Release 2.22.1

* use local devtools configs instead of global ones

* make docker image rootless

* add migration notes

* fix setup command

* fix regress jo

.github/scripts/setup.sh

@@ -44,7 +44,7 @@ pacman -Qdtq | pacman -Rscn --noconfirm -
 
 # initial setup command as root
 [[ -z $MINIMAL_INSTALL ]] && WEB_ARGS=("--web-port" "8080")
-ahriman -a x86_64 -r "github" service-setup --packager "ahriman bot <ahriman@example.com>" "${WEB_ARGS[@]}"
+sudo -u ahriman -- ahriman -a x86_64 -r "github" service-setup --packager "ahriman bot <ahriman@example.com>" "${WEB_ARGS[@]}"
 # enable services
 systemctl enable ahriman@x86_64-github.timer
 if [[ -z $MINIMAL_INSTALL ]]; then

.github/workflows/regress.yml

@@ -18,8 +18,8 @@ jobs:
         image: arcan1s/ahriman:edge
         env:
           AHRIMAN_PORT: 8080
-          AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman-web.sock
-        options: --privileged --entrypoint entrypoint-web
+          AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman-web.sock
+        options: --privileged --user root --entrypoint entrypoint-web
         ports:
           - 8080
         volumes:
@@ -31,8 +31,8 @@ jobs:
         AHRIMAN_DEBUG: y
         AHRIMAN_OUTPUT: console
         AHRIMAN_PORT: 8080
-        AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman-web.sock
-      options: --privileged
+        AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman-web.sock
+      options: --privileged --user root
       volumes:
         - repo:/var/lib/ahriman
 
@@ -40,7 +40,9 @@ jobs:
       - run: pacman -Sy
 
       - name: Init repository
-        run: entrypoint help
+        run: |
+          chown ahriman:ahriman /var/lib/ahriman
+          sudo -E -u ahriman -- entrypoint help
 
       - name: Print configuration
         run: |

ahriman-core/package/bin/ahriman-archbuild

@@ -7,27 +7,46 @@ usage() {
     echo "Usage: $cmd [options] -- [archbuild args]"
     echo "    -r <repository>    Repository name"
     echo "    -a <architecture>  Repository architecture"
-    exit 1
+    echo "    -c <directory>     Read devtools pacman configurations from this directory"
 }
 
 repository=
 architecture=
+pacman_config_dir=
 
-while getopts ":r:a:" arg; do
+while getopts ":r:a:c:" arg; do
     case "$arg" in
         r) repository="$OPTARG" ;;
         a) architecture="$OPTARG" ;;
-        *) usage ;;
+        c) pacman_config_dir="$OPTARG" ;;
+        *) usage >&2; exit 1 ;;
     esac
 done
 
 if [[ -z $repository || -z $architecture ]]; then
-    usage
+    usage >&2
+    exit 1
+fi
+
+if [[ -n $pacman_config_dir && ! -d $pacman_config_dir ]]; then
+    echo "devtools configuration directory does not exist: $pacman_config_dir" >&2
+    exit 1
 fi
 
 source "/usr/share/devtools/lib/archroot.sh"
 check_root "SOURCE_DATE_EPOCH,SRCDEST,SRCPKGDEST,PKGDEST,LOGDEST,NPROC,MAKEFLAGS,PACKAGER,GNUPGHOME" "${BASH_SOURCE[0]}" "$@"
 
-exec bash -c '
-    source "$1" "${@:2}"
-' "${repository}-${architecture}-build" "archbuild" "${@:$OPTIND}"
+# because devtools doesn't allow to read configuration from custom path
+# here is a workaround, which uses unshare to bind-mount directory with configuration files
+# for specific process
+if [[ -n $pacman_config_dir && -z ${AHRIMAN_ARCHBUILD_MOUNTED:-} ]]; then
+    pacman_config_dir="$(readlink -e -- "$pacman_config_dir")"
+    export AHRIMAN_ARCHBUILD_MOUNTED=1
+
+    exec unshare --mount --propagation private \
+        bash -c 'mount --bind -- "$0" /usr/share/devtools/pacman.conf.d && exec "$@"' \
+        "$pacman_config_dir" "${BASH_SOURCE[0]}" "$@"
+fi
+
+exec bash -c 'source "/usr/bin/archbuild" "$@"' \
+    "${repository}-${architecture}-build" "${@:$OPTIND}"

ahriman-core/package/share/ahriman/settings/ahriman.ini

@@ -1,6 +1,7 @@
 [settings]
 ; Relative path to directory with configuration files overrides. Overrides will be applied in alphabetic order.
-include = ahriman.ini.d $HOME/.config/ahriman.ini.d
+include[] = ahriman.ini.d
+include[] = ${repository:root}/.config/ahriman/ahriman.ini.d
 ; Relative path to configuration used by logging package.
 logging = ahriman.ini.d/logging.ini
 ; Perform database migrations on the application start. Do not touch this option unless you know what you are doing.
@@ -34,6 +35,8 @@ retry_backoff = 1.0
 [build]
 ; List of additional flags passed to archbuild command.
 ;archbuild_flags =
+; Path to local directory with devtools configuration files, which will be bind-mounted for devtools.
+devtools_configs = ${repository:root}/.config/ahriman/pacman.conf.d
 ; Path to build command.
 devtools_wrapper = ahriman-archbuild
 ; List of packages to be ignored during automatic updates.

ahriman-core/package/share/bash-completion/completions/_ahriman

@@ -1,140 +1,129 @@
-# AUTOMATICALLY GENERATED by `shtab`
+# AUTOMATICALLY GENERATED by https://github.com/tqdm/shtab
 
-_shtab_ahriman_subparsers=('add' 'aur-search' 'check' 'clean' 'config' 'config-validate' 'copy' 'daemon' 'help' 'help-commands-unsafe' 'help-updates' 'help-version' 'init' 'key-import' 'package-add' 'package-archives' 'package-changes' 'package-changes-remove' 'package-copy' 'package-hold' 'package-pkgbuild' 'package-pkgbuild-remove' 'package-remove' 'package-rollback' 'package-status' 'package-status-remove' 'package-status-update' 'package-unhold' 'package-update' 'patch-add' 'patch-list' 'patch-remove' 'patch-set-add' 'rebuild' 'remove' 'remove-unknown' 'repo-backup' 'repo-check' 'repo-clean' 'repo-config' 'repo-config-validate' 'repo-create-keyring' 'repo-create-mirrorlist' 'repo-daemon' 'repo-init' 'repo-rebuild' 'repo-remove-unknown' 'repo-report' 'repo-restore' 'repo-setup' 'repo-sign' 'repo-statistics' 'repo-status-update' 'repo-sync' 'repo-tree' 'repo-triggers' 'repo-update' 'report' 'run' 'search' 'service-clean' 'service-config' 'service-config-validate' 'service-key-import' 'service-repositories' 'service-run' 'service-setup' 'service-shell' 'service-tree-migrate' 'setup' 'shell' 'sign' 'status' 'status-update' 'sync' 'update' 'user-add' 'user-list' 'user-remove' 'version' 'web' 'web-reload')
+_shtab_ahriman_subparsers=(add aur-search check clean config config-validate copy daemon help help-commands-unsafe help-updates help-version init key-import package-add package-archives package-changes package-changes-remove package-copy package-hold package-pkgbuild package-pkgbuild-remove package-remove package-rollback package-status package-status-remove package-status-update package-unhold package-update patch-add patch-list patch-remove patch-set-add rebuild remove remove-unknown repo-backup repo-check repo-clean repo-config repo-config-validate repo-create-keyring repo-create-mirrorlist repo-daemon repo-init repo-rebuild repo-remove-unknown repo-report repo-restore repo-setup repo-sign repo-statistics repo-status-update repo-sync repo-tree repo-triggers repo-update report run search service-clean service-config service-config-validate service-key-import service-repositories service-run service-setup service-shell service-tree-migrate setup shell sign status status-update sync update user-add user-list user-remove version web web-reload)
 
