fix: make an existing classroom converge into the Plasma appliance
A real room upgraded to 0.1.45 and came up as stock Debian Plasma with the old Waybar across the top, mako still catching notifications, and a lock screen on an account that has no password. The cause was one line, and it was in the lab: the harness handed the session under test XDG_CONFIG_DIRS by hand, so every result it had ever produced was a result about a machine somebody had already configured. On a machine SDDM starts the session through PAM, PAM does not read /etc/environment.d, and Debian's own plasma-workspace env.sh then set the variable from scratch — so the classroom's settings directory was not in the cascade at all. No layout, no lock policy, no Kiosk restrictions. The settings now arrive the way Plasma delivers them, through a file in /etc/xdg/plasma-workspace/env. Around that: the look and feel is immutable on its own key so a stale profile cannot answer for it; the palette is composed into the package, because naming a colour scheme does not produce one and the dark bar had been coming from a technician's hand; the desktop reset converges another desktop's appearance state and keeps the room's own; and classroom-migrate stops, deactivates and masks the old shell, including the D-Bus activation that brought mako back while the panel was down — found only by killing the panel on a migrated machine. device.conf loses COMPOSITOR and comes off the hyprland channel, which would otherwise have handed the room the experiment back. The lab stops flattering the package: it restarts the machine, lets SDDM actually autologin, and asks a fresh install and a machine upgraded from the Hyprland package the same sixty questions. Both answer identically, twice, and the panel still comes back from eight SIGKILLs. Co-Authored-By: Claude Opus 5 <[email protected]>
This commit is contained in:
ekklesia
co-authored by
Claude Opus 5
Claude Opus 5
parent
6050144e5d
commit
926668dc9b
@@ -1,7 +1,7 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
# Make the panel come from the package, every time.
|
||||
# Make the desktop come from the package, every time.
|
||||
#
|
||||
# Plasma builds the panel from the classroom's layout script whenever it
|
||||
# starts with no panel configuration, and keeps whatever it built after
|
||||
@@ -17,16 +17,131 @@ set -euo pipefail
|
||||
#
|
||||
# Nothing is lost by this. The panel is immutable to teachers by Kiosk
|
||||
# policy, so there is never anything of theirs in that file.
|
||||
#
|
||||
# This runs before plasmashell, as a user service ordered Before it.
|
||||
|
||||
CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/plasma-org.kde.plasma.desktop-appletsrc"
|
||||
CLASSROOM_XDG=/etc/ekklesia-classroom/xdg
|
||||
CONFIG_HOME="${XDG_CONFIG_HOME:-$HOME/.config}"
|
||||
CACHE_HOME="${XDG_CACHE_HOME:-$HOME/.cache}"
|
||||
|
||||
say() {
|
||||
echo "classroom-desktop-reset: $1"
|
||||
}
|
||||
|
||||
# THE CASCADE.
|
||||
#
|
||||
# Everything below this line is pointless if Plasma is not reading the
|
||||
# classroom's settings directory at all: without it the room gets stock
|
||||
# Plasma, no Kiosk restrictions and a lock screen. The session environment
|
||||
# is set by /etc/xdg/plasma-workspace/env/zz-ekklesia-classroom.sh, which
|
||||
# is the mechanism Plasma itself provides. This is the assertion, not the
|
||||
# mechanism: if the variable arrives here wrong, say so out loud and fix it
|
||||
# for the shell that is about to start rather than build a wrong desktop
|
||||
# quietly.
|
||||
case ":${XDG_CONFIG_DIRS:-}:" in
|
||||
*:"$CLASSROOM_XDG":*)
|
||||
;;
|
||||
*)
|
||||
say "XDG_CONFIG_DIRS did not contain $CLASSROOM_XDG — repairing it"
|
||||
export XDG_CONFIG_DIRS="$CLASSROOM_XDG:${XDG_CONFIG_DIRS:-/etc/xdg}"
|
||||
systemctl --user set-environment \
|
||||
"XDG_CONFIG_DIRS=$XDG_CONFIG_DIRS" 2>/dev/null || true
|
||||
;;
