ash
56b6c046ef
Desktop Exec=grok-bot has no TTY, so interactive sudo cannot prompt and auto-update is skipped. Try sudo -n, then pkexec of a grok-bot-bin-only helper (auth_admin, not NOPASSWD), then interactive sudo on a TTY. Cancel or deny still launches the installed binary. #16
108 lines
6.0 KiB
Markdown
108 lines
6.0 KiB
Markdown
# grok-bot-bin
|
|
|
|
Unofficial Arch / CachyOS package of the official [Grok Bot](https://cursor.com/download/bot) `.deb`. Temporary until upstream packages for Arch.
|
|
|
|
Not affiliated with Cursor / SpaceXAI. The app binary is unchanged; this only repacks it for `pacman`.
|
|
|
|
## Install (build locally)
|
|
|
|
This tree packages **0.39.0** (`pkgver` / `pkgrel=2` in `PKGBUILD`). `makepkg -si` from git tip builds that version even before a release tag exists.
|
|
|
|
```bash
|
|
git clone https://git.s1d3sw1ped.com/s1d3sw1ped/grok-bot-bin.git
|
|
cd grok-bot-bin
|
|
makepkg -si
|
|
```
|
|
|
|
With an AUR helper against this git URL:
|
|
|
|
```bash
|
|
paru -S grok-bot-bin --aururl https://git.s1d3sw1ped.com
|
|
# or:
|
|
yay -S grok-bot-bin # after cloning locally / using a custom AUR mirror
|
|
```
|
|
|
|
Simplest reliable path on CachyOS today:
|
|
|
|
```bash
|
|
makepkg -si
|
|
```
|
|
|
|
## Install from a release package
|
|
|
|
`pacman -U` installs whatever `.pkg.tar.zst` is attached on [Releases](https://git.s1d3sw1ped.com/s1d3sw1ped/grok-bot-bin/releases), which lags git tip until the bump is tagged (see Updating). After `v0.39.0` is tagged, CI (`build.yml`) attaches `grok-bot-bin-0.39.0-1-x86_64.pkg.tar.zst`. Until a new tag's asset exists, use `makepkg -si` for git-tip `pkgver`.
|
|
|
|
```bash
|
|
curl -LO 'https://git.s1d3sw1ped.com/s1d3sw1ped/grok-bot-bin/releases/download/v0.39.0/grok-bot-bin-0.39.0-1-x86_64.pkg.tar.zst'
|
|
sudo pacman -U grok-bot-bin-0.39.0-1-x86_64.pkg.tar.zst
|
|
```
|
|
|
|
Download first, then `pacman -U` the local file (`LocalFileSigLevel = Optional`). Do not pass the remote URL straight to pacman if signatures are required.
|
|
|
|
## Custom pacman repo (optional)
|
|
|
|
After CI publishes a repo database under Releases (or Packages), add to `/etc/pacman.conf`:
|
|
|
|
```ini
|
|
[grok-bot]
|
|
SigLevel = Optional TrustAll
|
|
Server = https://git.s1d3sw1ped.com/s1d3sw1ped/grok-bot-bin/releases/latest/download
|
|
```
|
|
|
|
Exact `Server=` URL may change once the first repo DB lands; `makepkg -si` works regardless.
|
|
|
|
## Updating
|
|
|
|
Stay-current path when Cursor's linux-x64 Grok Bot feed moves. `PKGBUILD` is currently **0.39.0** (pkgrel 2). One updater: `./scripts/update.sh`.
|
|
|
|
### Scheduled bump (Gitea Actions)
|
|
|
|
`.gitea/workflows/update.yml` runs daily (`cron: '17 6 * * *'`) and on `workflow_dispatch`. It:
|
|
|
|
1. Runs `./scripts/update.sh` against the live Cursor linux-x64 feed.
|
|
2. If `pkgver` changed, commits `PKGBUILD` and `.SRCINFO` as eva.
|
|
3. Pushes branch `chore/bump-$pkgver` (force-with-lease if that version is re-run). It does **not** push `master` or create a tag.
|
|
4. Opens a PR into `master` via the Gitea API (or reuses an open PR from that head). Title: `pkgbuild: Bump grok-bot-bin to $pkgver`.
