1 files changed, 65 insertions, 0 deletions
diff --git a/working/keyring-crash/deploy-ratio.sh b/working/keyring-crash/deploy-ratio.sh
new file mode 100644
index 0000000..f86e290
--- /dev/null
+++ b/working/keyring-crash/deploy-ratio.sh
@@ -0,0 +1,65 @@
+#!/bin/bash
+# Apply the patched gnome-keyring package to a live host (ratio, later velox).
+#
+# Runs only after the VM gates passed and only when Craig says go. Every step
+# is reversible: the encrypted keyring files are backed up with their modes,
+# the stock package stays in the pacman cache for a one-command rollback, and
+# only the keyring service is restarted (one unlock prompt is expected, to be
+# answered in the normal system dialog, never in chat).
+#
+#   deploy-ratio.sh build     build the package from the repo recipe (as the user)
+#   deploy-ratio.sh install   back up, install, restart the daemon, verify
+#   deploy-ratio.sh rollback  reinstall the cached stock 1:51.1-1 and restart
+#   deploy-ratio.sh verify    show versions, owner, restart counter, recent crashes
+set -euo pipefail
+
+repo="${ARCHSETUP_DIR:-$HOME/code/archsetup}"
+recipe="$repo/packages/gnome-keyring"
+build_dir="${BUILD_DIR:-$HOME/.cache/archsetup-build/gnome-keyring}"
+stock_pkg="/var/cache/pacman/pkg/gnome-keyring-1:51.1-1-x86_64.pkg.tar.zst"
+backup_root="$HOME/.local/share/keyrings-backup"
+
+verify() {
+    echo "host: $(uname -n)"
+    pacman -Q gnome-keyring glib2
+    systemctl --user show gnome-keyring-daemon.service -p ActiveState -p NRestarts -p MainPID -p ExecMainStartTimestamp
+    busctl --user status org.freedesktop.secrets 2>/dev/null | grep -E '^(PID|Comm)=' || echo "no Secret Service owner"
+    echo "aborts in the last hour: $(journalctl --user -u gnome-keyring-daemon.service --since '1 hour ago' --no-pager 2>/dev/null | grep -c 'Scheduled restart job')"
+    sha256sum /usr/bin/gnome-keyring-daemon
+}
+
+case "${1:-}" in
+build)
+    [ -f "$recipe/PKGBUILD" ] || { echo "recipe missing: $recipe" >&2; exit 1; }
+    rm -rf "$build_dir"; mkdir -p "$build_dir"; cp -a "$recipe/." "$build_dir/"
+    (cd "$build_dir" && makepkg --noconfirm -s)
+    ls -la "$build_dir"/*.pkg.tar.zst
+    ;;
+install)
+    pkg=$(ls "$build_dir"/gnome-keyring-1:51.1-1.1-x86_64.pkg.tar.zst)
+    [ -f "$stock_pkg" ] || { echo "stock package not in cache for rollback: $stock_pkg" >&2; exit 1; }
+    # Permission-protected backup of the encrypted keyring files, modes kept.
+    stamp=$(date +%Y%m%d-%H%M%S)
+    mkdir -p "$backup_root"; chmod 700 "$backup_root"
+    cp -a "$HOME/.local/share/keyrings" "$backup_root/keyrings-$stamp"
+    chmod -R go-rwx "$backup_root"
+    echo "backup: $backup_root/keyrings-$stamp"
+    sudo pacman -U --noconfirm "$pkg"
+    # Only the keyring service restarts; the socket unit stays. One unlock
+    # prompt is expected afterwards.
+    systemctl --user restart gnome-keyring-daemon.service
+    sleep 2
+    verify
+    ;;
+rollback)
+    sudo pacman -U --noconfirm "$stock_pkg"
+    systemctl --user restart gnome-keyring-daemon.service
+    sleep 2
+    verify
+    ;;
+verify)
+    verify
+    ;;
+*)
+    sed -n '2,13p' "$0"; exit 2 ;;
+esac