|
||||
esac
|
||||
|
||||
# FOREIGN APPEARANCE STATE.
|
||||
#
|
||||
# A classroom machine that has been through another desktop arrives with a
|
||||
# profile that answers questions the package means to answer. Two places
|
||||
# sit ahead of the classroom's own directory in KConfig's cascade:
|
||||
#
|
||||
# ~/.config/kdedefaults what the last look and feel applied wrote.
|
||||
# Plasma also treats it as the record of which
|
||||
# look and feel is in force: remove it and the
|
||||
# next session applies ours again from scratch,
|
||||
# which resets the palette to the package
|
||||
# default. That is right for a machine arriving
|
||||
# from another desktop and wrong for a room that
|
||||
# chose the light theme, so whose it is decides.
|
||||
#
|
||||
# ~/.config/kdeglobals the user's own file, which beats every system
|
||||
# directory. plasma-apply-colorscheme expands a
|
||||
# whole palette into it, so a light Breeze scheme
|
||||
# from a previous desktop would keep the room
|
||||
# light no matter what the package said.
|
||||
#
|
||||
# The colour scheme is the one piece of appearance a room is allowed to
|
||||
# choose, through classroom-theme, so an Ekklesia scheme is kept and
|
||||
# anything else is removed. This is not a wipe of the home directory: two
|
||||
# named pieces of appearance state, neither of them a teacher's work.
|
||||
|
||||
# The [General] ColorScheme of a KConfig file, or nothing.
|
||||
scheme_of() {
|
||||
awk -F= '
|
||||
/^\[/ { general = ($0 == "[General]"); next }
|
||||
general && $1 == "ColorScheme" { print $2; exit }
|
||||
' "$1" 2>/dev/null || true
|
||||
}
|
||||
|
||||
defaults_are_ours=no
|
||||
|
||||
if [[ -d "$CONFIG_HOME/kdedefaults" ]]; then
|
||||
case "$(scheme_of "$CONFIG_HOME/kdedefaults/kdeglobals")" in
|
||||
Ekklesia*)
|
||||
defaults_are_ours=yes
|
||||
;;
|
||||
*)
|
||||
rm -rf "$CONFIG_HOME/kdedefaults"
|
||||
say "removed another desktop's look and feel defaults"
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
|
||||
if [[ -f "$CONFIG_HOME/kdeglobals" ]]; then
|
||||
scheme=$(scheme_of "$CONFIG_HOME/kdeglobals")
|
||||
|
||||
case "$scheme" in
|
||||
Ekklesia*)
|
||||
say "keeping the room's colour scheme ($scheme)"
|
||||
;;
|
||||
"")
|
||||
# No scheme named. That is what Plasma leaves behind after it
|
||||
# applies a look and feel — it writes a hash instead — so the
|
||||
# palette belongs to whichever look and feel last ran, and the
|
||||
# directory above has just said whose that was.
|
||||
if [[ "$defaults_are_ours" == yes ]]; then
|
||||
say "keeping the palette the classroom's look and feel left"
|
||||
else
|
||||
rm -f "$CONFIG_HOME/kdeglobals"
|
||||
say "removed an unnamed palette from another desktop"
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
rm -f "$CONFIG_HOME/kdeglobals"
|
||||
say "removed a foreign palette ($scheme); the package supplies one"
