Two fixes for the black-shell / no-blur symptoms (seen first in a VM,
but the renderer one bites real hardware too):
1. `GSK_RENDERER=cairo` in the session env. GTK4's default renderer
(ngl/vulkan on 4.14+) draws transparent layer-shell surfaces as
opaque black on wlroots — the whole bread shell (breadbox launcher,
breadclip popup, breadbar, breadhelp, bos-settings) goes black-on-
black, and it's guaranteed under a VM's virtio-gpu where there's no
real GL/Vulkan context. cairo (software) always composites
transparency correctly; the shell is flat colour/text/icons so
there's no visible cost, and idle memory drops (~40%, no Mesa
driver resident). Override with GSK_RENDERER=gl in the session for a
GPU-heavy GTK4 app.
2. `scripts/ui/rules.lua` (new) + a `pcall(dofile ...)` for it in
hyprland.lua + `bread-theme layerrules` in the bootstrap. The
shell-theme work added layer-rule *generation* (bread-theme writes
~/.config/hypr/layerrules.json from the theme's [compositor] table)
but BOS never shipped the read side, so no blur / ignore-alpha /
per-namespace motion was ever applied to breadbar / breadbox /
breadclip. rules.lua reads the JSON and emits `hl.layer_rule`,
with the pre-theme hardcoded rule set as a pcall-guarded fallback
(matches the live reference config). Layer rules only — window /
workspace / focus rules stay in hyprland.lua.
python-pywal was dropped from Arch's [extra] repo (AUR-only now), so
`pacstrap` can no longer resolve it and every ISO build fails with
"target not found: python-pywal". The `wal` binary is load-bearing —
bread-theme shells out to it to extract the colour palette from the
user's wallpaper.
Republish it the same way as calamares / bibata / powerlevel10k /
yay-bin:
- `packaging/python-pywal/PKGBUILD` — in-house copy of the AUR PKGBUILD
(Morten Linderud's), modernised to `python -m build` / `installer`
instead of the removed `setup.py install`, sha256-only sources like
the sibling PKGBUILDs. Test-built locally: 28 unit tests pass, package
ships `/usr/bin/wal`.
- `.forgejo/workflows/python-pywal.yml` — builds + PUTs to the Forgejo
Arch registry on a push to `packaging/python-pywal/**`.
- `signed-repo.yml` gains it as a `workflow_run` trigger;
`ci-publish-signed-repo.sh` gains it in `PACKAGES` so the signed
dl.breadway.dev/arch db picks it up.
- packages.x86_64 keeps the `python-pywal` line (now sourced from
[breadway]) with a note.
Ordering: `python-pywal.yml` must publish to the registry once before
`signed-repo.yml` runs, or the collect step errors "registry db missing
packages: python-pywal".
The signed repo is live: https://dl.breadway.dev/arch/x86_64/ serves
breadway.db + .files + every .pkg.tar.zst with a detached .sig from the
BOS release key (56203B86A110695AE7F310934AF3323D678EB5E2 = KEYS.asc),
rebuilt from the Forgejo Arch registry by signed-repo.yml +
scripts/ci-publish-signed-repo.sh. Verified: db/pkg sigs all GPG-good
against KEYS.asc.
Executes the "After the signed repo exists" plan in docs/signed-repo.md:
- `iso/pacman.conf` + `iso/airootfs/etc/pacman.conf`: section renamed
`[Breadway.os.git.breadway.dev]` → `[breadway]` (matches breadway.db),
`Server = https://dl.breadway.dev/arch/$arch`, `SigLevel = Required`.
The old "Forgejo has no db sigs / KEYS.asc is not a repo key / do NOT
flip" comments are gone — both are now false.
- `iso/airootfs/etc/pacman.d/breadway-repo.asc`: the public key, baked
into the image.
- `build-local.sh`: trust the key in the build host's pacman keyring
before mkarchiso (so pacstrap can verify [breadway] while assembling
the airootfs); drop the now-obsolete Forgejo-registry URL rewrite.
- `iso/airootfs/root/customize_airootfs.sh` (new): trust the key in the
image keyring so the live medium — and, via calamares unpackfs, the
installed target — verify [breadway]. (archiso warns this hook is
deprecated; there is no replacement for "add a repo key to the image
keyring" and BOS ships no pacman-init.service.)
- `calamares/post-install.sh`: `pacman-key --add` + `--lsign-key` the
BOS key in the target chroot as a fallback (unpackfs can skip
/etc/pacman.d/gnupg).
