Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Security vulnerability in package priority
Reported by alerque · filed Feb 27, 2026Closed upstream on 2026-02-28 by dhh. GitHub close reason: completed. No closing PR or commit is recorded — "completed" alone is not evidence of a fix.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
System details
N/A
What's wrong?
Looking at recent release notes:
Fix AUR package installation to prefer AUR over repos when available
If this really is what the changelog says on the tin, this is a huge security snafu. You just opened up the entire system to "trust random stranger who just posted a name-squat of any system package with no authentication or identification at all more than you trust the people that hold distro package signing keys". Such packages would be against the AUR guidelines anyway, but it doesn't mean they can't happen and you just removed the main guard rail keeping random package squatters from breaching unsuspecting end users until such a time as the issue gets caught and cleaned up.
This should be reverted post-haste.
View raw text
### System details N/A ### What's wrong? Looking at recent release notes: > Fix AUR package installation to prefer AUR over repos when available If this really is what the changelog says on the tin, this is a huge security snafu. You just opened up the entire system to "trust random stranger who just posted a name-squat of any system package with no authentication or identification at all more than you trust the people that hold distro package signing keys". Such packages would be against the AUR guidelines anyway, but it doesn't mean they can't happen and you just removed the main guard rail keeping random package squatters from breaching unsuspecting end users until such a time as the issue gets caught and cleaned up. This should be reverted post-haste.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.