Save and apply
Every line of drift has two possible fixes: change the repo to match
the machine, or change the machine to match the repo. admin save and
admin apply are the two.
Change the repo: admin save
When the drift is something you meant, record it:
admin save
Wrote /home/admin/arch/aconfmgr/99-unsorted.sh. Move what you meant into a numbered file, delete the rest (and 'admin apply' to undo it), then commit.
99-unsorted.sh holds the same lines admin diff printed. Files it
copied – the sysctl file, here – are under aconfmgr/files/. It is
git-ignored on purpose: it is a to-do list, not configuration, and it
should not survive the review.
Review and commit
Sort each line into the place it belongs. In this repo, that is usually not another aconfmgr file, but the plain file aconfmgr reads:
| Line in 99-unsorted.sh | Where it goes |
|---|---|
AddPackage foo |
foo on a line of packages.txt |
CopyFile /etc/... |
the file, moved from aconfmgr/files/etc/... to etc/... |
CreateLink /etc/systemd/... |
the unit in units.txt |
| anything that is state | an IgnorePath in aconfmgr/90-ignore.sh |
| anything you did not mean | nowhere: delete it, and admin apply will undo it on the machine |
For the example above:
cd ~/arch echo htop >> packages.txt mkdir -p etc/sysctl.d mv aconfmgr/files/etc/sysctl.d/99-swappiness.conf etc/sysctl.d/ rm -r aconfmgr/99-unsorted.sh aconfmgr/files admin diff git add -A git commit -m "htop; lower swappiness"
The second admin diff is the check that the sorting was right: it
should say there is no drift. save writes and never commits, and
that review is the whole point – it is the moment the machine’s
history gets a reason attached to it.
Change the machine: admin apply
Edit the repo, commit, and apply:
echo ripgrep >> ~/arch/packages.txt git -C ~/arch commit -am "Add ripgrep" admin apply
aconfmgr shows each change before it makes it and asks. It installs what is missing, puts files back the way the repo has them, and enables units.
apply makes the machine match the repo exactly. A package
installed by hand and not in packages.txt is uninstalled (aconfmgr
marks it as a dependency, then removes orphans); a file that the repo
does not describe and 90-ignore.sh does not ignore is deleted. That is what makes it an undo button, and also why you
should run admin diff first and admin save anything you want to
keep. Read what it proposes before answering yes, and do not get into
the habit of admin apply --yes.
This is also how a second machine picks up a change: pull the repo there and apply.
Packages from the AUR
The AUR is not a repository of packages but of build recipes,
contributed by users and reviewed by nobody. Nothing in packages.txt
can come from it, because pacstrap and pacman only know the
official repositories. aconfmgr calls anything pacman did not install
from a repository a foreign package, and describes it with a
--foreign flag:
AddPackage --foreign yay # Yet another yogurt. Pacman wrapper and AUR helper written in go. AddPackage --foreign solo2-cli # A CLI for SoloKeys Solo 2 devices
You rarely type those lines yourself. Install something from the AUR by
hand and admin save writes them for you, comment and all, exactly as
it does for a package from the repos – which is the point: a foreign
package that is not described is drift, and admin apply would remove
it.
What makes this work without any setting of your own is how aconfmgr
finds a builder. It looks for aurman, pacaur, yaourt, yay,
paru, aura and then makepkg, in that order, and uses the first
one on PATH; --aur-helper HELPER overrides the choice. And if one of
those names is itself in the list of foreign packages it is about to
install, it builds that one first, with makepkg, and then uses it
for the rest. So a single AddPackage --foreign yay bootstraps itself
on a machine that has never had an AUR helper.
makepkg is what every one of those helpers ultimately runs, and it
needs the toolchain in base-devel – which setup does not install,
because a machine that builds nothing does not need a compiler. Add it
before the first foreign package, or the build fails on a missing
fakeroot:
echo base-devel >> ~/arch/packages.txt
makepkg also refuses to run as root, which is why admin apply runs
aconfmgr as admin and lets it call sudo for the parts that need it.
admin upgrade runs pacman -Syu, which has never heard of the AUR,
and then admin apply, which installs foreign packages that are
missing but does not rebuild ones that are merely out of date. So
foreign packages stay at whatever version you built, including when
that version grows a security hole. Upgrading them is a separate habit
– yay -Sua – and the honest reason to keep the --foreign list
short.
No machine built by this book has installed an AUR package yet. The
behaviour above is read from the pinned aconfmgr (96ab414) rather
than observed.