- README.md / DESIGN.md / docs/signed-repo.md updated.
NOT yet done: build the ISO (`sudo ./build-local.sh`) and VM-verify
`pacman -Sy` + a `[breadway]` install with no signature prompt, on both
the live medium and a fresh install. The build-time keyring path
(pacstrap -G vs host keyring vs customize_airootfs) may need a tweak
once the real build runs.
Resolve MAIN_USER after deleting liveuser so Snapper and skel target the
installed account. Wrap bakery update with sudo -n/pkexec for /usr/local.
Pin bakery and bread-theme 0.7.4; require bread-emit and bread-module-host.
Make Calamares internet check non-blocking against breadway.dev. Autostart
breadlock listen. Smoke avahi-daemon.socket to match post-install.
Click-to-install path for machines first-boot already offers. Installs
nvidia + nvidia-utils (never cuda), writes ~/.config/hypr/nvidia.lua,
and hyprland.lua dofiles that file only if it exists. Mesa stays
unchanged. Not on the ISO. Reboot after.
Recovery is reboot → GRUB “snapshots” submenu. snapper rollback
does not change what GRUB boots (rootflags=subvol=@). Same wording
in README Recovery and docs/hardware.md.
Bins live in /usr/local, so a later useradd no longer gets
~/.local/bin copies. systemctl --global enable the bakery
--user units (bake writes /etc/systemd/user/*.wants/, and
post-install + live-setup run the same enable) so first
login starts breadd, breadbox-sync, breadclipd, breadcrumbs,
and breadmill. Stock useradd -m copies skel (Hyprland +
bakery state). Rollback is still grub-btrfs.
BOS opts in to bakery's system prefix so desktop apps live on @
and ride snapper/grub-btrfs snapshots. The builder home stays
~/.local; build-local.sh copies bins, share/data, and user units
onto the image. Per-user installed.json and the index cache stay
in skel. Recovery is still grub-btrfs, not snapper rollback.
Live-ISO bos-rescue finds the installed btrfs @ and ESP, then offers
arch-chroot and/or the same GRUB NVRAM + --removable sequence as
post-install.sh. Recovery is grub-btrfs or this reinstall — GRUB pins
rootflags=subvol=@.
bos-first-boot runs once after the first graphical login: NVIDIA offer
file + notify (no driver install), VM-without-GL notify, HiDPI hint
file (never rewrites monitors.json).
Re-enable the Calamares packages module as a refresh-only step with
skip_if_no_internet and ignore_update_db_error so offline installs
cannot abort on pacman -Sy.
Newer git tags for breadpad, breadmon, breadclip, breadshot,
breadhelp, and breadcrumbs have no artifacts on dl.breadway.dev
because bakery release CI failed. Pin what the signed index
actually serves so the ISO bake can verify sha256.
Point os-release at the bos repo and issues; drop Arch privacy terms.
Take a best-effort snapper pre snapshot before pacman and bakery.
Pin current stable bakery versions so CI fetches the same bits per commit.
Autostart breadpaper/breadshot listen behind command -v.
Document signed-repo setup and Mesa/NVIDIA/grub-btrfs recovery.
Remove Calamares, archiso boot-chain, and memtest/EFI-shell packages
from the installed system (plus orphan sweep). Socket-activate avahi.
Mask the systemd-homed stack so presets cannot re-enable it. Cap
journald at 256 MiB instead of 10% of the @log pool.
List linux-firmware subpackages so nvidia blobs stay off the image.
Drop unused noto-fonts-cjk, base-devel, linux-headers, and zathura
(skel already maps PDF to Zen). Keep webkit2gtk-4.1, breadlock, cage,
and the bakery-vs-pacman comments; rustup was already gone.
systemd-boot can only read the ESP it launched from, so mkarchiso copies
vmlinuz + initramfs into efiboot.img on top of the ISO9660 copy (~244 MiB
duplicate). uefi.grub reads ISO9660 directly; iso/grub configs were already
present and BOS-branded.
The tagged ISO workflow fetched bos-settings/src/Cargo.toml from the
dev branch (404 after the Tauri split) and cargo-built bread-theme.
bread-theme 0.7.1 is already on the stable index. Stage required bins,
units, breadhelp content, and desktop/license files from the
minisign-verified index instead; optional bread-emit/module-host skip
until bread publishes them. Fail the bake if a required bin is missing.
