publish: the public projection begins here
This is a projection, not a development branch. The tree above was constructed from the internal source named below under a manifest that decides which paths may leave, then scanned as a whole tree rather than as a series of patches, and only then published. Public history starts here because the history before it was not admissible, and neither was the tree. What used to stand in this repository included a rescue copy of another machine, a directory of phone handoffs, deployment wired to one house, and a submodule pointing at a forge no stranger can reach. None of that was ever the product. It stays in the private forge, which is allowed to hold the whole working organism, and this is what was deliberately sent out instead. Three mechanisms produced this tree, in decreasing order of trust. A top-level path the manifest does not name never arrives at all, which is the one that catches directories nobody has thought of yet. Named internal files inside admitted roots are dropped. A short, reviewed table replaces deployment defaults that a public build must not carry -- an endpoint aimed at one LAN, a VPN profile belonging to one phone, packaging built from one checkout path. Everything after this commit is an ordinary publication with the same three trailers, so a force push stops being routine and starts meaning that something deliberate happened. The trailers bind the projection to its source without pretending the public SHA is the private one: same lineage, different tree, and the record says so. Source-Sha: 8f27b1e76a8fef560a336aba18e6990713ff1047 Policy-Sha: 6b261d2f3e6e1fb19874846ba4bb1dfe15565d25b8618c1c1afba0419c101d27 Tree-Digest: 18ec3563c5e5ef9a414993a9f6734b251ff9ed3cd56eebdd6cac01e45c6e3067
This commit is contained in:
Fimeg
commit
8f42fc953d
1476 changed files with 238455 additions and 0 deletions
7
packaging/arch/50-souveraine-power-key.conf
Normal file
7
packaging/arch/50-souveraine-power-key.conf
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
[Login]
|
||||
# ViewTop reports physical button edges to sessiond, which recognises the
|
||||
# gesture and owns the resulting lock, panel or power action. Letting logind's
|
||||
# default short press power the machine off gives the same button a second
|
||||
# authority and makes a compositor recovery attempt become a shutdown.
|
||||
HandlePowerKey=ignore
|
||||
HandlePowerKeyLongPress=ignore
|
||||
56
packaging/arch/PKGBUILD
Normal file
56
packaging/arch/PKGBUILD
Normal file
|
|
@ -0,0 +1,56 @@
|
|||
# Maintainer: Fimeg <casey.tunturi@gmail.com>
|
||||
# Souveraine — sovereign agent substrate. Part of the SouveraineOS layer;
|
||||
# the phone runs the same server + agents as the desktop.
|
||||
pkgname=souveraine
|
||||
pkgver=0.1.0
|
||||
pkgrel=1
|
||||
pkgdesc="Sovereign agent substrate — server, TUI, surfaces"
|
||||
arch=('aarch64' 'x86_64')
|
||||
url="https://github.com/Fimeg/souveraine"
|
||||
license=('MIT')
|
||||
depends=('gcc-libs' 'polkit')
|
||||
makedepends=('cargo' 'git')
|
||||
options=('!lto')
|
||||
|
||||
# Build from the local checkout synced by deploy-souveraine.sh (or a git
|
||||
# clone at $HOME/souveraine-src on device). No network fetch — the
|
||||
# phone builds what the laptop ships. Override with SOUVERAINE_SRCDIR.
|
||||
_srcdir="${SOUVERAINE_SRCDIR:-$HOME/souveraine-src}"
|
||||
|
||||
pkgver() {
|
||||
cd "$_srcdir"
|
||||
git describe --tags --always 2>/dev/null | sed 's/^v//;s/-/./g' || echo "$pkgver"
|
||||
}
|
||||
|
||||
build() {
|
||||
cd "$_srcdir"
|
||||
cargo build --release --locked
|
||||
}
|
||||
|
||||
package() {
|
||||
cd "$_srcdir"
|
||||
install -Dm755 target/release/souveraine "$pkgdir/usr/bin/souveraine"
|
||||
# repo unit points at ~/.local/bin (desktop dev install); packaged unit
|
||||
# runs the pacman-owned binary
|
||||
sed 's|%h/.local/bin/souveraine|/usr/bin/souveraine|' packaging/souveraine.service \
|
||||
| install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/souveraine.service"
|
||||
|
||||
# System tier: machine identity daemon + its service user. pacman runs
|
||||
# systemd-sysusers on install, so the `souveraine` user exists before
|
||||
# anyone runs `souveraine machine init`.
|
||||
install -Dm755 target/release/souveraine-admit "$pkgdir/usr/bin/souveraine-admit"
|
||||
install -Dm755 target/release/souveraine-machined "$pkgdir/usr/bin/souveraine-machined"
|
||||
install -Dm644 packaging/souveraine-machined.service \
|
||||
"$pkgdir/usr/lib/systemd/system/souveraine-machined.service"
|
||||
install -Dm644 packaging/arch/souveraine.sysusers \
|
||||
"$pkgdir/usr/lib/sysusers.d/souveraine.conf"
