Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1904GitHub issuePublicReceived

Fresh manual install leaves /boot unbootable on GRUB systems: mkinitcpio hooks disabled during kernel downgrade, never re-enabled

Reported by seokjushin · filed Jul 7, 2026Closed upstream on 2026-10-08 by the bot omarchybot, as not planned.

Open at source
Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

Fresh manual install leaves /boot unbootable on GRUB systems: mkinitcpio hooks disabled during kernel downgrade, never re-enabledrevision 1 · captured 2026-09-28 21:29 UTC via poll

Summary

On a fresh manual install (git clone + install.sh) onto a GRUB-booted Arch system whose kernel is newer than the one pinned in the omarchy repo, the installer leaves /boot in an unbootable state. The next reboot drops the machine into an unbootable kernel (on EC2: no ENA network driver, instance unreachable; had to recover via volume surgery from another instance).

Mechanism

  1. install/preflight/disable-mkinitcpio.sh moves 60-mkinitcpio-remove.hook and 90-mkinitcpio-install.hook to *.disabled to speed up package installation — a reasonable optimization.
  2. During package install, the omarchy repo downgrades linux to its pinned version (in my case host was 7.1.2-arch3, omarchy repo pins 7.0.10-arch1).
  3. With the hooks disabled, the downgrade neither copies the new vmlinuz to /boot nor regenerates the initramfs.
  4. Nothing re-enables the hooks afterwards — grep -rn 'hook.disabled' across the repo shows only the disable side; no restore in post-install/.

Result after install:
- /boot/vmlinuz-linux → still the old kernel (7.1.2)
- /usr/lib/modules/ → only the new pinned kernel (7.0.10)
- initramfs → stale
- ⇒ boot panics or comes up without disk/network modules

On Limine/UKI systems the omarchy-managed boot tooling presumably papers over this, but the manual-install path explicitly supports existing bootloaders (guard.sh only warns about non-Limine setups), and there the breakage is silent until reboot.

Repro

Arch official cloud image (GRUB, kernel newer than omarchy pin) on EC2 → manual install v3.8.2 → reboot → unbootable. Verified the same disable-without-restore logic is present on current master.

Suggested fix

In post-install/ (or a trap on installer exit):

for h in 60-mkinitcpio-remove 90-mkinitcpio-install; do
  [[ -f /usr/share/libalpm/hooks/$h.hook.disabled ]] && sudo mv /usr/share/libalpm/hooks/$h.hook.disabled /usr/share/libalpm/hooks/$h.hook
done
# if the linux package changed during install:
KVER=$(ls /usr/lib/modules | head -1)
sudo cp "/usr/lib/modules/$KVER/vmlinuz" /boot/vmlinuz-linux
sudo mkinitcpio -p linux

Related but distinct from #5026 (that's a DKMS/depmod ordering race on updates; this is the install-time disable-without-restore on the manual path).

Happy to PR if the direction sounds right.

View raw text
## Summary

On a fresh **manual install** (git clone + `install.sh`) onto a GRUB-booted Arch system whose kernel is *newer* than the one pinned in the omarchy repo, the installer leaves `/boot` in an unbootable state. The next reboot drops the machine into an unbootable kernel (on EC2: no ENA network driver, instance unreachable; had to recover via volume surgery from another instance).

## Mechanism

1. `install/preflight/disable-mkinitcpio.sh` moves `60-mkinitcpio-remove.hook` and `90-mkinitcpio-install.hook` to `*.disabled` to speed up package installation — a reasonable optimization.
2. During package install, the omarchy repo **downgrades** `linux` to its pinned version (in my case host was 7.1.2-arch3, omarchy repo pins 7.0.10-arch1).
3. With the hooks disabled, the downgrade neither copies the new `vmlinuz` to `/boot` nor regenerates the initramfs.
4. Nothing re-enables the hooks afterwards — `grep -rn 'hook.disabled' ` across the repo shows only the disable side; no restore in `post-install/`.

Result after install:
- `/boot/vmlinuz-linux` → still the **old** kernel (7.1.2)
- `/usr/lib/modules/` → only the **new** pinned kernel (7.0.10)
- initramfs → stale
- ⇒ boot panics or comes up without disk/network modules

On Limine/UKI systems the omarchy-managed boot tooling presumably papers over this, but the manual-install path explicitly supports existing bootloaders (guard.sh only warns about non-Limine setups), and there the breakage is silent until reboot.

## Repro

Arch official cloud image (GRUB, kernel newer than omarchy pin) on EC2 → manual install v3.8.2 → reboot → unbootable. Verified the same disable-without-restore logic is present on current master.

## Suggested fix

In `post-install/` (or a trap on installer exit):

```bash
for h in 60-mkinitcpio-remove 90-mkinitcpio-install; do
  [[ -f /usr/share/libalpm/hooks/$h.hook.disabled ]] && sudo mv /usr/share/libalpm/hooks/$h.hook.disabled /usr/share/libalpm/hooks/$h.hook
done
# if the linux package changed during install:
KVER=$(ls /usr/lib/modules | head -1)
sudo cp "/usr/lib/modules/$KVER/vmlinuz" /boot/vmlinuz-linux
sudo mkinitcpio -p linux
```

Related but distinct from #5026 (that's a DKMS/depmod ordering race on *updates*; this is the install-time disable-without-restore on the manual path).

Happy to PR if the direction sounds right.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.