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
|
||||
# The room's power behaviour is policy, not preference: never sleep, never
|
||||
# dim, never lock. PowerDevil loads an idle action when it finds a group
|
||||
# for it, and the merged view of this file is where such a group could
|
||||
# come from, so the user's copy goes at every login. Nothing of a
|
||||
# teacher's is in it — there is no settings application in this room.
|
||||
if [[ -f "$CONFIG_HOME/powermanagementprofilesrc" ]]; then
|
||||
rm -f "$CONFIG_HOME/powermanagementprofilesrc"
|
||||
say "cleared the user's power settings; the package supplies them"
|
||||
fi
|
||||
|
||||
CONFIG="$CONFIG_HOME/plasma-org.kde.plasma.desktop-appletsrc"
|
||||
|
||||
if [[ -e "$CONFIG" ]]; then
|
||||
rm -f "$CONFIG"
|
||||
echo "classroom-desktop-reset: panel will be rebuilt from the layout"
|
||||
say "panel will be rebuilt from the layout"
|
||||
else
|
||||
echo "classroom-desktop-reset: no panel configuration to clear"
|
||||
say "no panel configuration to clear"
|
||||
fi
|
||||
|
||||
# The icon cache remembers a name it once failed to find, which outlives
|
||||
# the package that later supplies it.
|
||||
rm -f "${XDG_CACHE_HOME:-$HOME/.cache}/icon-cache.kcache" 2>/dev/null || true
|
||||
rm -f "$CACHE_HOME/icon-cache.kcache" 2>/dev/null || true
|
||||
|
||||
Executable
+225
@@ -0,0 +1,225 @@
|
||||
#!/bin/bash
|
||||
set -uo pipefail
|
||||
|
||||
# Turn a machine that was something else into this classroom.
|
||||
#
|
||||
# A room does not arrive new. It arrives as whatever it was before: the
|
||||
# sway classroom, the Hyprland experiment, a machine a technician tried
|
||||
# something on. The package can describe the desktop it wants perfectly
|
||||
# and still lose to one leftover symlink, which is what happened: a real
|
||||
# room upgraded to the Plasma appliance and came up with the old Waybar
|
||||
# across the top, mako still catching notifications, and Plasma's own
|
||||
# stock panel underneath.
|
||||
#
|
||||
# So the installation converges the machine instead of assuming it.
|
||||
# Everything here is something a classroom package created, or state this
|
||||
# package can identify as belonging to a classroom shell it replaces.
|
||||
# Nothing removes a file Debian owns: the old bar and the old notification
|
||||
# daemon stay installed and simply stop being started.
|
||||
#
|
||||
# Idempotent, and safe on a machine that has none of this. Run by hand at
|
||||
# any time:
|
||||
#
|
||||
# sudo classroom-migrate
|
||||
|
||||
CLASSROOM_USER=classroom
|
||||
DEVICE_CONFIG=/etc/ekklesia-classroom/device.conf
|
||||
|
||||
# The shells this appliance replaces. There is exactly one desktop stack
|
||||
# now — SDDM, KWin, plasmashell — and every one of these is a component of
|
||||
# a stack that is gone.
|
||||
LEGACY_UNITS=(waybar.service mako.service swayidle.service swaybg.service)
|
||||
LEGACY_PROCESSES=(waybar mako classroom-dock swaybg swayidle)
|
||||
LEGACY_EXEC_PATTERN='waybar|mako|classroom-dock|classroom-notifications|sway|Hyprland|start-hyprland|classroom-session'
|
||||
|
||||
say() {
|
||||
echo "[classroom-migrate] $1"
|
||||
}
|
||||
|
||||
if [[ "$(id -u)" -ne 0 ]]; then
|
||||
say "must be run as root"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
home=$(getent passwd "$CLASSROOM_USER" | cut -d: -f6)
|
||||
uid=$(id -u "$CLASSROOM_USER" 2>/dev/null || true)
|
||||
|
||||
# ---------------------------------------------------------------- units
|
||||
|
||||
# Stop what is running now. The upgrade happens underneath a live session,
|
||||
# so the old bar is on the screen while this runs.
|
||||
if [[ -n "$uid" && -d "/run/user/$uid" ]]; then
|
||||
for unit in "${LEGACY_UNITS[@]}"; do
|
||||
runuser -u "$CLASSROOM_USER" -- env "XDG_RUNTIME_DIR=/run/user/$uid" \
|
||||
systemctl --user stop "$unit" >/dev/null 2>&1 || true
|
||||
done
|
||||
fi
|
||||
|
||||
for process in "${LEGACY_PROCESSES[@]}"; do
|
||||
if pkill -u "$CLASSROOM_USER" -x "$process" 2>/dev/null; then
|
||||
say "stopped $process"