|
||||
|
||||
# Let the active local session power off / reboot / suspend / hibernate
|
||||
# without an interactive polkit challenge — otherwise the lock surface
|
||||
# (no agent above session lock) silently no-ops these and every shutdown
|
||||
# is a fastboot hard-reboot.
|
||||
install -Dm644 packaging/arch/souveraine-login1.rules \
|
||||
"$pkgdir/etc/polkit-1/rules.d/49-souveraine-login1.rules"
|
||||
|
||||
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
|
||||
}
|
||||
46
packaging/arch/PKGBUILD.provision-x86-laptop
Normal file
46
packaging/arch/PKGBUILD.provision-x86-laptop
Normal file
|
|
@ -0,0 +1,46 @@
|
|||
# Maintainer: Casey Tunturi
|
||||
|
||||
pkgname=souveraine-provision-x86-laptop
|
||||
pkgver="${SOUVERAINE_PKGVER:?CI must set SOUVERAINE_PKGVER}"
|
||||
pkgrel=1
|
||||
pkgdesc='SouveraineOS commissioning and session activation for x86_64 laptops'
|
||||
arch=('x86_64')
|
||||
url='https://forge.caseytunturi.com/Fimeg/souveraine'
|
||||
license=('AGPL-3.0-or-later')
|
||||
depends=('souveraine' 'souveraine-viewtop' 'souveraine-shell' 'systemd')
|
||||
source=('souveraine-machine-firstboot.service'
|
||||
'souveraine-provision-x86-laptop.tmpfiles'
|
||||
'50-souveraine-power-key.conf'
|
||||
'LICENSE')
|
||||
sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP')
|
||||
|
||||
package() {
|
||||
install -Dm644 "$srcdir/souveraine-machine-firstboot.service" \
|
||||
"$pkgdir/usr/lib/systemd/system/souveraine-machine-firstboot.service"
|
||||
install -Dm644 "$srcdir/souveraine-provision-x86-laptop.tmpfiles" \
|
||||
"$pkgdir/usr/lib/tmpfiles.d/souveraine-provision-x86-laptop.conf"
|
||||
install -Dm644 "$srcdir/50-souveraine-power-key.conf" \
|
||||
"$pkgdir/usr/lib/systemd/logind.conf.d/50-souveraine-power-key.conf"
|
||||
|
||||
# The profile owns activation. Package install lays down the dependency
|
||||
# graph without running a post-install hook or writing into /etc.
|
||||
install -dm755 "$pkgdir/usr/lib/systemd/system/multi-user.target.wants"
|
||||
ln -s ../souveraine-machine-firstboot.service \
|
||||
"$pkgdir/usr/lib/systemd/system/multi-user.target.wants/souveraine-machine-firstboot.service"
|
||||
ln -s ../souveraine-machined.service \
|
||||
"$pkgdir/usr/lib/systemd/system/multi-user.target.wants/souveraine-machined.service"
|
||||
|
||||
install -dm755 \
|
||||
"$pkgdir/usr/lib/systemd/user/graphical-session-pre.target.wants" \
|
||||
"$pkgdir/usr/lib/systemd/user/graphical-session.target.wants" \
|
||||
"$pkgdir/usr/lib/systemd/user/souveraine-sessiond.service.wants"
|
||||
ln -s ../souveraine-sessiond.service \
|
||||
"$pkgdir/usr/lib/systemd/user/graphical-session-pre.target.wants/souveraine-sessiond.service"
|
||||
ln -s ../souveraine-shell.service \
|
||||
"$pkgdir/usr/lib/systemd/user/graphical-session.target.wants/souveraine-shell.service"
|
||||
ln -s ../souveraine-sensord.service \
|
||||
"$pkgdir/usr/lib/systemd/user/souveraine-sessiond.service.wants/souveraine-sensord.service"
|
||||
|
||||
install -Dm644 "$srcdir/LICENSE" \
|
||||
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
|
||||
}
|
||||
247
packaging/arch/publish-version.sh
Executable file
247
packaging/arch/publish-version.sh
Executable file
|
|
@ -0,0 +1,247 @@
|
|||
#!/usr/bin/env bash
|
||||
# Build and publish one immutable, signed pacman repository for a version tag.
|
||||
#
|
||||
# The tag is the release decision. It must be an annotated signed vMAJOR.MINOR.PATCH
|
||||
# tag whose commit is already reachable from internal Gitea's public branch. This
|
||||
# job publishes only to internal Gitea. Publication Rail copies the exact tag and
|
||||
# these exact bytes to Forge after its independent checks pass.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
TAG="${1:?usage: publish-version.sh <tag> <repo-dir> [extra-asset ...]}"
|
||||
REPO_DIR="${2:?usage: publish-version.sh <tag> <repo-dir> [extra-asset ...]}"
|
||||
shift 2
|
||||
EXTRA_ASSETS=("$@")
|
||||
|
||||
: "${RELEASE_TOKEN:?RELEASE_TOKEN must be set}"
|
||||
: "${ARCHIVE_KEY:?ARCHIVE_KEY must be set}"
|
||||
|
||||
[[ "$TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]] \
|
||||
|| { echo "FATAL: stable release tag must be vMAJOR.MINOR.PATCH" >&2; exit 1; }
|
||||
|
||||
SERVER="${GITHUB_SERVER_URL:?GITHUB_SERVER_URL must be set}"
|
||||
ARCHIVE_REPO="${ARCHIVE_REPO:-${GITHUB_REPOSITORY:?GITHUB_REPOSITORY must be set}}"
|
||||
API="$SERVER/api/v1"
|
||||
AUTH="Authorization: token $RELEASE_TOKEN"
|
||||
|
||||
log() { echo "[publish-version] $*"; }
|
||||
api() { curl -sf -H "$AUTH" "$@"; }
|
||||
|
||||
TAG_OBJECT=$(git rev-parse --verify "$TAG^{tag}" 2>/dev/null) \
|
||||
|| { echo "FATAL: $TAG is not an annotated tag" >&2; exit 1; }
|
||||
COMMIT=$(git rev-parse --verify "$TAG^{commit}")
