cmd/app: optional insecure options

These are useful for very specific cases by the maintainer. No app should ever require this.

Signed-off-by: Ophestra <cat@gensokyo.uk>

cmd/app/app.go

@@ -207,6 +207,17 @@ func parse(
 			c.SchedPriority = ext.Int(v)
 			continue
 
+		case "insecure":
+			switch value {
+			case "pipewire":
+				*c.Enablements |= hst.EPipeWire
+				c.DirectPipeWire = true
+				continue
+
+			default:
+				return nil, fmt.Errorf("invalid insecure flag %q", value)
+			}
+
 		case "env":
 			if key, value, ok = strings.Cut(value, "="); !ok {
 				return nil, fmt.Errorf("invalid environment %q", key)
@@ -309,7 +320,10 @@ func parse(
 		c.SystemBus = nil
 	}
 
-	if c.Container.Flags&hst.FShareTmpdir == 0 {
+	if c.Container.Flags&hst.FShareTmpdir == 0 &&
+		(c.Enablements.Unwrap()&hst.EX11 == 0 ||
+			c.Container.Flags&(hst.FHostNet|hst.FHostAbstract) ==
+				hst.FHostNet|hst.FHostAbstract) {
 		c.Container.Filesystem = append(c.Container.Filesystem,
 			hst.FilesystemConfigJSON{FilesystemConfig: &hst.FSEphemeral{
 				Target: fhs.AbsTmp,

cmd/app/main.go

@@ -33,8 +33,9 @@ func main() {
 	defer stop()
 
 	var (
-		flagVerbose bool
-		flagBase    string
+		flagVerbose  bool
+		flagBase     string
+		flagInsecure bool
 
 		base, template, initial *check.Absolute
 	)
@@ -61,6 +62,10 @@ func main() {
 		&flagBase,
 		"d", command.StringFlag("$ROSA_APP_PATH"),
 		"Configuration and state directory",
+	).Flag(
+		&flagInsecure,
+		"insecure", command.BoolFlag(false),
+		"Allow use of insecure compatibility options",
 	)
 
 	{
@@ -132,7 +137,7 @@ func main() {
 				if err != nil {
 					return err
 				}
-				err = run(ctx, msg, &config)
+				err = run(ctx, msg, false, &config)
 				return errors.Join(err, remove())
 			},
 		).Flag(
@@ -206,7 +211,7 @@ func main() {
 				if err = enterTemplate(base, name); err != nil {
 					return err
 				}
-				return run(ctx, msg, config, args[1:]...)
+				return run(ctx, msg, flagInsecure, config, args[1:]...)
 			},
 		).
 			Flag(

cmd/app/run.go

@@ -15,6 +15,7 @@ import (
 func run(
 	ctx context.Context,
 	msg message.Msg,
+	insecure bool,
 	config *hst.Config,
 	args ...string,
 ) error {
@@ -29,6 +30,9 @@ func run(
 	if msg.IsVerbose() {
 		cmd.Args = append(cmd.Args, "-v")
 	}
+	if insecure {
+		cmd.Args = append(cmd.Args, "--insecure")
+	}
 	cmd.Args = append(cmd.Args, "run", "3")
 	cmd.Args = append(cmd.Args, args...)
 

internal/rosa/package/curl.az

@@ -3,10 +3,10 @@ package curl {
 	website = "https://curl.se";
 	anitya = 381;
 
-	version# = "8.20.0";
+	version# = "8.21.0";
 	source = remoteTar {
 		url = "https://curl.se/download/curl-"+version+".tar.bz2";
-		checksum = "xyHXwrngIRGMasuzhn-I5MSCOhktwINbsWt1f_LuR-5jRVvyx_g6U1EQfDLEbr9r";
+		checksum = "lJSm8bVjS0OmsarEdbvejdQdvXsb7yGarlr6oMtA9FW1EXOga8zZxa1LPtfaq_qX";
 		compress = bzip2;
 	};
 

internal/rosa/package/glib/package.az

@@ -3,11 +3,11 @@ package glib {
 	website = "https://developer.gnome.org/glib";
 	anitya = 10024;
 
