Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
.sig from main page fails for omarchy-4.0.4.iso.sha256 (signature BAD, but ISO hash matches release notes)
Reported by szwejkinho · filed Sep 17, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
System details
N/A
What's wrong?
Downloaded omarchy-4.0.4.iso, omarchy-4.0.4.iso.sha256, and omarchy-4.0.4.iso.sig fresh from iso.omarchy.org. gpg --verify reports a BAD signature against the official Omarchy signing key (40DFB630FF42BCFFB047046CF0134EE680CAC571), even though the SHA256 inside the checksum file matches the ISO itself and matches the hash published in the v4.0.4 GitHub release notes.
$ gpg --verify omarchy-4.0.4.iso.sig omarchy-4.0.4.iso.sha256
gpg: Signature made Tue 15 Sep 2026 11:38:29 PM CEST
gpg: using EDDSA key 40DFB630FF42BCFFB047046CF0134EE680CAC571
gpg: BAD signature from "Omarchy <[email protected]>" [unknown]
$ sha256sum -c omarchy-4.0.4.iso.sha256
omarchy-4.0.4.iso: OK
Hash matches release notes: ddeded2758c48318d201dfdac905ecb28f570441883f0c052ea3cd5d05acf92d
Steps taken to rule out local causes:
Re-downloaded all three files fresh with curl (not a browser) directly from iso.omarchy.org
Confirmed key fingerprint matches the officially documented signing key
Checked for CRLF/whitespace corruption in the .sha256 file — none found
Reproduced consistently across multiple attempts
This suggests the .sig file served may not correspond to the current .sha256 file (possibly stale from a previous build/release step), rather than an actual integrity problem with the ISO itself.
View raw text
### System details N/A ### What's wrong? Downloaded omarchy-4.0.4.iso, omarchy-4.0.4.iso.sha256, and omarchy-4.0.4.iso.sig fresh from iso.omarchy.org. gpg --verify reports a BAD signature against the official Omarchy signing key (40DFB630FF42BCFFB047046CF0134EE680CAC571), even though the SHA256 inside the checksum file matches the ISO itself and matches the hash published in the v4.0.4 GitHub release notes. $ gpg --verify omarchy-4.0.4.iso.sig omarchy-4.0.4.iso.sha256 gpg: Signature made Tue 15 Sep 2026 11:38:29 PM CEST gpg: using EDDSA key 40DFB630FF42BCFFB047046CF0134EE680CAC571 gpg: BAD signature from "Omarchy <[email protected]>" [unknown] $ sha256sum -c omarchy-4.0.4.iso.sha256 omarchy-4.0.4.iso: OK Hash matches release notes: ddeded2758c48318d201dfdac905ecb28f570441883f0c052ea3cd5d05acf92d Steps taken to rule out local causes: Re-downloaded all three files fresh with curl (not a browser) directly from iso.omarchy.org Confirmed key fingerprint matches the officially documented signing key Checked for CRLF/whitespace corruption in the .sha256 file — none found Reproduced consistently across multiple attempts This suggests the .sig file served may not correspond to the current .sha256 file (possibly stale from a previous build/release step), rather than an actual integrity problem with the ISO itself.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 14:44 UTC