bcherb2
400bd9b9f1
The previous commit put the bws install on the private/bws-secrets row as a tarball channel. That row can never install anything: selected_packages drops every row flagged `private`, which is the invariant that makes --unattended safe to run. The container proved it — unzip installed, bws did not, and the row still could not deliver on its promise. Nor can it be a safe row: the defaults preset ticks every safe package, so that would put a Bitwarden binary and a 12 MB GitHub download on every throwaway public VM, for a tool those machines have no credential to use. So ensure_bws lives in dotup and is called from cmd_private immediately after the token is written. Nothing installs bws unless something is about to hand it a token, and the manifest keeps its invariant. core/unzip stays a real package with the @needs edge — the release is a .zip and 24.04 minimal has no unzip.
6.5 KiB
6.5 KiB
| 1 | #group | pkg | flag | apt | brew | note |
|---|---|---|---|---|---|---|
| 2 | # | |||||
| 3 | # Five columns, tab separated, greppable by hand. Anything that would have been | |||||
| 4 | # a sixth column is an @ directive instead, so a package with no dependency and | |||||
| 5 | # no install argument -- most of them -- costs nothing to read. | |||||
| 6 | # | |||||
| 7 | # @needs <group/pkg> <dep>... dep is group/pkg or a whole group. | |||||
| 8 | # Closure is transitive in both directions. | |||||
| 9 | # @spec <group/pkg> <arg>... Argument for a channel that cannot be named | |||||
| 10 | # by the package: the npm spec, the flatpak | |||||
| 11 | # app id, the .deb source. Defaults to the | |||||
| 12 | # package name when absent. | |||||
| 13 | # @<group> <note> Group note. Only needed where the members | |||||
| 14 | # fail the safe test for different reasons; | |||||
| 15 | # otherwise the worst child's note is right. | |||||
| 16 | # | |||||
| 17 | # -tarball -npm -script -snap -deb -flatpak -uv -builtin -xcode. | |||||
| 18 | # A bare `-` means unavailable there. Linux falls back to the brew column before | |||||
| 19 | # giving up -- omp, herdr and lazygit have no apt package at all. The fallback is | |||||
| 20 | # one-directional: there is no apt on a Mac, so a `-` in the brew column is the | |||||
| 21 | # end of the road rather than a reason to read a column of Debian package names. | |||||
| 22 | # | |||||
| 23 | @needs | networking/xrdp | desktop | |||
| 24 | @needs | networking/xorgxrdp | desktop | |||
| 25 | @needs | gpu/container-toolkit | docker | |||
| 26 | @needs | agents/codex | core/node | |||
| 27 | @needs | agents/pi | core/node | |||
| 28 | @needs | agents/pi-plugins | core/node | |||
| 29 | @needs | agents/pi-plugins | agents/pi | |||
| 30 | @needs | agents/specify-cli | core/uv | |||
| 31 | @needs | core/mermaid-cli | core/node | |||
| 32 | @needs | core/neovim | core/imagemagick core/mermaid-cli | |||
| 33 | @needs | private/bws-secrets | core/unzip | |||
| 34 | # | |||||
| 35 | # npm names carry scopes that the plugin's short name does not. `npm i -g | |||||
| 36 | # rpiv-btw` installs somebody else's package. | |||||
| 37 | @spec | agents/codex | @openai/codex | |||
| 38 | @spec | agents/pi | @earendil-works/pi-coding-agent | |||
| 39 | @spec | agents/pi-plugins | @juicesharp/rpiv-ask-user-question @juicesharp/rpiv-btw @juicesharp/rpiv-todo @samfp/pi-memory @tmustier/pi-ralph-wiggum pi-markdown-preview pi-powerline-footer pi-simplify pi-subagents pi-web-access | |||
| 40 | @spec | agents/specify-cli | specify-cli | |||
| 41 | @spec | core/mermaid-cli | @mermaid-js/mermaid-cli | |||
| 42 | @spec | core/bitwarden-cli | bw | |||
| 43 | @spec | apps/obsidian | md.obsidian.Obsidian | |||
| 44 | @spec | apps/chrome | https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb | |||
| 45 | @spec | apps/ghostty | gh:mkasberg/ghostty-ubuntu:_amd64.deb | |||
| 46 | core | neovim | safe | -tarball | neovim | apt ships 0.9.5 — tarball to /opt/nvim |
| 47 | core | ripgrep | safe | ripgrep | ripgrep | binary is rg |
| 48 | core | fd | safe | fd-find | fd | binary is fdfind on ubuntu |
| 49 | core | bat | safe | bat | bat | binary is batcat on ubuntu |
| 50 | core | fzf | safe | fzf | fzf | for your shell (ctrl-r); the picker uses its own pinned copy |
| 51 | core | eza | safe | eza | eza | |
| 52 | core | zsh | safe | zsh | -builtin | login shell everywhere |
| 53 | core | tmux | safe | tmux | tmux | |
| 54 | core | git-lfs | safe | git-lfs | git-lfs | |
| 55 | core | lazygit | safe | - | lazygit | no apt package |
| 56 | core | gh | safe | gh | gh | |
| 57 | core | chezmoi | safe | -script | chezmoi | bootstrap cannot come from the manifest |
| 58 | core | go | safe | -tarball | go | /usr/local/go on linux |
