proc-macro2" +version = "1.0.103" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8" +dependencies = [ + "unicode-ident", +] + +[[package]] +name = "quote" +version = "1.0.42" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f" +dependencies = [ + "proc-macro2", +] + +[[package]] +name = "r-efi" +version = "5.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f" + +[[package]] +name = "rustix" +version = "1.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e" +dependencies = [ + "bitflags", + "errno", + "libc", + "linux-raw-sys", + "windows-sys", +] + +[[package]] +name = "rustversion" +version = "1.0.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" + +[[package]] +name = "static_assertions" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f" + +[[package]] +name = "syn" +version = "2.0.111" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "390cc9a294ab71bdb1aa2e99d13be9c753cd2d7bd6560c77118597410c4d2e87" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + +[[package]] +name = "tempfile" +version = "3.23.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16" +dependencies = [ + "fastrand", + "getrandom", + "once_cell", + "rustix", + "windows-sys", +] + +[[package]] +name = "thiserror" +version = "2.0.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8" +dependencies = [ + "thiserror-impl", +] + +[[package]] +name = "thiserror-impl" +version = "2.0.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + +[[package]] +name = "unicode-ident" +version = "1.0.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5" + +[[package]] +name = "wasip2" +version = "1.0.1+wasi-0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7" +dependencies = [ + "wit-bindgen", +] + +[[package]] +name = "windows-link" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5" + +[[package]] +name = "windows-sys" +version = "0.61.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc" +dependencies = [ + "windows-link", +] + +[[package]] +name = "wit-bindgen" +version = "0.46.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59" diff --git a/tools/mount-flatpak/Cargo.lock.license b/tools/mount-flatpak/Cargo.lock.license new file mode 100644 index 0000000..d705e97 --- /dev/null +++ b/tools/mount-flatpak/Cargo.lock.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2024 Alyssa Ross <hi(a)alyssa.is> diff --git a/tools/mount-flatpak/Cargo.toml b/tools/mount-flatpak/Cargo.toml new file mode 100644 index 0000000..670be2f --- /dev/null +++ b/tools/mount-flatpak/Cargo.toml @@ -0,0 +1,11 @@ +# SPDX-License-Identifier: CC0-1.0 +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +[package] +name = "mount-flatpak" +edition = "2024" + +[dependencies] +libc = "0.2.177" +pathrs = "0.2.1" +rustix = "1.1.2" diff --git a/tools/mount-flatpak/config b/tools/mount-flatpak/config new file mode 100644 index 0000000..b3c2bee --- /dev/null +++ b/tools/mount-flatpak/config @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: CC0-1.0 +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +[core] +repo_version=1 +mode=bare-user-only +min-free-space-size=500MB diff --git a/tools/mount-flatpak/default.nix b/tools/mount-flatpak/default.nix new file mode 100644 index 0000000..f364fd7 --- /dev/null +++ b/tools/mount-flatpak/default.nix @@ -0,0 +1,25 @@ +# SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> +# SPDX-License-Identifier: MIT + +import ../../lib/call-package.nix ( +{ src, lib, rustPlatform }: + +rustPlatform.buildRustPackage { + name = "mount-flatpak"; + + src = lib.fileset.toSource { + root = ../..; + fileset = lib.fileset.intersection src ./.; + }; + sourceRoot = "source/tools/mount-flatpak"; + + cargoLock.lockFile = ./Cargo.lock; + + env = { + MOUNT_FLATPAK_CONFIG_PATH = "${placeholder "out"}/share/spectrum/flatpak-config"; + }; + + postInstall = '' + install -Dm 0755 config $MOUNT_FLATPAK_CONFIG_PATH + ''; +}) (_: {}) diff --git a/tools/mount-flatpak/src/keyfile.rs b/tools/mount-flatpak/src/keyfile.rs new file mode 100644 index 0000000..fa746b3 --- /dev/null +++ b/tools/mount-flatpak/src/keyfile.rs @@ -0,0 +1,189 @@ +// Copyright 2021 System76 <info(a)system76.com> +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> +// SPDX-License-Identifier: MPL-2.0 + +// Adapted from freedesktop-desktop-entry 0.7.19. + +use std::collections::BTreeMap; +use std::fmt::{self, Display, Formatter}; + +type Group = BTreeMap<String, String>; + +#[derive(Debug)] +pub enum DecodeError { + KeyValueWithoutAGroup, + InvalidKey, + InvalidValue, +} + +impl Display for DecodeError { + fn fmt(&self, f: &mut Formatter) -> fmt::Result { + match self { + Self::KeyValueWithoutAGroup => write!(f, "key/value without a group"), + Self::InvalidKey => write!(f, "invalid key"), + Self::InvalidValue => write!(f, "invalid value"), + } + } +} + +pub fn parse(input: &str) -> Result<BTreeMap<String, Group>, DecodeError> { + let mut groups = BTreeMap::default(); + let mut active_group: Option<ActiveGroup> = None; + let mut active_keys: Option<ActiveKeys> = None; + + for line in input.lines() { + process_line(line, &mut groups, &mut active_group, &mut active_keys)?; + } + + if let Some(active_keys) = active_keys.take() { + match &mut active_group { + Some(active_group) => { + active_group + .group + .insert(active_keys.key_name, active_keys.value); + } + None => return Err(DecodeError::KeyValueWithoutAGroup), + } + } + + if let Some(mut group) = active_group.take() { + groups + .entry(group.group_name) + .or_default() + .append(&mut group.group); + } + + Ok(groups) +} + +struct ActiveGroup { + group_name: String, + group: Group, +} + +struct ActiveKeys { + key_name: String, + value: String, +} + +#[inline(never)] +fn process_line( + line: &str, + groups: &mut BTreeMap<String, Group>, + active_group: &mut Option<ActiveGroup>, + active_keys: &mut Option<ActiveKeys>, +) -> Result<(), DecodeError> { + if line.trim().is_empty() || line.starts_with('#') { + return Ok(()); + } + + let line_bytes = line.as_bytes(); + + // if group + if line_bytes[0] == b'[' { + if let Some(end) = line_bytes[1..].iter().rposition(|&b| b == b']') { + let group_name = &line[1..end + 1]; + + if let Some(active_keys) = active_keys.take() { + match active_group { + Some(active_group) => { + active_group + .group + .insert(active_keys.key_name, active_keys.value); + } + None => return Err(DecodeError::KeyValueWithoutAGroup), + } + } + + if let Some(mut group) = active_group.take() { + groups + .entry(group.group_name) + .or_default() + .append(&mut group.group); + } + + active_group.replace(ActiveGroup { + group_name: group_name.to_string(), + group: Group::default(), + }); + } + } + // else, if value + else if let Some(delimiter) = line_bytes.iter().position(|&b| b == b'=') { + let key = &line[..delimiter]; + let value = format_value(&line[delimiter + 1..])?; + + if key.is_empty() { + return Err(DecodeError::InvalidKey); + } + + if let Some(active_keys) = active_keys.take() { + match active_group { + Some(active_group) => { + active_group + .group + .insert(active_keys.key_name, active_keys.value); + } + None => return Err(DecodeError::KeyValueWithoutAGroup), + } + } + active_keys.replace(ActiveKeys { + key_name: key.trim().to_string(), + value, + }); + } + Ok(()) +} + +// https://specifications.freedesktop.org/desktop-entry-spec/latest/value-type… +#[inline] +fn format_value(input: &str) -> Result<String, DecodeError> { + let input = if let Some(input) = input.strip_prefix(" ") { + input + } else { + input + }; + + let mut res = String::with_capacity(input.len()); + + let mut last: usize = 0; + + for (i, v) in input.as_bytes().iter().enumerate() { + if *v != b'\\' { + continue; + } + + // edge case for // + if last > i { + continue; + } + + // when there is an \ at the end + if input.len() <= i + 1 { + return Err(DecodeError::InvalidValue); + } + + if last < i { + res.push_str(&input[last..i]); + } + + last = i + 2; + + match input.as_bytes()[i + 1] { + b's' => res.push(' '), + b'n' => res.push('\n'), + b't' => res.push('\t'), + b'r' => res.push('\r'), + b'\\' => res.push('\\'), + _ => { + return Err(DecodeError::InvalidValue); + } + } + } + + if last < input.len() { + res.push_str(&input[last..input.len()]); + } + + Ok(res) +} diff --git a/tools/mount-flatpak/src/main.rs b/tools/mount-flatpak/src/main.rs new file mode 100644 index 0000000..f62f88b --- /dev/null +++ b/tools/mount-flatpak/src/main.rs @@ -0,0 +1,249 @@ +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> +// SPDX-License-Identifier: EUPL-1.2+ + +mod keyfile; +mod metadata; + +use std::borrow::Cow; +use std::env::{ArgsOs, args_os}; +use std::ffi::OsStr; +use std::io; +use std::os::unix::prelude::*; +use std::path::{Path, PathBuf}; +use std::process::exit; + +use pathrs::Root; +use pathrs::flags::{OpenFlags, ResolverFlags}; +use rustix::fs::{CWD, FileType, fstat}; +use rustix::mount::{MoveMountFlags, OpenTreeFlags, move_mount, open_tree}; + +use metadata::extract_runtime; + +fn ex_usage() -> ! { + eprintln!("Usage: mount-flatpak installation app"); + exit(1); +} + +fn run(mut args: ArgsOs) -> Result<(), String> { + let Some(installation_path) = args.next() else { + ex_usage(); + }; + let Some(app) = args.next() else { + ex_usage(); + }; + if args.next().is_some() { + ex_usage(); + } + + let mut source_installation_dir = Root::open(installation_path) + .map_err(|e| format!("opening source flatpak installation: {e}"))?; + source_installation_dir.set_resolver_flags(ResolverFlags::NO_SYMLINKS); + + std::fs::create_dir("flatpak") + .map_err(|e| format!("creating target flatpak installation: {e}"))?; + + let target_installation_dir = open_tree( + CWD, + "flatpak", + OpenTreeFlags::OPEN_TREE_CLONE + | OpenTreeFlags::OPEN_TREE_CLOEXEC + | OpenTreeFlags::AT_RECURSIVE, + ) + .map_err(|e| format!("opening target flatpak installation: {e}"))?; + let mut target_installation_dir = Root::from_fd(target_installation_dir); + target_installation_dir.set_resolver_flags(ResolverFlags::NO_SYMLINKS); + + let mut full_app_path = PathBuf::from("app"); + full_app_path.push(&app); + full_app_path.push("current"); + let arch_and_branch = source_installation_dir + .readlink(&full_app_path) + .map_err(|e| format!("reading current app arch and branch: {e}"))?; + let mut components = arch_and_branch.components(); + let arch = components.next().unwrap().as_os_str(); + let branch = components.as_path().as_os_str(); + if branch.is_empty() { + return Err("can't infer branch from \"current\" link".to_string()); + } + + full_app_path.pop(); + full_app_path.push(&arch_and_branch); + full_app_path.push("active"); + let commit = source_installation_dir + .readlink(&full_app_path) + .map_err(|e| format!("reading active app commit: {e}"))? + .into_os_string(); + + full_app_path.pop(); + full_app_path.push(&commit); + let source_app_dir = source_installation_dir + .resolve(&full_app_path) + .map_err(|e| format!("opening source app directory: {e}"))?; + + let metadata = source_installation_dir + .resolve(full_app_path.join("metadata")) + .map_err(|e| format!("resolving app metadata: {e}"))?; + + let metadata_stat = + fstat(&metadata).map_err(|e| format!("checking app metadata is a regular file: {e}"))?; + let metadata_type = FileType::from_raw_mode(metadata_stat.st_mode); + if !metadata_type.is_file() { + let e = format!("type of app metadata is {metadata_type:?}, not RegularFile"); + return Err(e); + } + let metadata = metadata + .reopen(OpenFlags::O_RDONLY) + .map_err(|e| format!("opening app metadata: {e}"))?; + + let runtime = + extract_runtime(metadata).map_err(|e| format!("reading runtime from metadata: {e}"))?; + + let mut full_runtime_path = PathBuf::from("runtime"); + full_runtime_path.push(runtime); + full_runtime_path.push("active"); + let runtime_commit = source_installation_dir + .readlink(&full_runtime_path) + .map_err(|e| format!("reading active runtime commit: {e}"))? + .into_os_string(); + + full_runtime_path.pop(); + full_runtime_path.push(&runtime_commit); + let source_runtime_dir = source_installation_dir + .resolve(&full_runtime_path) + .map_err(|e| format!("opening source runtime directory: {e}"))?; + + let target_app_dir = target_installation_dir + .mkdir_all(&full_app_path, &PermissionsExt::from_mode(0o700)) + .map_err(|e| format!("creating target app directory: {e}"))?; + let target_runtime_dir = target_installation_dir + .mkdir_all(&full_runtime_path, &PermissionsExt::from_mode(0o700)) + .map_err(|e| format!("creating target runtime directory: {e}"))?; + + let source_app_tree = open_tree( + &source_app_dir, + "", + OpenTreeFlags::AT_EMPTY_PATH + | OpenTreeFlags::OPEN_TREE_CLONE + | OpenTreeFlags::OPEN_TREE_CLOEXEC + | OpenTreeFlags::AT_RECURSIVE, + ) + .map_err(|e| format!("cloning source app tree: {e}"))?; + let source_runtime_tree = open_tree( + &source_runtime_dir, + "", + OpenTreeFlags::AT_EMPTY_PATH + | OpenTreeFlags::OPEN_TREE_CLONE + | OpenTreeFlags::OPEN_TREE_CLOEXEC + | OpenTreeFlags::AT_RECURSIVE, + ) + .map_err(|e| format!("cloning source runtime tree: {e}"))?; + + move_mount( + source_app_tree, + "", + target_app_dir, + "", + MoveMountFlags::MOVE_MOUNT_F_EMPTY_PATH | MoveMountFlags::MOVE_MOUNT_T_EMPTY_PATH, + ) + .map_err(|e| format!("mounting app directory: {e}"))?; + move_mount( + source_runtime_tree, + "", + target_runtime_dir, + "", + MoveMountFlags::MOVE_MOUNT_F_EMPTY_PATH | MoveMountFlags::MOVE_MOUNT_T_EMPTY_PATH, + ) + .map_err(|e| format!("mounting runtime directory: {e}"))?; + + target_installation_dir + .mkdir_all("repo/objects", &PermissionsExt::from_mode(0o700)) + .map_err(|e| format!("creating repo/objects: {e}"))?; + target_installation_dir + .mkdir_all("repo/tmp/cache", &PermissionsExt::from_mode(0o700)) + .map_err(|e| format!("creating repo/tmp/cache: {e}"))?; + let config_target = target_installation_dir + .create_file( + "repo/config", + OpenFlags::O_WRONLY | OpenFlags::O_CLOEXEC, + &PermissionsExt::from_mode(0o700), + ) + .map_err(|e| format!("creating repo/config: {e}"))?; + let config_source_path = env!("MOUNT_FLATPAK_CONFIG_PATH"); + let config_source = open_tree( + CWD, + config_source_path, + OpenTreeFlags::OPEN_TREE_CLONE | OpenTreeFlags::OPEN_TREE_CLOEXEC, + ) + .map_err(|e| format!("opening {config_source_path}: {e}"))?; + move_mount( + config_source, + "", + config_target, + "", + MoveMountFlags::MOVE_MOUNT_F_EMPTY_PATH | MoveMountFlags::MOVE_MOUNT_T_EMPTY_PATH, + ) + .map_err(|e| format!("mounting config: {e}"))?; + + let mut attr = libc::mount_attr { + attr_clr: libc::MOUNT_ATTR_NOSYMFOLLOW, + attr_set: libc::MOUNT_ATTR_RDONLY | libc::MOUNT_ATTR_NODEV, + propagation: 0, + userns_fd: 0, + }; + let empty = b"\0"; + // SAFETY: we pass a valid FD, and a valid mutable pointer with the correct size. + unsafe { + let r = libc::syscall( + libc::SYS_mount_setattr, + target_installation_dir.as_fd(), + empty.as_ptr() as *const libc::c_char, + (libc::AT_EMPTY_PATH | libc::AT_RECURSIVE) as libc::c_uint, + &mut attr as *mut libc::mount_attr, + size_of::<libc::mount_attr>() as libc::size_t, + ); + if r == -1 { + return Err(format!( + "setting target mount attributes: {}", + io::Error::last_os_error() + )); + } + } + move_mount( + target_installation_dir, + "", + CWD, + "flatpak", + MoveMountFlags::MOVE_MOUNT_F_EMPTY_PATH, + ) + .map_err(|e| format!("mounting target installation dir: {e}"))?; + + std::fs::create_dir("params").map_err(|e| format!("creating params directory: {e}"))?; + std::fs::write("params/id", app.as_bytes()).map_err(|e| format!("writing params/id: {e}"))?; + std::fs::write("params/commit", commit.as_bytes()) + .map_err(|e| format!("writing params/commit: {e}"))?; + std::fs::write("params/arch", arch.as_bytes()) + .map_err(|e| format!("writing params/arch: {e}"))?; + std::fs::write("params/branch", branch.as_bytes()) + .map_err(|e| format!("writing params/branch: {e}"))?; + std::fs::write("params/runtime-commit", runtime_commit.as_bytes()) + .map_err(|e| format!("writing params/runtime-commit: {e}"))?; + + Ok(()) +} + +fn main() { + let mut args = args_os(); + + let prog_name = args + .next() + .as_ref() + .map(Path::new) + .and_then(Path::file_name) + .map_or(Cow::Borrowed("mount-flatpak"), OsStr::to_string_lossy) + .into_owned(); + + if let Err(e) = run(args) { + eprintln!("{prog_name}: {e}"); + exit(1); + } +} diff --git a/tools/mount-flatpak/src/metadata.rs b/tools/mount-flatpak/src/metadata.rs new file mode 100644 index 0000000..dfc05b1 --- /dev/null +++ b/tools/mount-flatpak/src/metadata.rs @@ -0,0 +1,19 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +use std::fs::File; +use std::io::read_to_string; + +use crate::keyfile::parse; + +pub fn extract_runtime(mut metadata: File) -> Result<String, String> { + let metadata = read_to_string(&mut metadata).map_err(|e| e.to_string())?; + let group = parse(&metadata).map_err(|e| e.to_string())?; + let application = group + .get("Application") + .ok_or_else(|| "Application group missing".to_string())?; + Ok(application + .get("runtime") + .ok_or_else(|| "runtime property missing".to_string())? + .clone()) +} base-commit: aa5ab817d6eb990683a88893a6375acef7a585aa -- 2.51.0