|
||||
if [ "$COMMIT" != "${GITHUB_SHA:?GITHUB_SHA must be set}" ]; then
|
||||
echo "FATAL: $TAG peels to $COMMIT, workflow is building $GITHUB_SHA" >&2
|
||||
exit 1
|
||||
fi
|
||||
git merge-base --is-ancestor "$COMMIT" refs/remotes/origin/public \
|
||||
|| { echo "FATAL: $TAG is not reachable from internal public" >&2; exit 1; }
|
||||
|
||||
# Trust in the signer is checked by the root-owned boundary service. The product
|
||||
# job only refuses unsigned/lightweight tags so it cannot accidentally mint a
|
||||
# release shape the boundary will never accept.
|
||||
git cat-file tag "$TAG_OBJECT" \
|
||||
| grep -Eq '^-----BEGIN (PGP|SSH) SIGNATURE-----$' \
|
||||
|| { echo "FATAL: $TAG has no Git tag signature" >&2; exit 1; }
|
||||
|
||||
STAGE=$(mktemp -d)
|
||||
trap 'rm -rf "$STAGE"' EXIT
|
||||
ASSETS="$STAGE/assets"
|
||||
mkdir -p "$ASSETS"
|
||||
|
||||
for ARCH_DIR in "$REPO_DIR"/*/; do
|
||||
[ -d "$ARCH_DIR" ] || continue
|
||||
ARCH=$(basename "$ARCH_DIR")
|
||||
shopt -s nullglob
|
||||
PKGS=("$ARCH_DIR"*.pkg.tar.zst)
|
||||
shopt -u nullglob
|
||||
[ ${#PKGS[@]} -gt 0 ] || continue
|
||||
|
||||
DB="souveraine-$ARCH"
|
||||
WORK="$STAGE/$ARCH"
|
||||
mkdir -p "$WORK"
|
||||
for package in "${PKGS[@]}"; do
|
||||
[ -f "$package.sig" ] \
|
||||
|| { echo "FATAL: unsigned package $(basename "$package")" >&2; exit 1; }
|
||||
gpg --batch --verify "$package.sig" "$package"
|
||||
cp "$package" "$package.sig" "$ASSETS/"
|
||||
done
|
||||
|
||||
repo-add --include-sigs --sign --key "$ARCHIVE_KEY" \
|
||||
"$WORK/$DB.db.tar.zst" "${PKGS[@]}"
|
||||
gpg --batch --verify "$WORK/$DB.db.tar.zst.sig" "$WORK/$DB.db.tar.zst"
|
||||
|
||||
rm -f "$WORK/$DB.db" "$WORK/$DB.db.sig"
|
||||
cp "$WORK/$DB.db.tar.zst" "$ASSETS/$DB.db.tar.zst"
|
||||
cp "$WORK/$DB.db.tar.zst.sig" "$ASSETS/$DB.db.tar.zst.sig"
|
||||
cp "$WORK/$DB.db.tar.zst" "$ASSETS/$DB.db"
|
||||
cp "$WORK/$DB.db.tar.zst.sig" "$ASSETS/$DB.db.sig"
|
||||
if [ -f "$WORK/$DB.files.tar.zst" ]; then
|
||||
cp "$WORK/$DB.files.tar.zst" "$ASSETS/$DB.files.tar.zst"
|
||||
cp "$WORK/$DB.files.tar.zst" "$ASSETS/$DB.files"
|
||||
if [ -f "$WORK/$DB.files.tar.zst.sig" ]; then
|
||||
cp "$WORK/$DB.files.tar.zst.sig" "$ASSETS/$DB.files.tar.zst.sig"
|
||||
cp "$WORK/$DB.files.tar.zst.sig" "$ASSETS/$DB.files.sig"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
shopt -s nullglob
|
||||
BUILT_PACKAGES=("$ASSETS"/*.pkg.tar.zst)
|
||||
shopt -u nullglob
|
||||
[ ${#BUILT_PACKAGES[@]} -gt 0 ] \
|
||||
|| { echo "FATAL: no packages were assembled" >&2; exit 1; }
|
||||
|
||||
cp packaging/arch/souveraine-archive-key.asc "$ASSETS/"
|
||||
cp packaging/arch/souveraine-stable.conf "$ASSETS/"
|
||||
for asset in "${EXTRA_ASSETS[@]+"${EXTRA_ASSETS[@]}"}"; do
|
||||
[ -f "$asset" ] || { echo "FATAL: release asset is absent: $asset" >&2; exit 1; }
|
||||
cp "$asset" "$ASSETS/"
|
||||
done
|
||||
|
||||
python3 - "$ASSETS" "$ARCHIVE_REPO" "$TAG" "$TAG_OBJECT" "$COMMIT" <<'PY'
|
||||
import hashlib
|
||||
import json
|
||||
from pathlib import Path
|
||||
import sys
|
||||
|
||||
assets = Path(sys.argv[1])
|
||||
entries = []
|
||||
for path in sorted(assets.iterdir(), key=lambda item: item.name):
|
||||
if not path.is_file():
|
||||
continue
|
||||
digest = hashlib.sha256()
|
||||
with path.open("rb") as handle:
|
||||
for block in iter(lambda: handle.read(1024 * 1024), b""):
|
||||
digest.update(block)
|
||||
entries.append({"name": path.name, "sha256": digest.hexdigest(), "size": path.stat().st_size})
|
||||
|
||||
manifest = {
|
||||
"schema_version": 1,
|
||||
"repository": sys.argv[2],
|
||||
"tag": sys.argv[3],
|
||||
"tag_object": sys.argv[4],
|
||||
"commit": sys.argv[5],
|
||||
"public_ref": "refs/heads/public",
|
||||
"archive_key_fingerprint": "3CD9E99E222C2A174986FC9AFF4949AA20C8E911",
|
||||
"assets": entries,
|
||||
}
|
||||
(assets / "publication-manifest.json").write_text(
|
||||
json.dumps(manifest, indent=2, sort_keys=True) + "\n", encoding="utf-8"
|
||||
)
|
||||
PY
|
||||
gpg --batch --yes --local-user "$ARCHIVE_KEY" \
|
||||
--detach-sign "$ASSETS/publication-manifest.json"
|
||||
|
||||
REL_JSON=$(curl -s -H "$AUTH" "$API/repos/$ARCHIVE_REPO/releases/tags/$TAG" || true)
|
||||
REL_ID=$(printf '%s' "$REL_JSON" | python3 -c '
|
||||
import json, sys
|
||||
try:
|
||||
print(json.load(sys.stdin).get("id", ""))
|
||||
except Exception:
|
||||
print("")
|
||||
')
|
||||
|
||||
if [ -z "$REL_ID" ]; then
|
||||
REL_ID=$(api -X POST -H 'Content-Type: application/json' \
|
||||
"$API/repos/$ARCHIVE_REPO/releases" \
|
||||
-d "$(python3 - "$TAG" "$COMMIT" <<'PY'
|
||||
import json, sys
|
||||
print(json.dumps({
|
||||
"tag_name": sys.argv[1],
