{"id":"8076d091-f0a8-40d5-8696-693a97bf0f09","slug":"blackomarchy","kind":"skill","name":"BlackOmarchy","summary":"Additive BlackArch layer for Omarchy. Not a distro and not an Omarchy fork.","owner":"MahdiHedhli","repoUrl":"https://github.com/MahdiHedhli/BlackOmarchy","license":"MIT","licenseTier":"permissive","trust":"community","stars":2,"match":null,"fewStars":true,"format":"skill","createdAt":"2026-08-28T20:16:30.000Z","addedAt":"2026-10-31T23:49:28.829Z","logoUrl":"https://avatars.githubusercontent.com/u/16087011?u=729baeabf1cd5f263589a6474242c8850f468baa&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["cloud-infra","developer-tools"],"tags":["arch-linux","blackarch","cybersecurity","hyprland","linux","omarchy","penetration-testing","security-tools"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-31T23:49:43.182Z","sample":false,"url":"https://conduits.dev/tools/blackomarchy","language":"Shell","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# Black omARCHy\n\n![Black omARCHy login](docs/images/login.png)\n\nAn additive BlackArch layer for [Omarchy](https://omarchy.org).\n\n**Project site:** [mahdihedhli.github.io/BlackOmarchy](https://mahdihedhli.github.io/BlackOmarchy/)\n\nIt is a bootstrap, a small CLI, and a set of package lists that have to\nearn their place on an Omarchy host. It is not a Linux distribution, not\nan ISO, and not a restyle of Omarchy.\n\nAfter a successful install you should still have the same Omarchy\ndesktop, applications, keybindings, and update command. You also have\nthe official BlackArch repository and a curated tool set.\n\nv0.1 is experimental. Treat it that way.\n\n## What this is not\n\n- Not affiliated with, endorsed by, or part of Omarchy, BlackArch, or\n  Arch Linux.\n- Not a fork of Omarchy and not a \"hardened Omarchy\".\n- Not an installer for the complete BlackArch package group.\n- Not a one-line `curl | sudo bash` product.\n\nIf a BlackArch package would change Omarchy, that package is excluded.\n\n## Relationship to upstream projects\n\n| Project | Role |\n| --- | --- |\n| [Omarchy](https://omarchy.org) | The desktop and the supported Arch-based host. Owned by its authors. |\n| [Arch Linux](https://archlinux.org) | The package manager and base that Omarchy already uses. |\n| [BlackArch](https://blackarch.org) | The unofficial Arch user repository of security tools. |\n\nBlack omARCHy only adds the official BlackArch repository, required\nsigning material, curated packages, and its own CLI and state files.\n\n## Prerequisites\n\n- A clean, supported Omarchy 4.x install (packaged `omarchy`, not\n  `omarchy-dev`). v0.1 was checked on 4.0.1 and 4.0.2. The latest\n  ISO is currently 4.0.2; we do not pin a single patch level.\n- `x86_64`\n- Root via `sudo`\n- Network access to `blackarch.org` and `www.blackarch.org`\n- Network access to `keyserver.ubuntu.com` or `keys.openpgp.org` for\n  fingerprint-pinned signing keys\n\n## Installation\n\nCopy the repository to the Omarchy machine, read `bootstrap.sh`, then\nrun it.\n\n```bash\ngit clone https://github.com/MahdiHedhli/BlackOmarchy.git\ncd BlackOmarchy\nless bootstrap.sh\nsudo ./bootstrap.sh\n```\n\nThe script:\n\n1. Checks architecture and Omarchy evidence\n2. Backs up pacman configuration\n3. Records an Omarchy baseline\n4. Downloads the official `strap.sh` and checks its SHA1 against the\n   value published on the BlackArch downloads page.\n5. Discovers the `blackarch-keyring` package through the official\n   repository database and verifies its detached GPG signature against\n   an explicit allowlist of trusted signer fingerprints.\n6. Runs the verified strap script if the BlackArch repository is not\n   already enabled.\n7. Installs the core profile one package at a time, skipping anything\n   that would upgrade or replace already-installed software.\n8. Installs the blackomarchy CLI, Omarchy menu overlay, login\n   wordmark, update hooks, and Agent Skills.\n9. Compares the Omarchy baseline and exits non-zero on unexpected\n   drift.