From 79c487ecead88e4be28360f121ac9dbb7e2fa2bc Mon Sep 17 00:00:00 2001 From: NubsCarson Date: Tue, 19 May 2026 02:55:30 +0000 Subject: [PATCH 1/4] fix elizaOS live polish and updater materialization --- .../milady-tails/scripts/security-smoke.sh | 6 ++ .../milady-tails/scripts/static-smoke.sh | 11 ++++ .../usr/lib/live/config/2000-aesthetics | 2 +- .../usr/lib/live/config/2000-import-gnupg-key | 4 +- .../usr/local/bin/milady | 2 +- .../usr/local/lib/elizaos/update-manager | 62 ++++++++++++++++--- .../desktop-directories/Tails.directory.in | 4 +- .../scripts/init-premount/partitioning | 4 +- .../read-and-update-random-seed-sector | 4 +- 9 files changed, 81 insertions(+), 18 deletions(-) diff --git a/packages/os/linux/variants/milady-tails/scripts/security-smoke.sh b/packages/os/linux/variants/milady-tails/scripts/security-smoke.sh index d5dabf586da84..6a62163f3db1c 100755 --- a/packages/os/linux/variants/milady-tails/scripts/security-smoke.sh +++ b/packages/os/linux/variants/milady-tails/scripts/security-smoke.sh @@ -301,6 +301,12 @@ require_fixed 'contains unlisted file' "${update_manager}" \ "update manager must reject files outside the signed runtime inventory" require_fixed 'runtime_store' "${update_manager}" \ "update manager must materialize verified runtimes into a root-owned store" +require_fixed 'os.O_NOFOLLOW' "${update_manager}" \ + "update manager must materialize files without following source symlinks" +require_fixed 'tempfile.mkstemp' "${update_manager}" \ + "update manager must materialize files through temporary files" +require_fixed 'verified runtime file changed while copying' "${update_manager}" \ + "update manager must re-check manifest digests during materialization" if grep -q 'ELIZAOS_ALLOW_RUNTIME_ENV_OVERRIDES' "${runtime_env}"; then fail "runtime selector must not expose caller-controlled runtime override escape hatches" fi diff --git a/packages/os/linux/variants/milady-tails/scripts/static-smoke.sh b/packages/os/linux/variants/milady-tails/scripts/static-smoke.sh index ef356dd40fdf9..54cee2389174b 100755 --- a/packages/os/linux/variants/milady-tails/scripts/static-smoke.sh +++ b/packages/os/linux/variants/milady-tails/scripts/static-smoke.sh @@ -276,6 +276,17 @@ then echo "High-visibility inherited Tails strings still need elizaOS branding." >&2 exit 1 fi +if rg -n \ + 'Preparing Tails for first use|Checking the Tails system partition|Configuring Tails|Tails specific tools|Tails live user' \ + tails/config/chroot_local-includes/usr/share/initramfs-tools/scripts/init-premount/partitioning \ + tails/config/chroot_local-includes/usr/share/initramfs-tools/scripts/init-top/read-and-update-random-seed-sector \ + tails/config/chroot_local-includes/usr/lib/live/config/2000-aesthetics \ + tails/config/chroot_local-includes/usr/local/bin/milady \ + tails/config/chroot_local-includes/usr/share/desktop-directories/Tails.directory.in +then + echo "First-boot and launcher polish still exposes inherited Tails wording." >&2 + exit 1 +fi launcher_paths=( tails/config/chroot_local-includes/usr/share/applications/tails-documentation.desktop tails/config/chroot_local-includes/usr/share/applications/tails-backup.desktop diff --git a/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/lib/live/config/2000-aesthetics b/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/lib/live/config/2000-aesthetics index 07847f0ddbcb0..6948ae5090891 100755 --- a/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/lib/live/config/2000-aesthetics +++ b/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/lib/live/config/2000-aesthetics @@ -1,4 +1,4 @@ #!