|
||||
"target_commitish": sys.argv[2],
|
||||
"name": sys.argv[1],
|
||||
"body": "Immutable signed package release built once by internal Gitea.",
|
||||
"draft": True,
|
||||
"prerelease": False,
|
||||
}))
|
||||
PY
|
||||
)" | python3 -c 'import json, sys; print(json.load(sys.stdin)["id"])')
|
||||
log "created draft release $REL_ID for $TAG"
|
||||
else
|
||||
LIVE_COMMIT=$(printf '%s' "$REL_JSON" | python3 -c '
|
||||
import json, sys
|
||||
body = json.load(sys.stdin)
|
||||
print(body.get("target_commitish") or body.get("target") or "")
|
||||
')
|
||||
[ -z "$LIVE_COMMIT" ] || [ "$LIVE_COMMIT" = "$COMMIT" ] \
|
||||
|| { echo "FATAL: existing $TAG release targets $LIVE_COMMIT, expected $COMMIT" >&2; exit 1; }
|
||||
log "resuming release $REL_ID for $TAG"
|
||||
fi
|
||||
|
||||
asset_ids() {
|
||||
api "$API/repos/$ARCHIVE_REPO/releases/$REL_ID/assets" | python3 -c '
|
||||
import json, sys
|
||||
name = sys.argv[1]
|
||||
for asset in json.load(sys.stdin):
|
||||
if asset.get("name") == name:
|
||||
print(asset.get("id", ""))
|
||||
' "$1"
|
||||
}
|
||||
|
||||
upload_immutable() {
|
||||
local path="$1" name ids count live
|
||||
name=$(basename "$path")
|
||||
ids=$(asset_ids "$name")
|
||||
count=$(printf '%s\n' "$ids" | sed '/^$/d' | wc -l)
|
||||
if [ "$count" -gt 1 ]; then
|
||||
echo "FATAL: existing $TAG release has duplicate asset $name" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [ "$count" -eq 1 ]; then
|
||||
live="$STAGE/live-$name"
|
||||
curl -sfL -H "$AUTH" "$SERVER/$ARCHIVE_REPO/releases/download/$TAG/$name" -o "$live"
|
||||
cmp -s "$path" "$live" \
|
||||
|| { echo "FATAL: immutable asset $name already exists with different bytes" >&2; exit 1; }
|
||||
log "kept identical $name"
|
||||
return
|
||||
fi
|
||||
curl -sf -X POST -H "$AUTH" \
|
||||
"$API/repos/$ARCHIVE_REPO/releases/$REL_ID/assets?name=$name" \
|
||||
-F "attachment=@$path" -o /dev/null
|
||||
log "uploaded $name"
|
||||
}
|
||||
|
||||
# Packages and their signatures land before databases. The signed manifest is
|
||||
# last, so its presence means every byte it names was already accepted.
|
||||
for path in "$ASSETS"/*.pkg.tar.zst "$ASSETS"/*.pkg.tar.zst.sig; do
|
||||
[ -f "$path" ] && upload_immutable "$path"
|
||||
done
|
||||
for path in "$ASSETS"/*; do
|
||||
[ -f "$path" ] || continue
|
||||
case "$(basename "$path")" in
|
||||
*.pkg.tar.zst|*.pkg.tar.zst.sig|*.db|*.db.sig|*.db.tar.zst|*.db.tar.zst.sig|publication-manifest.json|publication-manifest.json.sig)
|
||||
continue
|
||||
;;
|
||||
esac
|
||||
upload_immutable "$path"
|
||||
done
|
||||
for path in "$ASSETS"/*.db.tar.zst "$ASSETS"/*.db.tar.zst.sig "$ASSETS"/*.db "$ASSETS"/*.db.sig; do
|
||||
[ -f "$path" ] && upload_immutable "$path"
|
||||
done
|
||||
upload_immutable "$ASSETS/publication-manifest.json"
|
||||
upload_immutable "$ASSETS/publication-manifest.json.sig"
|
||||
|
||||
api -X PATCH -H 'Content-Type: application/json' \
|
||||
"$API/repos/$ARCHIVE_REPO/releases/$REL_ID" \
|
||||
-d "$(python3 - "$TAG" <<'PY'
|
||||
import json, sys
|
||||
print(json.dumps({
|
||||
"name": sys.argv[1],
|
||||
"body": "Immutable signed package release built once by internal Gitea.",
|
||||
"draft": False,
|
||||
"prerelease": False,
|
||||
}))
|
||||
PY
|
||||
)" -o /dev/null
|
||||
|
||||
for path in "$ASSETS"/*; do
|
||||
[ -f "$path" ] || continue
|
||||
live="$STAGE/verify-$(basename "$path")"
|
||||
curl -sfL -H "$AUTH" \
|
||||
"$SERVER/$ARCHIVE_REPO/releases/download/$TAG/$(basename "$path")" -o "$live"
|
||||
cmp -s "$path" "$live" \
|
||||
|| { echo "FATAL: read-back differs for $(basename "$path")" >&2; exit 1; }
|
||||
done
|
||||
|
||||
log "$TAG published internally at $COMMIT with ${#BUILT_PACKAGES[@]} packages"
|
||||
10
packaging/arch/souveraine-archive-key.asc
Normal file
10
packaging/arch/souveraine-archive-key.asc
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mDMEalQ47RYJKwYBBAHaRw8BAQdAr8Qx2Czxw1qJNp7Io9usd9P1ayqHYuuHCzNm
|
||||
9k6ocYO0NlNvdXZlcmFpbmUgUGFja2FnZSBBcmNoaXZlIDxwYWNrYWdlc0Bzb3V2
|
||||
ZXJhaW5lLmxvY2FsPoiWBBMWCgA+FiEEPNnpniIsKhdJhvya/0lJqiDI6REFAmpU
|
||||
OO0CGwMFCQPCZwAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ/0lJqiDI6RHb
|
||||
lgD9E8WBlE4agkW2bXq9X6Hz86lRWdlWOHkxUCnCZN3HMS8A/1WE8gL8U5A2grDD
|
||||
bWms5/iphtrh2S1Up031H9a+bvEL
|
||||
=/YGc
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
31
packaging/arch/souveraine-login1.rules
Normal file
31
packaging/arch/souveraine-login1.rules
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
// Souveraine — let the active local session power off, reboot, suspend, and
|
||||
// hibernate without an interactive polkit challenge.
