Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Remove AUR from omarchy-update-perform
Reported by daviewales · filed Jul 14, 2026Closed upstream on 2026-07-14 by dhh. GitHub close reason: completed. No closing PR or commit is recorded — "completed" alone is not evidence of a fix.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
System details
Lenovo ThinkPad L380, Omarchy 3.8.3
What's wrong?
The Omarchy auto-updater (omarchy-update-perform) should not auto-update AUR packages, because they have a significantly different threat model and security posture to regular Arch system packages.
I've read #857 and #1466. These were closed with the reasoning that the AUR is no less secure than RubyGems or NPM, and "...people aren't going to read these diffs..."
However, recent events (#6083) highlighted that the AUR is less secure than package repositories such as RubyGems or NPM due to the adoption mechanism for orphaned packages. Any random person with an AUR account can adopt an orphaned package, and start uploading malicious software to it at any time. Unlike most language package repositories, there's no approval process required for this. Just log in, and click the 'adopt' button.
Due to these issues, I try to limit my AUR use to a small selection of packages, with the intention that I will review the diffs, and will update them less frequently (i.e. when I have time to carefully review the diffs.)
However, because AUR is included in the official Omarchy system upgrade, it exposes me to security risks which I would otherwise avoid.
If AUR is compared to language package repositories, then treat it like a language package repository and don't include it in the full system upgrade script at all! I wouldn't expect omarchy-update-perform to update my Pip packages. So why is it updating my (considerably less secure) AUR packages?
Proposal: Remove the following line to keep system updates and AUR updates separate:
https://github.com/basecamp/omarchy/blob/9cf1852525a5f7de26d3162db9d61e2f5c1d5523/bin/omarchy-update-perform#L16
View raw text
### System details Lenovo ThinkPad L380, Omarchy 3.8.3 ### What's wrong? The Omarchy auto-updater (`omarchy-update-perform`) should not auto-update AUR packages, because they have a significantly different threat model and security posture to regular Arch system packages. I've read #857 and #1466. These were closed with the reasoning that the AUR is no less secure than RubyGems or NPM, and "...people aren't going to read these diffs..." However, [recent events](https://lists.archlinux.org/archives/list/[email protected]/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/#5FDTMKA54RMWNRHJFUAKXEBAFV5WPDUL) (#6083) highlighted that the AUR is _less_ secure than package repositories such as RubyGems or NPM due to the adoption mechanism for orphaned packages. Any random person with an AUR account can adopt an orphaned package, and start uploading malicious software to it at any time. Unlike most language package repositories, there's no approval process required for this. Just log in, and click the 'adopt' button. Due to these issues, I try to limit my AUR use to a small selection of packages, with the intention that I _will_ review the diffs, and will update them less frequently (i.e. when I have time to carefully review the diffs.) However, because AUR is included in the official Omarchy system upgrade, it exposes me to security risks which I would otherwise avoid. If AUR is compared to language package repositories, then treat it like a language package repository and don't include it in the full system upgrade script at all! I wouldn't expect `omarchy-update-perform` to update my Pip packages. So why is it updating my (considerably less secure) AUR packages? Proposal: Remove the following line to keep system updates and AUR updates separate: https://github.com/basecamp/omarchy/blob/9cf1852525a5f7de26d3162db9d61e2f5c1d5523/bin/omarchy-update-perform#L16
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.