-_shtab_ahriman_option_strings=('-h' '--help' '-a' '--architecture' '-c' '--configuration' '--force' '-l' '--lock' '--log-handler' '-q' '--quiet' '--report' '--no-report' '-r' '--repository' '--unsafe' '-V' '--version' '--wait-timeout')
-_shtab_ahriman_add_option_strings=('-h' '--help' '--changes' '--no-changes' '--dependencies' '--no-dependencies' '-e' '--exit-code' '--increment' '--no-increment' '-n' '--now' '-s' '--source' '-u' '--username' '-v' '--variable' '-y' '--refresh')
-_shtab_ahriman_aur_search_option_strings=('-h' '--help' '-e' '--exit-code' '--info' '--no-info' '--sort-by')
-_shtab_ahriman_check_option_strings=('-h' '--help' '--changes' '--no-changes' '--check-files' '--no-check-files' '-e' '--exit-code' '--vcs' '--no-vcs' '-y' '--refresh')
-_shtab_ahriman_clean_option_strings=('-h' '--help' '--cache' '--no-cache' '--chroot' '--no-chroot' '--manual' '--no-manual' '--packages' '--no-packages' '--pacman' '--no-pacman')
-_shtab_ahriman_config_option_strings=('-h' '--help' '--info' '--no-info' '--secure' '--no-secure')
-_shtab_ahriman_config_validate_option_strings=('-h' '--help' '-e' '--exit-code')
-_shtab_ahriman_copy_option_strings=('-h' '--help' '-e' '--exit-code' '--remove')
-_shtab_ahriman_daemon_option_strings=('-h' '--help' '-i' '--interval' '--aur' '--no-aur' '--changes' '--no-changes' '--check-files' '--no-check-files' '--dependencies' '--no-dependencies' '--dry-run' '--increment' '--no-increment' '--local' '--no-local' '--manual' '--no-manual' '--partitions' '--no-partitions' '-u' '--username' '--vcs' '--no-vcs' '-y' '--refresh')
-_shtab_ahriman_help_option_strings=('-h' '--help')
-_shtab_ahriman_help_commands_unsafe_option_strings=('-h' '--help')
-_shtab_ahriman_help_updates_option_strings=('-h' '--help' '-e' '--exit-code')
-_shtab_ahriman_help_version_option_strings=('-h' '--help')
-_shtab_ahriman_init_option_strings=('-h' '--help' '--build-as-user' '--from-configuration' '--generate-salt' '--no-generate-salt' '--makeflags-jobs' '--no-makeflags-jobs' '--mirror' '--multilib' '--no-multilib' '--packager' '--server' '--sign-key' '--sign-target' '--web-port' '--web-unix-socket')
-_shtab_ahriman_key_import_option_strings=('-h' '--help' '--key-server')
-_shtab_ahriman_package_add_option_strings=('-h' '--help' '--changes' '--no-changes' '--dependencies' '--no-dependencies' '-e' '--exit-code' '--increment' '--no-increment' '-n' '--now' '-s' '--source' '-u' '--username' '-v' '--variable' '-y' '--refresh')
-_shtab_ahriman_package_archives_option_strings=('-h' '--help' '-e' '--exit-code' '--info' '--no-info')
-_shtab_ahriman_package_changes_option_strings=('-h' '--help' '-e' '--exit-code')
-_shtab_ahriman_package_changes_remove_option_strings=('-h' '--help')
-_shtab_ahriman_package_copy_option_strings=('-h' '--help' '-e' '--exit-code' '--remove')
-_shtab_ahriman_package_hold_option_strings=('-h' '--help')
-_shtab_ahriman_package_pkgbuild_option_strings=('-h' '--help' '-e' '--exit-code')
-_shtab_ahriman_package_pkgbuild_remove_option_strings=('-h' '--help')
-_shtab_ahriman_package_remove_option_strings=('-h' '--help')
-_shtab_ahriman_package_rollback_option_strings=('-h' '--help' '--hold' '--no-hold' '-u' '--username')
-_shtab_ahriman_package_status_option_strings=('-h' '--help' '--ahriman' '-e' '--exit-code' '--info' '--no-info' '-s' '--status')
-_shtab_ahriman_package_status_remove_option_strings=('-h' '--help')
-_shtab_ahriman_package_status_update_option_strings=('-h' '--help' '-s' '--status')
-_shtab_ahriman_package_unhold_option_strings=('-h' '--help')
-_shtab_ahriman_package_update_option_strings=('-h' '--help' '--changes' '--no-changes' '--dependencies' '--no-dependencies' '-e' '--exit-code' '--increment' '--no-increment' '-n' '--now' '-s' '--source' '-u' '--username' '-v' '--variable' '-y' '--refresh')
-_shtab_ahriman_patch_add_option_strings=('-h' '--help')
-_shtab_ahriman_patch_list_option_strings=('-h' '--help' '-e' '--exit-code' '-v' '--variable')
-_shtab_ahriman_patch_remove_option_strings=('-h' '--help' '-v' '--variable')
-_shtab_ahriman_patch_set_add_option_strings=('-h' '--help' '-t' '--track')
-_shtab_ahriman_rebuild_option_strings=('-h' '--help' '--depends-on' '--dry-run' '--from-database' '--increment' '--no-increment' '-e' '--exit-code' '-s' '--status' '-u' '--username')
-_shtab_ahriman_remove_option_strings=('-h' '--help')
-_shtab_ahriman_remove_unknown_option_strings=('-h' '--help' '--dry-run')
-_shtab_ahriman_repo_backup_option_strings=('-h' '--help')
-_shtab_ahriman_repo_check_option_strings=('-h' '--help' '--changes' '--no-changes' '--check-files' '--no-check-files' '-e' '--exit-code' '--vcs' '--no-vcs' '-y' '--refresh')
-_shtab_ahriman_repo_clean_option_strings=('-h' '--help' '--cache' '--no-cache' '--chroot' '--no-chroot' '--manual' '--no-manual' '--packages' '--no-packages' '--pacman' '--no-pacman')
-_shtab_ahriman_repo_config_option_strings=('-h' '--help' '--info' '--no-info' '--secure' '--no-secure')
-_shtab_ahriman_repo_config_validate_option_strings=('-h' '--help' '-e' '--exit-code')
-_shtab_ahriman_repo_create_keyring_option_strings=('-h' '--help')
-_shtab_ahriman_repo_create_mirrorlist_option_strings=('-h' '--help')
-_shtab_ahriman_repo_daemon_option_strings=('-h' '--help' '-i' '--interval' '--aur' '--no-aur' '--changes' '--no-changes' '--check-files' '--no-check-files' '--dependencies' '--no-dependencies' '--dry-run' '--increment' '--no-increment' '--local' '--no-local' '--manual' '--no-manual' '--partitions' '--no-partitions' '-u' '--username' '--vcs' '--no-vcs' '-y' '--refresh')
-_shtab_ahriman_repo_init_option_strings=('-h' '--help' '--build-as-user' '--from-configuration' '--generate-salt' '--no-generate-salt' '--makeflags-jobs' '--no-makeflags-jobs' '--mirror' '--multilib' '--no-multilib' '--packager' '--server' '--sign-key' '--sign-target' '--web-port' '--web-unix-socket')
-_shtab_ahriman_repo_rebuild_option_strings=('-h' '--help' '--depends-on' '--dry-run' '--from-database' '--increment' '--no-increment' '-e' '--exit-code' '-s' '--status' '-u' '--username')
-_shtab_ahriman_repo_remove_unknown_option_strings=('-h' '--help' '--dry-run')
-_shtab_ahriman_repo_report_option_strings=('-h' '--help')
-_shtab_ahriman_repo_restore_option_strings=('-h' '--help' '-o' '--output')
-_shtab_ahriman_repo_setup_option_strings=('-h' '--help' '--build-as-user' '--from-configuration' '--generate-salt' '--no-generate-salt' '--makeflags-jobs' '--no-makeflags-jobs' '--mirror' '--multilib' '--no-multilib' '--packager' '--server' '--sign-key' '--sign-target' '--web-port' '--web-unix-socket')
-_shtab_ahriman_repo_sign_option_strings=('-h' '--help')
-_shtab_ahriman_repo_statistics_option_strings=('-h' '--help' '--chart' '-e' '--event' '--from-date' '--limit' '--offset' '--to-date')
-_shtab_ahriman_repo_status_update_option_strings=('-h' '--help' '-s' '--status')
-_shtab_ahriman_repo_sync_option_strings=('-h' '--help')
-_shtab_ahriman_repo_tree_option_strings=('-h' '--help' '-p' '--partitions')
-_shtab_ahriman_repo_triggers_option_strings=('-h' '--help')
-_shtab_ahriman_repo_update_option_strings=('-h' '--help' '--aur' '--no-aur' '--changes' '--no-changes' '--check-files' '--no-check-files' '--dependencies' '--no-dependencies' '--dry-run' '-e' '--exit-code' '--increment' '--no-increment' '--local' '--no-local' '--manual' '--no-manual' '-u' '--username' '--vcs' '--no-vcs' '-y' '--refresh')
-_shtab_ahriman_report_option_strings=('-h' '--help')
-_shtab_ahriman_run_option_strings=('-h' '--help')
-_shtab_ahriman_search_option_strings=('-h' '--help' '-e' '--exit-code' '--info' '--no-info' '--sort-by')
-_shtab_ahriman_service_clean_option_strings=('-h' '--help' '--cache' '--no-cache' '--chroot' '--no-chroot' '--manual' '--no-manual' '--packages' '--no-packages' '--pacman' '--no-pacman')
-_shtab_ahriman_service_config_option_strings=('-h' '--help' '--info' '--no-info' '--secure' '--no-secure')
-_shtab_ahriman_service_config_validate_option_strings=('-h' '--help' '-e' '--exit-code')
-_shtab_ahriman_service_key_import_option_strings=('-h' '--help' '--key-server')
-_shtab_ahriman_service_repositories_option_strings=('-h' '--help' '--id-only' '--no-id-only')
-_shtab_ahriman_service_run_option_strings=('-h' '--help')
-_shtab_ahriman_service_setup_option_strings=('-h' '--help' '--build-as-user' '--from-configuration' '--generate-salt' '--no-generate-salt' '--makeflags-jobs' '--no-makeflags-jobs' '--mirror' '--multilib' '--no-multilib' '--packager' '--server' '--sign-key' '--sign-target' '--web-port' '--web-unix-socket')
-_shtab_ahriman_service_shell_option_strings=('-h' '--help' '-o' '--output')
-_shtab_ahriman_service_tree_migrate_option_strings=('-h' '--help')
-_shtab_ahriman_setup_option_strings=('-h' '--help' '--build-as-user' '--from-configuration' '--generate-salt' '--no-generate-salt' '--makeflags-jobs' '--no-makeflags-jobs' '--mirror' '--multilib' '--no-multilib' '--packager' '--server' '--sign-key' '--sign-target' '--web-port' '--web-unix-socket')
-_shtab_ahriman_shell_option_strings=('-h' '--help' '-o' '--output')
-_shtab_ahriman_sign_option_strings=('-h' '--help')
-_shtab_ahriman_status_option_strings=('-h' '--help' '--ahriman' '-e' '--exit-code' '--info' '--no-info' '-s' '--status')
-_shtab_ahriman_status_update_option_strings=('-h' '--help' '-s' '--status')
-_shtab_ahriman_sync_option_strings=('-h' '--help')
-_shtab_ahriman_update_option_strings=('-h' '--help' '--aur' '--no-aur' '--changes' '--no-changes' '--check-files' '--no-check-files' '--dependencies' '--no-dependencies' '--dry-run' '-e' '--exit-code' '--increment' '--no-increment' '--local' '--no-local' '--manual' '--no-manual' '-u' '--username' '--vcs' '--no-vcs' '-y' '--refresh')
-_shtab_ahriman_user_add_option_strings=('-h' '--help' '--key' '--packager' '-p' '--password' '-R' '--role')
-_shtab_ahriman_user_list_option_strings=('-h' '--help' '-e' '--exit-code' '-R' '--role')
-_shtab_ahriman_user_remove_option_strings=('-h' '--help')
-_shtab_ahriman_version_option_strings=('-h' '--help')
-_shtab_ahriman_web_option_strings=('-h' '--help')
-_shtab_ahriman_web_reload_option_strings=('-h' '--help')
+_shtab_ahriman_add_option_strings=(-h --help --changes --no-changes --dependencies --no-dependencies -e --exit-code --increment --no-increment -n --now -s --source -u --username -v --variable -y --refresh)
+_shtab_ahriman_aur_search_option_strings=(-h --help -e --exit-code --info --no-info --sort-by)
+_shtab_ahriman_check_option_strings=(-h --help --changes --no-changes --check-files --no-check-files -e --exit-code --vcs --no-vcs -y --refresh)
+_shtab_ahriman_clean_option_strings=(-h --help --cache --no-cache --chroot --no-chroot --manual --no-manual --packages --no-packages --pacman --no-pacman)
+_shtab_ahriman_config_option_strings=(-h --help --info --no-info --secure --no-secure)
+_shtab_ahriman_config_validate_option_strings=(-h --help -e --exit-code)
+_shtab_ahriman_copy_option_strings=(-h --help -e --exit-code --remove)
+_shtab_ahriman_daemon_option_strings=(-h --help -i --interval --aur --no-aur --changes --no-changes --check-files --no-check-files --dependencies --no-dependencies --dry-run --increment --no-increment --local --no-local --manual --no-manual --partitions --no-partitions -u --username --vcs --no-vcs -y --refresh)
+_shtab_ahriman_help_option_strings=(-h --help)
+_shtab_ahriman_help_commands_unsafe_option_strings=(-h --help)
+_shtab_ahriman_help_updates_option_strings=(-h --help -e --exit-code)
+_shtab_ahriman_help_version_option_strings=(-h --help)
+_shtab_ahriman_init_option_strings=(-h --help --build-as-user --from-configuration --generate-salt --no-generate-salt --makeflags-jobs --no-makeflags-jobs --mirror --multilib --no-multilib --packager --server --sign-key --sign-target --web-port --web-unix-socket)
+_shtab_ahriman_key_import_option_strings=(-h --help --key-server)
+_shtab_ahriman_package_add_option_strings=(-h --help --changes --no-changes --dependencies --no-dependencies -e --exit-code --increment --no-increment -n --now -s --source -u --username -v --variable -y --refresh)
+_shtab_ahriman_package_archives_option_strings=(-h --help -e --exit-code --info --no-info)
+_shtab_ahriman_package_changes_option_strings=(-h --help -e --exit-code)
+_shtab_ahriman_package_changes_remove_option_strings=(-h --help)
+_shtab_ahriman_package_copy_option_strings=(-h --help -e --exit-code --remove)
+_shtab_ahriman_package_hold_option_strings=(-h --help)
+_shtab_ahriman_package_pkgbuild_option_strings=(-h --help -e --exit-code)
+_shtab_ahriman_package_pkgbuild_remove_option_strings=(-h --help)
+_shtab_ahriman_package_remove_option_strings=(-h --help)
+_shtab_ahriman_package_rollback_option_strings=(-h --help --hold --no-hold -u --username)
+_shtab_ahriman_package_status_option_strings=(-h --help --ahriman -e --exit-code --info --no-info -s --status)
+_shtab_ahriman_package_status_remove_option_strings=(-h --help)
+_shtab_ahriman_package_status_update_option_strings=(-h --help -s --status)
+_shtab_ahriman_package_unhold_option_strings=(-h --help)
+_shtab_ahriman_package_update_option_strings=(-h --help --changes --no-changes --dependencies --no-dependencies -e --exit-code --increment --no-increment -n --now -s --source -u --username -v --variable -y --refresh)
+_shtab_ahriman_patch_add_option_strings=(-h --help)
+_shtab_ahriman_patch_list_option_strings=(-h --help -e --exit-code -v --variable)
+_shtab_ahriman_patch_remove_option_strings=(-h --help -v --variable)
+_shtab_ahriman_patch_set_add_option_strings=(-h --help -t --track)
+_shtab_ahriman_rebuild_option_strings=(-h --help --depends-on --dry-run --from-database --increment --no-increment -e --exit-code -s --status -u --username)
+_shtab_ahriman_remove_option_strings=(-h --help)
+_shtab_ahriman_remove_unknown_option_strings=(-h --help --dry-run)
+_shtab_ahriman_repo_backup_option_strings=(-h --help)
+_shtab_ahriman_repo_check_option_strings=(-h --help --changes --no-changes --check-files --no-check-files -e --exit-code --vcs --no-vcs -y --refresh)
+_shtab_ahriman_repo_clean_option_strings=(-h --help --cache --no-cache --chroot --no-chroot --manual --no-manual --packages --no-packages --pacman --no-pacman)
+_shtab_ahriman_repo_config_option_strings=(-h --help --info --no-info --secure --no-secure)
+_shtab_ahriman_repo_config_validate_option_strings=(-h --help -e --exit-code)
+_shtab_ahriman_repo_create_keyring_option_strings=(-h --help)
+_shtab_ahriman_repo_create_mirrorlist_option_strings=(-h --help)
+_shtab_ahriman_repo_daemon_option_strings=(-h --help -i --interval --aur --no-aur --changes --no-changes --check-files --no-check-files --dependencies --no-dependencies --dry-run --increment --no-increment --local --no-local --manual --no-manual --partitions --no-partitions -u --username --vcs --no-vcs -y --refresh)
+_shtab_ahriman_repo_init_option_strings=(-h --help --build-as-user --from-configuration --generate-salt --no-generate-salt --makeflags-jobs --no-makeflags-jobs --mirror --multilib --no-multilib --packager --server --sign-key --sign-target --web-port --web-unix-socket)
+_shtab_ahriman_repo_rebuild_option_strings=(-h --help --depends-on --dry-run --from-database --increment --no-increment -e --exit-code -s --status -u --username)
+_shtab_ahriman_repo_remove_unknown_option_strings=(-h --help --dry-run)
+_shtab_ahriman_repo_report_option_strings=(-h --help)
+_shtab_ahriman_repo_restore_option_strings=(-h --help -o --output)
+_shtab_ahriman_repo_setup_option_strings=(-h --help --build-as-user --from-configuration --generate-salt --no-generate-salt --makeflags-jobs --no-makeflags-jobs --mirror --multilib --no-multilib --packager --server --sign-key --sign-target --web-port --web-unix-socket)
+_shtab_ahriman_repo_sign_option_strings=(-h --help)
+_shtab_ahriman_repo_statistics_option_strings=(-h --help --chart -e --event --from-date --limit --offset --to-date)
+_shtab_ahriman_repo_status_update_option_strings=(-h --help -s --status)
+_shtab_ahriman_repo_sync_option_strings=(-h --help)
+_shtab_ahriman_repo_tree_option_strings=(-h --help -p --partitions)
+_shtab_ahriman_repo_triggers_option_strings=(-h --help)
+_shtab_ahriman_repo_update_option_strings=(-h --help --aur --no-aur --changes --no-changes --check-files --no-check-files --dependencies --no-dependencies --dry-run -e --exit-code --increment --no-increment --local --no-local --manual --no-manual -u --username --vcs --no-vcs -y --refresh)
+_shtab_ahriman_report_option_strings=(-h --help)
+_shtab_ahriman_run_option_strings=(-h --help)
+_shtab_ahriman_search_option_strings=(-h --help -e --exit-code --info --no-info --sort-by)
+_shtab_ahriman_service_clean_option_strings=(-h --help --cache --no-cache --chroot --no-chroot --manual --no-manual --packages --no-packages --pacman --no-pacman)
+_shtab_ahriman_service_config_option_strings=(-h --help --info --no-info --secure --no-secure)
+_shtab_ahriman_service_config_validate_option_strings=(-h --help -e --exit-code)
+_shtab_ahriman_service_key_import_option_strings=(-h --help --key-server)
+_shtab_ahriman_service_repositories_option_strings=(-h --help --id-only --no-id-only)
+_shtab_ahriman_service_run_option_strings=(-h --help)
+_shtab_ahriman_service_setup_option_strings=(-h --help --build-as-user --from-configuration --generate-salt --no-generate-salt --makeflags-jobs --no-makeflags-jobs --mirror --multilib --no-multilib --packager --server --sign-key --sign-target --web-port --web-unix-socket)
+_shtab_ahriman_service_shell_option_strings=(-h --help -o --output)
+_shtab_ahriman_service_tree_migrate_option_strings=(-h --help)
+_shtab_ahriman_setup_option_strings=(-h --help --build-as-user --from-configuration --generate-salt --no-generate-salt --makeflags-jobs --no-makeflags-jobs --mirror --multilib --no-multilib --packager --server --sign-key --sign-target --web-port --web-unix-socket)
+_shtab_ahriman_shell_option_strings=(-h --help -o --output)
+_shtab_ahriman_sign_option_strings=(-h --help)
+_shtab_ahriman_status_option_strings=(-h --help --ahriman -e --exit-code --info --no-info -s --status)
+_shtab_ahriman_status_update_option_strings=(-h --help -s --status)
+_shtab_ahriman_sync_option_strings=(-h --help)
+_shtab_ahriman_update_option_strings=(-h --help --aur --no-aur --changes --no-changes --check-files --no-check-files --dependencies --no-dependencies --dry-run -e --exit-code --increment --no-increment --local --no-local --manual --no-manual -u --username --vcs --no-vcs -y --refresh)
+_shtab_ahriman_user_add_option_strings=(-h --help --key --packager -p --password -R --role)
+_shtab_ahriman_user_list_option_strings=(-h --help -e --exit-code -R --role)
+_shtab_ahriman_user_remove_option_strings=(-h --help)
+_shtab_ahriman_version_option_strings=(-h --help)
+_shtab_ahriman_web_option_strings=(-h --help)
+_shtab_ahriman_web_reload_option_strings=(-h --help)
+_shtab_ahriman_option_strings=(-h --help -a --architecture -c --configuration --force -l --lock --log-handler -q --quiet --report --no-report -r --repository --unsafe -V --version --wait-timeout)
 
 
 
-_shtab_ahriman_pos_0_choices=('add' 'aur-search' 'check' 'clean' 'config' 'config-validate' 'copy' 'daemon' 'help' 'help-commands-unsafe' 'help-updates' 'help-version' 'init' 'key-import' 'package-add' 'package-archives' 'package-changes' 'package-changes-remove' 'package-copy' 'package-hold' 'package-pkgbuild' 'package-pkgbuild-remove' 'package-remove' 'package-rollback' 'package-status' 'package-status-remove' 'package-status-update' 'package-unhold' 'package-update' 'patch-add' 'patch-list' 'patch-remove' 'patch-set-add' 'rebuild' 'remove' 'remove-unknown' 'repo-backup' 'repo-check' 'repo-clean' 'repo-config' 'repo-config-validate' 'repo-create-keyring' 'repo-create-mirrorlist' 'repo-daemon' 'repo-init' 'repo-rebuild' 'repo-remove-unknown' 'repo-report' 'repo-restore' 'repo-setup' 'repo-sign' 'repo-statistics' 'repo-status-update' 'repo-sync' 'repo-tree' 'repo-triggers' 'repo-update' 'report' 'run' 'search' 'service-clean' 'service-config' 'service-config-validate' 'service-key-import' 'service-repositories' 'service-run' 'service-setup' 'service-shell' 'service-tree-migrate' 'setup' 'shell' 'sign' 'status' 'status-update' 'sync' 'update' 'user-add' 'user-list' 'user-remove' 'version' 'web' 'web-reload')
-_shtab_ahriman___log_handler_choices=('console' 'syslog' 'journald')
-_shtab_ahriman_add__s_choices=('auto' 'archive' 'aur' 'directory' 'local' 'remote' 'repository')
-_shtab_ahriman_add___source_choices=('auto' 'archive' 'aur' 'directory' 'local' 'remote' 'repository')
-_shtab_ahriman_aur_search___sort_by_choices=('description' 'first_submitted' 'id' 'last_modified' 'maintainer' 'name' 'num_votes' 'out_of_date' 'package_base' 'package_base_id' 'popularity' 'repository' 'submitter' 'url' 'url_path' 'version')
-_shtab_ahriman_init___sign_target_choices=('disabled' 'packages' 'repository')
-_shtab_ahriman_package_add__s_choices=('auto' 'archive' 'aur' 'directory' 'local' 'remote' 'repository')
-_shtab_ahriman_package_add___source_choices=('auto' 'archive' 'aur' 'directory' 'local' 'remote' 'repository')
-_shtab_ahriman_package_status__s_choices=('unknown' 'pending' 'building' 'failed' 'success')
-_shtab_ahriman_package_status___status_choices=('unknown' 'pending' 'building' 'failed' 'success')
-_shtab_ahriman_package_status_update__s_choices=('unknown' 'pending' 'building' 'failed' 'success')
-_shtab_ahriman_package_status_update___status_choices=('unknown' 'pending' 'building' 'failed' 'success')
-_shtab_ahriman_package_update__s_choices=('auto' 'archive' 'aur' 'directory' 'local' 'remote' 'repository')
-_shtab_ahriman_package_update___source_choices=('auto' 'archive' 'aur' 'directory' 'local' 'remote' 'repository')
-_shtab_ahriman_rebuild__s_choices=('unknown' 'pending' 'building' 'failed' 'success')
-_shtab_ahriman_rebuild___status_choices=('unknown' 'pending' 'building' 'failed' 'success')
-_shtab_ahriman_repo_init___sign_target_choices=('disabled' 'packages' 'repository')
-_shtab_ahriman_repo_rebuild__s_choices=('unknown' 'pending' 'building' 'failed' 'success')
-_shtab_ahriman_repo_rebuild___status_choices=('unknown' 'pending' 'building' 'failed' 'success')
-_shtab_ahriman_repo_setup___sign_target_choices=('disabled' 'packages' 'repository')
-_shtab_ahriman_repo_statistics__e_choices=('build-log' 'package-held' 'package-outdated' 'package-removed' 'package-status-changed' 'package-update-failed' 'package-updated' 'service-status-changed')
-_shtab_ahriman_repo_statistics___event_choices=('build-log' 'package-held' 'package-outdated' 'package-removed' 'package-status-changed' 'package-update-failed' 'package-updated' 'service-status-changed')
-_shtab_ahriman_repo_status_update__s_choices=('unknown' 'pending' 'building' 'failed' 'success')
-_shtab_ahriman_repo_status_update___status_choices=('unknown' 'pending' 'building' 'failed' 'success')
-_shtab_ahriman_search___sort_by_choices=('description' 'first_submitted' 'id' 'last_modified' 'maintainer' 'name' 'num_votes' 'out_of_date' 'package_base' 'package_base_id' 'popularity' 'repository' 'submitter' 'url' 'url_path' 'version')
-_shtab_ahriman_service_setup___sign_target_choices=('disabled' 'packages' 'repository')
-_shtab_ahriman_setup___sign_target_choices=('disabled' 'packages' 'repository')
-_shtab_ahriman_status__s_choices=('unknown' 'pending' 'building' 'failed' 'success')
-_shtab_ahriman_status___status_choices=('unknown' 'pending' 'building' 'failed' 'success')
-_shtab_ahriman_status_update__s_choices=('unknown' 'pending' 'building' 'failed' 'success')
-_shtab_ahriman_status_update___status_choices=('unknown' 'pending' 'building' 'failed' 'success')
-_shtab_ahriman_user_add__R_choices=('unauthorized' 'read' 'reporter' 'full')
-_shtab_ahriman_user_add___role_choices=('unauthorized' 'read' 'reporter' 'full')
-_shtab_ahriman_user_list__R_choices=('unauthorized' 'read' 'reporter' 'full')
-_shtab_ahriman_user_list___role_choices=('unauthorized' 'read' 'reporter' 'full')
+_shtab_ahriman_add__s_choices=(auto archive aur directory local remote repository)
+_shtab_ahriman_add___source_choices=(auto archive aur directory local remote repository)
+_shtab_ahriman_aur_search___sort_by_choices=(description first_submitted id last_modified maintainer name num_votes out_of_date package_base package_base_id popularity repository submitter url url_path version)
+_shtab_ahriman_init___sign_target_choices=(disabled packages repository)
+_shtab_ahriman_package_add__s_choices=(auto archive aur directory local remote repository)
+_shtab_ahriman_package_add___source_choices=(auto archive aur directory local remote repository)
+_shtab_ahriman_package_status__s_choices=(unknown pending building failed success)
+_shtab_ahriman_package_status___status_choices=(unknown pending building failed success)
+_shtab_ahriman_package_status_update__s_choices=(unknown pending building failed success)
+_shtab_ahriman_package_status_update___status_choices=(unknown pending building failed success)
+_shtab_ahriman_package_update__s_choices=(auto archive aur directory local remote repository)
+_shtab_ahriman_package_update___source_choices=(auto archive aur directory local remote repository)
+_shtab_ahriman_rebuild__s_choices=(unknown pending building failed success)
+_shtab_ahriman_rebuild___status_choices=(unknown pending building failed success)
+_shtab_ahriman_repo_init___sign_target_choices=(disabled packages repository)
+_shtab_ahriman_repo_rebuild__s_choices=(unknown pending building failed success)
+_shtab_ahriman_repo_rebuild___status_choices=(unknown pending building failed success)
+_shtab_ahriman_repo_setup___sign_target_choices=(disabled packages repository)
+_shtab_ahriman_repo_statistics__e_choices=(build-log package-held package-outdated package-removed package-status-changed package-update-failed package-updated service-status-changed)
+_shtab_ahriman_repo_statistics___event_choices=(build-log package-held package-outdated package-removed package-status-changed package-update-failed package-updated service-status-changed)
+_shtab_ahriman_repo_status_update__s_choices=(unknown pending building failed success)
+_shtab_ahriman_repo_status_update___status_choices=(unknown pending building failed success)
+_shtab_ahriman_search___sort_by_choices=(description first_submitted id last_modified maintainer name num_votes out_of_date package_base package_base_id popularity repository submitter url url_path version)
+_shtab_ahriman_service_setup___sign_target_choices=(disabled packages repository)
+_shtab_ahriman_setup___sign_target_choices=(disabled packages repository)
+_shtab_ahriman_status__s_choices=(unknown pending building failed success)
+_shtab_ahriman_status___status_choices=(unknown pending building failed success)
+_shtab_ahriman_status_update__s_choices=(unknown pending building failed success)
+_shtab_ahriman_status_update___status_choices=(unknown pending building failed success)
+_shtab_ahriman_user_add__R_choices=(unauthorized read reporter full)
+_shtab_ahriman_user_add___role_choices=(unauthorized read reporter full)
+_shtab_ahriman_user_list__R_choices=(unauthorized read reporter full)
+_shtab_ahriman_user_list___role_choices=(unauthorized read reporter full)
+_shtab_ahriman_pos_0_choices=(add aur-search check clean config config-validate copy daemon help help-commands-unsafe help-updates help-version init key-import package-add package-archives package-changes package-changes-remove package-copy package-hold package-pkgbuild package-pkgbuild-remove package-remove package-rollback package-status package-status-remove package-status-update package-unhold package-update patch-add patch-list patch-remove patch-set-add rebuild remove remove-unknown repo-backup repo-check repo-clean repo-config repo-config-validate repo-create-keyring repo-create-mirrorlist repo-daemon repo-init repo-rebuild repo-remove-unknown repo-report repo-restore repo-setup repo-sign repo-statistics repo-status-update repo-sync repo-tree repo-triggers repo-update report run search service-clean service-config service-config-validate service-key-import service-repositories service-run service-setup service-shell service-tree-migrate setup shell sign status status-update sync update user-add user-list user-remove version web web-reload)
+_shtab_ahriman___log_handler_choices=(console syslog journald)
 
