omakit 0.5.1 → 0.6.1

package/tools/lab/host.mjs

@@ -0,0 +1,177 @@
+// What the host has and what it lacks, each with its measured reason.
+//
+// Read-only: every probe is a stat, a read of /proc, or a `--version`.
+// Nothing here installs anything (packaging/LAB_PLAN.md: lab-only host
+// capabilities are preflighted and reported, never installed). Measured
+// before this (docs/history/2026-09-18-lab-inventory.md P10, P20): the
+// upstream harness ran `omarchy-pkg-add` for six packages at the top of
+// every invocation, and the old doctor refused on the first missing thing
+// without saying what it cost.
+
+import { accessSync, constants, existsSync, readFileSync, statSync, statfsSync } from "node:fs"
+import { spawnSync } from "node:child_process"
+import { cpus } from "node:os"
+import { dirname } from "node:path"
+import { labPin } from "./pin.mjs"
+
+export const OVMF_CODE = "/usr/share/edk2/x64/OVMF_CODE.4m.fd"
+export const OVMF_VARS_TEMPLATE = "/usr/share/edk2/x64/OVMF_VARS.4m.fd"
+
+/** The commands a run needs, and what each is for. `--version` is the whole question asked of any of them here. */
+export const RUN_COMMANDS = Object.freeze([
+  Object.freeze({ command: "qemu-system-x86_64", package: "qemu-full", why: "boots the guest" }),
+  Object.freeze({ command: "qemu-img", package: "qemu-full", why: "creates the per-run overlay and inspects disks" }),
+  Object.freeze({ command: "ssh", versionArgs: ["-V"], package: "openssh", why: "runs the suite in the guest" }),
+])
+
+/** What base preparation needs beyond a run: the toolchain's console driver reads the installer's screen. */
+export const BUILD_COMMANDS = Object.freeze([
+  Object.freeze({ command: "socat", versionArgs: ["-V"], package: "socat", why: "the toolchain's QMP transport" }),
+  Object.freeze({ command: "magick", package: "imagemagick", why: "the toolchain's screendump conversion" }),
+  Object.freeze({ command: "tesseract", package: "tesseract, tesseract-data-eng", why: "the toolchain reads the installer's screens" }),
+  // `-l -f /dev/null` is a read that fails; a bare `ssh-keygen` starts
+  // generating a key at ~/.ssh/id_ed25519 (measured: it printed
+  // "Generating public/private ed25519 key pair." under this probe). The
+  // probe's output is an error sentence, not a version, so the line says
+  // the command is there and nothing it printed (measured on 2026-09-19:
+  // doctor showed "ok  ssh-keygen  /dev/null is not a public key file.").
+  Object.freeze({ command: "ssh-keygen", versionArgs: ["-l", "-f", "/dev/null"], presenceOnly: true, package: "openssh", why: "the guest's lab key" }),
+  Object.freeze({ command: "python3", package: "python", why: "the toolchain's one-file bootstrap server" }),
+])
+
+/** What acquisition needs: the signature check. */
+export const VERIFY_COMMANDS = Object.freeze([
+  Object.freeze({ command: "gpg", package: "gnupg", why: "verifies the release signature against the packaged key" }),
+])
+
+/**
+ * Whether a command is on PATH, and the first line it prints for its
+ * version. Presence is what matters and is read from the spawn itself: a
+ * command that is there answers, whatever its exit status (`ssh -V` prints
+ * on stderr, `ssh-keygen` has no version flag and prints usage with exit
+ * 1), and one that is not is ENOENT.
