omarchy-pkgs-aarch64

Unofficial aarch64 builds of Omarchy's own packages, for Apple Silicon Macs running Asahi Linux and the omarchy-mac fork.

Why this exists

Omarchy's package repo at pkgs.omarchy.org now serves edge/aarch64, but Apple Silicon machines must not install from it. Mac pacman.conf sets [omarchy] to Usage = Sync: the db is refreshed, and only three explicit Hyprland targets (omarchy/hyprland, omarchy/hyprtoolkit, omarchy/hyprland-guiutils) come from official edge. Everything else — omarchy-nvim, voxtype-bin, 1password, the share picker — is invisible to pacman -S and Restore Preinstalls. This repo is the install repo those names actually resolve from. Widening [omarchy] to normal Install is how you get official Hyprland fighting ALARM's libaquamarine SONAME.

Application sources are unmodified. The Omarchy Mac package pair carries a small, checked packaging patch described below. Packages come from four places:

• Omarchy's own repo (omacom-io/omarchy-pkgs), built with that repo's tooling, which already supports ARM: ./bin/build --arch aarch64 --package omacalc omacut omawrite
• The AUR, built with makepkg from the published PKGBUILD.
• any-architecture packages, which need no rebuild at all — the AUR artifact is reused as-is.
• In-tree PKGBUILDs (pkgbuilds/, source: local in packages.json), for software that exists nowhere in a form an aarch64 build can use. obs-studio is absent from Arch Linux ARM entirely, and every AUR pkgbase hardcodes obsproject's prebuilt CEF browser bundle, which is published for x86_64 only; ours builds upstream's unmodified release sources with ENABLE_BROWSER=OFF — no browser source/dock, everything else enabled. pinta is Omarchy's default simple image editor, but the AUR recipe is arch=('x86_64') and hardcodes linux-x64; ALARM has none, and ignorearch on that recipe would still emit x64. Ours is that recipe with arch=('aarch64') and linux-arm64, depending on this repo's dotnet-*-bin packages rather than Arch extra names that do not exist on ARM. cursor-bin is the vendor linux-arm64 AppImage with bundled Electron under /opt/cursor-bin; the omarchy-pkgs recipe is x86_64-only. grok-bot repacks the vendor linux-arm64 .deb that the x86_64-only omarchy-pkgs recipe never reaches for. avd-fw and libva-v4l2_request-avd are in no repository at all, and together turn on hardware video decode on Apple Silicon.