/bin/sh echo "" -echo "Configuring Tails" +echo "Configuring elizaOS" diff --git a/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/lib/live/config/2000-import-gnupg-key b/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/lib/live/config/2000-import-gnupg-key index 2b9aed3901352..37ca7806fa2f3 100755 --- a/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/lib/live/config/2000-import-gnupg-key +++ b/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/lib/live/config/2000-import-gnupg-key @@ -1,10 +1,10 @@ #!/bin/sh Import_GnuPG_key() { - echo "- importing Tails' GnuPG keys into the ${LIVE_USERNAME}'s keyring" + echo "- importing upstream live-OS GnuPG keys into the ${LIVE_USERNAME}'s keyring" sudo -H -u "${LIVE_USERNAME}" gpg --batch --import /usr/share/doc/tails/website/*.key - echo "- importing Tails help desk's GnuPG key into WhisperBack's keyring" + echo "- importing inherited feedback GnuPG key into WhisperBack's keyring" gpg --batch --no-default-keyring \ --keyring /usr/share/keyrings/whisperback-keyring.gpg \ --import /usr/share/doc/tails/website/tails-bugs.key diff --git a/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/local/bin/milady b/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/local/bin/milady index 26482e7fc1b4d..5435fbb5aea01 100755 --- a/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/local/bin/milady +++ b/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/local/bin/milady @@ -8,7 +8,7 @@ if [ "$(id -u)" -eq 0 ]; then fi if [ "$(id -un)" != "amnesia" ]; then - echo "elizaOS must run as the Tails live user 'amnesia'." >&2 + echo "elizaOS must run as the live user 'amnesia'." >&2 exit 1 fi diff --git a/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/local/lib/elizaos/update-manager b/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/local/lib/elizaos/update-manager index b87214814ec5e..2c825551ac7d1 100755 --- a/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/local/lib/elizaos/update-manager +++ b/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/local/lib/elizaos/update-manager @@ -149,6 +149,7 @@ import pathlib import re import shutil import shlex +import stat import sys import tempfile @@ -242,11 +243,44 @@ def ensure_safe_dir(path, field): fail(f"{field} must not be group/world writable") return path -def copy_verified_file(src, dst): +def copy_verified_file(src, dst, expected_sha256): dst.parent.mkdir(mode=0o755, parents=True, exist_ok=True) - shutil.copyfile(src, dst, follow_symlinks=False) - mode = src.stat().st_mode - os.chmod(dst, 0o755 if mode & 0o111 else 0o644) + if dst.parent.is_symlink(): + fail(f"destination parent must not be a symlink: {dst.parent}") + flags = os.O_RDONLY + if hasattr(os, "O_NOFOLLOW"): + flags |= os.O_NOFOLLOW + try: + src_fd = os.open(src, flags) + except OSError as exc: + fail(f"unable to open verified runtime file without following symlinks: {src}: {exc}") + tmp_name = None + try: + src_stat = os.fstat(src_fd) + if not stat.S_ISREG(src_stat.st_mode): + fail(f"verified runtime path is not a regular file: {src}") + tmp_fd, tmp_name = tempfile.mkstemp(prefix=f"{dst.name}.", dir=str(dst.parent)) + digest = hashlib.sha256() + with os.fdopen(src_fd, "rb", closefd=True) as src_handle, os.fdopen( + tmp_fd, + "wb", + closefd=True, + ) as dst_handle: + src_fd = -1 + for chunk in iter(lambda: src_handle.read(1024 * 1024), b""): + digest.update(chunk) + dst_handle.write(chunk) + actual = digest.hexdigest() + if actual.lower() != expected_sha256.lower(): + fail(f"verified runtime file changed while copying: {src}") + os.chmod(tmp_name, 0o755 if src_stat.st_mode & 0o111 else 0o644) + os.replace(tmp_name, dst) + tmp_name = None + finally: + if src_fd >= 0: + os.close(src_fd) + if tmp_name and os.path.exists(tmp_name): + os.unlink(tmp_name) def chown_tree_root(path): if os.geteuid() != 0: @@ -350,6 +384,7 @@ if runtime.get("filesComplete") is not True: fail("runtime.filesComplete must be true") hashed_entrypoint_paths = set() declared_files = {} +declared_hashes = {} for item in files: if not isinstance(item, dict): fail("runtime.files entries must be objects") @@ -368,6 +403,7 @@ for item in files: if rel_text in declared_files: fail(f"runtime.files contains duplicate path: {rel_text}") declared_files[rel_text] = path + declared_hashes[rel_text] = expected.lower() for candidate in bundle_dir.rglob("*"): if candidate.is_symlink(): @@ -403,6 +439,7 @@ if floor_path.exists(): fail("manifest sequence is below the stored channel floor") model_catalog_path = "" +model_catalog_digest = "" model_catalog = manifest.get("modelCatalog") if model_catalog is not None: if not isinstance(model_catalog, dict): @@ -417,6 +454,7 @@ if model_catalog is not None: actual = file_sha256(catalog_path) if actual.lower() != expected.lower(): fail("model catalog hash mismatch") + model_catalog_digest = expected.lower() catalog = read_json(catalog_path, "modelCatalog") if catalog.get("schemaVersion") != 1 or catalog.get("kind") != "elizaos.modelCatalog": fail("model catalog kind/schemaVersion mismatch") @@ -432,14 +470,22 @@ else: tmp_runtime = tmp_store / "runtime" try: for rel_text, src in declared_files.items(): - copy_verified_file(src, tmp_runtime / pathlib.PurePosixPath(rel_text)) + copy_verified_file( + src, + tmp_runtime / pathlib.PurePosixPath(rel_text), + declared_hashes[rel_text], + ) node_modules_rel = pathlib.Path( os.path.relpath(resolved_entrypoints["nodeModules"], bundle_dir) ) (tmp_runtime / node_modules_rel).mkdir(mode=0o755, parents=True, exist_ok=True) - copy_verified_file(manifest_path, tmp_store / "manifest.json") + copy_verified_file(manifest_path, tmp_store / "manifest.json", manifest_digest) if model_catalog_path: - copy_verified_file(pathlib.Path(model_catalog_path), tmp_store / "model-catalog.json") + copy_verified_file( + pathlib.Path(model_catalog_path), + tmp_store / "model-catalog.json", + model_catalog_digest, + ) model_catalog_path = str(tmp_store / "model-catalog.json") chown_tree_root(tmp_store) for root, dirs, files in os.walk(tmp_store): @@ -463,7 +509,7 @@ if not materialized_manifest_path.is_file(): if file_sha256(materialized_manifest_path) != manifest_digest: fail("materialized update manifest hash mismatch") for rel_text, src in declared_files.items(): - expected = file_sha256(src) + expected = declared_hashes[rel_text] materialized_file = materialized_runtime / pathlib.PurePosixPath(rel_text) if materialized_file.is_symlink(): fail(f"materialized