+ */
+function versionOf(entry, run = spawnSync, env = process.env) {
+  const result = run(entry.command, [...(entry.versionArgs || ["--version"])], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 4000, env })
+  if (result.error?.code === "ENOENT") return null
+  if (entry.presenceOnly) return `${entry.command} is on PATH (${entry.package})`
+  const line = `${result.stdout || ""}\n${result.stderr || ""}`.split("\n").map((l) => l.trim()).find(Boolean)
+  return line || `${entry.command} is on PATH`
+}
+
+/** One line per command: present with its first version line, or missing with the package that provides it. */
+export function probeCommands(list, { run, env = process.env } = {}) {
+  return list.map((entry) => {
+    const version = versionOf(entry, run, env)
+    return {
+      name: entry.command,
+      state: version ? "ok" : "missing",
+      reason: version ? version : `${entry.command} is not on PATH (${entry.why})`,
+      remedy: version ? null : `sudo pacman -S --needed ${entry.package}`,
+    }
+  })
+}
+
+/**
+ * Where this process runs, when /dev/kvm is not there: a container leaves
+ * marks (`/.dockerenv`, `/run/.containerenv`, a container runtime in
+ * /proc/1/cgroup), and a loaded kvm module without its device node is a
+ * missing node, not a missing kernel feature. Measured on 2026-09-19 by a
+ * first user whose `doctor` said /dev/kvm was absent on the machine whose
+ * lab suites had run hours earlier: the product was run from inside a
+ * sandbox without the device, and the message blamed the kernel and the
+ * firmware (docs/evidence/ux/2026-09-19-first-user-test.json, finding 11).
+ */
+export function kvmContext({ files = { dockerenv: "/.dockerenv", containerenv: "/run/.containerenv", cgroup: "/proc/1/cgroup", module: "/sys/module/kvm" } } = {}) {
+  const marks = []
+  if (existsSync(files.dockerenv)) marks.push(files.dockerenv)
+  if (existsSync(files.containerenv)) marks.push(files.containerenv)
+  try {
+    const cgroup = readFileSync(files.cgroup, "utf8")
+    const runtime = cgroup.match(/docker|lxc|podman|containerd|libpod|machine\.slice|nspawn/)?.[0]
+    if (runtime) marks.push(`${files.cgroup} names ${runtime}`)
+  } catch {
+    // no cgroup file to read: not Linux, or no /proc; nothing to conclude
+  }
+  return { container: marks.length > 0, marks, moduleLoaded: existsSync(files.module) }
+}
+
+/** /dev/kvm: a character device this user can open for reading and writing, which is what QEMU needs from it. */
+export function probeKvm(path = "/dev/kvm", context = kvmContext) {
+  try {
+    const st = statSync(path)
+    if (!st.isCharacterDevice()) return { name: "kvm", state: "missing", reason: `${path} is not a character device`, remedy: "load the kvm module for this CPU (kvm_amd or kvm_intel)" }
+    accessSync(path, constants.R_OK | constants.W_OK)
+    return { name: "kvm", state: "ok", reason: `${path} is a character device this user can open read-write` }
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      const where = context()
+      if (where.container) return { name: "kvm", state: "missing", reason: `${path} is not there in this environment, which is a container (${where.marks.join("; ")}); the host's device is not mapped in, and a lab that ran on the host says nothing about this process`, remedy: "run omakit on the host itself, or start the container with --device /dev/kvm" }
+      if (where.moduleLoaded) return { name: "kvm", state: "missing", reason: `${path} is not there although the kvm module is loaded (/sys/module/kvm exists): the device node is missing, or this process runs in a mount namespace without the host's /dev`, remedy: "check udev for /dev/kvm on the host, or run omakit outside the sandbox" }
