From c67cc3c6f6599ef2324442738cca6248fcd53ae4 Mon Sep 17 00:00:00 2001 From: Breadway Date: Wed, 15 Jul 2026 19:35:23 +0800 Subject: [PATCH 1/4] iso: temporarily drop breadhelp pending [breadway] publish MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit breadhelp's own repo builds cleanly but hasn't been published yet (see git.breadway.dev/Breadway/breadhelp package.yml — needs REGISTRY_TOKEN added to that repo's Actions secrets). Re-add once a tag publish succeeds. --- iso/packages.x86_64 | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iso/packages.x86_64 b/iso/packages.x86_64 index 38b4488..d23c42c 100644 --- a/iso/packages.x86_64 +++ b/iso/packages.x86_64 @@ -189,8 +189,12 @@ yay-bin # # bos-settings and breadhelp are BOS-specific pacman packages (not part of the # bakery index), so they stay here, served from the [breadway] repo. +# breadhelp temporarily commented out: its own repo (git.breadway.dev/ +# Breadway/breadhelp) exists and builds, but hasn't been published to +# [breadway] yet (package.yml's REGISTRY_TOKEN secret still needs to be +# added to that repo). Re-add once a tag publish succeeds. bos-settings -breadhelp +#breadhelp # Input / screen utilities brightnessctl From cd5bf1b5463e9b8d79a4ae5be9bd311542bd8501 Mon Sep 17 00:00:00 2001 From: Breadway Date: Fri, 17 Jul 2026 03:28:48 +0800 Subject: [PATCH 2/4] Fix release CI: stale bread-theme tag path + calamares default-branch clone - release-iso.yml's "Build bread-theme from source" step grepped bos-settings/Cargo.toml for the bread-theme tag pin, but bos-settings was split out into its own repo (git.breadway.dev/Breadway/bos-settings) -- that path no longer exists in this checkout, so the grep would fail (or silently find nothing). Now fetches bos-settings' Cargo.toml directly from its own repo (dev branch, the one its own CI actually publishes the bos-settings pacman package from) via the Forgejo raw-file endpoint. - calamares.yml cloned the repo's default branch instead of the branch/tag that actually triggered the run -- bibata.yml, powerlevel10k.yml, and yay-bin.yml (the other in-house-PKGBUILD workflows in this same family) all correctly clone --branch "${GITHUB_REF_NAME}". Brought calamares.yml in line with them. - breadhelp-tour.lua interpolated an untrusted, client-controlled Wayland window class / layer-shell namespace directly into a bread.exec shell command string -- a session-level shell injection vector (verified exploitable with a crafted window class before this fix, e.g. "evil; touch ~/pwned #"). bread.exec only accepts a single shell string (always run via `sh -lc`, per breadd/src/lua/mod.rs) -- there's no array-exec form to bypass the shell with -- so the fix is a proper POSIX shell_quote() helper wrapping every interpolated value in single quotes before it reaches bread.exec. --- .forgejo/workflows/calamares.yml | 7 ++++++- .forgejo/workflows/release-iso.yml | 14 +++++++++++-- .../.config/bread/modules/breadhelp-tour.lua | 20 ++++++++++++++++--- 3 files changed, 35 insertions(+), 6 deletions(-) diff --git a/.forgejo/workflows/calamares.yml b/.forgejo/workflows/calamares.yml index 80637f9..26b90b0 100644 --- a/.forgejo/workflows/calamares.yml +++ b/.forgejo/workflows/calamares.yml @@ -24,7 +24,12 @@ jobs: kcoreaddons kpmcore libpwquality qt6-declarative qt6-svg yaml-cpp useradd -m builder git config --global --add safe.directory '*' - git clone --depth 1 "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /home/builder/src + # Clone the branch/tag that triggered this run (not the default + # branch) — same as bibata.yml/powerlevel10k.yml/yay-bin.yml, so a + # push to a feature branch (or a release tag) builds and publishes + # from that ref, not whatever happens to be on the default branch. + git clone --depth 1 --branch "${GITHUB_REF_NAME}" \ + "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /home/builder/src chown -R builder:builder /home/builder/src su builder -c "cd /home/builder/src/packaging/calamares && makepkg -f --noconfirm --nocheck" PKG=$(find /home/builder/src/packaging/calamares -name '*.pkg.tar.zst' | head -1) diff --git a/.forgejo/workflows/release-iso.yml b/.forgejo/workflows/release-iso.yml index 27c2a34..862368e 100644 --- a/.forgejo/workflows/release-iso.yml +++ b/.forgejo/workflows/release-iso.yml @@ -111,8 +111,18 @@ jobs: run: | set -euo pipefail # bread-theme is not in the bakery index; build it at the tag pinned - # in bos-settings/Cargo.toml so the CLI matches the library version. - THEME_TAG=$(grep 'bread-theme.*tag' /bos/bos-settings/Cargo.toml \ + # in bos-settings' Cargo.toml so the CLI matches the library version + # the bos-settings package (and breadbar/breadbox/breadpad) were + # built against. bos-settings used to live at bos-settings/Cargo.toml + # inside this repo; it's since been split into its own repo + # (git.breadway.dev/Breadway/bos-settings), so fetch its Cargo.toml + # from there instead of a path that no longer exists in this + # checkout. Uses bos-settings' default branch (dev) — the branch its + # own CI actually publishes the `bos-settings` pacman package from. + REPO_OWNER="${GITHUB_REPOSITORY%%/*}" + curl -fsSL "https://git.breadway.dev/${REPO_OWNER}/bos-settings/raw/branch/dev/Cargo.toml" \ + -o /tmp/bos-settings-Cargo.toml + THEME_TAG=$(grep 'bread-theme.*tag' /tmp/bos-settings-Cargo.toml \ | grep -oP '"v[^"]+"' | tr -d '"') echo "Building bread-theme @ $THEME_TAG" git clone --branch "$THEME_TAG" --depth 1 \ diff --git a/iso/airootfs/etc/skel/.config/bread/modules/breadhelp-tour.lua b/iso/airootfs/etc/skel/.config/bread/modules/breadhelp-tour.lua index 7233064..74a29f3 100644 --- a/iso/airootfs/etc/skel/.config/bread/modules/breadhelp-tour.lua +++ b/iso/airootfs/etc/skel/.config/bread/modules/breadhelp-tour.lua @@ -18,9 +18,23 @@ local M = bread.module({ name = "breadhelp-tour", version = "1.0.0" }) +-- `bread.exec` only takes a single shell command string — it always runs it +-- as `sh -lc ` (see breadd's Lua runtime), there's no array-exec form +-- that bypasses the shell. `event.data.class` (a Wayland window class) and +-- `event.data.data` (a layer-shell namespace) are both arbitrary strings a +-- client fully controls — a window/surface can name itself +-- `x; rm -rf ~ #` and have that land in a real shell command otherwise. +-- POSIX single-quoting neutralizes that: wrap the value in single quotes, +-- and turn any single quote *inside* it into `'\''` (close the quote, an +-- escaped literal quote, reopen the quote) — the one escaping rule `sh` +-- needs to treat the whole thing as inert data, never command syntax. +local function shell_quote(s) + return "'" .. tostring(s):gsub("'", "'\\''") .. "'" +end + function M.on_load() bread.on("bread.window.opened", function(event) - bread.exec("breadhelp --tour-event window:" .. event.data.class) + bread.exec("breadhelp --tour-event " .. shell_quote("window:" .. event.data.class)) end) bread.on("bread.workspace.changed", function(event) @@ -28,11 +42,11 @@ function M.on_load() end) bread.hyprland.on_raw("openlayer", function(event) - bread.exec("breadhelp --tour-event layer:" .. event.data.data) + bread.exec("breadhelp --tour-event " .. shell_quote("layer:" .. event.data.data)) end) bread.hyprland.on_raw("closelayer", function(event) - bread.exec("breadhelp --tour-event layer-closed:" .. event.data.data) + bread.exec("breadhelp --tour-event " .. shell_quote("layer-closed:" .. event.data.data)) end) end From d826fd0576db98d9b4d15e808960649de80c514f Mon Sep 17 00:00:00 2001 From: Breadway Date: Fri, 17 Jul 2026 14:02:40 +0800 Subject: [PATCH 3/4] Remove misplaced bakery.toml (copy-pasted from bos-settings) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit bos is ISO-only (release-iso.yml); it has never been bakery-distributed. This file was a byte-for-byte copy of bos-settings/bakery.toml (name, binaries, description all describe bos-settings, not bos) and isn't referenced by the bread-ecosystem registry or any workflow in this repo. DESIGN.md already documents that bos-settings — not bos — is the one meant to get a bakery.toml and a registry entry. --- bakery.toml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 bakery.toml diff --git a/bakery.toml b/bakery.toml deleted file mode 100644 index 632de76..0000000 --- a/bakery.toml +++ /dev/null @@ -1,12 +0,0 @@ -name = "bos-settings" -description = "System settings app for Bread OS" -binaries = ["bos-settings"] -system_deps = ["gtk4", "glib2"] -optional_system_deps = ["snapper"] -bread_deps = [] - -[config] -dir = "~/.config" - -[install] -post_install = [] From c24202cff1dc3cd7cff5b0d4aba770b8b9c6a1ed Mon Sep 17 00:00:00 2001 From: Breadway Date: Sun, 19 Jul 2026 03:08:24 +0800 Subject: [PATCH 4/4] Add touchpad workspace-swipe gestures, pacman/yay aliases, re-enable breadhelp package, fix identity URLs --- README.md | 2 +- .../etc/calamares/branding/bos/branding.desc | 8 ++++---- .../etc/skel/.config/hypr/scripts/ui/settings.lua | 13 +++++++++++++ iso/airootfs/etc/skel/.zshrc | 8 ++++++++ iso/packages.x86_64 | 6 +----- packaging/arch/README.md | 2 +- packaging/calamares/PKGBUILD | 2 +- 7 files changed, 29 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index 7b1be40..7eb401b 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # BOS — Bread Operating System An Arch-based, Hyprland desktop distribution that ships the [bread -ecosystem](https://github.com/Breadway) preconfigured. One Calamares install +ecosystem](https://git.breadway.dev/Breadway) preconfigured. One Calamares install produces a themed, bootable Wayland desktop — no manual Arch bootstrap, no wiring up dotfiles, no per-tool bakery installs. diff --git a/iso/airootfs/etc/calamares/branding/bos/branding.desc b/iso/airootfs/etc/calamares/branding/bos/branding.desc index 91c929f..4076b93 100644 --- a/iso/airootfs/etc/calamares/branding/bos/branding.desc +++ b/iso/airootfs/etc/calamares/branding/bos/branding.desc @@ -9,10 +9,10 @@ strings: versionedName: "BOS (rolling)" shortVersionedName: "BOS" bootloaderEntryName: "BOS" - productUrl: "https://github.com/Breadway/bos" - supportUrl: "https://github.com/Breadway/bos/issues" - knownIssuesUrl: "https://github.com/Breadway/bos/issues" - releaseNotesUrl: "https://github.com/Breadway/bos/releases" + productUrl: "https://git.breadway.dev/Breadway/bos" + supportUrl: "https://git.breadway.dev/Breadway/bos/issues" + knownIssuesUrl: "https://git.breadway.dev/Breadway/bos/issues" + releaseNotesUrl: "https://git.breadway.dev/Breadway/bos/releases" images: productLogo: "logo.png" diff --git a/iso/airootfs/etc/skel/.config/hypr/scripts/ui/settings.lua b/iso/airootfs/etc/skel/.config/hypr/scripts/ui/settings.lua index 8d3a829..f9cd963 100644 --- a/iso/airootfs/etc/skel/.config/hypr/scripts/ui/settings.lua +++ b/iso/airootfs/etc/skel/.config/hypr/scripts/ui/settings.lua @@ -112,6 +112,19 @@ local function build_hl_config(v) dwindle = { preserve_split = true }, animations = { enabled = true }, misc = { disable_hyprland_logo = true, disable_splash_rendering = true }, + -- 3-finger touchpad swipe switches workspaces (touchscreen/touchpad + -- gesture, native to Hyprland — no plugin needed). + gestures = { + workspace_swipe = true, + workspace_swipe_fingers = 3, + workspace_swipe_distance = 300, + workspace_swipe_invert = true, + workspace_swipe_min_speed_to_force = 30, + workspace_swipe_cancel_ratio = 0.5, + workspace_swipe_create_new = true, + workspace_swipe_direction_lock = true, + workspace_swipe_forever = false, + }, } end diff --git a/iso/airootfs/etc/skel/.zshrc b/iso/airootfs/etc/skel/.zshrc index 8a2a31e..e4f1e69 100644 --- a/iso/airootfs/etc/skel/.zshrc +++ b/iso/airootfs/etc/skel/.zshrc @@ -81,6 +81,14 @@ alias ip='ip --color=auto' alias update='bos-update' alias pacman='sudo pacman' +# Package shortcuts — official repos via pacman, AUR via yay (alt-* prefix). +alias install='sudo pacman -S' +alias uninstall='sudo pacman -R' +alias srchpkg='sudo pacman -Ss' +alias alt-install='yay -S' +alias alt-uninstall='yay -R' +alias alt-srchpkg='yay -Ss' + # ~/.local/bin holds the bread* binaries baked in at build time. export PATH="$HOME/.local/bin:$PATH" diff --git a/iso/packages.x86_64 b/iso/packages.x86_64 index d23c42c..38b4488 100644 --- a/iso/packages.x86_64 +++ b/iso/packages.x86_64 @@ -189,12 +189,8 @@ yay-bin # # bos-settings and breadhelp are BOS-specific pacman packages (not part of the # bakery index), so they stay here, served from the [breadway] repo. -# breadhelp temporarily commented out: its own repo (git.breadway.dev/ -# Breadway/breadhelp) exists and builds, but hasn't been published to -# [breadway] yet (package.yml's REGISTRY_TOKEN secret still needs to be -# added to that repo). Re-add once a tag publish succeeds. bos-settings -#breadhelp +breadhelp # Input / screen utilities brightnessctl diff --git a/packaging/arch/README.md b/packaging/arch/README.md index 3d1d3e7..ccdd544 100644 --- a/packaging/arch/README.md +++ b/packaging/arch/README.md @@ -7,7 +7,7 @@ from this repo. `bos-settings` is also pacman-packaged and served from the same [breadway] repo, but its source lives in its own repo now (`~/Projects/bos-settings`, -`github.com/Breadway/bos-settings`) so a bos-settings release doesn't require +`git.breadway.dev/Breadway/bos-settings`) so a bos-settings release doesn't require a BOS ISO release. Everything else the bread ecosystem ships (breadbar, breadbox, breadpad, ...) diff --git a/packaging/calamares/PKGBUILD b/packaging/calamares/PKGBUILD index 494ae31..7f44bbb 100644 --- a/packaging/calamares/PKGBUILD +++ b/packaging/calamares/PKGBUILD @@ -1,4 +1,4 @@ -# Maintainer: Breadway +# Maintainer: Breadway # In-house copy of the AUR calamares PKGBUILD (Calamares is AUR-only; not in # Arch's official repos). Built by CI and published to the [breadway] repo. # Source of truth: https://aur.archlinux.org/packages/calamares