No description
Find a file
Breadway 394a252f9e Fix audit findings: bakery index signing, artifact checksums, stale theme docs
- Add minisign-based signing/verification for the bakery index:
  scripts/gen-index.sh signs index.json (MINISIGN_SEC_KEY env var, dormant
  no-op with a loud warning until a key is provisioned); bakery/src/manifest.rs
  fetches index.json.minisig and verifies it with minisign-verify against a
  hardcoded PUBKEY before parsing/caching, and re-verifies the cached copy
  on every load (falls back to one re-fetch if the cache predates signing
  or fails verification; a fresh fetch that fails verification is a hard
  error).
- Close the previously-unchecksummed config-example and systemd-unit
  downloads in bakery/src/install.rs (scaffold_config, install_service):
  index.json now carries `sha256`/`example_sha256` for these artifacts
  (computed in gen-index.sh), verified via the same download::verify_sha256
  used for binaries. Downloads without a matching sha256 in the index are
  refused rather than installed unverified.
- scripts/get.sh now verifies the bakery release binary itself against a
  pinned minisign public key before installing it (falls back to the
  existing sha256-only check with a loud warning if no .minisig is
  published yet or minisign isn't installed; a present-but-invalid
  signature is a hard failure).
- Add dormant "sign release binary" steps to the bakery and bread-theme
  release workflows (.github/workflows/release.yml,
  .forgejo/workflows/release-bread-theme.yml), gated on secrets that are
  not yet configured — binaries ship unsigned exactly as before until the
  owner wires up the secret.
- .gitignore: add *.minisign-sec / minisign.key so the signing key can
  never be committed by accident.
- bread-theme: fix stale docs describing a "Catppuccin Mocha fallback"
  (BREAD_DESIGN_SYSTEM.md, README.md, Cargo.toml/bakery.toml/registry
  descriptions) — the actual implementation (palette.rs) uses a fixed BOS
  dark base with only accent colors from pywal.
- bread-theme: fix the legacy css_vars() path, which had its own
  hand-written @define-color block that predated the `accent` and computed
  `on-*` ink colors used by the rest of the stylesheet — any caller whose
  CSS referenced those names against css_vars()'s output would hit
  undefined colors (the illegible-text bug). css_vars() now delegates to
  the same define_colors() the full stylesheet uses, so the two can't
  drift apart again.
2026-07-17 03:37:51 +08:00
.forgejo/workflows Fix audit findings: bakery index signing, artifact checksums, stale theme docs 2026-07-17 03:37:51 +08:00
.github/workflows Fix audit findings: bakery index signing, artifact checksums, stale theme docs 2026-07-17 03:37:51 +08:00
bakery Fix audit findings: bakery index signing, artifact checksums, stale theme docs 2026-07-17 03:37:51 +08:00
bread-theme Fix audit findings: bakery index signing, artifact checksums, stale theme docs 2026-07-17 03:37:51 +08:00
packaging/arch Disable debug package so the main package publishes correctly 2026-06-13 23:00:47 +08:00
registry Fix audit findings: bakery index signing, artifact checksums, stale theme docs 2026-07-17 03:37:51 +08:00
scripts Fix audit findings: bakery index signing, artifact checksums, stale theme docs 2026-07-17 03:37:51 +08:00
.gitignore Fix audit findings: bakery index signing, artifact checksums, stale theme docs 2026-07-17 03:37:51 +08:00
bakery.toml fix: comprehensive bakery package manager audit and repair 2026-06-11 13:37:09 +08:00
BREAD_DESIGN_SYSTEM.md Fix audit findings: bakery index signing, artifact checksums, stale theme docs 2026-07-17 03:37:51 +08:00
Cargo.lock Fix audit findings: bakery index signing, artifact checksums, stale theme docs 2026-07-17 03:37:51 +08:00
Cargo.toml Fix audit findings: bakery index signing, artifact checksums, stale theme docs 2026-07-17 03:37:51 +08:00
README.md Fix audit findings: bakery index signing, artifact checksums, stale theme docs 2026-07-17 03:37:51 +08:00

Bread Ecosystem

A collection of Rust tools for the Linux desktop (Hyprland / Wayland / Arch). Install any product with a single command — no Rust toolchain required.

curl https://breadway.dev/get | sh
bakery install breadbar

Products

Package Description
bread Reactive automation daemon (breadd) + CLI — Lua scripting over Hyprland, udev, power, network, and Bluetooth events
breadbar GTK4 status bar (workspaces, clock, CPU/RAM/battery/WiFi/Bluetooth) and D-Bus notification daemon for Hyprland
breadbox GTK4 fuzzy app launcher for Hyprland with context-aware sorting; ships an icon-sync daemon (breadbox-sync)
breadcrumbs Profile-aware Wi-Fi state machine with Tailscale exit-node management and a self-healing watch daemon
breadpad Quick-capture scratchpad popup with AI-powered note classification, reminders, recurrence, and a full note viewer (breadman)

The ecosystem assumes a Hyprland setup with SUPER as the modifier. The conventional bindings (used by BOS and recommended for any install):

Keys Action
SUPER+Space breadbox — app launcher
SUPER+U breadpad — quick-capture notes/reminders
SUPER+M breadman — note viewer / manager
SUPER+, settings (bos-settings, where installed)

breadbar and breadd are services started at login (exec-once), not bound to keys.