-_shtab_ahriman_pos_0_nargs=A...
-_shtab_ahriman__h_nargs=0
-_shtab_ahriman___help_nargs=0
-_shtab_ahriman___force_nargs=0
-_shtab_ahriman__q_nargs=0
-_shtab_ahriman___quiet_nargs=0
-_shtab_ahriman___report_nargs=0
-_shtab_ahriman___no_report_nargs=0
-_shtab_ahriman___unsafe_nargs=0
-_shtab_ahriman__V_nargs=0
-_shtab_ahriman___version_nargs=0
 _shtab_ahriman_add_pos_0_nargs=+
 _shtab_ahriman_add__h_nargs=0
 _shtab_ahriman_add___help_nargs=0
@@ -157,7 +146,7 @@ _shtab_ahriman_aur_search__e_nargs=0
 _shtab_ahriman_aur_search___exit_code_nargs=0
 _shtab_ahriman_aur_search___info_nargs=0
 _shtab_ahriman_aur_search___no_info_nargs=0
-_shtab_ahriman_check_pos_0_nargs=*
+_shtab_ahriman_check_pos_0_nargs='*'
 _shtab_ahriman_check__h_nargs=0
 _shtab_ahriman_check___help_nargs=0
 _shtab_ahriman_check___changes_nargs=0
@@ -223,7 +212,7 @@ _shtab_ahriman_daemon__y_nargs=0
 _shtab_ahriman_daemon___refresh_nargs=0
 _shtab_ahriman_help__h_nargs=0
 _shtab_ahriman_help___help_nargs=0
-_shtab_ahriman_help_commands_unsafe_pos_0_nargs=*
+_shtab_ahriman_help_commands_unsafe_pos_0_nargs='*'
 _shtab_ahriman_help_commands_unsafe__h_nargs=0
 _shtab_ahriman_help_commands_unsafe___help_nargs=0
 _shtab_ahriman_help_updates__h_nargs=0
@@ -291,7 +280,7 @@ _shtab_ahriman_package_rollback__h_nargs=0
 _shtab_ahriman_package_rollback___help_nargs=0
 _shtab_ahriman_package_rollback___hold_nargs=0
 _shtab_ahriman_package_rollback___no_hold_nargs=0
-_shtab_ahriman_package_status_pos_0_nargs=*
+_shtab_ahriman_package_status_pos_0_nargs='*'
 _shtab_ahriman_package_status__h_nargs=0
 _shtab_ahriman_package_status___help_nargs=0
 _shtab_ahriman_package_status___ahriman_nargs=0
@@ -302,7 +291,7 @@ _shtab_ahriman_package_status___no_info_nargs=0
 _shtab_ahriman_package_status_remove_pos_0_nargs=+
 _shtab_ahriman_package_status_remove__h_nargs=0
 _shtab_ahriman_package_status_remove___help_nargs=0
-_shtab_ahriman_package_status_update_pos_0_nargs=*
+_shtab_ahriman_package_status_update_pos_0_nargs='*'
 _shtab_ahriman_package_status_update__h_nargs=0
 _shtab_ahriman_package_status_update___help_nargs=0
 _shtab_ahriman_package_unhold_pos_0_nargs=+
@@ -349,7 +338,7 @@ _shtab_ahriman_remove_unknown___help_nargs=0
 _shtab_ahriman_remove_unknown___dry_run_nargs=0
 _shtab_ahriman_repo_backup__h_nargs=0
 _shtab_ahriman_repo_backup___help_nargs=0
-_shtab_ahriman_repo_check_pos_0_nargs=*
+_shtab_ahriman_repo_check_pos_0_nargs='*'
 _shtab_ahriman_repo_check__h_nargs=0
 _shtab_ahriman_repo_check___help_nargs=0
 _shtab_ahriman_repo_check___changes_nargs=0
@@ -442,7 +431,7 @@ _shtab_ahriman_repo_setup___makeflags_jobs_nargs=0
 _shtab_ahriman_repo_setup___no_makeflags_jobs_nargs=0
 _shtab_ahriman_repo_setup___multilib_nargs=0
 _shtab_ahriman_repo_setup___no_multilib_nargs=0
-_shtab_ahriman_repo_sign_pos_0_nargs=*
+_shtab_ahriman_repo_sign_pos_0_nargs='*'
 _shtab_ahriman_repo_sign__h_nargs=0
 _shtab_ahriman_repo_sign___help_nargs=0
 _shtab_ahriman_repo_statistics__h_nargs=0
@@ -453,10 +442,10 @@ _shtab_ahriman_repo_sync__h_nargs=0
 _shtab_ahriman_repo_sync___help_nargs=0
 _shtab_ahriman_repo_tree__h_nargs=0
 _shtab_ahriman_repo_tree___help_nargs=0
-_shtab_ahriman_repo_triggers_pos_0_nargs=*
+_shtab_ahriman_repo_triggers_pos_0_nargs='*'
 _shtab_ahriman_repo_triggers__h_nargs=0
 _shtab_ahriman_repo_triggers___help_nargs=0
-_shtab_ahriman_repo_update_pos_0_nargs=*
+_shtab_ahriman_repo_update_pos_0_nargs='*'
 _shtab_ahriman_repo_update__h_nargs=0
 _shtab_ahriman_repo_update___help_nargs=0
 _shtab_ahriman_repo_update___aur_nargs=0
@@ -533,8 +522,6 @@ _shtab_ahriman_service_setup___multilib_nargs=0
 _shtab_ahriman_service_setup___no_multilib_nargs=0
 _shtab_ahriman_service_shell__h_nargs=0
 _shtab_ahriman_service_shell___help_nargs=0
-_shtab_ahriman_service_shell__v_nargs=0
-_shtab_ahriman_service_shell___verbose_nargs=0
 _shtab_ahriman_service_tree_migrate__h_nargs=0
 _shtab_ahriman_service_tree_migrate___help_nargs=0
 _shtab_ahriman_setup__h_nargs=0
@@ -547,12 +534,10 @@ _shtab_ahriman_setup___multilib_nargs=0
 _shtab_ahriman_setup___no_multilib_nargs=0
 _shtab_ahriman_shell__h_nargs=0
 _shtab_ahriman_shell___help_nargs=0
-_shtab_ahriman_shell__v_nargs=0
-_shtab_ahriman_shell___verbose_nargs=0
-_shtab_ahriman_sign_pos_0_nargs=*
+_shtab_ahriman_sign_pos_0_nargs='*'
 _shtab_ahriman_sign__h_nargs=0
 _shtab_ahriman_sign___help_nargs=0
-_shtab_ahriman_status_pos_0_nargs=*
+_shtab_ahriman_status_pos_0_nargs='*'
 _shtab_ahriman_status__h_nargs=0
 _shtab_ahriman_status___help_nargs=0
 _shtab_ahriman_status___ahriman_nargs=0
@@ -560,12 +545,12 @@ _shtab_ahriman_status__e_nargs=0
 _shtab_ahriman_status___exit_code_nargs=0
 _shtab_ahriman_status___info_nargs=0
 _shtab_ahriman_status___no_info_nargs=0
-_shtab_ahriman_status_update_pos_0_nargs=*
+_shtab_ahriman_status_update_pos_0_nargs='*'
 _shtab_ahriman_status_update__h_nargs=0
 _shtab_ahriman_status_update___help_nargs=0
 _shtab_ahriman_sync__h_nargs=0
 _shtab_ahriman_sync___help_nargs=0
-_shtab_ahriman_update_pos_0_nargs=*
+_shtab_ahriman_update_pos_0_nargs='*'
 _shtab_ahriman_update__h_nargs=0
 _shtab_ahriman_update___help_nargs=0
 _shtab_ahriman_update___aur_nargs=0
@@ -603,6 +588,17 @@ _shtab_ahriman_web__h_nargs=0
 _shtab_ahriman_web___help_nargs=0
 _shtab_ahriman_web_reload__h_nargs=0
 _shtab_ahriman_web_reload___help_nargs=0
+_shtab_ahriman_pos_0_nargs=A...
+_shtab_ahriman__h_nargs=0
+_shtab_ahriman___help_nargs=0
+_shtab_ahriman___force_nargs=0
+_shtab_ahriman__q_nargs=0
+_shtab_ahriman___quiet_nargs=0
+_shtab_ahriman___report_nargs=0
+_shtab_ahriman___no_report_nargs=0
+_shtab_ahriman___unsafe_nargs=0
+_shtab_ahriman__V_nargs=0
+_shtab_ahriman___version_nargs=0
 
 
 # $1=COMP_WORDS[1]
@@ -680,7 +676,7 @@ _shtab_ahriman() {
 
   local prefix=_shtab_ahriman
   local word_index=0
-  local pos_only=0 # "--" delimeter not encountered yet
+  local pos_only=0 # "--" delimiter not encountered yet
   _set_parser_defaults
   word_index=1
 
@@ -713,7 +709,7 @@ _shtab_ahriman() {
         _set_new_action "pos_${completed_positional_actions}" true
       fi
     else
-      pos_only=1 # "--" delimeter encountered
+      pos_only=1 # "--" delimiter encountered
     fi
 
     let "word_index+=1"
@@ -721,20 +717,21 @@ _shtab_ahriman() {
 
   # Generate the completions
 
+  COMPREPLY=()
   if [[ $pos_only = 0 && "${completing_word}" == -* ]]; then
     # optional argument started: use option strings
-    COMPREPLY=( $(compgen -W "${current_option_strings[*]}" -- "${completing_word}") )
-  elif [[ "${previous_word}" == ">" || "${previous_word}" == ">>" ||
-          "${previous_word}" =~ ^[12]">" || "${previous_word}" =~ ^[12]">>" ]]; then
+    while IFS= read -r line; do COMPREPLY+=("$line"); done < <(
+      compgen -W "${current_option_strings[*]}" -- "${completing_word}")
+  elif [[ "${previous_word}" =~ ^[0-9\&]*[\<\>]\>?$ ]]; then
     # handle redirection operators
-    COMPREPLY=( $(compgen -f -- "${completing_word}") )
+    while IFS= read -r line; do COMPREPLY+=("$line"); done < <(compgen -f -- "${completing_word}")
   else
     # use choices & compgen
-    local IFS=$'\n' # items may contain spaces, so delimit using newline
-    COMPREPLY=( $([ -n "${current_action_compgen}" ] \
-                  && "${current_action_compgen}" "${completing_word}") )
-    unset IFS
-    COMPREPLY+=( $(compgen -W "${current_action_choices[*]}" -- "${completing_word}") )
+    [ -n "${current_action_compgen}" ] &&
+      while IFS= read -r line; do COMPREPLY+=("$line"); done < <(
+        "${current_action_compgen}" "${completing_word}")
+    while IFS= read -r line; do COMPREPLY+=("$line"); done < <(
+      compgen -W "${current_action_choices[*]}" -- "${completing_word}")
   fi
 
   return 0

ahriman-core/package/share/man/man1/ahriman.1

@@ -1,4 +1,4 @@
-.TH AHRIMAN "1" "2026\-07\-21" "ahriman 2.21.1" "ArcH linux ReposItory MANager"
+.TH AHRIMAN "1" "2026\-08\-18" "ahriman 2.22.1" "ArcH linux ReposItory MANager"
 .SH NAME
 ahriman \- ArcH linux ReposItory MANager
 .SH SYNOPSIS
@@ -990,7 +990,7 @@ usage: ahriman service\-setup [\-h] [\-\-build\-as\-user BUILD_AS_USER] [\-\-fro
                              [\-\-sign\-key SIGN_KEY] [\-\-sign\-target {disabled,packages,repository}] [\-\-web\-port WEB_PORT]
                              [\-\-web\-unix\-socket WEB_UNIX_SOCKET]
 
-create initial service configuration, requires root
+create initial service configuration as the repository owner
 
 .SH OPTIONS \fI\,'ahriman service\-setup'\/\fR
 .TP

ahriman-core/package/share/zsh/site-functions/_ahriman

@@ -1,92 +1,92 @@
 #compdef ahriman
 
-# AUTOMATICALLY GENERATED by `shtab`
+# AUTOMATICALLY GENERATED by https://github.com/tqdm/shtab
 