\n\nRe-running bootstrap is safe. It will not duplicate `[blackarch]` or\nre-run `strap.sh` when the repo is already enabled. Re-run it after\npulling this repo to refresh CLI, hooks, login overlay, and skills.\n\nAfter install, Omarchy's menu grows additive entries (no upstream files\nare patched):\n\n- Install > Black omARCHy\n- Remove > Black omARCHy\n- Install > Security tools (All lists the BlackArch catalog; extra\n  profiles still fan out from the curated lists)\n- Security (status, verify, and a few installed tools)\n\nInstall and Remove use the same floating terminal Omarchy uses for\nChrome, 1Password, and other optional apps. After the first bootstrap,\nadd/remove is that menu path. Uninstall keeps the Install row so\nre-add is the same gesture.\n\nThe SDDM login screen and Plymouth reboot/unlock splash keep Omarchy's\ngreeter, script, and colors. Bootstrap overlays `logo.png` only: a\nquiet BLACK caption above the pixel OMARCHY wordmark, with the\nBlackArch katana through the A. Plymouth is baked into initramfs once\n(`plymouth-set-default-theme` plus `limine-mkinitcpio` or\n`mkinitcpio -P`) so the mark survives reboot. Uninstall restores\nOmarchy's logos and rebuilds initramfs. `omarchy update`,\n`omarchy refresh sddm`, and Style > Unlock re-apply the overlay if a\npackaged refresh overwrote it. `Main.qml` is not patched.\n\n## Agent skills\n\nBootstrap installs two standard Agent Skills (`SKILL.md` folders), not\nGrok-only:\n\n| Skill | Role |\n| --- | --- |\n| `black-omarchy` | This host: CLI, profiles, `omarchy update`, Omarchy invariants |\n| `black-omarchy-pentest` | Authorized collaborative / semi-autonomous testing |\n\nThey land in the directories common agents already scan (`~/.agents/skills`,\n`~/.grok/skills`, `~/.claude/skills`, `~/.cursor/skills`, `~/.codex/skills`,\nOpenCode, Gemini). A clone of this repo also has `.agents/skills/` plus\n[AGENTS.md](AGENTS.md) / [CLAUDE.md](CLAUDE.md).\n\n`black-omarchy-pentest` will not scan until authorization and scope are\non record. It will not generate exploit source. Details:\n[docs/agent-skills.md](docs/agent-skills.md).\n\n## Updating\n\nKeep using Omarchy's update command:\n\n```bash\nomarchy update\n```\n\nThat is `pacman -Syu` plus migrations. With `[blackarch]` last in\n`pacman.conf`, BlackArch **packages** update in the same transaction.\nDo not replace this with a raw `pacman -Syu`.\n\nAfter packages, Omarchy runs `post-update.d`. Our hook:\n\n1. Re-appends `[blackarch]` if a migration rewrote `pacman.conf`\n2. Runs `blackomarchy-update` (fast-forward the seeded git tree, then\n   `bootstrap.sh`) so CLI, hooks, skills, and the login wordmark match\n   this repo\n3. If the git pull cannot run, still restores the login overlay and\n   refreshes the baseline pin\n\nA failed layer pull does not fail the Omarchy update.\n\nTo refresh the layer without an Omarchy upgrade:\n\n```bash\nblackomarchy update\n```\n\nThat is the same as `blackomarchy-update`. First-time source is\n`~/.local/share/blackomarchy-src` (cloned from GitHub on install).\n\n`omarchy refresh pacman` still copies a channel template over\n`pacman.conf`. The `pre-refresh-pacman.d` hook puts `[blackarch]` back\nlast before `-Syyuu`.\n\nLogout uses SDDM. Reboot and disk-unlock use Plymouth, which lives in\ninitramfs — overlaying the greeter file alone does not survive reboot.\n\nIf either screen still shows stock OMARCHY:\n\n```bash\nsudo /usr/local/sbin/blackomarchy-apply-login-branding apply\nblackomarchy doctor\n```\n\nThat copies the wordmark onto SDDM and Plymouth, then rebuilds\ninitramfs and refreshes the live UKI Blake2b hash in `limine.conf`.\nA oneshot before `sddm`, a path watch on both `logo.png` files, and a\npacman hook re-apply the overlay when a packaged refresh restores\nstock. The Plymouth bake is skipped when the live splash already\nmatches.\n\nIf reboot stops on `Blake2b hash for URI ... does not match`, press\n`Y` once to continue, then:\n\n```bash\nsudo /usr/local/sbin/blackomarchy-apply-login-branding sync-limine\n```\n\n## Package profiles\n\nDefault install is `core` only.