Theming

All GUIs share one look via bread-theme. The bread-theme CLI renders the component stylesheet from your pywal palette, layered on a fixed BOS dark base (background/surface/overlay never come from pywal — only the accent colors do, so a light wallpaper can't wash out the UI), to $XDG_RUNTIME_DIR/bread/theme.css; every app loads that file and live-reloads it, so changing your wallpaper recolours the whole ecosystem with no rebuilds:

wal -i ~/Pictures/wall.png   # regenerate pywal palette
bread-theme generate         # render the shared stylesheet (run from a wal hook)

See BREAD_DESIGN_SYSTEM.md for the tokens (fonts, spacing, radii, colour roles) the stylesheet is built from.

Installing bakery

bakery is the package manager for the ecosystem. Install it with the bootstrap script:

curl https://breadway.dev/get | sh
# or
curl -sSfL https://get.breadway.dev | sh

The script downloads the prebuilt bakery binary to ~/.local/bin/bakery and prints a note if that directory isn't on your PATH yet.

Using bakery

bakery list                    # all available packages
bakery list --installed        # only installed packages
bakery info breadbar           # version, binaries, system deps, services
bakery doctor                  # check system deps for installed packages
bakery doctor breadbar         # check system deps for a specific package

bakery install <pkg>           # install a package
bakery update <pkg>            # update a package
bakery update --all            # update everything
bakery remove <pkg>            # remove a package (data files are never deleted)

bakery install runs doctor first and bails with a clear message if any system dependency is missing. Binaries land in ~/.local/bin (override with BAKERY_BIN_DIR).

System dependencies by product

bakery doctor checks these automatically before any install. Required deps block installation; optional deps generate a warning but never block.

Package Required Optional
bakery (statically linked, none)
bread systemd-libs openssl zlib bluez hyprland
breadbar gtk4 gtk4-layer-shell iw libpulse hyprland
breadbox gtk4 gtk4-layer-shell librsvg hyprland
breadcrumbs networkmanager tailscale sudo xdg-utils
breadpad gtk4 gtk4-layer-shell rocm-hip-runtime ollama hyprland

Install all required deps with sudo pacman -S <packages>. Use pacman -Q <pkg> to check whether any are already present.

Theming

All GUI products (breadbar, breadbox, breadpad) read pywal colors from ~/.cache/wal/colors.json for accents only; background, surface, overlay, and foreground are always BOS's fixed dark values (see BREAD_DESIGN_SYSTEM.md) regardless of what pywal extracted from the wallpaper. When colors.json is absent, accents fall back to BOS's curated bread-toned defaults. Per-app CSS overrides live at ~/.config/<app>/style.css.

The shared theming logic lives in the bread-theme crate in this repo.

Workspace

This repo is a Cargo workspace:

bread-ecosystem/
├── bakery/          # package manager binary
├── bread-theme/     # shared pywal + fixed-dark-base theming crate
├── registry/        # bread-ecosystem.toml — product registry
└── scripts/
    ├── get.sh       # curl | sh bootstrap
    └── gen-index.sh # generates dl.breadway.dev/index.json from release artifacts

Release pipeline

Each product repo (Breadway/bread, Breadway/breadbar, …) has a .github/workflows/release.yml that triggers on v* tags. The workflow runs on a self-hosted runner on hestia, builds a stripped x86_64 binary, deposits it at dl.breadway.dev/<pkg>/<version>/, updates index.json, and mirrors the binary to GitHub Releases as a fallback.

bakery always tries dl.breadway.dev first and transparently falls back to the GitHub Release URL recorded in the manifest.

Release artifact contract

Each product's release.yml must upload the following files alongside the binary to dl.breadway.dev/<name>/<version>/:

File Purpose
bakery.toml Metadata (deps, services, config) read by gen-index.sh
<binary>-x86_64.sha256 Checksum verified by bakery install and get.sh
*.service systemd unit files installed by bakery install
*.example.toml / config.example.toml Example configs copied on first install

gen-index.sh fails loudly if bakery.toml is missing — this is by design to catch omissions in the release workflow before they silently produce empty metadata in production.

License

MIT