From d88417312a0bd55e249ae81e4e8bd4b356d15d0b Mon Sep 17 00:00:00 2001 From: Roland Date: Mon, 25 May 2026 18:35:29 -0600 Subject: [PATCH] Adding desktop shortcuts for WROLPi services + trust-on-login autostart. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Five Type=Link launchers drop on /home/wrolpi/Desktop/ via the chroot hook: WROLPi https://localhost/ /opt/wrolpi/icon.png WROLPi Controller https://localhost/controller/ controller-logo.png WROLPi Help https://localhost:8086/ help-browser (icon theme) Kiwix Library https://localhost:8085/ accessories-dictionary WROLPi Files file:///media/wrolpi/ folder All HTTPS URLs land on Caddy on localhost; the file:// URL is dispatched via xdg-open to Thunar. XFCE Bookworm rejects any .desktop file in $HOME/Desktop without metadata::trusted set, even for Type=Link entries (verified live). So this also restores the trust autostart we previously had for the now- removed Calamares icon — generalised to walk every *.desktop in $HOME/Desktop and stamp the trust metadata on each, every session start. Idempotent; gio set is a no-op when values already match. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../hooks/normal/9999-wrolpi.hook.chroot | 47 +++++++++++++++++++ .../wrolpi-trust-desktop-icons.desktop | 11 +++++ .../usr/local/bin/wrolpi-trust-desktop-icons | 28 +++++++++++ 3 files changed, 86 insertions(+) create mode 100644 debian-live-config/config/includes.chroot/etc/xdg/autostart/wrolpi-trust-desktop-icons.desktop create mode 100755 debian-live-config/config/includes.chroot/usr/local/bin/wrolpi-trust-desktop-icons diff --git a/debian-live-config/config/hooks/normal/9999-wrolpi.hook.chroot b/debian-live-config/config/hooks/normal/9999-wrolpi.hook.chroot index d20644f2..ed9e7d4f 100644 --- a/debian-live-config/config/hooks/normal/9999-wrolpi.hook.chroot +++ b/debian-live-config/config/hooks/normal/9999-wrolpi.hook.chroot @@ -207,6 +207,53 @@ autologin-session=xfce EOF mkdir -p /home/wrolpi/Desktop + +# Desktop shortcuts to WROLPi's HTTPS services and the on-drive media +# directory. Type=Link entries dispatch via xdg-open, which sidesteps +# XFCE's executable-launcher trust check (the check only applies to +# Type=Application entries with an Exec field). All URLs go through +# Caddy on localhost, configured in /etc/caddy/Caddyfile. +cat > /home/wrolpi/Desktop/wrolpi-app.desktop <<'EOF' +[Desktop Entry] +Encoding=UTF-8 +Name=WROLPi +Type=Link +URL=https://localhost/ +Icon=/opt/wrolpi/icon.png +EOF +cat > /home/wrolpi/Desktop/wrolpi-controller.desktop <<'EOF' +[Desktop Entry] +Encoding=UTF-8 +Name=WROLPi Controller +Type=Link +URL=https://localhost/controller/ +Icon=/opt/wrolpi/etc/raspberrypios/controller-logo.png +EOF +cat > /home/wrolpi/Desktop/wrolpi-help.desktop <<'EOF' +[Desktop Entry] +Encoding=UTF-8 +Name=WROLPi Help +Type=Link +URL=https://localhost:8086/ +Icon=help-browser +EOF +cat > /home/wrolpi/Desktop/wrolpi-kiwix.desktop <<'EOF' +[Desktop Entry] +Encoding=UTF-8 +Name=Kiwix Library +Type=Link +URL=https://localhost:8085/ +Icon=accessories-dictionary +EOF +cat > /home/wrolpi/Desktop/wrolpi-files.desktop <<'EOF' +[Desktop Entry] +Encoding=UTF-8 +Name=WROLPi Files +Type=Link +URL=file:///media/wrolpi/ +Icon=folder +EOF + chown -R wrolpi:wrolpi /home/wrolpi/Desktop # Drop the default Postgres cluster created by the postgresql-* package. diff --git a/debian-live-config/config/includes.chroot/etc/xdg/autostart/wrolpi-trust-desktop-icons.desktop b/debian-live-config/config/includes.chroot/etc/xdg/autostart/wrolpi-trust-desktop-icons.desktop new file mode 100644 index 00000000..f91ba233 --- /dev/null +++ b/debian-live-config/config/includes.chroot/etc/xdg/autostart/wrolpi-trust-desktop-icons.desktop @@ -0,0 +1,11 @@ +[Desktop Entry] +Type=Application +Name=WROLPi Trust Desktop Icons +Comment=Mark all desktop launchers as trusted so XFCE will launch them +Exec=/usr/local/bin/wrolpi-trust-desktop-icons +TryExec=/usr/local/bin/wrolpi-trust-desktop-icons +Icon=dialog-information +Terminal=false +Categories=System; +NoDisplay=true +X-GNOME-Autostart-enabled=true diff --git a/debian-live-config/config/includes.chroot/usr/local/bin/wrolpi-trust-desktop-icons b/debian-live-config/config/includes.chroot/usr/local/bin/wrolpi-trust-desktop-icons new file mode 100755 index 00000000..14b9ffa6 --- /dev/null +++ b/debian-live-config/config/includes.chroot/usr/local/bin/wrolpi-trust-desktop-icons @@ -0,0 +1,28 @@ +#!/bin/sh +# Mark every .desktop file in ~/Desktop as trusted so XFCE will actually +# launch it on double-click. XFCE Bookworm requires trust metadata +# (metadata::trusted + metadata::xfce-exe-checksum) even for Type=Link +# entries. +# +# Runs at user session start via /etc/xdg/autostart/. Idempotent — safe +# to re-run; gio set is a no-op if the metadata already matches. +# +# Requires gvfs (for the metadata service that `gio set` talks to). + +LOG=/tmp/wrolpi-trust-desktop-icons.log +exec >>"$LOG" 2>&1 +echo "===== $(date) invoked (user=$(id -un)) =====" + +DESKTOP="$HOME/Desktop" +[ -d "$DESKTOP" ] || exit 0 + +for f in "$DESKTOP"/*.desktop; do + [ -f "$f" ] || continue + gio set --type=string "$f" metadata::trusted true 2>&1 || true + gio set --type=string "$f" metadata::xfce-exe-checksum \ + "$(sha256sum "$f" | cut -d' ' -f1)" 2>&1 || true + touch "$f" + echo "trusted: $f" +done + +echo "done"