-	version# = "2.89.0";
+	version# = "2.89.1";
 	source = remoteGit {
 		url = "https://gitlab.gnome.org/GNOME/glib.git";
 		tag = version;
-		checksum = "4FXKhdS3pC98LevYa_h7piRylG86cZ_c9zAtGr78oHodU1ob8rBxGU0hoIZ4nzcA";
+		checksum = "9_6Eew2KIwa1AHopjU7CqC13_nur5FPJMu-iGUd7sD_1gAM1pa_HVUuAtqExJoYU";
 	};
 
 	files = {

internal/rosa/package/hakurei/package.az

@@ -2,11 +2,11 @@ package hakurei-source {
 	description = "hakurei source tree";
 	exclude = true;
 
-	version# = "0.4.4";
+	version# = "0.4.5";
 	output = remoteTar {
 		url = "https://git.gensokyo.uk/rosa/hakurei/archive/"+
 			"v"+version+".tar.gz";
-		checksum = "BCIKpRiVv2tDg8lyX1bG_VgTBBMFCByv726x6DfJ0LiRg5ma4T5fcxYUaQl8JMVB";
+		checksum = "5bvbuIRcDIrtijogwqXn3y8h5f3rVS4ZSVhOig6Galfzt3g-O3Ufb-tHL1kQCQWK";
 		compress = gzip;
 	};
 }

internal/rosa/package/libexpat.az

@@ -3,7 +3,7 @@ package libexpat {
 	website = "https://libexpat.github.io";
 	anitya = 770;
 
-	version# = "2.8.1";
+	version# = "2.8.2";
 	source = remoteGitHubRelease {
 		suffix = "libexpat/libexpat";
 		tag = "R_"+replace {
@@ -12,7 +12,7 @@ package libexpat {
 			new = "_";
 		};
 		name = "expat-"+version+".tar.bz2";
-		checksum = "iMEtbOJhQfGof2GxSlxffQSI1va_NDDQ9VIuqcPbNZ0291Dr8wttD5QecYyjIQap";
+		checksum = "98Pdyj5QtO7QRtNFXTWsCNCixQDx701ZGql2B-JIrTDkw49J5WXXUwnS4AdMlM4L";
 		compress = bzip2;
 	};
 

internal/rosa/package/libpsl.az

@@ -3,12 +3,12 @@ package libpsl {
 	website = "https://rockdaboot.github.io/libpsl";
 	anitya = 7305;
 
-	version# = "0.21.5";
+	version# = "0.22.0";
 	source = remoteGitHubRelease {
 		suffix = "rockdaboot/libpsl";
 		tag = version;
 		name = "libpsl-"+version+".tar.gz";
-		checksum = "XjfxSzh7peG2Vg4vJlL8z4JZJLcXqbuP6pLWkrGCmRxlnYUFTKNBqWGHCxEOlCad";
+		checksum = "sYrq75kNAJvU5gA2gv2tFYIFbFFit6PuYuW1tYSgcsJsIUzwMJTodofsaEGq3iGf";
 		compress = gzip;
 	};
 
@@ -21,5 +21,8 @@ test_disable 'int main(){return 0;}' tests/test-is-public-builtin.c
 
 	exec = make {};
 