1 2

[REGRESSION] Cloud Hypervisor crashes when guest writes to VSOCK
by Alyssa Ross 24 Nov '25

24 Nov '25

This notably happens when an application that uses portals starts up and the org.freedesktop.impl.portal.desktop.spectrum D-Bus service is activated. Already fixed upstream in Cloud Hypervisor: https://github.com/cloud-hypervisor/cloud-hypervisor/pull/7477 Proposed a backport in Nixpkgs: https://github.com/NixOS/nixpkgs/pull/464618

1 0

[PATCH 1/3] tools/mount-flatpak: init
by Alyssa Ross 24 Nov '25

24 Nov '25

Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- LICENSES/MPL-2.0.txt | 373 ++++++++++++++++++++++++++++ tools/default.nix | 7 +- tools/meson.build | 1 + tools/mount-flatpak/config | 7 + tools/mount-flatpak/keyfile.rs | 189 ++++++++++++++ tools/mount-flatpak/meson.build | 18 ++ tools/mount-flatpak/metadata.h | 4 + tools/mount-flatpak/metadata.rs | 47 ++++ tools/mount-flatpak/mount-flatpak.c | 294 ++++++++++++++++++++++ 9 files changed, 938 insertions(+), 2 deletions(-) create mode 100644 LICENSES/MPL-2.0.txt create mode 100644 tools/mount-flatpak/config create mode 100644 tools/mount-flatpak/keyfile.rs create mode 100644 tools/mount-flatpak/meson.build create mode 100644 tools/mount-flatpak/metadata.h create mode 100644 tools/mount-flatpak/metadata.rs create mode 100644 tools/mount-flatpak/mount-flatpak.c diff --git a/LICENSES/MPL-2.0.txt b/LICENSES/MPL-2.0.txt new file mode 100644 index 0000000..d0a1fa1 --- /dev/null +++ b/LICENSES/MPL-2.0.txt @@ -0,0 +1,373 @@ +Mozilla Public License Version 2.0 +================================== + +1. Definitions +-------------- + +1.1. "Contributor" + means each individual or legal entity that creates, contributes to + the creation of, or owns Covered Software. + +1.2. "Contributor Version" + means the combination of the Contributions of others (if any) used + by a Contributor and that particular Contributor's Contribution. + +1.3. "Contribution" + means Covered Software of a particular Contributor. + +1.4. "Covered Software" + means Source Code Form to which the initial Contributor has attached + the notice in Exhibit A, the Executable Form of such Source Code + Form, and Modifications of such Source Code Form, in each case + including portions thereof. + +1.5. "Incompatible With Secondary Licenses" + means + + (a) that the initial Contributor has attached the notice described + in Exhibit B to the Covered Software; or + + (b) that the Covered Software was made available under the terms of + version 1.1 or earlier of the License, but not also under the + terms of a Secondary License. + +1.6. "Executable Form" + means any form of the work other than Source Code Form. + +1.7. "Larger Work" + means a work that combines Covered Software with other material, in + a separate file or files, that is not Covered Software. + +1.8. "License" + means this document. + +1.9. "Licensable" + means having the right to grant, to the maximum extent possible, + whether at the time of the initial grant or subsequently, any and + all of the rights conveyed by this License. + +1.10. "Modifications" + means any of the following: + + (a) any file in Source Code Form that results from an addition to, + deletion from, or modification of the contents of Covered + Software; or + + (b) any new file in Source Code Form that contains any Covered + Software. + +1.11. "Patent Claims" of a Contributor + means any patent claim(s), including without limitation, method, + process, and apparatus claims, in any patent Licensable by such + Contributor that would be infringed, but for the grant of the + License, by the making, using, selling, offering for sale, having + made, import, or transfer of either its Contributions or its + Contributor Version. + +1.12. "Secondary License" + means either the GNU General Public License, Version 2.0, the GNU + Lesser General Public License, Version 2.1, the GNU Affero General + Public License, Version 3.0, or any later versions of those + licenses. + +1.13. "Source Code Form" + means the form of the work preferred for making modifications. + +1.14. "You" (or "Your") + means an individual or a legal entity exercising rights under this + License. For legal entities, "You" includes any entity that + controls, is controlled by, or is under common control with You. For + purposes of this definition, "control" means (a) the power, direct + or indirect, to cause the direction or management of such entity, + whether by contract or otherwise, or (b) ownership of more than + fifty percent (50%) of the outstanding shares or beneficial + ownership of such entity. + +2. License Grants and Conditions +-------------------------------- + +2.1. Grants + +Each Contributor hereby grants You a world-wide, royalty-free, +non-exclusive license: + +(a) under intellectual property rights (other than patent or trademark) + Licensable by such Contributor to use, reproduce, make available, + modify, display, perform, distribute, and otherwise exploit its + Contributions, either on an unmodified basis, with Modifications, or + as part of a Larger Work; and + +(b) under Patent Claims of such Contributor to make, use, sell, offer + for sale, have made, import, and otherwise transfer either its + Contributions or its Contributor Version. + +2.2. Effective Date + +The licenses granted in Section 2.1 with respect to any Contribution +become effective for each Contribution on the date the Contributor first +distributes such Contribution. + +2.3. Limitations on Grant Scope + +The licenses granted in this Section 2 are the only rights granted under +this License. No additional rights or licenses will be implied from the +distribution or licensing of Covered Software under this License. +Notwithstanding Section 2.1(b) above, no patent license is granted by a +Contributor: + +(a) for any code that a Contributor has removed from Covered Software; + or + +(b) for infringements caused by: (i) Your and any other third party's + modifications of Covered Software, or (ii) the combination of its + Contributions with other software (except as part of its Contributor + Version); or + +(c) under Patent Claims infringed by Covered Software in the absence of + its Contributions. + +This License does not grant any rights in the trademarks, service marks, +or logos of any Contributor (except as may be necessary to comply with +the notice requirements in Section 3.4). + +2.4. Subsequent Licenses + +No Contributor makes additional grants as a result of Your choice to +distribute the Covered Software under a subsequent version of this +License (see Section 10.2) or under the terms of a Secondary License (if +permitted under the terms of Section 3.3). + +2.5. Representation + +Each Contributor represents that the Contributor believes its +Contributions are its original creation(s) or it has sufficient rights +to grant the rights to its Contributions conveyed by this License. + +2.6. Fair Use + +This License is not intended to limit any rights You have under +applicable copyright doctrines of fair use, fair dealing, or other +equivalents. + +2.7. Conditions + +Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted +in Section 2.1. + +3. Responsibilities +------------------- + +3.1. Distribution of Source Form + +All distribution of Covered Software in Source Code Form, including any +Modifications that You create or to which You contribute, must be under +the terms of this License. You must inform recipients that the Source +Code Form of the Covered Software is governed by the terms of this +License, and how they can obtain a copy of this License. You may not +attempt to alter or restrict the recipients' rights in the Source Code +Form. + +3.2. Distribution of Executable Form + +If You distribute Covered Software in Executable Form then: + +(a) such Covered Software must also be made available in Source Code + Form, as described in Section 3.1, and You must inform recipients of + the Executable Form how they can obtain a copy of such Source Code + Form by reasonable means in a timely manner, at a charge no more + than the cost of distribution to the recipient; and + +(b) You may distribute such Executable Form under the terms of this + License, or sublicense it under different terms, provided that the + license for the Executable Form does not attempt to limit or alter + the recipients' rights in the Source Code Form under this License. + +3.3. Distribution of a Larger Work + +You may create and distribute a Larger Work under terms of Your choice, +provided that You also comply with the requirements of this License for +the Covered Software. If the Larger Work is a combination of Covered +Software with a work governed by one or more Secondary Licenses, and the +Covered Software is not Incompatible With Secondary Licenses, this +License permits You to additionally distribute such Covered Software +under the terms of such Secondary License(s), so that the recipient of +the Larger Work may, at their option, further distribute the Covered +Software under the terms of either this License or such Secondary +License(s). + +3.4. Notices + +You may not remove or alter the substance of any license notices +(including copyright notices, patent notices, disclaimers of warranty, +or limitations of liability) contained within the Source Code Form of +the Covered Software, except that You may alter any license notices to +the extent required to remedy known factual inaccuracies. + +3.5. Application of Additional Terms + +You may choose to offer, and to charge a fee for, warranty, support, +indemnity or liability obligations to one or more recipients of Covered +Software. However, You may do so only on Your own behalf, and not on +behalf of any Contributor. You must make it absolutely clear that any +such warranty, support, indemnity, or liability obligation is offered by +You alone, and You hereby agree to indemnify every Contributor for any +liability incurred by such Contributor as a result of warranty, support, +indemnity or liability terms You offer. You may include additional +disclaimers of warranty and limitations of liability specific to any +jurisdiction. + +4. Inability to Comply Due to Statute or Regulation +--------------------------------------------------- + +If it is impossible for You to comply with any of the terms of this +License with respect to some or all of the Covered Software due to +statute, judicial order, or regulation then You must: (a) comply with +the terms of this License to the maximum extent possible; and (b) +describe the limitations and the code they affect. Such description must +be placed in a text file included with all distributions of the Covered +Software under this License. Except to the extent prohibited by statute +or regulation, such description must be sufficiently detailed for a +recipient of ordinary skill to be able to understand it. + +5. Termination +-------------- + +5.1. The rights granted under this License will terminate automatically +if You fail to comply with any of its terms. However, if You become +compliant, then the rights granted under this License from a particular +Contributor are reinstated (a) provisionally, unless and until such +Contributor explicitly and finally terminates Your grants, and (b) on an +ongoing basis, if such Contributor fails to notify You of the +non-compliance by some reasonable means prior to 60 days after You have +come back into compliance. Moreover, Your grants from a particular +Contributor are reinstated on an ongoing basis if such Contributor +notifies You of the non-compliance by some reasonable means, this is the +first time You have received notice of non-compliance with this