|
||||
//
|
||||
// Without this, login1 returns 'challenge' for CanPowerOff/CanReboot on
|
||||
// every call, and the session has no usable polkit agent on the lock
|
||||
// surface, so power off / reboot silently no-op'd and every shutdown was a
|
||||
// fastboot hard-reboot.
|
||||
//
|
||||
// Doctrine boundary: this grants every process in the authenticated active
|
||||
// local seat0 session unchallenged power state. That authority remains while
|
||||
// the session is screen-locked; a Wayland lock is not a new logind session.
|
||||
// Config.options.lock.security.allowPowerFromLock (default false, opt-in)
|
||||
// gates only Souveraine's lock-surface buttons, and requirePasswordToPower can
|
||||
// arm those buttons for PIN confirmation. They do not constrain arbitrary
|
||||
// local D-Bus clients. Remote/SSH sessions are NOT granted.
|
||||
//
|
||||
// Mirrors the default rule every desktop (GNOME/KDE/Phosh) ships.
|
||||
|
||||
polkit.addRule(function(action, subject) {
|
||||
if ((action.id === "org.freedesktop.login1.power-off" ||
|
||||
action.id === "org.freedesktop.login1.power-off-multiple-sessions" ||
|
||||
action.id === "org.freedesktop.login1.reboot" ||
|
||||
action.id === "org.freedesktop.login1.reboot-multiple-sessions" ||
|
||||
action.id === "org.freedesktop.login1.suspend" ||
|
||||
action.id === "org.freedesktop.login1.suspend-multiple-sessions" ||
|
||||
action.id === "org.freedesktop.login1.hibernate" ||
|
||||
action.id === "org.freedesktop.login1.hibernate-multiple-sessions") &&
|
||||
subject.active && subject.local && subject.seat === "seat0") {
|
||||
return polkit.Result.YES;
|
||||
}
|
||||
});
|
||||
1
packaging/arch/souveraine-provision-x86-laptop.tmpfiles
Normal file
1
packaging/arch/souveraine-provision-x86-laptop.tmpfiles
Normal file
|
|
@ -0,0 +1 @@
|
|||
d /var/lib/souveraine 0700 souveraine souveraine -
|
||||
13
packaging/arch/souveraine-stable.conf
Normal file
13
packaging/arch/souveraine-stable.conf
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# Public stable releases. Each update is an immutable version tag already
|
||||
# accepted on internal Gitea's public branch; Publication Rail advances this
|
||||
# feed only after it copies and anonymously verifies the signed release bytes.
|
||||
#
|
||||
# Install this file as /etc/pacman.d/souveraine-stable.conf, replace __ARCH__
|
||||
# with the machine architecture, import souveraine-archive-key.asc, then add:
|
||||
#
|
||||
# Include = /etc/pacman.d/souveraine-stable.conf
|
||||
#
|
||||
# to /etc/pacman.conf.
|
||||
[souveraine-__ARCH__]
|
||||
SigLevel = Required DatabaseRequired
|
||||
Server = https://forge.caseytunturi.com/Fimeg/souveraine/releases/download/stable
|
||||
18
packaging/arch/souveraine.sysusers
Normal file
18
packaging/arch/souveraine.sysusers
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
# The `souveraine` system user owns the machine's system tier: the machine
|
||||
# seed (/var/lib/souveraine) and the machined socket (/run/souveraine).
|
||||
# Session users join the group to talk to the daemon:
|
||||
# usermod -aG souveraine <user>
|
||||
u souveraine - "SouveraineOS system tier" /var/lib/souveraine -
|
||||
|
||||
# The lock authority's principal. Declared here because it is machine-tier —
|
||||
# one per install, like `souveraine`, and not an agent. sessiond is still a
|
||||
# user unit with no User=; moving it here without first proving the Wayland
|
||||
# lock handshake, PAM path, crash retake, and key-eviction order would only
|
||||
# relocate the black screen. See souveraine/saf/authority/01-session.md.
|
||||
u souveraine-session - "SouveraineOS lock authority" /var/lib/souveraine-session -
|
||||
|
||||
# Agent principals (souvie, annie, vanguard, …) are deliberately NOT here.
|
||||
# sysusers is per-install; admission is per-agent and per-node, keyed to an
|
||||
# agent ID rather than a display name, and must refuse collisions. A line
|
||||
# here would mint accounts on every device the package ever touches.
|
||||
# See souveraine/saf/identity/02-agent-principal.md.
|
||||
4
packaging/org.freedesktop.secrets.service
Normal file
4
packaging/org.freedesktop.secrets.service
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
[D-BUS Service]
|
||||
Name=org.freedesktop.secrets
|
||||
Exec=/usr/local/bin/souveraine-secrets
|
||||
SystemdService=souveraine-secrets.service
|
||||
21
packaging/org.souveraine.stepup.policy
Normal file
21
packaging/org.souveraine.stepup.policy
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE policyconfig PUBLIC
|
||||
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
|
||||
"http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
|
||||
<policyconfig>
|
||||
<vendor>SouveraineOS</vendor>
|
||||
<vendor_url>https://forge.caseytunturi.com/Fimeg/souveraine</vendor_url>
|
||||
|
||||
<!-- Fallback path for StepUpAuth on targets without a PamContext route.