Packages

Package	Version	Provides
1password	8.12.36-2	Password manager
1password-cli	2.39.0-1	1Password CLI
aether	4.29.9-1	Wallpaper-driven desktop theming
aspnet-runtime-bin	10.0.12.sdk401-1	ASP.NET Core runtime
aspnet-targeting-pack-bin	10.0.12.sdk401-1	ASP.NET Core targeting pack
avd-fw	0.1-1	Apple Video Decoder firmware — H.264/HEVC/VP9 hardware decode
brave-origin-bin	1:1.95.104-1	Minimalist browser from the Brave team
cliamp	2.2.0-1	Retro terminal music player
cursor-bin	3.20.17-1	Cursor editor (vendor linux-arm64 AppImage)
dotnet-host-bin	10.0.12.sdk401-1	.NET CLI driver
dotnet-runtime-2.1	2.1.30.sdk818-1	.NET Core 2.1 runtime
dotnet-runtime-bin	10.0.12.sdk401-1	.NET runtime
dotnet-sdk-2.1	2.1.30.sdk818-1	.NET Core 2.1 SDK
dotnet-sdk-bin	10.0.12.sdk401-1	.NET SDK
dotnet-targeting-pack-bin	10.0.12.sdk401-1	.NET targeting pack
ghostty	1.3.1-1	Stable terminal emulator
ghostty-nautilus	1.3.1-1	Open in Ghostty extension for GNOME Files
ghostty-shell-integration	1.3.1-1	Ghostty shell integration scripts
ghostty-terminfo	1.3.1-1	xterm-ghostty terminal definition
grok-bot	0.47.0-1	Grok Bot desktop agent (vendor linux-arm64 .deb)
herdr	0.9.1-1	Terminal workspace manager for AI coding agents
hermes-desktop	2026.9.7-1	Native desktop shell for Hermes Agent
hypa-ttfx-bin	0.3.1-1	Hypa terminal text effects
hyprland-preview-share-picker	0.2.1-1	Share picker with window/monitor previews
libva-v4l2_request-avd	1.3-1	VA-API driver so applications can reach the Apple Video Decoder
localsend	1.18.2-2	Cross-platform AirDrop alternative
mise-bin	2026.9.11-1	Dev tools, env vars, task runner
obs-studio	32.2.2-1	Video recording and live streaming (no browser source)
obsidian-appimage	1.13.7-2	Markdown knowledge base (AppImage)
omacalc	0.2.2-1	Calculator — bound to SUPER + CTRL + Q
omacut	0.4.0-1	Video length trimmer
omarchy	4.0.2-2	Omarchy Mac scripts and desktop runtime
omarchy-mac-keyring	Pending edge bootstrap	Omarchy Mac public signing certificate and trust policy
omarchy-emacs	1.10.1-1	Emacs theme/font syncing for Omarchy
omarchy-nvim	2026.8.13-1	Pre-built LazyVim configuration
omarchy-settings	4.0.2-2	Apple Silicon system and user defaults
omarchy-steam-fex	1.0.0-1	Steam launcher for the Asahi muvm/FEX stack
omarchy-webapp-theme	0.3.7-1	Theme Slack, Discord, GitHub et al. to match Omarchy
omawrite	0.5.0-1	Markdown writing app — bound to SUPER + SHIFT + W
openai-codex-desktop	26.915.31029-1	ChatGPT desktop app with Codex
pinta	3.1.2-1	Simple image editor
tensaku	0.29.0-1	Screenshot annotation for Wayland
ttf-ia-writer	20181225-1	iA Writer font subset
ttfx	0.3.2-1	Terminal text effects, static binary
tzupdate	3.1.0-1	Set timezone from IP geolocation
ufw-docker	251123-1	Fix the Docker/UFW security flaw
vi	1:070224-9	Original ex/vi text editor
voxtype-bin	1.0.1-1	Push-to-talk dictation
xdg-terminal-exec	0.14.3-1	Launch desktop apps with Terminal=true
yaru-icon-theme	26.04.5.1ubuntu-1	Yaru default Ubuntu icon theme
yay	13.0.1-1	Pacman wrapper and AUR helper

Usage

Use the repository configuration and keyring delivered by your Omarchy Mac release. The historical edge feed remains unsigned until its separately approved trust conversion; do not enable strict verification before installing and verifying the fork keyring. The signed configuration is:

[omarchy-aarch64]
SigLevel = PackageRequired DatabaseRequired TrustedOnly
Server = https://github.com/omarchy-mac/omarchy-pkgs-aarch64/releases/download/edge

After the documented trust transition, install packages with a full upgrade:

sudo pacman -Syu omacalc omawrite omacut

See signing and bootstrap for the two-stage trust transition and lane status requirements. Do not weaken a signed lane's policy to work around a failed signature. The rolling edge URL stays constant; its database and signature are separate mutable assets, so updates can briefly fail closed.

Caveats

• Unofficial. Not affiliated with or endorsed by Omarchy or 37signals. Upstream owes you nothing for these builds; report packaging bugs here, not to them.
• Trust transition. Legacy unsigned edge remains compatible until an explicitly approved complete-inventory conversion. Signed RC/stable bundles and a converted edge require the fork keyring and strict signature policy.
• Automated. Scheduled workflows refresh the general package set and the fork-owned Omarchy Mac package pair independently. See Automation.

Automation

.github/workflows/update-packages.yml runs every six hours. It compares each package's upstream version against the version in the published db and rebuilds only what moved, so a typical run does nothing. It never publishes a version older than the one already in the repo, which is what would make pacman -Syu offer you a downgrade.