License +from such Contributor, and You become compliant prior to 30 days after +Your receipt of the notice. + +5.2. If You initiate litigation against any entity by asserting a patent +infringement claim (excluding declaratory judgment actions, +counter-claims, and cross-claims) alleging that a Contributor Version +directly or indirectly infringes any patent, then the rights granted to +You by any and all Contributors for the Covered Software under Section +2.1 of this License shall terminate. + +5.3. In the event of termination under Sections 5.1 or 5.2 above, all +end user license agreements (excluding distributors and resellers) which +have been validly granted by You or Your distributors under this License +prior to termination shall survive termination. + +************************************************************************ +* * +* 6. Disclaimer of Warranty * +* ------------------------- * +* * +* Covered Software is provided under this License on an "as is" * +* basis, without warranty of any kind, either expressed, implied, or * +* statutory, including, without limitation, warranties that the * +* Covered Software is free of defects, merchantable, fit for a * +* particular purpose or non-infringing. The entire risk as to the * +* quality and performance of the Covered Software is with You. * +* Should any Covered Software prove defective in any respect, You * +* (not any Contributor) assume the cost of any necessary servicing, * +* repair, or correction. This disclaimer of warranty constitutes an * +* essential part of this License. No use of any Covered Software is * +* authorized under this License except under this disclaimer. * +* * +************************************************************************ + +************************************************************************ +* * +* 7. Limitation of Liability * +* -------------------------- * +* * +* Under no circumstances and under no legal theory, whether tort * +* (including negligence), contract, or otherwise, shall any * +* Contributor, or anyone who distributes Covered Software as * +* permitted above, be liable to You for any direct, indirect, * +* special, incidental, or consequential damages of any character * +* including, without limitation, damages for lost profits, loss of * +* goodwill, work stoppage, computer failure or malfunction, or any * +* and all other commercial damages or losses, even if such party * +* shall have been informed of the possibility of such damages. This * +* limitation of liability shall not apply to liability for death or * +* personal injury resulting from such party's negligence to the * +* extent applicable law prohibits such limitation. Some * +* jurisdictions do not allow the exclusion or limitation of * +* incidental or consequential damages, so this exclusion and * +* limitation may not apply to You. * +* * +************************************************************************ + +8. Litigation +------------- + +Any litigation relating to this License may be brought only in the +courts of a jurisdiction where the defendant maintains its principal +place of business and such litigation shall be governed by laws of that +jurisdiction, without reference to its conflict-of-law provisions. +Nothing in this Section shall prevent a party's ability to bring +cross-claims or counter-claims. + +9. Miscellaneous +---------------- + +This License represents the complete agreement concerning the subject +matter hereof. If any provision of this License is held to be +unenforceable, such provision shall be reformed only to the extent +necessary to make it enforceable. Any law or regulation which provides +that the language of a contract shall be construed against the drafter +shall not be used to construe this License against a Contributor. + +10. Versions of the License +--------------------------- + +10.1. New Versions + +Mozilla Foundation is the license steward. Except as provided in Section +10.3, no one other than the license steward has the right to modify or +publish new versions of this License. Each version will be given a +distinguishing version number. + +10.2. Effect of New Versions + +You may distribute the Covered Software under the terms of the version +of the License under which You originally received the Covered Software, +or under the terms of any subsequent version published by the license +steward. + +10.3. Modified Versions + +If you create software not governed by this License, and you want to +create a new license for such software, you may create and use a +modified version of this License if you rename the license and remove +any references to the name of the license steward (except to note that +such modified license differs from this License). + +10.4. Distributing Source Code Form that is Incompatible With Secondary +Licenses + +If You choose to distribute Source Code Form that is Incompatible With +Secondary Licenses under the terms of this version of the License, the +notice described in Exhibit B of this License must be attached. + +Exhibit A - Source Code Form License Notice +------------------------------------------- + + This Source Code Form is subject to the terms of the Mozilla Public + License, v. 2.0. If a copy of the MPL was not distributed with this + file, You can obtain one at https://mozilla.org/MPL/2.0/. + +If it is not possible or desirable to put the notice in a particular +file, then You may include the notice in a location (such as a LICENSE +file in a relevant directory) where a recipient would be likely to look +for such a notice. + +You may add additional accurate notices of copyright ownership. + +Exhibit B - "Incompatible With Secondary Licenses" Notice +--------------------------------------------------------- + + This Source Code Form is "Incompatible With Secondary Licenses", as + defined by the Mozilla Public License, v. 2.0. diff --git a/tools/default.nix b/tools/default.nix index 27d4b82..27741b3 100644 --- a/tools/default.nix +++ b/tools/default.nix @@ -74,6 +74,7 @@ stdenv.mkDerivation (finalAttrs: { ./xdg-desktop-portal-spectrum ] ++ lib.optionals hostSupport [ ./lsvm + ./mount-flatpak ./sd-notify-adapter.c ./start-vmm ./subprojects @@ -88,8 +89,10 @@ stdenv.mkDerivation (finalAttrs: { ++ lib.optionals (appSupport || driverSupport) [ pkg-config ] ++ lib.optionals hostSupport [ rustc ] ++ lib.optionals driverSupport [ llvmPackages.clang-unwrapped ]; - buildInputs = lib.optionals appSupport [ dbus ] - ++ lib.optionals driverSupport [ libbpf linuxHeaders ]; + buildInputs = with stdenv.hostPlatform; lib.optionals appSupport [ dbus ] + ++ lib.optionals driverSupport [ libbpf linuxHeaders ] + # Workaround for <https://github.com/mesonbuild/meson/pull/15216>. + ++ lib.optionals (hostSupport && isMusl && isStatic) [ llvmPackages.libunwind ]; postPatch = lib.optionals hostSupport (lib.concatMapStringsSep "\n" (crate: '' mkdir -p subprojects/packagecache diff --git a/tools/meson.build b/tools/meson.build index d465e99..c024ca6 100644 --- a/tools/meson.build +++ b/tools/meson.build @@ -30,6 +30,7 @@ if get_option('host') install: true) subdir('lsvm') + subdir('mount-flatpak') subdir('start-vmm') endif diff --git a/tools/mount-flatpak/config b/tools/mount-flatpak/config new file mode 100644 index 0000000..b3c2bee --- /dev/null +++ b/tools/mount-flatpak/config @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: CC0-1.0 +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +[core] +repo_version=1 +mode=bare-user-only +min-free-space-size=500MB diff --git a/tools/mount-flatpak/keyfile.rs b/tools/mount-flatpak/keyfile.rs new file mode 100644 index 0000000..fa746b3 --- /dev/null +++ b/tools/mount-flatpak/keyfile.rs @@ -0,0 +1,189 @@ +// Copyright 2021 System76 <info(a)system76.com> +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> +// SPDX-License-Identifier: MPL-2.0 + +// Adapted from freedesktop-desktop-entry 0.7.19. + +use std::collections::BTreeMap; +use std::fmt::{self, Display, Formatter}; + +type Group = BTreeMap<String, String>; + +#[derive(Debug)] +pub enum DecodeError { + KeyValueWithoutAGroup, + InvalidKey, + InvalidValue, +} + +impl Display for DecodeError { + fn fmt(&self, f: &mut Formatter) -> fmt::Result { + match self { + Self::KeyValueWithoutAGroup => write!(f, "key/value without a group"), + Self::InvalidKey => write!(f, "invalid key"), + Self::InvalidValue => write!(f, "invalid value"), + } + } +} + +pub fn parse(input: &str) -> Result<BTreeMap<String, Group>, DecodeError> { + let mut groups = BTreeMap::default(); + let mut active_group: Option<ActiveGroup> = None; + let mut active_keys: Option<ActiveKeys> = None; + + for line in input.lines() { + process_line(line, &mut groups, &mut active_group, &mut active_keys)?; + } + + if let Some(active_keys) = active_keys.take() { + match &mut active_group { + Some(active_group) => { + active_group + .group + .insert(active_keys.key_name, active_keys.value); + } + None => return Err(DecodeError::KeyValueWithoutAGroup), + } + } + + if let Some(mut group) = active_group.take() { + groups + .entry(group.group_name) + .or_default() + .append(&mut group.group); + } + + Ok(groups) +} + +struct ActiveGroup { + group_name: String, + group: Group, +} + +struct ActiveKeys { + key_name: String, + value: String, +} + +#[inline(never)] +fn process_line( + line: &str, + groups: &mut BTreeMap<String, Group>, + active_group: &mut Option<ActiveGroup>, + active_keys: &mut Option<ActiveKeys>, +) -> Result<(), DecodeError> { + if line.trim().is_empty() || line.starts_with('#') { + return Ok(()); + } + + let line_bytes = line.as_bytes(); + + // if group + if line_bytes[0] == b'[' { + if let Some(end) = line_bytes[1..].iter().rposition(|&b| b == b']') { + let group_name = &line[1..end + 1]; + + if let Some(active_keys) = active_keys.take() { + match active_group { + Some(active_group) => { + active_group + .group + .insert(active_keys.key_name, active_keys.value); + } + None => return Err(DecodeError::KeyValueWithoutAGroup), + } + } + + if let Some(mut group) = active_group.take() { + groups + .entry(group.group_name) + .or_default() + .append(&mut group.group); + } + + active_group.replace(ActiveGroup { + group_name: group_name.to_string(), + group: Group::default(), + }); + } + } + // else, if value + else if let Some(delimiter) = line_bytes.iter().position(|&b| b == b'=') { + let key = &line[..delimiter]; + let value = format_value(&line[delimiter + 1..])