Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Kernel/limine update leaves boot broken until manual `limine-mkinitcpio` rerun — encrypt hook "device not found"; suspicious duplicate signing hash across different kernel versions
Reported by el7oussine3yyache · filed Jul 5, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
System details
- Hardware: Lenovo ThinkPad E14 Gen 5 - Omarchy version: 3.8.2 - Kernel: happened across two separate updates — 7.0.10-arch1-1 → 7.0.14-arch1-1, then again 7.0.14-arch1-1 → 7.1.2-arch3-1 - Filesystem: encrypted LUKS + Btrfs (subvolumes @, @home, @log, @pkg) - Bootloader: Limine, UKI enabled
What's wrong?
sudo pacman -Syu completes with no visible errors. On the next reboot, the system fails with: :: running hook [encrypt]
ERROR: device not found. Skipping fsck.
:: mounting '' on real root
mount: /new_root: wrong fs type, bad option, bad superblock...
Dropped to emergency shell.
This has now happened 3 times in under a week, each time immediately following an update that touched linux, limine, or limine-mkinitcpio-hook.
What I checked (all correct, ruled out)
- /boot/limine.conf cmdline correct, PARTUUID matches blkid output exactly
- /etc/default/limine cmdline correct
- No stale duplicate /boot/EFI/Limine/limine.conf (checked for #3335, not present — only .efi binaries in that dir)
- Kernel modules directory matches installed kernel version (pacman -Q linux and /usr/lib/modules/ agree)
- mkinitcpio.conf.d/omarchy_hooks.conf HOOKS line intact, includes encrypt and btrfs-overlayfs
- No .pacnew/.pacsave files anywhere under /etc
The fix, every time
Chrooting in from an emergency shell and simply re-running:
limine-mkinitcpio
...with zero config changes, immediately fixes the boot. Nothing else is modified.
Suspicious detail in pacman.log
Comparing the two failing updates' logs, I noticed the "already signed" line references the identical SHA256 hash for the UKI across two different kernel versions:
Update 1 (kernel 7.0.14-arch1-1):
[2026-07-03T01:51:36+0100] [ALPM-SCRIPTLET] File has already been signed /boot/a51c0f30fa4a4933a746741bf7cc2854/limine_history/omarchy_linux.efi_sha256_1b2b0f9199efd20c3fc94d88e8201af631c7a44d13b56a1ff0fece862d1f29ea
Update 2 (kernel 7.1.2-arch3-1):
[2026-07-05T15:23:35+0100] [ALPM-SCRIPTLET] File has already been signed /boot/a51c0f30fa4a4933a746741bf7cc2854/limine_history/omarchy_linux.efi_sha256_1b2b0f9199efd20c3fc94d88e8201af631c7a44d13b56a1ff0fece862d1f29ea
Same hash, different kernel versions, both logged as "already signed" right after the log line claims a fresh UKI was just built and stored. This seems like it could indicate the signing-history check (sbctl) is matching against a stale cached hash and skip-signing what should be a newly built image — possibly leaving a stale/mismatched UKI in place despite the build step reporting success. I'm not certain this is the root cause, but it's the one concrete anomaly I could find in the logs and seemed worth flagging.
grep -iE "linux|limine|kernel" /var/log/pacman.log | tail -60
[2026-07-03T01:50:37+0100] [ALPM] upgraded linux-firmware-realtek (20260519-1 -> 20260622-1)
[2026-07-03T01:50:37+0100] [ALPM] upgraded linux-firmware (20260519-1 -> 20260622-1)
[2026-07-03T01:50:50+0100] [ALPM] running '10-linux-modules-post.hook'...
[2026-07-03T01:51:06+0100] [ALPM] running '80-limine-efi-deploy.hook'...
[2026-07-03T01:51:06+0100] [ALPM-SCRIPTLET] Updating Limine fallback EFI...
[2026-07-03T01:51:06+0100] [ALPM-SCRIPTLET] Updating /boot/EFI/limine/limine_x64.efi...
[2026-07-03T01:51:06+0100] [ALPM-SCRIPTLET] Creating a backup /boot/EFI/limine/limine_x64.bak...