|
||||
auth_self, never auth_admin: step-up re-proves the user to themselves,
|
||||
it does not escalate. Inactive sessions get nothing. -->
|
||||
<action id="org.souveraine.stepup">
|
||||
<description>Confirm a sensitive Souveraine action</description>
|
||||
<message>Authentication is required to confirm this action</message>
|
||||
<defaults>
|
||||
<allow_any>no</allow_any>
|
||||
<allow_inactive>no</allow_inactive>
|
||||
<allow_active>auth_self</allow_active>
|
||||
</defaults>
|
||||
</action>
|
||||
</policyconfig>
|
||||
68
packaging/souveraine-button
Executable file
68
packaging/souveraine-button
Executable file
|
|
@ -0,0 +1,68 @@
|
|||
#!/bin/sh
|
||||
# Report a hardware button edge to the session authority. That is all it does.
|
||||
#
|
||||
# It replaces `blueline-power-button`, which was policy in shell script: it read
|
||||
# its own copy of the panel state, asked the SHELL to lock over `qs ipc`, polled
|
||||
# `session state` twenty times at 100 ms grepping JSON for `"locked": true`, and
|
||||
# then called `blueline-screen-toggle off` itself. Three separate problems:
|
||||
#
|
||||
# 1. It blanked the panel without going through sessiond's `request_blank()`,
|
||||
# so LOCK-DPMS-LESSONS §1 ("every path to a dark panel routes through it —
|
||||
# an invariant, not a coincidence") had a hole in it, and the hole was the
|
||||
# most-used control on the device.
|
||||
# 2. It carried its own copy of the lock-then-blank ordering, which is the
|
||||
# exact duplication DEVICE-STATE-MACHINE §1 is about: seven blind actors,
|
||||
# three of which can turn the screen off.
|
||||
# 3. It could only ever see one edge, so it could never tell a tap from a
|
||||
# hold. Gesture recognition needs time, and a process that exits cannot
|
||||
# hold any.
|
||||
#
|
||||
# Now the machine owns all three. This reports `down` and `up`; sessiond
|
||||
# accumulates them into tap / double / triple / hold and decides what, if
|
||||
# anything, that means.
|
||||
#
|
||||
# Wire it up in hyprland.lua as a PAIR — press and release:
|
||||
#
|
||||
# hl.bind( "XF86PowerOff", hl.dsp.exec_cmd("souveraine-button power down"), { locked = true })
|
||||
# hl.bindr("XF86PowerOff", hl.dsp.exec_cmd("souveraine-button power up"), { locked = true })
|
||||
#
|
||||
# Only reporting `down` gives you a machine that thinks the button is held
|
||||
# forever: the hold threshold passes, `Hold` fires, and no `Tap` ever resolves.
|
||||
set -eu
|
||||
|
||||
button=${1:-power}
|
||||
edge=${2:-down}
|
||||
|
||||
case "$edge" in
|
||||
down | up) ;;
|
||||
*)
|
||||
echo "usage: souveraine-button <power|volume_up|volume_down> <down|up>" >&2
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
|
||||
runtime=${XDG_RUNTIME_DIR:-/run/user/$(id -u)}
|
||||
sock="$runtime/souveraine/sessiond.sock"
|
||||
|
||||
line="{\"op\":\"button\",\"button\":\"$button\",\"edge\":\"$edge\"}"
|
||||
|
||||
# Fire and forget, with a hard timeout. A button press must never block on the
|
||||
# authority being slow — the user is holding the button and the phone must not
|
||||
# feel stuck. Losing an edge degrades to a missed gesture, which is recoverable;
|
||||
# hanging here is not.
|
||||
#
|
||||
# No nc/socat on this device (checked), so this is Python's stdlib or nothing.
|
||||
exec timeout 1 python3 -c '
|
||||
import socket, sys
|
||||
sock, line = sys.argv[1], sys.argv[2]
|
||||
try:
|
||||
s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
|
||||
s.settimeout(0.8)
|
||||
s.connect(sock)
|
||||
s.sendall((line + "\n").encode())
|
||||
except Exception:
|
||||
# sessiond down. Say so in the journal and drop it: a button reporter that
|
||||
# falls back to acting on its own is the thing this file exists to delete.
|
||||
print("sessiond unreachable; button edge dropped: " + line, file=sys.stderr)
|
||||
sys.exit(1)
|
||||
' "$sock" "$line"
|
||||
40
packaging/souveraine-machine-firstboot.service
Normal file
40
packaging/souveraine-machine-firstboot.service
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
[Unit]
|
||||
Description=Commission the local Souveraine machine identity
|
||||
Documentation=https://forge.caseytunturi.com/Fimeg/SouveraineOS/src/branch/main/saf/federation/02-commissioning.md
