Breadway/breadlock
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Honor bread.command.lock.lock; pin theme to v0.7.2

Browse source 
Pin bread-theme/bread-utils to bread-ecosystem tag v0.7.2.
Subscribe from the locker and from `breadlock listen` so the command
works while unlocked; start breadlock the same way hypridle does.
Emit bread.lock.lock.done / .failed. Document loginctl lock-session
as the Super+L equivalent.

Optional GPG detach-sign of the .pkg.tar.zst when GPG_PRIVATE_KEY is
set; ISO [breadway] stays SigLevel = Never until a signed db exists.
This commit is contained in:
Breadway 2026-08-15 22:51:35 +08:00
parent 76544398d3
commit 80caedc7fd
7 changed files with 401 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

16
README.md
View file

@ -12,9 +12,14 @@ Both use [`bread-theme`](https://git.breadway.dev/Breadway/bread-ecosystem) for
## bread event integration
`breadlock` works the same with or without `breadd`. When `breadd` is
running, it publishes `bread.lock.locked` / `bread.lock.unlocked`. See
[EVENTS.md](EVENTS.md) for the bus contract. `breadgreet` is not on the
bus. There is no `bakery.toml` (PAM / pacman exception).
running, it publishes `bread.lock.locked` / `bread.lock.unlocked` and
honors `bread.command.lock.lock` (emits `bread.lock.lock.done` /
`.failed`). Run `breadlock listen` so the command works while unlocked;
the locker also subscribes while the session is locked. Super+L remains
`loginctl lock-session` (hypridle then runs `breadlock`) — that is the
session-level equivalent, not a bus command. See [EVENTS.md](EVENTS.md).
`breadgreet` is not on the bus. There is no `bakery.toml` (PAM / pacman
exception).
## Architecture
@ -76,6 +81,11 @@ command = "cage -s -- breadgreet"
lock_cmd = breadlock
```
`breadlock listen` is the unlocked-path subscriber for
`bread.command.lock.lock`. It is not started by hypridle; add it to
session startup (`exec-once = breadlock listen`) if a Lua workflow
should be able to lock the session while it is unlocked.
## Verification (why this is safe to test without a lockout risk)
1. **PAM logic in isolation first**: `cargo run --bin breadlock-auth-check` exercises the exact PAM flow `breadlock` uses, against a typed password, with **no Wayland surface at all**. A bad `/etc/pam.d/breadlock` just prints an error here — it can never lock a session.