glanced 0.3.2__tar.gz → 0.3.4__tar.gz

{glanced-0.3.2/src/glanced.egg-info → glanced-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: glanced
-Version: 0.3.2
+Version: 0.3.4
 Summary: Face unlock for Linux with real liveness detection
 License: MIT
 Requires-Python: >=3.11
@@ -89,10 +89,16 @@ From PyPI. `pipx` keeps the daemon in its own environment and puts
 
 ```bash
 pipx install 'glanced[runtime,gui]'
-glancectl install-service            # ~16MB of models, the user unit, started
+glancectl setup                      # models, service, PAM, lock indicator
 omarchy plugin add https://github.com/ayandexyz/omarchy-glance.git --enable
 ```
 
+Then click the bar icon and **Enroll**, and `omarchy-restart-shell` to load the
+indicator. `setup` asks for your password once and does what `install-service`,
+`setup-pam` and `setup-lock` do separately; run those instead if you want to
+watch each one. Enrolling is not part of it: it needs your face in front of the
+camera and a passphrase you choose.
+
 The `gui` extra is PySide6, for the enrollment window: a camera preview that
 guides the sweep. Leave it out and nothing breaks -- `glancectl status`
 reports the window as unavailable and the plugin's **Enroll** button runs the

{glanced-0.3.2 → glanced-0.3.4}/README.md

@@ -68,10 +68,16 @@ From PyPI. `pipx` keeps the daemon in its own environment and puts
 
 ```bash
 pipx install 'glanced[runtime,gui]'
-glancectl install-service            # ~16MB of models, the user unit, started
+glancectl setup                      # models, service, PAM, lock indicator
 omarchy plugin add https://github.com/ayandexyz/omarchy-glance.git --enable
 ```
 
+Then click the bar icon and **Enroll**, and `omarchy-restart-shell` to load the
+indicator. `setup` asks for your password once and does what `install-service`,
+`setup-pam` and `setup-lock` do separately; run those instead if you want to
+watch each one. Enrolling is not part of it: it needs your face in front of the
+camera and a passphrase you choose.
+
 The `gui` extra is PySide6, for the enrollment window: a camera preview that
 guides the sweep. Leave it out and nothing breaks -- `glancectl status`
 reports the window as unavailable and the plugin's **Enroll** button runs the

{glanced-0.3.2 → glanced-0.3.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "glanced"
-version = "0.3.2"
+version = "0.3.4"
 description = "Face unlock for Linux with real liveness detection"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -33,5 +33,12 @@ glancectl = "glanced.cli:main"
 [tool.setuptools.packages.find]
 where = ["src"]
 
+# The PAM module's source and the lock-screen patch. They are data, not code,
+# but `setup-pam` and `setup-lock` cannot work without them, and a wheel that
+# leaves them out is a face unlock that stops at the lock screen. Kept in step
+# with the canonical top-level copies by tests/test_packaged_data.py.
+[tool.setuptools.package-data]
+glanced = ["_data/pam/*", "_data/lock-faceid/*", "_data/hooks/*"]
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]

glanced-0.3.4/src/glanced/_data/hooks/repair-glance-lock.hook

@@ -0,0 +1,51 @@
+#!/bin/bash
+# Installed by `glancectl setup-lock` via `omarchy hook install post-update`.
+#
+# `omarchy update` overwrites the package-owned lock plugin, and with it the
+# Face ID-style indicator that `patches/omarchy-lock-faceid/apply.sh` put
+# there. This runs at the end of that update, while sudo is still
+# authenticated from its package step, and puts the indicator back.
+#
+# It only executes files from the root-owned copy the glanced package installs
+# under /usr/share/glanced. A warm sudo timestamp must never be spent running
+# whatever is sitting in a user-writable checkout; from a source checkout this
+# hook can only tell you to rerun `glancectl setup-lock` yourself.
+set -u
+
+lock="${OMARCHY_PATH:-/usr/share/omarchy}/shell/plugins/lock/Service.qml"
+[[ -f $lock ]] || lock=/usr/share/omarchy/shell/plugins/lock/Service.qml
+[[ -f $lock ]] || exit 0                       # no lock plugin here; nothing to repair
+
+grep -q 'faceMessagePrefix' "$lock" && exit 0  # still patched
+
+patch_dir=/usr/share/glanced/lock-faceid
+notify() {
+  echo "glanced: $1"
+  command -v notify-send >/dev/null && notify-send -u critical "Glance face unlock" "$1" || true
+}
+
+# Root-owned, not writable by anyone else, on every path component we execute.
+trusted() {
+  local f
+  for f in "$patch_dir" "$patch_dir/apply.sh"; do
+    [[ -e $f ]] || return 1
+    [[ $(stat -c '%u %a' "$f") =~ ^0\ [0-9]?[0-9][0145][0145]$ ]] || return 1
+  done
+}
+
+if ! trusted; then
+  notify "The lock screen indicator was reverted by the update. Run: glancectl setup-lock"
+  exit 0
+fi
+
+if ! sudo -n true 2>/dev/null; then
+  notify "The lock screen indicator was reverted by the update and sudo is not available here. Run: glancectl setup-lock"
+  exit 0
+fi
+
+if sudo -n bash "$patch_dir/apply.sh" >/dev/null; then
+  echo "glanced: lock screen indicator re-applied after update."
+else
+  notify "Re-applying the lock screen indicator failed. Run: glancectl setup-lock"
+fi
+exit 0