runtime contains unsupported symlink: {rel_text}") diff --git a/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/share/desktop-directories/Tails.directory.in b/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/share/desktop-directories/Tails.directory.in index 332a4c2b147f7..6629792e464d3 100644 --- a/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/share/desktop-directories/Tails.directory.in +++ b/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/share/desktop-directories/Tails.directory.in @@ -1,5 +1,5 @@ [Desktop Entry] -_Name=Tails -_Comment=Tails specific tools +_Name=elizaOS +_Comment=elizaOS live tools Icon=preferences-system Type=Directory diff --git a/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/share/initramfs-tools/scripts/init-premount/partitioning b/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/share/initramfs-tools/scripts/init-premount/partitioning index b5f29ade7ff4c..cf27c2f4e281e 100755 --- a/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/share/initramfs-tools/scripts/init-premount/partitioning +++ b/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/share/initramfs-tools/scripts/init-premount/partitioning @@ -90,7 +90,7 @@ GUID=$(sgdisk --print "${PARENT_DEVICE}" | if [ "${GUID}" = "17B81DA0-8B1E-4269-9C39-FE5C7B9B58A3" ]; then log "This is the first boot, so repartitioning" - PLYMOUTH_MSG="Preparing Tails for first use..." + PLYMOUTH_MSG="Preparing elizaOS for first use..." plymouth display-message --text="${PLYMOUTH_MSG}" if ! /scripts/lib/first_boot_repartition "${PARENT_DEVICE}" "${SYSTEM_PARTITION}"; then log "Repartitioning failed" @@ -109,7 +109,7 @@ else verify_partition_table log "This is not the first boot, so repairing filesystem" - PLYMOUTH_MSG="Checking the Tails system partition for errors..." + PLYMOUTH_MSG="Checking the elizaOS system partition for errors..." plymouth display-message --text="${PLYMOUTH_MSG}" repair_system_partition # `plymouth hide-message` doesn't work (#20401) diff --git a/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/share/initramfs-tools/scripts/init-top/read-and-update-random-seed-sector b/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/share/initramfs-tools/scripts/init-top/read-and-update-random-seed-sector index 4185e77192749..8145b10d45b65 100755 --- a/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/share/initramfs-tools/scripts/init-top/read-and-update-random-seed-sector +++ b/packages/os/linux/variants/milady-tails/tails/config/chroot_local-includes/usr/share/initramfs-tools/scripts/init-top/read-and-update-random-seed-sector @@ -74,13 +74,13 @@ log "Restoring random seed from LBA 34" dd bs=512 skip=34 count=1 status=none if="${PARENT_DEVICE}" of=/dev/urandom log "Random seed restored from LBA 34" -# We try to obfuscate the number of times Tails has been booted by +# We try to obfuscate the number of times elizaOS has been booted by # writing a random number of times (1-500) to the seed during the first # boot. if [ -n "${FIRST_BOOT:-}" ]; then ITERATIONS=$((1 + $(od -An -N2 -t uI /dev/urandom) % 500)) log "First boot, writing random seed $ITERATIONS times..." - PLYMOUTH_INIT_MSG="Preparing Tails for first use..." + PLYMOUTH_INIT_MSG="Preparing elizaOS for first use..." plymouth display-message --text="${PLYMOUTH_INIT_MSG}" # Debug output for the following