| 59 | core | uv | safe | -script | uv | astral installer to ~/.local/bin |
| 60 | core | node | safe | nodejs npm | node | apt's nodejs ships node WITHOUT npm — both names needed |
| 61 | core | imagemagick | safe | imagemagick | imagemagick | required by the nvim markdown render path |
| 62 | core | mermaid-cli | safe | -npm | -npm | mmdc — nvim renders mermaid fences with it |
| 63 | core | btop | safe | btop | btop | |
| 64 | core | htop | safe | htop | htop | |
| 65 | core | ncdu | safe | ncdu | ncdu | |
| 66 | core | unzip | safe | unzip | unzip | the bws release ships as a .zip, and 24.04 minimal has no unzip |
| 67 | core | tree | safe | tree | tree | |
| 68 | core | cmake | safe | cmake | cmake | |
| 69 | core | ninja | safe | ninja-build | ninja | package name differs from binary |
| 70 | core | build-tools | safe | build-essential | -xcode | |
| 71 | core | magic-wormhole | safe | magic-wormhole | magic-wormhole | snap wormhole on dev |
| 72 | core | bitwarden-cli | safe | -snap | bitwarden-cli | snap bw on ubuntu |
| 73 | core | mosh | safe | mosh | mosh | |
| 74 | core | nmap | safe | nmap | nmap | |
| 75 | core | binwalk | safe | binwalk | binwalk | |
| 76 | core | pipx | safe | pipx | pipx | |
| 77 | core | age | safe | age | age | general purpose only now |
| 78 | agents | codex | safe | -npm | -npm | @openai/codex — unpinned, always latest |
| 79 | agents | pi | safe | -npm | -npm | @earendil-works/pi-coding-agent |
| 80 | agents | pi-plugins | safe | -npm | -npm | 10 plugins: rpiv-*, pi-memory, pi-subagents, ... |
| 81 | agents | omp | safe | - | can1357/tap/omp | oh my pi — tap only, pulls linuxbrew on linux |
| 82 | agents | herdr | safe | - | herdr | terminal workspace manager for agents |
| 83 | agents | specify-cli | safe | -uv | -uv | uv tool install |
| 84 | fonts | hack-nerd-font | safe | fonts-powerline | font-hack-nerd-font | |
| 85 | fonts | iosevka-nerd-font | safe | fonts-powerline | font-iosevka-nerd-font | |
| 86 | media | ffmpeg | safe | ffmpeg | ffmpeg | |
| 87 | media | sox | safe | sox | sox | |
| 88 | media | p7zip | safe | p7zip-full | p7zip | |
| 89 | apps | obsidian | gui | -flatpak | obsidian | |
| 90 | apps | ghostty | gui | -deb | ghostty | |
| 91 | apps | chrome | gui | -deb | google-chrome | |
| 92 | apps | firefox | gui | firefox | firefox | |
| 93 | apps | vlc | gui | vlc | vlc | |
| 94 | @networking | daemons, listening ports, and setuid mount helpers | ||||
| 95 | networking | openssh-server | invasive | openssh-server | -builtin | opens port 22 on every network this box can reach |
| 96 | networking | tailscale | invasive | tailscale | tailscale | daemon; joins a private network and rewrites DNS |
| 97 | networking | avahi-daemon | invasive | avahi-daemon | - | daemon; broadcasts this host on the LAN |
| 98 | networking | xrdp | invasive | xrdp | - | opens port 3389 · useless without the desktop group |
| 99 | networking | xorgxrdp | invasive | xorgxrdp | - | xrdp's X backend |
| 100 | networking | nfs-common | invasive | nfs-common | - | setuid mount helper |
| 101 | networking | cifs-utils | invasive | cifs-utils | - | setuid mount helper |
| 102 | networking | davfs2 | invasive | davfs2 | - | setuid mount helper |
| 103 | @docker | daemon; membership in the docker group is root-equivalent | ||||
| 104 | docker | docker-ce | invasive | docker-ce | - | daemon; docker group is root-equivalent |
| 105 | docker | docker-buildx | invasive | docker-buildx-plugin | - | |
| 106 | docker | docker-compose | invasive | docker-compose-plugin | - | |
| 107 | @desktop | changes the display manager — can leave you at a black screen | ||||
| 108 | desktop | xfce4 | invasive | xfce4 | - | changes the display manager |
| 109 | desktop | lightdm | invasive | lightdm | - | CAN LEAVE YOU AT A BLACK SCREEN |
| 110 | @gpu | kernel modules; a bad driver can break boot | ||||
| 111 | gpu | nvidia-driver | invasive | nvidia-driver-570 | - | kernel modules; can break boot |
| 112 | gpu | cuda-toolkit | invasive | nvidia-cuda-toolkit | - | |
| 113 | gpu | container-toolkit | invasive | nvidia-container-toolkit | - | requires docker |
| 114 | @virt | daemon, bridges, and group membership | ||||
| 115 | virt | qemu | invasive | qemu-kvm | - | |
| 116 | virt | libvirt | invasive | libvirt-daemon-system | - | daemon + group membership |
| 117 | virt | virt-manager | invasive | virt-manager | - | |
| 118 | @private | one password, typed after the install finishes | ||||
| 119 | private | private-repo | private | - | - | ~/.local/share/dotfiles-private — agent config, ssh config |
| 120 | private | bws-secrets | private | - | - | bws + 7 API keys into ~/.config/zsh/secrets.zsh; the tier installs bws itself |