|
||||
fi
|
||||
done
|
||||
|
||||
# Remove the activation, wherever it was made. `systemctl --global enable`
|
||||
# writes into /etc/systemd/user; a session that set XDG_CONFIG_DIRS gets
|
||||
# /etc/xdg/systemd/user as well; and a unit enabled by hand as the
|
||||
# classroom user lands in the home directory. The real room had it in the
|
||||
# second of those, which is why guessing one location would not have been
|
||||
# enough.
|
||||
wants_roots=(/etc/systemd/user /etc/xdg/systemd/user /run/systemd/user)
|
||||
[[ -n "$home" ]] && wants_roots+=("$home/.config/systemd/user")
|
||||
|
||||
for root in "${wants_roots[@]}"; do
|
||||
[[ -d "$root" ]] || continue
|
||||
|
||||
for unit in "${LEGACY_UNITS[@]}"; do
|
||||
while IFS= read -r link; do
|
||||
rm -f "$link"
|
||||
say "removed activation ${link#/}"
|
||||
done < <(find "$root" -name "$unit" -path '*.wants/*' 2>/dev/null)
|
||||
done
|
||||
done
|
||||
|
||||
# The unit files themselves, where somebody wrote them by hand. Neither
|
||||
# waybar nor mako ships a systemd unit in trixie, so a file by one of
|
||||
# those names belongs to the shell this package replaces — but the rule is
|
||||
# checked rather than assumed: anything a Debian package owns is left
|
||||
# exactly where it is.
|
||||
for root in /etc/systemd/user /etc/xdg/systemd/user "${home:+$home/.config/systemd/user}"; do
|
||||
[[ -n "$root" && -d "$root" ]] || continue
|
||||
|
||||
for unit in "${LEGACY_UNITS[@]}"; do
|
||||
[[ -f "$root/$unit" ]] || continue
|
||||
|
||||
if dpkg -S "$root/$unit" >/dev/null 2>&1; then
|
||||
say "left $root/$unit alone: a Debian package owns it"
|
||||
continue
|
||||
fi
|
||||
|
||||
rm -f "$root/$unit"
|
||||
say "removed the hand-written $root/$unit"
|
||||
done
|
||||
done
|
||||
|
||||
# And then say no once more, at the system level, so that a unit file
|
||||
# reappearing from anywhere cannot start it. A mask is a symlink to
|
||||
# /dev/null in /etc/systemd/user: visible, reversible, and it removes
|
||||
# nothing.
|
||||
systemctl --global mask "${LEGACY_UNITS[@]}" >/dev/null 2>&1 || true
|
||||
|
||||
# And the other way the old notification daemon starts: D-Bus activation.
|
||||
# The package shadows mako's service file so that activation fails, but a
|
||||
# session bus that is already running read its service directories at
|
||||
# startup and has not seen it. Measured during crash recovery on a
|
||||
# migrated machine: the panel was killed, a notification was sent while
|
||||
# nothing owned the name, and mako took it.
|
||||
if [[ -n "$uid" && -S "/run/user/$uid/bus" ]]; then
|
||||
runuser -u "$CLASSROOM_USER" -- env \
|
||||
"XDG_RUNTIME_DIR=/run/user/$uid" \
|
||||
"DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$uid/bus" \
|
||||
dbus-send --session --dest=org.freedesktop.DBus --type=method_call \
|
||||
/org/freedesktop/DBus org.freedesktop.DBus.ReloadConfig \
|
||||
>/dev/null 2>&1 || true
|
||||
fi
|
||||
|
||||
# ------------------------------------------------------------- autostart
|
||||
|
||||
# XDG autostart entries that start a component of the old shell. Matched on
|
||||
# what they run, not on their filename, and only in the classroom's own
|
||||
# directory.
|
||||
if [[ -n "$home" && -d "$home/.config/autostart" ]]; then
|
||||
for entry in "$home/.config/autostart"/*.desktop; do
|
||||
[[ -e "$entry" ]] || continue
|
||||
|
||||
if grep -qE "^Exec=.*($LEGACY_EXEC_PATTERN)" "$entry" 2>/dev/null; then
|
||||
rm -f "$entry"
|
||||
say "removed autostart entry $(basename "$entry")"
