Update shenv SSH_AUTH_SOCK code

Migrated Vim plugins from Git submodules to vim-plug, and Tmux plugins
to TPM (Tmux Plugin Manager).

This change:
- Updates `install.sh` to automatically install vim-plug and TPM.
- Modifies `dotfiles/vimrc` to configure plugins via vim-plug.
- Modifies `dotfiles/tmux.conf` to configure plugins via TPM.
- Removes all Vim and Tmux submodule entries from `.gitmodules`.
- Deletes the old submodule directories from the repository.

This streamlines plugin management, making updates easier and reducing
the complexity of the main `install.sh` script.

.Brewfile.ignore

@@ -0,0 +1,6 @@
+# Add package names here to ignore them in Brewfile updates.
+# One package per line.
+# Example:
+# iterm2
+# wget
+orbstack

.gemini/settings.json

@@ -0,0 +1,5 @@
+{
+  "context": {
+    "fileName": "AGENTS.md"
+  }
+}

.githooks/githooks.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+
+# --- 1. Identity Resolution ---
+# Finds the physical location of this script, regardless of symlinks
+REAL_PATH=$(realpath "$0")
+REAL_NAME=$(basename "$REAL_PATH")
+HOOKS_DIR=$(dirname "$REAL_PATH")
+CALLED_AS=$(basename "$0")
+
+# --- 2. Self-Installation / Sync Logic ---
+if [ "$CALLED_AS" == "$REAL_NAME" ]; then
+    echo "🔧 Synchronizing Git Hook Dispatcher..."
+
+    # Point Git to this directory
+    git config core.hooksPath "$HOOKS_DIR"
+
+    # Create symlinks for any [hook-name].d directories found
+    for d in "$HOOKS_DIR"/*.d/; do
+        [ -d "$d" ] || continue
+        HOOK_NAME=$(basename "$d" .d)
+        TARGET="$HOOKS_DIR/$HOOK_NAME"
+
+        if [ ! -L "$TARGET" ]; then
+            ln -sf "$REAL_NAME" "$TARGET"
+            chmod +x "$TARGET"
+            echo "   ✨ Linked: $HOOK_NAME"
+        fi
+    done
+
+    # Cleanup: Remove symlinks that no longer have a matching .d directory
+    for link in "$HOOKS_DIR"/*; do
+        if [ -L "$link" ] && [ "$(basename "$link")" != "$REAL_NAME" ]; then
+            if [ ! -d "${link}.d" ]; then
+                rm "$link"
+                echo "   🗑️ Removed: $(basename "$link")"
+            fi
+        fi
+    done
+    echo "✅ Done."
+    exit 0
+fi
+
+# --- 3. Selective Stdin Buffering ---
+# Buffer stdin only for hooks that expect it to prevent hanging/performance hits
+STDIN_DATA=""
+case "$CALLED_AS" in
+    pre-push|post-rewrite|pre-receive|post-receive|reference-transaction)
+        # Check if stdin has data (is not a terminal)
+        if [ ! -t 0 ]; then
+            STDIN_DATA=$(cat)
+        fi
+        ;;
+esac
+
+# --- 4. Dispatch Logic ---
+SUB_HOOK_DIR="${HOOKS_DIR}/${CALLED_AS}.d"
+
+if [ -d "$SUB_HOOK_DIR" ]; then
+    # Sort files naturally so 01- runs before 02-
+    for script in $(ls "$SUB_HOOK_DIR" | sort); do
+        FULL_PATH="$SUB_HOOK_DIR/$script"
+        [ -x "$FULL_PATH" ] || continue
+
+        # Replay stdin if we captured it, otherwise execute normally
+        if [ -n "$STDIN_DATA" ]; then
+            echo "$STDIN_DATA" | "$FULL_PATH" "$@"
+        else
+            "$FULL_PATH" "$@"
+        fi
+
+        # Exit immediately if any sub-script fails
+        EXIT_CODE=$?
+        if [ $EXIT_CODE -ne 0 ]; then
+            echo "❌ Hook '$CALLED_AS' failed at: $script"
+            exit $EXIT_CODE
+        fi
+    done
+fi
+
+exit 0

.githooks/pre-commit

@@ -0,0 +1 @@
+githooks.sh

.githooks/pre-commit.d/05-check-brewfile

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+# Check if Brewfile needs updating
+if [[ "$(uname)" != "Darwin" ]]; then
+    exit 0
+fi
+
+# We use the script we just created
+UPDATE_SCRIPT="bin/macos/update_brewfile"
+
+if [[ -x "$UPDATE_SCRIPT" ]]; then
+    # Run in dry-run mode and see if there's output
+    DIFF_OUTPUT=$("$UPDATE_SCRIPT" --dry-run 2>/dev/null)
+    if [[ "$DIFF_OUTPUT" == *"Changes detected"* ]]; then
+        echo "⚠️  Brewfile is out of sync with your installed packages."
+        echo "   Run '$UPDATE_SCRIPT' to synchronize it."
+        echo ""
+        # We don't fail the commit, just warn.
+    fi
+fi

.gitignore

@@ -1,5 +1,9 @@
-private_dotfiles
-private_dotfiles/**
+installed-prefs
+.installed-prefs
 *.swp
 *~
 *.bak
+local_dotfiles
+dotfile_overlays/*
+!dotfile_overlays/.keep
+!dotfile_overlays/README

.gitmodules

@@ -0,0 +1 @@
+

AGENTS.md

@@ -0,0 +1,69 @@
+## Installation and Environment
+
+This is a set of dotfiles and utilities for setting up my personal environment
+on POSIX-style environments. It is cloned from github and installed from the
+`install.sh` script.
+
+It mostly relies on symlinking dotfiles and other resources into the appropriate
+locations, but also installs dependencies in various ways.
+
+I primarily target Debian Linux-based (Debian, Ubuntu, and Kali Linux) systems
+as well as MacOS.  Other platforms are lower priorities.  Shell scripts ending
+in `.sh` should use only POSIX features unless there is a shebang line at the
+beginning suggesting a different shell will be used.
+
+`zsh` and `fish` are the key interactive shells to be configured, but `bash`
+may also be used at times.
+
+## Project Structure
+
+*   `bin/`: Contains executable scripts symlinked to `~/bin/`. Subdirectories like `macos/`, `restic/`, and `setup/` are included.
+*   `dotfiles/`: Contains configuration files (dotfiles) symlinked to the home directory.
+*   `dotfile_overlays/`: Each directory within is symlinked to the home directory, allowing for modular or git-submodule-based configurations.
+*   `local_dotfiles/`: If present, its contents are symlinked to the home directory (ignored by git).
+*   `packages/`: Contains lists of packages (one per line) for different environments or toolsets.
+*   `keys/`: Contains SSH keys (`ssh/`), GPG keys (`gpg/`), and a `known_hosts` file to be installed/merged.
+*   `skeltools/`: Internal utilities used by the installation scripts.
+*   `sysctl/` and `udev/`: Linux system configuration files.
+*   `Brewfile`: Homebrew package list for macOS environments.
+*   `install.sh`: The primary installation script for symlinking and basic setup.
+
+## Notes on Security Issues
+
+It is safe to have scripts and tools re-invoke themselves with sudo when they
+require elevated privileges, as these are my own. Do not attempt to remove
+these use cases.
+
+## Making Changes
+
+**IMPORTANT**: Only make those changes which are explicitly requested.  If you
+identify other issues, notify me about them, but do not suggest changes until I
+ask for them.
+
+When making large changes, explain your chain of thought transparently and
+explain solution design.
+
+If making changes that affects how the user installs the tools, update
+`README.md` accordingly.
+
+### Adding a new dotfile
+
+1.  Place the new dotfile in the `dotfiles/` directory.
+2.  Alternatively, use `dotfile_overlays/` if the dotfile belongs to a specific group or submodule.
+3.  The `install.sh` script will automatically symlink it to the home directory.
+
+### Adding a new script to `bin/`
+
+1.  Add the new script to the `bin/` directory (or an appropriate subdirectory).
+2.  Ensure the script is executable (`chmod +x`).
+
+### Adding a new package
+
+1.  Identify the appropriate package list in the `packages/` directory (e.g., `packages/cli`, `packages/kali`).
+2.  Add the new package name to the list (one per line).
+3.  If a new package set is required, create a new file in the `packages/` directory.
+4.  For macOS-specific packages, also consider adding them to the `Brewfile`.
+
+### Platform-specific changes
+
+When making changes that are specific to a platform (e.g., Debian vs. macOS), please check for existing conventions in the `install.sh` script or other files. Use conditional logic (e.g., checking `uname`) to apply platform-specific settings.

Brewfile

@@ -0,0 +1,106 @@
+tap "dart-lang/dart"
+tap "sass/sass"
+brew "ack"
+brew "acme.sh"
+brew "age"
+brew "autoconf"
+brew "automake"
+brew "b2-tools"
+brew "bat"
+brew "cask"
+brew "ccache"
+brew "certbot"
+brew "cmake"
+brew "colima"
+brew "devcontainer"
+brew "difftastic"
+brew "dfu-util"
+brew "direnv"
+brew "duck"
+brew "earthly"
+brew "esptool"
+brew "gh"
+brew "ghidra", link: false
+brew "git"
+brew "git-delta"
+brew "git-lfs"
+brew "gnupg"
+brew "go"
+brew "gradle"
+brew "htop"
+brew "httpie"
+brew "huggingface-cli"
+brew "hugo"
+brew "imagemagick"
+brew "john-jumbo"
+brew "jq"
+brew "lima"
+brew "mise"
+brew "mosh"
+brew "neovim"
+brew "ninja"
+brew "nmap"
+brew "protobuf"
+brew "p7zip"
+brew "pipenv"
+brew "pipx"
+brew "pkgconf"
+brew "pwgen"
+brew "pwntools"
+brew "qemu"
+brew "restic"
+brew "ripgrep"
+brew "ruby"
+brew "ruby@3.3"
+brew "rustup"
+brew "scroll-reverser"
+brew "shellcheck"
+brew "smartmontools"
+brew "starship"
+brew "tmux"
+brew "uv"
+brew "virtualenvwrapper"
+brew "wget"
+brew "yt-dlp"
+brew "zlib"
+brew "zsh-syntax-highlighting"
+brew "sass/sass/migrator"
+brew "sass/sass/sass"
+cask "codeql"
+cask "cyberduck"
+cask "font-fira-code-nerd-font"
+cask "font-fira-mono-nerd-font"
+cask "font-go-mono-nerd-font"
+cask "font-hack-nerd-font"
+cask "font-inconsolata-nerd-font"
+cask "font-symbols-only-nerd-font"
+cask "font-terminess-ttf-nerd-font"
+cask "ghidra"
+cask "gimp"
+cask "github"
+cask "iterm2"
+cask "macfuse"
+cask "meld"
+cask "mitmproxy"
+cask "raycast"
+cask "rectangle"
+cask "scroll-reverser"
+cask "temurin"
+cask "veracrypt"
+cask "zulu@17"
+
+def is_corp?
+  # Check for MDM enrollment (Enrolled via DEP: Yes)
+  `profiles status -type enrollment 2>/dev/null`.include?("Enrolled via DEP: Yes")
+end
+
+# non-corp
+if !is_corp?
+  brew "bazel"
+  brew "openssh"
+  cask "claude-code"
+  cask "cryptomator"
+  cask "gcloud-cli"
+  cask "google-cloud-sdk"
+  cask "orbstack"
+end

README.md

@@ -0,0 +1,86 @@
+### About ###
+
+This is a repository of configuration files that I like to have on all the
+machines that I use. For new systems, you can bootstrap by running the
+included `clone.sh` script:
+
+```bash
+curl -L https://raw.githubusercontent.com/Matir/skel/master/clone.sh | bash
+```
+
+Alternatively, you can manually clone the repository and run `./install.sh`.
+
+This started just as dotfiles, but expanded to include SSH keys, GPG keys,
+and an ever-growing setup script.  There are various
+options to install just parts of it, such as on a machine where I only have a
+user account but no root.
+
+This environment supports using `dotfile_overlays/` or `local_dotfiles/` to
+manage machine-specific or private configurations. You can use
+[git-crypt](https://github.com/AGWA/git-crypt) on these overlay directories
+for things you don't want to splash all over the internet. :)
+I still wouldn't check in anything terribly sensitive, like private keys.
+
+### Usefulness ###
+
+Mostly I post this to github so I can quickly grab the things I want, but it
+might also be useful to others.  Feel free to raise an issue if you have any
+questions.  I don't anticipating taking merge requests -- make your own
+dotfiles.  ;)
+
+### Options ###
+
+### macOS-like Copy/Paste ###
+
+To address keyboard shortcut conflicts between operating systems, this environment
+now supports using `Alt+C` for copy and `Alt+V` for paste, similar to macOS.
+This functionality is context-aware: it will automatically use `Ctrl+Shift+C/V`
+in terminals and `Ctrl+C/V` in all other applications.
+
+This feature requires the following packages to be installed:
+
+-   `xbindkeys`: To listen for the keyboard shortcuts.
+-   `xdotool`: To send the appropriate keypresses.
+
+On Debian-based systems (like Ubuntu or Kali), you can install them with:
+
+```bash
+sudo apt-get update
+sudo apt-get install xbindkeys xdotool
+```
+
+After installation, the functionality will be enabled automatically on your
+next login.
+
+On macOS, you can install the recommended packages using the included `Brewfile`:
+
+```bash
+brew bundle install
+```
+
+### Packages ###
+
+The `packages/` directory contains lists of recommended packages. You can
+manually install a set (e.g., on a Debian-based system) using:
+
+```bash
+grep -v "^#" packages/cli | xargs sudo apt-get install -y
+```
+
+```
+BASEDIR: Where the skel framework is installed.  Defaults to $HOME/.skel
+MINIMAL: Don't do things that require git clones or installation of anything
+  not included in my .skel. (e.g., skips vim-plug, TPM) (Defaults to 0)
+INSTALL_KEYS: Install GnuPG and SSH keys.  SSH keys are placed in
+  authorized_keys. (Defaults to 1, installs keys.)
+TRUST_ALL_KEYS: Allow all keys to be used for SSH login, versus a small subset.
+VERBOSE: Enable verbose output during installation. (Defaults to 0)
+SAVE: Save the install options to ${BASEDIR}/.installed-prefs
+```
+
+### TODO ###
+
+-  [X] Re-do the installation of packages.
+    -  [X] Make manual installation of sets easy/possible.
+    -  [X] Make missing packages not cause a full set failure.
+    -  [X] Allow comments and blank lines. in packages

bin/add_hosts_entry

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+
+# vim: set ft=python:
+
+import datetime
+import ipaddress
+import os
+import sys
+import sys.path
+
+
+def generate_hosts_entry(ip_address_str, hostnames):
+    """
+    Generates a string formatted for /etc/hosts after validating the IP address.
+
+    Args:
+        ip_address_str (str): The IP address string.
+        hostnames (list): A list of hostname strings.
+
+    Returns:
+        str: A formatted string for /etc/hosts, or None if validation fails.
+    """
+    try:
+        # Validate the IP address
+        ip = ipaddress.ip_address(ip_address_str)
+    except ValueError:
+        print(f"Error: '{ip_address_str}' is not a valid IP address.", file=sys.stderr)
+        return None
+
+    # Join hostnames with spaces
+    hostnames_str = " ".join(hostnames)
+
+    # Return the formatted line
+    return f"{ip}    {hostnames_str}"
+
+
+def append_hosts_entry(entry, hosts_file="/etc/hosts"):
+    when = datetime.datetime.now().strftime("%Y-%m-%d %H:%M")
+    try:
+        with open(hosts_file, "a") as fp:
+            fp.write(f"# Added by add_hosts_entry {when}\n{entry}\n")
+        return True
+    except PermissionError:
+        if os.geteuid() == 0:
+            print(f"Error: failed opening {hosts_file} for writing.",
+                  file=sys.stderr)
+            return False
+        return relaunch_with_sudo()
+
+
+def relaunch_with_sudo():
+    script_abspath = os.path.abspath(sys.argv[0])
+    os.execvp("sudo", [script_abspath] + sys.argv[1:])
+
+
+if __name__ == "__main__":
+    # Check for correct number of arguments
+    if len(sys.argv) < 3:
+        print("Usage: python3 generate_hosts_entry.py <ip_address> <hostname1> [hostname2 ...]", file=sys.stderr)
+        sys.exit(1)
+
+    ip_to_add = sys.argv[1]
+    hostnames_to_add = sys.argv[2:]
+
+    # Generate the entry
+    entry = generate_hosts_entry(ip_to_add, hostnames_to_add)
+    if not entry:
+        sys.exit(1)
+    if not append_hosts_entry(entry):
+        sys.exit(1)

bin/autostart.py

@@ -0,0 +1,16 @@
+#!/usr/bin/python
+"""
+Launch desktop files from ~/.config/autostart
+"""
+
+import glob
+import os.path
+from gi.repository import Gio
+
+dirname = os.path.expanduser('~/.config/autostart')
+for desktop in glob.glob(os.path.join(dirname, '*.desktop')):
+    try:
+        fp = Gio.DesktopAppInfo.new_from_filename(desktop)
+    except TypeError:
+        continue
+    fp.launch_uris([], None)

bin/backup.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+
+set -o nounset
+set -o errexit
+
+if [ "$(uname)" != "Linux" ]; then
+  echo "Error: This backup script is only intended for use on Linux." >&2
+  exit 1
+fi
+
+DEFAULT=`echo /media/${USER}/[bB]ackup/${USER}/`
+DEST="${1:-${DEFAULT}}"
+
+function verify_dest {
+  arr=($1)
+  items=${#arr[@]}
+  if [ $items -ne 1 ] ; then
+    echo "Bad count of backup destinations." > /dev/stderr
+    exit 1
+  fi
+  dir="$1"
+  end=$((${#dir}-1))
+  last="${dir:$end:1}"
+  if [ "$last" != "/" ] ; then
+    echo -n "Destination $dir does not end in a /, " > /dev/stderr
+    echo "this is probably not what you want!" > /dev/stderr
+    echo "Press a key to continue, or CTRL-C to cancel." > /dev/stderr
+    read
+  fi
+}
+
+verify_dest "$DEST"
+
+time nice rsync -Hax --delete --exclude-from="$HOME/.rsync_ignore" \
+  --delete-excluded "${HOME}/" "$DEST"
+echo "Backup completed..."
+time sync
+echo "Run finished, safe to unmount."