|
||||
After=systemd-sysusers.service systemd-tmpfiles-setup.service
|
||||
Before=souveraine-machined.service
|
||||
Wants=souveraine-machined.service
|
||||
ConditionPathExists=!/var/lib/souveraine/seed-id
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
# The CLI opens its relative souveraine.log before dispatching the machine
|
||||
# command. Keep that transient file inside PrivateTmp; `/` is read-only below.
|
||||
WorkingDirectory=/tmp
|
||||
ExecStart=/usr/bin/souveraine machine init --fresh
|
||||
UMask=0077
|
||||
|
||||
# The guarded CLI writes only the body-local machine seed.
|
||||
NoNewPrivileges=yes
|
||||
RestrictAddressFamilies=AF_UNIX
|
||||
IPAddressDeny=any
|
||||
ProtectSystem=strict
|
||||
ReadWritePaths=/var/lib/souveraine
|
||||
ProtectHome=yes
|
||||
PrivateTmp=yes
|
||||
PrivateDevices=yes
|
||||
ProtectKernelTunables=yes
|
||||
ProtectKernelModules=yes
|
||||
ProtectControlGroups=yes
|
||||
ProtectClock=yes
|
||||
ProtectHostname=yes
|
||||
LockPersonality=yes
|
||||
RestrictRealtime=yes
|
||||
RestrictNamespaces=yes
|
||||
RestrictSUIDSGID=yes
|
||||
SystemCallArchitectures=native
|
||||
SystemCallFilter=@system-service
|
||||
SystemCallErrorNumber=EPERM
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
54
packaging/souveraine-machined.service
Normal file
54
packaging/souveraine-machined.service
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
# Souveraine machine identity — SYSTEM unit (contrast souveraine.service,
|
||||
# which is a user unit). Runs from boot, before any human authenticates;
|
||||
# owns the machine seed and serves signatures over a Unix socket.
|
||||
#
|
||||
# Access control is the socket: /run/souveraine (0750 souveraine:souveraine)
|
||||
# + machined.sock (0660). Add session users to the `souveraine` group:
|
||||
# usermod -aG souveraine <user>
|
||||
#
|
||||
# Provision the seed before first start:
|
||||
# sudo souveraine machine init --fresh
|
||||
# sudo souveraine machine init --migrate-from /home/<user>/.souveraine/seed-id
|
||||
[Unit]
|
||||
Description=Souveraine machine identity (system tier)
|
||||
|
||||
[Service]
|
||||
User=souveraine
|
||||
Group=souveraine
|
||||
ExecStart=/usr/bin/souveraine-machined
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
|
||||
# /var/lib/souveraine — the seed. /run/souveraine — the socket.
|
||||
StateDirectory=souveraine
|
||||
StateDirectoryMode=0700
|
||||
RuntimeDirectory=souveraine
|
||||
RuntimeDirectoryMode=0750
|
||||
UMask=0007
|
||||
|
||||
# Network-less signer, RedFlag-executor posture: nothing to reach, nothing
|
||||
# reachable. AF_UNIX only, no privileges, no writable system.
|
||||
NoNewPrivileges=yes
|
||||
CapabilityBoundingSet=
|
||||
RestrictAddressFamilies=AF_UNIX
|
||||
IPAddressDeny=any
|
||||
ProtectSystem=strict
|
||||
ProtectHome=yes
|
||||
PrivateTmp=yes
|
||||
PrivateDevices=yes
|
||||
ProtectKernelTunables=yes
|
||||
ProtectKernelModules=yes
|
||||
ProtectControlGroups=yes
|
||||
ProtectClock=yes
|
||||
ProtectHostname=yes
|
||||
LockPersonality=yes
|
||||
MemoryDenyWriteExecute=yes
|
||||
RestrictRealtime=yes
|
||||
RestrictNamespaces=yes
|
||||
RestrictSUIDSGID=yes
|
||||
SystemCallArchitectures=native
|
||||
SystemCallFilter=@system-service
|
||||
SystemCallErrorNumber=EPERM
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
22
packaging/souveraine-secrets.service
Normal file
22
packaging/souveraine-secrets.service
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
# Souveraine Secret Service — the machine's org.freedesktop.secrets provider.
|
||||
# Claims the well-known name at session start (WantedBy=default.target) so no
|
||||
# client ever D-Bus-activates a different provider; the paired activation file
|
||||
# (org.freedesktop.secrets.service → SystemdService=) routes on-demand starts
|
||||
# here too. Requires souveraine-machined (system tier) or a legacy user seed;
|
||||
# refuses to start without a machine identity, by design.
|
||||
[Unit]
|
||||
Description=Souveraine Secret Service (org.freedesktop.secrets)
|
||||
Documentation=file:///usr/local/share/doc/souveraine/STORAGE-ENCRYPTION.md
|
||||
After=dbus.socket
|
||||
Requires=dbus.socket
|
||||
|
||||
[Service]
|
||||
Type=dbus
|
||||
BusName=org.freedesktop.secrets
|
||||
ExecStart=/usr/bin/souveraine-secrets
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
Environment=RUST_LOG=info
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
33
packaging/souveraine-sensord.service
Normal file
33
packaging/souveraine-sensord.service
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
[Unit]
|
||||
Description=Souveraine sensor reporter (proximity, light, charge)
|
||||
# One reporter for every iio-sensor-proxy source. Replaces the per-sensor shell
|
||||
# scripts (blueline-proximity-lock and the light/accel copies that were about to
|
||||
# be written) — see DEVICE-STATE-MACHINE.md §10 and §12.
|
||||
#
|
||||
# A user unit, like sessiond: it talks to sessiond over
|
||||
# $XDG_RUNTIME_DIR/souveraine/sessiond.sock and needs no privilege at all.
|
||||
#
|
||||
# Bound to sessiond, NOT to graphical-session.target. It was WantedBy that
|
||||
# target until 2026-07-27, and on this device nothing ever starts it: greetd
|
||||
# launches Hyprland directly, and hyprland.lua starts each unit it wants by
|
||||
# name. So the reporter was `enabled` and dead from every boot, the machine ran
|
||||
# with no evidence at all, and — because a source that has never spoken sits at
|
||||
# SourceHealth::Unknown, which is silent by design — nothing said so.
|
||||
#
|
||||
# The dependency that is actually true is this one: the reporter exists to feed
|
||||
# the state machine, so it should live and die with the state machine. sessiond
|
||||
# is started explicitly at session start, needs no Wayland, and neither does
|
||||
# this: it reads iio-sensor-proxy on the system bus and writes a unix socket.
|
||||
PartOf=souveraine-sessiond.service
|
||||
After=souveraine-sessiond.service
|
||||
|
||||
[Service]