Derive BREAD_BINS from iso/bread-lockfile.toml and fail the bake when a
listed binary or breadhelp content is missing. Bake bakery share files
and drop breadcast from the copied installed.json. Add WebKitGTK 4.1 for
Tauri bos-settings, remove rustup, and rewrite README/DESIGN to match the
ISO+skel tree.
Both now install like every other bread app: staged into skel via
build-local.sh's BREAD_BINS array from this laptop's real bakery
install, with hand-committed .desktop files matching the existing
breadclip/breadman/breadmon/breadsearch pattern. Removes the last two
BOS-specific pacman packages from packages.x86_64.
- release-iso.yml's "Build bread-theme from source" step grepped
bos-settings/Cargo.toml for the bread-theme tag pin, but bos-settings was
split out into its own repo (git.breadway.dev/Breadway/bos-settings) --
that path no longer exists in this checkout, so the grep would fail (or
silently find nothing). Now fetches bos-settings' Cargo.toml directly from
its own repo (dev branch, the one its own CI actually publishes the
bos-settings pacman package from) via the Forgejo raw-file endpoint.
- calamares.yml cloned the repo's default branch instead of the branch/tag
that actually triggered the run -- bibata.yml, powerlevel10k.yml, and
yay-bin.yml (the other in-house-PKGBUILD workflows in this same family)
all correctly clone --branch "${GITHUB_REF_NAME}". Brought calamares.yml
in line with them.
- breadhelp-tour.lua interpolated an untrusted, client-controlled Wayland
window class / layer-shell namespace directly into a bread.exec shell
command string -- a session-level shell injection vector (verified
exploitable with a crafted window class before this fix, e.g.
"evil; touch ~/pwned #"). bread.exec only accepts a single shell string
(always run via `sh -lc`, per breadd/src/lua/mod.rs) -- there's no
array-exec form to bypass the shell with -- so the fix is a proper POSIX
shell_quote() helper wrapping every interpolated value in single quotes
before it reaches bread.exec.
breadhelp's own repo builds cleanly but hasn't been published yet (see
git.breadway.dev/Breadway/breadhelp package.yml — needs REGISTRY_TOKEN
added to that repo's Actions secrets). Re-add once a tag publish
succeeds.
Replaces the old in-window onboarding wizard with a real screen-wide
tour: dim + spotlight cutout around the actual on-screen component
(breadbar, breadbox), floating callout teaching the shortcut, and
event-driven confirmation via real Hyprland/breadd signals instead of
click-through fakery.
The sed matched snapper's default config template text exactly
(ALLOW_USERS=""), so any drift in that template across snapper versions
made it silently no-op -- leaving ALLOW_USERS empty and every non-root
snapper call (including bos-settings' Snapshots page) failing with
"No permissions." forever, with no error surfaced anywhere at install
time. `snapper -c root set-config` is the stable API regardless of
template wording.
bos-settings moves to git.breadway.dev/Breadway/bos-settings (full history
preserved via git-filter-repo) so its release cadence is decoupled from
BOS's own. breadhelp takes its place as this repo's workspace member: a
GTK4 onboarding/help center replacing the old bos-welcome/bos-keybinds
bash scripts with searchable guides, an interactive keybind viewer
(sourced from the new keybinds.toml, not parsed out of hyprland.lua or
hardcoded), a troubleshooting wizard with one-click fixes, and a proper
first-run tour. bos-netcheck extracts bos-welcome's network-check half,
which still needs to run every login independent of breadhelp's own
first-run gating.
hyprland.lua's keybinds/settings/monitors/autostart are now JSON-driven
(binds.json/settings.json/monitors.json/autostart.json) with every
loader pcall-wrapped and falling back to hardcoded defaults per field on
bad or missing config, so bread* apps (bos-settings' new editors, and
breadhelp's keybind viewer) can read/write this config without ever
being able to leave the compositor unable to start.
CI's package.yml now builds breadhelp instead of bos-settings on tag
push; bos-settings needs its own equivalent workflow in its new repo
(not yet set up).
Confirmed on the test laptop's real install: /etc/snapper/configs/ was
completely empty post-install — snapper create-config failed silently and
BOS's advertised snapshot/rollback feature was entirely non-functional,
despite snapper-cleanup.timer being enabled and grub-btrfsd active (both
harmless no-ops with no config to act on).
Root cause is the known chroot-specific busy-mount race already documented
in this section's comments, but the existing recovery (retry umount 5x,
then one lazy-unmount fallback) wasn't sufficient on this hardware — a
lazy unmount detaches the mountpoint from the namespace immediately, but
whatever was holding it busy can take a moment longer to actually release,
and the immediately-following rmdir/create-config both fail if anything
still references /.snapshots at that instant.