?; + + if key.is_empty() { + return Err(DecodeError::InvalidKey); + } + + if let Some(active_keys) = active_keys.take() { + match active_group { + Some(active_group) => { + active_group + .group + .insert(active_keys.key_name, active_keys.value); + } + None => return Err(DecodeError::KeyValueWithoutAGroup), + } + } + active_keys.replace(ActiveKeys { + key_name: key.trim().to_string(), + value, + }); + } + Ok(()) +} + +// https://specifications.freedesktop.org/desktop-entry-spec/latest/value-type… +#[inline] +fn format_value(input: &str) -> Result<String, DecodeError> { + let input = if let Some(input) = input.strip_prefix(" ") { + input + } else { + input + }; + + let mut res = String::with_capacity(input.len()); + + let mut last: usize = 0; + + for (i, v) in input.as_bytes().iter().enumerate() { + if *v != b'\\' { + continue; + } + + // edge case for // + if last > i { + continue; + } + + // when there is an \ at the end + if input.len() <= i + 1 { + return Err(DecodeError::InvalidValue); + } + + if last < i { + res.push_str(&input[last..i]); + } + + last = i + 2; + + match input.as_bytes()[i + 1] { + b's' => res.push(' '), + b'n' => res.push('\n'), + b't' => res.push('\t'), + b'r' => res.push('\r'), + b'\\' => res.push('\\'), + _ => { + return Err(DecodeError::InvalidValue); + } + } + } + + if last < input.len() { + res.push_str(&input[last..input.len()]); + } + + Ok(res) +} diff --git a/tools/mount-flatpak/meson.build b/tools/mount-flatpak/meson.build new file mode 100644 index 0000000..e0c0a85 --- /dev/null +++ b/tools/mount-flatpak/meson.build @@ -0,0 +1,18 @@ +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +rust_lib = static_library('metadata', 'metadata.rs', rust_abi : 'c') + +conf_data = configuration_data() +conf_data.set_quoted('CONFIG_PATH', + get_option('prefix') / get_option('datadir') / 'spectrum/flatpak-config') +configure_file(output : 'config.h', configuration : conf_data) + +executable('mount-flatpak', 'mount-flatpak.c', + c_args : '-D_GNU_SOURCE', + link_with : rust_lib, + install : true) + +install_data('config', + rename : 'flatpak-config', + install_dir : get_option('datadir') / 'spectrum') diff --git a/tools/mount-flatpak/metadata.h b/tools/mount-flatpak/metadata.h new file mode 100644 index 0000000..d6441b7 --- /dev/null +++ b/tools/mount-flatpak/metadata.h @@ -0,0 +1,4 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +void extract_runtime(int metadata, char *runtime); diff --git a/tools/mount-flatpak/metadata.rs b/tools/mount-flatpak/metadata.rs new file mode 100644 index 0000000..0398416 --- /dev/null +++ b/tools/mount-flatpak/metadata.rs @@ -0,0 +1,47 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +mod keyfile; + +use std::env::args_os; +use std::ffi::OsString; +use std::fs::File; +use std::io::{read_to_string, stderr, Write}; +use std::os::fd::OwnedFd; +use std::os::unix::prelude::*; +use std::process::exit; + +use keyfile::parse; + +fn extract_runtime(mut metadata: File) -> Result<String, String> { + let metadata = read_to_string(&mut metadata).map_err(|e| e.to_string())?; + let group = parse(&metadata).map_err(|e| e.to_string())?; + let application = group + .get("Application") + .ok_or_else(|| "Application group missing".to_string())?; + Ok(application + .get("runtime") + .ok_or_else(|| "runtime property missing".to_string())? + .clone()) +} + +// SAFETY: we do not expect "extract_runtime" to collide with another symbol. +#[unsafe(export_name = "extract_runtime")] +pub extern "C" fn extract_runtime_c(metadata: OwnedFd, out: &mut [u8; 256]) { + let error = match extract_runtime(metadata.into()) { + Err(e) => e, + Ok(runtime) if runtime.len() >= out.len() => "runtime name too long".to_string(), + Ok(runtime) => { + out[..runtime.len()].copy_from_slice(runtime.as_bytes()); + out[runtime.len()] = 0; + return; + } + }; + + let prog_name = args_os() + .next() + .unwrap_or_else(|| OsString::from("mount-flatpak")); + stderr().write_all(prog_name.as_bytes()).unwrap(); + eprintln!(": {error}"); + exit(1); +} diff --git a/tools/mount-flatpak/mount-flatpak.c b/tools/mount-flatpak/mount-flatpak.c new file mode 100644 index 0000000..8e09d1d --- /dev/null +++ b/tools/mount-flatpak/mount-flatpak.c @@ -0,0 +1,294 @@ +// SPDX-License-Identifier: EUPL-1.2+ +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +#include "config.h" +#include "metadata.h" + +#include <err.h> +#include <fcntl.h> +#include <stdlib.h> +#include <stdio.h> +#include <string.h> +#include <unistd.h> + +#include <sys/stat.h> +#include <sys/syscall.h> + +#include <linux/mount.h> +#include <linux/openat2.h> + +static void bind_mount(int source_fd, const char *source, + int target_fd, const char *target) +{ + int source_tree = syscall(SYS_open_tree, source_fd, source, + AT_EMPTY_PATH | OPEN_TREE_CLOEXEC | + OPEN_TREE_CLONE | AT_RECURSIVE); + + if (source_tree == -1) + err(EXIT_FAILURE, "open_tree %s", source); + if (syscall(SYS_move_mount, source_tree, "", target_fd, target, + MOVE_MOUNT_F_EMPTY_PATH | MOVE_MOUNT_T_EMPTY_PATH) == -1) + err(EXIT_FAILURE, "move_mount"); +} + +static int mkdir_openat(int dirfd, const char *path, mode_t mode) +{ + int fd; + if (mkdirat(dirfd, path, mode) == -1) + err(EXIT_FAILURE, "mkdirat %s", path); + if ((fd = openat(dirfd, path, O_PATH | O_DIRECTORY | O_CLOEXEC)) == -1) + err(EXIT_FAILURE, "openat %s", path); + return fd; +} + +// By failing on EEXIST when creating each directory, +// we can be sure we don't end up following .. components. +static int mkdirs_beneath(int root, const char *target) +{ + int last, fd = root; + size_t len = strlen(target); + char *end, *path = malloc(len + 1), *dir = path; + if (!dir) + err(EXIT_FAILURE, "malloc %zu", len + 1); + memcpy(dir, target, len + 1); + + do { + // Find next non-empty directory component + end = strchrnul(dir, '/'); + while (*(end + 1) == '/') + end++; + + // Replace path separator with string terminator. + *end = 0; + + // Update fd to a new child, and close the previous one + // unless it was the one provided by the caller. + last = fd; + fd = mkdir_openat(fd, dir, 0755); + if (last != root) + close(last); + + dir = end + 1; + } while (end != &path[len]); + + free(path); + return fd; +} + +static int openat_beneath(int dirfd, const char *path, int flags) +{ + struct open_how how = { + .flags = flags, + .resolve = RESOLVE_BENEATH | RESOLVE_NO_MAGICLINKS, + }; + int r = syscall(SYS_openat2, dirfd, path, &how, sizeof how); + if (r == -1) + err(EXIT_FAILURE, "openat2 %s", path); + return r; +} + +static int resolve_link(int dirfd, const char *path, char **target) +{ + int r; + struct stat sb; + if (fstatat(dirfd, path, &sb, AT_SYMLINK_NOFOLLOW) == -1) + err(EXIT_FAILURE, "fstatat %s", path); + if (!(*target = malloc(sb.st_size + 1))) + err(EXIT_FAILURE, "malloc %zu", sb.st_size + 1); + if ((r = readlinkat(dirfd, path, *target, sb.st_size + 1)) <= -1) + err(EXIT_FAILURE, "readlinkat %s", path); + if (r == sb.st_size + 1) + errx(EXIT_FAILURE, "symlink target lengthened"); + (*target)[r] = 0; // NOLINT(clang-analyzer-security.ArrayBound) + return openat_beneath(dirfd, *target, O_PATH | O_CLOEXEC | O_DIRECTORY); +} + +static void write_to(int dirfd, const char *path, const char *text) +{ + FILE *file; + size_t len = strlen(text); + int f = openat(dirfd, path, + O_WRONLY | O_CLOEXEC | O_NOFOLLOW | O_CREAT, 0644); + + if (f == -1) + err(EXIT_FAILURE, "openat %s", path); + if (!(file = fdopen(f, "w"))) + err(EXIT_FAILURE, "fdopen %s", path); + + if (fwrite(text, 1, len, file) != len) + err(EXIT_FAILURE, "fwrite"); + if (fclose(file) == EOF) + err(EXIT_FAILURE, "fclose"); +} + +static void set_up_app_dir(int source_commit_dir, int installation_dir, + const char *id, const char *arch, + const char *branch, const char *commit) +{ + int app_dir, id_dir, arch_dir, branch_dir; + + app_dir = mkdir_openat(installation_dir, "app", 0755); + + id_dir = mkdir_openat(app_dir, id, 0755); + close(app_dir); + + arch_dir = mkdir_openat(id_dir, arch, 0755); + close(id_dir); + + branch_dir = mkdir_openat(arch_dir, branch, 0755); + close(arch_dir); + + if (mkdirat(branch_dir, commit, 0755) == -1) + err(EXIT_FAILURE, "mkdirat %s", commit); + bind_mount(source_commit_dir, "", branch_dir, commit); + close(branch_dir); +} + +static int mount_app(int source_installation_dir, int target_installation_dir, + int params_dir, const char *id) +{ + char *arch_and_branch, *arch_end, *commit; + int app_dir, id_dir, branch_dir, commit_dir; + + app_dir = openat_beneath(source_installation_dir, "app", + O_PATH | O_CLOEXEC | O_DIRECTORY); + id_dir = openat_beneath(app_dir, id, O_PATH | O_CLOEXEC | O_DIRECTORY); + close(app_dir); + + branch_dir = resolve_link(id_dir, "current", &arch_and_branch); + close(id_dir); + + commit_dir = resolve_link(branch_dir, "active", &commit); + close(branch_dir); + + if (!(arch_end = strchr(arch_and_branch, '/'))) + errx(EXIT_FAILURE, "unexpected current format"); + *arch_end = 0; + + set_up_app_dir(commit_dir, target_installation_dir, id, + arch_and_branch, arch_end + 1, commit); + write_to(params_dir, "commit", commit); + write_to(params_dir, "arch", arch_and_branch); + write_to(params_dir, "branch", arch_end + 1); + + free(arch_and_branch); + free(commit); + return commit_dir; +} + +static void set_up_runtime_dir(int source_commit_dir, int installation_dir, + const char *ref, const char *commit) +{ + int runtime_dir, branch_dir; + + runtime_dir = mkdir_openat(installation_dir, "runtime", 0755); + + branch_dir = mkdirs_beneath(runtime_dir, ref); + close(runtime_dir); + + if (mkdirat(branch_dir, commit, 0755) == -1) + err(EXIT_FAILURE, "mkdirat %s", commit); + bind_mount(source_commit_dir, "", branch_dir, commit); + close(branch_dir); +} + +static void mount_runtime(int source_installation_dir, + int target_installation_dir, + int params_dir, int app_commit_dir) +{ + char runtime[256], *commit; + int runtime_dir, branch_dir, commit_dir; + int metadata = openat_beneath(app_commit_dir, "metadata", + O_RDONLY | O_CLOEXEC); + + extract_runtime(metadata, runtime); + + runtime_dir = openat_beneath(source_installation_dir, "runtime", + O_PATH | O_CLOEXEC | O_DIRECTORY); + + branch_dir = openat_beneath(runtime_dir, runtime, + O_PATH | O_CLOEXEC | O_DIRECTORY); + close(runtime_dir); + + commit_dir = resolve_link(branch_dir, "active", &commit); + close(branch_dir); + + set_up_runtime_dir(commit_dir, target_installation_dir, + runtime, commit); + write_to(params_dir, "runtime-commit", commit); + + free(commit); + close(commit_dir); +} + +static void set_up_repo(int target_installation_dir) +{ + int config; + + if (mkdirat(target_installation_dir, "repo", 0755) == -1) + err(EXIT_FAILURE, "mkdir repo"); + if (mkdirat(target_installation_dir, "repo/objects", 0755) == -1) + err(EXIT_FAILURE, "mkdir repo/objects"); + if (mkdirat(target_installation_dir, "repo/tmp", 0775) == -1) + err(EXIT_FAILURE, "mkdir repo/tmp"); + if (mkdirat(target_installation_dir, "repo/tmp/cache", 0775) == -1) + err(EXIT_FAILURE, "mkdir repo/tmp/cache"); + + if ((config = openat(target_installation_dir, "repo/config", + O_WRONLY | O_CLOEXEC | O_NOFOLLOW | O_CREAT, + 0644)) == -1) + err(EXIT_FAILURE, "openat repo/config"); + + bind_mount(AT_FDCWD, CONFIG_PATH, config, ""); + + close(config); +} + +int main(int, char **argv) +{ + char *installation_path, *id; + int params_dir, source_installation_dir, target_installation_dir, + app_commit_dir; + struct mount_attr attr = { + .attr_clr = MOUNT_ATTR_NOSYMFOLLOW, + .attr_set = MOUNT_ATTR_RDONLY | MOUNT_ATTR_NODEV, + }; + + if (!(installation_path = *++argv)) + errx(EXIT_FAILURE, "missing installation path"); + if (!(id = *++argv)) + errx(EXIT_FAILURE, "missing app ID"); + + if ((source_installation_dir = open(installation_path, + O_PATH | O_CLOEXEC | O_DIRECTORY)) == -1) + err(EXIT_FAILURE, "open %s", installation_path); + + params_dir = mkdir_openat(AT_FDCWD, "params", 0755); + write_to(params_dir, "id", id); + + if (mkdir("flatpak", 0755) == -1) + err(EXIT_FAILURE, "mkdir flatpak"); + if ((target_installation_dir = syscall(SYS_open_tree, AT_FDCWD, + "flatpak", + AT_EMPTY_PATH | OPEN_TREE_CLONE | + OPEN_TREE_CLOEXEC | + AT_RECURSIVE)) == -1) + err(EXIT_FAILURE, "open_tree flatpak"); + + app_commit_dir = mount_app(source_installation_dir, + target_installation_dir, params_dir, id); + mount_runtime(source_installation_dir, target_installation_dir, + params_dir, app_commit_dir); + close(source_installation_dir); + close(params_dir); + + set_up_repo(target_installation_dir); + + if (syscall(SYS_mount_setattr, target_installation_dir, "", + AT_EMPTY_PATH | AT_RECURSIVE, &attr, sizeof attr) == -1) + err(EXIT_FAILURE, "mount_setattr flatpak"); + if (syscall(SYS_move_mount, target_installation_dir, "", + AT_FDCWD, "flatpak", MOVE_MOUNT_F_EMPTY_PATH) == -1) + err(EXIT_FAILURE, "move_mount flatpak flatpak"); + close(target_installation_dir); +} base-commit: 4b89596e112d26c4bd60bc46bb45c5d9a0875314 -- 2.51.0