bin/checksec.sh

@@ -0,0 +1,882 @@
+#!/bin/bash
+#
+# The BSD License (http://www.opensource.org/licenses/bsd-license.php) 
+# specifies the terms and conditions of use for checksec.sh:
+#
+# Copyright (c) 2009-2011, Tobias Klein.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without 
+# modification, are permitted provided that the following conditions 
+# are met:
+# 
+# * Redistributions of source code must retain the above copyright 
+#   notice, this list of conditions and the following disclaimer.
+# * Redistributions in binary form must reproduce the above copyright 
+#   notice, this list of conditions and the following disclaimer in 
+#   the documentation and/or other materials provided with the 
+#   distribution.
+# * Neither the name of Tobias Klein nor the name of trapkit.de may be 
+#   used to endorse or promote products derived from this software 
+#   without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 
+# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 
+# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 
+# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 
+# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 
+# OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 
+# AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF 
+# THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH 
+# DAMAGE.
+#
+# Name    : checksec.sh
+# Version : 1.5
+# Author  : Tobias Klein
+# Date    : November 2011
+# Download: http://www.trapkit.de/tools/checksec.html
+# Changes : http://www.trapkit.de/tools/checksec_changes.txt
+#
+# Description:
+#
+# Modern Linux distributions offer some mitigation techniques to make it 
+# harder to exploit software vulnerabilities reliably. Mitigations such 
+# as RELRO, NoExecute (NX), Stack Canaries, Address Space Layout 
+# Randomization (ASLR) and Position Independent Executables (PIE) have 
+# made reliably exploiting any vulnerabilities that do exist far more 
+# challenging. The checksec.sh script is designed to test what *standard* 
+# Linux OS and PaX (http://pax.grsecurity.net/) security features are being 
+# used.
+#
+# As of version 1.3 the script also lists the status of various Linux kernel 
+# protection mechanisms.
+#
+# Credits:
+#
+# Thanks to Brad Spengler (grsecurity.net) for the PaX support.
+# Thanks to Jon Oberheide (jon.oberheide.org) for the kernel support.
+# Thanks to Ollie Whitehouse (Research In Motion) for rpath/runpath support.
+# 
+# Others that contributed to checksec.sh (in no particular order):
+#
+# Simon Ruderich, Denis Scherbakov, Stefan Kuttler, Radoslaw Madej,
+# Anthony G. Basile, Martin Vaeth and Brian Davis. 
+#
+
+# global vars
+have_readelf=1
+verbose=false
+
+# FORTIFY_SOURCE vars
+FS_end=_chk
+FS_cnt_total=0
+FS_cnt_checked=0
+FS_cnt_unchecked=0
+FS_chk_func_libc=0
+FS_functions=0
+FS_libc=0
+ 
+# version information
+version() {
+  echo "checksec v1.5, Tobias Klein, www.trapkit.de, November 2011"
+  echo 
+}
+
+# help
+help() {
+  echo "Usage: checksec [OPTION]"
+  echo
+  echo "Options:"
+  echo
+  echo "  --file <executable-file>"
+  echo "  --dir <directory> [-v]"
+  echo "  --proc <process name>"
+  echo "  --proc-all"
+  echo "  --proc-libs <process ID>"
+  echo "  --kernel"
+  echo "  --fortify-file <executable-file>"
+  echo "  --fortify-proc <process ID>"
+  echo "  --version"
+  echo "  --help"
+  echo
+  echo "For more information, see:"
+  echo "  http://www.trapkit.de/tools/checksec.html"
+  echo
+}
+
+# check if command exists
+command_exists () {
+  type $1  > /dev/null 2>&1;
+}
+
+# check if directory exists
+dir_exists () {
+  if [ -d $1 ] ; then
+    return 0
+  else
+    return 1
+  fi
+}
+
+# check user privileges
+root_privs () {
+  if [ $(/usr/bin/id -u) -eq 0 ] ; then
+    return 0
+  else
+    return 1
+  fi
+}
+
+# check if input is numeric
+isNumeric () {
+  echo "$@" | grep -q -v "[^0-9]"
+}
+
+# check if input is a string
+isString () {
+  echo "$@" | grep -q -v "[^A-Za-z]"
+}
+
+# check file(s)
+filecheck() {
+  # check for RELRO support
+  if readelf -l $1 2>/dev/null | grep -q 'GNU_RELRO'; then
+    if readelf -d $1 2>/dev/null | grep -q 'BIND_NOW'; then
+      echo -n -e '\033[32mFull RELRO   \033[m   '
+    else
+      echo -n -e '\033[33mPartial RELRO\033[m   '
+    fi
+  else
+    echo -n -e '\033[31mNo RELRO     \033[m   '
+  fi
+
+  # check for stack canary support
+  if readelf -s $1 2>/dev/null | grep -q '__stack_chk_fail'; then
+    echo -n -e '\033[32mCanary found   \033[m   '
+  else
+    echo -n -e '\033[31mNo canary found\033[m   '
+  fi
+
+  # check for NX support
+  if readelf -W -l $1 2>/dev/null | grep 'GNU_STACK' | grep -q 'RWE'; then
+    echo -n -e '\033[31mNX disabled\033[m   '
+  else
+    echo -n -e '\033[32mNX enabled \033[m   '
+  fi 
+
+  # check for PIE support
+  if readelf -h $1 2>/dev/null | grep -q 'Type:[[:space:]]*EXEC'; then
+    echo -n -e '\033[31mNo PIE       \033[m   '
+  elif readelf -h $1 2>/dev/null | grep -q 'Type:[[:space:]]*DYN'; then
+    if readelf -d $1 2>/dev/null | grep -q '(DEBUG)'; then
+      echo -n -e '\033[32mPIE enabled  \033[m   '
+    else   
+      echo -n -e '\033[33mDSO          \033[m   '
+    fi
+  else
+    echo -n -e '\033[33mNot an ELF file\033[m   '
+  fi 
+
+  # check for rpath / run path
+  if readelf -d $1 2>/dev/null | grep -q 'rpath'; then
+   echo -n -e '\033[31mRPATH    \033[m  '
+  else
+   echo -n -e '\033[32mNo RPATH \033[m  '
+  fi
+
+  if readelf -d $1 2>/dev/null | grep -q 'runpath'; then
+   echo -n -e '\033[31mRUNPATH    \033[m  '
+  else
+   echo -n -e '\033[32mNo RUNPATH \033[m  '
+  fi
+}
+
+# check process(es)
+proccheck() {
+  # check for RELRO support
+  if readelf -l $1/exe 2>/dev/null | grep -q 'Program Headers'; then
+    if readelf -l $1/exe 2>/dev/null | grep -q 'GNU_RELRO'; then
+      if readelf -d $1/exe 2>/dev/null | grep -q 'BIND_NOW'; then
+        echo -n -e '\033[32mFull RELRO       \033[m '
+      else
+        echo -n -e '\033[33mPartial RELRO    \033[m '
+      fi
+    else
+      echo -n -e '\033[31mNo RELRO         \033[m '
+    fi
+  else
+    echo -n -e '\033[31mPermission denied (please run as root)\033[m\n'
+    exit 1
+  fi
+
+  # check for stack canary support
+  if readelf -s $1/exe 2>/dev/null | grep -q 'Symbol table'; then
+    if readelf -s $1/exe 2>/dev/null | grep -q '__stack_chk_fail'; then
+      echo -n -e '\033[32mCanary found         \033[m  '
+    else
+      echo -n -e '\033[31mNo canary found      \033[m  '
+    fi
+  else
+    if [ "$1" != "1" ] ; then
+      echo -n -e '\033[33mPermission denied    \033[m  '
+    else
+      echo -n -e '\033[33mNo symbol table found\033[m  '
+    fi
+  fi
+
+  # first check for PaX support
+  if cat $1/status 2> /dev/null | grep -q 'PaX:'; then
+    pageexec=( $(cat $1/status 2> /dev/null | grep 'PaX:' | cut -b6) )
+    segmexec=( $(cat $1/status 2> /dev/null | grep 'PaX:' | cut -b10) )
+    mprotect=( $(cat $1/status 2> /dev/null | grep 'PaX:' | cut -b8) )
+    randmmap=( $(cat $1/status 2> /dev/null | grep 'PaX:' | cut -b9) )
+    if [[ "$pageexec" = "P" || "$segmexec" = "S" ]] && [[ "$mprotect" = "M" && "$randmmap" = "R" ]] ; then
+      echo -n -e '\033[32mPaX enabled\033[m   '
+    elif [[ "$pageexec" = "p" && "$segmexec" = "s" && "$randmmap" = "R" ]] ; then
+      echo -n -e '\033[33mPaX ASLR only\033[m '
+    elif [[ "$pageexec" = "P" || "$segmexec" = "S" ]] && [[ "$mprotect" = "m" && "$randmmap" = "R" ]] ; then
+      echo -n -e '\033[33mPaX mprot off \033[m'
+    elif [[ "$pageexec" = "P" || "$segmexec" = "S" ]] && [[ "$mprotect" = "M" && "$randmmap" = "r" ]] ; then
+      echo -n -e '\033[33mPaX ASLR off\033[m  '
+    elif [[ "$pageexec" = "P" || "$segmexec" = "S" ]] && [[ "$mprotect" = "m" && "$randmmap" = "r" ]] ; then
+      echo -n -e '\033[33mPaX NX only\033[m   '
+    else
+      echo -n -e '\033[31mPaX disabled\033[m  '
+    fi
+  # fallback check for NX support
+  elif readelf -W -l $1/exe 2>/dev/null | grep 'GNU_STACK' | grep -q 'RWE'; then
+    echo -n -e '\033[31mNX disabled\033[m   '
+  else
+    echo -n -e '\033[32mNX enabled \033[m   '
+  fi 
+
+  # check for PIE support
+  if readelf -h $1/exe 2>/dev/null | grep -q 'Type:[[:space:]]*EXEC'; then
+    echo -n -e '\033[31mNo PIE               \033[m   '
+  elif readelf -h $1/exe 2>/dev/null | grep -q 'Type:[[:space:]]*DYN'; then
+    if readelf -d $1/exe 2>/dev/null | grep -q '(DEBUG)'; then
+      echo -n -e '\033[32mPIE enabled          \033[m   '
+    else   
+      echo -n -e '\033[33mDynamic Shared Object\033[m   '
+    fi
+  else
+    echo -n -e '\033[33mNot an ELF file      \033[m   '
+  fi
+}
+
+# check mapped libraries
+libcheck() {
+  libs=( $(awk '{ print $6 }' /proc/$1/maps | grep '/' | sort -u | xargs file | grep ELF | awk '{ print $1 }' | sed 's/:/ /') )
+ 
+  printf "\n* Loaded libraries (file information, # of mapped files: ${#libs[@]}):\n\n"
+  
+  for element in $(seq 0 $((${#libs[@]} - 1)))
+  do
+    echo "  ${libs[$element]}:"
+    echo -n "    "
+    filecheck ${libs[$element]}
+    printf "\n\n"
+  done
+}
+
+# check for system-wide ASLR support
+aslrcheck() {
+  # PaX ASLR support
+  if !(cat /proc/1/status 2> /dev/null | grep -q 'Name:') ; then
+    echo -n -e ':\033[33m insufficient privileges for PaX ASLR checks\033[m\n'
+    echo -n -e '  Fallback to standard Linux ASLR check'
+  fi
+  
+  if cat /proc/1/status 2> /dev/null | grep -q 'PaX:'; then
+    printf ": "
+    if cat /proc/1/status 2> /dev/null | grep 'PaX:' | grep -q 'R'; then
+      echo -n -e '\033[32mPaX ASLR enabled\033[m\n\n'
+    else
+      echo -n -e '\033[31mPaX ASLR disabled\033[m\n\n'
+    fi
+  else
+    # standard Linux 'kernel.randomize_va_space' ASLR support
+    # (see the kernel file 'Documentation/sysctl/kernel.txt' for a detailed description)
+    printf " (kernel.randomize_va_space): "
+    if /sbin/sysctl -a 2>/dev/null | grep -q 'kernel.randomize_va_space = 1'; then
+      echo -n -e '\033[33mOn (Setting: 1)\033[m\n\n'
+      printf "  Description - Make the addresses of mmap base, stack and VDSO page randomized.\n"
+      printf "  This, among other things, implies that shared libraries will be loaded to \n"
+      printf "  random addresses. Also for PIE-linked binaries, the location of code start\n"
+      printf "  is randomized. Heap addresses are *not* randomized.\n\n"
+    elif /sbin/sysctl -a 2>/dev/null | grep -q 'kernel.randomize_va_space = 2'; then
+      echo -n -e '\033[32mOn (Setting: 2)\033[m\n\n'
+      printf "  Description - Make the addresses of mmap base, heap, stack and VDSO page randomized.\n"
+      printf "  This, among other things, implies that shared libraries will be loaded to random \n"
+      printf "  addresses. Also for PIE-linked binaries, the location of code start is randomized.\n\n"
+    elif /sbin/sysctl -a 2>/dev/null | grep -q 'kernel.randomize_va_space = 0'; then
+      echo -n -e '\033[31mOff (Setting: 0)\033[m\n'
+    else
+      echo -n -e '\033[31mNot supported\033[m\n'
+    fi
+    printf "  See the kernel file 'Documentation/sysctl/kernel.txt' for more details.\n\n"
+  fi 
+}
+
+# check cpu nx flag
+nxcheck() {
+  if grep -q nx /proc/cpuinfo; then
+    echo -n -e '\033[32mYes\033[m\n\n'
+  else
+    echo -n -e '\033[31mNo\033[m\n\n'
+  fi
+}
+
+# check for kernel protection mechanisms
+kernelcheck() {
+  printf "  Description - List the status of kernel protection mechanisms. Rather than\n"
+  printf "  inspect kernel mechanisms that may aid in the prevention of exploitation of\n"
+  printf "  userspace processes, this option lists the status of kernel configuration\n"
+  printf "  options that harden the kernel itself against attack.\n\n"
+  printf "  Kernel config: "
+ 
+  if [ -f /proc/config.gz ] ; then
+    kconfig="zcat /proc/config.gz"
+    printf "\033[32m/proc/config.gz\033[m\n\n"
+  elif [ -f /boot/config-`uname -r` ] ; then
+    kconfig="cat /boot/config-`uname -r`"
+    printf "\033[33m/boot/config-`uname -r`\033[m\n\n"
+    printf "  Warning: The config on disk may not represent running kernel config!\n\n";
+  elif [ -f "${KBUILD_OUTPUT:-/usr/src/linux}"/.config ] ; then
+    kconfig="cat ${KBUILD_OUTPUT:-/usr/src/linux}/.config"
+    printf "\033[33m%s\033[m\n\n" "${KBUILD_OUTPUT:-/usr/src/linux}/.config"
+    printf "  Warning: The config on disk may not represent running kernel config!\n\n";
+  else
+    printf "\033[31mNOT FOUND\033[m\n\n"
+    exit 0
+  fi
+
+  printf "  GCC stack protector support:            "
+  if $kconfig | grep -qi 'CONFIG_CC_STACKPROTECTOR=y'; then
+    printf "\033[32mEnabled\033[m\n"
+  else
+    printf "\033[31mDisabled\033[m\n"
+  fi
+
+  printf "  Strict user copy checks:                "
+  if $kconfig | grep -qi 'CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y'; then
+    printf "\033[32mEnabled\033[m\n"
+  else
+    printf "\033[31mDisabled\033[m\n"
+  fi
+
+  printf "  Enforce read-only kernel data:          "
+  if $kconfig | grep -qi 'CONFIG_DEBUG_RODATA=y'; then
+    printf "\033[32mEnabled\033[m\n"
+  else
+    printf "\033[31mDisabled\033[m\n"
+  fi
+  printf "  Restrict /dev/mem access:               "
+  if $kconfig | grep -qi 'CONFIG_STRICT_DEVMEM=y'; then
+    printf "\033[32mEnabled\033[m\n"
+  else
+    printf "\033[31mDisabled\033[m\n"
+  fi
+
+  printf "  Restrict /dev/kmem access:              "
+  if $kconfig | grep -qi 'CONFIG_DEVKMEM=y'; then
+    printf "\033[31mDisabled\033[m\n"
+  else
+    printf "\033[32mEnabled\033[m\n"
+  fi
+
+  printf "\n"
+  printf "* grsecurity / PaX: "
+
+  if $kconfig | grep -qi 'CONFIG_GRKERNSEC=y'; then
+    if $kconfig | grep -qi 'CONFIG_GRKERNSEC_HIGH=y'; then
+      printf "\033[32mHigh GRKERNSEC\033[m\n\n"
+    elif $kconfig | grep -qi 'CONFIG_GRKERNSEC_MEDIUM=y'; then
+      printf "\033[33mMedium GRKERNSEC\033[m\n\n"
+    elif $kconfig | grep -qi 'CONFIG_GRKERNSEC_LOW=y'; then
+      printf "\033[31mLow GRKERNSEC\033[m\n\n"
+    else
+      printf "\033[33mCustom GRKERNSEC\033[m\n\n"
+    fi
+
+    printf "  Non-executable kernel pages:            "
+    if $kconfig | grep -qi 'CONFIG_PAX_KERNEXEC=y'; then
+      printf "\033[32mEnabled\033[m\n"
+    else
+      printf "\033[31mDisabled\033[m\n"
+    fi
+
+    printf "  Prevent userspace pointer deref:        "
+    if $kconfig | grep -qi 'CONFIG_PAX_MEMORY_UDEREF=y'; then
+      printf "\033[32mEnabled\033[m\n"
+    else
+      printf "\033[31mDisabled\033[m\n"
+    fi
+
+    printf "  Prevent kobject refcount overflow:      "
+    if $kconfig | grep -qi 'CONFIG_PAX_REFCOUNT=y'; then
+      printf "\033[32mEnabled\033[m\n"
+    else
+      printf "\033[31mDisabled\033[m\n"
+    fi
+
+    printf "  Bounds check heap object copies:        "
+    if $kconfig | grep -qi 'CONFIG_PAX_USERCOPY=y'; then
+      printf "\033[32mEnabled\033[m\n"
+    else
+      printf "\033[31mDisabled\033[m\n"
+    fi
+
+    printf "  Disable writing to kmem/mem/port:       "
+    if $kconfig | grep -qi 'CONFIG_GRKERNSEC_KMEM=y'; then
+      printf "\033[32mEnabled\033[m\n"
+    else
+      printf "\033[31mDisabled\033[m\n"
+    fi
+
+    printf "  Disable privileged I/O:                 "
+    if $kconfig | grep -qi 'CONFIG_GRKERNSEC_IO=y'; then
+      printf "\033[32mEnabled\033[m\n"
+    else
+      printf "\033[31mDisabled\033[m\n"
+    fi
+
+    printf "  Harden module auto-loading:             "
+    if $kconfig | grep -qi 'CONFIG_GRKERNSEC_MODHARDEN=y'; then
+      printf "\033[32mEnabled\033[m\n"
+    else
+      printf "\033[31mDisabled\033[m\n"
+    fi
+
+    printf "  Hide kernel symbols:                    "
+    if $kconfig | grep -qi 'CONFIG_GRKERNSEC_HIDESYM=y'; then
+      printf "\033[32mEnabled\033[m\n"
+    else
+      printf "\033[31mDisabled\033[m\n"
+    fi
+  else
+    printf "\033[31mNo GRKERNSEC\033[m\n\n"
+    printf "  The grsecurity / PaX patchset is available here:\n"
+    printf "    http://grsecurity.net/\n"
+  fi
+
+  printf "\n"
+  printf "* Kernel Heap Hardening: "
+
+  if $kconfig | grep -qi 'CONFIG_KERNHEAP=y'; then
+    if $kconfig | grep -qi 'CONFIG_KERNHEAP_FULLPOISON=y'; then
+      printf "\033[32mFull KERNHEAP\033[m\n\n"
+    else
+      printf "\033[33mPartial KERNHEAP\033[m\n\n"
+    fi
+  else
+    printf "\033[31mNo KERNHEAP\033[m\n\n"
+    printf "  The KERNHEAP hardening patchset is available here:\n"
+    printf "    https://www.subreption.com/kernheap/\n\n"
+  fi
+}
+
+# --- FORTIFY_SOURCE subfunctions (start) ---
+
+# is FORTIFY_SOURCE supported by libc?
+FS_libc_check() {
+  printf "* FORTIFY_SOURCE support available (libc)    : "
+
+  if [ "${#FS_chk_func_libc[@]}" != "0" ] ; then
+    printf "\033[32mYes\033[m\n"
+  else
+    printf "\033[31mNo\033[m\n"
+    exit 1
+  fi
+}
+
+# was the binary compiled with FORTIFY_SOURCE?
+FS_binary_check() {
+  printf "* Binary compiled with FORTIFY_SOURCE support: "
+
+  for FS_elem_functions in $(seq 0 $((${#FS_functions[@]} - 1)))
+  do
+    if [[ ${FS_functions[$FS_elem_functions]} =~ _chk ]] ; then
+      printf "\033[32mYes\033[m\n"
+      return
+    fi
+  done
+  printf "\033[31mNo\033[m\n"
+  exit 1
+}
+
+FS_comparison() {
+  echo
+  printf " ------ EXECUTABLE-FILE ------- . -------- LIBC --------\n"
+  printf " FORTIFY-able library functions | Checked function names\n"
+  printf " -------------------------------------------------------\n"
+
+  for FS_elem_libc in $(seq 0 $((${#FS_chk_func_libc[@]} - 1)))
+  do
+    for FS_elem_functions in $(seq 0 $((${#FS_functions[@]} - 1)))
+    do
+      FS_tmp_func=${FS_functions[$FS_elem_functions]}
+      FS_tmp_libc=${FS_chk_func_libc[$FS_elem_libc]}
+
+      if [[ $FS_tmp_func =~ ^$FS_tmp_libc$ ]] ; then
+        printf " \033[31m%-30s\033[m | __%s%s\n" $FS_tmp_func $FS_tmp_libc $FS_end
+        let FS_cnt_total++
+        let FS_cnt_unchecked++
+      elif [[ $FS_tmp_func =~ ^$FS_tmp_libc(_chk) ]] ; then
+        printf " \033[32m%-30s\033[m | __%s%s\n" $FS_tmp_func $FS_tmp_libc $FS_end
+        let FS_cnt_total++
+        let FS_cnt_checked++
+      fi
+
+    done
+  done
+}
+
+FS_summary() {
+  echo
+  printf "SUMMARY:\n\n"
+  printf "* Number of checked functions in libc                : ${#FS_chk_func_libc[@]}\n"
+  printf "* Total number of library functions in the executable: ${#FS_functions[@]}\n"
+  printf "* Number of FORTIFY-able functions in the executable : %s\n" $FS_cnt_total
+  printf "* Number of checked functions in the executable      : \033[32m%s\033[m\n" $FS_cnt_checked
+  printf "* Number of unchecked functions in the executable    : \033[31m%s\033[m\n" $FS_cnt_unchecked
+  echo
+}
+
+# --- FORTIFY_SOURCE subfunctions (end) ---
+
+if !(command_exists readelf) ; then
+  printf "\033[31mWarning: 'readelf' not found! It's required for most checks.\033[m\n\n"
+  have_readelf=0
+fi
+
+# parse command-line arguments
+case "$1" in
+
+ --version)
+  version
+  exit 0
+  ;;
+
+ --help)
+  help
+  exit 0
+  ;;
+
+ --dir)
+  if [ "$3" = "-v" ] ; then
+    verbose=true
+  fi
+  if [ $have_readelf -eq 0 ] ; then
+    exit 1
+  fi
+  if [ -z "$2" ] ; then
+    printf "\033[31mError: Please provide a valid directory.\033[m\n\n"
+    exit 1
+  fi
+  # remove trailing slashes
+  tempdir=`echo $2 | sed -e "s/\/*$//"`
+  if [ ! -d $tempdir ] ; then
+    printf "\033[31mError: The directory '$tempdir' does not exist.\033[m\n\n"
+    exit 1
+  fi
+  cd $tempdir
+  printf "RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FILE\n"
+  for N in [A-Za-z]*; do
+    if [ "$N" != "[A-Za-z]*" ]; then
+      # read permissions?
+      if [ ! -r $N ]; then
+        printf "\033[31mError: No read permissions for '$tempdir/$N' (run as root).\033[m\n"
+      else
+        # ELF executable?
+        out=`file $N`
+        if [[ ! $out =~ ELF ]] ; then
+           if [ "$verbose" = "true" ] ; then
+             printf "\033[34m*** Not an ELF file: $tempdir/"
+             file $N
+             printf "\033[m"
+           fi
+        else 
+          filecheck $N
+          if [ `find $tempdir/$N \( -perm -004000 -o -perm -002000 \) -type f -print` ]; then
+            printf "\033[37;41m%s%s\033[m" $2 $N
+          else
+            printf "%s%s" $tempdir/ $N
+          fi
+          echo
+        fi
+      fi
+    fi
+  done
+  exit 0
+  ;;
+ 
+ --file)
+  if [ $have_readelf -eq 0 ] ; then
+    exit 1
+  fi
+  if [ -z "$2" ] ; then
+    printf "\033[31mError: Please provide a valid file.\033[m\n\n"
+   exit 1
+  fi
+  # does the file exist?
+  if [ ! -e $2 ] ; then
+    printf "\033[31mError: The file '$2' does not exist.\033[m\n\n"
+    exit 1
+  fi
+  # read permissions?
+  if [ ! -r $2 ] ; then
+    printf "\033[31mError: No read permissions for '$2' (run as root).\033[m\n\n"
+    exit 1
+  fi
+  # ELF executable?
+  out=`file $2`
+  if [[ ! $out =~ ELF ]] ; then
+    printf "\033[31mError: Not an ELF file: "
+    file $2
+    printf "\033[m\n"
+    exit 1
+  fi
+  printf "RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FILE\n"
+  filecheck $2
+  if [ `find $2 \( -perm -004000 -o -perm -002000 \) -type f -print` ] ; then
+    printf "\033[37;41m%s%s\033[m" $2 $N
+  else
+    printf "%s" $2
+  fi
+  echo
+  exit 0
+  ;;
+
+ --proc-all)
+  if [ $have_readelf -eq 0 ] ; then
+    exit 1
+  fi
+  cd /proc
+  printf "* System-wide ASLR"
+  aslrcheck
+  printf "* Does the CPU support NX: "
+  nxcheck 
+  printf "         COMMAND    PID RELRO             STACK CANARY           NX/PaX        PIE\n"
+  for N in [1-9]*; do
+    if [ $N != $$ ] && readlink -q $N/exe > /dev/null; then
+      printf "%16s" `head -1 $N/status | cut -b 7-`
+      printf "%7d " $N
+      proccheck $N
+      echo
+    fi
+  done
+  if [ ! -e /usr/bin/id ] ; then
+    printf "\n\033[33mNote: If you are running 'checksec.sh' as an unprivileged user, you\n"
+    printf "      will not see all processes. Please run the script as root.\033[m\n\n"
+  else 
+    if !(root_privs) ; then
+      printf "\n\033[33mNote: You are running 'checksec.sh' as an unprivileged user.\n" 
+      printf "      Too see all processes, please run the script as root.\033[m\n\n"
+    fi
+  fi
+  exit 0
+  ;;
+
+ --proc)
+  if [ $have_readelf -eq 0 ] ; then
+    exit 1
+  fi
+  if [ -z "$2" ] ; then
+    printf "\033[31mError: Please provide a valid process name.\033[m\n\n"
+    exit 1
+  fi
+  if !(isString "$2") ; then
+     printf "\033[31mError: Please provide a valid process name.\033[m\n\n"
+     exit 1
+  fi
+  cd /proc
+  printf "* System-wide ASLR"
+  aslrcheck
+  printf "* Does the CPU support NX: "
+  nxcheck
+  printf "         COMMAND    PID RELRO             STACK CANARY           NX/PaX        PIE\n"
+  for N in `ps -Ao pid,comm | grep $2 | cut -b1-6`; do
+    if [ -d $N ] ; then
+      printf "%16s" `head -1 $N/status | cut -b 7-`
+      printf "%7d " $N
+      # read permissions?
+      if [ ! -r $N/exe ] ; then
+        if !(root_privs) ; then
+          printf "\033[31mNo read permissions for '/proc/$N/exe' (run as root).\033[m\n\n"
+          exit 1
+        fi
+        if [ ! `readlink $N/exe` ] ; then
+          printf "\033[31mPermission denied. Requested process ID belongs to a kernel thread.\033[m\n\n"
+          exit 1
+        fi
+        exit 1
+      fi
+      proccheck $N
+      echo
+    fi
+  done
+  exit 0
+  ;;
+
+ --proc-libs)
+  if [ $have_readelf -eq 0 ] ; then
+    exit 1
+  fi
+  if [ -z "$2" ] ; then
+    printf "\033[31mError: Please provide a valid process ID.\033[m\n\n"
+    exit 1
+  fi
+  if !(isNumeric "$2") ; then
+     printf "\033[31mError: Please provide a valid process ID.\033[m\n\n"
+     exit 1
+  fi
+  cd /proc
+  printf "* System-wide ASLR"
+  aslrcheck
+  printf "* Does the CPU support NX: "
+  nxcheck
+  printf "* Process information:\n\n"
+  printf "         COMMAND    PID RELRO             STACK CANARY           NX/PaX        PIE\n"
+  N=$2
+  if [ -d $N ] ; then
+    printf "%16s" `head -1 $N/status | cut -b 7-`
+    printf "%7d " $N
+    # read permissions?
+    if [ ! -r $N/exe ] ; then
+      if !(root_privs) ; then
+        printf "\033[31mNo read permissions for '/proc/$N/exe' (run as root).\033[m\n\n"
+        exit 1
+      fi
+      if [ ! `readlink $N/exe` ] ; then
+        printf "\033[31mPermission denied. Requested process ID belongs to a kernel thread.\033[m\n\n"
+        exit 1
+      fi
+      exit 1
+    fi
+    proccheck $N
+    echo
+    libcheck $N
+  fi
+  exit 0
+  ;;
+
+ --kernel)
+  cd /proc
+  printf "* Kernel protection information:\n\n"
+  kernelcheck
+  exit 0
+  ;;
+
+ --fortify-file)
+  if [ $have_readelf -eq 0 ] ; then
+    exit 1
+  fi
+  if [ -z "$2" ] ; then
+    printf "\033[31mError: Please provide a valid file.\033[m\n\n"
+   exit 1
+  fi
+  # does the file exist?
+  if [ ! -e $2 ] ; then
+    printf "\033[31mError: The file '$2' does not exist.\033[m\n\n"
+    exit 1
+  fi
+  # read permissions?
+  if [ ! -r $2 ] ; then
+    printf "\033[31mError: No read permissions for '$2' (run as root).\033[m\n\n"
+    exit 1
+  fi
+  # ELF executable?
+  out=`file $2`
+  if [[ ! $out =~ ELF ]] ; then
+    printf "\033[31mError: Not an ELF file: "
+    file $2
+    printf "\033[m\n"
+    exit 1
+  fi
+  if [ -e /lib/libc.so.6 ] ; then
+    FS_libc=/lib/libc.so.6
+  elif [ -e /lib64/libc.so.6 ] ; then
+    FS_libc=/lib64/libc.so.6
+  elif [ -e /lib/i386-linux-gnu/libc.so.6 ] ; then
+    FS_libc=/lib/i386-linux-gnu/libc.so.6
+  elif [ -e /lib/x86_64-linux-gnu/libc.so.6 ] ; then
+    FS_libc=/lib/x86_64-linux-gnu/libc.so.6
+  else
+    printf "\033[31mError: libc not found.\033[m\n\n"
+    exit 1
+  fi
+
+  FS_chk_func_libc=( $(readelf -s $FS_libc | grep _chk@@ | awk '{ print $8 }' | cut -c 3- | sed -e 's/_chk@.*//') )
+  FS_functions=( $(readelf -s $2 | awk '{ print $8 }' | sed 's/_*//' | sed -e 's/@.*//') )
+
+  FS_libc_check
+  FS_binary_check
+  FS_comparison
+  FS_summary
+
+  exit 0
+  ;;
+
+ --fortify-proc)
+  if [ $have_readelf -eq 0 ] ; then
+    exit 1
+  fi
+  if [ -z "$2" ] ; then
+    printf "\033[31mError: Please provide a valid process ID.\033[m\n\n"
+    exit 1
+  fi
+  if !(isNumeric "$2") ; then
+     printf "\033[31mError: Please provide a valid process ID.\033[m\n\n"
+     exit 1
+  fi
+  cd /proc
+  N=$2
+  if [ -d "$N" ] ; then
+    # read permissions?
+    if [ ! -r "$N/exe" ] ; then
+      if !(root_privs) ; then
+        printf "\033[31mNo read permissions for '/proc/%s/exe' (run as root).\033[m\n\n" "$N"
+        exit 1
+      fi
+      if [ ! "$(readlink "$N/exe")" ] ; then
+        printf "\033[31mPermission denied. Requested process ID belongs to a kernel thread.\033[m\n\n"
+        exit 1
+      fi
+      exit 1
+    fi
+    if [ -e /lib/libc.so.6 ] ; then
+      FS_libc=/lib/libc.so.6
+    elif [ -e /lib64/libc.so.6 ] ; then
+      FS_libc=/lib64/libc.so.6
+    elif [ -e /lib/i386-linux-gnu/libc.so.6 ] ; then
+      FS_libc=/lib/i386-linux-gnu/libc.so.6
+    elif [ -e /lib/x86_64-linux-gnu/libc.so.6 ] ; then
+      FS_libc=/lib/x86_64-linux-gnu/libc.so.6
+    else
+      printf "\033[31mError: libc not found.\033[m\n\n"
+      exit 1
+    fi
+    printf "* Process name (PID)                         : %s (%d)\n" "$(head -1 "$N/status" | cut -b 7-)" "$N"
+    FS_chk_func_libc=( $(readelf -s "$FS_libc" | grep _chk@@ | awk '{ print $8 }' | cut -c 3- | sed -e 's/_chk@.*//') )
+    FS_functions=( $(readelf -s "$2/exe" | awk '{ print $8 }' | sed 's/_*//' | sed -e 's/@.*//') )
+
+    FS_libc_check
+    FS_binary_check
+    FS_comparison
+    FS_summary
+  fi
+  exit 0
+  ;;
+
+ *)
+  if [ "$#" != "0" ] ; then
+    printf "\033[31mError: Unknown option '$1'.\033[m\n\n"
+  fi
+  help
+  exit 1
+  ;;
+esac