|
|
|
|
`master` and tags stay protected; the bump job must not push those refs. A no-op is only “already at this `pkgver`” (exit 0). Branch push or PR create/reuse failures fail the job.
|
|
|
|
After that PR merges, `.gitea/workflows/tag-release.yml` (push to `master`, or `workflow_dispatch`) reads `pkgver` from `PKGBUILD`. If tag `v$pkgver` is missing, it creates and pushes it for the master commit; if the tag already exists, it is a no-op. Pushing only that tag does not re-run the PKGBUILD bump.
|
|
|
|
The tag triggers `.gitea/workflows/build.yml`, which builds the Arch package and attaches `grok-bot-bin-$pkgver-$pkgrel-x86_64.pkg.tar.zst` to the Gitea release. An upstream bump resets `pkgrel` to 1, so 0.39.0 → tag `v0.39.0`.
|
|
|
|
If the script cannot parse the feed, the `.deb` download fails, or `curl` / `python3` / `sha256sum` is missing, the job fails (it is not a silent “up to date”). `jq` is optional; without it the script parses the feed with `python3`. The workflow still `apt-get install`s `jq` for the run.
|
|
|
|
Scheduled jobs run on the default branch (`master`). Bump PRs target `master` so merge can tag. Product PRs still land on `develop` (see CONTRIBUTING).
|
|
|
|
### Manual force path
|
|
|
|
When you do not want to wait for cron:
|
|
|
|
```bash
|
|
# requires curl, python3, sha256sum; jq optional
|
|
./scripts/update.sh
|
|
```
|
|
|
|
If the feed is newer, that rewrites `PKGBUILD` and `.SRCINFO`. Commit and open a PR into `master` (same as the scheduled job); after merge, `tag-release.yml` creates `v<pkgver>`. Or tag yourself after merge:
|
|
|
|
```bash
|
|
git add PKGBUILD .SRCINFO
|
|
git commit -m "pkgbuild: Bump grok-bot-bin to <pkgver>"
|
|
git push origin "HEAD:chore/bump-<pkgver>" # then open a PR into master
|
|
# After merge, tag-release.yml creates v<pkgver>. To tag yourself:
|
|
git tag "v<pkgver>" # e.g. v0.39.0
|
|
git push origin "v<pkgver>"
|
|
makepkg -si # install from this tree without waiting for the release asset
|
|
```
|
|
|
|
Install the new version with `makepkg -si`, or (once CI publishes the asset) `pacman -U` from Releases as in the example above.
|
|
|
|
## Notes
|
|
|
|
- `/usr/bin/grok-bot` (and `sand`) is a launch shim: unless `GROK_BOT_NO_UPDATE=1`, it checks the latest Gitea release and may `pacman -U` a newer `.pkg.tar.zst` before exec'ing `/opt/Grok Bot/…`. Network/API failures still launch the installed binary.
|
|
- Auto-update privilege order: `sudo -n` (passwordless, e.g. lab NOPASSWD) → `pkexec` / polkit when launched from the desktop (no TTY, `DISPLAY` or `WAYLAND_DISPLAY` set) → interactive `sudo` when stdin is a TTY. Cancel or deny still launches the installed binary. Passwordless sudo is **not** the default.
|
|
- Desktop / CachyOS: `polkit` (provides `pkexec`) and a session polkit authentication agent (usually already running with KDE / GNOME / Hyprland / etc.) are required for the graphical password prompt. The package installs `/usr/lib/grok-bot-bin/pkexec-pacman-u` and `com.s1d3sw1ped.grok-bot-bin.update` (`auth_admin`, not NOPASSWD). `polkit` is an optdepend.
|
|
- If the app menu still launches an old binary without updating, run `/usr/bin/grok-bot` once from a terminal, or `sudo pacman -U` the newer `.pkg.tar.zst` from Releases — the menu must call the PATH shim, not `/opt/Grok Bot/…`.
|
|
- Upstream Linux builds still have no in-app updater for the Electron app itself; `scripts/update.sh` (cron or manual) is the packaging bump from Cursor's feed.
|
|
- `chrome-sandbox` is left non-setuid because the install path contains a space; user namespaces cover sandboxing on CachyOS.
|