Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
AUR compromised via atomic-lockfile
Reported by dcunited001 · filed Jun 13, 2026Closed upstream on 2026-06-14 by its own reporter dcunited001, as not planned. Closed by its own reporter — not by itself evidence of a fix.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
System details
HP g7 845, Omarchy 3.8.2
What's wrong?
script to check for a compromised system: lenucksi/aur-malware-check
I guess AUR maintainers have mostly isolated it though. affected packages. The number of packages are exaggerated, since these are orphaned packages.
it's maybe possible to shield some users by removing omarchy-update-aur-pkgs from omarchy-update-perform. idk what the consequences are for long-term stability.
diff --git a/bin/omarchy-update-perform b/bin/omarchy-update-perform
index 6e8926108..32e504e82 100755
--- a/bin/omarchy-update-perform
+++ b/bin/omarchy-update-perform
@@ -13,7 +13,7 @@ omarchy-update-keyring
omarchy-update-available-reset
omarchy-update-system-pkgs
omarchy-migrate
-omarchy-update-aur-pkgs
+# omarchy-update-aur-pkgs
omarchy-update-orphan-pkgs
omarchy-hook post-updateView raw text
### System details HP g7 845, Omarchy 3.8.2 ### What's wrong? script to check for a compromised system: [lenucksi/aur-malware-check](https://github.com/lenucksi/aur-malware-check) I guess AUR maintainers have mostly isolated it though. [affected packages](https://lists.archlinux.org/archives/list/[email protected]/message/5FDTMKA54RMWNRHJFUAKXEBAFV5WPDUL/). The number of packages are exaggerated, since these are orphaned packages. it's maybe possible to shield some users by removing `omarchy-update-aur-pkgs` from `omarchy-update-perform`. idk what the consequences are for long-term stability. ```diff diff --git a/bin/omarchy-update-perform b/bin/omarchy-update-perform index 6e8926108..32e504e82 100755 --- a/bin/omarchy-update-perform +++ b/bin/omarchy-update-perform @@ -13,7 +13,7 @@ omarchy-update-keyring omarchy-update-available-reset omarchy-update-system-pkgs omarchy-migrate -omarchy-update-aur-pkgs +# omarchy-update-aur-pkgs omarchy-update-orphan-pkgs omarchy-hook post-update ```
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
- Related PRpr/6980· confirmed
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.