 
 _shtab_ahriman_commands() {
   local _commands=(
-    "add:add existing or new package to the build queue"
-    "aur-search:search for package in AUR using API"
-    "check:check for packages updates. Same as repo-update --dry-run --no-manual"
-    "clean:remove local caches"
-    "config:dump configuration for the specified architecture"
-    "config-validate:validate configuration and print found errors"
-    "copy:copy package and its metadata from another repository"
-    "daemon:start process which periodically will run update process"
-    "help:show help message for application or command and exit"
-    "help-commands-unsafe:list unsafe commands as defined in default args"
-    "help-updates:request AUR for current version and compare with current service version"
-    "help-version:print application and its dependencies versions"
-    "init:create initial service configuration, requires root"
-    "key-import:import PGP key from public sources to the repository user"
-    "package-add:add existing or new package to the build queue"
-    "package-archives:list available archive versions for the package"
-    "package-changes:retrieve package changes stored in database"
-    "package-changes-remove:remove the package changes stored remotely"
-    "package-copy:copy package and its metadata from another repository"
-    "package-hold:hold package from automatic updates"
-    "package-pkgbuild:retrieve package PKGBUILD stored in database"
-    "package-pkgbuild-remove:remove the package PKGBUILD stored remotely"
-    "package-remove:remove package from the repository"
-    "package-rollback:rollback package to specified version from archives"
-    "package-status:request status of the package"
-    "package-status-remove:remove the package from the status page"
-    "package-status-update:update package status on the status page"
-    "package-unhold:remove package hold, allowing automatic updates"
-    "package-update:add existing or new package to the build queue"
-    "patch-add:create or update patched PKGBUILD function or variable"
-    "patch-list:list available patches for the package"
-    "patch-remove:remove patches for the package"
-    "patch-set-add:create or update source patches"
-    "rebuild:force rebuild whole repository"
-    "remove:remove package from the repository"
-    "remove-unknown:remove packages which are missing in AUR and do not have local PKGBUILDs"
-    "repo-backup:backup repository settings and database"
-    "repo-check:check for packages updates. Same as repo-update --dry-run --no-manual"
-    "repo-clean:remove local caches"
-    "repo-config:dump configuration for the specified architecture"
-    "repo-config-validate:validate configuration and print found errors"
-    "repo-create-keyring:create package which contains list of trusted keys as set by configuration. Note, that this action will only create package, the package itself has to be built manually"
-    "repo-create-mirrorlist:create package which contains list of available mirrors as set by configuration. Note, that this action will only create package, the package itself has to be built manually"
-    "repo-daemon:start process which periodically will run update process"
-    "repo-init:create initial service configuration, requires root"
-    "repo-rebuild:force rebuild whole repository"
-    "repo-remove-unknown:remove packages which are missing in AUR and do not have local PKGBUILDs"
-    "repo-report:generate repository report according to current settings"
-    "repo-restore:restore settings and database"
-    "repo-setup:create initial service configuration, requires root"
-    "repo-sign:(re-)sign packages and repository database according to current settings"
-    "repo-statistics:fetch repository statistics"
-    "repo-status-update:update repository status on the status page"
-    "repo-sync:sync repository files to remote server according to current settings"
-    "repo-tree:dump repository tree based on packages dependencies"
-    "repo-triggers:run triggers on empty build result as configured by settings"
-    "repo-update:check for packages updates and run build process if requested"
-    "report:generate repository report according to current settings"
-    "run:run multiple commands on success run of the previous command"
-    "search:search for package in AUR using API"
-    "service-clean:remove local caches"
-    "service-config:dump configuration for the specified architecture"
-    "service-config-validate:validate configuration and print found errors"
-    "service-key-import:import PGP key from public sources to the repository user"
-    "service-repositories:list all available repositories"
-    "service-run:run multiple commands on success run of the previous command"
-    "service-setup:create initial service configuration, requires root"
-    "service-shell:drop into python shell"
-    "service-tree-migrate:migrate repository tree between versions"
-    "setup:create initial service configuration, requires root"
-    "shell:drop into python shell"
-    "sign:(re-)sign packages and repository database according to current settings"
-    "status:request status of the package"
-    "status-update:update package status on the status page"
-    "sync:sync repository files to remote server according to current settings"
-    "update:check for packages updates and run build process if requested"
-    "user-add:update user for web services with the given password and role. In case if password was not entered it will be asked interactively"
-    "user-list:list users from the user mapping and their roles"
-    "user-remove:remove user from the user mapping and update the configuration"
-    "version:print application and its dependencies versions"
-    "web:start web server"
-    "web-reload:reload web server configuration"
+    add:'add existing or new package to the build queue'
+    aur-search:'search for package in AUR using API'
+    check:'check for packages updates. Same as repo-update --dry-run --no-manual'
+    clean:'remove local caches'
+    config:'dump configuration for the specified architecture'
+    config-validate:'validate configuration and print found errors'
+    copy:'copy package and its metadata from another repository'
+    daemon:'start process which periodically will run update process'
+    help:'show help message for application or command and exit'
+    help-commands-unsafe:'list unsafe commands as defined in default args'
+    help-updates:'request AUR for current version and compare with current service version'
+    help-version:'print application and its dependencies versions'
+    init:'create initial service configuration as the repository owner'
+    key-import:'import PGP key from public sources to the repository user'
+    package-add:'add existing or new package to the build queue'
+    package-archives:'list available archive versions for the package'
+    package-changes:'retrieve package changes stored in database'
+    package-changes-remove:'remove the package changes stored remotely'
+    package-copy:'copy package and its metadata from another repository'
+    package-hold:'hold package from automatic updates'
+    package-pkgbuild:'retrieve package PKGBUILD stored in database'
+    package-pkgbuild-remove:'remove the package PKGBUILD stored remotely'
+    package-remove:'remove package from the repository'
+    package-rollback:'rollback package to specified version from archives'
+    package-status:'request status of the package'
+    package-status-remove:'remove the package from the status page'
+    package-status-update:'update package status on the status page'
+    package-unhold:'remove package hold, allowing automatic updates'
+    package-update:'add existing or new package to the build queue'
+    patch-add:'create or update patched PKGBUILD function or variable'
+    patch-list:'list available patches for the package'
+    patch-remove:'remove patches for the package'
+    patch-set-add:'create or update source patches'
+    rebuild:'force rebuild whole repository'
+    remove:'remove package from the repository'
+    remove-unknown:'remove packages which are missing in AUR and do not have local PKGBUILDs'
+    repo-backup:'backup repository settings and database'
+    repo-check:'check for packages updates. Same as repo-update --dry-run --no-manual'
+    repo-clean:'remove local caches'
+    repo-config:'dump configuration for the specified architecture'
+    repo-config-validate:'validate configuration and print found errors'
+    repo-create-keyring:'create package which contains list of trusted keys as set by configuration. Note, that this action will only create package, the package itself has to be built manually'
+    repo-create-mirrorlist:'create package which contains list of available mirrors as set by configuration. Note, that this action will only create package, the package itself has to be built manually'
+    repo-daemon:'start process which periodically will run update process'
+    repo-init:'create initial service configuration as the repository owner'
+    repo-rebuild:'force rebuild whole repository'
+    repo-remove-unknown:'remove packages which are missing in AUR and do not have local PKGBUILDs'
+    repo-report:'generate repository report according to current settings'
+    repo-restore:'restore settings and database'
+    repo-setup:'create initial service configuration as the repository owner'
+    repo-sign:'(re-)sign packages and repository database according to current settings'
+    repo-statistics:'fetch repository statistics'
+    repo-status-update:'update repository status on the status page'
+    repo-sync:'sync repository files to remote server according to current settings'
+    repo-tree:'dump repository tree based on packages dependencies'
+    repo-triggers:'run triggers on empty build result as configured by settings'
+    repo-update:'check for packages updates and run build process if requested'
+    report:'generate repository report according to current settings'
+    run:'run multiple commands on success run of the previous command'
+    search:'search for package in AUR using API'
+    service-clean:'remove local caches'
+    service-config:'dump configuration for the specified architecture'
+    service-config-validate:'validate configuration and print found errors'
+    service-key-import:'import PGP key from public sources to the repository user'
+    service-repositories:'list all available repositories'
+    service-run:'run multiple commands on success run of the previous command'
+    service-setup:'create initial service configuration as the repository owner'
+    service-shell:'drop into python shell'
+    service-tree-migrate:'migrate repository tree between versions'
+    setup:'create initial service configuration as the repository owner'
+    shell:'drop into python shell'
+    sign:'(re-)sign packages and repository database according to current settings'
+    status:'request status of the package'
+    status-update:'update package status on the status page'
+    sync:'sync repository files to remote server according to current settings'
+    update:'check for packages updates and run build process if requested'
+    user-add:'update user for web services with the given password and role. In case if password was not entered it will be asked interactively'
+    user-list:'list users from the user mapping and their roles'
+    user-remove:'remove user from the user mapping and update the configuration'
+    version:'print application and its dependencies versions'
+    web:'start web server'
+    web-reload:'reload web server configuration'
   )
   _describe 'ahriman commands' _commands
 }
@@ -99,7 +99,7 @@ _shtab_ahriman_options=(
   {-l,--lock}"[lock file (default\: ahriman.pid)]:lock:"
   "--log-handler[explicit log handler specification. If none set, the handler will be guessed from environment (default\: None)]:log_handler:(console syslog journald)"
   {-q,--quiet}"[force disable any logging (default\: False)]"
-  {--report,--no-report}"[force enable or disable reporting to web service (default\: True)]:report:"
+  {--report,--no-report}"[force enable or disable reporting to web service (default\: True)]"
   {-r,--repository}"[filter by target repository (default\: None)]:repository:"
   "--unsafe[allow to run ahriman as non-ahriman user. Some actions might be unavailable (default\: False)]"
   "(- : *)"{-V,--version}"[show program\'s version number and exit]"
@@ -111,10 +111,10 @@ _shtab_ahriman_defaults_added=0
 
 _shtab_ahriman_add_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--changes,--no-changes}"[calculate changes from the latest known commit if available (default\: True)]:changes:"
-  {--dependencies,--no-dependencies}"[process missing package dependencies (default\: True)]:dependencies:"
+  {--changes,--no-changes}"[calculate changes from the latest known commit if available (default\: True)]"
+  {--dependencies,--no-dependencies}"[process missing package dependencies (default\: True)]"
   {-e,--exit-code}"[return non-zero exit status if result is empty (default\: False)]"
-  {--increment,--no-increment}"[increment package release (pkgrel) version on duplicate (default\: True)]:increment:"
+  {--increment,--no-increment}"[increment package release (pkgrel) version on duplicate (default\: True)]"
   {-n,--now}"[run update function after (default\: False)]"
   {-s,--source}"[explicitly specify the package source for this command (default\: auto)]:source:(auto archive aur directory local remote repository)"
   {-u,--username}"[build as user (default\: None)]:username:"
@@ -129,7 +129,7 @@ _shtab_ahriman_add_defaults_added=0
 _shtab_ahriman_aur_search_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
   {-e,--exit-code}"[return non-zero exit status if result is empty (default\: False)]"
-  {--info,--no-info}"[show additional package information (default\: False)]:info:"
+  {--info,--no-info}"[show additional package information (default\: False)]"
   "--sort-by[sort field by this field. In case if two packages have the same value of the specified field, they will be always sorted by name (default\: name)]:sort_by:(description first_submitted id last_modified maintainer name num_votes out_of_date package_base package_base_id popularity repository submitter url url_path version)"
   "(*):search terms, can be specified multiple times, the result will match all terms:"
 )
@@ -139,10 +139,10 @@ _shtab_ahriman_aur_search_defaults_added=0
 
 _shtab_ahriman_check_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--changes,--no-changes}"[calculate changes from the latest known commit if available (default\: True)]:changes:"
-  {--check-files,--no-check-files}"[enable or disable checking of broken dependencies (e.g. dynamically linked libraries or modules directories) (default\: True)]:check_files:"
+  {--changes,--no-changes}"[calculate changes from the latest known commit if available (default\: True)]"
+  {--check-files,--no-check-files}"[enable or disable checking of broken dependencies (e.g. dynamically linked libraries or modules directories) (default\: True)]"
   {-e,--exit-code}"[return non-zero exit status if result is empty (default\: False)]"
-  {--vcs,--no-vcs}"[fetch actual version of VCS packages (default\: True)]:vcs:"
+  {--vcs,--no-vcs}"[fetch actual version of VCS packages (default\: True)]"
   "*"{-y,--refresh}"[download fresh package databases from the mirror before actions, -yy to force refresh even if up to date (default\: False)]"
   "(*)::filter check by package base (default\: None):"
 )
@@ -152,11 +152,11 @@ _shtab_ahriman_check_defaults_added=0
 
 _shtab_ahriman_clean_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--cache,--no-cache}"[clear directory with package caches (default\: False)]:cache:"
-  {--chroot,--no-chroot}"[clear build chroot (default\: False)]:chroot:"
-  {--manual,--no-manual}"[clear manually added packages queue (default\: False)]:manual:"
-  {--packages,--no-packages}"[clear directory with built packages (default\: False)]:packages:"
-  {--pacman,--no-pacman}"[clear directory with pacman local database cache (default\: False)]:pacman:"
+  {--cache,--no-cache}"[clear directory with package caches (default\: False)]"
+  {--chroot,--no-chroot}"[clear build chroot (default\: False)]"
+  {--manual,--no-manual}"[clear manually added packages queue (default\: False)]"
+  {--packages,--no-packages}"[clear directory with built packages (default\: False)]"
+  {--pacman,--no-pacman}"[clear directory with pacman local database cache (default\: False)]"
 )
 
 # guard to ensure default positional specs are added only once per session
@@ -164,8 +164,8 @@ _shtab_ahriman_clean_defaults_added=0
 
 _shtab_ahriman_config_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--info,--no-info}"[show additional information, e.g. configuration files (default\: True)]:info:"
-  {--secure,--no-secure}"[hide passwords and secrets from output (default\: True)]:secure:"
+  {--info,--no-info}"[show additional information, e.g. configuration files (default\: True)]"
+  {--secure,--no-secure}"[hide passwords and secrets from output (default\: True)]"
   ":filter settings by section (default\: None):"
   ":filter settings by key (default\: None):"
 )
@@ -195,17 +195,17 @@ _shtab_ahriman_copy_defaults_added=0
 _shtab_ahriman_daemon_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
   {-i,--interval}"[interval between runs in seconds (default\: 43200)]:interval:"
-  {--aur,--no-aur}"[enable or disable checking for AUR updates (default\: True)]:aur:"
-  {--changes,--no-changes}"[calculate changes from the latest known commit if available. Only applicable in dry run mode (default\: True)]:changes:"
-  {--check-files,--no-check-files}"[enable or disable checking of broken dependencies (e.g. dynamically linked libraries or modules directories) (default\: True)]:check_files:"
-  {--dependencies,--no-dependencies}"[process missing package dependencies (default\: True)]:dependencies:"
+  {--aur,--no-aur}"[enable or disable checking for AUR updates (default\: True)]"
+  {--changes,--no-changes}"[calculate changes from the latest known commit if available. Only applicable in dry run mode (default\: True)]"
+  {--check-files,--no-check-files}"[enable or disable checking of broken dependencies (e.g. dynamically linked libraries or modules directories) (default\: True)]"
+  {--dependencies,--no-dependencies}"[process missing package dependencies (default\: True)]"
   "--dry-run[just perform check for updates, same as check command (default\: False)]"
-  {--increment,--no-increment}"[increment package release (pkgrel) on duplicate (default\: True)]:increment:"
-  {--local,--no-local}"[enable or disable checking of local packages for updates (default\: True)]:local:"
-  {--manual,--no-manual}"[include or exclude manual updates (default\: True)]:manual:"
-  {--partitions,--no-partitions}"[instead of updating whole repository, split updates into chunks (default\: True)]:partitions:"
+  {--increment,--no-increment}"[increment package release (pkgrel) on duplicate (default\: True)]"
+  {--local,--no-local}"[enable or disable checking of local packages for updates (default\: True)]"
+  {--manual,--no-manual}"[include or exclude manual updates (default\: True)]"
+  {--partitions,--no-partitions}"[instead of updating whole repository, split updates into chunks (default\: True)]"
   {-u,--username}"[build as user (default\: None)]:username:"
-  {--vcs,--no-vcs}"[fetch actual version of VCS packages (default\: True)]:vcs:"
+  {--vcs,--no-vcs}"[fetch actual version of VCS packages (default\: True)]"
   "*"{-y,--refresh}"[download fresh package databases from the mirror before actions, -yy to force refresh even if up to date (default\: False)]"
 )
 
@@ -247,10 +247,10 @@ _shtab_ahriman_init_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
   "--build-as-user[force makepkg user to the specific one (default\: None)]:build_as_user:"
   "--from-configuration[path to default devtools pacman configuration (default\: \/usr\/share\/devtools\/pacman.conf.d\/extra.conf)]:from_configuration:"
-  {--generate-salt,--no-generate-salt}"[generate salt for user passwords (default\: False)]:generate_salt:"
-  {--makeflags-jobs,--no-makeflags-jobs}"[append MAKEFLAGS variable with parallelism set to number of cores (default\: True)]:makeflags_jobs:"
+  {--generate-salt,--no-generate-salt}"[generate salt for user passwords (default\: False)]"
+  {--makeflags-jobs,--no-makeflags-jobs}"[append MAKEFLAGS variable with parallelism set to number of cores (default\: True)]"
   "--mirror[use the specified explicitly mirror instead of including mirrorlist (default\: None)]:mirror:"
-  {--multilib,--no-multilib}"[add or do not multilib repository (default\: True)]:multilib:"
+  {--multilib,--no-multilib}"[add or do not multilib repository (default\: True)]"
   "--packager[packager name and email]:packager:"
   "--server[server to be used for devtools. If none set, local files will be used (default\: None)]:server:"
   "--sign-key[sign key id (default\: None)]:sign_key:"
@@ -273,10 +273,10 @@ _shtab_ahriman_key_import_defaults_added=0
 
 _shtab_ahriman_package_add_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--changes,--no-changes}"[calculate changes from the latest known commit if available (default\: True)]:changes:"
-  {--dependencies,--no-dependencies}"[process missing package dependencies (default\: True)]:dependencies:"
+  {--changes,--no-changes}"[calculate changes from the latest known commit if available (default\: True)]"
+  {--dependencies,--no-dependencies}"[process missing package dependencies (default\: True)]"
   {-e,--exit-code}"[return non-zero exit status if result is empty (default\: False)]"
-  {--increment,--no-increment}"[increment package release (pkgrel) version on duplicate (default\: True)]:increment:"
+  {--increment,--no-increment}"[increment package release (pkgrel) version on duplicate (default\: True)]"
   {-n,--now}"[run update function after (default\: False)]"
   {-s,--source}"[explicitly specify the package source for this command (default\: auto)]:source:(auto archive aur directory local remote repository)"
   {-u,--username}"[build as user (default\: None)]:username:"
@@ -291,7 +291,7 @@ _shtab_ahriman_package_add_defaults_added=0
 _shtab_ahriman_package_archives_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
   {-e,--exit-code}"[return non-zero exit status if result is empty (default\: False)]"
-  {--info,--no-info}"[show additional package information (default\: False)]:info:"
+  {--info,--no-info}"[show additional package information (default\: False)]"
   ":package base:"
 )
 
@@ -361,7 +361,7 @@ _shtab_ahriman_package_remove_defaults_added=0
 
 _shtab_ahriman_package_rollback_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--hold,--no-hold}"[hold package afterwards (default\: True)]:hold:"
+  {--hold,--no-hold}"[hold package afterwards (default\: True)]"
   {-u,--username}"[build as user (default\: None)]:username:"
   ":package base:"
   ":package version:"
@@ -374,7 +374,7 @@ _shtab_ahriman_package_status_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
   "--ahriman[get service status itself (default\: False)]"
   {-e,--exit-code}"[return non-zero exit status if result is empty (default\: False)]"
-  {--info,--no-info}"[show additional package information (default\: False)]:info:"
+  {--info,--no-info}"[show additional package information (default\: False)]"
   {-s,--status}"[filter packages by status (default\: None)]:status:(unknown pending building failed success)"
   "(*)::filter status by package base (default\: None):"
 )
@@ -409,10 +409,10 @@ _shtab_ahriman_package_unhold_defaults_added=0
 
 _shtab_ahriman_package_update_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--changes,--no-changes}"[calculate changes from the latest known commit if available (default\: True)]:changes:"
-  {--dependencies,--no-dependencies}"[process missing package dependencies (default\: True)]:dependencies:"
+  {--changes,--no-changes}"[calculate changes from the latest known commit if available (default\: True)]"
+  {--dependencies,--no-dependencies}"[process missing package dependencies (default\: True)]"
   {-e,--exit-code}"[return non-zero exit status if result is empty (default\: False)]"
-  {--increment,--no-increment}"[increment package release (pkgrel) version on duplicate (default\: True)]:increment:"
+  {--increment,--no-increment}"[increment package release (pkgrel) version on duplicate (default\: True)]"
   {-n,--now}"[run update function after (default\: False)]"
   {-s,--source}"[explicitly specify the package source for this command (default\: auto)]:source:(auto archive aur directory local remote repository)"
   {-u,--username}"[build as user (default\: None)]:username:"
@@ -467,7 +467,7 @@ _shtab_ahriman_rebuild_options=(
   "*--depends-on[only rebuild packages that depend on specified packages (default\: None)]:depends_on:"
   "--dry-run[just perform check for packages without rebuild process itself (default\: False)]"
   "--from-database[read packages from database instead of filesystem. This feature in particular is required in case if you would like to restore repository from another repository instance. Note, however, that in order to restore packages you need to have original ahriman instance run with web service and have run repo-update at least once. (default\: False)]"
-  {--increment,--no-increment}"[increment package release (pkgrel) on duplicate (default\: True)]:increment:"
+  {--increment,--no-increment}"[increment package release (pkgrel) on duplicate (default\: True)]"
   {-e,--exit-code}"[return non-zero exit status if result is empty (default\: False)]"
   {-s,--status}"[filter packages by status. Requires --from-database to be set (default\: None)]:status:(unknown pending building failed success)"
   {-u,--username}"[build as user (default\: None)]:username:"
@@ -502,10 +502,10 @@ _shtab_ahriman_repo_backup_defaults_added=0
 