Wrap the entire unmount → rmdir → create-config → cleanup → remount
sequence in an outer retry loop (checking whether the config file actually
exists before each attempt and after the loop), add a settle delay after
the lazy-unmount fallback, and turn the final failure into a loud ERROR
instead of a warning that's easy to miss — a system silently shipping
without snapshots is worse than one that's slow to set them up.
Verified against the actual cached mkinitcpio package (41-4), not assumed:
its shipped /etc/mkinitcpio.conf template is
HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole
block filesystems fsck) — there's no "udev" token at all on a stock
install anymore, systemd is the base hook instead.
This silently broke two things:
- The existing plymouth-hook insertion (`sed 's/\budev\b/\0 plymouth/'`)
has been a no-op on every fresh install using a current mkinitcpio
package — the boot splash was never actually getting wired into the
initramfs, just failing quietly (the script's best-effort `|| echo WARN`
pattern doesn't catch a sed that "succeeds" by matching nothing).
- My own new encrypt-hook insertion from the previous commit had the same
flaw, and would have used the wrong hook regardless: `encrypt` is the
udev-based hook, systemd-based initramfs needs `sd-encrypt` instead.
post-install.sh now detects which base hook (systemd or udev) is actually
in HOOKS once, and uses the matching hook name for both plymouth
(unaffected by the choice, just needed the right anchor to insert after)
and LUKS unlocking (encrypt vs sd-encrypt — genuinely different hooks).
Also: avoid a redundant pacman -Sy in release-iso.yml's signing step —
the job already synced repos earlier in the same container.
Continues reducing terminal-reliance for graphical system control. Five
new panels, plus three GUI apps shipped for things better served by an
existing dedicated tool than reimplemented in bos-settings
(gnome-disk-utility, gufw, mission-center).
- Power: battery status/health, brightness, charge-limit thresholds where
the hardware exposes them, TLP profile shown read-only by design (no
Balanced/Performance switcher — TLP auto-selects by power source, and
power-profiles-daemon isn't installed because it conflicts with tlp).
- Firewall: ufw enable/disable, add/remove rules, view active rules.
ufw's own status check requires root (confirmed against the installed
script — not just changes, reads too), so unlike every other panel this
one does NOT query state in build(): every view is constructed eagerly
at app launch, and an unconditional privileged read here would mean a
polkit prompt on every single bos-settings open. Starts blank with a
"Status not loaded" placeholder; state loads only on an explicit Refresh
click, with a guard so refresh's own set_active() doesn't loop back into
triggering ufw enable/disable.
- Users: add/remove accounts, change passwords. All through pkexec on a
background thread. Can't remove the account you're currently running as.
- AUR: search via yay. Installing deliberately opens a terminal instead of
a silent --noconfirm install — yay's interactive PKGBUILD diff review and
sudo prompt are the actual safety mechanism against a malicious AUR
package, not a formality worth automating away.
- Firmware: fwupd device list + updates, same stream-output-then-refresh
pattern as Packages.
packages.x86_64: gnome-disk-utility, gufw, mission-center for disk/firewall/
task-manager GUIs that don't need reinventing inside bos-settings.
yay (yay-bin, AUR-only like calamares/bibata) republished to [breadway] via
the same PKGBUILD + Forgejo workflow pattern, so users can reach the wider
AUR beyond bakery's bread ecosystem.
Disk encryption: Calamares' partition module already has LUKS support
enabled by default, but the checkbox led nowhere — no cryptsetup on the
live/target image, no mkinitcpio encrypt hook, no GRUB cryptodisk wiring.
An encrypted install would partition fine and then never boot. Added
cryptsetup, pinned luksGeneration to luks1 (GRUB doesn't support LUKS2 +
Argon2id), and post-install.sh now detects an encrypted root (lsblk TYPE
== crypt) and conditionally adds the encrypt hook + GRUB_ENABLE_CRYPTODISK +
--modules="cryptodisk luks luks2" on both grub-install passes. No effect on
a normal unencrypted install.
Secure Boot: self-signed via sbctl (shipped in packages.x86_64). BOS can't
ship a Microsoft-signed shim without going through Microsoft's own paid
UEFI CA process, so post-install.sh enrolls BOS's own keys automatically
only when the firmware is already in Setup Mode (sbctl status --json),
signs the kernel/bootloader, and leaves it alone otherwise — sbctl's own
pacman hook re-signs on every future kernel/GRUB update, no further
wiring needed.