2 11

[PATCH 1/3] img/app: move init to /usr/bin
by Alyssa Ross 18 Nov '25

18 Nov '25

/sbin/init (which for us is /usr/bin/init via the /sbin symlink) is the highest precedence path for init in the kernel. If we keep our init at /etc/init, installing a package (like systemd) that provides its own init will quietly take precedence over our own. Let's claim this path for ourselves, so adding init from a package will fail loudly. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- img/app/file-list.mk | 4 ++-- img/app/image/{etc => usr/bin}/init | 0 2 files changed, 2 insertions(+), 2 deletions(-) rename img/app/image/{etc => usr/bin}/init (100%) diff --git a/img/app/file-list.mk b/img/app/file-list.mk index 506ab7a..0b4d3d1 100644 --- a/img/app/file-list.mk +++ b/img/app/file-list.mk @@ -4,7 +4,6 @@ FILES = \ image/etc/dbus-1/session.conf \ image/etc/fstab \ - image/etc/init \ image/etc/mdev.conf \ image/etc/mdev/iface \ image/etc/mdev/listen \ @@ -26,7 +25,8 @@ FILES = \ image/etc/s6-linux-init/scripts/rc.shutdown \ image/etc/s6-linux-init/scripts/rc.shutdown.final \ image/etc/wireplumber/wireplumber.conf.d/99_spectrum.conf \ - image/etc/xdg/xdg-desktop-portal/portals.conf + image/etc/xdg/xdg-desktop-portal/portals.conf \ + image/usr/bin/init LINKS = \ image/bin \ diff --git a/img/app/image/etc/init b/img/app/image/usr/bin/init similarity index 100% rename from img/app/image/etc/init rename to img/app/image/usr/bin/init base-commit: 651da813154329e8398a23dbaabdeef633c1f2a6 -- 2.51.0

3 14

[PATCH 0/4] Minor improvements to scripts/run-qemu.sh
by Demi Marie Obenour 14 Nov '25

14 Nov '25

None of these are major changes. See individual commit messages for details. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Demi Marie Obenour (4): scripts/run-qemu.sh: better error checks & formatting scripts/run-qemu.sh: decrease indentation scripts/run-qemu.sh: Preserve ,, in QEMU arguments scripts/run-qemu.sh: Unset variables from the environment scripts/run-qemu.sh | 123 +++++++++++++++++++++++++++------------------------- 1 file changed, 65 insertions(+), 58 deletions(-) --- base-commit: 22e216712322cdfb85094bbd27ff34c4366fad41 change-id: 20251107-simple-sh-quote-fix-cf956d5422c3 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 15

[PATCH] tools: use llvmPackages as input
by Alyssa Ross 13 Nov '25

13 Nov '25

This makes sure that clang and clang-tidy will be using the same version of LLVM. (It's looking like we might also need LLVM libunwind at some point, so that's another thing we could take from a single llvmPackages.) Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- tools/default.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/default.nix b/tools/default.nix index 398f570..06b7ed2 100644 --- a/tools/default.nix +++ b/tools/default.nix @@ -5,9 +5,9 @@ import ../lib/call-package.nix ( { src, lib, stdenv, fetchCrate, fetchurl, runCommand, buildPackages , meson, ninja, pkg-config, rustc -, clang-tools, clippy, jq +, llvmPackages, clippy, jq , dbus, linuxHeaders -, clang, libbpf +, libbpf , buildSupport ? false , appSupport ? true , hostSupport ? false @@ -86,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ meson ninja ] ++ lib.optionals (appSupport || driverSupport) [ pkg-config ] ++ lib.optionals hostSupport [ rustc ] - ++ lib.optionals driverSupport [ clang.cc ]; + ++ lib.optionals driverSupport [ llvmPackages.clang-unwrapped ]; buildInputs = lib.optionals appSupport [ dbus ] ++ lib.optionals driverSupport [ libbpf linuxHeaders ]; @@ -121,7 +121,7 @@ stdenv.mkDerivation (finalAttrs: { # clang-tools needs to be before clang, otherwise it will not use # the Nix include path correctly and fail to find headers - nativeBuildInputs = [ clang-tools jq ] ++ nativeBuildInputs; + nativeBuildInputs = [ llvmPackages.clang-tools jq ] ++ nativeBuildInputs; buildPhase = '' jq -r '.[].file | select(endswith(".c"))' compile_commands.json | base-commit: 1d666582892fbdf812662b4490caf7821078eaf9 -- 2.51.0

2 1

[PATCH] tools/start-vmm: enable Cloud Hypervisor landlock
by Alyssa Ross 13 Nov '25

13 Nov '25

We can't really predict the device paths or IOMMU groups statically, so this is as good as it gets with landlock rules. We'll be able to do other things to further lock things down though, like running different Cloud Hypervisor instances as different users, and changing ownership of each IOMMU group in /dev/vfio/vfio to match. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- tools/start-vmm/ch.rs | 8 ++++++++ tools/start-vmm/lib.rs | 15 +++++++++++++-- 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/tools/start-vmm/ch.rs b/tools/start-vmm/ch.rs index 80e75dc..ed2d457 100644 --- a/tools/start-vmm/ch.rs +++ b/tools/start-vmm/ch.rs @@ -69,6 +69,12 @@ pub struct VsockConfig { pub socket: String, } +#[derive(Serialize)] +pub struct LandlockConfig { + pub path: String, + pub access: &'static str, +} + #[derive(Serialize)] pub struct VmConfig { pub console: ConsoleConfig, @@ -80,6 +86,8 @@ pub struct VmConfig { pub payload: PayloadConfig, pub serial: ConsoleConfig, pub vsock: VsockConfig, + pub landlock_enable: bool, + pub landlock_rules: Vec<LandlockConfig>, } fn command(vm_dir: &Path, s: impl AsRef<OsStr>) -> Command { diff --git a/tools/start-vmm/lib.rs b/tools/start-vmm/lib.rs index 5dc5ae7..9a77780 100644 --- a/tools/start-vmm/lib.rs +++ b/tools/start-vmm/lib.rs @@ -14,8 +14,8 @@ use std::io::{self, ErrorKind}; use std::path::Path; use ch::{ - ConsoleConfig, DiskConfig, FsConfig, GpuConfig, MemoryConfig, PayloadConfig, VmConfig, - VsockConfig, + ConsoleConfig, DiskConfig, FsConfig, GpuConfig, LandlockConfig, MemoryConfig, PayloadConfig, + VmConfig, VsockConfig, }; use net::net_setup; @@ -130,6 +130,17 @@ pub fn vm_config(vm_dir: &Path) -> Result<VmConfig, String> { cid: 3, socket: vm_dir.join("vsock").into_os_string().into_string().unwrap(), }, + landlock_enable: true, + landlock_rules: vec![ + LandlockConfig { + path: "/sys/devices".to_owned(), + access: "rw", + }, + LandlockConfig { + path: "/dev/vfio".to_owned(), + access: "rw", + }, + ], }) } base-commit: 50f8db9cec022a60ea978bfdde0904a18718d161 -- 2.51.0

3 2

config.nix validation?
by Demi Marie Obenour 09 Nov '25

09 Nov '25

Should the values from config.nix be validated in any way? They are obviously trusted, but it is very easy for the users to make mistakes that could cause extremely confusing problems. For instance, the update patch doesn't support URLs with a query string or a fragment specifier. In fact, such URLs could get mangled. There are other URLs that tools like curl will accept but which will break the build. Should these be validated with regular expressions before use? That will result in build-time errors that at least somewhat point to the source of the problem, rather than mysterious build-time or runtime misbehavior. -- Sincerely, Demi Marie Obenour (she/her/hers)

2 3

[PATCH 0/2] release/checks/shfmt: init
by Alyssa Ross 09 Nov '25

09 Nov '25

The default formatting seems unobjectionable to me, but if anybody wants to lobby for different sh formatting rules, now's the time. :) Alyssa Ross (2): scripts: format with shfmt release/checks/shfmt: init release/checks/default.nix | 2 + release/checks/shfmt.nix | 15 +++++ scripts/dist-cloud-hypervisor.sh | 4 +- scripts/format-uuid.sh | 2 +- scripts/make-erofs.sh | 8 +-- scripts/run-qemu.sh | 109 ++++++++++++++++--------------- scripts/update-nixpkgs.sh | 4 +- 7 files changed, 81 insertions(+), 63 deletions(-) create mode 100644 release/checks/shfmt.nix base-commit: e9480cfdf8cba16d0e0b8ee2db3a916979804db9 -- 2.51.0

