bcherb2
400bd9b9f1
The previous commit put the bws install on the private/bws-secrets row as a tarball channel. That row can never install anything: selected_packages drops every row flagged `private`, which is the invariant that makes --unattended safe to run. The container proved it — unzip installed, bws did not, and the row still could not deliver on its promise. Nor can it be a safe row: the defaults preset ticks every safe package, so that would put a Bitwarden binary and a 12 MB GitHub download on every throwaway public VM, for a tool those machines have no credential to use. So ensure_bws lives in dotup and is called from cmd_private immediately after the token is written. Nothing installs bws unless something is about to hand it a token, and the manifest keeps its invariant. core/unzip stays a real package with the @needs edge — the release is a .zip and 24.04 minimal has no unzip.
122 lines
6.5 KiB
Plaintext
122 lines
6.5 KiB
Plaintext
#group pkg flag apt brew note
|
|
#
|
|
# Five columns, tab separated, greppable by hand. Anything that would have been
|
|
# a sixth column is an @ directive instead, so a package with no dependency and
|
|
# no install argument -- most of them -- costs nothing to read.
|
|
#
|
|
# @needs <group/pkg> <dep>... dep is group/pkg or a whole group.
|
|
# Closure is transitive in both directions.
|
|
# @spec <group/pkg> <arg>... Argument for a channel that cannot be named
|
|
# by the package: the npm spec, the flatpak
|
|
# app id, the .deb source. Defaults to the
|
|
# package name when absent.
|
|
# @<group> <note> Group note. Only needed where the members
|
|
# fail the safe test for different reasons;
|
|
# otherwise the worst child's note is right.
|
|
#
|
|
# A leading `-` in the apt or brew column means "not from this package manager":
|
|
# -tarball -npm -script -snap -deb -flatpak -uv -builtin -xcode.
|
|
# A bare `-` means unavailable there. Linux falls back to the brew column before
|
|
# giving up -- omp, herdr and lazygit have no apt package at all. The fallback is
|
|
# one-directional: there is no apt on a Mac, so a `-` in the brew column is the
|
|
# end of the road rather than a reason to read a column of Debian package names.
|
|
#
|
|
@needs networking/xrdp desktop
|
|
@needs networking/xorgxrdp desktop
|
|
@needs gpu/container-toolkit docker
|
|
@needs agents/codex core/node
|
|
@needs agents/pi core/node
|
|
@needs agents/pi-plugins core/node
|
|
@needs agents/pi-plugins agents/pi
|
|
@needs agents/specify-cli core/uv
|
|
@needs core/mermaid-cli core/node
|
|
@needs core/neovim core/imagemagick core/mermaid-cli
|
|
@needs private/bws-secrets core/unzip
|
|
#
|
|
# npm names carry scopes that the plugin's short name does not. `npm i -g
|
|
# rpiv-btw` installs somebody else's package.
|
|
@spec agents/codex @openai/codex
|
|
@spec agents/pi @earendil-works/pi-coding-agent
|
|
@spec agents/pi-plugins @juicesharp/rpiv-ask-user-question @juicesharp/rpiv-btw @juicesharp/rpiv-todo @samfp/pi-memory @tmustier/pi-ralph-wiggum pi-markdown-preview pi-powerline-footer pi-simplify pi-subagents pi-web-access
|
|
@spec agents/specify-cli specify-cli
|
|
@spec core/mermaid-cli @mermaid-js/mermaid-cli
|
|
@spec core/bitwarden-cli bw
|
|
@spec apps/obsidian md.obsidian.Obsidian
|
|
@spec apps/chrome https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
|
|
@spec apps/ghostty gh:mkasberg/ghostty-ubuntu:_amd64.deb
|
|
core neovim safe -tarball neovim apt ships 0.9.5 — tarball to /opt/nvim
|
|
core ripgrep safe ripgrep ripgrep binary is rg
|
|
core fd safe fd-find fd binary is fdfind on ubuntu
|
|
core bat safe bat bat binary is batcat on ubuntu
|
|
core fzf safe fzf fzf for your shell (ctrl-r); the picker uses its own pinned copy
|
|
core eza safe eza eza
|
|
core zsh safe zsh -builtin login shell everywhere
|
|
core tmux safe tmux tmux
|
|
core git-lfs safe git-lfs git-lfs
|
|
core lazygit safe - lazygit no apt package
