Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-58GitHub issuePublicDecided· Out of scope

omarchy update aborts with 'Refusing to use an unsafe ... inhibitor state path' on non-English locales (localized stat %F comparison)

Reported by sijin-xb · filed Sep 27, 2026 · open at source

Open at source
Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

omarchy update aborts with 'Refusing to use an unsafe ... inhibitor state path' on non-English locales (localized stat %F comparison)revision 1 · captured 2026-09-28 21:23 UTC via poll

What happened

omarchy update aborts immediately after the pre-update snapshot with:

Refusing to use an unsafe Omarchy update inhibitor state path.

(then a second time from the cleanup path), and no packages are updated.

Environment

  • Omarchy 4.0.4 (omarchy 4.0.4-1)
  • LANG=zh_CN.UTF-8 (zh_CN.UTF-8 locale generated; any non-English locale should be affected)
  • Reproduced on two different kernels (linux-omarchy 7.2.5 and linux-cachyos 7.2.8), so it is kernel-independent
  • Still present on current master (bin/omarchy-update-stay-awake, root_owned_parent_chain)

Reproduction

On the same machine, same boot:

$ omarchy update          # fails at "omarchy-update-stay-awake start"
Refusing to use an unsafe Omarchy update inhibitor state path.

$ LC_ALL=C omarchy update # succeeds end-to-end

Root cause

bin/omarchy-update-stay-awake → root_owned_parent_chain():

read -r owner mode type < <(/usr/bin/stat -Lc '%u %a %F' -- "$parent") || return 1
[[ $owner == 0 && $type == "directory" ]] || return 1

stat's %F output is localized through gettext, so on a non-English locale the directory
comparison never matches and fail_state_boundary fires on every update:

$ stat -c %F /run/user
目录                       # zh_CN.UTF-8
$ LC_ALL=C stat -c %F /run/user
directory

The directories themselves are perfectly fine (/run/user is root-owned, 755 — no group/other
write bits), so in the C locale the whole boundary check passes. Nothing about the state path
is actually unsafe; only the string comparison is locale-dependent.

Suggested fix

Force the C locale for that call, e.g.:

read -r owner mode type < <(LC_ALL=C /usr/bin/stat -Lc '%u %a %F' -- "$parent") || return 1

or avoid localized output entirely (e.g. [[ -d $parent ]] plus numeric fields). This is the
only stat %F comparison I could find under bin/ that gates a command on a string match.

Workaround

LC_ALL=C omarchy update

Happy to test a patch if useful — the reproducer is 100% deterministic here.

View raw text
## What happened

`omarchy update` aborts immediately after the pre-update snapshot with:

```
Refusing to use an unsafe Omarchy update inhibitor state path.
```

(then a second time from the cleanup path), and no packages are updated.

## Environment

- Omarchy 4.0.4 (`omarchy 4.0.4-1`)
- `LANG=zh_CN.UTF-8` (zh_CN.UTF-8 locale generated; any non-English locale should be affected)
- Reproduced on two different kernels (`linux-omarchy` 7.2.5 and `linux-cachyos` 7.2.8), so it is kernel-independent
- Still present on current `master` (`bin/omarchy-update-stay-awake`, `root_owned_parent_chain`)

## Reproduction

On the same machine, same boot:

```
$ omarchy update          # fails at "omarchy-update-stay-awake start"
Refusing to use an unsafe Omarchy update inhibitor state path.

$ LC_ALL=C omarchy update # succeeds end-to-end
```

## Root cause

`bin/omarchy-update-stay-awake` → `root_owned_parent_chain()`:

```bash
read -r owner mode type < <(/usr/bin/stat -Lc '%u %a %F' -- "$parent") || return 1
[[ $owner == 0 && $type == "directory" ]] || return 1
```

`stat`'s `%F` output is localized through gettext, so on a non-English locale the `directory`
comparison never matches and `fail_state_boundary` fires on every update:

```
$ stat -c %F /run/user
目录                       # zh_CN.UTF-8
$ LC_ALL=C stat -c %F /run/user
directory
```

The directories themselves are perfectly fine (`/run/user` is root-owned, 755 — no group/other
write bits), so in the C locale the whole boundary check passes. Nothing about the state path
is actually unsafe; only the string comparison is locale-dependent.

## Suggested fix

Force the C locale for that call, e.g.:

```bash
read -r owner mode type < <(LC_ALL=C /usr/bin/stat -Lc '%u %a %F' -- "$parent") || return 1
```

or avoid localized output entirely (e.g. `[[ -d $parent ]]` plus numeric fields). This is the
only `stat %F` comparison I could find under `bin/` that gates a command on a string match.

## Workaround

```
LC_ALL=C omarchy update
```

Happy to test a patch if useful — the reproducer is 100% deterministic here.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 18:57 UTC