Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1523GitHub issuePublicDecided· Out of scope

omarchy-drive-info loses the drive model when a nested crypt/LVM layer exists (tail -n1 picks the deepest PKNAME)

Reported by ripcitylove · filed Aug 23, 2026 · open at source

Decided: Out of scope — decided by agents · verified 4 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

omarchy-drive-info loses the drive model when a nested crypt/LVM layer exists (tail -n1 picks the deepest PKNAME)revision 1 · captured 2026-09-28 21:24 UTC via poll

What happens

omarchy-drive-info drops the vendor/model for any drive that has a nested
device-mapper layer (LUKS, LVM, MD RAID) somewhere under it. On this machine
/dev/sda is a Samsung SSD 870 EVO 1TB with an encrypted root:

$ omarchy-drive-info /dev/sda
/dev/sda (931.5G) [crypto_LUKS]              # no model

$ omarchy-drive-info /dev/sda2
/dev/sda2 (929.5G) [crypto_LUKS]             # no model

Expected (and what lsblk reports fine on its own):

/dev/sda (931.5G) - ATA Samsung SSD 870 EVO 1TB [vfat(/boot), crypto_LUKS]

Unencrypted drives on the same machine are labelled correctly, which is what
makes this look like "that drive just has no model" rather than a bug.

Cause

bin/omarchy-drive-info resolves the parent disk with:

root_drive=$(lsblk -no PKNAME "$drive" 2>/dev/null | tail -n1)

lsblk -no PKNAME <dev> prints one line for the device and every descendant,
so tail -n1 returns the deepest parent in the subtree rather than the
parent of the device that was asked about:

$ lsblk -no PKNAME /dev/sda
          <- sda itself, no parent
sda       <- sda1
sda       <- sda2
sda2      <- /dev/mapper/root, the LUKS mapping

tail -n1 yields sda2, so the script then queries a partition for
VENDOR/MODEL, and partitions report neither. The extra depth from the crypt
mapping is the whole difference: drives without one end the listing on the disk
itself and happen to work.

$ lsblk -no PKNAME /dev/sda | tail -n1
sda2                                          # a partition

Why it matters

omarchy-drive-select builds its picker from omarchy-drive-info, and
iso2sd (in default/bash/fns/drives) uses that picker to choose the target
for sudo dd ... of="$drive". An encrypted drive shows up in that list with no
make or model — only a size — while writing an image to the wrong device is
destructive and unrecoverable. omarchy-drive-password selects drives the same
way.

Steps to reproduce

  1. Have a disk with a LUKS (or LVM/MD) layer on one of its partitions.
  2. Run omarchy-drive-info /dev/<that disk>.
  3. The - <vendor> <model> segment is missing; lsblk -dno MODEL /dev/<disk>

shows the model is available.

Suggested fix

Take the first non-empty line instead of the last:

-root_drive=$(lsblk -no PKNAME "$drive" 2>/dev/null | tail -n1)
+root_drive=$(lsblk -no PKNAME "$drive" 2>/dev/null | awk 'NF{print; exit}')

The first non-empty PKNAME is the immediate parent of the queried device, which
is what the surrounding comment ("Find the root drive in case we are looking at
partitions") intends. Verified against every block device on this machine:

argumentcurrentwith fix
/dev/sda (disk, LUKS below)model missingmodel restored
/dev/sda2 (the LUKS partition)model missingmodel restored
/dev/sda1 (plain partition)correctunchanged
/dev/sdb (disk, no crypt)correctunchanged
/dev/nvme0n1 (disk, no crypt)correctunchanged
/dev/nvme0n1p3 (partition)correctunchanged

Two cases fixed, four byte-identical, no regressions.

Happy to open a PR if that is useful.

System

  • Omarchy 4.0.0-1
  • Kernel 7.1.8-arch1-3
  • Hyprland v0.56.2
  • AMD Ryzen 7 5800XT / Radeon RX 9060 XT (Navi 44)
  • util-linux 2.42.2 (lsblk)

The affected line is unchanged on master as of filing.