bin/cloudy.sh

@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+
+set -ueo pipefail
+shopt -s extglob
+
+# get libraries
+. ${HOME}/.local/lib/bash/tui.sh
+
+COMMANDS=(
+  gctx
+  kctx
+)
+
+_make_extglob() {
+  local IFS='|'
+  echo "@($*)"
+}
+
+CMD_PATTERN=$(_make_extglob "${COMMANDS[@]}")
+
+usage() {
+  echo "Available Subcommands:"
+  printf "  - %-10s\n" "${COMMANDS[@]}"
+  exit 1
+}
+
+_gctx_set() {
+  gcloud config configurations activate "${1}" </dev/null
+}
+
+_gctx_choose() {
+  local lines=()
+  local default=''
+  local maxnamelen=0
+  local active name description
+  while IFS=$'\t' read -r active name description ; do
+    (( maxnamelen = ( ${#name} > maxnamelen ) ? ${#name} : maxnamelen ))
+    if [[ "$active" == "True" ]] ; then
+      default="${name}"
+    fi
+    lines+=("${name}" "${description}")
+  done < <(gcloud config configurations list \
+    --format='value(is_active, name, format("{} (as {})", properties.core.project, properties.core.account))')
+  local choice
+  if choice=$(printf "%-${maxnamelen}s %s\n" "${lines[@]}" | select_entry "gcloud config" "$default") ; then
+    _gctx_set "${choice}"
+  else
+    echo "No option selected, leaving unchanged."
+  fi
+  return 0
+}
+
+_gctx_new() {
+  local cname="${1:-}"
+  if test -z "${cname}" ; then
+    echo "Usage: gctx new <new name>" >&2
+    return 1
+  fi
+  gcloud config configurations create "${cname}"
+}
+
+_gctx_name() {
+  gcloud info --format='value(config.active_config_name)'
+}
+
+_gctx_clone() {
+  # save old config
+  local oldconfig=()
+  local line
+  while IFS= read -r line ; do
+    old_config+=("$line")
+  done < <(gcloud config configurations describe "$(_gctx_name)" --format='multi(properties:format="flattened[separator=\" \"]")')
+
+  # create new
+  _gctx_new "${1:-}"
+
+  # set config
+  for line in "${oldconfig[@]}" ; do
+    local keyname="${line%% *}"
+    local keypath="${keyname//\.//}"
+    local value="${line#* }"
+    gcloud config set "${keypath}" "${value}"
+  done
+  return 0
+}
+
+gctx() {
+  local subcmd="${1:-}"
+  shift || true
+  case "${subcmd}" in
+    clone)
+      _gctx_clone "$@"
+      return
+      ;;
+    new)
+      _gctx_new "$@"
+      return
+      ;;
+    show)
+      gcloud config configurations list --filter="is_active=True" \
+        --format='table(name, properties.core.account, properties.core.project, properties.compute.zone:label=COMPUTE_DEFAULT_ZONE, properties.compute.region:label=COMPUTE_DEFAULT_REGION)' \
+        "$@"
+      ;;
+    list)
+      gcloud config configurations list "$@"
+      return
+      ;;
+    activate)
+      _gctx_set "$@"
+      return
+      ;;
+    ""|choose)
+      _gctx_choose
+      return
+      ;;
+    *)
+      if _gctx_set "${subcmd}" 2>/dev/null ; then
+        return 0
+      fi
+      echo "Usage: gctx [show|list|new|choose|clone|<name>]" >&2
+      return 1
+      ;;
+  esac
+}
+
+kctx() {
+  return 0
+}
+
+INVOKED_AS=$(basename "$0")
+# shellcheck disable=SC2053
+if [[ "$INVOKED_AS" == $CMD_PATTERN ]] ; then
+  CMD="${INVOKED_AS}"
+else
+  CMD="${1:-}"
+  shift || usage
+fi
+
+
+# shellcheck disable=SC2254
+case "${CMD}" in
+  ${CMD_PATTERN})
+    "${CMD}" "$@"
+    ;;
+  *)
+    usage
+    ;;
+esac

bin/cyberchef

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -u
+
+CHEF_FILE=${HOME}/tools/cyberchef/cyberchef.html
+
+if [ ! -f ${CHEF_FILE} ] ; then
+  ${HOME}/bin/install_tool cyberchef
+fi
+
+exec xdg-open ${CHEF_FILE}

bin/darwin-env.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+env > ${TMPDIR}/env-pre
+. ${HOME}/.shenv
+env > ${TMPDIR}/env-post
+for VAR in $(env | cut -d'=' -f1) ; do
+  /bin/launchctl setenv "${VAR}" "$(eval echo \$${VAR})"
+done

bin/disk-benchmark

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+set -ue
+
+FILENAME=${1}
+BENCHMARK_SIZE=${BENCHMARK_SIZE:-1000m}
+
+if [ -f ${FILENAME} ] ; then
+  echo "File ${FILENAME} already exists!" >/dev/stderr
+  exit 1
+fi
+
+trap "test -f ${FILENAME} && rm -f ${FILENAME}" EXIT
+
+fio --loops=5 --size=${BENCHMARK_SIZE} --filename=${FILENAME} \
+  --stonewall --ioengine=libaio --direct=1 \
+  --name=Seqread --bs=1m --rw=read \
+  --name=Seqwrite --bs=1m --rw=write \
+  --name=512Kread --bs=512k --rw=randread \
+  --name=512Kwrite --bs=512k --rw=randwrite \
+  --name=4kQD32read --bs=4k --iodepth=32 --rw=randread \
+  --name=4kQD32write --bs=4k --iodepth=32 --rw=randwrite

bin/fix-broken-symlinks.sh

@@ -0,0 +1,93 @@
+#!/bin/bash
+
+# A script to find and remove broken symbolic links in a directory.
+#
+# OPTIONS:
+#   -y: Automatically remove all broken links without confirmation.
+#   -q: Quiet mode. Suppress all non-error output.
+
+set -euo pipefail
+
+# --- Default settings ---
+FORCE_DELETE=0
+QUIET=0
+TARGET_DIR="."
+
+# --- Helper function for logging ---
+log() {
+  if [ "${QUIET}" -eq 0 ]; then
+    echo "$@"
+  fi
+}
+
+# --- Usage function ---
+usage() {
+  echo "Usage: $0 [-y] [-q] [TARGET_DIRECTORY]"
+  echo "  -y: Yes. Automatically remove broken symlinks without confirmation."
+  echo "  -q: Quiet. Suppress all output except for errors."
+  echo "  TARGET_DIRECTORY: The directory to scan. Defaults to the current directory."
+  exit 1
+}
+
+# --- Parse command-line options ---
+while getopts "yq" opt; do
+  case ${opt} in
+    y)
+      FORCE_DELETE=1
+      ;;
+    q)
+      QUIET=1
+      ;;
+    *)
+      usage
+      ;;
+  esac
+done
+shift $((OPTIND - 1)) # Remove the parsed options
+
+# --- Set target directory ---
+# Use the first remaining argument as the target directory.
+if [ -n "$1" ]; then
+  TARGET_DIR="$1"
+fi
+
+if [ ! -d "${TARGET_DIR}" ]; then
+  echo "Error: Directory '${TARGET_DIR}' not found." >&2
+  exit 1
+fi
+
+log "Searching for broken symlinks in '${TARGET_DIR}'..."
+
+# --- Main logic ---
+# Find broken symlinks and process them.
+find "${TARGET_DIR}" -type l ! -exec test -e {} \; -print0 | while IFS= read -r -d '' link; do
+  if [ "${FORCE_DELETE}" -eq 1 ]; then
+    # No confirmation needed, just delete.
+    if rm "${link}"; then
+      log "Removed '${link}'."
+    else
+      # Errors should still be reported.
+      echo "Failed to remove '${link}'." >&2
+    fi
+  else
+    # If in quiet mode but not force mode, we can't prompt, so we skip.
+    if [ "${QUIET}" -eq 1 ]; then
+        continue
+    fi
+    # Ask the user for confirmation.
+    read -p "Remove broken symlink '${link}'? [y/N] " -n 1 -r
+    echo # Move to a new line after input.
+
+    if [[ $REPLY =~ ^[Yy]$ ]]; then
+      if rm "${link}"; then
+        log "Removed '${link}'."
+      else
+        echo "Failed to remove '${link}'." >&2
+      fi
+    else
+      log "Skipped '${link}'."
+    fi
+  fi
+done
+
+log "Cleanup complete."

bin/google-chrome-burp

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+CHROME_BINS="google-chrome-beta google-chrome"
+for bin in ${CHROME_BINS} ; do
+  if command -v ${bin} >/dev/null 2>&1 ; then
+    CHROME=$(command -v ${bin})
+    break
+  fi
+done
+
+if test -z "${CHROME}" ; then
+  echo "Chrome not found!" >/dev/stderr
+  exit 1
+fi
+
+# Set alternate HOME to use alternate NSS DB
+export HOME=${HOME}/.chrome-pentest
+mkdir -p ${HOME}
+
+# Launch chrome for burp
+exec ${CHROME} --user-data-dir=${HOME}/chrome-pentest --proxy-server=127.0.0.1:8080

bin/google-chrome-noroot

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+CHROME=`which google-chrome`
+
+if [ `id -u` != "0" ] ; then
+  exec "$CHROME" "$@"
+fi
+
+args=()
+for x in "$@"; do
+    args+=("$(printf %q "$x")")
+done
+
+su -c "$CHROME --user-data-dir=${HOME}/.chrome-data-dir ${args[*]}" chromeuser

bin/i3lock.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+LOCKTIME="${SCREENSAVER_MIN:-5}"
+LOCKER="i3lock -c 000000"
+# intentionally want word splitting below
+# do not quote this
+/usr/bin/xss-lock -- ${LOCKER} &
+exec /usr/bin/xautolock \
+  -time "${LOCKTIME}" \
+  -detectsleep \
+  -locker "${LOCKER}" \
+  -notify 30 \
+  -notifier "notify-send -u critical -t 10000 -- 'LOCKING SCREEN IN 30 SECONDS'"

bin/install_ansible.sh

@@ -0,0 +1,137 @@
+#!/bin/bash
+#
+# Installs Ansible, trying user-space methods first before falling back to sudo.
+# This script is designed to be idempotent and safe to run multiple times.
+
+set -e # Exit immediately if a command exits with a non-zero status.
+
+# --- Helper Functions ---
+info() { echo "[INFO] $1"; }
+warn() { echo "[WARN] $1"; }
+error() { echo "[ERROR] $1" >&2; exit 1; }
+
+# --- Main Logic ---
+
+# 1. Check if Ansible is already installed
+if command -v ansible >/dev/null 2>&1; then
+    info "Ansible is already installed at $(command -v ansible)."
+    exit 0
+fi
+info "Ansible not found. Attempting installation..."
+
+# 2. Try user-space installation (no sudo)
+info "--- Attempting user-space installation (no sudo required) ---"
+
+# Try pipx first, as it's the cleanest user-space method
+if command -v pipx >/dev/null 2>&1; then
+    info "Found pipx. Trying to install Ansible with it..."
+    if pipx install ansible;
+     then
+        # pipx requires adding ~/.local/bin to PATH, which might not be sourced yet.
+        # Check the executable directly.
+        if [[ -x "${HOME}/.local/bin/ansible" ]]; then
+            info "Ansible installed successfully with pipx."
+            info "Please ensure '${HOME}/.local/bin' is in your PATH."
+            info "You may need to restart your shell or run: export PATH=\"$HOME/.local/bin:$PATH\""
+            exit 0
+        else
+            warn "pipx install seemed to succeed, but ansible executable not found where expected."
+        fi
+    else
+        warn "pipx install ansible failed."
+    fi
+fi
+
+# Try Python's venv module if pipx failed or wasn't present
+VENV_PATH="${HOME}/.local/share/ansible_venv"
+# Create a temp path to avoid clobbering a failed install
+VENV_TEST_PATH="/tmp/ansible_venv_test_$$"
+if python3 -m venv "${VENV_TEST_PATH}" >/dev/null 2>&1; then
+    rm -rf "${VENV_TEST_PATH}" # Clean up test
+    info "Python's venv module is available. Creating a virtual environment at ${VENV_PATH}..."
+    python3 -m venv "${VENV_PATH}"
+    if "${VENV_PATH}/bin/pip" install --quiet ansible;
+     then
+        info "Ansible installed successfully into a virtual environment."
+        info "To use it, run: '${VENV_PATH}/bin/ansible'"
+        info "To make it available everywhere, add its bin directory to your PATH:"
+        info "  echo 'export PATH="${VENV_PATH}/bin:$PATH"' >> ~/.profile"
+        info "(You may need to source ~/.profile or restart your shell)."
+        exit 0
+    else
+        warn "Failed to install ansible into the virtual environment."
+        rm -rf "${VENV_PATH}" # Clean up failed attempt
+    fi
+else
+    info "Python's venv module not available or failed to create a test environment."
+fi
+
+# 3. Fallback to sudo installation
+info "--- User-space installation failed. Falling back to system-wide installation (sudo required) ---"
+
+if ! command -v sudo >/dev/null 2>&1; then
+    error "sudo command not found. Cannot attempt system-wide installation. Aborting."
+fi
+
+# Prompt for sudo password upfront so it doesn't happen in the middle of the script
+info "Sudo privileges are required. You may be prompted for your password."
+if ! sudo -v; then
+    error "Failed to acquire sudo privileges. Aborting."
+fi
+
+# Detect package manager and install
+if command -v apt-get >/dev/null 2>&1; then
+    info "Detected Debian-based system (apt)."
+    sudo apt-get update -y
+    info "Attempting to install 'ansible' package..."
+    if sudo apt-get install -y ansible;
+     then
+        info "System package 'ansible' installed successfully."
+    else
+        warn "Failed to install 'ansible' package directly. Trying to install prerequisites for user-space install..."
+        if sudo apt-get install -y pipx;
+         then
+             info "Installed pipx. Attempting to install Ansible with it..."
+             if pipx install ansible;
+              then
+                info "Ansible installed successfully with pipx."
+                info "Please ensure '${HOME}/.local/bin' is in your PATH."
+                exit 0
+             fi
+        else
+            error "Failed to install 'ansible' or 'pipx' via apt. Aborting."
+        fi
+    fi
+elif command -v dnf >/dev/null 2>&1; then
+    info "Detected Red Hat-based system (dnf)."
+    info "Attempting to install 'ansible-core' package..."
+    if ! sudo dnf install -y ansible-core;
+     then
+        error "Failed to install ansible-core via dnf. Aborting."
+    fi
+elif command -v pacman >/dev/null 2>&1; then
+    info "Detected Arch-based system (pacman)."
+    info "Attempting to install 'ansible' package..."
+    if ! sudo pacman -Syu --noconfirm ansible;
+     then
+        error "Failed to install ansible via pacman. Aborting."
+    fi
+elif command -v brew >/dev/null 2>&1; then
+    info "Detected macOS (brew)."
+    info "Attempting to install 'ansible' package..."
+    if ! brew install ansible;
+     then
+        error "Failed to install ansible via brew. Aborting."
+    fi
+else
+    error "Could not detect a known package manager (apt, dnf, pacman, brew). Aborting."
+fi
+
+# 4. Final verification
+info "--- Verifying final installation ---"
+if command -v ansible >/dev/null 2>&1; then
+    info "Ansible successfully installed at $(command -v ansible)."
+    exit 0
+else
+    error "Installation attempted but the 'ansible' command is still not available. Please check the output for errors."
+fi

bin/install_package.sh

@@ -0,0 +1,92 @@
+#!/bin/bash
+
+# Attempt to install packages regardless of OS
+
+set -ue
+
+is_sourced() {
+  if [ -n "${ZSH_VERSION:-}" ]; then
+      case $ZSH_EVAL_CONTEXT in *:file:*) return 0;; esac
+  else  # Add additional POSIX-compatible shell names here, if needed.
+      case ${0##*/} in dash|-dash|bash|-bash|ksh|-ksh|sh|-sh) return 0;; esac
+  fi
+  return 1  # NOT sourced.
+}
+
+# Format is <apt name>:<manager>:<alternate name>
+# Use "-" for alternate name if not available
+PACKAGE_ALIASES=$(cat <<'EOF'
+binfmt-support:brew:-
+cryptsetup:brew:-
+lvm2:brew:-
+EOF
+)
+
+package_alias() {
+  local manager="$1"
+  local package="$2"
+  local alias=$(echo "$PACKAGE_ALIASES" | \
+    awk -F: -v manager="${manager}" -v package="${package}" \
+    '$1 == package && $2 == manager { print $3 }' 2>/dev/null)
+  echo "${alias:-${package}}"
+}
+
+install_package() {
+  local package="$1"
+
+  # Check for apt-get
+  if command -v apt-get &> /dev/null; then
+    package=$(package_alias apt "${package}")
+    if [ "$package" == "-" ] ; then
+      echo "Package not available on this platform"
+      return 1
+    fi
+    echo "Installing '$package' using apt-get..."
+    sudo apt-get install -y -- "$package"
+    return 0
+  elif command -v yum &> /dev/null; then
+    package=$(package_alias yum "${package}")
+    if [ "$package" == "-" ] ; then
+      echo "Package not available on this platform"
+      return 1
+    fi
+    echo "Installing '$package' using yum..."
+    sudo yum install -y -- "$package"
+    return 0
+  elif command -v pacman &> /dev/null; then
+    package=$(package_alias pacman "${package}")
+    if [ "$package" == "-" ] ; then
+      echo "Package not available on this platform"
+      return 1
+    fi
+    echo "Installing '$package' using pacman..."
+    sudo pacman -S -- "$package"
+    return 0
+  # For macOS, assume Homebrew is installed
+  elif command -v brew &> /dev/null; then
+    package=$(package_alias brew "${package}")
+    if [ "$package" == "-" ] ; then
+      echo "Package not available on this platform"
+      return 1
+    fi
+    echo "Installing '$package' using Homebrew..."
+    brew install -- "$package"
+    return 0
+  else
+    echo "Error: No suitable package manager found."
+    return 1
+  fi
+}
+
+is_sourced || {
+  # Get the package name from the command line argument
+  if [ $# -eq 0 ]; then
+    echo "Usage: $0 <package_name>"
+    exit 1
+  fi
+
+  package_name="$1"
+
+  # Call the install function
+  install_package "$package_name"
+}