+      return { name: "kvm", state: "missing", reason: `${path} is not there and no kvm module is loaded: virtualisation may be off in firmware, or this is a virtual machine without nested virtualisation`, remedy: "enable virtualisation in firmware (kvm_amd or kvm_intel loads on its own); a guest without KVM is not something the lab runs" }
+    }
+    return { name: "kvm", state: "missing", reason: `${path} exists but this user cannot open it (${error.code}): a permission of the device node or a group this login does not carry yet`, remedy: "sudo usermod -aG kvm $USER, then log in again (a new login picks the group up; a new shell does not)" }
+  }
+}
+
+/** The two firmware files QEMU boots the guest with, readable. */
+export function probeOvmf(code = OVMF_CODE, vars = OVMF_VARS_TEMPLATE) {
+  const missing = [code, vars].filter((file) => {
+    try {
+      accessSync(file, constants.R_OK)
+      return false
+    } catch {
+      return true
+    }
+  })
+  if (missing.length) return { name: "ovmf", state: "missing", reason: `${missing.join(" and ")} not readable`, remedy: "sudo pacman -S --needed edk2-ovmf" }
+  return { name: "ovmf", state: "ok", reason: `${code} (${statSync(code).size.toLocaleString("en-US")} B) and the ${statSync(vars).size.toLocaleString("en-US")} B variables template readable` }
+}
+
+/** Free bytes on the filesystem that holds (or would hold) the lab cache, from the nearest existing ancestor. */
+export function freeBytesAt(path) {
+  let probe = path
+  while (!existsSync(probe)) {
+    const parent = dirname(probe)
+    if (parent === probe) break
+    probe = parent
+  }
+  const fs = statfsSync(probe)
+  return { path: probe, bytes: Number(fs.bavail) * Number(fs.bsize) }
+}
+
+/** MemTotal and MemAvailable from /proc/meminfo, in bytes. */
+export function memoryBytes(file = "/proc/meminfo") {
+  const text = readFileSync(file, "utf8")
+  const read = (key) => Number(text.match(new RegExp(`^${key}:\\s+(\\d+) kB`, "m"))?.[1] || 0) * 1024
+  return { total: read("MemTotal"), available: read("MemAvailable") }
+}
+
+/**
+ * The host for a run: KVM, the three commands, the firmware, memory against
+ * the guest's, and the CPU count the guest gets. `--json` carries the same
+ * fields.
+ */
+export function probeRunHost({ pin = labPin(), run, env = process.env } = {}) {
+  const memory = memoryBytes()
+  const guestBytes = pin.guest.memoryMiB * 1024 * 1024
+  const lines = [probeKvm(), ...probeCommands(RUN_COMMANDS, { run, env }), probeOvmf()]
+  lines.push({
+    name: "memory",
+    state: memory.total >= guestBytes * 1.5 ? "ok" : "missing",
+    reason: `${(memory.total / 2 ** 20).toFixed(0)} MiB total, ${(memory.available / 2 ** 20).toFixed(0)} MiB available; the guest takes ${pin.guest.memoryMiB} MiB`,
+    remedy: memory.total >= guestBytes * 1.5 ? null : `the guest needs ${pin.guest.memoryMiB} MiB and the host its own; this host has less than one and a half times that`,
+  })
+  lines.push({ name: "cpus", state: "ok", reason: `${cpus().length} logical CPUs, and the guest gets every one, as the toolchain's -smp $(nproc) gave the reference build (32, M14)` })
+  return lines
+}
+
+/**
+ * The vCPU count a run gives the guest: every logical CPU, which is what
+ * the toolchain's `-smp $(nproc)` gave the reference build (32, packaging/LAB_PLAN.md M4, M14). A
+ * smaller number would be a guess about what a suite needs, and no run
+ * has measured one.
+ */
+export function guestCpus() {
+  return Math.max(1, cpus().length)
+}

package/tools/lab/inspect.mjs

@@ -0,0 +1,240 @@
+// `omakit lab inspect`, and the lab lines of `omakit doctor`: what the pin
+// advertises, what is on disk, whether it was verified, what the host is
+// missing, and what each missing thing costs. Read-only: no directory is
+// created, no file is written, nothing is fetched. `--verify` re-hashes
+// the ISO and re-checks the signature now instead of reporting the record.