loop would be too verbose From b2049849cad963ff02a8bff0814ac9a6b8840714 Mon Sep 17 00:00:00 2001 From: NubsCarson Date: Tue, 19 May 2026 03:10:39 +0000 Subject: [PATCH 2/4] make elizaOS live app staging reproducible --- .../os/linux/variants/milady-tails/Justfile | 62 ++++++++++++++++--- .../milady-tails/scripts/static-smoke.sh | 3 + 2 files changed, 57 insertions(+), 8 deletions(-) diff --git a/packages/os/linux/variants/milady-tails/Justfile b/packages/os/linux/variants/milady-tails/Justfile index 11061ac66bdd8..a46f43ecd69a8 100644 --- a/packages/os/linux/variants/milady-tails/Justfile +++ b/packages/os/linux/variants/milady-tails/Justfile @@ -37,23 +37,69 @@ setup: milady-app: #!/usr/bin/env bash set -euo pipefail - milady_root="$(cd ../../../../../.. && pwd)" - app_out="${milady_root}/eliza/packages/app-core/platforms/electrobun/build/dev-linux-x64/Milady-dev" + eliza_root="$(git rev-parse --show-toplevel)" + outer_root="$(cd "${eliza_root}/.." && pwd)" + app_out="${ELIZAOS_MILADY_APP_ARTIFACT:-${eliza_root}/packages/app-core/platforms/electrobun/build/dev-linux-x64/Milady-dev}" stage="tails/config/chroot_local-includes/usr/share/elizaos/milady-app" + + ensure_plugin_runtime_dist() { + local package_rel="$1" + local mode="$2" + local package_dir="${eliza_root}/${package_rel}" + local dist_index="${package_dir}/dist/index.js" + + if [ -s "${dist_index}" ]; then + return 0 + fi + + echo "Building ${package_rel} runtime dist for elizaOS Live" + case "${mode}" in + package-js) + ( cd "${package_dir}" && bun run build:js ) + ;; + tsup-index) + ( cd "${package_dir}" && bunx tsup src/index.ts --format esm --clean ) + ;; + *) + echo "Unknown runtime package build mode: ${mode}" >&2 + exit 1 + ;; + esac + + test -s "${dist_index}" || { + echo "missing ${dist_index} after runtime package build" >&2 + exit 1 + } + } + if [ ! -x "${app_out}/bin/launcher" ]; then if [ "${ELIZAOS_BUILD_MILADY_APP:-0}" != "1" ]; then echo "Milady app build not found at ${app_out}/bin/launcher" - echo "Build it separately, or rerun with ELIZAOS_BUILD_MILADY_APP=1 to permit this recipe to build it." + echo "Build it separately, set ELIZAOS_MILADY_APP_ARTIFACT, or rerun with ELIZAOS_BUILD_MILADY_APP=1 to permit this recipe to build it." exit 1 fi echo "Milady app build not found; ELIZAOS_BUILD_MILADY_APP=1 so building it now" - ( cd "${milady_root}" && bun install --no-frozen-lockfile --ignore-scripts ) - ( cd "${milady_root}" && bun install --cwd eliza --no-frozen-lockfile --ignore-scripts ) - ( cd "${milady_root}" && MILADY_ELIZA_SOURCE=local node scripts/setup-upstreams.mjs ) - ( cd "${milady_root}/eliza/packages/electrobun-carrots" && bun run build ) - ( cd "${milady_root}" && MILADY_ELIZA_SOURCE=local bun run build:desktop ) + ( cd "${eliza_root}" && bun install --no-frozen-lockfile --ignore-scripts ) + if [ -f "${outer_root}/package.json" ] && [ -d "${outer_root}/eliza" ]; then + ( cd "${outer_root}" && bun install --no-frozen-lockfile --ignore-scripts ) + ( cd "${outer_root}" && bun install --cwd eliza --no-frozen-lockfile --ignore-scripts ) + ( cd "${outer_root}" && MILADY_ELIZA_SOURCE=local node scripts/setup-upstreams.mjs ) + ( cd "${outer_root}/eliza/packages/electrobun-carrots" && bun run build ) + ( cd "${outer_root}" && MILADY_ELIZA_SOURCE=local bun run build:desktop ) + else + ( cd "${eliza_root}" && MILADY_ELIZA_SOURCE=local