Addresses the deep codebase audit:
- Center the static wallpaper cover-fit crop so the software (wl_shm)
path agrees with the GPU path and the greeter, instead of anchoring
the crop top-left.
- Desktop-entry Exec tokenizer: respect single quotes and proper
backslash escaping per the freedesktop spec.
- Greeter: dispatch CancelSession whenever the UI resets to the
username stage so the error path can't leave greetd holding a stale
PAM conversation; add a per-roundtrip timeout so a wedged greetd peer
can't strand the "Working" spinner.
- start_locker: return an error instead of spawning a child that
expect()-panics when WAYLAND_DISPLAY is unset.
- Bound in-flight PAM checks with a concurrency cap, since libpam
cannot be cancelled and a stuck module would otherwise leak one
uncancellable thread per retry.
- Expand unit/regression tests (157 total): tokenizer edge cases and a
pseudo-fuzz, blit offset/clamp cases, horizontal+vertical cover
centering, greetd roundtrip-timeout and connection-recovery.
- Reformat the workspace to rustfmt-clean and add a Forgejo CI gate
(fmt --check, clippy -D warnings, all-target tests, locked release
build) — previously the only workflow was an Arch package builder.
README claimed fully software / no EGL; the locker is GLES2 wallpaper
plus software chrome, with opt-in Ken Burns. Building needs git and
pkg-config. PKGBUILD pkgver matches 0.2.0, backs up /etc/pam.d/breadlock,
and notes both dev bins. Release CI runs check() instead of --nocheck.
Pin bread-theme/bread-utils to bread-ecosystem tag v0.7.2.
Subscribe from the locker and from `breadlock listen` so the command
works while unlocked; start breadlock the same way hypridle does.
Emit bread.lock.lock.done / .failed. Document loginctl lock-session
as the Super+L equivalent.
Optional GPG detach-sign of the .pkg.tar.zst when GPG_PRIVATE_KEY is
set; ISO [breadway] stays SigLevel = Never until a signed db exists.
Emit bread.lock.locked when ext-session-lock-v1 is accepted and
bread.lock.unlocked after PAM success. Fail-silent if breadd is down.
No command verbs (no pin/blur stubs). breadgreet is not on the bus.
Note that Forgejo Arch registry packages are unsigned (SigLevel=Never
on BOS) without changing the package.yml registry.