+
+import { existsSync, readdirSync, statSync } from "node:fs"
+import { join } from "node:path"
+import { LAB_DIR, bytesBoth, durationWords, labPin } from "./pin.mjs"
+import { allocatedBytes, labLayout, readJson } from "./paths.mjs"
+import { BUILD_COMMANDS, VERIFY_COMMANDS, freeBytesAt, probeCommands, probeRunHost } from "./host.mjs"
+import { judgeRelease, sha256File } from "./verify.mjs"
+import { qmpAlive } from "./qemu.mjs"
+
+/** The names the base directory holds; a manifest names the same. */
+export const BASE_FILES = Object.freeze({
+  disk: "base.qcow2",
+  vars: "firmware-vars.template",
+  key: "id_ed25519",
+  publicKey: "id_ed25519.pub",
+  manifest: "manifest.json",
+})
+
+/** The verified ISO's place under downloads: by digest, so a second release never shares a directory with the first. */
+export function downloadDir(layout, pin = labPin()) {
+  return join(layout.downloads, pin.release.sha256)
+}
+
+/**
+ * The ISO on disk against its verification record. The record is what
+ * `setup` wrote after the digest and the signature passed; the file is
+ * held to the record by size and mtime, which is what can be read in a
+ * millisecond, and `--verify` is the five-second re-hash.
+ */
+export function inspectDownload(layout, pin = labPin(), { verify = false, stagingRoot = layout.staging, onProgress } = {}) {
+  const dir = downloadDir(layout, pin)
+  const iso = join(dir, pin.release.fileName)
+  const out = { dir, iso, present: false, bytes: null, partial: null, record: readJson(join(dir, "verified.json")), verified: false, reason: null, sidecars: { checksum: existsSync(`${iso}.sha256`), signature: existsSync(`${iso}.sig`) } }
+  const part = `${iso}.part`
+  if (existsSync(part)) out.partial = statSync(part).size
+  if (!existsSync(iso)) {
+    out.reason = out.partial !== null ? `not there; a partial download of ${out.partial.toLocaleString("en-US")} of ${pin.release.bytes.toLocaleString("en-US")} B is waiting to resume` : "not there"
+    return out
+  }
+  const st = statSync(iso)
+  out.present = true
+  out.bytes = st.size
+  if (verify) {
+    const judged = judgeRelease({ file: iso, signature: out.sidecars.signature ? `${iso}.sig` : null, checksum: out.sidecars.checksum ? `${iso}.sha256` : null, pin, stagingRoot, onProgress })
+    out.verified = judged.ok
+    out.reason = judged.ok ? `verified now: ${judged.reason}` : `not verified: ${judged.reason}`
+    out.judged = judged
+    return out
+  }
+  if (!out.record) {
+    out.reason = `${st.size.toLocaleString("en-US")} B on disk with no verification record; \`omakit lab setup\` verifies it, or \`omakit lab inspect --verify\` checks it now`
+    return out
+  }
+  const same = out.record.bytes === st.size && out.record.sha256 === pin.release.sha256 && Math.abs(Number(out.record.mtimeMs) - st.mtimeMs) < 1
+  out.verified = same
+  out.reason = same
+    ? `verified ${out.record.verifiedAt}: sha256 ${out.record.sha256}, signed by ${out.record.fingerprint}; the file's size and mtime still match that record`
+    : `the file changed since the record of ${out.record.verifiedAt} (${out.record.bytes === st.size ? "same size, different mtime" : `${st.size.toLocaleString("en-US")} B now, ${Number(out.record.bytes).toLocaleString("en-US")} B then`}); \`omakit lab setup\` verifies it again`
+  return out
+}
+
+/**
+ * The base: missing, ready, mismatch (a base of another release than the
+ * pin), or invalid (files without a complete manifest, or a disk whose
+ * size is not the recorded one). Never booted here. `allocatedBytes` is
+ * `du -B1` over the directory, the figure prune will recover.