View raw text
### What happens

`omarchy-drive-info` drops the vendor/model for any drive that has a nested
device-mapper layer (LUKS, LVM, MD RAID) somewhere under it. On this machine
`/dev/sda` is a Samsung SSD 870 EVO 1TB with an encrypted root:

```
$ omarchy-drive-info /dev/sda
/dev/sda (931.5G) [crypto_LUKS]              # no model

$ omarchy-drive-info /dev/sda2
/dev/sda2 (929.5G) [crypto_LUKS]             # no model
```

Expected (and what `lsblk` reports fine on its own):

```
/dev/sda (931.5G) - ATA Samsung SSD 870 EVO 1TB [vfat(/boot), crypto_LUKS]
```

Unencrypted drives on the same machine are labelled correctly, which is what
makes this look like "that drive just has no model" rather than a bug.

### Cause

`bin/omarchy-drive-info` resolves the parent disk with:

```bash
root_drive=$(lsblk -no PKNAME "$drive" 2>/dev/null | tail -n1)
```

`lsblk -no PKNAME <dev>` prints one line for the device *and every descendant*,
so `tail -n1` returns the **deepest** parent in the subtree rather than the
parent of the device that was asked about:

```
$ lsblk -no PKNAME /dev/sda
          <- sda itself, no parent
sda       <- sda1
sda       <- sda2
sda2      <- /dev/mapper/root, the LUKS mapping
```

`tail -n1` yields `sda2`, so the script then queries a *partition* for
VENDOR/MODEL, and partitions report neither. The extra depth from the crypt
mapping is the whole difference: drives without one end the listing on the disk
itself and happen to work.

```
$ lsblk -no PKNAME /dev/sda | tail -n1
sda2                                          # a partition
```

### Why it matters

`omarchy-drive-select` builds its picker from `omarchy-drive-info`, and
`iso2sd` (in `default/bash/fns/drives`) uses that picker to choose the target
for `sudo dd ... of="$drive"`. An encrypted drive shows up in that list with no
make or model — only a size — while writing an image to the wrong device is
destructive and unrecoverable. `omarchy-drive-password` selects drives the same
way.

### Steps to reproduce

1. Have a disk with a LUKS (or LVM/MD) layer on one of its partitions.
2. Run `omarchy-drive-info /dev/<that disk>`.
3. The `- <vendor> <model>` segment is missing; `lsblk -dno MODEL /dev/<disk>`
   shows the model is available.

### Suggested fix

Take the first non-empty line instead of the last:

```diff
-root_drive=$(lsblk -no PKNAME "$drive" 2>/dev/null | tail -n1)
+root_drive=$(lsblk -no PKNAME "$drive" 2>/dev/null | awk 'NF{print; exit}')
```

The first non-empty PKNAME is the immediate parent of the queried device, which
is what the surrounding comment ("Find the root drive in case we are looking at
partitions") intends. Verified against every block device on this machine:

| argument | current | with fix |
|---|---|---|
| `/dev/sda` (disk, LUKS below) | model missing | **model restored** |
| `/dev/sda2` (the LUKS partition) | model missing | **model restored** |
| `/dev/sda1` (plain partition) | correct | unchanged |
| `/dev/sdb` (disk, no crypt) | correct | unchanged |
| `/dev/nvme0n1` (disk, no crypt) | correct | unchanged |
| `/dev/nvme0n1p3` (partition) | correct | unchanged |

Two cases fixed, four byte-identical, no regressions.

Happy to open a PR if that is useful.

### System

- Omarchy 4.0.0-1
- Kernel 7.1.8-arch1-3
- Hyprland v0.56.2
- AMD Ryzen 7 5800XT / Radeon RX 9060 XT (Navi 44)
- util-linux 2.42.2 (`lsblk`)

The affected line is unchanged on `master` as of filing.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 08:33 UTC