From 5e6d1ef9390ad59bb600c3156514961013afab86 Mon Sep 17 00:00:00 2001
From: BlackScorp <cccpmik@gmail.com>
Date: Sun, 25 Oct 2026 14:46:41 +0100
Subject: [PATCH] New package: noctalia-greeter-1.7.0

Add the greeter with support for Void's polkitd-owned rules directory so
passwordless appearance synchronization works while executable and policy
paths remain restricted to root-owned directory chains.
---
 .../noctalia-greeter/patches/polkitd.patch    | 51 +++++++++++++++++++
 srcpkgs/noctalia-greeter/template             | 31 +++++++++++
 2 files changed, 82 insertions(+)
 create mode 100644 srcpkgs/noctalia-greeter/patches/polkitd.patch
 create mode 100644 srcpkgs/noctalia-greeter/template

diff --git a/srcpkgs/noctalia-greeter/patches/polkitd.patch b/srcpkgs/noctalia-greeter/patches/polkitd.patch
new file mode 100644
index 00000000000000..c7bfe46dba81dd
--- /dev/null
+++ b/srcpkgs/noctalia-greeter/patches/polkitd.patch
@@ -0,0 +1,51 @@
+diff --git a/src/tools/passwordless_sync_policy.cpp b/src/tools/passwordless_sync_policy.cpp
+--- a/src/tools/passwordless_sync_policy.cpp
++++ b/src/tools/passwordless_sync_policy.cpp
+@@ -46,6 +46,10 @@ namespace greeter::passwordless_sync {
+     constexpr std::size_t kMaximumUsers = 256;
+     constexpr std::size_t kMaximumUserNameLength = 256;
+     constexpr std::size_t kMaximumPathLength = 4096;
++    const uid_t kPolkitdUid = [] {
++      if (const struct passwd* pw = ::getpwnam("polkitd")) return pw->pw_uid;
++      return static_cast<uid_t>(-1);
++    }();
+ 
+     class UniqueFd {
+     public:
+@@ -199,7 +203,7 @@ namespace greeter::passwordless_sync {
+     }
+ 
+     [[nodiscard]] bool validateTrustedDirectoryChain(
+-        const std::filesystem::path& directory, std::string_view description, std::string& errorOut
++        const std::filesystem::path& directory, std::string_view description, std::string& errorOut, uid_t directoryOwner = 0
+     ) {
+       if (!directory.is_absolute()) {
+         errorOut = std::string(description) + " path is not absolute";
+@@ -212,7 +216,8 @@ namespace greeter::passwordless_sync {
+         if (::stat(current.c_str(), &state) != 0) {
+           return setErrnoError(std::string("failed to inspect ") + std::string(description) + " directory", errorOut);
+         }
+-        if (!S_ISDIR(state.st_mode) || state.st_uid != 0 || (state.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
++        if (!S_ISDIR(state.st_mode) || (state.st_uid != 0 && (current != directory || state.st_uid != directoryOwner))
++            || (state.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
+           errorOut = std::string(description) + " must use a root-owned, non-user-writable directory chain";
+           return false;
+         }
+@@ -423,7 +428,7 @@ namespace greeter::passwordless_sync {
+             + ec.message();
+         return false;
+       }
+-      if (!validateTrustedDirectoryChain(canonical, "Polkit rules", errorOut)) {
++      if (!validateTrustedDirectoryChain(canonical, "Polkit rules", errorOut, kPolkitdUid)) {
+         return false;
+       }
+ 
+@@ -432,7 +437,7 @@ namespace greeter::passwordless_sync {
+       if (::fstat(directory.get(), &state) != 0) {
+         return setErrnoError("failed to inspect the Polkit rules directory", errorOut);
+       }
+-      if (!S_ISDIR(state.st_mode) || state.st_uid != 0 || (state.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
++      if (!S_ISDIR(state.st_mode) || (state.st_uid != 0 && state.st_uid != kPolkitdUid) || (state.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
+         errorOut = "the Polkit rules directory has unsafe ownership or permissions";
+         return false;
+       }
diff --git a/srcpkgs/noctalia-greeter/template b/srcpkgs/noctalia-greeter/template
new file mode 100644
index 00000000000000..b68f9bf7301868
--- /dev/null
+++ b/srcpkgs/noctalia-greeter/template
@@ -0,0 +1,31 @@
+# Template file for 'noctalia-greeter'
+pkgname=noctalia-greeter
+version=1.7.0
+revision=1
+build_style=meson
+make_check_args="--exclude noctalia-greeter:greeter-frame-loop"
+hostmakedepends="pkg-config wayland-devel"
+makedepends="wayland-devel wayland-protocols wlroots0.20-devel
+ libinput-devel libglvnd-devel freetype-devel fontconfig-devel
+ cairo-devel pango-devel harfbuzz-devel librsvg-devel libxml2-devel
+ libxkbcommon-devel glib-devel tomlplusplus-devel json-c++ stb
+ libwebp-devel libjxl-devel"
+depends="greetd dbus bash"
+checkdepends="mesa-dri"
+short_desc="Minimal login greeter for greetd matching Noctalia Shell"
+maintainer="BlackScorp <cccpmik@gmail.com>"
+license="MIT"
+homepage="https://github.com/noctalia-dev/noctalia-greeter"
+distfiles="https://github.com/noctalia-dev/noctalia-greeter/archive/refs/tags/v${version}.tar.gz
+ https://raw.githubusercontent.com/google/wuffs/a14745aa458fd2b2785034efa04eab3c7b5b91e0/LICENSE-MIT>wuffs-LICENSE-MIT"
+checksum="5b092784c0147bb6739efc2e8146d2d07e3572a59d7a370e93092f9f56d4fcc8
+ bb811a4b485eac3caeb8bdc58bbafb355fbcb6116010a7ea9179e5c70b0bc878"
+skip_extraction="wuffs-LICENSE-MIT"
+make_dirs="/var/lib/noctalia-greeter 0750 _greeter _greeter"
+
+post_install() {
+	# The upstream tmpfiles entry hardcodes "greeter"; Void uses "_greeter".
+	rm -f "${DESTDIR}/usr/lib/tmpfiles.d/noctalia-greeter.conf"
+	vlicense LICENSE
+	vlicense "${XBPS_SRCDISTDIR}/${pkgname}-${version}/wuffs-LICENSE-MIT"
+}