 _shtab_ahriman_repo_check_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--changes,--no-changes}"[calculate changes from the latest known commit if available (default\: True)]:changes:"
-  {--check-files,--no-check-files}"[enable or disable checking of broken dependencies (e.g. dynamically linked libraries or modules directories) (default\: True)]:check_files:"
+  {--changes,--no-changes}"[calculate changes from the latest known commit if available (default\: True)]"
+  {--check-files,--no-check-files}"[enable or disable checking of broken dependencies (e.g. dynamically linked libraries or modules directories) (default\: True)]"
   {-e,--exit-code}"[return non-zero exit status if result is empty (default\: False)]"
-  {--vcs,--no-vcs}"[fetch actual version of VCS packages (default\: True)]:vcs:"
+  {--vcs,--no-vcs}"[fetch actual version of VCS packages (default\: True)]"
   "*"{-y,--refresh}"[download fresh package databases from the mirror before actions, -yy to force refresh even if up to date (default\: False)]"
   "(*)::filter check by package base (default\: None):"
 )
@@ -515,11 +515,11 @@ _shtab_ahriman_repo_check_defaults_added=0
 
 _shtab_ahriman_repo_clean_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--cache,--no-cache}"[clear directory with package caches (default\: False)]:cache:"
-  {--chroot,--no-chroot}"[clear build chroot (default\: False)]:chroot:"
-  {--manual,--no-manual}"[clear manually added packages queue (default\: False)]:manual:"
-  {--packages,--no-packages}"[clear directory with built packages (default\: False)]:packages:"
-  {--pacman,--no-pacman}"[clear directory with pacman local database cache (default\: False)]:pacman:"
+  {--cache,--no-cache}"[clear directory with package caches (default\: False)]"
+  {--chroot,--no-chroot}"[clear build chroot (default\: False)]"
+  {--manual,--no-manual}"[clear manually added packages queue (default\: False)]"
+  {--packages,--no-packages}"[clear directory with built packages (default\: False)]"
+  {--pacman,--no-pacman}"[clear directory with pacman local database cache (default\: False)]"
 )
 
 # guard to ensure default positional specs are added only once per session
@@ -527,8 +527,8 @@ _shtab_ahriman_repo_clean_defaults_added=0
 
 _shtab_ahriman_repo_config_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--info,--no-info}"[show additional information, e.g. configuration files (default\: True)]:info:"
-  {--secure,--no-secure}"[hide passwords and secrets from output (default\: True)]:secure:"
+  {--info,--no-info}"[show additional information, e.g. configuration files (default\: True)]"
+  {--secure,--no-secure}"[hide passwords and secrets from output (default\: True)]"
   ":filter settings by section (default\: None):"
   ":filter settings by key (default\: None):"
 )
@@ -561,17 +561,17 @@ _shtab_ahriman_repo_create_mirrorlist_defaults_added=0
 _shtab_ahriman_repo_daemon_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
   {-i,--interval}"[interval between runs in seconds (default\: 43200)]:interval:"
-  {--aur,--no-aur}"[enable or disable checking for AUR updates (default\: True)]:aur:"
-  {--changes,--no-changes}"[calculate changes from the latest known commit if available. Only applicable in dry run mode (default\: True)]:changes:"
-  {--check-files,--no-check-files}"[enable or disable checking of broken dependencies (e.g. dynamically linked libraries or modules directories) (default\: True)]:check_files:"
-  {--dependencies,--no-dependencies}"[process missing package dependencies (default\: True)]:dependencies:"
+  {--aur,--no-aur}"[enable or disable checking for AUR updates (default\: True)]"
+  {--changes,--no-changes}"[calculate changes from the latest known commit if available. Only applicable in dry run mode (default\: True)]"
+  {--check-files,--no-check-files}"[enable or disable checking of broken dependencies (e.g. dynamically linked libraries or modules directories) (default\: True)]"
+  {--dependencies,--no-dependencies}"[process missing package dependencies (default\: True)]"
   "--dry-run[just perform check for updates, same as check command (default\: False)]"
-  {--increment,--no-increment}"[increment package release (pkgrel) on duplicate (default\: True)]:increment:"
-  {--local,--no-local}"[enable or disable checking of local packages for updates (default\: True)]:local:"
-  {--manual,--no-manual}"[include or exclude manual updates (default\: True)]:manual:"
-  {--partitions,--no-partitions}"[instead of updating whole repository, split updates into chunks (default\: True)]:partitions:"
+  {--increment,--no-increment}"[increment package release (pkgrel) on duplicate (default\: True)]"
+  {--local,--no-local}"[enable or disable checking of local packages for updates (default\: True)]"
+  {--manual,--no-manual}"[include or exclude manual updates (default\: True)]"
+  {--partitions,--no-partitions}"[instead of updating whole repository, split updates into chunks (default\: True)]"
   {-u,--username}"[build as user (default\: None)]:username:"
-  {--vcs,--no-vcs}"[fetch actual version of VCS packages (default\: True)]:vcs:"
+  {--vcs,--no-vcs}"[fetch actual version of VCS packages (default\: True)]"
   "*"{-y,--refresh}"[download fresh package databases from the mirror before actions, -yy to force refresh even if up to date (default\: False)]"
 )
 
@@ -582,10 +582,10 @@ _shtab_ahriman_repo_init_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
   "--build-as-user[force makepkg user to the specific one (default\: None)]:build_as_user:"
   "--from-configuration[path to default devtools pacman configuration (default\: \/usr\/share\/devtools\/pacman.conf.d\/extra.conf)]:from_configuration:"
-  {--generate-salt,--no-generate-salt}"[generate salt for user passwords (default\: False)]:generate_salt:"
-  {--makeflags-jobs,--no-makeflags-jobs}"[append MAKEFLAGS variable with parallelism set to number of cores (default\: True)]:makeflags_jobs:"
+  {--generate-salt,--no-generate-salt}"[generate salt for user passwords (default\: False)]"
+  {--makeflags-jobs,--no-makeflags-jobs}"[append MAKEFLAGS variable with parallelism set to number of cores (default\: True)]"
   "--mirror[use the specified explicitly mirror instead of including mirrorlist (default\: None)]:mirror:"
-  {--multilib,--no-multilib}"[add or do not multilib repository (default\: True)]:multilib:"
+  {--multilib,--no-multilib}"[add or do not multilib repository (default\: True)]"
   "--packager[packager name and email]:packager:"
   "--server[server to be used for devtools. If none set, local files will be used (default\: None)]:server:"
   "--sign-key[sign key id (default\: None)]:sign_key:"
@@ -602,7 +602,7 @@ _shtab_ahriman_repo_rebuild_options=(
   "*--depends-on[only rebuild packages that depend on specified packages (default\: None)]:depends_on:"
   "--dry-run[just perform check for packages without rebuild process itself (default\: False)]"
   "--from-database[read packages from database instead of filesystem. This feature in particular is required in case if you would like to restore repository from another repository instance. Note, however, that in order to restore packages you need to have original ahriman instance run with web service and have run repo-update at least once. (default\: False)]"
-  {--increment,--no-increment}"[increment package release (pkgrel) on duplicate (default\: True)]:increment:"
+  {--increment,--no-increment}"[increment package release (pkgrel) on duplicate (default\: True)]"
   {-e,--exit-code}"[return non-zero exit status if result is empty (default\: False)]"
   {-s,--status}"[filter packages by status. Requires --from-database to be set (default\: None)]:status:(unknown pending building failed success)"
   {-u,--username}"[build as user (default\: None)]:username:"
@@ -639,10 +639,10 @@ _shtab_ahriman_repo_setup_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
   "--build-as-user[force makepkg user to the specific one (default\: None)]:build_as_user:"
   "--from-configuration[path to default devtools pacman configuration (default\: \/usr\/share\/devtools\/pacman.conf.d\/extra.conf)]:from_configuration:"
-  {--generate-salt,--no-generate-salt}"[generate salt for user passwords (default\: False)]:generate_salt:"
-  {--makeflags-jobs,--no-makeflags-jobs}"[append MAKEFLAGS variable with parallelism set to number of cores (default\: True)]:makeflags_jobs:"
+  {--generate-salt,--no-generate-salt}"[generate salt for user passwords (default\: False)]"
+  {--makeflags-jobs,--no-makeflags-jobs}"[append MAKEFLAGS variable with parallelism set to number of cores (default\: True)]"
   "--mirror[use the specified explicitly mirror instead of including mirrorlist (default\: None)]:mirror:"
-  {--multilib,--no-multilib}"[add or do not multilib repository (default\: True)]:multilib:"
+  {--multilib,--no-multilib}"[add or do not multilib repository (default\: True)]"
   "--packager[packager name and email]:packager:"
   "--server[server to be used for devtools. If none set, local files will be used (default\: None)]:server:"
   "--sign-key[sign key id (default\: None)]:sign_key:"
@@ -709,17 +709,17 @@ _shtab_ahriman_repo_triggers_defaults_added=0
 
 _shtab_ahriman_repo_update_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--aur,--no-aur}"[enable or disable checking for AUR updates (default\: True)]:aur:"
-  {--changes,--no-changes}"[calculate changes from the latest known commit if available. Only applicable in dry run mode (default\: True)]:changes:"
-  {--check-files,--no-check-files}"[enable or disable checking of broken dependencies (e.g. dynamically linked libraries or modules directories) (default\: True)]:check_files:"
-  {--dependencies,--no-dependencies}"[process missing package dependencies (default\: True)]:dependencies:"
+  {--aur,--no-aur}"[enable or disable checking for AUR updates (default\: True)]"
+  {--changes,--no-changes}"[calculate changes from the latest known commit if available. Only applicable in dry run mode (default\: True)]"
+  {--check-files,--no-check-files}"[enable or disable checking of broken dependencies (e.g. dynamically linked libraries or modules directories) (default\: True)]"
+  {--dependencies,--no-dependencies}"[process missing package dependencies (default\: True)]"
   "--dry-run[just perform check for updates, same as check command (default\: False)]"
   {-e,--exit-code}"[return non-zero exit status if result is empty (default\: False)]"
-  {--increment,--no-increment}"[increment package release (pkgrel) on duplicate (default\: True)]:increment:"
-  {--local,--no-local}"[enable or disable checking of local packages for updates (default\: True)]:local:"
-  {--manual,--no-manual}"[include or exclude manual updates (default\: True)]:manual:"
+  {--increment,--no-increment}"[increment package release (pkgrel) on duplicate (default\: True)]"
+  {--local,--no-local}"[enable or disable checking of local packages for updates (default\: True)]"
+  {--manual,--no-manual}"[include or exclude manual updates (default\: True)]"
   {-u,--username}"[build as user (default\: None)]:username:"
-  {--vcs,--no-vcs}"[fetch actual version of VCS packages (default\: True)]:vcs:"
+  {--vcs,--no-vcs}"[fetch actual version of VCS packages (default\: True)]"
   "*"{-y,--refresh}"[download fresh package databases from the mirror before actions, -yy to force refresh even if up to date (default\: False)]"
   "(*)::filter check by package base (default\: None):"
 )
@@ -745,7 +745,7 @@ _shtab_ahriman_run_defaults_added=0
 _shtab_ahriman_search_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
   {-e,--exit-code}"[return non-zero exit status if result is empty (default\: False)]"
-  {--info,--no-info}"[show additional package information (default\: False)]:info:"
+  {--info,--no-info}"[show additional package information (default\: False)]"
   "--sort-by[sort field by this field. In case if two packages have the same value of the specified field, they will be always sorted by name (default\: name)]:sort_by:(description first_submitted id last_modified maintainer name num_votes out_of_date package_base package_base_id popularity repository submitter url url_path version)"
   "(*):search terms, can be specified multiple times, the result will match all terms:"
 )
@@ -755,11 +755,11 @@ _shtab_ahriman_search_defaults_added=0
 
 _shtab_ahriman_service_clean_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--cache,--no-cache}"[clear directory with package caches (default\: False)]:cache:"
-  {--chroot,--no-chroot}"[clear build chroot (default\: False)]:chroot:"
-  {--manual,--no-manual}"[clear manually added packages queue (default\: False)]:manual:"
-  {--packages,--no-packages}"[clear directory with built packages (default\: False)]:packages:"
-  {--pacman,--no-pacman}"[clear directory with pacman local database cache (default\: False)]:pacman:"
+  {--cache,--no-cache}"[clear directory with package caches (default\: False)]"
+  {--chroot,--no-chroot}"[clear build chroot (default\: False)]"
+  {--manual,--no-manual}"[clear manually added packages queue (default\: False)]"
+  {--packages,--no-packages}"[clear directory with built packages (default\: False)]"
+  {--pacman,--no-pacman}"[clear directory with pacman local database cache (default\: False)]"
 )
 
 # guard to ensure default positional specs are added only once per session
@@ -767,8 +767,8 @@ _shtab_ahriman_service_clean_defaults_added=0
 
 _shtab_ahriman_service_config_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--info,--no-info}"[show additional information, e.g. configuration files (default\: True)]:info:"
-  {--secure,--no-secure}"[hide passwords and secrets from output (default\: True)]:secure:"
+  {--info,--no-info}"[show additional information, e.g. configuration files (default\: True)]"
+  {--secure,--no-secure}"[hide passwords and secrets from output (default\: True)]"
   ":filter settings by section (default\: None):"
   ":filter settings by key (default\: None):"
 )
@@ -795,7 +795,7 @@ _shtab_ahriman_service_key_import_defaults_added=0
 
 _shtab_ahriman_service_repositories_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--id-only,--no-id-only}"[show machine readable identifier instead (default\: False)]:id_only:"
+  {--id-only,--no-id-only}"[show machine readable identifier instead (default\: False)]"
 )
 
 # guard to ensure default positional specs are added only once per session
@@ -813,10 +813,10 @@ _shtab_ahriman_service_setup_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
   "--build-as-user[force makepkg user to the specific one (default\: None)]:build_as_user:"
   "--from-configuration[path to default devtools pacman configuration (default\: \/usr\/share\/devtools\/pacman.conf.d\/extra.conf)]:from_configuration:"
-  {--generate-salt,--no-generate-salt}"[generate salt for user passwords (default\: False)]:generate_salt:"
-  {--makeflags-jobs,--no-makeflags-jobs}"[append MAKEFLAGS variable with parallelism set to number of cores (default\: True)]:makeflags_jobs:"
+  {--generate-salt,--no-generate-salt}"[generate salt for user passwords (default\: False)]"
+  {--makeflags-jobs,--no-makeflags-jobs}"[append MAKEFLAGS variable with parallelism set to number of cores (default\: True)]"
   "--mirror[use the specified explicitly mirror instead of including mirrorlist (default\: None)]:mirror:"
-  {--multilib,--no-multilib}"[add or do not multilib repository (default\: True)]:multilib:"
+  {--multilib,--no-multilib}"[add or do not multilib repository (default\: True)]"
   "--packager[packager name and email]:packager:"
   "--server[server to be used for devtools. If none set, local files will be used (default\: None)]:server:"
   "--sign-key[sign key id (default\: None)]:sign_key:"
@@ -848,10 +848,10 @@ _shtab_ahriman_setup_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
   "--build-as-user[force makepkg user to the specific one (default\: None)]:build_as_user:"
   "--from-configuration[path to default devtools pacman configuration (default\: \/usr\/share\/devtools\/pacman.conf.d\/extra.conf)]:from_configuration:"
-  {--generate-salt,--no-generate-salt}"[generate salt for user passwords (default\: False)]:generate_salt:"
-  {--makeflags-jobs,--no-makeflags-jobs}"[append MAKEFLAGS variable with parallelism set to number of cores (default\: True)]:makeflags_jobs:"
+  {--generate-salt,--no-generate-salt}"[generate salt for user passwords (default\: False)]"
+  {--makeflags-jobs,--no-makeflags-jobs}"[append MAKEFLAGS variable with parallelism set to number of cores (default\: True)]"
   "--mirror[use the specified explicitly mirror instead of including mirrorlist (default\: None)]:mirror:"
-  {--multilib,--no-multilib}"[add or do not multilib repository (default\: True)]:multilib:"
+  {--multilib,--no-multilib}"[add or do not multilib repository (default\: True)]"
   "--packager[packager name and email]:packager:"
   "--server[server to be used for devtools. If none set, local files will be used (default\: None)]:server:"
   "--sign-key[sign key id (default\: None)]:sign_key:"
@@ -884,7 +884,7 @@ _shtab_ahriman_status_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
   "--ahriman[get service status itself (default\: False)]"
   {-e,--exit-code}"[return non-zero exit status if result is empty (default\: False)]"
-  {--info,--no-info}"[show additional package information (default\: False)]:info:"
+  {--info,--no-info}"[show additional package information (default\: False)]"
   {-s,--status}"[filter packages by status (default\: None)]:status:(unknown pending building failed success)"
   "(*)::filter status by package base (default\: None):"
 )
@@ -910,17 +910,17 @@ _shtab_ahriman_sync_defaults_added=0
 
 _shtab_ahriman_update_options=(
   "(- : *)"{-h,--help}"[show this help message and exit]"
-  {--aur,--no-aur}"[enable or disable checking for AUR updates (default\: True)]:aur:"
-  {--changes,--no-changes}"[calculate changes from the latest known commit if available. Only applicable in dry run mode (default\: True)]:changes:"
-  {--check-files,--no-check-files}"[enable or disable checking of broken dependencies (e.g. dynamically linked libraries or modules directories) (default\: True)]:check_files:"
-  {--dependencies,--no-dependencies}"[process missing package dependencies (default\: True)]:dependencies:"
+  {--aur,--no-aur}"[enable or disable checking for AUR updates (default\: True)]"
+  {--changes,--no-changes}"[calculate changes from the latest known commit if available. Only applicable in dry run mode (default\: True)]"
+  {--check-files,--no-check-files}"[enable or disable checking of broken dependencies (e.g. dynamically linked libraries or modules directories) (default\: True)]"
+  {--dependencies,--no-dependencies}"[process missing package dependencies (default\: True)]"
   "--dry-run[just perform check for updates, same as check command (default\: False)]"
   {-e,--exit-code}"[return non-zero exit status if result is empty (default\: False)]"
-  {--increment,--no-increment}"[increment package release (pkgrel) on duplicate (default\: True)]:increment:"
-  {--local,--no-local}"[enable or disable checking of local packages for updates (default\: True)]:local:"
-  {--manual,--no-manual}"[include or exclude manual updates (default\: True)]:manual:"
+  {--increment,--no-increment}"[increment package release (pkgrel) on duplicate (default\: True)]"
+  {--local,--no-local}"[enable or disable checking of local packages for updates (default\: True)]"
+  {--manual,--no-manual}"[include or exclude manual updates (default\: True)]"
   {-u,--username}"[build as user (default\: None)]:username:"
-  {--vcs,--no-vcs}"[fetch actual version of VCS packages (default\: True)]:vcs:"
+  {--vcs,--no-vcs}"[fetch actual version of VCS packages (default\: True)]"
   "*"{-y,--refresh}"[download fresh package databases from the mirror before actions, -yy to force refresh even if up to date (default\: False)]"
   "(*)::filter check by package base (default\: None):"
 )
@@ -981,7 +981,7 @@ _shtab_ahriman_web_reload_defaults_added=0
 