[2026-07-03T01:51:06+0100] [ALPM-SCRIPTLET] Limine EFI install completed successfully.
[2026-07-03T01:51:06+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/limine_x64.efi
[2026-07-03T01:51:06+0100] [ALPM] running '90-limine-mkinitcpio-remove-post.hook'...
[2026-07-03T01:51:07+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/limine_x64.efi
[2026-07-03T01:51:08+0100] [ALPM-SCRIPTLET] Building UKI for linux (7.0.14-arch1-1)
[2026-07-03T01:51:25+0100] [ALPM-SCRIPTLET] ==> Creating unified kernel image: '/tmp/staging_uki.efi'
[2026-07-03T01:51:25+0100] [ALPM-SCRIPTLET] ==> Unified kernel image generation successful
[2026-07-03T01:51:26+0100] [ALPM-SCRIPTLET] UKI stored in /boot/EFI/Linux/omarchy_linux.efi
[2026-07-03T01:51:26+0100] [ALPM-SCRIPTLET] Updated: /boot/limine.conf
[2026-07-03T01:51:26+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/limine_x64.efi
[2026-07-03T01:51:26+0100] [ALPM] running '99-limine.hook'...
[2026-07-03T01:51:36+0100] [ALPM-SCRIPTLET] File has already been signed /boot/a51c0f30fa4a4933a746741bf7cc2854/limine_history/omarchy_linux.efi_sha256_1b2b0f9199efd20c3fc94d88e8201af631c7a44d13b56a1ff0fece862d1f29ea
[2026-07-03T01:51:36+0100] [ALPM-SCRIPTLET] File has already been signed /boot/EFI/Linux/omarchy_linux.efi
[2026-07-03T01:51:36+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/BOOTIA32.EFI
[2026-07-03T01:51:36+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/BOOTX64.EFI
[2026-07-03T01:51:36+0100] [ALPM-SCRIPTLET] File has already been signed /boot/EFI/limine/limine_x64.efi
[2026-07-03T02:32:10+0100] [ALPM] running '10-limine-snapper-lock.hook'...
[2026-07-03T02:33:36+0100] [ALPM] running '10-limine-snapper-lock.hook'...
[2026-07-03T10:03:24+0100] [ALPM] running '10-limine-snapper-lock.hook'...
[2026-07-03T10:43:58+0100] [ALPM] running '10-limine-snapper-lock.hook'...
[2026-07-03T10:45:05+0100] [ALPM] running '10-limine-snapper-lock.hook'...
[2026-07-03T10:57:04+0100] [ALPM] running '10-limine-snapper-lock.hook'...
[2026-07-03T15:12:03+0100] [PACMAN] Running 'pacman -Sy --noconfirm archlinux-keyring'
[2026-07-03T15:12:04+0100] [ALPM] running '10-limine-snapper-lock.hook'...
[2026-07-03T15:12:04+0100] [ALPM] reinstalled archlinux-keyring (20260612-1)
[2026-07-03T15:12:05+0100] [ALPM-SCRIPTLET] ==> Appending keys from archlinux.gpg...
[2026-07-03T15:12:12+0100] [ALPM] running '10-limine-snapper-lock.hook'...
[2026-07-05T15:23:02+0100] [ALPM] running '10-limine-snapper-lock.hook'...
[2026-07-05T15:23:02+0100] [ALPM] running '10-linux-modules-pre.hook'...
[2026-07-05T15:23:05+0100] [ALPM] running '60-limine-mkinitcpio-remove-pre.hook'...
[2026-07-05T15:23:06+0100] [ALPM] upgraded limine (12.3.3-1 -> 12.4.0-1)
[2026-07-05T15:23:08+0100] [ALPM] upgraded linux (7.0.14.arch1-1 -> 7.1.2.arch3-1)
[2026-07-05T15:23:11+0100] [ALPM] running '10-linux-modules-post.hook'...
[2026-07-05T15:23:17+0100] [ALPM] running '80-limine-efi-deploy.hook'...
[2026-07-05T15:23:17+0100] [ALPM-SCRIPTLET] Updating Limine fallback EFI...
[2026-07-05T15:23:17+0100] [ALPM-SCRIPTLET] Updating /boot/EFI/limine/limine_x64.efi...