node packages/app-core/scripts/setup-upstreams.mjs ) + ( cd "${eliza_root}/packages/electrobun-carrots" && bun run build ) + ( cd "${eliza_root}" && \ + ELIZA_APP_NAME=Milady \ + ELIZA_APP_ID=ai.milady.milady \ + ELIZA_URL_SCHEME=milady \ + ELIZA_NAMESPACE=milady \ + bun run --cwd packages/app-core/platforms/electrobun build ) + fi fi test -x "${app_out}/bin/launcher" || { echo "missing ${app_out}/bin/launcher"; exit 1; } + ensure_plugin_runtime_dist "plugins/plugin-health" package-js + ensure_plugin_runtime_dist "plugins/plugin-calendly" tsup-index if [ -e "${stage}" ] && ! rm -rf "${stage}"; then sudo -n rm -rf "${stage}" fi diff --git a/packages/os/linux/variants/milady-tails/scripts/static-smoke.sh b/packages/os/linux/variants/milady-tails/scripts/static-smoke.sh index 54cee2389174b..91bcc955331d3 100755 --- a/packages/os/linux/variants/milady-tails/scripts/static-smoke.sh +++ b/packages/os/linux/variants/milady-tails/scripts/static-smoke.sh @@ -67,6 +67,9 @@ node --check scripts/generate-release-evidence.mjs node --check scripts/validate-model-catalog.mjs node --check scripts/validate-runtime-overlay.mjs node --check tails/config/chroot_local-includes/usr/local/lib/elizaos/renderer-server.mjs +grep -q 'ELIZAOS_MILADY_APP_ARTIFACT' Justfile +grep -q 'ensure_plugin_runtime_dist "plugins/plugin-health" package-js' Justfile +grep -q 'ensure_plugin_runtime_dist "plugins/plugin-calendly" tsup-index' Justfile python3 -m json.tool schemas/update-manifest.schema.json >/dev/null python3 -m json.tool schemas/model-catalog.schema.json >/dev/null python3 - \ From e7af75955c7a7300e548fc49a7ed69d7522f75e1 Mon Sep 17 00:00:00 2001 From: NubsCarson Date: Tue, 19 May 2026 03:16:28 +0000 Subject: [PATCH 3/4] vendor required Tails build data --- .../milady-tails/scripts/static-smoke.sh | 3 + .../debootstrap/scripts/debian-common.patch | 11 ++ .../milady-tails/tails/data/splash.png | Bin 0 -> 2291 bytes .../milady-tails/tails/data/splash.svg | 120 ++++++++++++++++++ .../milady-tails/tails/data/wrappers/apt-get | 71 +++++++++++ 5 files changed, 205 insertions(+) create mode 100644 packages/os/linux/variants/milady-tails/tails/data/debootstrap/scripts/debian-common.patch create mode 100644 packages/os/linux/variants/milady-tails/tails/data/splash.png create mode 100644 packages/os/linux/variants/milady-tails/tails/data/splash.svg create mode 100755 packages/os/linux/variants/milady-tails/tails/data/wrappers/apt-get diff --git a/packages/os/linux/variants/milady-tails/scripts/static-smoke.sh b/packages/os/linux/variants/milady-tails/scripts/static-smoke.sh index 91bcc955331d3..1be13a832c13a 100755 --- a/packages/os/linux/variants/milady-tails/scripts/static-smoke.sh +++ b/packages/os/linux/variants/milady-tails/scripts/static-smoke.sh @@ -28,6 +28,9 @@ stat_mode() { } echo "==> shell syntax" +test -f tails/data/debootstrap/scripts/debian-common.patch +test -f tails/data/splash.png +test -x tails/data/wrappers/apt-get bash -n build.sh build-iso.sh tails/auto/build \ scripts/dev-sign-update-manifest.sh \ scripts/usb-write.sh \ diff --git a/packages/os/linux/variants/milady-tails/tails/data/debootstrap/scripts/debian-common.patch b/packages/os/linux/variants/milady-tails/tails/data/debootstrap/scripts/debian-common.patch new file mode 100644 index 0000000000000..bb194bc6a3bde --- /dev/null +++ b/packages/os/linux/variants/milady-tails/tails/data/debootstrap/scripts/debian-common.patch @@ -0,0 +1,11 @@ +--- /usr/share/debootstrap/scripts/debian-common 2019-07-06 13:22:30.000000000 +0200 ++++ /usr/share/debootstrap/scripts/debian-common 2019-08-05 14:15:07.165451726 +0200 +@@ -217,4 +217,8 @@ + + progress $bases $bases CONFBASE "Configuring base system" + info BASESUCCESS "Base system installed successfully." ++ ++ # Tails-specific part: ++ chroot $TARGET /usr/bin/dpkg-divert --divert /usr/bin/apt-get.real --rename /usr/bin/apt-get ++ cp -f %%topdir%%/data/wrappers/apt-get $TARGET/usr/bin/apt-get + } diff --git a/packages/os/linux/variants/milady-tails/tails/data/splash.png b/packages/os/linux/variants/milady-tails/tails/data/splash.png new file mode 100644 index 0000000000000000000000000000000000000000..3345e630c92892d3334e3565239c0f402f50d596 GIT binary patch literal 2291 zcmd5-X*kldU8T{08(-20MAW0zk4J0MLH~00{`u zX8|A{1pxD80I~G>^d%lw5NrW4P?e^~8J$CKMqY^b_lw+I3qwAR9ADTy81vC=z)vz4e)2HVM#P_w%I&@)2 zf*Py&4x`(Vq%?5q4&Y|e52jC=n*6Adzi*`|7Zq)IcWERbdrtCNB%Px|Cj3^dD9HM`44MEtKyH6>TXNY7F;%LK4mZhjBpL8YFbMPM%M{x*>h7TLb0*uV z_#6Vld{)m-Kuoo0`$+XJo`NtV-ZsSZRgBYejP3zTjp6228quS&YCZbgfRq~a?;kOr zL-2q0htKfbuG`nJM6*L}s^Fvt+;J!i4SV^M?6L( z;X0Dk-NEn|Xe{Mtar~snvLAs6iX6&Yt%E5FME=;|vs20J#D*Fz=wMhD`@3Rq1mtU~ z)FgW?bG2bB&<+uFeW+sfSC}HXJ)kvVI{5=J3`-+;#^PvYNL3Dc44v@?xqTV^jtAP4UBX(5j>nOXEbw-tWV@Dimix8t|_PC)r< z%=%S%s>Z9B>7J5I0=HAu8A&Jjq(ZrOe@S^%9;+60AF0BzMP&8ss1bLLy=E*`^D3+L zV?yrf-#Z7?GSK5_X1-zju*yV$D&K2rqDS(y^2?6XNjel7y}A(EE~w)7zgyg^ob;F; zsT9`>Ur258ro=Nab-pBZa%9fg9D!I)N9{Ma9*MQwFq?;(`|Z|V6h~p^r^L97I7A-< zP368z+OD7}Z$>?hS36dCt)5Fr4cFC7%#e$kb2Xp(+JCm?_U+QXR=2MayG>pUgI)BQ z`43{t3^^2~r3&{aw4;I{IY%g5wo`7zWEroy)3DeE>Bo$=ng^iZrzqplK?&DWt?%X& z`>exDvufEkn{VI+GkmHeKN`%i3%~{nFRBd(Ew6|A`_Z-!{I$iexmf!BB$G{Tu}45A z_6O|Sub3x~+wInD?v>SvRwkBWw}#_CfAXSj@$f_#q!+Q4V_UW*e!_nTO<(S>6>4b~ zjFTcR$>aQMIpz;I7&6vBKfnM-xmHQrU;H}5?YlGIb*4mq&jLB|tdYA9j~`7@Q0x`V zxO6=1J5Sk}-WxufozjXX6x`T&-Z(LFfapTm`=ceyBBb)2El65|qVf5(1>B85 zs&;f!bV2i#H1f@87_(JQhT0SjQ%a1`Pqa)3PFUPC9pju)gyqZPDAk^Zjfc}^>r1R2 z`*!gdVGHwPLO80->f+AYdw3MHLWR@4RpwuGRs-V~pJL$^R>IH3y<(z|NxjlVMg068x4NskP=|Gpx5Bf%)o%q7e3Fgx>Ry`&Go zwOCzL1qpWpbof2<9U}3H&Pmo>+raGD+hM$BoLiIM`)y|f`fi0&Lfm@L_0>&5`P`_7 ze$pvgu<92@6}Uq+AWc<8L)iAqtGL15U&@ zHhu#N_7{#p^(8H?hqRMa0Aapg3l;^nQ>4h_9EMnH@8x%^g>t{iqvor%nud+ia8oJdmbjYPmr`O=%nT7E&`n!^NSgewp|~z%c@rlpD4Ku z!g`wkuAz>)=_}Q9UxP4z*s?o{m+B3w%b}iEUR^Epo>t))m=GHh+mHNDKhdR4yCzn5 z_k4F=F*p|)=in0;5*T;YCOGCQXaEb8xwQ$((!}Dlw}rXQ>C-l+&5ckf8x-o}@}Bp9 h6x^VMTn|n9F9oQ77kty literal 0 HcmV?d00001 diff --git a/packages/os/linux/variants/milady-tails/tails/data/splash.svg b/packages/os/linux/variants/milady-tails/tails/data/splash.svg new file mode 100644 index 0000000000000..07dae9f85c3df --- /dev/null +++ b/packages/os/linux/variants/milady-tails/tails/data/splash.svg @@ -0,0 +1,120 @@ + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + diff --git a/packages/os/linux/variants/milady-tails/tails/data/wrappers/apt-get b/packages/os/linux/variants/milady-tails/tails/data/wrappers/apt-get new file mode 100755 index 0000000000000..b0696b77a8836 --- /dev/null +++ b/packages/os/linux/variants/milady-tails/tails/data/wrappers/apt-get @@ -0,0 +1,71 @@ +#!