bin/install_tool

@@ -0,0 +1,563 @@
+#!/bin/bash
+
+set -ue
+
+TMPDIR=$(mktemp -d)
+trap 'rm -rf -- "${TMPDIR}"' EXIT
+
+REINSTALL=0
+PACKAGES=1
+
+export GO111MODULE=on
+
+while getopts -- "-:" a ; do
+  # shellcheck disable=SC2154
+  case "${a}" in
+    -)
+      case "${OPTARG}" in
+        reinstall)
+          REINSTALL=1
+          ;;
+        no-packages)
+          PACKAGES=0
+          ;;
+        *)
+          echo "Unknown long option ${OPTARG}" >/dev/stderr
+          exit 1
+          ;;
+      esac
+      ;;
+    *)
+      echo "Unknown short option ${OPTARG}" >/dev/stderr
+      exit 1
+      ;;
+  esac
+done
+
+shift $((OPTIND-1))
+
+function list_tools {
+  echo "Options:" >/dev/stderr
+  awk 'BEGIN {s=0;FS=")"};/main tool selection/{s=1};/^\s+\w+)$/{if(s==1){print $1}}' "$0" | sort | while read -r opt; do
+    echo -e "\\t${opt}" >/dev/stderr
+  done
+}
+
+if [ $# -ne 1 ] ; then
+  echo "Usage: ${0} <tool>" >/dev/stderr
+  list_tools
+  exit 1
+fi
+TOOL=${1}
+
+function die {
+  echo "$@" >/dev/stderr
+  exit 1
+}
+
+function install_pkgs {
+  if [ ${PACKAGES} -eq 0 ] ; then
+    return 0
+  fi
+  # TODO: check if packages are already installed
+  if [ "$(id -u)" -ne "0" ] ; then
+    sudo apt-get -y install "$@" || (
+      echo -n "Unable to install packages, please ensure these " >/dev/stderr
+      echo "are installed, then run with --no-packages." >/dev/stderr
+      echo "$@"
+      false )
+    return 0
+  fi
+  apt-get -y install "$@"
+}
+
+function download {
+  SRC=${1}
+  DST=${2}
+  echo -n "Downloading ${SRC} to ${DST}..." >&2
+  curl -fL -o "${DST}" "${SRC}"
+  echo " done." >&2
+}
+
+function check_sudo {
+  sudo -l >/dev/null
+}
+
+function add_bin_symlink {
+  local TARGET NAME BINDIR
+  TARGET="${1}"
+  NAME="${2:-$(basename "${1}")}"
+  BINDIR="${HOME}/bin/tools/"
+  mkdir -p -- "${BINDIR}"
+  ln -sf "${DESTDIR}/${TARGET}" "${BINDIR}/${NAME}"
+}
+
+mkdir -p "${HOME}/tools"
+
+DESTDIR="${HOME}/tools/${TOOL}"
+
+function makedest {
+  if [ -d "${DESTDIR}" ] ; then
+    if [ "${REINSTALL}" -eq 1 ] ; then
+      rm -ri "${DESTDIR}"
+    else
+      echo "${DESTDIR} exists but not reinstalling." >/dev/stderr
+      return 1
+    fi
+  fi
+  mkdir -p "${DESTDIR}"
+}
+
+function makedest_or_die {
+  makedest || die "Aborting."
+}
+
+function deb_only {
+  # Error if not on a debian or derivative
+  if ! test -f /etc/debian_version ; then
+    echo "This tool only available for debian." >&2
+    exit 1
+  fi
+}
+
+function get_latest_github_release_url {
+  local repo="$1"
+  local glob="$2"
+  curl -s "https://api.github.com/repos/${repo}/releases/latest" | \
+    jq -r ".assets[] | select(.name|test(\"${glob}\")) | .browser_download_url"
+}
+
+function require_pipx {
+  command -v pipx >/dev/null 2>&1 || die "Requires pipx"
+}
+
+# Begin main tool selection
+case ${TOOL} in
+  john)
+    deb_only
+    makedest_or_die
+    install_pkgs libssl-dev git build-essential yasm libgmp-dev libpcap-dev \
+      pkg-config libbz2-dev libopenmpi-dev openmpi-bin libnss3-dev \
+      libkrb5-dev libgmp-dev
+    jtemp="${TMPDIR}/john"
+    mkdir -p "${jtemp}"
+    git clone https://github.com/magnumripper/JohnTheRipper.git "${jtemp}/john"
+    cd "${jtemp}/john/src" || exit
+    ./configure && make -sj2
+    cp -r "${jtemp}"/john/run/* "${DESTDIR}"
+    # Persistent files
+    mkdir -p "${HOME}/.john"
+    touch "${HOME}/.john/john.pot"
+    ln -sf "${HOME}/.john/*" "${DESTDIR}"
+    add_bin_symlink john
+    ;;
+  wordlists)
+    makedest
+    download \
+      "http://downloads.skullsecurity.org/passwords/rockyou.txt.bz2" \
+      "${DESTDIR}/rockyou.txt.bz2"
+    bunzip2 "${DESTDIR}/rockyou.txt.bz2"
+    download \
+      "http://downloads.skullsecurity.org/passwords/phpbb.txt.bz2" \
+      "${DESTDIR}/phpbb.txt.bz2"
+    bunzip2 "${DESTDIR}/phpbb.txt.bz2"
+    download \
+      "http://downloads.skullsecurity.org/passwords/hak5.txt.bz2" \
+      "${DESTDIR}/hak5.txt.bz2"
+    bunzip2 "${DESTDIR}/hak5.txt.bz2"
+    ;;
+  seclists)
+    git clone https://github.com/danielmiessler/SecLists.git "${DESTDIR}"
+    ;;
+  werdlists)
+    git clone --depth 1 https://github.com/decal/werdlists.git "${DESTDIR}"
+    ;;
+  gcloud)
+    makedest_or_die
+    gbase="https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/"
+    gsdk=$(curl -s https://cloud.google.com/sdk/docs/install-sdk | grep -o "google-cloud-sdk-[0-9.]*-linux-x86_64.tar.gz" | head -n 1)
+    download "${gbase}${gsdk}" "${TMPDIR}/gcloud.tar.gz"
+    tar zxf "${TMPDIR}/gcloud.tar.gz" --strip-components=1 -C "${DESTDIR}"
+    add_bin_symlink bin/gcloud
+    ;;
+  android-sdk)
+    asdk=$(curl -s https://developer.android.com/studio/releases/platform-tools | grep -o "https://dl.google.com/android/repository/platform-tools_r[0-9.]*-linux.zip" | head -n 1)
+    download "${asdk}" "${TMPDIR}/android-tools.zip"
+    unzip -d "${DESTDIR}" "${TMPDIR}/android-tools.zip"
+    # Install components
+    "${DESTDIR}/tools/bin/sdkmanager" "emulator" "platform-tools"
+    ;;
+  burp)
+    # Install latest burp free
+    makedest
+    if ! download \
+      https://portswigger.net/DownloadUpdate.ashx\?Product=Free \
+      "${DESTDIR}/burp-free.jar" ; then
+      echo "Download failed." >&2
+      exit 1
+    fi
+    if [ -x /usr/bin/jarwrapper ] ; then
+      # We have binfmt support for jar, so add to bin
+      chmod +x "${DESTDIR}"/*.jar
+      ln -sf "${DESTDIR}"/*.jar "${HOME}/bin/burp"
+    fi
+    ;;
+  mitmproxy)
+    makedest_or_die
+    download \
+      "$(get_latest_github_release_url "mitmproxy/mitmproxy" ".*-linux\\.tar\\.gz")" \
+      "${TMPDIR}/mitmproxy.tar.gz"
+    tar zx -C "${DESTDIR}" -f "${TMPDIR}/mitmproxy.tar.gz"
+    add_bin_symlink mitmproxy
+    add_bin_symlink mitmweb
+    add_bin_symlink mitmdump
+    ;;
+  esp)
+    makedest_or_die
+    src="https://dl.espressif.com/dl/xtensa-esp32-elf-linux64-1.22.0-61-gab8375a-5.2.0.tar.gz"
+    download "${src}" "${TMPDIR}/esp32.tar.gz"
+    tar zx -C "${DESTDIR}" -f "${TMPDIR}/esp32.tar.gz"
+    git clone --recursive https://github.com/espressif/esp-idf.git "${DESTDIR}/esp-idf"
+    ;;
+  dex2jar)
+    makedest_or_die
+    src="https://github.com/pxb1988/dex2jar/releases/download/v2.4/dex-tools-v2.4.zip"
+    download "${src}" "${TMPDIR}/dex2jar.zip"
+    tmpd="${TMPDIR}/dex2jar"
+    mkdir -p "${tmpd}"
+    unzip -d "${tmpd}" "${TMPDIR}/dex2jar.zip"
+    mv "${tmpd}"/dex-tools-*/* "${DESTDIR}"
+    rm "${DESTDIR}"/*.bat
+    chmod +x "${DESTDIR}"/*.sh
+    ;;
+  proxmark3)
+    deb_only
+    install_pkgs p7zip git build-essential libreadline5 libreadline-dev \
+      libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev \
+      gcc-arm-none-eabi libstdc++-arm-none-eabi-newlib
+    src="https://github.com/Proxmark/proxmark3.git"
+    git clone "${src}" "${DESTDIR}"
+    cd "${DESTDIR}" || exit
+    make -sj2
+    check_sudo && sudo /bin/sh -c \
+      "cp -rf driver/78-mm-usb-device-blacklist.rules \
+         /etc/udev/rules.d/77-mm-usb-device-blacklist.rules &&\
+         udevadm control --reload-rules"
+    ;;
+  pm3iceman)
+    deb_only
+    # arch:
+    # sudo pacman -Syu git base-devel readline bzip2 lz4 arm-none-eabi-gcc arm-none-eabi-newlib qt5-base bluez python gd --needed
+    install_pkgs git ca-certificates build-essential pkg-config \
+      libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev \
+      libbz2-dev libbluetooth-dev libpython3-dev libssl-dev
+    src="https://github.com/RfidResearchGroup/proxmark3.git"
+    git clone "${src}" "${DESTDIR}"
+    cd "${DESTDIR}" || exit
+    make clean && make -sj2
+    check_sudo && sudo /bin/sh -c \
+      "cp -rf ./driver/77-pm3-usb-device-blacklist.rules \
+         /etc/udev/rules.d/77-pm3-usb-device-blacklist.rules &&\
+         udevadm control --reload-rules"
+    add_bin_symlink pm3
+    ;;
+  cyberchef)
+    makedest
+    cd "${DESTDIR}" || exit
+    download \
+      "$(get_latest_github_release_url "gchq/CyberChef" ".*\\.zip")" \
+      "${DESTDIR}/cyberchef.zip"
+    unzip -d "${DESTDIR}" "${DESTDIR}/cyberchef.zip"
+    ln -sf CyberChef*.html "${DESTDIR}/cyberchef.html"
+    ;;
+  apktool)
+    makedest_or_die
+    download \
+      https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts/linux/apktool \
+      "${DESTDIR}/apktool"
+    jar_url=$(curl -s https://bitbucket.org/iBotPeaches/apktool/downloads/ | grep -o "/iBotPeaches/apktool/downloads/apktool_[0-9.]*.jar" | head -n 1)
+    download \
+      "https://bitbucket.org${jar_url}" \
+      "${DESTDIR}/apktool.jar"
+    chmod +x "${DESTDIR}/apktool"
+    add_bin_symlink apktool
+    ;;
+  ptf)
+    makedest_or_die
+    src="https://github.com/trustedsec/ptf.git"
+    git clone "${src}" "${DESTDIR}"
+    ;;
+  pwndbg)
+    if ! command -v gdb > /dev/null 2>&1 ; then
+      echo 'No gdb available!' >/dev/stderr
+      exit 1
+    fi
+    git clone --depth 1 -b stable https://github.com/pwndbg/pwndbg.git "${DESTDIR}"
+    PY_PACKAGES=${DESTDIR}/vendor
+    mkdir -p "${PY_PACKAGES}"
+    PYVER=$(gdb -batch -q --nx -ex 'pi import platform; print(".".join(platform.python_version_tuple()[:2]))')
+    PYTHON=$(gdb -batch -q --nx -ex 'pi import sys; print(sys.executable)')
+    PYTHON="${PYTHON}${PYVER}"
+    "${PYTHON}" -m pip install --target "${PY_PACKAGES}" -Ur "${DESTDIR}/requirements.txt"
+    "${PYTHON}" -m pip install --target "${PY_PACKAGES}" -U capstone unicorn
+    # capstone package is broken, find and copy the library manually
+    capstone_so_path=$(find "${PY_PACKAGES}/usr/lib" -name "libcapstone.so" -type f)
+    if [ -z "${capstone_so_path}" ]; then
+      die "Could not find libcapstone.so for pwndbg."
+    elif [ "$(echo "${capstone_so_path}" | wc -l)" -ne 1 ]; then
+      die "Found multiple libcapstone.so files for pwndbg, aborting."
+    fi
+    cp "${capstone_so_path}" "${PY_PACKAGES}/capstone/"
+    ;;
+  gef)
+    makedest_or_die
+    if ! command -v gdb > /dev/null 2>&1 ; then
+      echo 'No gdb available!' >/dev/stderr
+      exit 1
+    fi
+    download \
+      https://github.com/hugsy/gef/raw/master/gef.py \
+      "${DESTDIR}/gef.py"
+    ;;
+  aflplusplus)
+    deb_only
+    install_pkgs libtool-bin libglib2.0-dev libpixman-1-dev clang clang-tools \
+      llvm python3-setuptools
+    git clone "https://github.com/vanhauser-thc/AFLplusplus" "${DESTDIR}"
+    make -C "${DESTDIR}" distrib
+    ;;
+  exploitdb)
+    if test -d "${DESTDIR}" ; then
+      echo "Already installed, updating instead..." >/dev/stderr
+      "${DESTDIR}/searchsploit" -u
+    else
+      git clone --depth 1 \
+        https://github.com/offensive-security/exploitdb.git \
+        "${DESTDIR}"
+      add_bin_symlink searchsploit
+      cp "${DESTDIR}/.searchsploit_rc" "${HOME}/.searchsploit_rc"
+      sed -i "s|/opt/exploitdb|${DESTDIR}|" "${HOME}/.searchsploit_rc"
+    fi
+    ;;
+  cura)
+    makedest
+    download \
+      "$(get_latest_github_release_url "Ultimaker/Cura" ".*\\.AppImage")" \
+      "${DESTDIR}/Cura.AppImage"
+    chmod +x "${DESTDIR}/Cura.AppImage"
+    add_bin_symlink "Cura.AppImage" cura
+    ;;
+  rr)
+    deb_only
+    check_sudo
+    download \
+      "$(get_latest_github_release_url "mozilla/rr" ".*-Linux-.*\\.deb")" \
+      "${TMPDIR}/rr.deb"
+    sudo dpkg -i "${TMPDIR}/rr.deb"
+    ;;
+  nmap-parse-output)
+    git clone --depth 1 \
+      https://github.com/ernw/nmap-parse-output.git \
+      "${DESTDIR}"
+    add_bin_symlink nmap-parse-output
+    cat <<EOF >"${HOME}/.zshrc.d/99-nmap-parse-output.zsh"
+if test -d ${DESTDIR} ; then
+  autoload bashcompinit
+  bashcompinit
+  source ${DESTDIR}/_nmap-parse-output
+fi
+EOF
+    ;;
+  logiops)
+    deb_only
+    install_pkgs cmake libevdev-dev libudev-dev libconfig++-dev checkinstall
+    git clone "https://github.com/PixlOne/logiops.git" "${DESTDIR}"
+    mkdir -p "${DESTDIR}/build"
+    cd "${DESTDIR}/build" || exit
+    cmake ..
+    make
+    check_sudo
+    sudo checkinstall --pkgname logiops --maintainer "${USER}" -y
+    ;;
+  aws)
+    DN="${TMPDIR}/aws"
+    mkdir -p "${DN}"
+    cd "${DN}" || exit
+    curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "${DN}/awscliv2.zip"
+    unzip "${DN}/awscliv2.zip"
+    mv "${DN}/aws/dist" "${DESTDIR}"
+    add_bin_symlink aws
+    ;;
+  tmpmail)
+    install_pkgs curl w3m jq
+    mkdir -p "${DESTDIR}"
+    download "https://git.io/tmpmail" "${DESTDIR}/tmpmail"
+    chmod +x "${DESTDIR}/tmpmail"
+    add_bin_symlink tmpmail
+    ;;
+  gf)
+    install_pkgs golang-go silversearcher-ag
+    go install github.com/tomnomnom/gf@latest
+    mkdir -p "${HOME}/.config"
+    if test -d "${HOME}/.config/gf" ; then
+      git -C "${HOME}/.config/gf" pull
+    else
+      git clone https://github.com/Matir/gf-patterns.git "${HOME}/.config/gf"
+    fi
+    ;;
+  gron)
+    go install github.com/tomnomnom/gron@latest
+    ;;
+  httprobe)
+    go install github.com/tomnomnom/httprobe@latest
+    ;;
+  ffuf)
+    go install github.com/ffuf/ffuf@latest
+    ;;
+  gobuster)
+    go install github.com/OJ/gobuster@latest
+    ;;
+  amass)
+    go install github.com/OWASP/Amass/v3/...
+    ;;
+  cht.sh)
+    install_pkgs rlwrap
+    mkdir -p "${DESTDIR}"
+    download "https://cht.sh/:cht.sh" "${DESTDIR}/cht.sh"
+    chmod +x "${DESTDIR}/cht.sh"
+    add_bin_symlink cht.sh
+    ;;
+  age)
+    go install filippo.io/age/cmd/age@latest
+    go install filippo.io/age/cmd/age-keygen@latest
+    ;;
+  docker-compose)
+    mkdir -p "${DESTDIR}"
+    latest_version=$(curl -s "https://api.github.com/repos/docker/compose/releases/latest" | jq -r '.tag_name')
+    curl -L \
+      "https://github.com/docker/compose/releases/download/${latest_version}/docker-compose-$(uname -s)-$(uname -m)" \
+            -o "${DESTDIR}/docker-compose"
+    chmod +x "${DESTDIR}/docker-compose"
+    add_bin_symlink docker-compose
+    ;;
+  tldr)
+    require_pipx
+    pipx install tldr
+    ;;
+  blint)
+    require_pipx
+    pipx install blint
+    ;;
+  dust)
+    if ! command -v cargo >/dev/null 2>&1 ; then
+      echo "This needs cargo (for rust)!" >/dev/stderr
+      exit 1
+    fi
+    cargo install du-dust
+    ;;
+  bottom)
+    if ! command -v cargo >/dev/null 2>&1 ; then
+      echo "This needs cargo (for rust)!" >/dev/stderr
+      exit 1
+    fi
+    cargo install bottom
+    ;;
+  delta)
+    deb_only
+    if ! check_sudo ; then
+      echo "Must be able to run as sudo."
+      exit 1
+    fi
+    dpkg_url=$(get_latest_github_release_url "dandavison/delta" ".*_amd64.deb")
+    dpkg_name="${TMPDIR}/delta_amd64.deb"
+    download "${dpkg_url}" "${dpkg_name}"
+    sudo dpkg -i "${dpkg_name}"
+    ;;
+  ropper)
+    deb_only
+    install_pkgs python3-z3
+    pip3 install --user pyvex ropper
+    ;;
+  kubeconform)
+    go install github.com/yannh/kubeconform/cmd/kubeconform@latest
+    ;;
+  kubectx)
+    git clone https://github.com/ahmetb/kubectx.git "${DESTDIR}"
+    add_bin_symlink kubectx
+    add_bin_symlink kubens
+    COMPDIR="${HOME}/.zshrc.completions"
+    mkdir -p "${COMPDIR}"
+    ln -sf "${DESTDIR}/completion/_kubectx.zsh" "${COMPDIR}"
+    ln -sf "${DESTDIR}/completion/_kubens.zsh" "${COMPDIR}"
+    ;;
+  starship)
+    mkdir -p "${DESTDIR}"
+    download \
+      "https://github.com/starship/starship/releases/latest/download/starship-$(uname -m)-unknown-linux-musl.tar.gz" \
+      "${TMPDIR}/starship.tar.gz"
+    tar -C "${DESTDIR}" -zxf "${TMPDIR}/starship.tar.gz" starship
+    add_bin_symlink starship
+    ;;
+  arduino-cli)
+    mkdir -p "${DESTDIR}"
+    download \
+      "https://downloads.arduino.cc/arduino-cli/arduino-cli_latest_Linux_64bit.tar.gz" \
+      "${TMPDIR}/arduino-cli.tar.gz"
+    tar -C "${DESTDIR}" -zxf "${TMPDIR}/arduino-cli.tar.gz" arduino-cli
+    add_bin_symlink arduino-cli
+    ;;
+  ghidra)
+    zip_url=$(get_latest_github_release_url "NationalSecurityAgency/ghidra" ".*\\.zip")
+    download "${zip_url}" "${TMPDIR}/ghidra.zip"
+    unzip -d "${DESTDIR}" "${TMPDIR}/ghidra.zip"
+    mv "${DESTDIR}"/*/* "${DESTDIR}"
+    add_bin_symlink ghidraRun ghidra
+    ;;
+  doctl)
+    # TODO: other architectures
+    tar_url=$(get_latest_github_release_url "digitalocean/doctl" ".*linux-amd64\\.tar\\.gz")
+    download "${tar_url}" "${TMPDIR}/doctl.tar.gz"
+    mkdir -p "${DESTDIR}"
+    tar -C "${DESTDIR}" -zxf "${TMPDIR}/doctl.tar.gz" "doctl"
+    add_bin_symlink doctl
+    ;;
+  rustup)
+    rustup_init="${TMPDIR}/rustup-init.sh"
+    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o "${rustup_init}"
+    sh "${rustup_init}" --no-modify-path -y
+    ;;
+  igrep)
+    if ! command -v cargo >/dev/null 2>&1 ; then
+      echo "This needs cargo (for rust)!" >/dev/stderr
+      exit 1
+    fi
+    cargo install igrep
+    ;;
+  unblob)
+    require_pipx
+    pipx install unblob
+    ;;
+  fq)
+    go install github.com/wader/fq@latest
+    ;;
+  mise)
+    if command -v brew >/dev/null 2>&1; then
+      brew install mise
+    else
+      curl -sSL https://mise.jdx.dev/gpg-key.pub | gpg --import
+      INSTALL_FILE_AND_SIG="${TMPDIR}/install.sh.sig"
+      download "https://mise.jdx.dev/install.sh.sig" "${INSTALL_FILE_AND_SIG}"
+      DECRYPTED_SCRIPT="${TMPDIR}/mise_install.sh"
+      if gpg --assert-signer 24853EC9F655CE80B48E6C3A8B81C9D17413A06D --decrypt -o "${DECRYPTED_SCRIPT}" "${INSTALL_FILE_AND_SIG}" >/dev/null 2>&1; then
+        sh "${DECRYPTED_SCRIPT}"
+      else
+        die "gpg verification or decryption failed for mise installer"
+      fi
+    fi
+    ;;
+  *)
+    echo "Unknown tool: ${TOOL}" >/dev/stderr
+    list_tools
+    exit 1
+    ;;
+esac

bin/macos/chromebundles.py

@@ -0,0 +1,546 @@
+#!/usr/bin/env python3
+
+import argparse
+import plistlib
+import shutil
+import stat
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+from PIL import Image, ImageEnhance
+
+
+DEFAULT_CHROME_APP = Path("/Applications/Google Chrome.app")
+DEFAULT_APPS_DIR = Path.home() / "Applications" / "Chrome Containers"
+
+# Edit this list for your containers.
+CONTAINERS = [
+#    {
+#        "name": "Chrome Work",
+#        "bundle_id": "com.example.chrome.work",
+#        "mode": "persistent",
+#        "profile_dir": str(Path.home() / ".chrome-work"),
+#        "badge_path": str(Path.home() / ".chrome-container-badges" / "briefcase.svg"),
+#    },
+    {
+        "name": "Chrome Family",
+        "bundle_id": "com.example.chrome.family",
+        "mode": "persistent",
+        "profile_dir": str(Path.home() / ".chrome-family"),
+        "badge_path": str(Path.home() / ".chrome-container-badges" / "family.svg"),
+    },
+    {
+        "name": "Chrome Research",
+        "bundle_id": "com.example.chrome.research",
+        "mode": "persistent",
+        "profile_dir": str(Path.home() / ".chrome-research"),
+        "badge_path": str(Path.home() / ".chrome-container-badges" / "research.svg"),
+    },
+    {
+        "name": "Chrome Ephemeral",
+        "bundle_id": "com.example.chrome.ephemeral",
+        "mode": "ephemeral",
+        "profile_dir": None,
+        "badge_path": str(Path.home() / ".chrome-container-badges" / "fire.svg"),
+    },
+]
+
+DEFAULT_COLOR_FACTOR = 0.55
+DEFAULT_BRIGHTNESS_FACTOR = 0.94
+DEFAULT_CONTRAST_FACTOR = 0.97
+DEFAULT_BADGE_FRACTION = 0.50
+DEFAULT_PADDING_FRACTION = 0.03
+DEFAULT_BADGE_OPACITY = 0.96
+
+
+def run(cmd, check=True, capture_output=False, text=True):
+    return subprocess.run(cmd, check=check, capture_output=capture_output, text=text)
+
+
+def require_tool(name: str):
+    if shutil.which(name) is None:
+        print(f"Missing required tool: {name}", file=sys.stderr)
+        sys.exit(1)
+
+
+def parse_icon_size(path: Path):
+    name = path.name
+    if not name.endswith(".png") or not name.startswith("icon_"):
+        return (0, 0)
+
+    stem = name[:-4]
+    rest = stem[len("icon_"):]
+    scale = 1
+    if rest.endswith("@2x"):
+        rest = rest[:-3]
+        scale = 2
+
+    try:
+        left, right = rest.split("x", 1)
+        return (int(left) * scale, int(right) * scale)
+    except Exception:
+        return (0, 0)
+
+
+def find_source_icns(app_path: Path) -> Path:
+    info_plist = app_path / "Contents" / "Info.plist"
+    resources_dir = app_path / "Contents" / "Resources"
+
+    if not info_plist.exists():
+        raise FileNotFoundError(f"Missing Info.plist: {info_plist}")
+    if not resources_dir.exists():
+        raise FileNotFoundError(f"Missing Resources directory: {resources_dir}")
+
+    with info_plist.open("rb") as f:
+        plist = plistlib.load(f)
+
+    icon_name = plist.get("CFBundleIconFile")
+    if icon_name:
+        if not icon_name.endswith(".icns"):
+            icon_name += ".icns"
+        candidate = resources_dir / icon_name
+        if candidate.exists():
+            return candidate
+
+    chrome_named = sorted(resources_dir.glob("*[Cc]hrome*.icns"))
+    if chrome_named:
+        return chrome_named[0]
+
+    any_icns = sorted(resources_dir.glob("*.icns"))
+    if any_icns:
+        return any_icns[0]
+
+    raise FileNotFoundError(f"No .icns file found in {resources_dir}")
+
+
+def extract_iconset(icns_path: Path, out_iconset: Path):
+    run(["iconutil", "-c", "iconset", str(icns_path), "-o", str(out_iconset)])
+
+
+def largest_png(iconset_dir: Path) -> Path:
+    pngs = list(iconset_dir.glob("*.png"))
+    if not pngs:
+        raise FileNotFoundError(f"No PNGs found in {iconset_dir}")
+    pngs.sort(key=lambda p: parse_icon_size(p)[0] * parse_icon_size(p)[1], reverse=True)
+    return pngs[0]
+
+
+def rasterize_svg(svg_path: Path, out_png: Path, size: int = 1024):
+    # Prefer librsvg if installed.
+    if shutil.which("rsvg-convert"):
+        run([
+            "rsvg-convert",
+            "-w", str(size),
+            "-h", str(size),
+            "-o", str(out_png),
+            str(svg_path),
+        ])
+        return
+
+    # Fallback to Inkscape CLI if available.
+    if shutil.which("inkscape"):
+        run([
+            "inkscape",
+            str(svg_path),
+            "--export-type=png",
+            f"--export-filename={out_png}",
+            "-w", str(size),
+            "-h", str(size),
+        ])
+        return
+
+    raise RuntimeError(
+        f"SVG badge provided but no SVG rasterizer found for {svg_path}. "
+        "Install librsvg (rsvg-convert) or Inkscape."
+    )
+
+
+def load_badge_image(badge_path: Path, temp_dir: Path) -> Image.Image | None:
+    if not badge_path.exists():
+        print(f"Warning: badge file not found, skipping overlay: {badge_path}")
+        return None
+
+    suffix = badge_path.suffix.lower()
+
+    if suffix == ".png":
+        return Image.open(badge_path).convert("RGBA")
+
+    if suffix == ".svg":
+        rasterized = temp_dir / f"{badge_path.stem}.png"
+        rasterize_svg(badge_path, rasterized, size=1024)
+        return Image.open(rasterized).convert("RGBA")
+
+    raise RuntimeError(
+        f"Unsupported badge format for {badge_path}. "
+        "Supported formats: .png, .svg"
+    )
+
+
+def compose_icon(
+    base_png: Path,
+    badge_path: str | None,
+    out_master: Path,
+    color_factor: float,
+    brightness_factor: float,
+    contrast_factor: float,
+    badge_fraction: float,
+    padding_fraction: float,
+    badge_opacity: float,
+    temp_dir: Path,
+):
+    base = Image.open(base_png).convert("RGBA")
+
+    muted = ImageEnhance.Color(base).enhance(color_factor)
+    muted = ImageEnhance.Brightness(muted).enhance(brightness_factor)
+    muted = ImageEnhance.Contrast(muted).enhance(contrast_factor)
+
+    result = muted.copy()
+
+    if badge_path:
+        badge = load_badge_image(Path(badge_path).expanduser(), temp_dir)
+        if badge is not None:
+            w, h = result.size
+
+            max_badge_w = int(w * badge_fraction)
+            max_badge_h = int(h * badge_fraction)
+            pad = max(4, int(w * padding_fraction))
+
+            bw, bh = badge.size
+            scale = min(max_badge_w / bw, max_badge_h / bh)
+            new_size = (max(1, int(bw * scale)), max(1, int(bh * scale)))
+            badge = badge.resize(new_size, Image.LANCZOS)
+
+            if badge_opacity < 1.0:
+                alpha = badge.getchannel("A")
+                alpha = ImageEnhance.Brightness(alpha).enhance(badge_opacity)
+                badge.putalpha(alpha)
+
+            x = w - badge.width - pad
+            y = h - badge.height - pad
+            result.alpha_composite(badge, (x, y))
+
+    result.save(out_master)
+
+
+def build_iconset_from_master(master_png: Path, out_iconset: Path):
+    out_iconset.mkdir(parents=True, exist_ok=True)
+    img = Image.open(master_png).convert("RGBA")
+
+    sizes = [
+        ("icon_16x16.png", 16),
+        ("icon_16x16@2x.png", 32),
+        ("icon_32x32.png", 32),
+        ("icon_32x32@2x.png", 64),
+        ("icon_128x128.png", 128),
+        ("icon_128x128@2x.png", 256),
+        ("icon_256x256.png", 256),
+        ("icon_256x256@2x.png", 512),
+        ("icon_512x512.png", 512),
+        ("icon_512x512@2x.png", 1024),
+    ]
+
+    for filename, size in sizes:
+        resized = img.resize((size, size), Image.LANCZOS)
+        resized.save(out_iconset / filename)
+
+
+def iconset_to_icns(iconset_dir: Path, out_icns: Path):
+    run(["iconutil", "-c", "icns", str(iconset_dir), "-o", str(out_icns)])
+
+
+def make_launch_script(chrome_bin: Path, mode: str, profile_dir: str | None) -> str:
+    chrome_bin_escaped = str(chrome_bin).replace("\\", "\\\\").replace('"', '\\"')
+
+    if mode == "persistent":
+        if not profile_dir:
+            raise ValueError("Persistent container requires profile_dir")
+        profile_dir_escaped = profile_dir.replace("\\", "\\\\").replace('"', '\\"')
+        return f"""#!/bin/bash
+set -euo pipefail
+
+CHROME_BIN="{chrome_bin_escaped}"
+PROFILE_DIR="{profile_dir_escaped}"
+
+mkdir -p "$PROFILE_DIR"
+
+exec "$CHROME_BIN" \\
+  --user-data-dir="$PROFILE_DIR" \\
+  --no-first-run \\
+  --no-default-browser-check \\
+  --new-window
+"""
+    elif mode == "ephemeral":
+        return f"""#!/bin/bash
+set -euo pipefail
+
+CHROME_BIN="{chrome_bin_escaped}"
+PROFILE_DIR="$(mktemp -d /tmp/chrome-ephemeral-XXXXXX)"
+
+cleanup() {{
+  rm -rf "$PROFILE_DIR"
+}}
+trap cleanup EXIT INT TERM
+
+exec "$CHROME_BIN" \\
+  --user-data-dir="$PROFILE_DIR" \\
+  --no-first-run \\
+  --no-default-browser-check \\
+  --new-window
+"""
+    else:
+        raise ValueError(f"Unknown mode: {mode}")
+
+
+def write_plist(app_name: str, bundle_id: str, plist_path: Path):
+    plist = {
+        "CFBundleDisplayName": app_name,
+        "CFBundleExecutable": "launch",
+        "CFBundleIdentifier": bundle_id,
+        "CFBundleName": app_name,
+        "CFBundlePackageType": "APPL",
+        "CFBundleShortVersionString": "1.0",
+        "CFBundleVersion": "1",
+        "LSMinimumSystemVersion": "12.0",
+        "NSHighResolutionCapable": True,
+        "CFBundleIconFile": "applet",
+    }
+    with plist_path.open("wb") as f:
+        plistlib.dump(plist, f)
+
+
+def codesign_app(app_dir: Path):
+    try:
+        run(["/usr/bin/codesign", "--force", "--deep", "--sign", "-", str(app_dir)])
+    except subprocess.CalledProcessError as e:
+        print(f"Warning: codesign failed for {app_dir}: {e}")
+
+
+def sanitize_container(container: dict) -> dict:
+    required = ["name", "bundle_id", "mode"]
+    for key in required:
+        if key not in container or not container[key]:
+            raise ValueError(f"Container missing required key: {key}")
+
+    mode = container["mode"]
+    if mode not in {"persistent", "ephemeral"}:
+        raise ValueError(f"Invalid mode for {container['name']}: {mode}")
+
+    if mode == "persistent" and not container.get("profile_dir"):
+        raise ValueError(f"Persistent container missing profile_dir: {container['name']}")
+
+    return container
+
+
+def container_matches_filter(name: str, only_names: set[str]) -> bool:
+    if not only_names:
+        return True
+    return name in only_names
+
+
+def build_icon_for_app(
+    source_icns: Path,
+    badge_path: str | None,
+    out_icns: Path,
+    color_factor: float,
+    brightness_factor: float,
+    contrast_factor: float,
+    badge_fraction: float,
+    padding_fraction: float,
+    badge_opacity: float,
+):
+    with tempfile.TemporaryDirectory() as tmp:
+        tmpdir = Path(tmp)
+        base_iconset = tmpdir / "base.iconset"
+        new_iconset = tmpdir / "new.iconset"
+        master_png = tmpdir / "master.png"
+
+        extract_iconset(source_icns, base_iconset)
+        base_png = largest_png(base_iconset)
+        size = parse_icon_size(base_png)
+        print(f"  Base icon source: {base_png.name} ({size[0]}x{size[1]})")
+
+        compose_icon(
+            base_png=base_png,
+            badge_path=badge_path,
+            out_master=master_png,
+            color_factor=color_factor,
+            brightness_factor=brightness_factor,
+            contrast_factor=contrast_factor,
+            badge_fraction=badge_fraction,
+            padding_fraction=padding_fraction,
+            badge_opacity=badge_opacity,
+            temp_dir=tmpdir,
+        )
+        build_iconset_from_master(master_png, new_iconset)
+        iconset_to_icns(new_iconset, out_icns)
+
+
+def create_or_update_container(
+    container: dict,
+    apps_dir: Path,
+    chrome_bin: Path,
+    source_icns: Path,
+    force: bool,
+    update_icons_only: bool,
+    codesign: bool,
+    color_factor: float,
+    brightness_factor: float,
+    contrast_factor: float,
+    badge_fraction: float,
+    padding_fraction: float,
+    badge_opacity: float,
+):
+    app_name = container["name"]
+    bundle_id = container["bundle_id"]
+    mode = container["mode"]
+    profile_dir = container.get("profile_dir")
+    badge_path = container.get("badge_path")
+
+    app_dir = apps_dir / f"{app_name}.app"
+    contents_dir = app_dir / "Contents"
+    macos_dir = contents_dir / "MacOS"
+    resources_dir = contents_dir / "Resources"
+    out_icns = resources_dir / "applet.icns"
+
+    exists = app_dir.exists()
+
+    if update_icons_only:
+        if not exists:
+            print(f"Skipping missing app for icon update: {app_dir}")
+            return
+        print(f"Updating icon only for {app_name}...")
+        resources_dir.mkdir(parents=True, exist_ok=True)
+        build_icon_for_app(
+            source_icns,
+            badge_path,
+            out_icns,
+            color_factor,
+            brightness_factor,
+            contrast_factor,
+            badge_fraction,
+            padding_fraction,
+            badge_opacity,
+        )
+        if codesign:
+            codesign_app(app_dir)
+        print(f"  Updated icon: {out_icns}")
+        return
+
+    if exists and not force:
+        print(f"Skipping existing app: {app_dir}")
+        return
+
+    if exists and force:
+        print(f"Recreating existing app: {app_dir}")
+        shutil.rmtree(app_dir)
+    else:
+        print(f"Creating {app_name}...")
+
+    macos_dir.mkdir(parents=True, exist_ok=True)
+    resources_dir.mkdir(parents=True, exist_ok=True)
+
+    write_plist(app_name, bundle_id, contents_dir / "Info.plist")
+
+    launch_script = make_launch_script(chrome_bin, mode, profile_dir)
+    launch_path = macos_dir / "launch"
+    launch_path.write_text(launch_script, encoding="utf-8")
+    launch_path.chmod(launch_path.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+
+    if mode == "persistent":
+        Path(profile_dir).expanduser().mkdir(parents=True, exist_ok=True)
+
+    build_icon_for_app(
+        source_icns,
+        badge_path,
+        out_icns,
+        color_factor,
+        brightness_factor,
+        contrast_factor,
+        badge_fraction,
+        padding_fraction,
+        badge_opacity,
+    )
+
+    if codesign:
+        codesign_app(app_dir)
+
+    print(f"  Created: {app_dir}")
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Create and manage Chrome container wrapper apps on macOS.")
+    parser.add_argument("--chrome-app", default=str(DEFAULT_CHROME_APP), help="Path to Chrome app bundle")
+    parser.add_argument("--apps-dir", default=str(DEFAULT_APPS_DIR), help="Directory for generated wrapper apps")
+    parser.add_argument("--force", action="store_true", help="Recreate containers even if they already exist")
+    parser.add_argument("--update-icons-only", action="store_true", help="Only rebuild icons for existing containers")
+    parser.add_argument("--no-codesign", action="store_true", help="Skip ad-hoc codesigning")
+    parser.add_argument(
+        "--only",
+        action="append",
+        default=[],
+        help="Limit to specific container name; can be passed multiple times",
+    )
+    parser.add_argument("--color-factor", type=float, default=DEFAULT_COLOR_FACTOR)
+    parser.add_argument("--brightness-factor", type=float, default=DEFAULT_BRIGHTNESS_FACTOR)
+    parser.add_argument("--contrast-factor", type=float, default=DEFAULT_CONTRAST_FACTOR)
+    parser.add_argument("--badge-fraction", type=float, default=DEFAULT_BADGE_FRACTION)
+    parser.add_argument("--padding-fraction", type=float, default=DEFAULT_PADDING_FRACTION)
+    parser.add_argument("--badge-opacity", type=float, default=DEFAULT_BADGE_OPACITY)
+    args = parser.parse_args()
+
+    require_tool("iconutil")
+
+    chrome_app = Path(args.chrome_app).expanduser().resolve()
+    apps_dir = Path(args.apps_dir).expanduser().resolve()
+    chrome_bin = chrome_app / "Contents" / "MacOS" / "Google Chrome"
+
+    if not chrome_bin.exists():
+        print(f"Chrome binary not found: {chrome_bin}", file=sys.stderr)
+        sys.exit(1)
+
+    try:
+        import PIL  # noqa: F401
+    except ImportError:
+        print("Pillow is required. Install it with:", file=sys.stderr)
+        print("  python3 -m pip install --user pillow", file=sys.stderr)
+        sys.exit(1)
+
+    source_icns = find_source_icns(chrome_app)
+    apps_dir.mkdir(parents=True, exist_ok=True)
+    only_names = set(args.only)
+
+    print(f"Using Python:      {sys.executable}")
+    print(f"Using Chrome app:  {chrome_app}")
+    print(f"Using source icon: {source_icns}")
+    print(f"Apps directory:    {apps_dir}")
+    print()
+
+    for raw_container in CONTAINERS:
+        container = sanitize_container(raw_container)
+        if not container_matches_filter(container["name"], only_names):
+            continue
+
+        create_or_update_container(
+            container=container,
+            apps_dir=apps_dir,
+            chrome_bin=chrome_bin,
+            source_icns=source_icns,
+            force=args.force,
+            update_icons_only=args.update_icons_only,
+            codesign=not args.no_codesign,
+            color_factor=args.color_factor,
+            brightness_factor=args.brightness_factor,
+            contrast_factor=args.contrast_factor,
+            badge_fraction=args.badge_fraction,
+            padding_fraction=args.padding_fraction,
+            badge_opacity=args.badge_opacity,
+        )
+        print()
+
+    print("Done.")
+
+
+if __name__ == "__main__":
+    main()