Release signing: generated a dedicated Ed25519 "BOS Release Signing" key
(not reused from anything else), stored as the GPG_PRIVATE_KEY Forgejo
Actions secret. release-iso.yml now generates SHA256SUMS and a detached
SHA256SUMS.asc signature alongside every ISO upload; public key committed
at KEYS.asc with verification instructions in the README.
README updated: fixed a stale "greetd + tuigreet" line (breadgreet since
round 3), documented yay/encryption/secure-boot/verification.
Round-3's autostart fix (breadpaper set instead of raw awww img) had a side
effect I missed: breadpaper set always runs real pywal against the wallpaper
image, which overwrote the curated colors.json baked into skel (#0c0c0c
black background, bread-toned browns reserved for accent slots only) with
colors genuinely extracted from bread-background.png — an all-beige photo,
so every bread-theme app (breadbar included) turned brown on first boot.
Revert autostart to plain `awww img`. Bake .cache/wal/wal (pywal's own
"last image" marker — the only thing breadpaper get/the bos-settings panel
actually read) alongside the existing colors.json instead, so the panel
still shows the real default without ever running pywal for real. pywal
only generates a genuine palette once the user picks their own wallpaper.
Snapshots panel was non-functional (wrong snapper flag); breadgreet picked
the wrong session .desktop and skipped bos-session's PATH fixup; Calamares
aborted offline installs over an unnecessary packages module; snapshot
rollback silently no-op'd on BOS's pinned-subvolume layout (now points at
grub-btrfs instead); breadcrumbs was configurable but had no daemon to run
it. Also: SUPER+I double-bind, breadpaper/packages panels blocking the GTK
main thread, dead polkit rule, and a sweep of smaller drift (default
sidebar view, stale wording, missing .desktop launchers, wallpaper daemon
not recording its own default).
Boot-critical (each confirmed with a real boot/install cycle, not just
code review):
- Live ISO's liveuser shell is zsh, but Hyprland autostart was written
to .bash_profile (never runs) — moved to .zprofile, and switched to
start-hyprland (Hyprland's own watchdog wrapper; raw `exec Hyprland`
is no longer the recommended launch method).
- copytoram (self-enables on most real hardware: non-optical boot +
image < 4GiB + enough free RAM) unmounts /run/archiso/bootmnt, which
unpackfs.conf and bos-copy-kernel both hardcoded as their source —
broke the installer outright on real hardware, confirmed by forcing
copytoram=y. Added a resolver step for unpackfs, and switched the
kernel copy to /usr/lib/modules/$(uname -r)/vmlinuz (part of the live
squashfs itself, unaffected by copytoram).
- BIOS installs got no bootloader — post-install.sh only ever ran the
UEFI grub-install path despite BOS shipping bios.syslinux. Added a
BIOS branch with disk auto-detection.
- @snapshots/@log/@cache were never real: iso/partition.conf's
btrfsSubvolumes key isn't part of this Calamares version's partition
module schema at all (same class of bug as the userShell fix below —
silently ignored). Calamares only natively creates @ and @home.
post-install.sh now creates the three subvolumes by hand after
unpackfs, migrates existing /var/log + /var/cache content into them
before mounting over, and adds the fstab entries — verified end to
end on real hardware, including grub-btrfs generating bootable
snapshot menu entries. The unmount step in the existing snapper
create-config dance also gained retry + lazy-unmount fallback after
a real chroot run hit a transient busy-mount race.
- Default shell was bash instead of zsh post-install: users.conf's
top-level `userShell` key isn't part of this Calamares version's
users module schema either — the real key is nested (user.shell).
- graphical-session.target ships RefuseManualStart=yes (systemd
convention), so the earlier attempt to activate it from hyprland.lua
silently failed and breadclipd (WantedBy=graphical-session.target)
never started. Starts breadclipd.service directly instead.
- /etc/os-release was never set (showed "Arch Linux"); live boot never
had quiet/splash/plymouth wired in (raw kernel scroll the whole
time) despite BOS already shipping a complete bread-logo+spinner
plymouth theme for the installed system.
Also: generalized build-local.sh's per-service skel baking (previously
only breadd.service was hand-committed; breadbox-sync/breadmill/
breadclipd never shipped), added the four new bakery packages to
BREAD_BINS, removed the redundant cliphist/fzf clipboard pipeline in
favor of breadclip, mirrored fastfetch's bread-logo config into skel,
and fixed a stale bos-update comment.