 
 _shtab_ahriman() {
-  local context state line curcontext="$curcontext" one_or_more='(*)' remainder='(-)*' default='*::: :->ahriman'
+  local context state line curcontext="$curcontext" one_or_more='(*)' remainder='(-)*:' default='*::: :->ahriman'
 
   # Add default positional/remainder specs only if none exist, and only once per session
   if (( ! _shtab_ahriman_defaults_added )); then

ahriman-core/src/ahriman/__init__.py

@@ -17,4 +17,4 @@
 # You should have received a copy of the GNU General Public License
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 #
-__version__ = "2.21.1"
+__version__ = "2.22.1"

ahriman-core/src/ahriman/application/handlers/setup.py

@@ -28,7 +28,7 @@ from urllib.parse import quote_plus as url_encode
 from ahriman.application.application import Application
 from ahriman.application.handlers.handler import Handler, SubParserAction
 from ahriman.core.configuration import Configuration
-from ahriman.core.exceptions import MissingArchitectureError
+from ahriman.core.exceptions import InitializeError, MissingArchitectureError
 from ahriman.core.utils import enum_values
 from ahriman.models.repository_id import RepositoryId
 from ahriman.models.sign_settings import SignSettings
@@ -63,18 +63,20 @@ class Setup(Handler):
         if args.architecture is None or args.repository is None:
             raise MissingArchitectureError(args.command)
 
-        Setup.configuration_create_ahriman(args, repository_id, configuration)
+        target_directory = Setup.configuration_create_directory(configuration)
+        Setup.configuration_create_ahriman(args, repository_id, configuration, target_directory)
         configuration.reload()
 
         application = Application(repository_id, configuration, report=report)
+        paths = application.repository.paths
 
-        # basically we create configuration here as root, but it is ok, because those files are only used for reading
-        repository_server = f"file://{application.repository.paths.repository}" if args.server is None else args.server
-        Setup.configuration_create_devtools(
-            repository_id, args.from_configuration, args.mirror, args.multilib, repository_server)
+        repository_server = f"file://{paths.repository}" if args.server is None else args.server
+        target_directory = paths.ensure_exists(configuration.getpath("build", "devtools_configs"))
+        Setup.configuration_create_devtools(repository_id, args.from_configuration, target_directory, args.mirror,
+                                            args.multilib, repository_server)
 
         # finish initialization
-        with application.repository.paths.preserve_owner():
+        with paths.preserve_owner():
             application.repository.repo.init()
             # lazy database sync
             application.repository.pacman.handle  # pylint: disable=pointless-statement
@@ -92,7 +94,7 @@ class Setup(Handler):
         """
         parser = root.add_parser("service-setup", aliases=["init", "repo-init", "repo-setup", "setup"],
                                  help="initial service configuration",
-                                 description="create initial service configuration, requires root",
+                                 description="create initial service configuration as the repository owner",
                                  epilog="Create minimal configuration for the service according to provided options.")
         parser.add_argument("--build-as-user", help="force makepkg user to the specific one")
         parser.add_argument("--from-configuration", help="path to default devtools pacman configuration",
@@ -114,12 +116,12 @@ class Setup(Handler):
         parser.add_argument("--web-port", help="port of the web service", type=int)
         parser.add_argument("--web-unix-socket", help="path to unix socket used for interprocess communications",
                             type=Path)
-        parser.set_defaults(lock=None, quiet=True, report=False, unsafe=True)
+        parser.set_defaults(lock=None, quiet=True, report=False)
         return parser
 
     @staticmethod
     def configuration_create_ahriman(args: argparse.Namespace, repository_id: RepositoryId,
-                                     root: Configuration) -> None:
+                                     root: Configuration, target_directory: Path) -> None:
         """
         create service specific configuration
 
@@ -127,6 +129,7 @@ class Setup(Handler):
             args(argparse.Namespace): command line args
             repository_id(RepositoryId): repository unique identifier
             root(Configuration): root configuration instance
+            target_directory(Path): path to directory where configuration files will be written
         """
         configuration = Configuration()
 
@@ -164,15 +167,13 @@ class Setup(Handler):
         if args.generate_salt:
             configuration.set_option("auth", "salt", User.generate_password(20))
 
-        include_path = next(path for path in root.include if os.access(path, os.W_OK))
-        (include_path / "00-setup-overrides.ini").unlink(missing_ok=True)  # remove old-style configuration
-        target = include_path / f"00-setup-overrides-{repository_id.id}.ini"
+        target = target_directory / f"00-setup-overrides-{repository_id.id}.ini"
         with target.open("w", encoding="utf8") as ahriman_configuration:
             configuration.write(ahriman_configuration)
 
     @staticmethod
-    def configuration_create_devtools(repository_id: RepositoryId, source: Path, mirror: str | None,
-                                      multilib: bool, repository_server: str) -> None:
+    def configuration_create_devtools(repository_id: RepositoryId, source: Path, target_directory: Path,
+                                      mirror: str | None, multilib: bool, repository_server: str) -> None:
         """
         create configuration for devtools based on ``source`` configuration
 
@@ -182,6 +183,7 @@ class Setup(Handler):
         Args:
             repository_id(RepositoryId): repository unique identifier
             source(Path): path to source configuration file
+            target_directory(Path): path to directory where configuration files will be written
             mirror(str | None): link to package server mirror
             multilib(bool): add or do not multilib repository to the configuration
             repository_server(str): url of the repository
@@ -216,8 +218,32 @@ class Setup(Handler):
         configuration.set_option(repository_id.name, "SigLevel", "Never")  # we don't care
         configuration.set_option(repository_id.name, "Server", repository_server)
 
-        target = source.parent / f"{repository_id.name}-{repository_id.architecture}.conf"
+        target = target_directory / f"{repository_id.name}-{repository_id.architecture}.conf"
         with target.open("w", encoding="utf8") as devtools_configuration:
             configuration.write(devtools_configuration)
 
+    @staticmethod
+    def configuration_create_directory(root: Configuration) -> Path:
+        """
+        create directory for includes
+
+        Args:
+            root(Configuration): root configuration instance
+
+        Returns:
+            Path: path to first writable directory
+
+        Raises:
+            InitializeError: if no writable directories have been found
+        """
+        for include_path in root.include:
+            try:
+                directory = root.repository_paths.ensure_exists(include_path)
+                if os.access(directory, os.W_OK | os.X_OK):
+                    return directory
+            except OSError:
+                continue
+
+        raise InitializeError("No writable include directory found")
+
     arguments = [_set_service_setup_parser]

ahriman-core/src/ahriman/core/build_tools/task.py

@@ -38,6 +38,7 @@ class Task(LazyLogging):
     Attributes:
         archbuild_flags(list[str]): command flags for archbuild command
         build_command(list[str]): build command
+        devtools_configs(Path): path to local directory with devtools configuration files
         include_debug_packages(bool): whether to include debug packages or not
         make_flags(str): MAKEFLAGS variable for makepkg command
         makechrootpkg_flags(list[str]): command flags for makechrootpkg command
@@ -64,6 +65,7 @@ class Task(LazyLogging):
 
         self.archbuild_flags = configuration.getlist("build", "archbuild_flags", fallback=[])
         self.build_command = configuration.getlist("build", "devtools_wrapper")
+        self.devtools_configs = configuration.getpath("build", "devtools_configs")
         self._legacy_build_command = configuration.getlist("build", "build_command", fallback=[])
         self.include_debug_packages = configuration.getboolean("build", "include_debug_packages", fallback=True)
         # even though this option is declared as list, there is no need to read it as list,
@@ -116,7 +118,12 @@ class Task(LazyLogging):
         """
         command = self._legacy_build_command[:]
         if not command:
-            command = self.build_command + ["-r", self.repository_id.name, "-a", self.repository_id.architecture, "--"]
+            command = self.build_command + [
+                "-r", self.repository_id.name,
+                "-a", self.repository_id.architecture,
+                "-c", str(self.devtools_configs),
+                "--",
+            ]
 
         command.extend(["-r", str(self.paths.chroot)] + self.archbuild_flags)  # archbuild flags
         command.extend(["--", "-D", str(self.paths.archive)] + self.makechrootpkg_flags)  # makechrootpkg flags

ahriman-core/src/ahriman/core/configuration/configuration.py

@@ -111,10 +111,10 @@ class Configuration(configparser.RawConfigParser):
     @property
     def include(self) -> list[Path]:
         """
-        get full path to include directory(ies)
+        get full path to include directory
 
         Returns:
-            list[Path]: path to directory with configuration includes
+            list[Path]: paths to directories with configuration includes
         """
         return self.getpathlist("settings", "include")
 
@@ -332,14 +332,19 @@ class Configuration(configparser.RawConfigParser):
         self.includes = []  # reset state
 
         try:
-            for path in self.include:  # pylint: disable=not-an-iterable
-                for include in sorted(path.glob("*.ini")):
-                    if include == self.logging_path:
-                        continue  # we don't want to load logging explicitly
-                    self.read(include)
-                    self.includes.append(include)
-        except (FileNotFoundError, configparser.NoOptionError, configparser.NoSectionError):
-            pass
+            include_directories = self.include
+        except (configparser.NoOptionError, configparser.NoSectionError):
+            return
+
+        for path in include_directories:  # pylint: disable=not-an-iterable
+            if not path.is_dir():
+                continue
+
+            for include in sorted(path.glob("*.ini")):
+                if include == self.logging_path:
+                    continue  # we don't want to load logging explicitly
+                self.read(include)
+                self.includes.append(include)
 
     def merge_sections(self, repository_id: RepositoryId) -> None:
         """
@@ -399,6 +404,7 @@ class Configuration(configparser.RawConfigParser):
         # create another instance and copy values from there
         instance = self.from_path(path, repository_id)
         self.copy_from(instance)
+        self.includes = instance.includes
 
     def set_option(self, section: str, option: str, value: str) -> None:
         """

ahriman-core/src/ahriman/core/configuration/schema.py

@@ -200,6 +200,13 @@ CONFIGURATION_SCHEMA: ConfigurationSchema = {
                     "empty": False,
                 },
             },
+            "devtools_configs": {
+                "type": "path",
+                "coerce": "absolute_path",
+                "required": True,
+                "path_exists": True,
+                "path_type": "dir",
+            },
             "devtools_wrapper": {
                 "type": "list",
                 "coerce": "list",

ahriman-core/src/ahriman/models/repository_paths.py

@@ -103,7 +103,7 @@ class RepositoryPaths(LazyLogging):
         Returns:
             Path: path to directory in which build process is run
         """
-        uid, _ = owner(self.root)
+        uid, _ = self.root_owner
         return self.chroot / f"{self.repository_id.name}-{self.repository_id.architecture}" / getpwuid(uid).pw_name
 
     @property
@@ -127,6 +127,16 @@ class RepositoryPaths(LazyLogging):
         # for the chroot directory devtools will create own tree, and we don't have to specify architecture here
         return self.root / "chroot" / self.repository_id.name
 
+    @property
+    def configs(self) -> Path:
+        """
+        get directory for local configuration files
+
+        Returns:
+            Path: full path to local configuration directory
+        """
+        return self.root / ".config" / "ahriman"
+
     @property
     def packages(self) -> Path:
         """
@@ -323,6 +333,7 @@ class RepositoryPaths(LazyLogging):
             self.archive,
             self.cache,
             self.chroot,
+            self.configs,
             self.packages,
             self.pacman,
             self.repository,

ahriman-core/tests/ahriman/application/handlers/test_handler_setup.py

@@ -1,5 +1,6 @@
 import argparse
 import multiprocessing
+import os
 import pytest
 
 from pathlib import Path
@@ -11,9 +12,8 @@ from urllib.parse import quote_plus as url_encode
 from ahriman.application.handlers.setup import Setup
 from ahriman.core.configuration import Configuration
 from ahriman.core.database import SQLite
-from ahriman.core.exceptions import MissingArchitectureError
+from ahriman.core.exceptions import InitializeError, MissingArchitectureError
 from ahriman.core.repository import Repository
-from ahriman.models.repository_id import RepositoryId
 from ahriman.models.repository_paths import RepositoryPaths
 from ahriman.models.sign_settings import SignSettings
 
@@ -51,8 +51,11 @@ def test_run(args: argparse.Namespace, configuration: Configuration, repository:
     must run command
     """
     args = _default_args(args)
+    local = Path("local")
     mocker.patch("ahriman.core.database.SQLite.load", return_value=database)
     mocker.patch("ahriman.core.repository.Repository.load", return_value=repository)
+    mkdir_mock = mocker.patch("ahriman.application.handlers.setup.Setup.configuration_create_directory",
+                              return_value=local)
     ahriman_configuration_mock = mocker.patch("ahriman.application.handlers.setup.Setup.configuration_create_ahriman")
     devtools_configuration_mock = mocker.patch("ahriman.application.handlers.setup.Setup.configuration_create_devtools")
     init_mock = mocker.patch("ahriman.core.alpm.repo.Repo.init")
@@ -61,9 +64,16 @@ def test_run(args: argparse.Namespace, configuration: Configuration, repository:
     _, repository_id = configuration.check_loaded()
     Setup.run(args, repository_id, configuration, report=False)
     owner_guard_mock.assert_called_once_with()
-    ahriman_configuration_mock.assert_called_once_with(args, repository_id, configuration)
+    mkdir_mock.assert_called_once_with(configuration)
+    ahriman_configuration_mock.assert_called_once_with(args, repository_id, configuration, local)
     devtools_configuration_mock.assert_called_once_with(
-        repository_id, args.from_configuration, args.mirror, args.multilib, f"file://{repository_paths.repository}")
+        repository_id,
+        args.from_configuration,
+        configuration.getpath("build", "devtools_configs"),
+        args.mirror,
+        args.multilib,
+        f"file://{repository_paths.repository}",
+    )
     init_mock.assert_called_once_with()
 
 
@@ -102,11 +112,17 @@ def test_run_with_server(args: argparse.Namespace, configuration: Configuration,
     _, repository_id = configuration.check_loaded()
     Setup.run(args, repository_id, configuration, report=False)
     devtools_configuration_mock.assert_called_once_with(
-        repository_id, args.from_configuration, args.mirror, args.multilib, "server")
+        repository_id,
+        args.from_configuration,
+        configuration.getpath("build", "devtools_configs"),
+        args.mirror,
+        args.multilib,
+        "server",
+    )
 
 
-def test_configuration_create_ahriman(args: argparse.Namespace, configuration: Configuration,
-                                      repository_paths: RepositoryPaths, mocker: MockerFixture) -> None:
+def test_configuration_create_ahriman(args: argparse.Namespace, configuration: Configuration, tmp_path: Path,
+                                      mocker: MockerFixture) -> None:
     """
     must create configuration for the service
     """
@@ -114,10 +130,9 @@ def test_configuration_create_ahriman(args: argparse.Namespace, configuration: C
     mocker.patch("pathlib.Path.open")
     set_option_mock = mocker.patch("ahriman.core.configuration.Configuration.set_option")
     write_mock = mocker.patch("ahriman.core.configuration.Configuration.write")
-    remove_mock = mocker.patch("pathlib.Path.unlink", autospec=True)
     _, repository_id = configuration.check_loaded()
 
-    Setup.configuration_create_ahriman(args, repository_id, configuration)
+    Setup.configuration_create_ahriman(args, repository_id, configuration, tmp_path)
     set_option_mock.assert_has_calls([
         MockCall("repository", "name", repository_id.name),
         MockCall(Configuration.section_name("build", repository_id.name, repository_id.architecture),
@@ -139,15 +154,10 @@ def test_configuration_create_ahriman(args: argparse.Namespace, configuration: C
         MockCall("auth", "salt", pytest.helpers.anyvar(str, strict=True)),
     ])
     write_mock.assert_called_once_with(pytest.helpers.anyvar(int))
-    remove_mock.assert_called_once_with(
-        next(
-            path for path in configuration.include) /
-        "00-setup-overrides.ini",
-        missing_ok=True)
 
 
 def test_configuration_create_ahriman_no_multilib(args: argparse.Namespace, configuration: Configuration,
-                                                  mocker: MockerFixture) -> None:
+                                                  tmp_path: Path, mocker: MockerFixture) -> None:
     """
     must create configuration for the service without multilib repository
     """
@@ -158,14 +168,14 @@ def test_configuration_create_ahriman_no_multilib(args: argparse.Namespace, conf
     set_option_mock = mocker.patch("ahriman.core.configuration.Configuration.set_option")
 
     _, repository_id = configuration.check_loaded()
-    Setup.configuration_create_ahriman(args, repository_id, configuration)
+    Setup.configuration_create_ahriman(args, repository_id, configuration, tmp_path)
     set_option_mock.assert_has_calls([
         MockCall(Configuration.section_name("alpm", repository_id.name, repository_id.architecture), "mirror",
                  args.mirror),
     ])  # non-strict check called intentionally
 
 
-def test_configuration_create_devtools(args: argparse.Namespace, configuration: Configuration,
+def test_configuration_create_devtools(args: argparse.Namespace, configuration: Configuration, tmp_path: Path,
                                        mocker: MockerFixture) -> None:
     """
     must create configuration for the devtools
@@ -177,12 +187,12 @@ def test_configuration_create_devtools(args: argparse.Namespace, configuration:
     write_mock = mocker.patch("ahriman.core.configuration.Configuration.write")
 
     _, repository_id = configuration.check_loaded()
-    Setup.configuration_create_devtools(repository_id, args.from_configuration, None, args.multilib, "server")
+    Setup.configuration_create_devtools(repository_id, args.from_configuration, tmp_path, None, args.multilib, "server")
     add_section_mock.assert_has_calls([MockCall("multilib"), MockCall(repository_id.name)])
     write_mock.assert_called_once_with(pytest.helpers.anyvar(int))
 