The packages differ only in where they can be built:

Group	Automated
any — architecture-independent	yes
repack — vendor-prebuilt ARM binary	yes
compile — built from source	yes

The exact inventory is maintained in packages.json. The desktop release owns omarchy-keyring, omarchy-mac-keyring and ttf-jetbrains-mono-nerd-basic extras when its package declares them; the generic matrix skips these names. omarchy and omarchy-settings are built as an atomic pair by update-omarchy-mac.yml, which checks hourly for a new Omarchy Mac release. It checks out the exact release tag, builds both packages on a native ARM runner, and refuses to publish unless their versions match and the aarch64 dependency and payload contracts hold. Failures in unrelated AUR packages therefore cannot block an Omarchy Mac release, and one half of the pair can never publish by itself. The fork keyring has one producer: the same verified desktop build, including declared extras. Its in-tree public key recipe is a verification input, not a second generic updater.

Before building the pair, scripts/prepare-omarchy-recipes.sh applies the checked-in recipe changes from upstream PR #341: Snapper is required on ARM, and settings packages install the keyboard-backlight user service when the release source contains it. The patch includes stable and development recipes, accepts an already-applied patch, and stops on conflicting upstream changes. Release verification requires Snapper while still rejecting Limine, and verifies the packaged keyboard service against the release source. Remove the carried patch once the upstream recipes provide these fixes.

This changes future builds, not existing release assets. Publishing still needs an appropriately versioned Omarchy Mac release. Desktop CI that checks out omacom/omarchy-pkgs directly does not use this patch automatically.

ghostty builds the stable upstream release with its required Zig toolchain, verified by checksum and used only during the build. Its four split packages are built together. Each manifest entry excludes the sibling runtime packages from build-time dependency installation, so the first build does not try to install its own unpublished output, including when just one split package is selected. The finished packages retain those runtime dependencies. Manpages are omitted because pandoc-cli is unavailable in Arch Linux ARM.

herdr uses the upstream omarchy-pkgs recipe, which downloads a checksum-pinned Zig 0.15.2 toolchain for the build architecture. This avoids the AUR recipe's dependency on the unavailable zig0.15 repository package.

hermes-desktop carries the ARM recipe fixes from upstream PR #373 locally. scripts/prepare-hermes-recipe.sh enables aarch64 and selects Electron's linux-arm64-unpacked output before the generic builder reads the recipe. It accepts the same fixes already applied upstream and fails on conflicting recipe changes. The patch preserves upstream's pkgver and pkgrel, keeping version detection consistent with the published package. Remove this patch and its build hook once upstream includes the fixes.

hyprland-preview-share-picker is the release package (command of that name) so omarchy-base.packages can ask for it. It is built against ALARM, not official-edge Hyprland; exclude_build_deps drops hyprland and xdg-desktop-portal-hyprland at build time. The omarchy-pkgs recipe pins RUSTUP_TOOLCHAIN=nightly; scripts/prepare-share-picker-recipe.sh rewrites that to stable, which is how the -git package this repo used to ship already built. After the release package is on edge, remove the leftover -git package from the published db with repo-remove on a downloaded copy of both db files, re-upload them, and delete the -git asset — and only while no update-packages run is in progress, or the workflow will clobber the upload.

omarchy-nvim is arch=('any') but build() runs nvim --headless on the ARM runner. The official artifact has no tree-sitter .so files; the host-arch binaries to inspect are mason/packages/shfmt and stylua.

omarchy-steam-fex installs omarchy-launch-steam for Apple Silicon's Asahi Steam/muvm/FEX stack. It is a script-only arch=('aarch64') package, built through repack with allow_empty_elf. The launcher creates the user's Steam desktop override and applies the Steam UI network workaround at launch or with --prepare. See the recipe notes for source provenance, behavior tests and Omarchy integration.

cursor-bin is an in-tree AppImage: the omarchy-pkgs recipe is x86_64-only and strips Electron. Ours keeps the vendor linux-arm64 AppImage and its bundled Electron under /opt/cursor-bin, so it does not collide with the Mac workaround's /opt/cursor. Icons and the URL-handler desktop file are unsquashed from the image with squashfs-tools; the AppImage is not executed. The quattro-mac follow-up must still delete the workaround files (/opt/cursor, /usr/local/bin/cursor, the two .desktop files, icons) before pacman -S cursor-bin, or those paths under /usr/share still conflict.