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
# ------------------------------------------------------------ tty1 login
|
||||
|
||||
# The sway classroom started its session from the login shell of an
|
||||
# autologin getty. SDDM owns the session now, and two things owning tty1
|
||||
# is how a machine ends up with no usable screen at all.
|
||||
if [[ -n "$home" && -f "$home/.bash_profile" ]]; then
|
||||
if grep -qE "exec .*($LEGACY_EXEC_PATTERN)" "$home/.bash_profile" 2>/dev/null; then
|
||||
rm -f "$home/.bash_profile"
|
||||
say "removed the login shell that used to start the old session"
|
||||
fi
|
||||
fi
|
||||
|
||||
rm -f /etc/systemd/system/[email protected]/autologin.conf
|
||||
rmdir --ignore-fail-on-non-empty \
|
||||
/etc/systemd/system/[email protected] 2>/dev/null || true
|
||||
|
||||
# --------------------------------------------------------- device.conf
|
||||
|
||||
# The room's own settings file outlives every version of this package, so
|
||||
# it is edited rather than replaced: the broker password is in it.
|
||||
#
|
||||
# COMPOSITOR chose between sway and Hyprland. There is nothing left for it
|
||||
# to choose, and a stale value is worse than none — it is an instruction
|
||||
# this package cannot carry out.
|
||||
#
|
||||
# CHANNEL decides which manifest the updater fetches. A machine left on the
|
||||
# hyprland channel would be handed the Hyprland experiment again by the
|
||||
# next release published there, undoing the upgrade it just took.
|
||||
if [[ -f "$DEVICE_CONFIG" ]]; then
|
||||
python3 - "$DEVICE_CONFIG" <<'PY'
|
||||
import re
|
||||
import sys
|
||||
|
||||
OBSOLETE_KEYS = ("COMPOSITOR", "HYPR_APPEARANCE")
|
||||
# Channels that served a desktop this package replaces.
|
||||
OBSOLETE_CHANNELS = {"hyprland"}
|
||||
CHANNEL = "classroom-v2"
|
||||
|
||||
path = sys.argv[1]
|
||||
|
||||
with open(path, "r", encoding="utf-8") as handle:
|
||||
lines = handle.readlines()
|
||||
|
||||
out = []
|
||||
changed = []
|
||||
|
||||
for line in lines:
|
||||
key = line.split("=", 1)[0].strip() if "=" in line else ""
|
||||
|
||||
if key in OBSOLETE_KEYS:
|
||||
changed.append(f"dropped {key}")
|
||||
continue
|
||||
|
||||
if key == "CHANNEL":
|
||||
value = line.split("=", 1)[1].strip()
|
||||
|
||||
if value.lower() in OBSOLETE_CHANNELS:
|
||||
changed.append(f"moved off the {value} channel onto {CHANNEL}")
|
||||
line = f"CHANNEL={CHANNEL}\n"
|
||||
|
||||
out.append(line)
|
||||
|
||||
if changed:
|
||||
with open(path, "w", encoding="utf-8") as handle:
|
||||
handle.writelines(out)
|
||||
|
||||
for note in changed:
|
||||
print(f"[classroom-migrate] device.conf: {note}")
|
||||
PY
|
||||
fi
|
||||
|
||||
# ------------------------------------------------------- the old session
|
||||
|
||||
# Plasma reads the classroom's settings out of a directory that has to be
|
||||
# in XDG_CONFIG_DIRS, and the environment.d file that used to put it there
|
||||
# never reached a session started by SDDM. The session script that does is
|
||||
# installed by the package; this only checks it arrived, because a room
|
||||
# without it is a room with no lockdown and no panel of ours.
|
||||
if [[ ! -r /etc/xdg/plasma-workspace/env/zz-ekklesia-classroom.sh ]]; then
|
||||
say "WARNING: the session environment script is missing;"
|
||||
say " the desktop will come up as stock Plasma"
|
||||
fi
|
||||
|
||||
say "done"
|
||||
Reference in New Issue
Block a user