+ */
+export function inspectBase(layout, pin = labPin()) {
+  const dir = layout.base
+  const out = { dir, state: "missing", reason: "no base; run `omakit lab setup`", manifest: null, allocatedBytes: 0, disk: join(dir, BASE_FILES.disk) }
+  if (!existsSync(dir)) return out
+  out.allocatedBytes = allocatedBytes(dir)
+  const manifest = readJson(join(dir, BASE_FILES.manifest))
+  const diskThere = existsSync(out.disk)
+  if (!manifest || manifest.state !== "ready" || !manifest.release || !manifest.guest || !manifest.disk) {
+    out.state = "invalid"
+    out.reason = diskThere ? `${BASE_FILES.disk} is there (${bytesBoth(out.allocatedBytes)}) but ${BASE_FILES.manifest} is ${manifest ? "incomplete" : "missing"}; it will not be booted` : `a base directory with no disk and ${manifest ? "an incomplete" : "no"} manifest; \`omakit lab prune\` removes it`
+    return out
+  }
+  out.manifest = manifest
+  if (!diskThere) {
+    out.state = "invalid"
+    out.reason = `the manifest names ${BASE_FILES.disk} and it is not there; it will not be booted`
+    return out
+  }
+  const size = statSync(out.disk).size
+  if (size !== manifest.disk.bytes) {
+    out.state = "invalid"
+    out.reason = `${BASE_FILES.disk} is ${size.toLocaleString("en-US")} B and the manifest recorded ${Number(manifest.disk.bytes).toLocaleString("en-US")} B; it will not be booted`
+    return out
+  }
+  for (const name of [BASE_FILES.vars, BASE_FILES.key]) {
+    if (!existsSync(join(dir, name))) {
+      out.state = "invalid"
+      out.reason = `${name} is missing from the base directory; it will not be booted`
+      return out
+    }
+  }
+  if (manifest.release.sha256 !== pin.release.sha256 || manifest.guest.version !== pin.release.expectedGuestVersion) {
+    out.state = "mismatch"
+    out.reason = `cached Omarchy ${manifest.release.name} (guest ${manifest.guest.version}, iso ${manifest.release.sha256}); required ${pin.release.name} (guest ${pin.release.expectedGuestVersion}, iso ${pin.release.sha256}); \`omakit lab setup\` replaces it`
+    return out
+  }
+  out.state = "ready"
+  out.reason = `Omarchy ${manifest.release.name}, guest omarchy ${manifest.guest.version}; ${bytesBoth(out.allocatedBytes)}; created ${manifest.createdAt}`
+  return out
+}
+
+/**
+ * The toolchain: the omarchy-iso checkout `setup --toolchain` recorded,
+ * whose harness must hash to the pinned patched digest before setup runs
+ * it. What is checked is the file, not git state: a harness that hashes
+ * to the pin is the pinned commit with the patch applied, whatever else
+ * the checkout holds.