/bin/sh +set -e +set -u + +mode=unknown +for param in "$@"; do + case "$param" in + install | download | purge | remove | upgrade | dist-upgrade) + mode=binuris + break + ;; + source) + mode=srcuris + break + ;; + update) + mode=update + break + ;; + check | autoclean | autoremove) + mode=noop + break + ;; + esac +done + +# let's fail as early as possible: +if [ "$mode" = unknown ]; then + echo "E: unsupported apt-get operation, mode is still unknown" >&2 + echo "E: requested operation follows:" "$@" >&2 + exit 1 +fi + +building_with_tagged_APT_snapshots() { + grep --recursive --quiet --silent --fixed-strings \ + tagged.snapshots.deb.tails.boum.org \ + /etc/apt/sources.list.d/ +} + +if [ "$mode" = binuris ]; then + apt-get.real "$@" --print-uris|perl -ne 'if (/^'\''(.+)'\'' ([^_]+)_([^_]+)_/) { my ($url, $package, $version)=($1,$2,$3); $version =~ s/%3a/:/g; print "$package $version $url\n"; }' >> /debootstrap/$mode + apt-get.real "$@" +elif [ "$mode" = srcuris ]; then + # all uris: perl -ne 'if (/^'\''(.+)'\'' (\S+)/) { my ($url, $filename) = ($1, $2); print "$filename $url\n"; }' + # only dsc: perl -ne 'if (/^'\''(.+)'\'' (\S+\.dsc)/) { my ($url, $filename) = ($1, $2); print "$filename $url\n"; }' + apt-get.real "$@" --print-uris|perl -ne 'if (/^'\''(.+)'\'' (\S+\.dsc)/) { my ($url, $filename) = ($1, $2); print "$filename $url\n"; }' >> /debootstrap/$mode.tmp + apt-get.real "$@" + while read -r filename uri; do + # extract source and version w/o taking the GnuPG version in the signature section, and add uri after that + s_v=$(awk '/^(Source|Version):/ {print $2}' "$filename" | head -2 | xargs) + echo "$s_v $uri" >> /debootstrap/$mode + done < /debootstrap/$mode.tmp + rm /debootstrap/$mode.tmp +elif [ "$mode" = update ]; then + echo "command:" "$@" >> /debootstrap/noop + set +e + apt-get.real "$@" + RET=$? + set -e + if [ $RET -ne 0 ] && building_with_tagged_APT_snapshots ; then + echo "APT update failed." + echo "You may be experiencing a known issue," + echo "that thankfully has a documented workaround:" + echo "see https://gitlab.tails.boum.org/tails/tails/-/issues/20009" + fi + exit $RET +else + # handle both noop and unknown here, each into its own file; unknown should be empty: + echo "command:" "$@" >> /debootstrap/$mode + apt-get.real "$@" +fi From 477abe5f1eb83396517cab367661aaa215511a4d Mon Sep 17 00:00:00 2001 From: NubsCarson Date: Tue, 19 May 2026 03:21:39 +0000 Subject: [PATCH 4/4] fix homepage smoke scope on shallow PR history --- .github/workflows/quality.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index d71c266deb4d1..63714826d2c2a 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -77,8 +77,13 @@ jobs: exit 0 fi - git fetch --no-tags --depth=1 origin "${{ github.base_ref }}" - changed_files="$(git diff --name-only "origin/${{ github.base_ref }}...HEAD")" + git fetch --no-tags origin "${{ github.base_ref }}" + if merge_base="$(git merge-base "origin/${{ github.base_ref }}" HEAD)"; then + changed_files="$(git diff --name-only "${merge_base}" HEAD)" + else + echo "No merge base found with origin/${{ github.base_ref }}; falling back to direct base/head diff." >&2 + changed_files="$(git diff --name-only "origin/${{ github.base_ref }}" HEAD)" + fi if grep -Eq '^(packages/homepage/|packages/shared-brand/|packages/app-core/scripts/write-homepage-release-data\.mjs|\.github/workflows/(deploy-homepage|release-electrobun|release-orchestrator)\.yml)' <<< "${changed_files}"; then echo "run=true" >> "$GITHUB_OUTPUT" else