bin/macos/update_brewfile

@@ -0,0 +1,156 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+import re
+import sys
+import argparse
+import difflib
+
+# Regex to match brew/cask/tap/mas lines
+PKG_RE = re.compile(r'^\s*(brew|cask|tap|mas)\s+["\']([^"\']+)["\'](.*)$')
+
+def get_repo_root():
+    try:
+        root = subprocess.check_output(['git', 'rev-parse', '--show-toplevel'], 
+                                       stderr=subprocess.STDOUT).decode().strip()
+        return root
+    except subprocess.CalledProcessError:
+        return os.getcwd()
+
+def get_ignore_list(repo_root):
+    ignore = set()
+    paths = [
+        os.path.join(repo_root, '.Brewfile.ignore'),
+        os.path.expanduser('~/.Brewfile.ignore'),
+        os.path.expanduser('~/.config/homebrew/ignore')
+    ]
+    for path in paths:
+        if os.path.exists(path):
+            with open(path) as f:
+                for line in f:
+                    line = line.split('#')[0].strip()
+                    if line:
+                        ignore.add(line)
+    return ignore
+
+def get_current_packages():
+    """Runs brew bundle dump and returns lines."""
+    try:
+        output = subprocess.check_output(['brew', 'bundle', 'dump', '--file=-'], 
+                                         stderr=subprocess.DEVNULL).decode()
+        return output.splitlines()
+    except subprocess.CalledProcessError:
+        print("Error: 'brew bundle dump' failed. Is homebrew installed?", file=sys.stderr)
+        sys.exit(1)
+
+def parse_brewfile(content):
+    """
+    Parses Brewfile content.
+    Returns:
+    - conditional_pkgs: set of (type, name)
+    - preserved_footer: string (everything from first conditional onwards)
+    """
+    lines = content.splitlines()
+    conditional_pkgs = set()
+    
+    # Find the start of the first conditional block
+    first_conditional_idx = -1
+    in_conditional = 0
+    
+    for i, line in enumerate(lines):
+        stripped = line.strip()
+        if stripped.startswith(('if ', 'unless ', 'case ')) and not stripped.endswith('; end'):
+            if first_conditional_idx == -1:
+                # Look back for comments that might belong to this block
+                j = i - 1
+                while j >= 0 and (lines[j].strip().startswith('#') or not lines[j].strip()):
+                    j -= 1
+                first_conditional_idx = j + 1
+            in_conditional += 1
+        
+        if in_conditional > 0:
+            match = PKG_RE.match(line)
+            if match:
+                conditional_pkgs.add((match.group(1), match.group(2)))
+            
+            if stripped == 'end' or stripped.endswith('; end'):
+                in_conditional -= 1
+
+    if first_conditional_idx == -1:
+        return set(), ""
+    
+    footer = "\n".join(lines[first_conditional_idx:])
+    return conditional_pkgs, footer
+
+def main(args):
+    repo_root = get_repo_root()
+    brewfile_path = os.path.join(repo_root, 'Brewfile')
+    
+    if not os.path.exists(brewfile_path):
+        print(f"Error: Brewfile not found at {brewfile_path}", file=sys.stderr)
+        sys.exit(1)
+        
+    with open(brewfile_path) as f:
+        old_content = f.read()
+        
+    conditional_pkgs, footer = parse_brewfile(old_content)
+    ignore_list = get_ignore_list(repo_root)
+    
+    dumped_lines = get_current_packages()
+    
+    new_unconditional_lines = []
+    
+    for line in dumped_lines:
+        match = PKG_RE.match(line)
+        if match:
+            pkg_type, pkg_name = match.group(1), match.group(2)
+            if pkg_name in ignore_list:
+                continue
+            if (pkg_type, pkg_name) in conditional_pkgs:
+                continue
+        
+        # If it's not a package line (e.g. comment from dump), we can skip or keep
+        if line.strip():
+            new_unconditional_lines.append(line)
+
+    # Sort lines by type (tap, brew, cask, mas) then name
+    def sort_key(line):
+        match = PKG_RE.match(line)
+        if not match: return (4, line)
+        order = {'tap': 0, 'brew': 1, 'cask': 2, 'mas': 3}
+        return (order.get(match.group(1), 4), match.group(2))
+
+    new_unconditional_lines.sort(key=sort_key)
+    
+    # Build new content
+    new_content = "\n".join(new_unconditional_lines)
+    if footer:
+        if new_unconditional_lines:
+            new_content += "\n\n"
+        new_content += footer.strip() + "\n"
+    else:
+        new_content += "\n"
+
+    if new_content == old_content:
+        print("Brewfile is already up to date.")
+    else:
+        if args.dry_run:
+            print("Changes detected (dry run):")
+            diff = difflib.unified_diff(
+                old_content.splitlines(keepends=True),
+                new_content.splitlines(keepends=True),
+                fromfile='Brewfile (original)',
+                tofile='Brewfile (new)'
+            )
+            sys.stdout.writelines(diff)
+        else:
+            with open(brewfile_path, 'w') as f:
+                f.write(new_content)
+            print("Brewfile updated.")
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Update Brewfile while preserving conditionals.")
+    parser.add_argument("--dry-run", action="store_true", help="Show changes without applying them.")
+    args = parser.parse_args()
+    main(args)

bin/metasploit.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+export NAME=$(basename "$0")
+export BASE="/opt/metasploit-framework" # TODO: search this path
+unset GEM_PATH
+
+if [ -f "${BASE}/bin/${NAME}" ] ; then
+  exec "${BASE}/bin/${NAME}" "$@"
+fi
+
+if [ -f "${BASE}/embedded/framework/tools/exploit/${NAME}.rb" ]; then
+  exec ${BASE}/embedded/bin/ruby \
+    "${BASE}/embedded/framework/tools/exploit/${NAME}.rb" "$@"
+fi
+
+echo "Couldn't find script." >&2
+exit 1

bin/nasm_shell

@@ -0,0 +1 @@
+metasploit.sh

bin/nvidia_hold.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+function list_nvidia_installed {
+  dpkg-query -l '*nvidia*' | grep '^[hi]i' | awk '{print $2}'
+}
+
+function hold_or_unhold {
+  list_nvidia_installed | xargs apt-mark "${1:-hold}"
+}
+
+case "$1" in
+  hold|h)
+    hold_or_unhold hold
+    ;;
+  unhold|u)
+    hold_or_unhold unhold
+    ;;
+  *)
+    echo "$0 <hold|unhold>" >/dev/stderr
+    exit 1
+    ;;
+esac

bin/pactl_helper

@@ -0,0 +1,46 @@
+#!/bin/bash
+
+function get_active_sink {
+  pactl list short sinks | grep RUNNING | awk '{print $2}'
+}
+
+function get_active_source {
+  pactl list short sources | grep RUNNING | awk '{print $2}'
+}
+
+function get_default_sink {
+  pactl info | grep '^Default Sink:' | awk '{print $NF}'
+}
+
+function get_default_source {
+  pactl info | grep '^Default Source:' | awk '{print $NF}'
+}
+
+function micmute {
+  MODE=${1:-toggle}
+  pactl set-source-mute $(get_default_source) ${MODE}
+}
+
+function mute {
+  MODE=${1:-toggle}
+  pactl set-sink-mute $(get_default_sink) ${MODE}
+}
+
+function volume {
+  VOL="${1}"
+  if test -z "${VOL}" ; then
+    echo "Need volume spec!"
+    exit 1
+  fi
+  pactl set-sink-volume $(get_default_sink) "${VOL}"
+}
+
+case "$1" in
+  mute|micmute|volume)
+    "$@"
+    ;;
+  *)
+    echo "Unknown command!"
+    exit 1
+    ;;
+esac

bin/pattern_create

@@ -0,0 +1 @@
+metasploit.sh

bin/pattern_offset

@@ -0,0 +1 @@
+metasploit.sh

bin/prune-broken-symlinks.sh

@@ -0,0 +1,46 @@
+#!/bin/sh
+# shellcheck disable=SC2039,SC2086
+
+set -o nounset
+
+prune_broken_symlinks() {
+    ask=1
+    dir="."
+    
+    if [ "${1:-}" = "-y" ]; then
+        ask=0
+        shift
+    fi
+    
+    if [ -n "${1:-}" ]; then
+        dir="$1"
+    fi
+    
+    # Check if there are any broken symlinks first
+    broken_links=$(find -L "$dir" -xdev -type l -print 2>/dev/null)
+    if [ -z "$broken_links" ]; then
+        return 0
+    fi
+    
+    if [ "$ask" -eq 1 ]; then
+        # Print broken links
+        echo "$broken_links"
+        
+        printf "Delete these links? [y/N] "
+        read -r reply
+        case "$reply" in
+            [yY]*)
+                ;;
+            *)
+                echo "Aborted."
+                return 0
+                ;;
+        esac
+    fi
+    
+    # Perform deletion
+    find -L "$dir" -xdev -type l -exec rm -- {} + 2>/dev/null
+}
+
+# Execute the function
+prune_broken_symlinks "$@"

bin/qdisc_span.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+
+set -ue
+
+ACTION="add"
+
+if [ "${1}" == "-d" ] ; then
+  ACTION="del"
+  shift
+fi
+
+BRIDGE="${1}"
+DEST="${2}"
+
+function setup_span {
+  if tc qdisc show dev "${1}" | grep -q 'qdisc ingress ffff' ; then
+    return 0
+  fi
+  tc qdisc add dev "${1}" ingress
+  tc filter add dev "${1}" parent ffff: protocol all u32 match u8 0 0 action mirred egress mirror dev "${DEST}"
+}
+
+function del_span {
+  tc qdisc del dev "${1}" ingress
+}
+
+function handle_iface {
+  case "${ACTION}" in
+    add)
+      setup_span "${1}"
+      ;;
+    del)
+      del_span "${1}"
+      ;;
+    *)
+      echo "Unknown action!"
+      exit 1
+      ;;
+  esac
+}
+
+function get_bridge_ifaces {
+  bridge link | grep "master ${1}" | cut -d: -f2 | cut -d@ -f1
+}
+
+get_bridge_ifaces "${BRIDGE}" | while IFS= read -r iface ; do
+  handle_iface "$iface"
+done

bin/remove-wine-associations

@@ -0,0 +1,5 @@
+#!/bin/sh
+rm -f ~/.local/share/applications/wine*.desktop
+update-desktop-database ~/.local/share/applications
+rm -f ~/.local/share/mime/packages/x-wine*.xml
+update-mime-database ~/.local/share/mime

bin/resign_for_debug.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+
+# Default values
+FORCE=false
+TARGET_PATH=""
+DEST_PATH=""
+
+# Parse flags (looking for -f)
+while getopts "f" opt; do
+  case $opt in
+    f) FORCE=true ;;
+    *) echo "Usage: $0 [-f] <binary_name_or_path> [destination]"; exit 1 ;;
+  esac
+done
+shift $((OPTIND-1))
+
+# Check for first argument
+if [ -z "$1" ]; then
+    echo "Error: No binary specified."
+    echo "Usage: $0 [-f] <binary_name_or_path> [destination]"
+    exit 1
+fi
+
+# 1. Resolve the Source Binary
+if [[ "$1" == *"/"* ]]; then
+    SOURCE_BIN="$1"
+else
+    SOURCE_BIN=$(command -v "$1")
+fi
+
+if [ ! -f "$SOURCE_BIN" ]; then
+    echo "Error: Could not find binary at '$1'"
+    exit 1
+fi
+
+# 2. Determine Destination Path
+if [ -n "$2" ]; then
+    DEST_PATH="$2"
+    # If destination is a directory, append the basename
+    if [ -d "$DEST_PATH" ]; then
+        DEST_PATH="${DEST_PATH%/}/$(basename "$SOURCE_BIN")"
+    fi
+else
+    # No destination given: create a temp directory
+    TMP_DIR=$(mktemp -d -t "debug_unlock_XXXXXX")
+    DEST_PATH="$TMP_DIR/$(basename "$SOURCE_BIN")"
+    echo "Notice: No destination provided. Using temp path: $DEST_PATH"
+fi
+
+# 3. Check for Collision
+if [ -f "$DEST_PATH" ] && [ "$FORCE" = false ]; then
+    echo "Error: Destination '$DEST_PATH' already exists. Use -f to overwrite."
+    exit 1
+fi
+
+# 4. Copy and Sign
+cp -f "$SOURCE_BIN" "$DEST_PATH"
+chmod +x "$DEST_PATH"
+
+ENTITLEMENTS_FILE=$(mktemp)
+cat <<EOF > "$ENTITLEMENTS_FILE"
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.get-task-allow</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>
+EOF
+
+echo "Unlocking: $SOURCE_BIN -> $DEST_PATH"
+codesign -s - --entitlements "$ENTITLEMENTS_FILE" -f "$DEST_PATH" 2>/dev/null
+
+if [ $? -eq 0 ]; then
+    echo "✅ Success! You can now debug: $DEST_PATH"
+else
+    echo "❌ Error: Code signing failed."
+fi
+
+rm "$ENTITLEMENTS_FILE"

bin/restic.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+#
+# Script to execute a restic backup script specific to the current hostname.
+#
+set -o errexit
+set -o nounset
+set -o pipefail
+
+# Get the current hostname
+HOSTNAME=$(hostname)
+
+# Define the directory where hostname-specific scripts are stored
+RESTIC_SCRIPTS_DIR="${HOME}/bin/restic"
+
+# Construct the full path to the hostname-specific script
+HOST_SPECIFIC_SCRIPT="${RESTIC_SCRIPTS_DIR}/${HOSTNAME}"
+
+# Check if the script exists and is executable
+if [[ -f "${HOST_SPECIFIC_SCRIPT}" && -x "${HOST_SPECIFIC_SCRIPT}" ]]; then
+  echo "Executing restic script for hostname: ${HOSTNAME}"
+  "${HOST_SPECIFIC_SCRIPT}"
+else
+  echo "Error: No executable restic script found for hostname '${HOSTNAME}' at '${HOST_SPECIFIC_SCRIPT}'." >&2
+  echo "Please create an executable script at that path if you want to use this functionality." >&2
+  exit 1
+fi

bin/restic/baymax

@@ -0,0 +1,165 @@
+#!/bin/bash
+#
+# A script to backup a single-user MacBook using restic to either a local
+# filesystem or Backblaze B2.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+# --- Configuration ---
+# Directory to be backed up.
+# For this script, we assume the user's home directory.
+SOURCE_DIR="${HOME}"
+
+# Exclude file location. We'll create a default one next to the script.
+EXCLUDE_FILE="$HOME/.restic_exclude.darwin"
+
+# --- Functions ---
+usage() {
+  cat << EOF
+Usage: $(basename "$0") [-l /path/to/repo | -b [bucket]] [-u UPLOAD_LIMIT]
+
+A script to backup a single-user MacBook using restic.
+
+Options:
+  -l <path>   Backup to a local filesystem repository at the given path.
+  -b [bucket] Backup to a Backblaze B2 bucket. The bucket name is optional.
+              If not provided, it will be read from the B2_BUCKET_NAME
+              environment variable.
+  -u <limit>  Limit the upload speed to the given value in KB/s.
+  -h          Show this help message.
+EOF
+}
+
+# --- Main Script ---
+# Check if restic is installed
+if ! command -v restic &> /dev/null; then
+  echo "Error: restic command not found." >&2
+  echo "Please install restic first: https://restic.net/" >&2
+  exit 1
+fi
+
+if [[ $# -eq 0 ]]; then
+  usage
+  exit 1
+fi
+
+BACKUP_MODE=""
+REPO=""
+UPLOAD_LIMIT=""
+
+while getopts ":l:bu:h" opt; do
+  case ${opt} in
+    l)
+      BACKUP_MODE="local"
+      REPO="${OPTARG}"
+      ;;
+    b)
+      BACKUP_MODE="b2"
+      if [[ ${OPTIND} -le $# && "${!OPTIND}" != -* ]]; then
+        REPO="b2:${!OPTIND}:"
+        OPTIND=$((OPTIND + 1))
+      fi
+      ;;
+    u)
+      UPLOAD_LIMIT="${OPTARG}"
+      ;;
+    h)
+      usage
+      exit 0
+      ;;
+    \?)
+      echo "Invalid option: -${OPTARG}" >&2
+      usage
+      exit 1
+      ;;
+    :)
+      echo "Option -${OPTARG} requires an argument." >&2
+      usage
+      exit 1
+      ;;
+  esac
+done
+
+# --- Pre-run checks ---
+if [[ -z "${BACKUP_MODE}" ]]; then
+    echo "Error: You must specify a backup mode (-l or -b)." >&2
+    usage
+    exit 1
+fi
+
+if [[ "${BACKUP_MODE}" == "b2" ]]; then
+    if [[ -f "${HOME}/.resticb2" ]] ; then
+      . "${HOME}/.resticb2"
+    fi
+    export B2_ACCOUNT_ID
+    export B2_ACCOUNT_KEY
+    export B2_BUCKET_NAME
+    if [[ -z "${B2_ACCOUNT_ID:-}" || -z "${B2_ACCOUNT_KEY:-}" ]]; then
+        echo "Error: For Backblaze B2 backups, you must set the B2_ACCOUNT_ID and B2_ACCOUNT_KEY environment variables." >&2
+        exit 1
+    fi
+
+    if [[ -z "${REPO:-}" ]]; then
+        if [[ -n "${B2_BUCKET_NAME:-}" ]]; then
+            REPO="b2:${B2_BUCKET_NAME}:"
+        else
+            echo "Error: Backup mode is B2 but no bucket name was provided and the B2_BUCKET_NAME environment variable is not set." >&2
+            usage
+            exit 1
+        fi
+    fi
+fi
+
+KEYCHAIN_ENTRY_NAME="restic_repo_password"
+if security find-generic-password -a "$(whoami)" -s "${KEYCHAIN_ENTRY_NAME}" >/dev/null 2>&1 ; then
+  export RESTIC_PASSWORD_COMMAND="security find-generic-password -a \"$(whoami)\" -s \"${KEYCHAIN_ENTRY_NAME}\" -w"
+# Source file?
+elif [[ -f "${HOME}/.resticpass" ]] ; then
+  export RESTIC_PASSWORD_FILE="${HOME}/.resticpass"
+fi
+
+# If the repository does not exist, initialize it.
+# The user will be prompted for a password, which will be required for all
+# future interactions with the repository.
+if ! restic -r "${REPO}" snapshots &> /dev/null; then
+    echo "Restic repository not found or not accessible. Initializing..."
+    restic init -r "${REPO}"
+fi
+
+
+# --- Run Backup ---
+echo "Starting restic backup..."
+echo "Source: ${SOURCE_DIR}"
+echo "Repository: ${REPO}"
+
+BACKUP_CMD="restic backup \
+    --verbose \
+    --repo \"${REPO}\" \
+    --exclude-file \"${EXCLUDE_FILE}\" \
+    --one-file-system \
+    --tag \"macbook-backup\""
+
+if [[ -n "${UPLOAD_LIMIT}" ]]; then
+    BACKUP_CMD="${BACKUP_CMD} --limit-upload ${UPLOAD_LIMIT}"
+fi
+
+BACKUP_CMD="${BACKUP_CMD} \"${SOURCE_DIR}\""
+
+eval "${BACKUP_CMD}"
+
+echo "Backup complete."
+
+# --- Prune old snapshots (optional, but recommended) ---
+# Keeps the last 7 daily, 4 weekly, and 6 monthly snapshots.
+echo "Pruning old snapshots..."
+restic forget \
+    --repo "${REPO}" \
+    --keep-daily 7 \
+    --keep-weekly 4 \
+    --keep-monthly 6 \
+    --prune
+
+echo "Pruning complete."
+echo "Restic backup script finished."

bin/restic/scar

@@ -0,0 +1,37 @@
+#!/bin/bash
+
+set -ue
+
+export RESTIC_DEFAULT_BE="google"
+export RESTIC_PASSWORD_FILE=${HOME}/.restic-password
+
+case "${RESTIC_BACKEND:=${RESTIC_DEFAULT_BE}}" in
+  google)
+    export GOOGLE_PROJECT_ID=systemoverlord.com:systemoverlord
+    export GOOGLE_APPLICATION_CREDENTIALS=${HOME}/.config/boto/restic-creds.json
+    export RESTIC_REPOSITORY="gs:systemoverlord-backups-scar-2:/"
+    ;;
+  b2)
+    . "${HOME}/.restic-backups-scar-creds"
+    export AWS_ACCESS_KEY_ID
+    export AWS_SECRET_ACCESS_KEY
+    export RESTIC_REPOSITORY="s3:s3.us-west-004.backblazeb2.com/systemoverlord-backups-scar"
+    ;;
+  *)
+    echo "Unknown restic backend $RESTIC_BACKEND" >&2
+    exit 1
+    ;;
+esac
+
+cd "${HOME}"
+
+if [ -z "${1}" ] ; then
+
+  restic backup \
+    --files-from "${HOME}/.restic-backup" \
+    --limit-upload 5000 \
+    --limit-download 10000
+
+else
+  restic "$@"
+fi

bin/screenshot.sh

@@ -0,0 +1,82 @@
+#!/bin/bash
+
+# Screenshot tool to try a few different tools
+
+set -ue
+
+TOOLS="flameshot scrot"
+SCREENDIR=${SCREENDIR:-${HOME}/Pictures/Screenshots}
+SCROT_FORMAT="%F-%T.png"
+
+function default_screenshot_command {
+  for tool in ${TOOLS} ; do
+    if which "${tool}" >/dev/null 2>&1 ; then
+      echo "${tool}"
+      return 0
+    fi
+  done
+  exit 1
+}
+
+TOOL=${SHOT:-$(default_screenshot_command)}
+CMD=${1:-region}
+
+function flameshot_gui_capture {
+  flameshot gui -p "${SCREENDIR}"
+}
+
+function flameshot_full_capture {
+  flameshot full -p "${SCREENDIR}"
+}
+
+function scrot_region_capture {
+  scrot -s "${SCREENDIR}/${SCROT_FORMAT}"
+}
+
+function scrot_window_capture {
+  scrot -u "${SCREENDIR}/${SCROT_FORMAT}"
+}
+
+function scrot_full_capture {
+  scrot "${SCREENDIR}/${SCROT_FORMAT}"
+}
+
+case "${CMD}" in
+  region|window|full)
+    mkdir -p "${SCREENDIR}"
+    case "${TOOL}" in
+      flameshot)
+        case "${CMD}" in
+          region|window)
+            flameshot_gui_capture
+            ;;
+          full)
+            flameshot_full_capture
+            ;;
+        esac
+        ;;
+      scrot)
+        case "${CMD}" in
+          region)
+            scrot_region_capture
+            ;;
+          window)
+            scrot_window_capture
+            ;;
+          full)
+            scrot_full_capture
+            ;;
+        esac
+        ;;
+      *)
+        echo "Error: Unknown or unsupported tool '${TOOL}'" >&2
+        exit 1
+        ;;
+    esac
+    exit $?
+    ;;
+  *)
+    echo "Usage: $0 [region|window|full]" >/dev/stderr
+    exit 1
+    ;;
+esac

bin/setup/apt_proxy.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+
+set -o errexit
+set -o nounset
+
+if test -f /etc/apt/apt.conf.d/90-proxy ; then
+  echo "Looks already setup."
+  exit 0
+fi
+
+cat >/etc/apt/proxy-detect <<'EOF'
+#!/bin/bash
+
+PROXY=192.168.60.10:3142
+
+if ! test -x /bin/nc ; then
+  echo DIRECT
+  exit 0
+fi
+
+if nc -w 2 -z ${PROXY/:/ } ; then
+  echo ${PROXY}
+  exit 0
+fi
+
+echo DIRECT
+EOF
+
+chmod 755 /etc/apt/proxy-detect
+
+cat >/etc/apt/apt.conf.d/90-proxy <<'EOF'
+Acquire::http::Proxy-Auto-Detect "/etc/apt/proxy-detect";
+EOF
+
+echo "Setup APT Proxying."