[2026-07-05T15:23:17+0100] [ALPM-SCRIPTLET] Creating a backup /boot/EFI/limine/limine_x64.bak...
[2026-07-05T15:23:17+0100] [ALPM-SCRIPTLET] Limine EFI install completed successfully.
[2026-07-05T15:23:17+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/limine_x64.efi
[2026-07-05T15:23:17+0100] [ALPM] running '90-limine-mkinitcpio-remove-post.hook'...
[2026-07-05T15:23:18+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/limine_x64.efi
[2026-07-05T15:23:18+0100] [ALPM-SCRIPTLET] Building UKI for linux (7.1.2-arch3-1)
[2026-07-05T15:23:33+0100] [ALPM-SCRIPTLET] ==> Creating unified kernel image: '/tmp/staging_uki.efi'
[2026-07-05T15:23:33+0100] [ALPM-SCRIPTLET] ==> Unified kernel image generation successful
[2026-07-05T15:23:34+0100] [ALPM-SCRIPTLET] UKI stored in /boot/EFI/Linux/omarchy_linux.efi
[2026-07-05T15:23:34+0100] [ALPM-SCRIPTLET] Updated: /boot/limine.conf
[2026-07-05T15:23:34+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/limine_x64.efi
[2026-07-05T15:23:34+0100] [ALPM] running '99-limine.hook'...
[2026-07-05T15:23:35+0100] [ALPM-SCRIPTLET] File has already been signed /boot/a51c0f30fa4a4933a746741bf7cc2854/limine_history/omarchy_linux.efi_sha256_1b2b0f9199efd20c3fc94d88e8201af631c7a44d13b56a1ff0fece862d1f29ea
[2026-07-05T15:23:35+0100] [ALPM-SCRIPTLET] File has already been signed /boot/EFI/Linux/omarchy_linux.efi
[2026-07-05T15:23:35+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/BOOTIA32.EFI
[2026-07-05T15:23:35+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/BOOTX64.EFI
[2026-07-05T15:23:35+0100] [ALPM-SCRIPTLET] File has already been signed /boot/EFI/limine/limine_x64.efi omarchy-debug: https://logs.omarchy.org/Oxbo0J
View raw text
### System details - Hardware: Lenovo ThinkPad E14 Gen 5 - Omarchy version: 3.8.2 - Kernel: happened across two separate updates — 7.0.10-arch1-1 → 7.0.14-arch1-1, then again 7.0.14-arch1-1 → 7.1.2-arch3-1 - Filesystem: encrypted LUKS + Btrfs (subvolumes @, @home, @log, @pkg) - Bootloader: Limine, UKI enabled ### What's wrong? `sudo pacman -Syu` completes with no visible errors. On the next reboot, the system fails with: :: running hook [encrypt] ERROR: device not found. Skipping fsck. :: mounting '' on real root mount: /new_root: wrong fs type, bad option, bad superblock... Dropped to emergency shell. This has now happened 3 times in under a week, each time immediately following an update that touched `linux`, `limine`, or `limine-mkinitcpio-hook`. **What I checked (all correct, ruled out)** - `/boot/limine.conf` cmdline correct, PARTUUID matches `blkid` output exactly - `/etc/default/limine` cmdline correct - No stale duplicate `/boot/EFI/Limine/limine.conf` (checked for #3335, not present — only .efi binaries in that dir) - Kernel modules directory matches installed kernel version (`pacman -Q linux` and `/usr/lib/modules/` agree) - `mkinitcpio.conf.d/omarchy_hooks.conf` HOOKS line intact, includes `encrypt` and `btrfs-overlayfs` - No `.pacnew`/`.pacsave` files anywhere under `/etc` **The fix, every time** Chrooting in from an emergency shell and simply re-running: limine-mkinitcpio ...with zero config changes, immediately fixes the boot. Nothing else is modified. **Suspicious detail in pacman.log** Comparing the two failing updates' logs, I noticed the "already signed" line