\n\n```bash\nblackomarchy profiles\nsudo blackomarchy install web\nsudo blackomarchy install recon\nsudo blackomarchy install network\nsudo blackomarchy install wireless\nsudo blackomarchy install reversing\nsudo blackomarchy install forensics\nsudo blackomarchy install password\nsudo blackomarchy install all\n```\n\n`all` means every Black omARCHy curated profile. It does not mean every\nBlackArch package.\n\nSee [docs/package-profiles.md](docs/package-profiles.md) and\n[docs/compatibility.md](docs/compatibility.md).\n\n## Verification\n\n```bash\nblackomarchy status\nblackomarchy verify\nblackomarchy doctor\n```\n\n`verify` fails if Omarchy-owned files under `/usr/share/omarchy`, the\nOmarchy repo `Server=` line, or the `omarchy` packages drifted. That is\nnot a “you must be on the newest ISO” check.\n\nA fresh install can rewrite files under `~/.config/omarchy` (our menu\noverlay and hooks, plus Omarchy’s own pacman hooks). If `verify` says\n**Omarchy user configuration changed**, the layer is still installed.\nRefresh the pin:\n\n```bash\nsudo blackomarchy recapture-baseline\nblackomarchy verify\n```\n\n## Uninstall\n\n```bash\nsudo ./uninstall.sh\n```\n\nDetails: [docs/uninstall.md](docs/uninstall.md).\n\n## Security model\n\n- No `curl | sh`.\n- `strap.sh` is hash-checked against the value published on the\n  official BlackArch downloads page.\n- The `blackarch-keyring` package is downloaded from the official\n  repository and its detached GPG signature is verified against an\n  explicit allowlist of trusted signer fingerprints.\n- Installed BlackArch keyring files are checked against the\n  independently verified package.\n- Bootstrap never sets `OMARCHY_ALLOW_DIRECT_PACMAN`.\n- The verified upstream script runs without a controlling terminal so\n  its full-upgrade prompt takes the explicit decline path. Keep using\n  `omarchy update` for system upgrades.\n- Conflicts are skipped, not overwritten.\n- Local operator files live in `private/` and are gitignored.\n- The downloads-page SHA1 is same-origin with `strap.sh`. It catches\n  corruption and split-brain, not a compromise of blackarch.org itself.\n- The repository database (`blackarch.db`) is fetched over HTTPS but is\n  not itself signature-verified, so a mirror could serve an older,\n  validly signed keyring package. The package signature, not the\n  database, is the trust anchor.\n\nDetails of the keyring verification flow:\n[docs/blackarch-bootstrap-compatibility.md](docs/blackarch-bootstrap-compatibility.md).\n\n## Known limitations\n\n- x86_64 and packaged Omarchy 4.x only (checked on 4.0.1 and 4.0.2)\n- `omarchy-dev` is refused\n- Some profile candidates will be missing or excluded on a given host\n- BlackArch tools that share a name with Arch `extra` keep the\n  Omarchy/Arch version because `[blackarch]` is appended last\n- v0.1 does not add Hyprland themes or keybindings; the menu, login\n  wordmark, and Agent Skills are overlays and uninstall cleanly\n- `hydra` pulls a large extra dependency set (including freerdp and\n  subversion). That did not upgrade Omarchy's own packages.\n- `omarchy update -y` over a non-interactive SSH session may still hit\n  a nested sudo prompt. The Omarchy system-package updater\n  (`omarchy-update-system-pkgs`) completed with BlackArch enabled.\n\n## Contributing\n\nContributions are welcome from anyone with a GitHub account. Fork the\nrepository, make a focused change on a branch, and open a pull request\nagainst `MahdiHedhli/BlackOmarchy:main`; collaborator access is not required.\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for the workflow and validation steps.\n\nRead `.specify/memory/constitution.md` and\n`specs/001-black-omarchy-bootstrap/spec.md` before proposing changes.\nThe design test is: does Black omARCHy require this, or are we trying\nto make Omarchy look like a security distribution?\n\n## Disclaimer\n\nBlack omARCHy is an independent integration project. Omarchy, BlackArch,\nand Arch Linux names are used for identification only. Security tools\ncan be misused; you are responsible for how you use them.\n"}