Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-3443GitHub issuePublicReceived

Enhance [omarchy] Repo Security: Switch SigLevel to `Required DatabaseOptional` and Update Security Docs

Reported by MrJack91 · filed Oct 22, 2025Closed upstream on 2026-07-18. GitHub close reason: completed. No closing PR or commit is recorded — "completed" alone is not evidence of a fix.

Open at source
Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

Enhance [omarchy] Repo Security: Switch SigLevel to `Required DatabaseOptional` and Update Security Docsrevision 1 · captured 2026-10-04 11:42 UTC via poll

What do you need?

Disclaimer

This issue was drafted with assistance from Grok, an AI tool created by xAI, to help articulate the proposal and ensure technical accuracy. The ideas and intent are my own, with Grok aiding in structuring and refining the content.

Description

To strengthen Omarchy’s security (https://learn.omacom.io/2/the-omarchy-manual/93/security) and support the repo pipeline in #767, I propose tightening the [omarchy] repository’s signature verification in default/pacman/pacman.conf and documenting this in the security manual.

Current Setup

  • Global: SigLevel = Required DatabaseOptional (secure—requires signed packages for Arch’s [core]/[extra]/[multilib]).
  • [omarchy]: SigLevel = Optional TrustAll (allows unsigned or untrusted packages from https://pkgs.omarchy.org/$arch).
  • Security Docs: Cover encryption, firewalls, etc., but not package signing.

The current Optional TrustAll suits prototyping but risks supply-chain attacks, especially as Omarchy scales to production (#767). The security docs should reflect package verification.

Proposed Changes

  1. Update `pacman.conf` for [omarchy]:
   [omarchy]
   SigLevel = Required DatabaseOptional
   Server = https://pkgs.omarchy.org/$arch
  • Benefits: Mandates signed, trusted packages (like Arch repos); supports #767’s reviewed pipeline; blocks unsigned/tampered packages.
  • Why `DatabaseOptional`?: Matches Arch’s standard (package signatures mandatory, database signatures optional). Ensures compatibility if omarchy.db isn’t signed yet, while securing packages (the main risk). Full Required (database + packages) could break if the pipeline lacks database signing.
  • Rationale: Users trust Omarchy’s OS build (ISO, scripts), but Required adds protection against repo hacks, unlike TrustAll (ArchWiki: debug-only).
  1. Update Security Manual (https://learn.omacom.io/2/the-omarchy-manual/93/security):

Add:
> 5. Package Signature Verification: The [omarchy] repository requires GPG-signed packages from trusted keys, matching Arch’s official repos, to protect against supply-chain attacks.

Steps to Implement

  • Update SigLevel in default/pacman/pacman.conf.
  • Generate/sign a dev key (e.g., pacman-key --gen), include in bootstrap, sign packages in pipeline.
  • Test pacman -S from [omarchy] (e.g., uwsm-omarchy).
  • Add doc section.
  • Optional: Keep Optional TrustAll for local/dev via env var.

Happy to test or contribute a PR! Thoughts? Experience with repo signing?

Metadata

  • Omarchy Version: 3.1.1
  • Hardware: Mac Book Air (late 2015)
  • Labels: enhancement, security
  • Assignees: @RaphaelKimmig (from #767)
  • Related: #767
View raw text
### What do you need?

## Disclaimer
This issue was drafted with assistance from Grok, an AI tool created by xAI, to help articulate the proposal and ensure technical accuracy. The ideas and intent are my own, with Grok aiding in structuring and refining the content.

## Description
To strengthen Omarchy’s security (https://learn.omacom.io/2/the-omarchy-manual/93/security) and support the repo pipeline in #767, I propose tightening the `[omarchy]` repository’s signature verification in `default/pacman/pacman.conf` and documenting this in the security manual.

### Current Setup
- Global: `SigLevel = Required DatabaseOptional` (secure—requires signed packages for Arch’s [core]/[extra]/[multilib]).
- `[omarchy]`: `SigLevel = Optional TrustAll` (allows unsigned or untrusted packages from `https://pkgs.omarchy.org/$arch`).
- Security Docs: Cover encryption, firewalls, etc., but not package signing.

The current `Optional TrustAll` suits prototyping but risks supply-chain attacks, especially as Omarchy scales to production (#767). The security docs should reflect package verification.

### Proposed Changes
1. **Update `pacman.conf`** for `[omarchy]`:
   ```
   [omarchy]
   SigLevel = Required DatabaseOptional
   Server = https://pkgs.omarchy.org/$arch
   ```
   - **Benefits**: Mandates signed, trusted packages (like Arch repos); supports #767’s reviewed pipeline; blocks unsigned/tampered packages.
   - **Why `DatabaseOptional`?**: Matches Arch’s standard (package signatures mandatory, database signatures optional). Ensures compatibility if `omarchy.db` isn’t signed yet, while securing packages (the main risk). Full `Required` (database + packages) could break if the pipeline lacks database signing.
   - **Rationale**: Users trust Omarchy’s OS build (ISO, scripts), but `Required` adds protection against repo hacks, unlike `TrustAll` (ArchWiki: debug-only).

2. **Update Security Manual** (https://learn.omacom.io/2/the-omarchy-manual/93/security):
   Add:
   > 5. **Package Signature Verification**: The `[omarchy]` repository requires GPG-signed packages from trusted keys, matching Arch’s official repos, to protect against supply-chain attacks.

### Steps to Implement
- Update `SigLevel` in `default/pacman/pacman.conf`.
- Generate/sign a dev key (e.g., `pacman-key --gen`), include in bootstrap, sign packages in pipeline.
- Test `pacman -S` from `[omarchy]` (e.g., `uwsm-omarchy`).
- Add doc section.
- Optional: Keep `Optional TrustAll` for local/dev via env var.

Happy to test or contribute a PR! Thoughts? Experience with repo signing?

## Metadata
- **Omarchy Version**: 3.1.1
- **Hardware**: Mac Book Air (late 2015)
- **Labels**: enhancement, security
- **Assignees**: @RaphaelKimmig (from #767)
- **Related**: #767

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.