ash
56b6c046ef
Desktop Exec=grok-bot has no TTY, so interactive sudo cannot prompt and auto-update is skipped. Try sudo -n, then pkexec of a grok-bot-bin-only helper (auth_admin, not NOPASSWD), then interactive sudo on a TTY. Cancel or deny still launches the installed binary. #16
40 lines
1.1 KiB
Bash
Executable File
40 lines
1.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Root helper for grok-bot-bin GUI auto-update. Invoked via pkexec only.
|
|
# Runs pacman -U on a local grok-bot-bin package — not a generic pacman wrapper.
|
|
set -euo pipefail
|
|
|
|
if [[ $# -ne 1 ]]; then
|
|
echo "pkexec-pacman-u: usage: pkexec-pacman-u /path/to/grok-bot-bin-*-x86_64.pkg.tar.zst" >&2
|
|
exit 2
|
|
fi
|
|
|
|
pkg=$1
|
|
if [[ "$pkg" != /* || "$pkg" == *..* ]]; then
|
|
echo "pkexec-pacman-u: refusing path: $pkg" >&2
|
|
exit 2
|
|
fi
|
|
|
|
base=$(basename -- "$pkg")
|
|
if [[ ! "$base" =~ ^grok-bot-bin-.+-x86_64\.pkg\.tar\.zst$ ]]; then
|
|
echo "pkexec-pacman-u: refusing package name: $base" >&2
|
|
exit 2
|
|
fi
|
|
|
|
if [[ ! -f "$pkg" || ! -r "$pkg" ]]; then
|
|
echo "pkexec-pacman-u: package not found or unreadable: $pkg" >&2
|
|
exit 2
|
|
fi
|
|
|
|
# Filename is not enough; require the package metadata name.
|
|
info=$(/usr/bin/pacman -Qp -- "$pkg" 2>/dev/null) || {
|
|
echo "pkexec-pacman-u: not a pacman package: $pkg" >&2
|
|
exit 2
|
|
}
|
|
name=${info%% *}
|
|
if [[ "$name" != grok-bot-bin ]]; then
|
|
echo "pkexec-pacman-u: refusing package $name" >&2
|
|
exit 2
|
|
fi
|
|
|
|
exec /usr/bin/pacman -U --noconfirm -- "$pkg"
|