Files

T

vasilito cb424d7448 build: static patch-sanity linter (shift-left the malformed-patch class)

verify-patch-sanity.py validates every active recipe .patch has internally-
consistent hunk line counts — catching the 'malformed patch at line N' failure
at commit/CI/preflight time instead of hours into a cook. This cycle hit that
class three times (qtwaylandscanner, sddm, xwayland), each only discovered when
cookbook tried to apply the patch.

Running it across the repo found 29 latent malformed patches (validated against
GNU patch: e.g. relibc/P3-sysv-ipc reproduces 'malformed patch at line 22').
They were harmless only because they sit in vendored recipes (baked, not re-
applied) — but would fail on any version-bump re-derivation. --fix recounts the
hunk headers (body untouched) and repaired all 29.

Wired into build-preflight.sh (Phase 1.0D) and redbear-ci.yml, with a unit test
(test-patch-sanity.sh). Skips archived/legacy trees and unvalidatable formats
(empty placeholders, bare-@@ git hunks).

2026-08-01 05:13:02 +03:00

source

mini recipes: fix-forward the eprintln->log/anyhow refactor (9 recipes)

2026-07-28 17:07:35 +09:00

README.md

build: static patch-sanity linter (shift-left the malformed-patch class)

2026-08-01 05:13:02 +03:00

recipe.toml

config + recipes: fix experimental.toml includes + sync 71 versions to 0.3.1

2026-07-27 15:23:26 +09:00

README.md

redbear-authd

Authentication daemon — PAM-like auth with password verification and session launch

Status: FEATURE-INCOMPLETE Category: system Build: cargo build --release --manifest-path source/Cargo.toml

Purpose

redbear-authd is the Red Bear authentication daemon. It listens on a Unix domain socket at /run/redbear-authd.sock and accepts JSON-format authentication requests from redbear-greeterd. It verifies user credentials against /etc/passwd and /etc/shadow, supports SHA-256/SHA-512 crypt and argon2 password hashes, enforces rate-limiting with lockout, and launches desktop sessions via redbear-session-launch. After successful authentication, it publishes session state to redbear-sessiond via the control socket.

Protocol

Transport: JSON over Unix socket at /run/redbear-authd.sock
Message types: Defined by redbear-login-protocol crate

AuthRequest Types

Type	Fields	Description
`authenticate`	`request_id, username, password, vt`	Verify credentials. Rate-limited (5 failures → 30s lockout).
`start_session`	`request_id, username, session, vt`	Launch a desktop session. Requires successful prior authentication within 15s on the same VT.
`power_action`	`request_id, action`	Perform shutdown/reboot.

AuthResponse Types

Type	Fields	Description
`authenticate_result`	`request_id, ok, message`	Auth success/failure with human-readable message
`session_result`	`request_id, ok, exit_code?, message`	Session launch result with optional exit code
`power_result`	`request_id, ok, message`	Power action result
`error`	`message`	Protocol-level error

Architecture

Single-file Rust binary (src/main.rs, ~722 lines). Synchronous I/O with blocking Unix socket operations.

Key types:

Account — username, hashed password (from shadow or passwd), uid, shell
Approval — temporary post-auth approval (15s expiry, VT-scoped)
FailureState — rate-limiting: tracks attempt timestamps within a 60s window; 5 failures triggers 30s lockout
RuntimeState — Arc<Mutex<>> wrappers for approvals and failures

Password verification:

/etc/shadow entries starting with $6$ or $5$ → SHA-512/SHA-256 crypt via sha-crypt crate (MIT licensed)
/etc/shadow entries starting with $argon2 → argon2 verification via rust-argon2 crate
Entries starting with ! or * → locked account (always denied)
Unhashed passwords (plaintext in /etc/passwd) → direct comparison (legacy compatibility)
Accounts with UID != 0 and UID < 1000 are rejected for login

Account format support:

Dual-format parsing: Redox (; delimiter) and Unix (: delimiter) passwd/group/shadow formats
Auto-detection by checking for ; in the first line

Session launch:

Spawns /usr/bin/redbear-session-launch --username <user> --mode session --session kde-wayland --vt <n>
Sends set_session control message to redbear-sessiond with username, uid, vt, leader PID
When session exits, sends reset_session control message
Supports validation mode: when /run/redbear-kde-session.validation-request exists, session exits are non-blocking

Power actions:

Searches for /usr/bin/shutdown, shutdown, or poweroff (in order) for poweroff
Searches for /usr/bin/reboot or reboot (in order) for reboot

Dependencies: redbear-login-protocol (local), rust-argon2, sha-crypt, serde/serde_json.

Consumers

redbear-greeterd — primary client, sends authentication and session-start requests over the Unix socket
redbear-sessiond — receives state updates via control socket (/run/redbear-sessiond-control.sock)

Status Notes

Authentication: Fully implemented with SHA-crypt, argon2, and plaintext support. Rate limiting with 5-attempt/60s window and 30s lockout.
Session management: Launches redbear-session-launch for kde-wayland sessions. Updates sessiond control socket on state transitions.
Power actions: Shutdown and reboot via /usr/bin/shutdown and /usr/bin/reboot (fallback search for bare command names).
Validation mode: /run/redbear-kde-session.validation-request enables non-blocking session exit for test automation.
Missing: No PAM module integration. No GUI authentication prompt — credentials come from the greeter over the Unix socket. No pam-redbear backend integration beyond the socket protocol.

Cross-reference: local/docs/GREETER-LOGIN-IMPLEMENTATION-PLAN.md