bin/setup/i3.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+apt-get install -y \
+  i3 i3lock xss-lock rxvt-unicode-256color fonts-inconsolata scrot \
+  xautolock xbacklight i3status dex libnotify-bin

bin/setup/nerdfonts.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+
+set -ue
+
+VER="v3.4.0"
+
+FONTS=(
+  https://github.com/ryanoasis/nerd-fonts/releases/download/${VER}/DejaVuSansMono.zip
+  https://github.com/ryanoasis/nerd-fonts/releases/download/${VER}/FiraCode.zip
+  https://github.com/ryanoasis/nerd-fonts/releases/download/${VER}/FiraMono.zip
+  https://github.com/ryanoasis/nerd-fonts/releases/download/${VER}/Hack.zip
+  https://github.com/ryanoasis/nerd-fonts/releases/download/${VER}/Inconsolata.zip
+  https://github.com/ryanoasis/nerd-fonts/releases/download/${VER}/OpenDyslexic.zip
+)
+
+if [ "$(uname)" = "Darwin" ]; then
+  FPATH="${HOME}/Library/Fonts"
+else
+  FPATH="${HOME}/.local/share/fonts/nerdfonts"
+fi
+
+mkdir -p "${FPATH}"
+cd "${FPATH}"
+
+for f in "${FONTS[@]}"; do
+  BN=$(basename "$f")
+  wget -O "${FPATH}/${BN}" "$f"
+  unzip -o -d "${FPATH}" "${FPATH}/${BN}"
+done
+
+if command -v fc-cache >/dev/null 2>&1; then
+  fc-cache -v
+fi

bin/setup/spicerandr.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -ue
+
+cat >/usr/local/bin/x-resize <<"EOF"
+#!/bin/sh
+PATH=/usr/bin:/bin:/usr/local/bin
+desktopuser=$(/bin/ps -ef  | /bin/grep -oP '^\w+ (?=.*vdagent( |$))') || exit 0
+export DISPLAY=:0
+export XAUTHORITY=$(eval echo "~$desktopuser")/.Xauthority
+/usr/bin/xrandr --output $(/usr/bin/xrandr | awk '/ connected/{print $1; exit; }') --auto
+EOF
+chmod 755 /usr/local/bin/x-resize
+
+cat >/etc/udev/rules.d/50-resize.rules <<"EOF"
+ACTION=="change",KERNEL=="card0", SUBSYSTEM=="drm", RUN+="/usr/local/bin/x-resize"
+EOF
+chmod 644 /etc/udev/rules.d/50-resize.rules

bin/smart-copy-paste

@@ -0,0 +1,36 @@
+#!/bin/sh
+#
+# smart-copy-paste
+#
+# This script provides context-aware copy and paste operations, mimicking
+# macOS behavior (Alt+C/V) while correctly handling terminals that require
+# the Shift key.
+
+# Exit silently if xdotool is not installed.
+if ! command -v xdotool > /dev/null; then
+  exit 1
+fi
+
+# Get the class name of the currently focused window.
+# We need to get the window on focus, to avoid issues with transparent terminals.
+class=$(xdotool getwindowclassname "$(xdotool getwindowfocus)")
+
+# Semicolon-separated list of terminal class names.
+terminals='Gnome-terminal;Xfce4-terminal;konsole;xterm;URxvt;Terminator;Alacritty;kitty;wezterm'
+
+# Determine the keystroke based on the window type and the argument passed.
+if echo "$terminals" | grep -q "$class"; then
+  # This is a terminal, so use Shift.
+  if [ "$1" = "copy" ]; then
+    xdotool key --clearmodifiers ctrl+shift+c
+  elif [ "$1" = "paste" ]; then
+    xdotool key --clearmodifiers ctrl+shift+v
+  fi
+else
+  # This is a standard GUI app.
+  if [ "$1" = "copy" ]; then
+    xdotool key --clearmodifiers ctrl+c
+  elif [ "$1" = "paste" ]; then
+    xdotool key --clearmodifiers ctrl+v
+  fi
+fi

bin/ssh-sign

@@ -0,0 +1,164 @@
+#!/bin/bash
+# A robust wrapper for ssh-keygen to sign and verify files.
+
+# --- Color Codes for Output ---
+COLOR_RED='\033[0;31m'
+COLOR_GREEN='\033[0;32m'
+COLOR_NONE='\033[0m' # No Color
+
+# --- Default values ---
+DEFAULT_SIGNING_KEY="$HOME/.ssh/id_signing"
+DEFAULT_ALLOWED_SIGNERS="$HOME/.ssh/allowed_signers"
+DEFAULT_IDENTITY="david@systemoverlord.com"
+DEFAULT_NAMESPACE="file"
+
+# --- Usage Message ---
+usage() {
+  cat << EOF
+Usage: $(basename "$0") <sign|verify> [OPTIONS] [FILE]
+
+A wrapper for 'ssh-keygen -Y' to simplify file signing and verification.
+
+COMMANDS:
+  sign      Sign a file. The path to the file to be signed is provided as a positional argument.
+  verify    Verify a signature. The original file content is read from stdin.
+
+OPTIONS:
+  -f <file>         For 'sign': Path to the private key for signing.
+                    Defaults to '$DEFAULT_SIGNING_KEY' if it exists.
+                    For 'verify': Path to the allowed_signers file.
+                    Defaults to '$DEFAULT_ALLOWED_SIGNERS'.
+  -n <namespace>    Signature namespace.
+                    Defaults to '$DEFAULT_NAMESPACE'.
+  -I <identity>     For 'verify': The identity to check the signature against.
+                    Defaults to '$DEFAULT_IDENTITY'.
+  -s <sig_file>     For 'verify': Path to the signature file to verify (e.g., file.sig). REQUIRED for verify.
+  -h, --help        Show this help message.
+
+EXAMPLE USAGE:
+  # Sign a file using the default key
+  $(basename "$0") sign release.tar.gz
+
+  # Sign a file with a specific key
+  $(basename "$0") sign -f ~/.ssh/id_ed25519_my_signing_key release.tar.gz
+
+  # Verify a signature using default allowed_signers and identity
+  cat release.tar.gz | $(basename "$0") verify -s release.tar.gz.sig
+
+  # Verify a signature with a specific allowed_signers file and identity
+  cat release.tar.gz | $(basename "$0") verify -f ./my_signers -I other@example.com -s release.tar.gz.sig
+
+EOF
+  exit 1
+}
+
+# --- Helper for error messages ---
+error() {
+  echo -e "${COLOR_RED}Error: $1${COLOR_NONE}" >&2
+  exit 1
+}
+
+# --- Main Script Logic ---
+
+if [[ "$1" != "sign" && "$1" != "verify" ]]; then
+  usage
+fi
+
+SUBCOMMAND=$1
+shift # Consume the subcommand
+
+# --- Argument Parsing and Validation ---
+
+# Separate arguments from the file to be signed
+declare -a remaining_args
+file_to_sign=""
+while [[ "$#" -gt 0 ]]; do
+  # If we see a non-flag argument, assume it's the file to sign.
+  # This works because the file to sign is the only positional argument.
+  if [[ "$1" != -* ]] && [[ -z "$file_to_sign" ]]; then
+    file_to_sign="$1"
+  else
+    remaining_args+=("$1")
+  fi
+  shift
+done
+
+# --- Build command based on subcommand ---
+declare -a CMD_ARGS
+CMD_ARGS=("ssh-keygen" "-Y" "$SUBCOMMAND")
+
+# Append all the flag-based arguments (-f, -n, -I, -s)
+CMD_ARGS+=("${remaining_args[@]}")
+
+# Scan for provided flags to handle defaults correctly
+f_provided=false
+n_provided=false
+I_provided=false
+s_provided=false
+for arg in "${remaining_args[@]}"; do
+  [[ "$arg" == "-f" ]] && f_provided=true
+  [[ "$arg" == "-n" ]] && n_provided=true
+  [[ "$arg" == "-I" ]] && I_provided=true
+  [[ "$arg" == "-s" ]] && s_provided=true
+done
+
+if [[ "$SUBCOMMAND" == "sign" ]]; then
+  if [[ -z "$file_to_sign" ]]; then
+    error "Path to file to be signed is required for 'sign' command."
+  fi
+  
+  # Set default signing key if -f was not provided
+  if ! $f_provided; then
+    if [[ ! -f "$DEFAULT_SIGNING_KEY" ]]; then
+      error "Default signing key not found at '$DEFAULT_SIGNING_KEY'. Specify one with -f."
+    fi
+    CMD_ARGS+=("-f" "$DEFAULT_SIGNING_KEY")
+  fi
+  
+  # Set default namespace if -n was not provided
+  if ! $n_provided; then
+    CMD_ARGS+=("-n" "$DEFAULT_NAMESPACE")
+  fi
+  
+  # The file to sign MUST be the last argument for ssh-keygen
+  CMD_ARGS+=("$file_to_sign")
+
+elif [[ "$SUBCOMMAND" == "verify" ]]; then
+  if [[ -n "$file_to_sign" ]]; then
+    error "The 'verify' command reads from stdin and does not accept a positional file argument. Found '$file_to_sign'."
+  fi
+  if ! $s_provided; then
+    error "Signature file must be provided with -s for 'verify' command."
+  fi
+  
+  # Set default allowed_signers if -f was not provided
+  if ! $f_provided; then
+    if [[ ! -f "$DEFAULT_ALLOWED_SIGNERS" ]]; then
+      error "Default allowed signers file not found at '$DEFAULT_ALLOWED_SIGNERS'. Specify one with -f."
+    fi
+    CMD_ARGS+=("-f" "$DEFAULT_ALLOWED_SIGNERS")
+  fi
+  
+  # Set default identity if -I was not provided
+  if ! $I_provided; then
+    CMD_ARGS+=("-I" "$DEFAULT_IDENTITY")
+  fi
+  
+  # Set default namespace if -n was not provided
+  if ! $n_provided; then
+    CMD_ARGS+=("-n" "$DEFAULT_NAMESPACE")
+  fi
+fi
+
+# --- Execute and Report ---
+
+# We capture the output and stderr to show it to the user
+if output=$("${CMD_ARGS[@]}" 2>&1); then
+  echo -e "${COLOR_GREEN}Success:${COLOR_NONE}"
+  echo "$output"
+  exit 0
+else
+  echo -e "${COLOR_RED}Command Failed:${COLOR_NONE}"
+  echo "$output" >&2
+  exit 1
+fi

bin/switch_virt.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+if [ $# -lt 1 ] ; then
+  echo "Usage: $0 <kvm|vbox>" >&2
+  exit 1
+fi
+
+if [ `whoami` != "root" ] ; then
+  if which sudo >/dev/null 2>&1 ; then
+    sudo "$0" "$@"
+    exit
+  fi
+  echo "Sorry, this requires root." >&2
+  exit 1
+fi
+
+if [ "$1" == "kvm" ] ; then
+  /etc/init.d/virtualbox stop
+  modprobe kvm
+  modprobe kvm_intel
+elif [ "$1" == "vbox" ]  ; then
+  rmmod kvm_intel
+  rmmod kvm
+  /etc/init.d/virtualbox start
+else
+  echo 'WTF?' >&2
+  exit 1
+fi

bin/update_skel

@@ -0,0 +1,7 @@
+#!/bin/sh
+set -e
+SKEL_DIR=$(dirname -- "$(readlink -f -- "$HOME/.profile")")
+cd -- "$SKEL_DIR"
+cd -- "$(git rev-parse --show-toplevel)"
+git pull
+./install.sh

clone.sh

@@ -0,0 +1,69 @@
+#!/bin/bash
+
+set -ue
+
+# --- Helper function to install git ---
+install_git() {
+  echo "Git not found. Attempting to install..." >&2
+  case "$(uname)" in
+    Darwin)
+      if command -v brew >/dev/null 2>&1; then
+        echo "Using Homebrew to install git..." >&2
+        brew install git
+      else
+        echo "Error: Homebrew not found on your macOS system." >&2
+        echo "Please install Homebrew first by visiting https://brew.sh/ then run this script again." >&2
+        return 1
+      fi
+      ;;
+    Linux)
+      if command -v apt-get >/dev/null 2>&1; then
+        echo "Using apt-get to install git..." >&2
+        if [ "${EUID:-$(id -u)}" -ne 0 ]; then
+          sudo apt-get update && sudo apt-get install -y git
+        else
+          apt-get update && apt-get install -y git
+        fi
+      else
+        echo "Error: This script requires 'apt-get' on Linux to install git." >&2
+        echo "Please install git using your system's package manager and run this script again." >&2
+        return 1
+      fi
+      ;;
+    *)
+      echo "Error: Unsupported operating system '$(uname)'." >&2
+      echo "Please install git manually and run this script again." >&2
+      return 1
+      ;;
+  esac
+}
+
+# --- Main script logic ---
+installer_main() {
+  # 1. Check for git, and try to install it if it's missing.
+  if ! command -v git >/dev/null 2>&1; then
+    install_git
+    # Final check after attempting installation
+    if ! command -v git >/dev/null 2>&1; then
+      echo "ERROR: git installation failed or was not found." >&2
+      echo "Please install git manually and re-run this script." >&2
+      exit 1
+    fi
+  fi
+
+  # 2. Clone the repository if it doesn't exist
+  local dest="${HOME}/.skel"
+  if [ -d "${dest}" ]; then
+    echo "Repository already exists in ${dest}. Skipping clone." >&2
+  else
+    echo "Cloning repository..." >&2
+    git clone --depth 1 https://github.com/Matir/skel.git "${dest}"
+  fi
+
+  # 3. Run the main installer
+  echo "Running main installer..." >&2
+  "${dest}/install.sh"
+}
+
+installer_main
+

conf/logid.cfg

@@ -0,0 +1,10 @@
+devices: ({
+	name: "Wireless Mouse MX Master 3";
+
+	smartshift: {
+		on: true;
+		threshold: 30;
+	};
+
+	dpi: 1500;
+});

darwin-env.plist

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.user.loadvars</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/sh</string>
+        <string>-c</string>
+        <string>~/bin/darwin-env.sh || true</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+</dict>
+</plist>

deb-to-kali.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+if [ `whoami` != "root" ] ; then
+  echo "This must be run as root." >&2
+  exit 1
+fi
+
+BASEDIR=`dirname $0`
+if ! test -f ${BASEDIR}/keys/gpg/kali-repo.key ; then
+  echo "Couldn't find key, are you in the right place?" >&2
+  exit 1
+fi
+
+cat >/etc/apt/sources.list.d/kali.list <<KALI_EOF
+deb http://http.kali.org/kali kali-rolling main contrib non-free
+KALI_EOF
+
+/usr/bin/apt-key add ${BASEDIR}/keys/gpg/kali-repo.key
+/usr/bin/apt-get update
+/usr/bin/apt-get install -y kali-linux-full

dotfile_overlays/README

@@ -0,0 +1 @@
+Each directory in this directory will be symlinked as dotfiles.

dotfiles/Xkbmap

@@ -0,0 +1 @@
+-option ctrl:nocaps -option compose:ralt

dotfiles/Xresources

@@ -0,0 +1,113 @@
+Xcursor.size: 16
+
+!!!
+! Xft for fonts
+!!!
+!Xft.dpi:                    144
+Xft.antialias:              true
+Xft.lcdfilter:              lcddefault
+Xft.rgba:                   rgb
+Xft.hinting:                true
+Xft.hintstyle:              hintslight
+Xft.autohint:               0
+
+!!!
+! Solarized urxvt
+!!!
+URxvt.depth:                32
+URxvt.geometry:             90x30
+URxvt.transparent:          false
+URxvt.fading:               0
+URxvt.urgentOnBell:         true
+URxvt.visualBell:           false
+URxvt.loginShell:           true
+URxvt.saveLines:            50000
+URxvt.internalBorder:       2
+URxvt.lineSpace:            0
+URxvt.iso14755:             false
+
+! Fonts
+URxvt.font: xft:inconsolata:pixelsize=17,xft:monospace:size=12
+
+! Fix font space
+URxvt.letterSpace: -1
+
+! Scrollbar and scrolling
+URxvt.scrollStyle:          rxvt
+URxvt.scrollBar:            false
+! do not scroll with output
+URxvt.scrollTtyOutput:      false
+! scroll in relation to buffer (with mouse scroll or Shift+Page Up)
+URxvt.scrollWithBuffer:     true
+! scroll back to the bottom on keypress
+URxvt.scrollTtyKeypress:    true
+
+! Allow apps to manage their own secondary screen
+URxvt.secondaryScreen:      1
+URxvt.secondaryScroll:      0
+
+! Perl extensions
+URxvt.perl-ext-common:      default,matcher,font-size,eval
+URxvt.matcher.button:       1
+URxvt.urlLauncher:          /usr/bin/xdg-open
+URxvt.url-launcher:         /usr/bin/xdg-open
+
+! Copy/Paste Stuff
+URxvt.keysym.Shift-Control-V:   eval:paste_clipboard
+URxvt.keysym.Shift-Control-C:   eval:selection_to_clipboard
+
+! Cursor
+URxvt.cursorBlink:          true
+URxvt.cursorUnderline:      false
+
+! Pointer
+URxvt.pointerBlank:         true
+
+! Disable printing the terminal contents when pressing PrintScreen.
+URxvt.print-pipe:           "cat > /dev/null"
+
+!!! Solarized colors begin
+! base03
+URxvt.background:             #002b36
+! base0
+URxvt.foreground:             #839496
+! base03
+URxvt.fadeColor:              #002b36
+! base1
+URxvt.cursorColor:            #93a1a1
+! base01
+URxvt.pointerColorBackground: #586e75
+! base1
+URxvt.pointerColorForeground: #93a1a1
+
+!! black dark/light
+URxvt.color0: #073642
+URxvt.color8: #002b36
+
+!! red dark/light
+URxvt.color1: #dc322f
+URxvt.color9: #cb4b16
+
+!! green dark/light
+URxvt.color2: #859900
+URxvt.color10: #586e75
+
+!! yellow dark/light
+URxvt.color3: #b58900
+URxvt.color11: #657b83
+
+!! blue dark/light
+URxvt.color4: #268bd2
+URxvt.color12: #839496
+
+!! magenta dark/light
+URxvt.color5: #d33682
+URxvt.color13: #6c71c4
+
+!! cyan dark/light
+URxvt.color6: #2aa198
+URxvt.color14: #93a1a1
+
+!! white dark/light
+URxvt.color7: #eee8d5
+URxvt.color15: #fdf6e3

dotfiles/ackrc

@@ -1,3 +1,4 @@
 --follow
 --pager=less -LMXRF
 --smart-case
+--ignore-dir=match:bazel-.*

dotfiles/aliases

@@ -1,20 +1,8 @@
 # General aliases, should only be sourced in interactive shells
-
-# Add an "alert" alias for long running commands.  Use like so:
-#   sleep 10; alert
-alias alert='notify-send --urgency=low -i "$([ $? = 0 ] && echo terminal || echo error)" "$(history|tail -n1|sed -e '\''s/^\s*[0-9]\+\s*//;s/[;&|]\s*alert$//'\'')"'
+# Try to keep in sync with ~/.config/fish/conf.d/aliases.fish
 
 # Cryptsetup alias
-alias luksFormat='sudo cryptsetup luksFormat -s 512 -c aes-xts-plain --use-random -h sha256 -i 5000'
-
-# Colors
-alias ls='ls --color=auto'
-alias grep='grep --color=auto'
-alias egrep='egrep --color=auto'
-alias fgrep='fgrep --color=auto'
-
-# Easy upgrade
-alias dist-upgrade="sudo sh -c 'apt-get update && apt-get -y dist-upgrade'"
+alias luksFormat='cryptsetup luksFormat --type=luks2 --pbkdf-memory=2560000 --pbkdf=argon2id -i 15000 -s 512 -h sha256 -c aes-xts-plain64'
 
 # Timestamp in a machine-sortable form
 alias tstamp="date '+%Y%m%d-%H%M%S'"
@@ -25,8 +13,38 @@ alias mdcode="sed 's/^/    /'"
 # Intel format plz
 alias objdump="command objdump -M intel"
 
-# ACK
-alias ack="ack-grep"
+# Drop caches for swap issues
+alias drop_caches="echo 3 | sudo /usr/bin/tee /proc/sys/vm/drop_caches"
 
-# Launch chrome for burp
-alias chrome-for-burp="/usr/bin/google-chrome --ignore-certificate-errors --user-data-dir=${HOME}/.chrome-for-burp --proxy-server=127.0.0.1:8080 >/dev/null 2>&1 &"
+# dump acpi temperature
+alias gettemp='printf "%02.2f\n" "$(cat /sys/class/thermal/thermal_zone0/temp)e-3"'
+
+# get git working directory
+alias gitroot="git rev-parse --show-toplevel"
+
+# SSH without host key checking
+alias sshanon="ssh -oUserKnownHostsFile=/dev/null -oStrictHostKeyChecking=no"
+
+# Straight to ipython
+alias ipy="ipython3 --no-banner"
+
+# Skip the header on bc
+alias bc="command bc -q"
+
+# Get a decently readable df
+alias dfh="df -h -x tmpfs -x devtmpfs -x squashfs -x fuse -x efivarfs"
+
+# Clear the GPG agent
+alias clear-gpg-agent="echo RELOADAGENT | gpg-connect-agent"
+
+# Battery details
+alias bat-details='upower -i $(upower -e | grep battery)'
+
+# Nvidia refresh rate
+alias nvidia-refresh-rate='nvidia-settings --display=:0 -q RefreshRate -t'
+
+# Earthly ssh
+alias earthly='earthly --ssh-auth-sock ""'
+
+# to clipboard
+alias toclip='xclip -selection clipboard'

dotfiles/bashrc

@@ -1,6 +1,10 @@
+# Load env first
+if [ -f $HOME/.shenv ] ; then source $HOME/.shenv ; fi
+
 # History settings
 HISTCONTROL=ignoredups:ignorespace
 shopt -s histappend
+shopt -s expand_aliases
 HISTSIZE=1000
 HISTFILESIZE=0
 
@@ -9,24 +13,13 @@ HISTFILESIZE=0
 shopt -s checkwinsize
 
 # Fancier outputs
-[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"
-case "$TERM" in
-    xterm-color) color_prompt=yes;;
-esac
-force_color_prompt=yes
-if [ -n "$force_color_prompt" ]; then
-    if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
-	color_prompt=yes
-    else
-	color_prompt=
-    fi
-fi
-if [ "$color_prompt" = yes ]; then
+[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe 2>/dev/null)"
+
+if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
     PS1='${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
 else
     PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ '
 fi
-unset color_prompt force_color_prompt
 