-	inputs = [ python ];
+	inputs = [
+		pkg-config,
+		python,
+	];
 }

internal/rosa/package/noto.az

@@ -0,0 +1,32 @@
+package noto {
+	description = "a typeface for the world";
+	website = "https://fonts.google.com/noto";
+	anitya = 10671;
+
+	version# = "2026.06.01";
+	source = remoteGitHub {
+		suffix = "notofonts/notofonts.github.io";
+		tag = "noto-monthly-release-"+version;
+		checksum = "QpCYYssOY-OIFKn0_K_7JG7Ij2VDbIkccWrWTC4db1ZPPE1yZnLrf7Kja-IuB4XS";
+	};
+
+	enterSource = true;
+	exec = generic {
+		inPlace = true;
+		install = `
+DEST=/work/system/share/fonts/noto
+for font in $(ls -d fonts/*/); do
+	if [[ -d "$font"unhinted/variable-ttf ]]; then
+		install -m444 -vDt "$DEST" "$font"unhinted/variable-ttf/*.ttf
+	elif [[ -d "$font"unhinted/otf ]]; then
+		install -m444 -vDt "$DEST" "$font"unhinted/otf/*.otf
+	else
+		install -m444 -vDt "$DEST" "$font"unhinted/ttf/*.ttf
+	fi
+done
+rename -v 's/\[.*\]//' $DEST/*
+`;
+	};
+
+	inputs = [ rename ];
+}

internal/rosa/package/python/package.az

@@ -124,11 +124,11 @@ package python-vcs-versioning {
 	website = "https://setuptools-scm.readthedocs.io/en/latest";
 	anitya = 389421;
 
-	version# = "2.1.1";
+	version# = "2.2.0";
 	source = remoteGitHub {
 		suffix = "pypa/setuptools-scm";
 		tag = "vcs-versioning-v"+version;
-		checksum = "9QRY65iBhyohRC0xPJeq4KUalL-a7p3qTPeD7Y7l6O4qMfvq0psg0X-bb4WPqdGW";
+		checksum = "SxG7WjLdbeqhQ8ikXCPS6VHGSGNk4GV-8Gz9MaKhuI4B539AWHq-jd4MlJnVjV6_";
 	};
 
 	env = [
@@ -158,11 +158,11 @@ package python-setuptools-scm {
 	website = "https://setuptools-scm.readthedocs.io/en/latest";
 	anitya = 7874;
 
-	version# = "10.1.2";
+	version# = "10.2.0";
 	source = remoteGitHub {
 		suffix = "pypa/setuptools-scm";
 		tag = "setuptools-scm-v"+version;
-		checksum = "pu9_XHYONnvziRwJ-Q44yjmCI0inPSCs0SvyAudTrpcdUluo65Fy-tmJkLgNOIzs";
+		checksum = "vbZMqPbhScSE5gQXHIvG3pPNw7Iqsi9sEpI13wPdTNQQYOI2skfCvwSTXLq9Ncq8";
 	};
 
 	env = [

internal/rosa/package/rename.az

@@ -0,0 +1,17 @@
+package rename {
+	description = "rename renames the filenames supplied according to the rule specified as the first argument";
+	website = "https://search.cpan.org/dist/rename";
+	anitya = 14302;
+
+	version# = "1.16.2";
+	// CPAN missing files
+	source = remoteGitHub {
+		suffix = "pstray/rename";
+		tag = "v"+version;
+		checksum = "4VTeBcv1-oa_OlxpKS4h9ZxZMEq1wrk8hzaiBVZTMYCVQ0adDZ8ubPZ3VFf6qqeo";
+	};
+
+	exec = makeMaker {};
+
+	runtime = [ perl ];
+}

internal/rosa/package/toybox.az

@@ -2,10 +2,10 @@ package toybox-source {
 	description = "toybox source tree";
 	exclude = true;
 
-	version# = "0.8.13";
+	version# = "0.8.14";
 	output = remoteTar {
 		url = "https://landley.net/toybox/downloads/toybox-"+version+".tar.gz";
-		checksum = "rZ1V1ATDte2WeQZanxLVoiRGdfPXhMlEo5-exX-e-ml8cGn9qOv0ABEUVZpX3wTI";
+		checksum = "RZQp2CTsLt_y15vsZxwqUb2O1XfK7uvwn-2sTd38O4HAsFKPQpS1UP0brYJ3dRA-";
 		compress = gzip;
 	};
 }

internal/rosa/package/vim.az

@@ -2,6 +2,8 @@ package vim {
 	description = "a greatly improved version of the good old UNIX editor Vi";
 	website = "https://www.vim.org";
 	anitya = 5092;
+	exclude = true;
+	block = "not exposed to end users";
 
 	version# = "9.2.0707";
 	source = remoteGitHub {