+ */
+export function inspectToolchain(layout, pin = labPin()) {
+  const record = readJson(layout.toolchain)
+  const out = { record, dir: record?.dir || null, harness: null, sha256: null, state: "missing", reason: null }
+  if (!record?.dir) {
+    out.reason = "no toolchain recorded; `omakit lab setup --toolchain <omarchy-iso checkout>` records one"
+    return out
+  }
+  out.harness = join(record.dir, pin.toolchain.harness)
+  if (!existsSync(out.harness)) {
+    out.reason = `${out.harness} is not there (the recorded checkout moved or was removed)`
+    return out
+  }
+  out.sha256 = sha256File(out.harness).sha256
+  if (out.sha256 === pin.toolchain.patchedHarnessSha256) {
+    out.state = "ready"
+    out.reason = `${out.harness} hashes to the pinned patched harness (omarchy-iso ${pin.toolchain.commit.slice(0, 12)} with ${pin.toolchain.patch})`
+  } else if (out.sha256 === pin.toolchain.upstreamHarnessSha256) {
+    out.state = "unpatched"
+    out.reason = `${out.harness} is the upstream harness at ${pin.toolchain.commit.slice(0, 12)} without the patch; \`git -C ${record.dir} apply ${join(LAB_DIR, pin.toolchain.patch)}\``
+  } else {
+    out.state = "unknown"
+    out.reason = `${out.harness} hashes to ${out.sha256}, neither the pinned patched harness nor the upstream one at ${pin.toolchain.commit.slice(0, 12)}`
+  }
+  return out
+}
+
+/**
+ * The one command that prepares a toolchain checkout, printed whole so it
+ * can be run as it stands. `dir` is under the resolved lab cache: with
+ * XDG_CACHE_HOME set, the remedy names that root, not ~/.cache (measured
+ * on 2026-09-19 by a first user under XDG_CACHE_HOME=/tmp/empty-cache,
+ * whose `lab inspect` printed clone and setup commands into ~/.cache;
+ * docs/evidence/ux/2026-09-19-first-user-test.json, finding 6).
+ */
+export function toolchainCommand(pin = labPin(), dir = join(labLayout().cache, "toolchain/omarchy-iso")) {
+  return `git clone ${pin.toolchain.repository} ${dir} && git -C ${dir} checkout --detach ${pin.toolchain.commit} && git -C ${dir} apply ${join(LAB_DIR, pin.toolchain.patch)} && omakit lab setup --toolchain ${dir}`
+}
+
+/** Staging directories, each with whether a QEMU still answers on its socket (the cross-namespace liveness question). */
+export async function inspectStaging(layout) {
+  if (!existsSync(layout.staging)) return []
+  const entries = []
+  for (const name of readdirSync(layout.staging).sort()) {
+    const dir = join(layout.staging, name)
+    let st
+    try {
+      st = statSync(dir)
+    } catch {
+      continue
+    }
+    if (!st.isDirectory()) continue
+    const socket = join(dir, "qmp.sock")
+    const alive = existsSync(socket) ? (await qmpAlive(socket)).alive : false
+    entries.push({ name, dir, allocatedBytes: allocatedBytes(dir), alive, socket: existsSync(socket) ? socket : null })
+  }
+  return entries
+}
+
+/** The lock: a directory with a record of the run holding it, and whether that run's QEMU still answers. */
+export async function inspectLock(layout) {
+  const record = readJson(join(layout.lock, "holder.json"))
+  if (!existsSync(layout.lock)) return { held: false, record: null, alive: false }
+  const alive = record?.qmpSocket ? (await qmpAlive(record.qmpSocket)).alive : false
+  let pidAlive = false
+  try {
+    if (record?.pid) {
+      process.kill(record.pid, 0)
+      pidAlive = true
+    }
+  } catch {
+    pidAlive = false
+  }
+  return { held: true, record, alive: alive || pidAlive, qemuAnswers: alive, holderPidAlive: pidAlive }
+}
+
+/**
+ * Everything `inspect` and `doctor` print, as one document. `host` is the
+ * run probes plus what acquisition and a build need; `missing` is the list
+ * of what stands between this host and a run, each with its cost and the
+ * one command.