references the *identical* SHA256 hash for the UKI across two different kernel versions: Update 1 (kernel 7.0.14-arch1-1): [2026-07-03T01:51:36+0100] [ALPM-SCRIPTLET] File has already been signed /boot/a51c0f30fa4a4933a746741bf7cc2854/limine_history/omarchy_linux.efi_sha256_1b2b0f9199efd20c3fc94d88e8201af631c7a44d13b56a1ff0fece862d1f29ea Update 2 (kernel 7.1.2-arch3-1): [2026-07-05T15:23:35+0100] [ALPM-SCRIPTLET] File has already been signed /boot/a51c0f30fa4a4933a746741bf7cc2854/limine_history/omarchy_linux.efi_sha256_1b2b0f9199efd20c3fc94d88e8201af631c7a44d13b56a1ff0fece862d1f29ea Same hash, different kernel versions, both logged as "already signed" right after the log line claims a fresh UKI was just built and stored. This seems like it could indicate the signing-history check (sbctl) is matching against a stale cached hash and skip-signing what should be a newly built image — possibly leaving a stale/mismatched UKI in place despite the build step reporting success. I'm not certain this is the root cause, but it's the one concrete anomaly I could find in the logs and seemed worth flagging. grep -iE "linux|limine|kernel" /var/log/pacman.log | tail -60 [2026-07-03T01:50:37+0100] [ALPM] upgraded linux-firmware-realtek (20260519-1 -> 20260622-1) [2026-07-03T01:50:37+0100] [ALPM] upgraded linux-firmware (20260519-1 -> 20260622-1) [2026-07-03T01:50:50+0100] [ALPM] running '10-linux-modules-post.hook'... [2026-07-03T01:51:06+0100] [ALPM] running '80-limine-efi-deploy.hook'... [2026-07-03T01:51:06+0100] [ALPM-SCRIPTLET] Updating Limine fallback EFI... [2026-07-03T01:51:06+0100] [ALPM-SCRIPTLET] Updating /boot/EFI/limine/limine_x64.efi... [2026-07-03T01:51:06+0100] [ALPM-SCRIPTLET] Creating a backup /boot/EFI/limine/limine_x64.bak... [2026-07-03T01:51:06+0100] [ALPM-SCRIPTLET] Limine EFI install completed successfully. [2026-07-03T01:51:06+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/limine_x64.efi [2026-07-03T01:51:06+0100] [ALPM] running '90-limine-mkinitcpio-remove-post.hook'... [2026-07-03T01:51:07+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/limine_x64.efi [2026-07-03T01:51:08+0100] [ALPM-SCRIPTLET] Building UKI for linux (7.0.14-arch1-1) [2026-07-03T01:51:25+0100] [ALPM-SCRIPTLET] ==> Creating unified kernel image: '/tmp/staging_uki.efi' [2026-07-03T01:51:25+0100] [ALPM-SCRIPTLET] ==> Unified kernel image generation successful [2026-07-03T01:51:26+0100] [ALPM-SCRIPTLET] UKI stored in /boot/EFI/Linux/omarchy_linux.efi [2026-07-03T01:51:26+0100] [ALPM-SCRIPTLET] Updated: /boot/limine.conf [2026-07-03T01:51:26+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/limine_x64.efi [2026-07-03T01:51:26+0100] [ALPM] running '99-limine.hook'... [2026-07-03T01:51:36+0100] [ALPM-SCRIPTLET] File has already been signed /boot/a51c0f30fa4a4933a746741bf7cc2854/limine_history/omarchy_linux.efi_sha256_1b2b0f9199efd20c3fc94d88e8201af631c7a44d13b56a1ff0fece862d1f29ea [2026-07-03T01:51:36+0100] [ALPM-SCRIPTLET] File has already been signed /boot/EFI/Linux/omarchy_linux.efi [2026-07-03T01:51:36+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/BOOTIA32.EFI [2026-07-03T01:51:36+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/BOOTX64.EFI [2026-07-03T01:51:36+0100] [ALPM-SCRIPTLET] File has already been signed /boot/EFI/limine/limine_x64.efi [2026-07-03T02:32:10+0100] [ALPM] running '10-limine-snapper-lock.hook'... [2026-07-03T02:33:36+0100] [ALPM] running '10-limine-snapper-lock.hook'... [2026-07-03T10:03:24+0100] [ALPM] running '10-limine-snapper-lock.hook'... [2026-07-03T10:43:58+0100] [ALPM] running '10-limine-snapper-lock.hook'... [2026-07-03T10:45:05+0100] [ALPM] running '10-limine-snapper-lock.hook'... [2026-07-03T10:57:04+0100] [ALPM] running '10-limine-snapper-lock.hook'... [2026-07-03T15:12:03+0100] [PACMAN] Running 'pacman -Sy --noconfirm archlinux-keyring' [2026-07-03T15:12:04+0100] [ALPM] running '10-limine-snapper-lock.hook'... [2026-07-03T15:12:04+0100] [ALPM] reinstalled archlinux-keyring (20260612-1) [2026-07-03T15:12:05+0100] [ALPM-SCRIPTLET] ==> Appending keys from archlinux.gpg... [2026-07-03T15:12:12+0100] [ALPM] running '10-limine-snapper-lock.hook'... [2026-07-05T15:23:02+0100] [ALPM] running '10-limine-snapper-lock.hook'... [2026-07-05T15:23:02+0100] [ALPM] running '10-linux-modules-pre.hook'... [2026-07-05T15:23:05+0100] [ALPM] running '60-limine-mkinitcpio-remove-pre.hook'... [2026-07-05T15:23:06+0100] [ALPM] upgraded limine (12.3.3-1 -> 12.4.0-1) [2026-07-05T15:23:08+0100] [ALPM] upgraded linux (7.0.14.arch1-1 -> 7.1.2.arch3-1) [2026-07-05T15:23:11+0100] [ALPM] running '10-linux-modules-post.hook'... [2026-07-05T15:23:17+0100] [ALPM] running '80-limine-efi-deploy.hook'... [2026-07-05T15:23:17+0100] [ALPM-SCRIPTLET] Updating Limine fallback EFI... [2026-07-05T15:23:17+0100] [ALPM-SCRIPTLET] Updating /boot/EFI/limine/limine_x64.efi... [2026-07-05T15:23:17+0100] [ALPM-SCRIPTLET] Creating a backup /boot/EFI/limine/limine_x64.bak... [2026-07-05T15:23:17+0100] [ALPM-SCRIPTLET] Limine EFI install completed successfully. [2026-07-05T15:23:17+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/limine_x64.efi [2026-07-05T15:23:17+0100] [ALPM] running '90-limine-mkinitcpio-remove-post.hook'... [2026-07-05T15:23:18+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/limine_x64.efi [2026-07-05T15:23:18+0100] [ALPM-SCRIPTLET] Building UKI for linux (7.1.2-arch3-1) [2026-07-05T15:23:33+0100] [ALPM-SCRIPTLET] ==> Creating unified kernel image: '/tmp/staging_uki.efi' [2026-07-05T15:23:33+0100] [ALPM-SCRIPTLET] ==> Unified kernel image generation successful [2026-07-05T15:23:34+0100] [ALPM-SCRIPTLET] UKI stored in /boot/EFI/Linux/omarchy_linux.efi [2026-07-05T15:23:34+0100] [ALPM-SCRIPTLET] Updated: /boot/limine.conf [2026-07-05T15:23:34+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/limine_x64.efi [2026-07-05T15:23:34+0100] [ALPM] running '99-limine.hook'... [2026-07-05T15:23:35+0100] [ALPM-SCRIPTLET] File has already been signed /boot/a51c0f30fa4a4933a746741bf7cc2854/limine_history/omarchy_linux.efi_sha256_1b2b0f9199efd20c3fc94d88e8201af631c7a44d13b56a1ff0fece862d1f29ea [2026-07-05T15:23:35+0100] [ALPM-SCRIPTLET] File has already been signed /boot/EFI/Linux/omarchy_linux.efi [2026-07-05T15:23:35+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/BOOTIA32.EFI [2026-07-05T15:23:35+0100] [ALPM-SCRIPTLET] ✓ Signed /boot/EFI/limine/BOOTX64.EFI [2026-07-05T15:23:35+0100] [ALPM-SCRIPTLET] File has already been signed /boot/EFI/limine/limine_x64.efi omarchy-debug: https://logs.omarchy.org/Oxbo0J
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 03:55 UTC