- Move assets to assets/ directory (bread_white.svg, icons 256/512/1024px)
- Update Calamares branding + Plymouth theme logos
- Bake breadpaper (wallpaper manager + pywal) into /etc/skel alongside the
rest of the bread ecosystem — previously missing from the ISO build
- Bump bos-settings to 0.4.0
- .gitignore: ignore the /out/ ISO build dir
- bos-settings: use expect() with messages over unwrap() for piped stdio;
drop a stray blank line
- pacman.conf: reword the SigLevel=Never TODO as a future-improvement note
- post-install: ensure the `microcode` initramfs hook (after autodetect) so
installed systems carry CPU ucode — the live ISO embeds it, so nothing is
staged onto the target otherwise. Rebuild all presets with `mkinitcpio -P`.
- post-install: drop the nonexistent `sd-plymouth` hook branch; only the udev
`plymouth` hook exists. Set the theme then rebuild once.
- packages: add zathura + zathura-pdf-mupdf (BOS had no PDF viewer) and
libva-utils (`vainfo`); the Mesa VA-API backend now ships in `mesa` itself.
- bos-welcome: on first run, if NetworkManager isn't fully online, open nmtui
so the user connects before the first bos-update/pacman (avoids confusing DNS
errors on a fresh install). Float the bos-netsetup window like bos-welcome.
Fresh installs couldn't update — the live medium's /etc/pacman.d/gnupg doesn't
reliably carry to the target, so the first `pacman -Syu` failed with "keyring is
not writable / required key missing from keyring". Run pacman-key --init +
--populate archlinux in post-install so signature verification works out of the
box. ([breadway] is SigLevel=Never, so no extra key needed.)
BOS shipped zsh + a p10k skel .zshrc and Calamares' userShell was already
/bin/zsh, but two paths still defaulted to bash:
- /etc/default/useradd had SHELL=/usr/bin/bash, so any plain `useradd` (and
anything not going through Calamares) created bash users.
- bos-live-setup created the live ISO user with -s /bin/bash, so the live
session ran bash instead of the BOS zsh setup.
Ship /etc/default/useradd with SHELL=/usr/bin/zsh and create liveuser with zsh
so the whole distro — live and installed — defaults to zsh.
Best practice for the long-running bread daemon: ship an enabled user unit in
skel (~/.config/systemd/user/breadd.service + default.target.wants symlink)
instead of a bare Hyprland exec-once. Gives crash-restart, journald logging
(journalctl --user -u breadd), and proper lifecycle.
- ExecStart uses %h so it works for any account created from skel (not a
hardcoded home).
- RuntimeDirectoryPreserve=yes so restarting breadd doesn't wipe the shared
theme.css that bread-theme writes into /run/user/<uid>/bread.
- hyprland.lua: replace the `breadd` exec-once with a Wayland-env import
(dbus-update-activation-environment) + `systemctl --user restart breadd`, so
the service — which autostarts at login before Hyprland exists — picks up
HYPRLAND_INSTANCE_SIGNATURE and can drive the compositor.
bos-update: one command that updates both BOS channels — pacman -Syu (snap-pac
snapshotted) and bakery update --all — best-effort so one failing doesn't abort
the other. Baked into the live env and skel.
Shell: match the dev laptop's zsh. Ship Powerlevel10k + zsh-autosuggestions,
zsh-history-substring-search and zsh-syntax-highlighting, sourced from the distro
packages (no oh-my-zsh framework) in the correct order, plus the dev .p10k.zsh.
Powerlevel10k is AUR-only, so it's republished to [breadway] via
packaging/powerlevel10k + a CI workflow (builds libgit2 + gitstatus from source),
same pattern as bibata / zen-browser-bin. skel/.zshrc keeps the BOS QoL aliases
and pywal palette import, with `update` aliased to bos-update.
Loads airootfs.sfs into RAM at boot so the installer reads from memory
instead of a possibly-flaky USB — fixes SquashFS read errors during
unpackfs. Kept as a separate menu entry (not default) since it needs a few
GB of RAM.
A zero-config bread module (auto-discovered) that fires a critical
notification once when the battery runs low and resets on AC. No-op on
desktops. Demonstrates the bread automation layer out of the box.
- Add bread-theme to the binaries baked into /etc/skel from bakery state.
- Run `bread-theme generate` first in the Hyprland autostart so the shared
GUI stylesheet ($XDG_RUNTIME_DIR/bread/theme.css) exists before breadbar /
breadbox / bos-settings paint (they also live-reload it on change).
