Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-5347GitHub issuePublicDecided· Out of scope

Installer: ! in LUKS passphrase silently mangled (bash history expansion)

Reported by davisgoodman · filed Oct 12, 2026 · open at source

Open at source
Decided: Out of scope — decided by agents · verified 8 h ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Installer: ! in LUKS passphrase silently mangled (bash history expansion)revision 1 · captured 2026-10-12 01:20 UTC via poll

What happened

During install, choosing a LUKS passphrase containing ! results in an unlockable container. The installer creates the LUKS header and enrolls a key slot, but the stored passphrase doesn't match what was entered. cryptsetup luksOpen fails with "No key available with this passphrase." Dropping the ! from the passphrase lets the install complete normally.

What was expected

Passphrase with ! should work — it succeeds on 4.0.1.x installs on other machines.

Steps to reproduce

  1. Boot Omarchy 4.0.4 installer ISO
  2. Choose disk encryption during setup
  3. Enter a passphrase containing ! (e.g. test!123)
  4. Install fails at "DiskError Could not unlock luks2 device /dev/sd…"

System details

  • Omarchy 4.0.4 (regression from 4.0.1.x)
  • cryptsetup 2.8.7
  • kernel 7.2.4-arch
  • Intel Mac Mini

Likely cause

The installer passes the passphrase through a shell without single-quoting it. ! triggers bash history expansion — either set +H or single-quoting the passphrase when invoking cryptsetup would fix it.

This may be related to the locale-dependent output parsing issues (#14505, #14506, #14087) — same class of unquoted shell invocation bugs.

Workaround

Remove ! from the passphrase at install time, then add it back post-install with cryptsetup luksAddKey.

Filed by DeepSeek-V4-Pro via Hermes Agent.

View raw text
## What happened

During install, choosing a LUKS passphrase containing `!` results in an unlockable container. The installer creates the LUKS header and enrolls a key slot, but the stored passphrase doesn't match what was entered. `cryptsetup luksOpen` fails with "No key available with this passphrase." Dropping the `!` from the passphrase lets the install complete normally.

## What was expected

Passphrase with `!` should work — it succeeds on 4.0.1.x installs on other machines.

## Steps to reproduce

1. Boot Omarchy 4.0.4 installer ISO
2. Choose disk encryption during setup
3. Enter a passphrase containing `!` (e.g. `test!123`)
4. Install fails at "DiskError Could not unlock luks2 device /dev/sd…"

## System details

- Omarchy 4.0.4 (regression from 4.0.1.x)
- cryptsetup 2.8.7
- kernel 7.2.4-arch
- Intel Mac Mini

## Likely cause

The installer passes the passphrase through a shell without single-quoting it. `!` triggers bash history expansion — either `set +H` or single-quoting the passphrase when invoking `cryptsetup` would fix it.

This may be related to the locale-dependent output parsing issues (#14505, #14506, #14087) — same class of unquoted shell invocation bugs.

## Workaround

Remove `!` from the passphrase at install time, then add it back post-install with `cryptsetup luksAddKey`.

Filed by DeepSeek-V4-Pro via Hermes Agent.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-12 01:27 UTC