From 511d6dcceb16db0ddd0b6caba9f2a1f03bb5fb60 Mon Sep 17 00:00:00 2001
From: Thomas Duckworth <tduck@filotimoproject.org>
Date: Mon, 6 Jul 2026 03:23:18 +0000
Subject: [PATCH] Implement single-prompt auth, POSIX sh compliance

Ensure users are only faced with one polkit prompt when running certain
commands, and ensure they use POSIX sh function syntax, not bash, as the
shebang is for /bin/sh.
---
 mkosi.extra/usr/bin/set-up-systemd-extension | 33 +++++++++++--------
 mkosi.extra/usr/bin/toggle-developer-mode    | 34 ++++++++++++--------
 2 files changed, 40 insertions(+), 27 deletions(-)

diff --git a/mkosi.extra/usr/bin/set-up-systemd-extension b/mkosi.extra/usr/bin/set-up-systemd-extension
index 32c0702..e2ef8f7 100755
--- a/mkosi.extra/usr/bin/set-up-systemd-extension
+++ b/mkosi.extra/usr/bin/set-up-systemd-extension
@@ -8,7 +8,7 @@ set -e
 
 SYSEXT_BASE_LOCATION="${HOME}/kde/usr/"
 SYSEXT_LOCATION="${SYSEXT_BASE_LOCATION}/lib/extension-release.d/"
-SYSEXT_ROOT_LOCATION=/var/lib/extensions/
+SYSEXT_ROOT_LOCATION="/var/lib/extensions/"
 
 echo
 if [ -f "${SYSEXT_LOCATION}/extension-release.kde" ]; then
@@ -18,22 +18,27 @@ else
     echo "Setting up extension at ${SYSEXT_BASE_LOCATION}..."
 
     # Create directory to hold this system extension
-    mkdir -p ${SYSEXT_LOCATION}
-    sudo mkdir -p ${SYSEXT_ROOT_LOCATION}
-    sudo ln -fs "${HOME}/kde" ${SYSEXT_ROOT_LOCATION}
+    mkdir -p "${SYSEXT_LOCATION}"
 
-    # Copy the system os-release file to be an extension-release file that identifies this extension
-    sudo cp /usr/lib/os-release "${SYSEXT_LOCATION}/extension-release.kde"
+    # Heredoc into run0 so we only have one auth prompt.
+    run0 sh <<EOF
+set -e
+mkdir -p "${SYSEXT_ROOT_LOCATION}"
+ln -fs "${HOME}/kde" "${SYSEXT_ROOT_LOCATION}"
 
-    # Set its ID to "_any" so system updates don't break the extension
-    # Skip this step if you want the extension to only work for the current system build
-    sed -i "s/^ID=.*/ID=_any/g" "${SYSEXT_LOCATION}/extension-release.kde"
+# Copy the system os-release file to be an extension-release file that identifies this extension
+cp /usr/lib/os-release "${SYSEXT_LOCATION}/extension-release.kde"
 
-    # Make the release file immutable so it can't be accidentally removed
-    sudo chattr +i "${SYSEXT_LOCATION}/extension-release.kde"
+# Set its ID to "_any" so system updates don't break the extension
+# Skip this step if you want the extension to only work for the current system build
+sed -i "s/^ID=.*/ID=_any/g" "${SYSEXT_LOCATION}/extension-release.kde"
 
-    # Turn it on!
-    sudo systemd-sysext refresh || sudo systemd-sysext merge
+# Make the release file immutable so it can't be accidentally removed
+chattr +i "${SYSEXT_LOCATION}/extension-release.kde"
 
-    echo "Finished setting up extension! When you put files in ${SYSEXT_BASE_LOCATION} and run 'sudo systemd-sysext refresh', they will appear in /usr/. See https://community.kde.org/KDE_Linux/Add_or_override_content_in_/usr for more information."
+# Turn it on!
+systemd-sysext refresh || systemd-sysext merge
+EOF
+
+    echo "Finished setting up extension! When you put files in ${SYSEXT_BASE_LOCATION} and run 'run0 systemd-sysext refresh', they will appear in /usr/. See https://community.kde.org/KDE_Linux/Add_or_override_content_in_/usr for more information."
 fi
diff --git a/mkosi.extra/usr/bin/toggle-developer-mode b/mkosi.extra/usr/bin/toggle-developer-mode
index cc23b3e..c624479 100755
--- a/mkosi.extra/usr/bin/toggle-developer-mode
+++ b/mkosi.extra/usr/bin/toggle-developer-mode
@@ -14,17 +14,21 @@ org.kde.plasma.lookandfeelexplorer.desktop \
 org.kde.plasma.themeexplorer.desktop \
 org.kde.plasmaengineexplorer.desktop"
 
-function enable_dev_apps
+enable_dev_apps()
 {
     echo "Enabling development apps…"
 
-    run0 mkdir -p "$OPT_APPS_LOCATION" 1> /dev/null
+    # Heredoc into run0 so we only have one auth prompt.
+    run0 sh <<EOF
+set -e
+mkdir -p "$OPT_APPS_LOCATION" 1> /dev/null
 
-    for ITEM in $PREINSTALLED_DEV_APPS; do
-        run0 cp "${USR_APPS_LOCATION}${ITEM}" "${OPT_APPS_LOCATION}${ITEM}" 1> /dev/null
-        run0 sed -i "/NoDisplay=true/d" "${OPT_APPS_LOCATION}${ITEM}" 1> /dev/null
-        echo "- Enabled ${ITEM}"
-    done
+for ITEM in $PREINSTALLED_DEV_APPS; do
+    cp "${USR_APPS_LOCATION}\${ITEM}" "${OPT_APPS_LOCATION}\${ITEM}" 1> /dev/null
+    sed -i "/NoDisplay=true/d" "${OPT_APPS_LOCATION}\${ITEM}" 1> /dev/null
+    echo "- Enabled \${ITEM}"
+done
+EOF
 
     echo "Refreshing app cache…"
     kbuildsycoca6
@@ -33,19 +37,23 @@ function enable_dev_apps
     echo "files were installed in ${OPT_APPS_LOCATION}."
 }
 
-function disable_dev_apps
+disable_dev_apps()
 {
     echo "Hiding development apps…"
 
-    for ITEM in $PREINSTALLED_DEV_APPS; do
-        run0 rm "${OPT_APPS_LOCATION}${ITEM}" 1> /dev/null
-    done
+    # Heredoc into run0 so we only have one auth prompt.
+    run0 sh <<EOF
+set -e
+for ITEM in $PREINSTALLED_DEV_APPS; do
+    rm "${OPT_APPS_LOCATION}\${ITEM}" 1> /dev/null
+done
+
+rmdir --ignore-fail-on-non-empty "$OPT_APPS_LOCATION" 1> /dev/null
+EOF
 
     echo "Refreshing app cache…"
     kbuildsycoca6
 
-    run0 rmdir --ignore-fail-on-non-empty "$OPT_APPS_LOCATION" 1> /dev/null
-
     echo "Done; development apps are now hidden."
 }