grok-bot repacks the vendor linux-arm64 .deb. It is omacom/omarchy-pkgs#244 with three changes for a binary repo. Upstream decides whether chrome-sandbox is setuid by probing for user namespaces inside package(), which measures the build host; here that host is a CI container where the probe fails, so every user would get a setuid-root helper. A setuid helper could not work anyway: Electron cannot exec it from a path with a space, and this one lives under /opt/Grok Bot/ (electron/electron#44414). The package always ships it as 0755, and grok-bot.install probes as nobody and tells users on a kernel without unprivileged user namespaces to add --no-sandbox to ~/.config/grok-bot-flags.conf. alsa-lib is added because libasound.so.2 is a direct dependency of the binary that nothing else in the depends pulls in. StartupWMClass matches the vendor entry, grok-bot, not upstream's Grok Bot.

Signed source tarballs (1password, 1password-cli, vi, voxtype-bin) import only the fingerprints listed in validpgpkeys, plus any matching key file the recipe already ships. Signature checks are not skipped.

packages.json records which group each package belongs to and where its PKGBUILD comes from — the AUR for most, omacom-io/omarchy-pkgs for the ones that aren't in the AUR, and this repo's own pkgbuilds/ for obs-studio, pinta, cursor-bin, and grok-bot. The source is per-package on purpose: for omarchy-emacs the AUR leads Omarchy's own repo, so switching it would be a downgrade.

Builds run on ubuntu-24.04-arm, which is free for public repos; detection and publishing run on x86, since neither vercmp nor repo-add cares about the target architecture.

Every build needs a real aarch64 environment. Forcing CARCH=aarch64 inside an x86 container looks like it ought to work for the repacks — they only unpack a binary someone else built — but several of those PKGBUILDs execute the ARM binary while packaging it. mise-bin runs mise completion three times to generate its shell completions. Emulating aarch64 on an x86 runner does work, but a free native ARM runner makes it pointless.

Publishing is ordered so the repo is never internally inconsistent: package assets upload first, then the four db files with .db last, and only then are superseded package assets deleted. A package whose version carries an epoch is renamed before repo-add sees it, because a GitHub release asset cannot contain a : — the db records 1:1.93.138-1 as the version but brave-origin-bin-1.1.93.138-1-aarch64.pkg.tar.xz as the filename.

Running it by hand:

gh workflow run update-packages.yml                        # everything in scope
gh workflow run update-packages.yml -f packages=mise-bin   # one package
gh workflow run update-packages.yml -f dry_run=true        # build, verify, publish nothing
gh workflow run update-omarchy-mac.yml -f release_tag=v4.0.2-1 -f dry_run=true

scripts/self-test.sh covers the parts that would fail quietly rather than loudly — epoch filename handling, reading a package's name from its .PKGINFO, the ELF audit and its allowances, and repo db parsing. It is offline, takes a couple of seconds, and runs on every push and pull request. A failed scheduled run opens an issue rather than only turning a run red.

The scripts under scripts/ are plain bash and run outside CI too. scripts/smoke-test.sh is the useful one on its own: it syncs the published repo the way pacman does and checks that every package the db advertises is actually fetchable. After publication, both updater workflows pass the newly published database as SMOKE_EXPECTED_DB. The check retries forced refreshes until pacman has that exact database, then verifies packages against the same snapshot.

Building these yourself

Omarchy's own packages:

git clone https://github.com/omacom-io/omarchy-pkgs
cd omarchy-pkgs
./bin/build --arch aarch64 --package omacalc omacut omawrite

Requires Docker. On an x86_64 host it sets up QEMU automatically; on ARM it builds natively. Each of these takes well under a minute.

Everything else comes from the AUR — clone the package and run makepkg. Packages marked arch=('any') need no rebuild at all; the AUR artifact works on ARM unchanged.