 
-def test_configuration_create_devtools_mirror(args: argparse.Namespace, configuration: Configuration,
+def test_configuration_create_devtools_mirror(args: argparse.Namespace, configuration: Configuration, tmp_path: Path,
                                               mocker: MockerFixture) -> None:
     """
     must create configuration for the devtools with mirror set explicitly
@@ -202,14 +212,21 @@ def test_configuration_create_devtools_mirror(args: argparse.Namespace, configur
     set_option_mock = mocker.patch("ahriman.core.configuration.Configuration.set_option")
 
     _, repository_id = configuration.check_loaded()
-    Setup.configuration_create_devtools(repository_id, args.from_configuration, args.mirror, args.multilib, "server")
+    Setup.configuration_create_devtools(
+        repository_id,
+        args.from_configuration,
+        tmp_path,
+        args.mirror,
+        args.multilib,
+        "server",
+    )
     get_mock.assert_has_calls([MockCall("core", "Include", fallback=None), MockCall("extra", "Include", fallback=None)])
     remove_option_mock.assert_called_once_with("core", "Include")
     set_option_mock.assert_has_calls([MockCall("core", "Server", args.mirror)])  # non-strict check called intentionally
 
 
 def test_configuration_create_devtools_no_multilib(args: argparse.Namespace, configuration: Configuration,
-                                                   mocker: MockerFixture) -> None:
+                                                   tmp_path: Path, mocker: MockerFixture) -> None:
     """
     must create configuration for the devtools without multilib
     """
@@ -219,10 +236,33 @@ def test_configuration_create_devtools_no_multilib(args: argparse.Namespace, con
     write_mock = mocker.patch("ahriman.core.configuration.Configuration.write")
 
     _, repository_id = configuration.check_loaded()
-    Setup.configuration_create_devtools(repository_id, args.from_configuration, args.mirror, False, "server")
+    Setup.configuration_create_devtools(repository_id, args.from_configuration, tmp_path, args.mirror, False, "server")
     write_mock.assert_called_once_with(pytest.helpers.anyvar(int))
 
 
+def test_configuration_create_directory(configuration: Configuration, mocker: MockerFixture) -> None:
+    """
+    must create writable directory for includes
+    """
+    configuration.set_option("settings", "include", f"/path1 /path2 /path3")
+    mkdir_mock = mocker.patch("ahriman.models.repository_paths.RepositoryPaths.ensure_exists",
+                              side_effect=[OSError, "/path2", "/path3"])
+    access_mock = mocker.patch("os.access", side_effect=[False, True])
+
+    assert Setup.configuration_create_directory(configuration) == "/path3"
+    mkdir_mock.assert_has_calls([MockCall(Path("/path1")), MockCall(Path("/path2")), MockCall(Path("/path3"))])
+    access_mock.assert_has_calls([MockCall("/path2", os.W_OK | os.X_OK), MockCall("/path3", os.W_OK | os.X_OK)])
+
+
+def test_configuration_create_directory_no_writable(configuration: Configuration, mocker: MockerFixture) -> None:
+    """
+    must raise InitializeError if no writable directories found
+    """
+    mocker.patch("ahriman.models.repository_paths.RepositoryPaths.ensure_exists", side_effect=OSError)
+    with pytest.raises(InitializeError):
+        Setup.configuration_create_directory(configuration)
+
+
 def test_disallow_multi_architecture_run() -> None:
     """
     must not allow multi architecture run

ahriman-core/tests/ahriman/application/handlers/test_handler_validate.py

@@ -63,7 +63,7 @@ def test_run_default(args: argparse.Namespace, configuration: Configuration) ->
 
     default = Configuration.from_path(Configuration.SYSTEM_CONFIGURATION_PATH, repository_id)
     # copy autogenerated values
-    for section, key in (("repository", "root"),):
+    for section, key in (("repository", "root"), ("build", "devtools_configs")):
         value = configuration.get(section, key)
         default.set_option(section, key, value)
 

ahriman-core/tests/ahriman/application/test_ahriman.py

@@ -1488,7 +1488,7 @@ def test_subparsers_service_run_option_repository(parser: argparse.ArgumentParse
 
 def test_subparsers_service_setup(parser: argparse.ArgumentParser) -> None:
     """
-    service-setup command must imply lock, quiet, report and unsafe
+    service-setup command must imply lock, quiet and report
     """
     args = parser.parse_args(["-a", "x86_64", "-r", "repo", "service-setup",
                               "--packager", "ahriman bot <ahriman@example.com>"])
@@ -1497,7 +1497,6 @@ def test_subparsers_service_setup(parser: argparse.ArgumentParser) -> None:
     assert args.quiet
     assert not args.report
     assert args.repository == "repo"
-    assert args.unsafe
 
 
 def test_subparsers_service_setup_option_from_configuration(parser: argparse.ArgumentParser) -> None:

ahriman-core/tests/ahriman/core/build_tools/test_task.py

@@ -54,7 +54,9 @@ def test_build(task_ahriman: Task, mocker: MockerFixture) -> None:
     assert task_ahriman.build(local) == [task_ahriman.package.base]
     check_output_mock.assert_called_once_with(
         "ahriman-archbuild",
-        "-r", task_ahriman.repository_id.name, "-a", task_ahriman.repository_id.architecture,
+        "-r", task_ahriman.repository_id.name,
+        "-a", task_ahriman.repository_id.architecture,
+        "-c", str(task_ahriman.devtools_configs),
         "--", "-r", str(task_ahriman.paths.chroot),
         "--", "-D", str(task_ahriman.paths.archive),
         "--", "--skippgpcheck",
@@ -81,7 +83,9 @@ def test_build_environment(task_ahriman: Task, mocker: MockerFixture) -> None:
     task_ahriman.build(local, **environment, empty=None)
     check_output_mock.assert_called_once_with(
         "ahriman-archbuild",
-        "-r", task_ahriman.repository_id.name, "-a", task_ahriman.repository_id.architecture,
+        "-r", task_ahriman.repository_id.name,
+        "-a", task_ahriman.repository_id.architecture,
+        "-c", str(task_ahriman.devtools_configs),
         "--", "-r", str(task_ahriman.paths.chroot),
         "--", "-D", str(task_ahriman.paths.archive),
         "--", "--skippgpcheck",
@@ -106,7 +110,9 @@ def test_build_makeflags(task_ahriman: Task, mocker: MockerFixture) -> None:
     task_ahriman.build(local)
     check_output_mock.assert_called_once_with(
         "ahriman-archbuild",
-        "-r", task_ahriman.repository_id.name, "-a", task_ahriman.repository_id.architecture,
+        "-r", task_ahriman.repository_id.name,
+        "-a", task_ahriman.repository_id.architecture,
+        "-c", str(task_ahriman.devtools_configs),
         "--", "-r", str(task_ahriman.paths.chroot),
         "--", "-D", str(task_ahriman.paths.archive),
         "--", "--skippgpcheck",
@@ -130,7 +136,9 @@ def test_build_dry_run(task_ahriman: Task, mocker: MockerFixture) -> None:
     task_ahriman.build(local, dry_run=True)
     check_output_mock.assert_called_once_with(
         "ahriman-archbuild",
-        "-r", task_ahriman.repository_id.name, "-a", task_ahriman.repository_id.architecture,
+        "-r", task_ahriman.repository_id.name,
+        "-a", task_ahriman.repository_id.architecture,
+        "-c", str(task_ahriman.devtools_configs),
         "--", "-r", str(task_ahriman.paths.chroot),
         "--", "-D", str(task_ahriman.paths.archive),
         "--", "--skippgpcheck",

archlinux/PKGBUILD

@@ -2,7 +2,7 @@
 
 pkgbase='ahriman'
 pkgname=('ahriman' 'ahriman-core' 'ahriman-triggers' 'ahriman-web')
-pkgver=2.21.1
+pkgver=2.22.1
 pkgrel=1
 pkgdesc="ArcH linux ReposItory MANager"
 arch=('any')

archlinux/sudoers.conf

@@ -1 +1,2 @@
-ahriman ALL= NOPASSWD:SETENV: /usr/bin/ahriman-archbuild *
+Defaults!/usr/bin/ahriman-archbuild env_keep += "SOURCE_DATE_EPOCH SRCDEST SRCPKGDEST PKGDEST LOGDEST NPROC MAKEFLAGS PACKAGER GNUPGHOME"
+ahriman ALL= NOPASSWD:NOSETENV: /usr/bin/ahriman-archbuild *

docker/01-docker.ini

@@ -0,0 +1,2 @@
+[web]
+host = $AHRIMAN_HOST

docker/Dockerfile

@@ -8,7 +8,7 @@ ARG BUILD_DATE
 RUN useradd -m -d "/home/build" -s "/usr/bin/nologin" build
 
 ## extract container creation date and set mirror for this timestamp, set PKGEXT and refresh database next
-RUN echo "Server = https://archive.archlinux.org/repos/${BUILD_DATE//-/\/}/\$repo/os/\$arch" > "/etc/pacman.d/mirrorlist" && \
+RUN echo "Server = https://archive.archlinux.org/repos/${BUILD_DATE//-//}/\$repo/os/\$arch" > "/etc/pacman.d/mirrorlist" && \
     pacman -Syyuu --noconfirm
 ## setup package cache
 RUN runuser -u build -- mkdir "/tmp/pkg" && \
@@ -80,7 +80,6 @@ FROM archlinux:base AS ahriman
 # image configuration
 ENV AHRIMAN_ARCHITECTURE="x86_64"
 ENV AHRIMAN_DEBUG=""
-ENV AHRIMAN_FORCE_ROOT=""
 ENV AHRIMAN_HOST="0.0.0.0"
 ENV AHRIMAN_MULTILIB="yes"
 ENV AHRIMAN_OUTPUT=""
@@ -91,7 +90,6 @@ ENV AHRIMAN_POSTSETUP_COMMAND=""
 ENV AHRIMAN_PRESETUP_COMMAND=""
 ENV AHRIMAN_REPOSITORY="aur"
 ENV AHRIMAN_REPOSITORY_SERVER=""
-ENV AHRIMAN_REPOSITORY_ROOT="/var/lib/ahriman/ahriman"
 ENV AHRIMAN_UNIX_SOCKET=""
 ENV AHRIMAN_USER="ahriman"
 ENV AHRIMAN_VALIDATE_CONFIGURATION="yes"
@@ -135,11 +133,15 @@ RUN find "/var/cache/pacman/pkg" "/var/lib/pacman/sync" -type "f,l" -delete && \
 VOLUME ["/var/lib/ahriman"]
 
 # minimal runtime ahriman setup
+RUN systemd-machine-id-setup
+COPY "docker/01-docker.ini" "/etc/ahriman.ini.d/01-docker.ini"
 ## FIXME since 1.0.4 devtools requires dbus to be run, which doesn't work now in container
 COPY "docker/systemd-nspawn.sh" "/usr/local/bin/systemd-nspawn"
 ## entrypoint setup
 COPY "docker/entrypoint.sh" "/usr/local/bin/entrypoint"
 COPY "docker/entrypoint-web.sh" "/usr/local/bin/entrypoint-web"
+
+USER ahriman
 ENTRYPOINT ["entrypoint"]
 # default command
 CMD ["repo-update", "--refresh"]

docker/entrypoint-web.sh

@@ -2,4 +2,9 @@
 # Special workaround for running web service in github actions, must not be usually used in real environment,
 # consider running web command explicitly instead
 
-exec entrypoint web "$@"
+if (( EUID == 0 )); then
+    chown ahriman:ahriman /var/lib/ahriman
+    exec sudo -E -u ahriman -- entrypoint web "$@"
+fi
+
+exec entrypoint web "$@"

docker/entrypoint.sh

@@ -3,30 +3,15 @@
 set -e
 [ -n "$AHRIMAN_DEBUG" ] && set -x
 
-# configuration tune
-cat <<EOF > "/etc/ahriman.ini.d/01-docker.ini"
-[repository]
-root = $AHRIMAN_REPOSITORY_ROOT
-
-[web]
-host = $AHRIMAN_HOST
-
-EOF
-
 AHRIMAN_DEFAULT_ARGS=("--architecture" "$AHRIMAN_ARCHITECTURE")
 AHRIMAN_DEFAULT_ARGS+=("--repository" "$AHRIMAN_REPOSITORY")
 if [ -n "$AHRIMAN_OUTPUT" ]; then
     AHRIMAN_DEFAULT_ARGS+=("--log-handler" "$AHRIMAN_OUTPUT")
 fi
 
-# create repository root inside the [[mounted]] directory and set correct ownership
-[ -d "$AHRIMAN_REPOSITORY_ROOT" ] || mkdir "$AHRIMAN_REPOSITORY_ROOT"
-chown "$AHRIMAN_USER":"$AHRIMAN_USER" "$AHRIMAN_REPOSITORY_ROOT"
-
 # create .gnupg directory which is required for keys
 AHRIMAN_GNUPG_HOME="$(getent passwd "$AHRIMAN_USER" | cut -d : -f 6)/.gnupg"
 [ -d "$AHRIMAN_GNUPG_HOME" ] || mkdir -m700 "$AHRIMAN_GNUPG_HOME"
-chown "$AHRIMAN_USER":"$AHRIMAN_USER" "$AHRIMAN_GNUPG_HOME"
 
 # run built-in setup command
 AHRIMAN_SETUP_ARGS=("--build-as-user" "$AHRIMAN_USER")
@@ -54,19 +39,7 @@ ahriman "${AHRIMAN_DEFAULT_ARGS[@]}" service-setup "${AHRIMAN_SETUP_ARGS[@]}"
 # validate configuration if set
 [ -n "$AHRIMAN_VALIDATE_CONFIGURATION" ] && ahriman "${AHRIMAN_DEFAULT_ARGS[@]}" service-config-validate --exit-code
 
-# create machine-id which is required by build tools
-systemd-machine-id-setup &> /dev/null
-
 # special workaround to emulate /bin/bash entrypoint if first argument starts with /
 [[ "$1" =~ ^/.* ]] && exec "$@"
 
-# if AHRIMAN_FORCE_ROOT is set or command is unsafe we can run without sudo
-# otherwise we prepend executable by sudo command
-if [ -n "$AHRIMAN_FORCE_ROOT" ]; then
-    AHRIMAN_EXECUTABLE=("ahriman")
-elif ahriman help-commands-unsafe -- "$@" &> /dev/null; then
-    AHRIMAN_EXECUTABLE=("sudo" "-E" "-u" "$AHRIMAN_USER" "--" "ahriman")
-else
-    AHRIMAN_EXECUTABLE=("ahriman")
-fi
-exec "${AHRIMAN_EXECUTABLE[@]}" "${AHRIMAN_DEFAULT_ARGS[@]}" "$@"
+exec ahriman "${AHRIMAN_DEFAULT_ARGS[@]}" "$@"

docs/architecture.rst

@@ -116,7 +116,7 @@ Filesystem tree
 
 The application supports two types of trees, one is for the legacy configuration (when there were no explicit repository name configuration available) and another one is the new-style tree. This document describes only new-style tree in order to avoid deprecated structures.
 
-Having default root as ``/var/lib/ahriman`` (differs from container though), the directory structure is the following:
+Having default root as ``/var/lib/ahriman``, the directory structure is the following:
 
 .. code-block::
 

docs/configuration.rst

@@ -131,6 +131,7 @@ Authorized users are stored inside internal database, if any of external provide
 Build related configuration. Group name can refer to architecture, e.g. ``build:x86_64`` can be used for x86_64 architecture specific settings.
 
 * ``archbuild_flags`` - additional flags passed to ``archbuild`` command, space separated list of strings, optional.
+* ``devtools_configs`` - path to devtools configuration directory, string, required.
 * ``devtools_wrapper`` - path to devtools wrapper, space separated list of strings, required.
 * ``ignore_packages`` - list packages to ignore during a regular update (manual update will still work), space separated list of strings, optional.
 * ``include_debug_packages`` - distribute debug packages, boolean, optional, default ``yes``.

docs/faq/docker.rst

@@ -22,6 +22,12 @@ In order to make data available outside of container, you would need to mount lo
 
    docker run --privileged -v /path/to/local/repo:/var/lib/ahriman -v /path/to/overrides/overrides.ini:/etc/ahriman.ini.d/10-overrides.ini arcan1s/ahriman:latest
 
+The volume must have correct rights, e.g.:
+
+.. code-block:: shell
+
+   chown 643:643 /path/to/local/repo
+
 The action can be specified during run, e.g.:
 
 .. code-block:: shell
@@ -59,19 +65,17 @@ The following environment variables are supported:
 
 * ``AHRIMAN_ARCHITECTURE`` - architecture of the repository, default is ``x86_64``.
 * ``AHRIMAN_DEBUG`` - if set all commands will be logged to console.
-* ``AHRIMAN_FORCE_ROOT`` - force run ahriman as root instead of guessing by subcommand.
 * ``AHRIMAN_HOST`` - host for the web interface, default is ``0.0.0.0``.
 * ``AHRIMAN_MULTILIB`` - if set (default) multilib repository will be used, disabled otherwise.
 * ``AHRIMAN_OUTPUT`` - controls logging handler, e.g. ``syslog``, ``console``. The name must be found in logging configuration. Note that if ``syslog`` handler is used you will need to mount ``/dev/log`` inside container because it is not available there.
 * ``AHRIMAN_PACKAGER`` - packager name from which packages will be built, default is ``ahriman bot <ahriman@example.com>``.
 * ``AHRIMAN_PACMAN_MIRROR`` - override pacman mirror server if set.
 * ``AHRIMAN_PORT`` - HTTP server port if any, default is empty.
-* ``AHRIMAN_POSTSETUP_COMMAND`` - if set, the command which will be called (as root) after the setup command, but before any other actions.
-* ``AHRIMAN_PRESETUP_COMMAND`` - if set, the command which will be called (as root) right before the setup command.
+* ``AHRIMAN_POSTSETUP_COMMAND`` - if set, the command which will be called after the setup command, but before any other actions.
+* ``AHRIMAN_PRESETUP_COMMAND`` - if set, the command which will be called right before the setup command.
 * ``AHRIMAN_REPOSITORY`` - repository name, default is ``aur``.
 * ``AHRIMAN_REPOSITORY_SERVER`` - optional override for the repository URL. Useful if you would like to download packages from remote instead of local filesystem.
-* ``AHRIMAN_REPOSITORY_ROOT`` - repository root. Because of filesystem rights it is required to override default repository root. By default, it uses ``ahriman`` directory inside ahriman's home, which can be passed as mount volume.
-* ``AHRIMAN_UNIX_SOCKET`` - full path to unix socket which is used by web server, default is empty. Note that more likely you would like to put it inside ``AHRIMAN_REPOSITORY_ROOT`` directory (e.g. ``/var/lib/ahriman/ahriman/ahriman-web.sock``) or to ``/run/ahriman``.
+* ``AHRIMAN_UNIX_SOCKET`` - full path to unix socket which is used by web server, default is empty. Note that more likely you would like to put it inside repository root directory (e.g. ``/var/lib/ahriman/ahriman-web.sock``) or to ``/run/ahriman``.
 * ``AHRIMAN_USER`` - ahriman user, usually must not be overwritten, default is ``ahriman``.
 * ``AHRIMAN_VALIDATE_CONFIGURATION`` - if set (default) validate service configuration.
 