 # If this is an xterm set the title to user@host:dir
 case "$TERM" in
@@ -45,3 +38,5 @@ fi
 if [ -f /etc/bash_completion ] && ! shopt -oq posix; then
     . /etc/bash_completion
 fi
+
+if [[ -e $HOME/.aliases ]] ; then source $HOME/.aliases ; fi

dotfiles/config/Code/User/settings.json

@@ -0,0 +1,15 @@
+{
+    "editor.accessibilitySupport": "off",
+    "telemetry.telemetryLevel": "off",
+    "dotfiles.repository": "matir/skel",
+    "dotfiles.targetPath": "~/.skel",
+    "remote.defaultExtensionsIfInstalledLocally": [],
+    "mise.configureExtensionsAutomatically": true,
+    "kilo-code.debug": false,
+    "kilo-code.allowedCommands": [
+        "git log",
+        "git diff",
+        "git show"
+    ],
+    "kilo-code.deniedCommands": []
+}

dotfiles/config/direnv/lib/mise.sh

@@ -0,0 +1,5 @@
+if command -v mise ; then
+  use_mise() {
+    eval "$(mise direnv activate)"
+  }
+fi

dotfiles/config/direnv/lib/python.sh

@@ -0,0 +1,16 @@
+layout_python() {
+  local DIR_NAME="$(basename $(pwd))"
+  VIRTUAL_ENV="${VIRTUAL_ENV:-$(pwd)/.venv/${DIR_NAME}}"
+  local PYBIN="$(command -v python 2>/dev/null || command -v python3 2>/dev/null)"
+  if [[ -z "${PYBIN}" ]]; then
+    log_error "No python found!"
+    return 1
+  fi
+  if [[ ! -d $VIRTUAL_ENV ]]; then
+    log_status "No virtual environment exists. Executing \`${PYBIN} -m venv ${VIRTUAL_ENV}\`."
+    "${PYBIN}" -m venv "${VIRTUAL_ENV}"
+  fi
+
+  # Activate the virtual environment
+  . $VIRTUAL_ENV/bin/activate
+}

dotfiles/config/fish/conf.d/aliases.fish

@@ -0,0 +1,77 @@
+# Cryptsetup alias
+alias luksFormat 'cryptsetup luksFormat --type=luks2 --pbkdf-memory=2560000 --pbkdf=argon2id -i 15000 -s 512 -h sha256 -c aes-xts-plain64'
+
+# Timestamp in a machine-sortable form
+alias tstamp "date '+%Y%m%d-%H%M%S'"
+
+# Prepare code for markdown
+alias mdcode "sed 's/^/    /'"
+
+# Intel format plz
+alias objdump "command objdump -M intel"
+
+# Drop caches for swap issues
+alias drop_caches "echo 3 | sudo /usr/bin/tee /proc/sys/vm/drop_caches"
+
+# dump acpi temperature
+alias gettemp 'printf "%02.2f\n" (cat /sys/class/thermal/thermal_zone0/temp)e-3'
+
+# get git working directory
+alias gitroot "git rev-parse --show-toplevel"
+
+# SSH without host key checking
+alias sshanon "ssh -oUserKnownHostsFile=/dev/null -oStrictHostKeyChecking=no"
+
+# Straight to ipython
+alias ipy "ipython3 --no-banner"
+
+# Skip the header on bc
+alias bc "command bc -q"
+
+# Get a decently readable df
+alias dfh "df -h -x tmpfs -x devtmpfs -x squashfs -x fuse -x efivarfs"
+
+# Clear the GPG agent
+alias clear-gpg-agent "echo RELOADAGENT | gpg-connect-agent"
+
+# Battery details
+alias bat-details 'upower -i (upower -e | grep battery)'
+
+# Nvidia refresh rate
+alias nvidia-refresh-rate 'nvidia-settings --display=:0 -q RefreshRate -t'
+
+# Earthly ssh
+alias earthly 'earthly --ssh-auth-sock ""'
+
+# to clipboard
+alias toclip 'xclip -selection clipboard'
+
+# On some systems, bat is batcat
+if not command -v bat >/dev/null 2>&1
+  if command -v batcat >/dev/null 2>&1
+    alias bat (command -v batcat)
+  end
+end
+
+# FFUF aliases
+if command -v ffuf >/dev/null 2>&1
+  if test -d $HOME/tools/seclists
+    alias ffuf-files "ffuf -c -w $HOME/tools/seclists/Discovery/Web-Content/raft-large-files.txt"
+    alias ffuf-dirs "ffuf -c -w $HOME/tools/seclists/Discovery/Web-Content/raft-large-directories.txt"
+    alias ffuf-quick "ffuf -c -w $HOME/tools/seclists/Discovery/Web-Content/quickhits.txt"
+  end
+end
+
+if grep --help 2>/dev/null | grep -q 'color'
+  # Should have a better way to check for GNU versions
+  alias grep 'grep --color=auto'
+  alias egrep 'egrep --color=auto'
+  alias fgrep 'fgrep --color=auto'
+end
+
+# Detect which `ls` flavor is in use and use the right flag for colors.
+if ls --help 2>&1 | grep -q -- '--color'
+  alias ls 'ls --color=auto' # GNU `ls`
+else if test (uname) = "Darwin"
+  alias ls 'ls -G' # macOS `ls`
+end

dotfiles/config/fish/conf.d/fish_frozen_key_bindings.fish

@@ -0,0 +1,14 @@
+# This file was created by fish when upgrading to version 4.3, to migrate
+# the 'fish_key_bindings' variable from its old default scope (universal)
+# to its new default scope (global).  We recommend you delete this file
+# and configure key bindings in ~/.config/fish/config.fish if needed.
+
+# set --global fish_key_bindings fish_default_key_bindings
+
+# Prior to version 4.3, fish shipped an event handler that runs
+# `set --universal fish_key_bindings fish_default_key_bindings`
+# whenever the fish_key_bindings variable is erased.
+# This means that as long as any fish < 4.3 is still running on this system,
+# we cannot complete the migration.
+# As a workaround, erase the universal variable at every shell startup.
+set --erase --universal fish_key_bindings

dotfiles/config/fish/conf.d/fish_frozen_theme.fish

@@ -0,0 +1,48 @@
+# This file was created by fish when upgrading to version 4.3, to migrate
+# theme variables from universal to global scope.
+# Don't edit this file, as it will be written by the web-config tool (`fish_config`).
+# To customize your theme, delete this file and see
+#     help interactive#syntax-highlighting
+# or
+#     man fish-interactive | less +/^SYNTAX.HIGHLIGHTING
+# for appropriate commands to add to ~/.config/fish/config.fish instead.
+# See also the release notes for fish 4.3.0 (run `help relnotes`).
+
+set --global fish_color_autosuggestion 4D5566
+set --global fish_color_cancel --reverse
+set --global fish_color_command 39BAE6
+set --global fish_color_comment 626A73
+set --global fish_color_cwd 59C2FF
+set --global fish_color_cwd_root red
+set --global fish_color_end F29668
+set --global fish_color_error FF3333
+set --global fish_color_escape 95E6CB
+set --global fish_color_history_current --bold
+set --global fish_color_host normal
+set --global fish_color_host_remote yellow
+set --global fish_color_keyword 39BAE6
+set --global fish_color_match F07178
+set --global fish_color_normal B3B1AD
+set --global fish_color_operator E6B450
+set --global fish_color_option B3B1AD
+set --global fish_color_param B3B1AD
+set --global fish_color_quote C2D94C
+set --global fish_color_redirection FFEE99
+set --global fish_color_search_match --background=E6B450
+set --global fish_color_selection --background=E6B450
+set --global fish_color_status red
+set --global fish_color_user brgreen
+set --global fish_color_valid_path --underline
+set --global fish_pager_color_background
+set --global fish_pager_color_completion normal
+set --global fish_pager_color_description B3A06D
+set --global fish_pager_color_prefix normal --bold --underline
+set --global fish_pager_color_progress brwhite --background=cyan
+set --global fish_pager_color_secondary_background
+set --global fish_pager_color_secondary_completion
+set --global fish_pager_color_secondary_description
+set --global fish_pager_color_secondary_prefix
+set --global fish_pager_color_selected_background --background=E6B450
+set --global fish_pager_color_selected_completion
+set --global fish_pager_color_selected_description
+set --global fish_pager_color_selected_prefix

dotfiles/config/fish/config.fish

@@ -0,0 +1,34 @@
+if test -x /opt/homebrew/bin/brew
+  /opt/homebrew/bin/brew shellenv fish | source
+  if test -d (brew --prefix)"/share/fish/completions"
+    set -p fish_complete_path (brew --prefix)/share/fish/completions
+  end
+
+  if test -d (brew --prefix)"/share/fish/vendor_completions.d"
+    set -p fish_complete_path (brew --prefix)/share/fish/vendor_completions.d
+  end
+
+  # mise, if installed
+  if type -q mise
+    mise activate fish | source
+  end
+end
+
+if command -q starship
+  starship init fish --print-full-init | source
+end
+
+function install_fisher
+  if not test -e ~/.config/fish/functions/fisher.fish
+    echo "Installing Fisher for fish shell..."
+    curl -sL https://raw.githubusercontent.com/jorgebucaran/fisher/main/functions/fisher.fish | source
+    fisher install jorgebucaran/fisher
+  end
+end
+
+if status --is-interactive
+  install_fisher
+end
+
+# Want this at the bottom to put this path first
+fish_add_path --move --path {$HOME}/bin

dotfiles/config/fish/fish_plugins

@@ -0,0 +1,2 @@
+jorgebucaran/fisher
+wfxr/forgit

dotfiles/config/fish/functions/cdgr.fish

@@ -0,0 +1,8 @@
+# Change to the root of the git repository.
+# If not in a git repo, do nothing.
+function cdgr
+    set git_root (git rev-parse --show-toplevel 2>/dev/null)
+    if test -n "$git_root"
+        cd "$git_root"
+    end
+end

dotfiles/config/gemini/settings.json

@@ -0,0 +1,15 @@
+{
+  "editor": {
+    "mode": "vim"
+  },
+  "context": {
+    "includeFiles": [
+      "/usr/local/google/home/davidtomaschik/.skel/GEMINI.md",
+      "/usr/local/google/home/davidtomaschik/.skel/AGENTS.md"
+    ]
+  },
+  "experimental": {
+    "skills": true,
+    "planMode": true
+  }
+}

dotfiles/config/gh/config.yml

@@ -0,0 +1,12 @@
+# What protocol to use when performing git operations. Supported values: ssh, https
+git_protocol: https
+# What editor gh should run when creating issues, pull requests, etc. If blank, will refer to environment.
+editor: !!null vim
+# When to interactively prompt. This is a global config that cannot be overridden by hostname. Supported values: enabled, disabled
+prompt: enabled
+# A pager program to send command output to, e.g. "less". Set the value to "cat" to disable the pager.
+pager: !!null less -R
+# Aliases allow you to create nicknames for gh commands
+aliases:
+    co: pr checkout
+version: "1"

dotfiles/config/htop/htoprc

@@ -0,0 +1,64 @@
+# Beware! This file is rewritten by htop when settings are changed in the interface.
+# The parser is also very primitive, and not human-friendly.
+htop_version=3.4.1-3.4.1
+config_reader_min_version=3
+fields=0 48 17 18 38 39 40 2 46 47 49 1
+hide_kernel_threads=1
+hide_userland_threads=1
+hide_running_in_container=0
+shadow_other_users=0
+show_thread_names=0
+show_program_path=1
+highlight_base_name=0
+highlight_deleted_exe=1
+shadow_distribution_path_prefix=0
+highlight_megabytes=1
+highlight_threads=1
+highlight_changes=0
+highlight_changes_delay_secs=5
+find_comm_in_cmdline=1
+strip_exe_from_cmdline=1
+show_merged_command=0
+header_margin=1
+screen_tabs=0
+detailed_cpu_time=0
+cpu_count_from_one=1
+show_cpu_usage=1
+show_cpu_frequency=0
+show_cpu_temperature=0
+degree_fahrenheit=0
+show_cached_memory=1
+update_process_names=0
+account_guest_in_cpu_meter=0
+color_scheme=6
+enable_mouse=1
+delay=15
+hide_function_bar=0
+header_layout=two_50_50
+column_meters_0=AllCPUs Memory Swap
+column_meter_modes_0=1 1 1
+column_meters_1=Tasks LoadAverage Uptime
+column_meter_modes_1=2 2 2
+tree_view=0
+sort_key=46
+tree_sort_key=0
+sort_direction=-1
+tree_sort_direction=1
+tree_view_always_by_pid=0
+all_branches_collapsed=0
+screen:Main=PID USER PRIORITY NICE M_VIRT M_RESIDENT M_SHARE STATE PERCENT_CPU PERCENT_MEM TIME Command
+.sort_key=PERCENT_CPU
+.tree_sort_key=PID
+.tree_view_always_by_pid=0
+.tree_view=0
+.sort_direction=-1
+.tree_sort_direction=1
+.all_branches_collapsed=0
+screen:I/O=PID USER IO_PRIORITY IO_RATE IO_READ_RATE IO_WRITE_RATE PERCENT_SWAP_DELAY PERCENT_IO_DELAY Command
+.sort_key=IO_RATE
+.tree_sort_key=PID
+.tree_view_always_by_pid=0
+.tree_view=0
+.sort_direction=-1
+.tree_sort_direction=1
+.all_branches_collapsed=0

dotfiles/config/i3/config

@@ -0,0 +1,198 @@
+# i3 config file (v4)
+#
+# Please see http://i3wm.org/docs/userguide.html for a complete reference!
+
+set $mod Mod4
+set $alt Mod1
+
+# This font is widely installed, provides lots of unicode glyphs, right-to-left
+# text rendering and scalability on retina/hidpi displays (thanks to pango).
+font pango:DejaVu Sans Mono 8
+
+# Use Mouse+$mod to drag floating windows to their wanted position
+floating_modifier $mod
+
+# start a terminal
+bindsym $mod+Return exec i3-sensible-terminal
+
+# kill focused window
+bindsym $mod+Shift+q kill
+
+# start dmenu (a program launcher)
+bindsym $mod+d exec dmenu_run
+# There also is the (new) i3-dmenu-desktop which only displays applications
+# shipping a .desktop file. It is a wrapper around dmenu, so you need that
+# installed.
+bindsym $mod+Shift+d exec --no-startup-id i3-dmenu-desktop
+
+# move focus
+bindsym $mod+Left focus left
+bindsym $mod+Down focus down
+bindsym $mod+Up focus up
+bindsym $mod+Right focus right
+
+# move windows
+bindsym $mod+Shift+Left move left
+bindsym $mod+Shift+Down move down
+bindsym $mod+Shift+Up move up
+bindsym $mod+Shift+Right move right
+
+# split in horizontal orientation
+bindsym $mod+h split h
+
+# split in vertical orientation
+bindsym $mod+v split v
+
+# enter fullscreen mode for the focused container
+bindsym $mod+f fullscreen toggle
+
+# change container layout (stacked, tabbed, toggle split)
+bindsym $mod+s layout stacking
+bindsym $mod+w layout tabbed
+bindsym $mod+e layout toggle split
+
+# toggle tiling / floating
+bindsym $mod+Shift+space floating toggle
+
+# change focus between tiling / floating windows
+bindsym $mod+space focus mode_toggle
+
+# focus the parent container
+bindsym $mod+a focus parent
+
+# focus the child container
+#bindsym $mod+d focus child
+
+# switch to workspace
+bindsym $mod+1 workspace 1
+bindsym $mod+2 workspace 2
+bindsym $mod+3 workspace 3
+bindsym $mod+4 workspace 4
+bindsym $mod+5 workspace 5
+bindsym $mod+6 workspace 6
+bindsym $mod+7 workspace 7
+bindsym $mod+8 workspace 8
+bindsym $mod+9 workspace 9
+bindsym $mod+0 workspace 10
+
+# move focused container to workspace
+bindsym $mod+Shift+1 move container to workspace 1
+bindsym $mod+Shift+2 move container to workspace 2
+bindsym $mod+Shift+3 move container to workspace 3
+bindsym $mod+Shift+4 move container to workspace 4
+bindsym $mod+Shift+5 move container to workspace 5
+bindsym $mod+Shift+6 move container to workspace 6
+bindsym $mod+Shift+7 move container to workspace 7
+bindsym $mod+Shift+8 move container to workspace 8
+bindsym $mod+Shift+9 move container to workspace 9
+bindsym $mod+Shift+0 move container to workspace 10
+
+# do some scratchpad
+bindsym $mod+Shift+minus  move scratchpad
+bindsym $mod+minus        scratchpad show
+
+# Move workspaces between monitors
+bindsym $mod+Shift+greater move workspace to output right
+bindsym $mod+Shift+less move workspace to output left
+
+# reload the configuration file
+bindsym $mod+Shift+c reload
+# restart i3 inplace (preserves your layout/session, can be used to upgrade i3)
+bindsym $mod+Shift+r restart
+# exit i3 (logs you out of your X session)
+bindsym $mod+Shift+e exec \
+  "i3-nagbar -t warning -m \
+    'You pressed the exit shortcut. Do you really want to exit i3? \
+     This will end your X session.' \
+    -b 'Yes, exit i3' 'i3-msg exit'"
+
+# resize window (you can also use the mouse for that)
+mode "resize" {
+        # These bindings trigger as soon as you enter the resize mode
+        bindsym Left resize shrink width 10 px or 10 ppt
+        bindsym Down resize grow height 10 px or 10 ppt
+        bindsym Up resize shrink height 10 px or 10 ppt
+        bindsym Right resize grow width 10 px or 10 ppt
+
+        # back to normal: Enter or Escape or mod+r to toggle
+        bindsym Return mode "default"
+        bindsym Escape mode "default"
+        bindsym $mod+r mode "default"
+}
+
+bindsym $mod+r mode "resize"
+
+# Start i3bar to display a workspace bar (plus the system information i3status
+# finds out, if available)
+bar {
+        status_command bash -c "i3status -c <(~/.config/i3status/build_config.sh)"
+}
+
+# Cycle through workspaces like cinnamon
+bindsym $alt+Control+Right workspace next
+bindsym $alt+Control+Left workspace prev
+
+# i3 lock
+exec --no-startup-id ~/bin/i3lock.sh &
+exec --no-startup-id xset dpms 600
+bindsym $mod+l exec \
+  bash -c "i3lock -c 000000 && (sleep 2 && xset dpms force off) &"
+bindsym $alt+Control+l exec \
+  bash -c "i3lock -c 000000 && (sleep 2 && xset dpms force off) &"
+# suspend under systemd
+bindsym $mod+Control+s exec --no-startup-id systemctl suspend
+
+# things to start quickly
+bindsym $mod+g exec /usr/bin/google-chrome-beta --password-store=gnome
+
+# kill a window with middle click + mod
+bindsym --whole-window $mod+button2 kill
+# float a window with right click + mod
+bindsym --whole-window $mod+button3 floating toggle
+
+# media keys
+# Pulse Audio controls
+bindsym XF86AudioRaiseVolume exec --no-startup-id ~/bin/pactl_helper volume +5%
+bindsym XF86AudioLowerVolume exec --no-startup-id ~/bin/pactl_helper volume -5%
+bindsym XF86AudioMute exec --no-startup-id ~/bin/pactl_helper mute toggle
+bindsym XF86AudioMicMute exec --no-startup-id ~/bin/pactl_helper micmute toggle
+bindsym F13 exec --no-startup-id ~/bin/pactl_helper micmute toggle
+# Screen brightness controls
+bindsym XF86MonBrightnessUp exec --no-startup-id xbacklight -inc 10
+bindsym XF86MonBrightnessDown exec --no-startup-id xbacklight -dec 10
+
+# screenshots
+# region/selection
+bindsym --release Print exec --no-startup-id \
+  ~/bin/screenshot.sh region
+# full screen
+bindsym --release Shift+Print exec --no-startup-id \
+  ~/bin/screenshot.sh full
+# single window
+bindsym --release $alt+Sys_Req exec --no-startup-id \
+  ~/bin/screenshot.sh window
+
+# useful utilities
+exec --no-startup-id gnome-keyring-daemon --start --components=pkcs11,secrets
+exec --no-startup-id xset r rate 200 20
+#exec --no-startup-id ~/bin/autostart.py
+exec --no-startup-id dex --autostart --environment x-cinnamon
+# Solaar for mouse
+exec --no-startup-id sh -c 'command solaar -w hide || true'
+
+# customize windows
+for_window [window_role="pop-up"] floating enable
+for_window [window_role="bubble"] floating enable
+for_window [window_role="task_dialog"] floating enable
+for_window [window_role="Preferences"] floating enable
+for_window [window_type="dialog"] floating enable
+for_window [window_type="menu"] floating enable
+
+for_window [class="^google-chrome$"] border pixel
+for_window [class="^Google-chrome-beta$"] border pixel
+for_window [class="^burp-StartBurp$" title="^(?!Burp Suite)"] floating enable
+
+# no need for borders on the edge of the screen
+hide_edge_borders both
+
+# vim:filetype=i3

dotfiles/config/i3status/build_config.sh

@@ -0,0 +1,143 @@
+#!/bin/bash
+
+function general {
+	cat <<-EOF
+		general {
+			colors = true
+			interval = 5
+		}
+	EOF
+}
+
+function disks {
+	local DISKS=(/ /home)
+	local d
+	local used
+	for d in ${DISKS[@]} ; do
+		local dev=`df $d | tail -1 | awk '{print $1}'`
+		if [[ $used == *$dev* ]] ; then
+			continue
+		fi
+		local size=`df $d | tail -1 | awk '{print $2}'`
+		if [ $size -eq 0 ] ; then
+			continue
+		fi
+		used="${used} ${dev}"
+		cat <<-EOF
+			disk "${d}" {
+				format = "${d} %avail"
+			}
+			order += "disk ${d}"
+		EOF
+	done
+}
+
+function wireless {
+	which iwconfig >/dev/null || return
+	iwconfig 2>&1 | grep . | grep -vq 'no wireless extensions' || return
+	cat <<-EOF
+		wireless _first_ {
+			format_up = "W: (%quality %essid) %ip"
+			format_down = "W: down"
+		}
+		order += "wireless _first_"
+	EOF
+}
+
+function wired {
+	local def_iface="$(ip route get 1.1.1.1 2>&1 | grep -oP 'dev \K\S+')"
+	if test -n "${def_iface}" ; then
+		cat <<-EOF
+			ethernet "${def_iface}" {
+				format_up = "E: %ip"
+				format_down = "E: down"
+			}
+			order += "ethernet ${def_iface}"
+		EOF
+		return 0
+	fi
+	cat <<-EOF
+		ethernet _first_ {
+			format_up = "E: %ip"
+			format_down = "E: down"
+		}
+		order += "ethernet _first_"
+	EOF
+}
+
+function ipv6 {
+	echo "order += \"ipv6\""
+}
+
+function load {
+	cat <<-EOF
+		load {
+			format = "%1min %5min"
+		}
+		order += "load"
+	EOF
+}
+
+function now {
+	cat <<-EOF
+		tztime local {
+			format = "%Y-%m-%d %H:%M"
+		}
+		order += "tztime local"
+	EOF
+}
+
+function battery {
+	local bat
+	shopt -s nullglob
+	for bat in /sys/class/power_supply/BAT* ; do
+		local bid=${bat##*BAT}
+		cat <<-EOF
+			battery ${bid} {
+				low_threshold = 15
+				threshold_type = time
+				status_chr = "↑ CHR"
+				status_bat = "↓ BAT"
+		EOF
+		if [ $(bc <<< "$(i3status --version | awk '{print $2}') < 2.11") -eq 0 ] ;
+		then
+			cat <<-EOF
+				status_unk = "? UNK"
+			EOF
+		fi
+		cat <<-EOF
+				status_full = "FULL"
+				format = "%status %percentage"
+				path = "/sys/class/power_supply/BAT${bid}/uevent"
+				hide_seconds = true
+				last_full_capacity = true
+			}
+			order += "battery ${bid}"
+		EOF
+	done
+}
+
+function audio {
+	cat <<-EOF
+		volume master {
+			format = "♪: %volume"
+			format_muted = "♪: MUTE"
+			device = "default"
+			mixer = "Master"
+			mixer_idx = 0
+		}
+		order += "volume master"
+	EOF
+}
+
+general
+disks
+wireless
+wired
+ipv6
+load
+battery
+audio
+now
+
+# vim: noexpandtab

dotfiles/config/i3status/config

@@ -0,0 +1,52 @@
+# i3status configuration file.
+# see "man i3status" for documentation.
+
+# It is important that this file is edited as UTF-8.
+# The following line should contain a sharp s:
+# ß
+# If the above line is not correctly displayed, fix your editor first!
+
+general {
+        colors = true
+        interval = 5
+}
+
+order += "ipv6"
+order += "disk /"
+order += "disk /home"
+order += "wireless _first_"
+order += "ethernet _first_"
+order += "battery all"
+order += "load"
+order += "tztime local"
+
+wireless _first_ {
+        format_up = "W: (%quality at %essid) %ip"
+        format_down = "W: down"
+}
+
+ethernet _first_ {
+        # if you use %speed, i3status requires root privileges
+        format_up = "E: %ip (%speed)"
+        format_down = "E: down"
+}
+
+battery all {
+        format = "%status %percentage %remaining"
+}
+
+tztime local {
+        format = "%Y-%m-%d %H:%M:%S"
+}
+
+load {
+        format = "%1min"
+}
+
+disk "/" {
+        format = "%avail"
+}
+
+disk "/home" {
+        format = "%avail"
+}

dotfiles/config/mise/config.toml

@@ -0,0 +1,19 @@
+[settings]
+experimental = true
+
+[settings.pipx]
+uvx = true
+
+[settings.python]
+uv_venv_auto = true
+
+[tools]
+age = "latest"
+usage = "latest"
+uv = "latest"
+
+[hooks]
+postinstall = "mise sync python --uv"
+
+[env]
+UV_PROJECT_ENVIRONMENT = { value='{% if env.PROJECT_SLUG %}{{ env.HOME}}/.cache/uv-venvs/{{ env.PROJECT_SLUG }}{% endif %}', tools = true }

dotfiles/config/nvim/init.vim

@@ -0,0 +1,4 @@
+" nvim config
+set runtimepath^=~/.vim runtimepath+=~/.vim/after
+let &packpath = &runtimepath
+source ~/.vimrc

dotfiles/config/redshift.conf

@@ -0,0 +1,11 @@
+[redshift]
+temp-day=5700
+temp-night=4750
+transition=1
+brightness-day=1.0
+brightness-night=0.9
+adjustment-method=randr
+
+[manual]
+lat=37.3
+lon=-121.9

dotfiles/config/starship.toml

@@ -0,0 +1,53 @@
+"$schema" = 'https://starship.rs/config-schema.json'
+
+[directory]
+fish_style_pwd_dir_length = 1
+truncate_to_repo = false
+
+[gcloud]
+symbol = "️🇬️ "
+format = "on [$symbol$project]($style) "
+detect_env_vars = ["STARSHIP_SHOW_GCLOUD"]
+
+[status]
+disabled = false
+symbol = "⛌"
+
+[username]
+show_always = true
+
+[ruby]
+detect_variables = []
+
+[shell]
+fish_indicator = '🐟 '
+zsh_indicator = ''
+bash_indicator = ''
+powershell_indicator = '_'
+unknown_indicator = '??'
+style = 'cyan bold'
+disabled = false
+format = '[$indicator]($style)'
+
+[pulumi]
+disabled = true
+
+[docker_context]
+# really long paths when DOCKER_HOST is set
+disabled = true
+
+[kubernetes]
+disabled = false
+detect_folders = ["k8s"]
+
+[custom.gemini_context]
+description = "Displays the current Gemini CLI context"
+when = "test -n \"$GEMINI_CLI_HOME\""
+command = """
+context_dir=\"${XDG_CONFIG_HOME:-$HOME/.config}/gemini\"
+if [[ \"$GEMINI_CLI_HOME\" == $context_dir/* ]]; then
+  basename \"$GEMINI_CLI_HOME\"
+fi
+"""
+style = "bold blue"
+format = "♊[$output](blue) "

dotfiles/config/user-dirs.dirs

@@ -0,0 +1,15 @@
+# This file is written by xdg-user-dirs-update
+# If you want to change or add directories, just edit the line you're
+# interested in. All local changes will be retained on the next run
+# Format is XDG_xxx_DIR="$HOME/yyy", where yyy is a shell-escaped
+# homedir-relative path, or XDG_xxx_DIR="/yyy", where /yyy is an
+# absolute path. No other format is supported.
+# 
+XDG_DESKTOP_DIR="$HOME/Desktop"
+XDG_DOWNLOAD_DIR="$HOME/Downloads"
+XDG_TEMPLATES_DIR="$HOME/"
+XDG_PUBLICSHARE_DIR="$HOME/Shared"
+XDG_DOCUMENTS_DIR="$HOME/Documents"
+XDG_MUSIC_DIR="$HOME/Music"
+XDG_PICTURES_DIR="$HOME/Pictures"
+XDG_VIDEOS_DIR="$HOME/Videos"