|
||||
ExecStart=/usr/bin/souveraine-sensord
|
||||
# The reporter must outlive every transient failure it can hit — a dead sensor
|
||||
# stack, a restarting sessiond, monitor-sensor exiting. It handles those in
|
||||
# process; this covers the ones it cannot.
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=souveraine-sessiond.service
|
||||
5
packaging/souveraine-sessiond.pam
Normal file
5
packaging/souveraine-sessiond.pam
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
# souveraine-sessiond fallback unlock surface.
|
||||
# Same stack as console login (the shell's own lock uses quickshell's
|
||||
# default "login" service) — the fallback must accept exactly the
|
||||
# credentials the real lockscreen accepts, no more, no less.
|
||||
auth include login
|
||||
15
packaging/souveraine-sessiond.service
Normal file
15
packaging/souveraine-sessiond.service
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
[Unit]
|
||||
Description=Souveraine session authority (lock-before-shell, lock-past-shell-death)
|
||||
# graphical-session-pre, not graphical-session: the authority takes
|
||||
# ext-session-lock before any surface exists, and -pre is the window systemd
|
||||
# already reserves for that. It cannot start earlier — ext-session-lock is a
|
||||
# Wayland protocol and needs the compositor's socket.
|
||||
PartOf=graphical-session-pre.target
|
||||
|
||||
[Service]
|
||||
ExecStart=/usr/bin/souveraine-sessiond
|
||||
Restart=on-failure
|
||||
RestartSec=1
|
||||
|
||||
[Install]
|
||||
WantedBy=graphical-session-pre.target
|
||||
14
packaging/souveraine-stepup.pam
Normal file
14
packaging/souveraine-stepup.pam
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
# Step-up authentication for SouveraineOS (SESSION-AUTHORITY-DOCTRINE §3).
|
||||
# Never unlocks the session; a success mints a short-lived in-memory grant.
|
||||
#
|
||||
# Same stack as the lock surface, for the same reason souveraine-sessiond gives:
|
||||
# step-up must accept exactly the credentials the lockscreen accepts, no more.
|
||||
#
|
||||
# The leading '-' loads the FPC factor only where it is installed, so one file
|
||||
# serves the phone and the laptop. blueline-fingerprintd ships the module; it
|
||||
# accepts only PAM_SERVICE=polkit-1 today and returns PAM_IGNORE here, falling
|
||||
# through to the password stack until its service check is widened.
|
||||
-auth sufficient pam_souveraine_fpc.so
|
||||
auth include login
|
||||
|
||||
account include login
|
||||
73
packaging/souveraine-verify-trail
Executable file
73
packaging/souveraine-verify-trail
Executable file
|
|
@ -0,0 +1,73 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Verify a Souveraine hash-chained JSONL trail.
|
||||
|
||||
Reads the forensic trail (or SessionAudit's — same contract) and checks that
|
||||
every entry's hash covers its own body and that each `prev` is the previous
|
||||
entry's hash. DEVICE-STATE-MACHINE.md §11 called the trail tamper-evident and
|
||||
listed this as owed: evidence nobody checks is not evidence.
|
||||
|
||||
The contract, in one sentence: strip the trailing `,"hash":"<hex>"`, close the
|
||||
object, SHA-256 what is left.
|
||||
|
||||
Rotation is expected, not an error — the live file's first entry chains onto
|
||||
the last entry of `.jsonl.1`, so a single file verified alone opens with a
|
||||
`prev` it cannot see. Pass the generations oldest-first to check across them.
|
||||
|
||||
souveraine-verify-trail # the default trail
|
||||
souveraine-verify-trail f.jsonl.2 f.jsonl.1 f.jsonl
|
||||
"""
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
import sys
|
||||
|
||||
DEFAULT = os.path.join(
|
||||
os.environ.get("XDG_STATE_HOME", os.path.expanduser("~/.local/state")),
|
||||
"souveraine",
|
||||
"forensic.jsonl",
|
||||
)
|
||||
|
||||
|
||||
def verify(paths):
|
||||
prev = None # None = first file, accept whatever prev it opens with
|
||||
seq = None
|
||||
checked = 0
|
||||
for path in paths:
|
||||
try:
|
||||
lines = open(path).read().splitlines()
|
||||
except OSError as e:
|
||||
print(f"cannot read {path}: {e}", file=sys.stderr)
|
||||
return 2
|
||||
for n, line in enumerate(lines, 1):
|
||||
if not line.strip():
|
||||
continue
|
||||
cut = line.rfind(',"hash":')
|
||||
if cut < 0:
|
||||
print(f"{path}:{n}: no hash field")
|
||||
return 1
|
||||
want = hashlib.sha256((line[:cut] + "}").encode()).hexdigest()
|
||||
try:
|
||||
entry = json.loads(line)
|
||||
except json.JSONDecodeError as e:
|
||||
print(f"{path}:{n}: not JSON ({e})")
|
||||
return 1
|
||||
if entry.get("hash") != want:
|
||||
print(f"{path}:{n}: seq {entry.get('seq')} hash does not cover its body")
|
||||
return 1
|
||||
if prev is not None and entry.get("prev", "") != prev:
|
||||
print(f"{path}:{n}: seq {entry.get('seq')} does not chain onto the entry before it")
|
||||
return 1
|
||||
if seq is not None and entry.get("seq") != seq + 1:
|
||||
# A gap is not tampering by itself — a rotated generation may be
|
||||
# gone — but it is worth naming, because the chain cannot span
|
||||
# what is not on disk.
|
||||
print(f"{path}:{n}: sequence jumps {seq} -> {entry.get('seq')}")
|
||||
prev = entry["hash"]
|
||||
seq = entry.get("seq")
|
||||
checked += 1
|
||||
print(f"chain verifies: {checked} entries")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(verify(sys.argv[1:] or [DEFAULT]))
|
||||
14
packaging/souveraine.service
Normal file
14
packaging/souveraine.service
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
# Souveraine server — systemd user unit.
|
||||
# Install: cp to ~/.config/systemd/user/ && systemctl --user enable --now souveraine
|
||||
# The quickshell surface starts this on demand when autostart is enabled.
|
||||
[Unit]
|
||||
Description=Souveraine server
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
ExecStart=%h/.local/bin/souveraine server
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
Loading…
Reference in a new issue