3 6

[PATCH] img/app: Use set -euo pipefail for building the erofs
by Demi Marie Obenour 09 Nov '25

09 Nov '25

This caught problems when I was trying to filter the set of files to be built. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- img/app/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/img/app/Makefile b/img/app/Makefile index 981889ebe55d9ba03228977f3dc0ea3f26d5c4fb..48eba871339d314479f730101246ace3fa39e2db 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -46,6 +46,7 @@ build/empty: mkdir -p $@ build/rootfs.erofs: ../../scripts/make-erofs.sh $(PACKAGES_FILE) $(FILES) $(BUILD_FILES) build/empty build/fifo file-list.mk + set -euo pipefail; \ { \ cat $(PACKAGES_FILE) ;\ for file in $(FILES) $(LINKS); do printf '%s\n%s\n' $$file "$${file#image/}"; done ;\ --- base-commit: 22e216712322cdfb85094bbd27ff34c4366fad41 change-id: 20251107-pipefail-92dd75264707 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 2

[PATCH 0/2] host/rootfs: remove unnecessary coldplug dependencies
by Alyssa Ross 09 Nov '25

09 Nov '25

I didn't want to block the udev series on this, but I really don't think these dependencies are necessary. Rationale in each patch. Alyssa Ross (2): host/rootfs: remove vmm-env coldplug dependency host/rootfs: remove vm-env coldplug dependency host/rootfs/file-list.mk | 2 -- .../image/etc/s6-rc/vm-env/contents.d/systemd-udevd-coldplug | 0 .../image/etc/s6-rc/vmm-env/contents.d/systemd-udevd-coldplug | 0 3 files changed, 2 deletions(-) delete mode 100644 host/rootfs/image/etc/s6-rc/vm-env/contents.d/systemd-udevd-coldplug delete mode 100644 host/rootfs/image/etc/s6-rc/vmm-env/contents.d/systemd-udevd-coldplug base-commit: 36d2f0bd5caf297efec0e41f42e5983ae9dc1cb1 -- 2.51.0

1 2

[PATCH v6 0/2] Switch from mdevd to systemd-udevd in root filesystem
by Demi Marie Obenour 09 Nov '25

09 Nov '25

systemd-udevd provides support for significantly more hardware than mdevd does. Therefore, switch to it. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Changes in v6: - Avoid using GOTO and LABEL in udev rules. Changes in v5: - Use -D_GNU_SOURCE in build system instead of #define _GNU_SOURCE 1 in C files. - Do not check for EAGAIN or EWOULDBLOCK after poll() has reported FD as ready. - Do not use MSG_NONBLOCK. - Use static variable for iovec. - Network hotplug script is safe to call more than once, so do not check for it having already been called. - Do not try to prevent /run/user from being created with wrong mode when it is known to already exist. - Fix copyright texts. - Link to v4: https://spectrum-os.org/lists/archives/spectrum-devel/20251003-udev-v4-0-7d… Changes in v4: - Use 'udevadm trigger --action=add' at coldplug time. - Ensure that the wrapper does not exit after the first message. - Include the hardware database. - sd-notify-adapter should not exit if it receives a message without READY=1. - Link to v3: https://spectrum-os.org/lists/archives/spectrum-devel/20250928-udev-v3-0-bb… Changes in v3: - Try to avoid net-add running twice. - Use full systemd instead of systemdMinimal, as something else already pulls it into the image. - Hopefully fix integration tests. - Link to v2: https://spectrum-os.org/lists/archives/spectrum-devel/20250924-udev-v2-2-60… Changes in v2: - Use more optional arguments instead of positional parameters in sd-notify-wrapper. - Explain why explicit modprobe is needed. - Link to v1: https://spectrum-os.org/lists/archives/spectrum-devel/20250913-udev-v1-0-ea… --- Demi Marie Obenour (2): tools: Add adapter tool for services using sd_notify host/rootfs: Switch to systemd-udevd host/rootfs/Makefile | 2 +- host/rootfs/default.nix | 118 ++++++++------------- host/rootfs/file-list.mk | 33 +++--- host/rootfs/image/etc/mdev.conf | 7 -- host/rootfs/image/etc/mdev/listen | 11 -- host/rootfs/image/etc/mdev/wait | 14 --- host/rootfs/image/etc/s6-rc/card0/type.license | 2 - host/rootfs/image/etc/s6-rc/card0/up | 4 - host/rootfs/image/etc/s6-rc/kvm/timeout-up | 1 - host/rootfs/image/etc/s6-rc/kvm/timeout-up.license | 2 - host/rootfs/image/etc/s6-rc/kvm/type | 1 - host/rootfs/image/etc/s6-rc/kvm/type.license | 2 - host/rootfs/image/etc/s6-rc/kvm/up | 4 - host/rootfs/image/etc/s6-rc/mdevd-coldplug/type | 1 - host/rootfs/image/etc/s6-rc/mdevd-coldplug/up | 4 - .../image/etc/s6-rc/mdevd/notification-fd.license | 2 - host/rootfs/image/etc/s6-rc/mdevd/run | 5 - .../contents.d/systemd-udevd-coldplug} | 0 .../dependencies.d/systemd-udevd} | 0 .../s6-rc/{card0 => systemd-udevd-coldplug}/type | 0 .../type.license | 0 .../image/etc/s6-rc/systemd-udevd-coldplug/up | 3 + .../s6-rc/{mdevd => systemd-udevd}/notification-fd | 0 .../s6-rc/systemd-udevd/notification-fd.license | 2 + host/rootfs/image/etc/s6-rc/systemd-udevd/run | 14 +++ .../image/etc/s6-rc/{mdevd => systemd-udevd}/type | 0 .../s6-rc/{mdevd => systemd-udevd}/type.license | 0 .../contents.d/systemd-udevd-coldplug} | 0 .../contents.d/systemd-udevd-coldplug} | 0 .../weston/dependencies.d/systemd-udevd-coldplug | 0 host/rootfs/image/etc/s6-rc/weston/run | 6 +- .../image/etc/udev/rules.d/99-spectrum.rules | 5 + host/rootfs/image/usr/bin/run-vmm | 1 + host/rootfs/image/usr/bin/systemd-udevd | 1 + .../{etc/mdev/net/add => usr/libexec/net-add} | 0 tools/default.nix | 1 + tools/meson.build | 1 + tools/sd-notify-adapter/meson.build | 4 + tools/sd-notify-adapter/sd-notify-adapter.c | 107 +++++++++++++++++++ 39 files changed, 199 insertions(+), 159 deletions(-) --- base-commit: 22e216712322cdfb85094bbd27ff34c4366fad41 change-id: 20250911-udev-24cf4bf68fbe -- Sincerely, Demi Marie Obenour (she/her/hers)

3 16

[BUG] Spurious test failure in networking integration test
by Alyssa Ross 07 Nov '25

07 Nov '25

I'm seeing a test failure sometimes that looks like this: unexpected connection data: qemu-system-aarch64: terminating on signal 15 from pid 184 () I think this is because, now that the nc command in the networking integration test has a timeout, it's possible for it to time out after having opened the connection, but before having written all its input to it. I think the test should therefore ignore connections that send a prefix of the expected data (including nothing), and just wait for the next connection rather than failing if that happens.

1 0

[PATCH] host/initramfs: Fix 'nix-shell --pure --run "make run"'
by Demi Marie Obenour 06 Nov '25

06 Nov '25

Add the needed build-dependency on jq. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/initramfs/shell.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/host/initramfs/shell.nix b/host/initramfs/shell.nix index eeba865e3ac793f67ae1808a92cf5eb1b37d57af..8b47aa53bc19a818ebf563e281f22e82202a8ea5 100644 --- a/host/initramfs/shell.nix +++ b/host/initramfs/shell.nix @@ -3,7 +3,7 @@ import ../../lib/call-package.nix ( { callSpectrumPackage, rootfs, pkgsStatic, stdenv -, cryptsetup, qemu_kvm, tar2ext4, util-linux +, cryptsetup, jq, qemu_kvm, tar2ext4, util-linux }: let @@ -12,7 +12,7 @@ in initramfs.overrideAttrs ({ nativeBuildInputs ? [], env ? {}, ... }: { nativeBuildInputs = nativeBuildInputs ++ [ - cryptsetup qemu_kvm tar2ext4 util-linux + cryptsetup jq qemu_kvm tar2ext4 util-linux ]; env = env // { --- base-commit: 1d666582892fbdf812662b4490caf7821078eaf9 change-id: 20251105-fix-nix-shell-initramfs-244323043a9d -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[PATCH v6 0/2] Switch from mdevd to systemd-udevd in root filesystem
by Demi Marie Obenour 06 Nov '25

06 Nov '25

systemd-udevd provides support for significantly more hardware than mdevd does. Therefore, switch to it. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Changes in v5: - Use -D_GNU_SOURCE in build system instead of #define _GNU_SOURCE 1 in C files. - Do not check for EAGAIN or EWOULDBLOCK after poll() has reported FD as ready. - Do not use MSG_NONBLOCK. - Use static variable for iovec. - Network hotplug script is safe to call more than once, so do not check for it having already been called. - Do not try to prevent /run/user from being created with wrong mode when it is known to already exist. - Fix copyright texts. - Link to v4: https://spectrum-os.org/lists/archives/spectrum-devel/20251003-udev-v4-0-7d… Changes in v4: - Use 'udevadm trigger --action=add' at coldplug time. - Ensure that the wrapper does not exit after the first message. - Include the hardware database. - sd-notify-adapter should not exit if it receives a message without READY=1. - Link to v3: https://spectrum-os.org/lists/archives/spectrum-devel/20250928-udev-v3-0-bb… Changes in v3: - Try to avoid net-add running twice. - Use full systemd instead of systemdMinimal, as something else already pulls it into the image. - Hopefully fix integration tests. - Link to v2: https://spectrum-os.org/lists/archives/spectrum-devel/20250924-udev-v2-2-60… Changes in v2: - Use more optional arguments instead of positional parameters in sd-notify-wrapper. - Explain why explicit modprobe is needed. - Link to v1: https://spectrum-os.org/lists/archives/spectrum-devel/20250913-udev-v1-0-ea… --- Demi Marie Obenour (2): tools: Add adapter tool for services using sd_notify host/rootfs: Switch to systemd-udevd host/rootfs/Makefile | 2 +- host/rootfs/default.nix | 118 ++++++++------------- host/rootfs/file-list.mk | 33 +++--- host/rootfs/image/etc/mdev.conf | 7 -- host/rootfs/image/etc/mdev/listen | 11 -- host/rootfs/image/etc/mdev/wait | 14 --- host/rootfs/image/etc/s6-rc/card0/type.license | 2 - host/rootfs/image/etc/s6-rc/card0/up | 4 - host/rootfs/image/etc/s6-rc/kvm/timeout-up | 1 - host/rootfs/image/etc/s6-rc/kvm/timeout-up.license | 2 - host/rootfs/image/etc/s6-rc/kvm/type | 1 - host/rootfs/image/etc/s6-rc/kvm/type.license | 2 - host/rootfs/image/etc/s6-rc/kvm/up | 4 - host/rootfs/image/etc/s6-rc/mdevd-coldplug/type | 1 - host/rootfs/image/etc/s6-rc/mdevd-coldplug/up | 4 - .../image/etc/s6-rc/mdevd/notification-fd.license | 2 - host/rootfs/image/etc/s6-rc/mdevd/run | 5 - .../contents.d/systemd-udevd-coldplug} | 0 .../dependencies.d/systemd-udevd} | 0 .../s6-rc/{card0 => systemd-udevd-coldplug}/type | 0 .../type.license | 0 .../image/etc/s6-rc/systemd-udevd-coldplug/up | 3 + .../s6-rc/{mdevd => systemd-udevd}/notification-fd | 0 .../s6-rc/systemd-udevd/notification-fd.license | 2 + host/rootfs/image/etc/s6-rc/systemd-udevd/run | 14 +++ .../image/etc/s6-rc/{mdevd => systemd-udevd}/type | 0 .../s6-rc/{mdevd => systemd-udevd}/type.license | 0 .../contents.d/systemd-udevd-coldplug} | 0 .../contents.d/systemd-udevd-coldplug} | 0 .../weston/dependencies.d/systemd-udevd-coldplug | 0 host/rootfs/image/etc/s6-rc/weston/run | 6 +- .../image/etc/udev/rules.d/99-spectrum.rules | 9 ++ host/rootfs/image/usr/bin/run-vmm | 1 + host/rootfs/image/usr/bin/systemd-udevd | 1 + .../{etc/mdev/net/add => usr/libexec/net-add} | 0 tools/default.nix | 1 + tools/meson.build | 1 + tools/sd-notify-adapter/meson.build | 4 + tools/sd-notify-adapter/sd-notify-adapter.c | 107 +++++++++++++++++++ 39 files changed, 203 insertions(+), 159 deletions(-) --- base-commit: 1d666582892fbdf812662b4490caf7821078eaf9 change-id: 20250911-udev-24cf4bf68fbe -- Sincerely, Demi Marie Obenour (she/her/hers)