@@ -99,7 +103,7 @@ For that you would need to have web container instance running forever; it can b
 
 .. code-block:: shell
 
-   docker run --privileged -p 8080:8080 -e AHRIMAN_PORT=8080 -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman/ahriman-web.sock -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
+   docker run --privileged -p 8080:8080 -e AHRIMAN_PORT=8080 -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman-web.sock -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
 
 Note about ``AHRIMAN_PORT`` environment variable which is required in order to enable web service. An additional port bind by ``-p 8080:8080`` is required to pass docker port outside of container.
 
@@ -109,7 +113,7 @@ If you are using ``AHRIMAN_UNIX_SOCKET`` variable, for every next container run
 
 .. code-block:: shell
 
-   docker run --privileged -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman/ahriman-web.sock -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
+   docker run --privileged -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman-web.sock -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
 
 Otherwise, you would need to pass ``AHRIMAN_PORT`` and mount container network to the host system (``--net=host``), e.g.:
 
@@ -128,7 +132,7 @@ In order to create configuration for additional repositories, the ``AHRIMAN_POST
 
 .. code-block:: shell
 
-   docker run --privileged -p 8080:8080 -e AHRIMAN_PORT=8080 -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman/ahriman-web.sock -e AHRIMAN_POSTSETUP_COMMAND="ahriman --architecture x86_64 --repository aur-v2 service-setup --build-as-user ahriman --packager 'ahriman bot <ahriman@example.com>'" -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
+   docker run --privileged -p 8080:8080 -e AHRIMAN_PORT=8080 -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman-web.sock -e AHRIMAN_POSTSETUP_COMMAND="ahriman --architecture x86_64 --repository aur-v2 service-setup --build-as-user ahriman --packager 'ahriman bot <ahriman@example.com>'" -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
 
 The command above will also create configuration for the repository named ``aur-v2``.
 

docs/faq/non-x86_64-setup.rst

@@ -55,6 +55,13 @@ There are two possible ways to achieve same setup, by using docker container. Th
 
       FROM arcan1s/ahriman:latest
 
+#.
+   Switch to ``root`` user:
+
+   .. code-block:: dockerfile
+
+      USER root
+
 #.
    Init pacman keys. This command is required in order to populate distribution keys:
 
@@ -78,12 +85,16 @@ There are two possible ways to achieve same setup, by using docker container. Th
 
       FROM arcan1s/ahriman:latest
 
+      USER root
+
       RUN pacman-key --init
 
       RUN pacman --noconfirm -Sy wget
       RUN wget https://pool.mirror.archlinux32.org/i686/extra/devtools-20221208-1.2-any.pkg.tar.zst && pacman --noconfirm -U devtools-20221208-1.2-any.pkg.tar.zst
       RUN wget https://pool.mirror.archlinux32.org/i686/core/archlinux32-keyring-20230705-1.0-any.pkg.tar.zst && pacman --noconfirm -U archlinux32-keyring-20230705-1.0-any.pkg.tar.zst
 
+      USER ahriman
+
 #.
    After that you can build you own container, e.g.:
 

docs/migrations/2.22.0.rst

@@ -0,0 +1,56 @@
+To 2.22.0
+---------
+
+This release stores newly generated configuration files in the repository root and changes the docker image to run as the ``ahriman`` user. Existing system-wide configuration files remain supported, so regular installations do not require manual intervention. Docker installations require data migration.
+
+Regular installation
+^^^^^^^^^^^^^^^^^^^^
+
+Newly generated ahriman and devtools configuration files are stored below ``/var/lib/ahriman/.config/ahriman`` instead of system-wide configuration directories. Existing configurations continue to work without any changes.
+
+However, it is recommended to migrate to the new configuration schema by doing the following steps:
+
+#.
+   Stop all ahriman services.
+
+#.
+   Remove the old generated configuration files. For example, for repository ``aur`` and architecture ``x86_64``:
+
+   .. code-block:: shell
+
+      sudo rm /etc/ahriman.ini.d/00-setup-overrides-x86_64-aur.ini
+      sudo rm /usr/share/devtools/pacman.conf.d/aur-x86_64.conf
+
+   Repeat this step for every configured repository. Do not remove manually maintained configuration overrides.
+
+#.
+   Run setup command (i.e. ``ahriman service-setup``) again with the same arguments as used before as the ``ahriman`` user.
+
+#.
+   Start the services again.
+
+Docker installation
+^^^^^^^^^^^^^^^^^^^
+
+The repository root inside the Docker image has changed from ``/var/lib/ahriman/ahriman`` to ``/var/lib/ahriman``. Existing repository contents must therefore be moved one directory level up, and the volume must be owned by the ``ahriman`` user.
+
+#.
+   Stop all containers using the repository volume and create a backup.
+
+#.
+   Run a one-off container which mounts the existing volume. Replace ``VOLUME`` with the named volume or bind mount used by the installation:
+
+   .. code-block:: shell
+
+      docker run --rm --user root --entrypoint bash \
+          --volume VOLUME:/var/lib/ahriman \
+          arcan1s/ahriman:latest \
+          -c 'find /var/lib/ahriman/ahriman -mindepth 1 -maxdepth 1 -exec mv -t /var/lib/ahriman -- {} + && rmdir /var/lib/ahriman/ahriman && chown ahriman:ahriman /var/lib/ahriman'
+
+#.
+   Update custom configuration and container arguments which refer to ``/var/lib/ahriman/ahriman``. The new path is ``/var/lib/ahriman``.
+
+#.
+   Start the containers again.
+
+Please note, that some environment variables - ``AHRIMAN_FORCE_ROOT`` and ``AHRIMAN_REPOSITORY_ROOT`` - have been also removed and not supported anymore. ``AHRIMAN_POSTSETUP_COMMAND`` and ``AHRIMAN_PRESETUP_COMMAND`` are now executed as non-root user.

docs/migrations/index.rst

@@ -12,3 +12,4 @@ Upgrades to breakpoints
    2.9.0
    2.12.0
    2.16.0
+   2.22.0

docs/setup.rst

@@ -10,41 +10,32 @@ Initial setup
 
    .. code-block:: shell
 
-      sudo ahriman -a x86_64 -r aur service-setup ...
+      sudo -u ahriman -- ahriman -a x86_64 -r aur service-setup \
+          --packager "ahriman bot <ahriman@example.com>" ...
 
    .. admonition:: Details
       :collapsible: closed
 
-      ``service-setup`` literally does the following steps:
+      ``service-setup`` does the following steps:
 
       #.
-         Create ``/var/lib/ahriman/.makepkg.conf`` with ``makepkg.conf`` overrides if required (at least you might want to set ``PACKAGER``):
-
-         .. code-block:: shell
-
-            echo 'PACKAGER="ahriman bot <ahriman@example.com>"' | sudo -u ahriman tee -a /var/lib/ahriman/.makepkg.conf
+         Create a repository-specific ahriman configuration below
+         ``/var/lib/ahriman/.config/ahriman/ahriman.ini.d``. This configuration stores the
+         packager identity, ``MAKEFLAGS`` and other options supplied on the command line.
 
       #.
-         Configure build tools (it is required for correct dependency management system):
+         Generate the devtools pacman configuration in
+         ``/var/lib/ahriman/.config/ahriman/pacman.conf.d``. The file is based on the
+         configuration selected by ``--from-configuration`` and contains the requested mirror,
+         multilib settings and the ahriman repository path.
 
-          #.
-             Create configuration file ``{name}.conf`` or ``{name}-{arch}.conf``, where ``name`` is the repostory name and ``arch`` is the repository architecture, e.g.:
+      #.
+         Create the repository directories, initialize the package repository and synchronize
+         its pacman database.
 
-             .. code-block:: shell
-
-                cp /usr/share/devtools/pacman.conf.d/{extra,aur-x86_64}.conf
-
-          #.
-             Change configuration file, add your own repository, add multilib repository etc:
-
-             .. code-block:: shell
-
-                echo '[multilib]' | tee -a /usr/share/devtools/pacman.conf.d/aur-x86_64.conf
-                echo 'Include = /etc/pacman.d/mirrorlist' | tee -a /usr/share/devtools/pacman.conf.d/aur-x86_64.conf
-
-                echo '[aur]' | tee -a /usr/share/devtools/pacman.conf.d/aur-x86_64.conf
-                echo 'SigLevel = Optional TrustAll' | tee -a /usr/share/devtools/pacman.conf.d/aur-x86_64.conf
-                echo 'Server = file:///var/lib/ahriman/repository/$repo/$arch' | tee -a /usr/share/devtools/pacman.conf.d/aur-x86_64.conf
+      Both configuration locations are below the repository root and must be writable by the
+      user running ahriman. Existing system-wide overrides remain supported; see
+      :doc:`the 2.22.0 migration guide <migrations/2.22.0>` when upgrading.
 
    This command supports several arguments, kindly refer to its help message.
 
@@ -53,14 +44,14 @@ Initial setup
 
    .. code-block:: shell
 
-       systemctl enable --now ahriman@x86_64-aur.timer
+       sudo systemctl enable --now ahriman@x86_64-aur.timer
 
 #. 
    Start and enable status page:
 
    .. code-block:: shell
 
-       systemctl enable --now ahriman-web
+       sudo systemctl enable --now ahriman-web
 
 #. 
    Add packages by using ``ahriman package-add {package}`` command:

frontend/package.json

@@ -2,9 +2,9 @@
     "dependencies": {
         "@emotion/react": ">=11.14.0 <11.15.0",
         "@emotion/styled": ">=11.14.0 <11.15.0",
-        "@mui/icons-material": ">=9.2.0 <9.3.0",
-        "@mui/material": ">=9.2.0 <9.3.0",
-        "@mui/x-data-grid": ">=9.10.0 <9.11.0",
+        "@mui/icons-material": ">=9.3.0 <9.4.0",
+        "@mui/material": ">=9.3.0 <9.4.0",
+        "@mui/x-data-grid": ">=9.11.0 <9.12.0",
         "@tanstack/react-query": ">=5.101.0 <5.102.0",
         "chart.js": ">=4.5.0 <4.6.0",
         "react": ">=19.2.0 <19.3.0",
@@ -26,8 +26,8 @@
         "eslint-plugin-react-refresh": ">=0.5.0 <0.6.0",
         "eslint-plugin-simple-import-sort": ">=14.0.0 <14.1.0",
         "typescript": ">=6.0.0 <6.1.0",
-        "typescript-eslint": ">=8.64.0 <8.65.0",
-        "vite": ">=8.1.0 <8.2.0"
+        "typescript-eslint": ">=8.67.0 <8.68.0",
+        "vite": ">=8.2.0 <8.3.0"
     },
     "name": "ahriman",
     "private": true,
@@ -39,5 +39,5 @@
         "preview": "vite preview"
     },
     "type": "module",
-    "version": "2.21.1"
+    "version": "2.22.1"
 }

frontend/vite.config.ts

@@ -19,7 +19,7 @@ export default defineConfig({
     build: {
         chunkSizeWarningLimit: 10000,
         emptyOutDir: false,
-        outDir: path.resolve(__dirname, "../ahriman-web/package/share/ahriman/templates"),
+        outDir: path.resolve(import.meta.dirname, "../ahriman-web/package/share/ahriman/templates"),
         rolldownOptions: {
             output: {
                 assetFileNames: "static/[name].[ext]",

pyproject.toml

@@ -70,7 +70,6 @@ exclude = [
     "/conftest.py",
     "/github-logo.png",
     "/tox.toml",
-    "/toxfile.py",
     "/web.png",
 ]
 

recipes/check/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -8,9 +25,9 @@ services:
       AHRIMAN_OUTPUT: console
       AHRIMAN_PASSWORD: ${AHRIMAN_PASSWORD}
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | sudo -u ahriman ahriman user-add demo -R full
+      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | ahriman user-add demo -R full
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -22,8 +39,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -37,6 +56,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf
@@ -57,7 +80,7 @@ services:
       AHRIMAN_DEBUG: yes
       AHRIMAN_OUTPUT: console
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     volumes:
       - type: volume

recipes/daemon/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -12,8 +29,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     command: repo-daemon
 

recipes/distributed-manual/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -8,9 +25,9 @@ services:
       AHRIMAN_OUTPUT: console
       AHRIMAN_PASSWORD: ${AHRIMAN_PASSWORD}
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | sudo -u ahriman ahriman user-add demo -R full
+      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | ahriman user-add demo -R full
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -22,8 +39,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -37,6 +56,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf

recipes/distributed/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -8,9 +25,9 @@ services:
       AHRIMAN_OUTPUT: console
       AHRIMAN_PASSWORD: ${AHRIMAN_PASSWORD}
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | sudo -u ahriman ahriman user-add demo -R full
+      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | ahriman user-add demo -R full
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -22,8 +39,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -37,6 +56,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf
@@ -62,7 +85,7 @@ services:
       AHRIMAN_OUTPUT: console
       AHRIMAN_PASSWORD: ${AHRIMAN_PASSWORD}
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | sudo -u ahriman ahriman user-add demo -R full
+      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | ahriman user-add demo -R full
       AHRIMAN_REPOSITORY: ahriman-demo
       AHRIMAN_REPOSITORY_SERVER: http://frontend/repo/$$repo/$$arch
 

recipes/i686/Dockerfile

@@ -2,8 +2,12 @@ FROM arcan1s/ahriman:edge
 
 ENV ARCH32_KEYRING_VERSION="20231126-1.0"
 
+USER root
+
 RUN pacman-key --init
 
 RUN pacman -Sy --noconfirm wget && \
     wget -nv https://pool.mirror.archlinux32.org/i686/core/archlinux32-keyring-${ARCH32_KEYRING_VERSION}-any.pkg.tar.zst && \
     pacman -U --noconfirm archlinux32-keyring-${ARCH32_KEYRING_VERSION}-any.pkg.tar.zst
+
+USER ahriman

recipes/i686/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: ahriman-i686
     build: .
@@ -12,9 +29,9 @@ services:
       AHRIMAN_PACMAN_MIRROR: https://de.mirror.archlinux32.org/$$arch/$$repo
       AHRIMAN_PASSWORD: ${AHRIMAN_PASSWORD}
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | sudo -u ahriman ahriman user-add demo -R full
+      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | ahriman user-add demo -R full
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: makepkg
@@ -30,8 +47,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -45,6 +64,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf

recipes/index/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -16,8 +33,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     command: repo-report
 

recipes/multirepo/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -8,10 +25,10 @@ services:
       AHRIMAN_OUTPUT: console
       AHRIMAN_PASSWORD: ${AHRIMAN_PASSWORD}
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | sudo -u ahriman ahriman user-add demo -R full
+      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | ahriman user-add demo -R full
       AHRIMAN_PRESETUP_COMMAND: ahriman --architecture x86_64 --repository another-demo service-setup --build-as-user ahriman --packager 'ahriman bot <ahriman@example.com>'
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -23,8 +40,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -38,6 +57,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf

recipes/oauth/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -9,9 +26,9 @@ services:
       AHRIMAN_OAUTH_CLIENT_SECRET: ${AHRIMAN_OAUTH_CLIENT_SECRET}
       AHRIMAN_OUTPUT: console
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: sudo -u ahriman ahriman user-add ${AHRIMAN_OAUTH_USER} -R full -p ""
+      AHRIMAN_POSTSETUP_COMMAND: ahriman user-add ${AHRIMAN_OAUTH_USER} -R full -p ""
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -21,8 +38,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -36,6 +55,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf

recipes/pam/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -10,7 +27,7 @@ services:
       AHRIMAN_PORT: 8080
       AHRIMAN_PRESETUP_COMMAND: useradd -d / -G wheel -M demo; (cat /run/secrets/password; echo; cat /run/secrets/password) | passwd demo
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -22,8 +39,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -37,6 +56,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf

recipes/pull/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -16,8 +33,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
   frontend:
     image: nginx

recipes/sign/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -6,7 +23,7 @@ services:
     environment:
       AHRIMAN_DEBUG: yes
       AHRIMAN_OUTPUT: console
-      AHRIMAN_POSTSETUP_COMMAND: sudo -u ahriman gpg --import /run/secrets/key
+      AHRIMAN_POSTSETUP_COMMAND: gpg --import /run/secrets/key
       AHRIMAN_REPOSITORY: ahriman-demo
 
     configs:
@@ -19,8 +36,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     command: repo-daemon
 

recipes/web/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -8,9 +25,9 @@ services:
       AHRIMAN_OUTPUT: console
       AHRIMAN_PASSWORD: ${AHRIMAN_PASSWORD}
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | sudo -u ahriman ahriman user-add demo -R full
+      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | ahriman user-add demo -R full
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -22,8 +39,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -37,6 +56,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf

tests/testresources/core/ahriman.ini

@@ -23,6 +23,7 @@ allow_read_only = no
 
 [build]
 archbuild_flags =
+devtools_configs = .
 devtools_wrapper = ahriman-archbuild
 ignore_packages =
 makechrootpkg_flags =

tools/tox_plugins/pyproject.toml

@@ -0,0 +1,18 @@
+[build-system]
+requires = [
+    "hatchling",
+]
+build-backend = "hatchling.build"
+
+[project]
+name = "ahriman-tox-plugins"
+classifiers = [
+    "Framework :: tox",
+]
+version = "1"
+
+[project.entry-points.tox]
+dynamic-version = "dynamic_version"
+
+[tool.hatch.build.targets.wheel]
+packages = ["dynamic_version"]

tox.toml

@@ -3,6 +3,7 @@ env_list = [
     "tests",
 ]
 requires = [
+    "ahriman-tox-plugins @ file://{tox_root}/tools/tox_plugins",
     "tox-uv",
 ]
 labels.release = [
@@ -266,6 +267,7 @@ description = "Build frontend HTML and JS"
 allowlist_externals = [
     "npm",
 ]
+skip_install = true
 commands = [
     { replace = "ref", of = ["commands", "npm_install"], extend = true },
     [