+ */
+export async function inspectLab({ env = process.env, pin = labPin(), verify = false, onProgress, run } = {}) {
+  const layout = labLayout(env)
+  const download = inspectDownload(layout, pin, { verify, onProgress })
+  const base = inspectBase(layout, pin)
+  const toolchain = inspectToolchain(layout, pin)
+  const staging = await inspectStaging(layout)
+  const lock = await inspectLock(layout)
+  const host = { run: probeRunHost({ pin, run, env }), verify: probeCommands(VERIFY_COMMANDS, { run, env }), build: probeCommands(BUILD_COMMANDS, { run, env }) }
+  const free = freeBytesAt(layout.cache)
+  const runs = existsSync(layout.runs) ? readdirSync(layout.runs).filter((name) => /^\d{8}-\d{6}/.test(name)).sort() : []
+  const totals = {
+    cacheBytes: existsSync(layout.cache) ? allocatedBytes(layout.cache) : 0,
+    downloadsBytes: existsSync(layout.downloads) ? allocatedBytes(layout.downloads) : 0,
+    baseBytes: base.allocatedBytes,
+    stagingBytes: staging.reduce((sum, entry) => sum + entry.allocatedBytes, 0),
+    pluginsBytes: existsSync(layout.plugins) ? allocatedBytes(layout.plugins) : 0,
+    runsBytes: existsSync(layout.runs) ? allocatedBytes(layout.runs) : 0,
+  }
+  const missing = []
+  for (const line of host.run) if (line.state !== "ok") missing.push({ what: line.name, cost: line.reason, command: line.remedy })
+  if (!download.verified) {
+    missing.push({
+      what: "the verified ISO",
+      cost: download.present ? `verification of the ${bytesBoth(download.bytes)} on disk (about ${durationWords(5215 + 9430)} on the reference host: the hash and the signature check)` : `a download of ${bytesBoth(pin.release.bytes)} from ${pin.release.isoUrl}, verified against the pinned sha256 and the Omarchy signature, into ${download.dir}`,
+      command: "omakit lab setup",
+    })
+  }
+  if (toolchain.state !== "ready" && base.state !== "ready") {
+    missing.push({ what: "the toolchain", cost: `a checkout of omarchy-iso at ${pin.toolchain.commit.slice(0, 12)} with ${pin.toolchain.patch} applied; it drives the installer once, to build the base`, command: toolchainCommand(pin, join(layout.cache, "toolchain/omarchy-iso")) })
+  }
+  if (base.state !== "ready") {
+    missing.push({
+      what: base.state === "missing" ? "a prepared base" : `a usable base (the one there is ${base.state})`,
+      cost: `${bytesBoth(pin.measured.baseDirectoryBytes)} on disk, ${durationWords(pin.measured.buildMilliseconds)} to build on the reference host (M14), plus one verification boot`,
+      command: "omakit lab setup",
+    })
+  }
+  return { pin: { release: pin.release, toolchain: pin.toolchain, guest: pin.guest, measured: pin.measured }, layout, download, base, toolchain, staging, lock, host, free, runs, totals, missing }
+}

package/tools/lab/omarchy.gpg

@@ -0,0 +1,13 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEaLAsIhYJKwYBBAHaRw8BAQdAYmKmrWMlfpdIPh3QzvEMzzxdNd/kqDl/Bj8H
+mCavKji0Gk9tYXJjaHkgPHBrZ3NAb21hcmNoeS5vcmc+iJAEExYKADgWIQRA37Yw
+/0K8/7BHBGzwE07mgMrFcQUCaLAsIgIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIX
+gAAKCRDwE07mgMrFcRF2AQCjjvjgju/kowkN69nenqqRnE+v2MrHmWh2wU0ugIt9
+3gD/bXGugWc5J1vqoT+5aCnJAtfRRmHEfsrAiFgjduB+VA24OARosCwiEgorBgEE
+AZdVAQUBAQdAJoU73WdgxE/pEYK5ofyRvQDs1IFRdfJHV9j4Jm+tuDUDAQgHiHgE
+GBYKACAWIQRA37Yw/0K8/7BHBGzwE07mgMrFcQUCaLAsIgIbDAAKCRDwE07mgMrF
+cYXsAQC5eBEGK0xKsGwtnDDVeNAapx32dpvLgJ94W4DtIpdLlwEA85cSsTiBMuGy
+6kwYmHzqw7oFx3VYGXdMNl0SMKzvJA4=
+=G7wU
+-----END PGP PUBLIC KEY BLOCK-----