2 6

[PATCH v5 0/2] Switch from mdevd to systemd-udevd in root filesystem
by Demi Marie Obenour 03 Nov '25

03 Nov '25

systemd-udevd provides support for significantly more hardware than mdevd does. Therefore, switch to it. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Changes in v5: - Use -D_GNU_SOURCE in build system instead of #define _GNU_SOURCE 1 in C files. - Do not check for EAGAIN or EWOULDBLOCK after poll() has reported FD as ready. - Do not use MSG_NONBLOCK. - Use static variable for iovec. - Network hotplug script is safe to call more than once, so do not check for it having already been called. - Do not try to prevent /run/user from being created with wrong mode when it is known to already exist. - Fix copyright texts. - Link to v4: https://spectrum-os.org/lists/archives/spectrum-devel/20251003-udev-v4-0-7d… Changes in v4: - Use 'udevadm trigger --action=add' at coldplug time. - Ensure that the wrapper does not exit after the first message. - Include the hardware database. - sd-notify-adapter should not exit if it receives a message without READY=1. - Link to v3: https://spectrum-os.org/lists/archives/spectrum-devel/20250928-udev-v3-0-bb… Changes in v3: - Try to avoid net-add running twice. - Use full systemd instead of systemdMinimal, as something else already pulls it into the image. - Hopefully fix integration tests. - Link to v2: https://spectrum-os.org/lists/archives/spectrum-devel/20250924-udev-v2-2-60… Changes in v2: - Use more optional arguments instead of positional parameters in sd-notify-wrapper. - Explain why explicit modprobe is needed. - Link to v1: https://spectrum-os.org/lists/archives/spectrum-devel/20250913-udev-v1-0-ea… --- Demi Marie Obenour (2): tools: Add adapter tool for services using sd_notify host/rootfs: Switch to systemd-udevd host/rootfs/Makefile | 2 +- host/rootfs/default.nix | 118 ++++++++------------- host/rootfs/file-list.mk | 33 +++--- host/rootfs/image/etc/mdev.conf | 7 -- host/rootfs/image/etc/mdev/listen | 11 -- host/rootfs/image/etc/mdev/wait | 14 --- host/rootfs/image/etc/s6-rc/card0/type.license | 2 - host/rootfs/image/etc/s6-rc/card0/up | 4 - host/rootfs/image/etc/s6-rc/kvm/timeout-up | 1 - host/rootfs/image/etc/s6-rc/kvm/timeout-up.license | 2 - host/rootfs/image/etc/s6-rc/kvm/type | 1 - host/rootfs/image/etc/s6-rc/kvm/type.license | 2 - host/rootfs/image/etc/s6-rc/kvm/up | 4 - host/rootfs/image/etc/s6-rc/mdevd-coldplug/type | 1 - host/rootfs/image/etc/s6-rc/mdevd-coldplug/up | 4 - .../image/etc/s6-rc/mdevd/notification-fd.license | 2 - host/rootfs/image/etc/s6-rc/mdevd/run | 5 - .../contents.d/systemd-udevd-coldplug} | 0 .../dependencies.d/systemd-udevd} | 0 .../s6-rc/{card0 => systemd-udevd-coldplug}/type | 0 .../type.license | 0 .../image/etc/s6-rc/systemd-udevd-coldplug/up | 3 + .../s6-rc/{mdevd => systemd-udevd}/notification-fd | 0 .../s6-rc/systemd-udevd/notification-fd.license | 2 + host/rootfs/image/etc/s6-rc/systemd-udevd/run | 14 +++ .../image/etc/s6-rc/{mdevd => systemd-udevd}/type | 0 .../s6-rc/{mdevd => systemd-udevd}/type.license | 0 .../contents.d/systemd-udevd-coldplug} | 0 .../contents.d/systemd-udevd-coldplug} | 0 .../weston/dependencies.d/systemd-udevd-coldplug | 0 host/rootfs/image/etc/s6-rc/weston/run | 6 +- .../image/etc/udev/rules.d/99-spectrum.rules | 9 ++ host/rootfs/image/usr/bin/run-vmm | 1 + host/rootfs/image/usr/bin/systemd-udevd | 1 + .../{etc/mdev/net/add => usr/libexec/net-add} | 0 tools/default.nix | 1 + tools/meson.build | 1 + tools/sd-notify-adapter/meson.build | 4 + tools/sd-notify-adapter/sd-notify-adapter.c | 107 +++++++++++++++++++ 39 files changed, 203 insertions(+), 159 deletions(-) --- base-commit: 1d666582892fbdf812662b4490caf7821078eaf9 change-id: 20250911-udev-24cf4bf68fbe -- Sincerely, Demi Marie Obenour (she/her/hers)

1 2

[PATCH 1/2] host/rootfs: assign-devices: silence errors
by Alyssa Ross 02 Nov '25

02 Nov '25

The expected warnings frequently confuse people. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/image/usr/bin/assign-devices | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/host/rootfs/image/usr/bin/assign-devices b/host/rootfs/image/usr/bin/assign-devices index 1332a40..58dd3cc 100755 --- a/host/rootfs/image/usr/bin/assign-devices +++ b/host/rootfs/image/usr/bin/assign-devices @@ -5,4 +5,9 @@ elglob -0 devices /sys/bus/pci/drivers/vfio-pci/????:??:??.? forx -pE device { $devices } +# This script is designed to be re-entrant and called multiple times. +# This means we expect to sometimes get an error due to the device +# already having been added. If there's a different error, +# cloud-hypervisor will probably log it itself anyway. +redirfd -w 2 /dev/null ch-remote --api-socket /run/vm/by-name/sys.netvm/vmm add-device path=${device} base-commit: e0f5aad7901d150b1abe381ffd99d554e65e758b -- 2.51.0

3 5

[PATCH] tools: use default clang version
by Yureka Lilian 02 Nov '25

02 Nov '25

Now that we have updated nixpkgs, the default clang version is recent enough to support the required flags Signed-off-by: Yureka Lilian <yureka(a)cyberchaos.dev> --- tools/default.nix | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/tools/default.nix b/tools/default.nix index de5a3b8..398f570 100644 --- a/tools/default.nix +++ b/tools/default.nix @@ -7,8 +7,7 @@ import ../lib/call-package.nix ( , meson, ninja, pkg-config, rustc , clang-tools, clippy, jq , dbus, linuxHeaders -# clang 19 (current nixpkgs default) is too old to support -fwrapv-pointer -, clang_21, libbpf +, clang, libbpf , buildSupport ? false , appSupport ? true , hostSupport ? false @@ -87,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ meson ninja ] ++ lib.optionals (appSupport || driverSupport) [ pkg-config ] ++ lib.optionals hostSupport [ rustc ] - ++ lib.optionals driverSupport [ clang_21.cc ]; + ++ lib.optionals driverSupport [ clang.cc ]; buildInputs = lib.optionals appSupport [ dbus ] ++ lib.optionals driverSupport [ libbpf linuxHeaders ]; -- 2.51.0

2 1

[PATCH] release/checks/integration: add nc timeout
by Alyssa Ross 02 Nov '25

02 Nov '25

I recently saw a transient timeout of this test. Looking at the logs, it seems like, before netvm was rebooted, nc was already running, and that nc never failed, getting stuck. Presumably, if it had failed, another nc run would have connected successfully. Avoid this by setting a 2 second timeout for nc to ensure this eternal hang can't happen. Reported-by: Demi Marie Obenour <demiobenour(a)gmail.com> Link: https://spectrum-os.org/lists/archives/spectrum-devel/f52c1aa7-96c0-462b-92… Fixes: ae45978 ("release/checks/networking: init") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- release/checks/integration/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/release/checks/integration/default.nix b/release/checks/integration/default.nix index 340fb6e..81db264 100644 --- a/release/checks/integration/default.nix +++ b/release/checks/integration/default.nix @@ -19,7 +19,7 @@ let type = "nix"; run = writeShellScript "run" '' set -x - while :; do echo hello | ${libressl.nc}/bin/nc -N 10.0.2.2 1234; done + while :; do echo hello | ${libressl.nc}/bin/nc -Nw 2 10.0.2.2 1234; done ''; }; base-commit: b1bb4e5050b09a8edcafc0cf1b1b9c9ab42832bc -- 2.51.0

3 2

Is builtins.readFile okay?
by Demi Marie Obenour 02 Nov '25

02 Nov '25

Is it okay to use builtins.readFile in a Spectrum derivation? If the input is a store path that is Import From Derivation and discouraged, but I don't know if Spectrum's sources will ever be in a store path. -- Sincerely, Demi Marie Obenour (she/her/hers)

2 3

Partitioning in the installer
by Demi Marie Obenour 01 Nov '25

01 Nov '25

I'm working on updates and am very close to getting something that at least runs. However, the installer doesn't support more than three partitions, so I have to create the others manually. Where would the best place to address this be? I'm not sure if this needs a patch to the installer's C source code, or if I should fix it in a script somewhere. -- Sincerely, Demi Marie Obenour (she/her/hers)

3 5

[PATCH 0/3] Switch from mdevd to systemd-udevd in root filesystem
by Demi Marie Obenour 01 Nov '25

01 Nov '25

systemd-udevd provides support for significantly more hardware than mdevd does. Therefore, switch to it. The last patch intentionally uses some packages built with glibc to avoid having to build the world from source. The use of glibc isn't essential and is just because not using the binary cache to build is very, very slow. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Demi Marie Obenour (3): host/rootfs: Add early serial output tools: Add adapter tool for services using sd_notify host/rootfs: switch to systemd-udevd host/rootfs/Makefile | 18 +- host/rootfs/default.nix | 94 +--- host/rootfs/etc/init | 2 +- host/rootfs/etc/mdev.conf | 7 - host/rootfs/etc/mdev/listen | 2 +- host/rootfs/etc/mdev/net/add | 1 + host/rootfs/etc/s6-rc/mdevd-coldplug/dependencies | 4 - host/rootfs/etc/s6-rc/mdevd-coldplug/up | 4 - host/rootfs/etc/s6-rc/mdevd/run | 5 - host/rootfs/etc/s6-rc/ok-all/contents | 2 +- .../dependencies.d/systemd-udevd | 0 .../type | 0 .../type.license | 0 host/rootfs/etc/s6-rc/systemd-udevd-coldplug/up | 3 + host/rootfs/etc/s6-rc/systemd-udevd/flag-essential | 0 .../s6-rc/{mdevd => systemd-udevd}/notification-fd | 0 .../notification-fd.license | 0 host/rootfs/etc/s6-rc/systemd-udevd/run | 10 + .../rootfs/etc/s6-rc/{mdevd => systemd-udevd}/type | 0 .../s6-rc/{mdevd => systemd-udevd}/type.license | 0 host/rootfs/etc/s6-rc/vmm-env/contents | 1 + host/rootfs/etc/s6-rc/weston/dependencies | 4 - .../weston/dependencies.d/systemd-udevd-coldplug | 0 host/rootfs/etc/udev/rules.d/99-spectrum.rules | 5 + tools/default.nix | 1 + tools/meson.build | 1 + tools/sd-notify-adapter/meson.build | 4 + tools/sd-notify-adapter/sd-notify-adapter.c | 490 +++++++++++++++++++++ 28 files changed, 552 insertions(+), 106 deletions(-) --- base-commit: 31121b718d94229809b53c31bfbb0353b6c3d0d1 change-id: 20250911-udev-24cf4bf68fbe -- Sincerely, Demi Marie Obenour (she/her/hers)