|
|
core gh safe gh gh
|
|
core chezmoi safe -script chezmoi bootstrap cannot come from the manifest
|
|
core go safe -tarball go /usr/local/go on linux
|
|
core uv safe -script uv astral installer to ~/.local/bin
|
|
core node safe nodejs npm node apt's nodejs ships node WITHOUT npm — both names needed
|
|
core imagemagick safe imagemagick imagemagick required by the nvim markdown render path
|
|
core mermaid-cli safe -npm -npm mmdc — nvim renders mermaid fences with it
|
|
core btop safe btop btop
|
|
core htop safe htop htop
|
|
core ncdu safe ncdu ncdu
|
|
core unzip safe unzip unzip the bws release ships as a .zip, and 24.04 minimal has no unzip
|
|
core tree safe tree tree
|
|
core cmake safe cmake cmake
|
|
core ninja safe ninja-build ninja package name differs from binary
|
|
core build-tools safe build-essential -xcode
|
|
core magic-wormhole safe magic-wormhole magic-wormhole snap wormhole on dev
|
|
core bitwarden-cli safe -snap bitwarden-cli snap bw on ubuntu
|
|
core mosh safe mosh mosh
|
|
core nmap safe nmap nmap
|
|
core binwalk safe binwalk binwalk
|
|
core pipx safe pipx pipx
|
|
core age safe age age general purpose only now
|
|
agents codex safe -npm -npm @openai/codex — unpinned, always latest
|
|
agents pi safe -npm -npm @earendil-works/pi-coding-agent
|
|
agents pi-plugins safe -npm -npm 10 plugins: rpiv-*, pi-memory, pi-subagents, ...
|
|
agents omp safe - can1357/tap/omp oh my pi — tap only, pulls linuxbrew on linux
|
|
agents herdr safe - herdr terminal workspace manager for agents
|
|
agents specify-cli safe -uv -uv uv tool install
|
|
fonts hack-nerd-font safe fonts-powerline font-hack-nerd-font
|
|
fonts iosevka-nerd-font safe fonts-powerline font-iosevka-nerd-font
|
|
media ffmpeg safe ffmpeg ffmpeg
|
|
media sox safe sox sox
|
|
media p7zip safe p7zip-full p7zip
|
|
apps obsidian gui -flatpak obsidian
|
|
apps ghostty gui -deb ghostty
|
|
apps chrome gui -deb google-chrome
|
|
apps firefox gui firefox firefox
|
|
apps vlc gui vlc vlc
|
|
@networking daemons, listening ports, and setuid mount helpers
|
|
networking openssh-server invasive openssh-server -builtin opens port 22 on every network this box can reach
|
|
networking tailscale invasive tailscale tailscale daemon; joins a private network and rewrites DNS
|
|
networking avahi-daemon invasive avahi-daemon - daemon; broadcasts this host on the LAN
|
|
networking xrdp invasive xrdp - opens port 3389 · useless without the desktop group
|
|
networking xorgxrdp invasive xorgxrdp - xrdp's X backend
|
|
networking nfs-common invasive nfs-common - setuid mount helper
|
|
networking cifs-utils invasive cifs-utils - setuid mount helper
|
|
networking davfs2 invasive davfs2 - setuid mount helper
|
|
@docker daemon; membership in the docker group is root-equivalent
|
|
docker docker-ce invasive docker-ce - daemon; docker group is root-equivalent
|
|
docker docker-buildx invasive docker-buildx-plugin -
|
|
docker docker-compose invasive docker-compose-plugin -
|
|
@desktop changes the display manager — can leave you at a black screen
|
|
desktop xfce4 invasive xfce4 - changes the display manager
|
|
desktop lightdm invasive lightdm - CAN LEAVE YOU AT A BLACK SCREEN
|
|
@gpu kernel modules; a bad driver can break boot
|
|
gpu nvidia-driver invasive nvidia-driver-570 - kernel modules; can break boot
|
|
gpu cuda-toolkit invasive nvidia-cuda-toolkit -
|
|
gpu container-toolkit invasive nvidia-container-toolkit - requires docker
|
|
@virt daemon, bridges, and group membership
|
|
virt qemu invasive qemu-kvm -
|
|
virt libvirt invasive libvirt-daemon-system - daemon + group membership
|
|
virt virt-manager invasive virt-manager -
|
|
@private one password, typed after the install finishes
|
|
private private-repo private - - ~/.local/share/dotfiles-private — agent config, ssh config
|
|
private bws-secrets private - - bws + 7 API keys into ~/.config/zsh/secrets.zsh; the tier installs bws itself
|