3 50

Best practices for submitting tree-wide changes
by Demi Marie Obenour 01 Nov '25

01 Nov '25

In some cases, the same change should be made to many parts of the codebase. This includes things like adding set -o pipefail to shell scripts or moving command substitutions to their own commands. Should one send a single patch that makes all the changes, or should one send a bunch of tiny patches? Preferably, the answer should be added to the documentation so people don't need to ask again :) -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[PATCH 1/2] vm/sys/net: build against pkgsMusl
by Yureka Lilian 31 Oct '25

31 Oct '25

Some of the following changes do not work with pkgsStatic, specifically it is difficult to link libbpf statically[1]. [1] https://lists.fedorahosted.org/archives/list/elfutils-devel@lists.fedorahos… Signed-off-by: Yureka Lilian <yureka(a)cyberchaos.dev> Reviewed-by: Alyssa Ross <hi(a)alyssa.is> --- vm/sys/net/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix index b8dc964..4cdb1c4 100644 --- a/vm/sys/net/default.nix +++ b/vm/sys/net/default.nix @@ -2,8 +2,8 @@ # SPDX-FileCopyrightText: 2021-2023 Alyssa Ross <hi(a)alyssa.is> import ../../../lib/call-package.nix ( -{ spectrum-build-tools, src, terminfo, pkgsStatic }: -pkgsStatic.callPackage ( +{ spectrum-build-tools, src, terminfo, pkgsMusl }: +pkgsMusl.callPackage ( { lib, stdenvNoCC, nixos, runCommand, writeClosure , erofs-utils, jq, s6-rc, util-linux, xorg -- 2.51.0

4 8

[PATCH] Add dontFixup=true to derivations that build images
by Demi Marie Obenour 28 Oct '25

28 Oct '25

This prevents lengthy and pointless scans of large image files. dontFixup is added to the derivations that already used unsafeDiscardReferences. Both dontFixup and unsafeDiscardReferences are added to a derivation that builds an ext4 filesystem image. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/initramfs/default.nix | 3 +++ host/rootfs/default.nix | 1 + img/app/default.nix | 2 ++ release/checks/integration/default.nix | 2 ++ release/combined/default.nix | 3 +++ release/combined/eosimages.nix | 1 + release/live/default.nix | 2 ++ vm-lib/make-vm.nix | 1 + vm/sys/net/default.nix | 2 ++ 9 files changed, 17 insertions(+) diff --git a/host/initramfs/default.nix b/host/initramfs/default.nix index a3672bfeb7002f81bf67bfc13c0b757d46b93d66..51305a7da1645ca63f1c9b2f07a15aa0d5659ff2 100644 --- a/host/initramfs/default.nix +++ b/host/initramfs/default.nix @@ -63,6 +63,7 @@ let nativeBuildInputs = [ cpio ]; __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' cpio -id < ${microcodeAmd}/amd-ucode.img cpio -id < ${microcodeIntel}/intel-ucode.img @@ -82,6 +83,7 @@ let __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' cd ${packagesSysroot} (printf "%s\n" "''${storePrefixes[@]}" && find . $(< $storePaths)) | @@ -118,6 +120,7 @@ stdenvNoCC.mkDerivation { __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; passthru = { inherit packagesSysroot; }; } diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index 484a43f372f934e6b3be0c383d12c9eabf2f7171..1673a83e9d70da6f22fa71c4a79e0eaeff309fc2 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -195,6 +195,7 @@ stdenvNoCC.mkDerivation { __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; passthru = { inherit appvm firmware kernel nixosAllHardware packagesSysroot pkgsGui; diff --git a/img/app/default.nix b/img/app/default.nix index 2863cbdfc067c8a6de018e5f0920d00878cf96ff..5cd381e837db3057590c075cf2b33a486cc188bc 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -134,6 +134,8 @@ stdenvNoCC.mkDerivation { unsafeDiscardReferences = { out = true; }; + dontFixup = true; + meta = with lib; { license = licenses.eupl12; platforms = platforms.linux; diff --git a/release/checks/integration/default.nix b/release/checks/integration/default.nix index 570918613e083b0c2d7c82486544b6405ae5ea89..582a4be8df3098ddaf318b7dac60690c2f8b2304 100644 --- a/release/checks/integration/default.nix +++ b/release/checks/integration/default.nix @@ -37,6 +37,8 @@ let userData = runCommand "user-data.img" { nativeBuildInputs = [ e2fsprogs tar2ext4 ]; + unsafeDiscardReferences = true; + dontFixup = true; } '' tar -Pcvf root.tar \ --transform=s,^${appimage},test.appimage, ${appimage} \ diff --git a/release/combined/default.nix b/release/combined/default.nix index 5c917951f845ee94871a0532f3145493f8ee06ba..cb64f34bef9c397014d7303da39497e1216a2a62 100644 --- a/release/combined/default.nix +++ b/release/combined/default.nix @@ -31,6 +31,7 @@ let nativeBuildInputs = [ squashfs-tools-ng ]; __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' sed 's,^${storeDir}/,,' ${writeClosure [ installer.store ]} | tar -C ${storeDir} -c --verbatim-files-from -T - \ @@ -64,6 +65,7 @@ let __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; passthru = { inherit grubCfg; }; } '' @@ -91,6 +93,7 @@ runCommand "spectrum-installer" { nativeBuildInputs = [ grub jq util-linux systemdMinimal ]; __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; passthru = { inherit eosimages esp installer rootfs; }; } '' blockSize() { diff --git a/release/combined/eosimages.nix b/release/combined/eosimages.nix index 351265bbd54a04b1c1fd3aa6f4c23dad57bd4395..0ac4c48374e7098a2b91f61fc07cebb2042ffbdc 100644 --- a/release/combined/eosimages.nix +++ b/release/combined/eosimages.nix @@ -10,6 +10,7 @@ runCommand "eosimages.img" { image = callSpectrumPackage ../live {}; __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' mkdir dir cd dir diff --git a/release/live/default.nix b/release/live/default.nix index 7a856149de4c736fd850fa37b9f09db9715007a0..5320ce0ecbd7e8912d91f725327a4cfd3d456a54 100644 --- a/release/live/default.nix +++ b/release/live/default.nix @@ -63,6 +63,8 @@ stdenv.mkDerivation { unsafeDiscardReferences = { out = true; }; + dontFixup = true; + passthru = { inherit initramfs rootfs; }; } ) (_: {}) diff --git a/vm-lib/make-vm.nix b/vm-lib/make-vm.nix index 0812b8ea53404c620829fc79bb61005e0bc75b8d..ea7ace99034029325405bd237b8fd50e071bb358 100644 --- a/vm-lib/make-vm.nix +++ b/vm-lib/make-vm.nix @@ -31,6 +31,7 @@ runCommand "spectrum-vm" { __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' mkdir -p $out/{blk,fs,providers} pushd "$out" diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix index b8dc964dd75eccf230cac285dd2a32e7fd75dc9a..478545d2680025a99c2032689c6cc7011dc851c8 100644 --- a/vm/sys/net/default.nix +++ b/vm/sys/net/default.nix @@ -132,6 +132,8 @@ stdenvNoCC.mkDerivation { unsafeDiscardReferences = { out = true; }; + dontFixup = true; + passthru = { inherit firmware kernel packagesSysroot; }; meta = with lib; { --- base-commit: db54efac07deee32f39bdec4e4b8b73674df18c7 change-id: 20251025-dont-fixup-5389ba1b0b7f -- Sincerely, Demi Marie Obenour (she/her/hers)

3 3

[PATCH] release/checks/integration: adjust timeout when no KVM
by Alyssa Ross 26 Oct '25

26 Oct '25

We never use KVM for these on aarch64, but KVM may also not be used on x86_64 if it's unavailable. Checking for write access to /dev/kvm should be a decent proxy for that. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- Demi, hopefully this can make development on Qubes OS a bit less annoying (albiet still slow). release/checks/integration/default.nix | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/release/checks/integration/default.nix b/release/checks/integration/default.nix index 5709186..eb3be07 100644 --- a/release/checks/integration/default.nix +++ b/release/checks/integration/default.nix @@ -65,10 +65,11 @@ stdenv.mkDerivation (finalAttrs: { doCheck = true; dontAddTimeoutMultiplier = true; - mesonCheckFlags = lib.optionals stdenv.hostPlatform.isAarch64 [ - # Tests are run with TCG on aarch64. - "--timeout-multiplier=15" - ]; + preCheck = '' + if [ -n "$FORCE_LONG_TIMEOUTS" ] || ! [ -w /dev/kvm ]; then + mesonCheckFlagsArray+=(--timeout-multiplier=15) + fi + ''; installPhase = '' runHook preInstall @@ -83,6 +84,7 @@ stdenv.mkDerivation (finalAttrs: { env = { QEMU_SYSTEM = "qemu-system-${stdenv.hostPlatform.qemuArch} -nographic"; EFI_PATH = "${qemu_kvm}/share/qemu/edk2-${stdenv.hostPlatform.qemuArch}-code.fd"; + FORCE_LONG_TIMEOUTS = toString stdenv.buildPlatform.isAarch64; IMG_PATH = live; USER_DATA_PATH = userData; }; -- 2.51.0

1 0

[PATCH] scripts/make-erofs.sh: Standardize file modes in images
by Demi Marie Obenour 25 Oct '25

25 Oct '25

Enforce that anything under /var or /etc is 0755 for directories and executable files and 0644 for anything else. Enforce that anything else is 0555 for directories and executable files and 0444 for anything else. This avoids depending on factors that may depend on the build environment, such as the user's umask. This requires that /var always exist, so add it to img/app/Makefile. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/Makefile | 3 ++- img/app/Makefile | 2 +- scripts/make-erofs.sh | 21 +++++++++++++++++++++ 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index aa45ca1d5c18d0dfb78d19267f263cc4222e8e84..ba1beddabb46afa6b20e66177107fbe6b6f42bd2 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -40,7 +40,8 @@ DIRS = \ ext \ proc \ run \ - sys + sys \ + var FIFOS = etc/s6-linux-init/run-image/service/s6-svscan-log/fifo diff --git a/img/app/Makefile b/img/app/Makefile index 981889ebe55d9ba03228977f3dc0ea3f26d5c4fb..2540075fbb2cdcbcde29853cb0ffe676de0b9063 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -30,7 +30,7 @@ $(imgdir)/appvm/blk/root.img: ../../scripts/make-gpt.sh ../../scripts/sfdisk-fie build/rootfs.erofs:root:5460386f-2203-4911-8694-91400125c604:root mv $@.tmp $@ -DIRS = dev run proc sys tmp \ +DIRS = dev run proc sys tmp var \ etc/s6-linux-init/run-image/service \ etc/s6-linux-init/run-image/user \ etc/s6-linux-init/run-image/wait diff --git a/scripts/make-erofs.sh b/scripts/make-erofs.sh index ad04844387c880047a79f2f05e1e985d8bd4229c..5e283a380dbdae3dbfb83d43915e5015a2ae6f04 100755 --- a/scripts/make-erofs.sh +++ b/scripts/make-erofs.sh @@ -68,4 +68,25 @@ while read -r arg1; do cp -RT -- "$arg1" "$root/$arg2" done +# Ensure that the permissions in the image are independent +# of those in the git repository or Nix store, except for +# the executable bit. In particular, the mode of those +# outside the Nix store might depend on the user's umask. +# While the image itself is strictly read-only, it makes +# sense to populate an overlayfs over /etc and /var, and +# this overlayfs should be writable by root and readable +# by all users. The remaining paths should not be writable +# by anyone, but should be world-readable. +find "$root" \ + -path "$root/nix/store" -prune -o \ + -path "$root/etc" -prune -o \ + -path "$root/var" -prune -o \ + -type l -o \ + -type d -a -perm 0555 -o \ + -type f -a -perm 0444 -o \ + -execdir chmod ugo-w,ugo+rX -- '{}' + +find "$root/etc" "$root/var" ! -type l -execdir chmod u+w,go-w,ugo+rX -- '{}' + +chmod 0755 "$root" + +# Make the erofs image. mkfs.erofs -x-1 -b4096 --all-root "$@" "$root" --- base-commit: c5d5786d3dc938af0b279c542d1e43bce381b4b9 change-id: 20251021-fix-permissions-4549d0653368 -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1