dotfiles/config/wezterm/wezterm.lua

@@ -0,0 +1,181 @@
+
+  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                 Dload  Upload   Total   Spent    Left  Speed
+
+  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0-- https://wezfurlong.org/wezterm/config/files.html
+-- https://alexplescan.com/posts/2024/08/10/wezterm/
+-- https://github.com/wez/wezterm/issues/6112
+-- https://github.com/wez/wezterm/issues/5754
+local wezterm = require "wezterm"
+local config = wezterm.config_builder()
+local action = wezterm.action
+local mux = wezterm.mux
+
+config.audible_bell = "Disabled"
+config.check_for_updates = false -- managed by brew
+config.set_environment_variables = {
+  PATH = '/opt/homebrew/bin:/usr/local/bin/:' .. os.getenv('PATH')
+}
+
+local function scheme_for_appearance(a)
+  return a:find("Dark") and "Catppuccin Macchiato" or "Catppuccin Latte"
+end
+
+config.font = wezterm.font { family = 'JetBrains Mono', weight = 'Medium', harfbuzz_features = { 'calt=0', 'clig=0', 'liga=0' } }
+config.font_size = 15.0
+config.line_height = 1.0
+config.bold_brightens_ansi_colors = true
+config.color_scheme = scheme_for_appearance(wezterm.gui.get_appearance())
+config.macos_window_background_blur = 20
+config.window_background_opacity = 0.96
+
+config.window_decorations = 'RESIZE|INTEGRATED_BUTTONS'
+config.window_padding = { left = '0.5cell', right = '0.5cell', top = '1.5cell', bottom = '0.5cell' }
+config.enable_tab_bar = true
+config.use_fancy_tab_bar = false
+config.tab_bar_at_bottom = true
+config.tab_max_width = 32
+config.show_new_tab_button_in_tab_bar = false
+-- config.hide_tab_bar_if_only_one_tab = true -- sometimes procude wrong window size on maximize
+
+config.default_cursor_style = 'BlinkingBar'
+config.animation_fps = 1
+config.cursor_blink_rate = 500
+config.prefer_egl = true
+config.max_fps = 60
+
+config.enable_scroll_bar = true
+config.scrollback_lines = 10000
+
+-- makes wezterm to work like tmux; see also: https://bower.sh/zmx-session-persistence
+config.default_gui_startup_args = { 'connect', 'unix' }
+config.window_close_confirmation = 'NeverPrompt'
+
+local function maximize_window(window)
+  if not window.gui_window then return end
+
+  local screen = wezterm.gui.screens().active
+  local guiwin = window:gui_window()
+  if not screen or not guiwin then return end
+
+  -- window:gui_window():maximize() -- have long animation
+  guiwin:set_position(screen.x, screen.y)
+  guiwin:set_inner_size(screen.width, screen.height)
+end
+
+-- https://github.com/wez/wezterm/issues/3299#issuecomment-2145712082
+wezterm.on("gui-startup", function(cmd)
+	local tab, pane, window = mux.spawn_window(cmd or {})
+  maximize_window(window)
+end)
+
+wezterm.on("gui-attached", function(window)
+  local workspace = mux.get_active_workspace()
+  for _, window in ipairs(mux.all_windows()) do
+    if window:get_workspace() == workspace then
+      maximize_window(window)
+    end
+  end
+end)
+
+wezterm.on("window-resized", function(window, pane)
+  maximize_window(window)
+end)
+
+-- see also https://wezterm.org/config/lua/wezterm/battery_info.html
+wezterm.on("format-tab-title", function(tab, tabs, panes, config, hover, max_width)
+  local title = (tab.tab_title ~= "" and tab.tab_title) or tab.active_pane.title
+  title = title:lower()
+
+  local prefix = tostring(tab.tab_index + 1) .. ":"
+  local width = math.max(1, max_width - (#prefix + 2))
+  title = wezterm.truncate_right(title, width)
+
+  return " " .. prefix .. title .. " "
+end)
+
+-- https://github.com/wezterm/wezterm/issues/1988#issuecomment-2462216249
+local function search_cmd(window, pane)
+  window:perform_action(action.Search 'CurrentSelectionOrEmptyString', pane)
+  window:perform_action(action.Multiple {
+    action.CopyMode 'ClearPattern',
+    action.CopyMode 'ClearSelectionMode',
+    action.CopyMode 'MoveToScrollbackBottom'
+  }, pane)
+end
+
+config.keys = {
+  { key = 'q', mods = 'CMD', action = wezterm.action.Nop }, -- prevent accidental quit
+  { key = 't', mods = 'CMD', action = action.SpawnTab 'CurrentPaneDomain' },
+  { key = 'd', mods = 'CMD', action = action.SplitHorizontal { domain = 'CurrentPaneDomain' } },
+  { key = 'd', mods = 'CMD|SHIFT', action = action.SplitVertical { domain = 'CurrentPaneDomain' } },
+  { key = 'k', mods = 'CMD', action = action.ClearScrollback 'ScrollbackAndViewport' },
+  { key = 'w', mods = 'CMD', action = action.CloseCurrentPane { confirm 
+100  6869  100  6869    0     0  42178      0 --:--:-- --:--:-- --:--:-- 42401
+= false } },
+  { key = 'w', mods = 'CMD|SHIFT', action = action.CloseCurrentTab { confirm = false } },
+  { key = 'a', mods = 'CMD', action = action.SelectTextAtMouseCursor 'SemanticZone', },
+  { key = 'LeftArrow', mods = 'CMD', action = action.SendKey { key = 'Home' } },
+  { key = 'RightArrow', mods = 'CMD', action = action.SendKey { key = 'End' } },
+  { key = 'Backspace', mods = 'CMD', action = action.SendKey({ mods = "CTRL", key = "u" }) },
+  { key = 'Backspace', mods = 'OPT', action = action.SendKey({ mods = "CTRL", key = "w" }) },
+  { key = 'P', mods = 'CMD|SHIFT', action = action.ActivateCommandPalette },
+  { key = 'f', mods = 'CMD', action = wezterm.action_callback(search_cmd) },
+  { key = ',', mods = 'CMD', action = action.SpawnCommandInNewTab { cwd = wezterm.home_dir, args = { 'code', wezterm.config_file } } },
+  { key = 'E', mods = 'CMD|SHIFT', action = action.PromptInputLine {
+    description = 'Enter tab title (empty to unset):',
+    action = wezterm.action_callback(function(window, _, line)
+      window:active_tab():set_title(line)
+    end),
+  }},
+}
+
+config.mouse_bindings = {
+  { event = { Up = { streak = 1, button = "Left" } }, mods = "NONE", action = action.Nop },
+  { event = { Up = { streak = 1, button = "Left" } }, mods = "CMD", action = action.OpenLinkAtMouseCursor },
+  -- Disable CMD + LeftClick window drag (make it behave like normal select)
+  -- { event = { Drag = { streak = 1, button = 'Left' } }, mods = "CMD", action = action.Nop },
+  { event = { Drag = { streak = 1, button = "Left" } }, mods = "CMD", action = action.ExtendSelectionToMouseCursor("Cell") },
+}
+
+-- https://code.visualstudio.com/docs/configure/command-line#_opening-vs-code-with-urls
+-- path-symbols: [\w@\.\/\-\[\]\(\)]
+
+local function path_exists(path)
+  local ok, _, _ = wezterm.run_child_process { "test", "-e", path }
+  return ok
+end
+
+config.hyperlink_rules = wezterm.default_hyperlink_rules()
+-- config.hyperlink_rules = {}
+
+table.insert(config.hyperlink_rules, {
+  regex = [[((?:[\w@\.\/\-\[\]\(\)]+\/)+[\w@\.\/\-\[\]\(\)]+\.\w+)\b]],
+  format = "vscode://file/$PWD/$1",
+  highlight = 1,
+})
+
+table.insert(config.hyperlink_rules, {
+  regex = [[((?:[\w@\.\/\-\[\]\(\)]+\/)+[\w@\.\/\-\[\]\(\)]+\.\w+):(\d+):(\d+)]],
+  format = "vscode://file/$PWD/$1:$2:$3",
+  highlight = 1,
+})
+
+wezterm.on("open-uri", function(window, pane, uri)
+  if uri:find("$PWD") then
+    local cwd_uri = pane:get_current_working_dir()
+    local before, after = uri:match("^(.-)$PWD/(.+)$")
+    wezterm.log_info(before, after, path_exists(after))
+    if path_exists(after) then
+      uri = before .. after
+    else
+      uri = uri:gsub("$PWD", cwd_uri.file_path)
+    end
+
+    wezterm.log_info(uri)
+    wezterm.open_with(uri)
+    return false
+  end
+
+  return true
+end)

dotfiles/config/xfce4/xfconf/xfce-perchannel-xml/xfce4-keyboard-shortcuts.xml

@@ -0,0 +1,195 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<channel name="xfce4-keyboard-shortcuts" version="1.0">
+  <property name="commands" type="empty">
+    <property name="default" type="empty">
+      <property name="&lt;Alt&gt;F1" type="empty"/>
+      <property name="&lt;Alt&gt;F2" type="empty">
+        <property name="startup-notify" type="empty"/>
+      </property>
+      <property name="&lt;Alt&gt;F3" type="empty">
+        <property name="startup-notify" type="empty"/>
+      </property>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;Delete" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;l" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;t" type="empty"/>
+      <property name="XF86Display" type="empty"/>
+      <property name="&lt;Super&gt;p" type="empty"/>
+      <property name="&lt;Primary&gt;Escape" type="empty"/>
+      <property name="XF86WWW" type="empty"/>
+      <property name="HomePage" type="empty"/>
+      <property name="XF86Mail" type="empty"/>
+      <property name="Print" type="empty"/>
+      <property name="&lt;Alt&gt;Print" type="empty"/>
+      <property name="&lt;Shift&gt;Print" type="empty"/>
+      <property name="&lt;Super&gt;e" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;f" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;Escape" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Shift&gt;Escape" type="empty"/>
+      <property name="&lt;Super&gt;r" type="empty">
+        <property name="startup-notify" type="empty"/>
+      </property>
+      <property name="&lt;Alt&gt;&lt;Super&gt;s" type="empty"/>
+    </property>
+    <property name="custom" type="empty">
+      <property name="&lt;Alt&gt;F2" type="string" value="xfce4-appfinder --collapsed">
+        <property name="startup-notify" type="bool" value="true"/>
+      </property>
+      <property name="&lt;Super&gt;r" type="string" value="xfce4-appfinder -c">
+        <property name="startup-notify" type="bool" value="true"/>
+      </property>
+      <property name="XF86WWW" type="string" value="exo-open --launch WebBrowser"/>
+      <property name="XF86Mail" type="string" value="exo-open --launch MailReader"/>
+      <property name="&lt;Alt&gt;F3" type="string" value="xfce4-appfinder">
+        <property name="startup-notify" type="bool" value="true"/>
+      </property>
+      <property name="&lt;Primary&gt;Escape" type="string" value="xfdesktop --menu"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;Delete" type="string" value="xfce4-session-logout"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;t" type="string" value="exo-open --launch TerminalEmulator"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;f" type="string" value="thunar"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;l" type="string" value="xflock4"/>
+      <property name="&lt;Alt&gt;F1" type="string" value="xfce4-popup-applicationsmenu"/>
+      <property name="&lt;Super&gt;p" type="string" value="xfce4-display-settings --minimal"/>
+      <property name="&lt;Primary&gt;&lt;Shift&gt;Escape" type="string" value="xfce4-taskmanager"/>
+      <property name="&lt;Super&gt;e" type="string" value="thunar"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;Escape" type="string" value="xkill"/>
+      <property name="HomePage" type="string" value="exo-open --launch WebBrowser"/>
+      <property name="XF86Display" type="string" value="xfce4-display-settings --minimal"/>
+      <property name="override" type="bool" value="true"/>
+      <property name="&lt;Super&gt;l" type="string" value="xflock4"/>
+      <property name="Print" type="string" value="flameshot gui"/>
+      <property name="&lt;Shift&gt;Print" type="string" value="flameshot full"/>
+    </property>
+  </property>
+  <property name="xfwm4" type="empty">
+    <property name="default" type="empty">
+      <property name="&lt;Alt&gt;Insert" type="empty"/>
+      <property name="Escape" type="empty"/>
+      <property name="Left" type="empty"/>
+      <property name="Right" type="empty"/>
+      <property name="Up" type="empty"/>
+      <property name="Down" type="empty"/>
+      <property name="&lt;Alt&gt;Tab" type="empty"/>
+      <property name="&lt;Alt&gt;&lt;Shift&gt;Tab" type="empty"/>
+      <property name="&lt;Alt&gt;Delete" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;Down" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;Left" type="empty"/>
+      <property name="&lt;Shift&gt;&lt;Alt&gt;Page_Down" type="empty"/>
+      <property name="&lt;Alt&gt;F4" type="empty"/>
+      <property name="&lt;Alt&gt;F6" type="empty"/>
+      <property name="&lt;Alt&gt;F7" type="empty"/>
+      <property name="&lt;Alt&gt;F8" type="empty"/>
+      <property name="&lt;Alt&gt;F9" type="empty"/>
+      <property name="&lt;Alt&gt;F10" type="empty"/>
+      <property name="&lt;Alt&gt;F11" type="empty"/>
+      <property name="&lt;Alt&gt;F12" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Shift&gt;&lt;Alt&gt;Left" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;End" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;Home" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Shift&gt;&lt;Alt&gt;Right" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Shift&gt;&lt;Alt&gt;Up" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_1" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_2" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_3" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_4" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_5" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_6" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_7" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_8" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_9" type="empty"/>
+      <property name="&lt;Alt&gt;space" type="empty"/>
+      <property name="&lt;Shift&gt;&lt;Alt&gt;Page_Up" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;Right" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;d" type="empty"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;Up" type="empty"/>
+      <property name="&lt;Super&gt;Tab" type="empty"/>
+      <property name="&lt;Primary&gt;F1" type="empty"/>
+      <property name="&lt;Primary&gt;F2" type="empty"/>
+      <property name="&lt;Primary&gt;F3" type="empty"/>
+      <property name="&lt;Primary&gt;F4" type="empty"/>
+      <property name="&lt;Primary&gt;F5" type="empty"/>
+      <property name="&lt;Primary&gt;F6" type="empty"/>
+      <property name="&lt;Primary&gt;F7" type="empty"/>
+      <property name="&lt;Primary&gt;F8" type="empty"/>
+      <property name="&lt;Primary&gt;F9" type="empty"/>
+      <property name="&lt;Primary&gt;F10" type="empty"/>
+      <property name="&lt;Primary&gt;F11" type="empty"/>
+      <property name="&lt;Primary&gt;F12" type="empty"/>
+      <property name="&lt;Super&gt;KP_Left" type="empty"/>
+      <property name="&lt;Super&gt;KP_Right" type="empty"/>
+      <property name="&lt;Super&gt;KP_Down" type="empty"/>
+      <property name="&lt;Super&gt;KP_Up" type="empty"/>
+      <property name="&lt;Super&gt;KP_Page_Up" type="empty"/>
+      <property name="&lt;Super&gt;KP_Home" type="empty"/>
+      <property name="&lt;Super&gt;KP_End" type="empty"/>
+      <property name="&lt;Super&gt;KP_Next" type="empty"/>
+    </property>
+    <property name="custom" type="empty">
+      <property name="&lt;Primary&gt;F12" type="string" value="workspace_12_key"/>
+      <property name="&lt;Alt&gt;F4" type="string" value="close_window_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_3" type="string" value="move_window_workspace_3_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;Down" type="string" value="down_workspace_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_9" type="string" value="move_window_workspace_9_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;End" type="string" value="move_window_next_workspace_key"/>
+      <property name="&lt;Primary&gt;&lt;Shift&gt;&lt;Alt&gt;Left" type="string" value="move_window_left_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_4" type="string" value="move_window_workspace_4_key"/>
+      <property name="Right" type="string" value="right_key"/>
+      <property name="Down" type="string" value="down_key"/>
+      <property name="&lt;Shift&gt;&lt;Alt&gt;Page_Down" type="string" value="lower_window_key"/>
+      <property name="&lt;Alt&gt;Tab" type="string" value="cycle_windows_key"/>
+      <property name="&lt;Primary&gt;&lt;Shift&gt;&lt;Alt&gt;Right" type="string" value="move_window_right_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;Right" type="string" value="right_workspace_key"/>
+      <property name="&lt;Alt&gt;F6" type="string" value="stick_window_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_5" type="string" value="move_window_workspace_5_key"/>
+      <property name="&lt;Primary&gt;F11" type="string" value="workspace_11_key"/>
+      <property name="&lt;Alt&gt;F10" type="string" value="maximize_window_key"/>
+      <property name="&lt;Alt&gt;Delete" type="string" value="del_workspace_key"/>
+      <property name="&lt;Super&gt;Tab" type="string" value="switch_window_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;d" type="string" value="show_desktop_key"/>
+      <property name="&lt;Super&gt;KP_Page_Up" type="string" value="tile_up_right_key"/>
+      <property name="&lt;Alt&gt;F7" type="string" value="move_window_key"/>
+      <property name="Up" type="string" value="up_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_6" type="string" value="move_window_workspace_6_key"/>
+      <property name="&lt;Alt&gt;F11" type="string" value="fullscreen_key"/>
+      <property name="&lt;Alt&gt;space" type="string" value="popup_menu_key"/>
+      <property name="&lt;Super&gt;KP_Home" type="string" value="tile_up_left_key"/>
+      <property name="Escape" type="string" value="cancel_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_1" type="string" value="move_window_workspace_1_key"/>
+      <property name="&lt;Shift&gt;&lt;Alt&gt;Page_Up" type="string" value="raise_window_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;Home" type="string" value="move_window_prev_workspace_key"/>
+      <property name="&lt;Alt&gt;&lt;Shift&gt;Tab" type="string" value="cycle_reverse_windows_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;Left" type="string" value="left_workspace_key"/>
+      <property name="&lt;Alt&gt;F12" type="string" value="above_key"/>
+      <property name="&lt;Primary&gt;&lt;Shift&gt;&lt;Alt&gt;Up" type="string" value="move_window_up_key"/>
+      <property name="&lt;Alt&gt;F8" type="string" value="resize_window_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_7" type="string" value="move_window_workspace_7_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_2" type="string" value="move_window_workspace_2_key"/>
+      <property name="&lt;Super&gt;KP_End" type="string" value="tile_down_left_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;Up" type="string" value="up_workspace_key"/>
+      <property name="&lt;Alt&gt;F9" type="string" value="hide_window_key"/>
+      <property name="Left" type="string" value="left_key"/>
+      <property name="&lt;Primary&gt;&lt;Alt&gt;KP_8" type="string" value="move_window_workspace_8_key"/>
+      <property name="&lt;Alt&gt;Insert" type="string" value="add_workspace_key"/>
+      <property name="override" type="bool" value="true"/>
+      <property name="&lt;Super&gt;1" type="string" value="workspace_1_key"/>
+      <property name="&lt;Super&gt;2" type="string" value="workspace_2_key"/>
+      <property name="&lt;Super&gt;3" type="string" value="workspace_3_key"/>
+      <property name="&lt;Super&gt;4" type="string" value="workspace_4_key"/>
+      <property name="&lt;Super&gt;5" type="string" value="workspace_5_key"/>
+      <property name="&lt;Super&gt;6" type="string" value="workspace_6_key"/>
+      <property name="&lt;Super&gt;7" type="string" value="workspace_7_key"/>
+      <property name="&lt;Super&gt;8" type="string" value="workspace_8_key"/>
+      <property name="&lt;Super&gt;9" type="string" value="workspace_9_key"/>
+      <property name="&lt;Super&gt;0" type="string" value="workspace_10_key"/>
+      <property name="&lt;Super&gt;Left" type="string" value="tile_left_key"/>
+      <property name="&lt;Super&gt;Right" type="string" value="tile_right_key"/>
+      <property name="&lt;Super&gt;Up" type="string" value="tile_down_key"/>
+      <property name="&lt;Super&gt;Down" type="string" value="tile_up_key"/>
+      <property name="&lt;Super&gt;Page_Down" type="string" value="tile_down_right_key"/>
+    </property>
+  </property>
+  <property name="providers" type="array">
+    <value type="string" value="xfwm4"/>
+    <value type="string" value="commands"/>
+  </property>
+</channel>

dotfiles/config/xfce4/xfconf/xfce-perchannel-xml/xfwm4.xml

@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<channel name="xfwm4" version="1.0">
+  <property name="general" type="empty">
+    <property name="activate_action" type="string" value="switch"/>
+    <property name="borderless_maximize" type="bool" value="true"/>
+    <property name="box_move" type="bool" value="false"/>
+    <property name="box_resize" type="bool" value="false"/>
+    <property name="button_layout" type="string" value="O|SHMC"/>
+    <property name="button_offset" type="int" value="0"/>
+    <property name="button_spacing" type="int" value="0"/>
+    <property name="click_to_focus" type="bool" value="false"/>
+    <property name="cycle_apps_only" type="bool" value="false"/>
+    <property name="cycle_draw_frame" type="bool" value="true"/>
+    <property name="cycle_raise" type="bool" value="false"/>
+    <property name="cycle_hidden" type="bool" value="true"/>
+    <property name="cycle_minimum" type="bool" value="true"/>
+    <property name="cycle_minimized" type="bool" value="false"/>
+    <property name="cycle_preview" type="bool" value="true"/>
+    <property name="cycle_tabwin_mode" type="int" value="0"/>
+    <property name="cycle_workspaces" type="bool" value="false"/>
+    <property name="double_click_action" type="string" value="maximize"/>
+    <property name="double_click_distance" type="int" value="5"/>
+    <property name="double_click_time" type="int" value="250"/>
+    <property name="easy_click" type="string" value="Alt"/>
+    <property name="focus_delay" type="int" value="316"/>
+    <property name="focus_hint" type="bool" value="true"/>
+    <property name="focus_new" type="bool" value="true"/>
+    <property name="frame_opacity" type="int" value="100"/>
+    <property name="frame_border_top" type="int" value="0"/>
+    <property name="full_width_title" type="bool" value="true"/>
+    <property name="horiz_scroll_opacity" type="bool" value="false"/>
+    <property name="inactive_opacity" type="int" value="100"/>
+    <property name="maximized_offset" type="int" value="0"/>
+    <property name="mousewheel_rollup" type="bool" value="true"/>
+    <property name="move_opacity" type="int" value="100"/>
+    <property name="placement_mode" type="string" value="center"/>
+    <property name="placement_ratio" type="int" value="20"/>
+    <property name="popup_opacity" type="int" value="100"/>
+    <property name="prevent_focus_stealing" type="bool" value="false"/>
+    <property name="raise_delay" type="int" value="250"/>
+    <property name="raise_on_click" type="bool" value="true"/>
+    <property name="raise_on_focus" type="bool" value="false"/>
+    <property name="raise_with_any_button" type="bool" value="true"/>
+    <property name="repeat_urgent_blink" type="bool" value="false"/>
+    <property name="resize_opacity" type="int" value="100"/>
+    <property name="scroll_workspaces" type="bool" value="true"/>
+    <property name="shadow_delta_height" type="int" value="0"/>
+    <property name="shadow_delta_width" type="int" value="0"/>
+    <property name="shadow_delta_x" type="int" value="0"/>
+    <property name="shadow_delta_y" type="int" value="-3"/>
+    <property name="shadow_opacity" type="int" value="50"/>
+    <property name="show_app_icon" type="bool" value="false"/>
+    <property name="show_dock_shadow" type="bool" value="true"/>
+    <property name="show_frame_shadow" type="bool" value="true"/>
+    <property name="show_popup_shadow" type="bool" value="false"/>
+    <property name="snap_resist" type="bool" value="false"/>
+    <property name="snap_to_border" type="bool" value="true"/>
+    <property name="snap_to_windows" type="bool" value="false"/>
+    <property name="snap_width" type="int" value="10"/>
+    <property name="vblank_mode" type="string" value="auto"/>
+    <property name="theme" type="string" value="Default"/>
+    <property name="tile_on_move" type="bool" value="true"/>
+    <property name="title_alignment" type="string" value="center"/>
+    <property name="title_font" type="string" value="Sans Bold 9"/>
+    <property name="title_horizontal_offset" type="int" value="0"/>
+    <property name="titleless_maximize" type="bool" value="false"/>
+    <property name="title_shadow_active" type="string" value="false"/>
+    <property name="title_shadow_inactive" type="string" value="false"/>
+    <property name="title_vertical_offset_active" type="int" value="0"/>
+    <property name="title_vertical_offset_inactive" type="int" value="0"/>
+    <property name="toggle_workspaces" type="bool" value="false"/>
+    <property name="unredirect_overlays" type="bool" value="true"/>
+    <property name="urgent_blink" type="bool" value="false"/>
+    <property name="use_compositing" type="bool" value="true"/>
+    <property name="workspace_count" type="int" value="6"/>
+    <property name="wrap_cycle" type="bool" value="true"/>
+    <property name="wrap_layout" type="bool" value="true"/>
+    <property name="wrap_resistance" type="int" value="10"/>
+    <property name="wrap_windows" type="bool" value="false"/>
+    <property name="wrap_workspaces" type="bool" value="false"/>
+    <property name="zoom_desktop" type="bool" value="true"/>
+    <property name="zoom_pointer" type="bool" value="true"/>
+    <property name="workspace_names" type="array">
+      <value type="string" value="Workspace 1"/>
+      <value type="string" value="Workspace 2"/>
+      <value type="string" value="Workspace 3"/>
+      <value type="string" value="Workspace 4"/>
+      <value type="string" value="Workspace 5"/>
+      <value type="string" value="Workspace 6"/>
+    </property>
+  </property>
+</channel>

dotfiles/config/ycm_extra_conf.py

@@ -0,0 +1,6 @@
+def Settings( **kwargs ):
+  client_data = kwargs[ 'client_data' ]
+  return {
+    'interpreter_path': client_data[ 'g:ycm_python_interpreter_path' ] or '/usr/bin/python3',
+    'sys_path': client_data[ 'g:ycm_python_sys_path' ]
+  }

dotfiles/curlrc

@@ -1,4 +1,3 @@
 tlsv1
-user-agent = "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0 Safari/537.36"
 create-dirs
 referer = ";auto"

dotfiles/dircolors

@@ -0,0 +1,480 @@
+# Exact Solarized Dark color theme for the color GNU ls utility.
+# Designed for dircolors (GNU coreutils) 5.97
+#
+# This simple theme was simultaneously designed for these terminal color schemes:
+# - Solarized dark  (best)
+# - Solarized light
+# - default dark
+# - default light
+# with a slight optimization for Solarized Dark.
+#
+# How the colors were selected:
+# - Terminal emulators often have an option typically enabled by default that makes
+#   bold a different color.  It is important to leave this option enabled so that
+#   you can access the entire 16-color Solarized palette, and not just 8 colors.
+# - We favor universality over a greater number of colors.  So we limit the number
+#   of colors so that this theme will work out of the box in all terminals,
+#   Solarized or not, dark or light.
+# - We choose to have the following category of files:
+#   NORMAL & FILE, DIR, LINK, EXEC and
+#   editable text including source, unimportant text, binary docs & multimedia source
+#   files, viewable multimedia, archived/compressed, and unimportant non-text
+# - For uniqueness, we stay away from the Solarized foreground colors are -- either
+#   base00 (brightyellow) or base0 (brightblue).  However, they can be used if
+#   you know what the bg/fg colors of your terminal are, in order to optimize the display.
+# - 3 different options are provided: universal, solarized dark, and solarized light.
+#   The only difference between the universal scheme and one that's optimized for
+#   dark/light is the color of "unimportant" files, which should blend more with the
+#   background
+# - We note that blue is the hardest color to see on dark bg and yellow is the hardest
+#   color to see on light bg (with blue being particularly bad).  So we choose yellow
+#   for multimedia files which are usually accessed in a GUI folder browser anyway.
+#   And blue is kept for custom use of this scheme's user.
+# - See table below to see the assignments.
+
+
+# Installation instructions:
+# This file goes in the /etc directory, and must be world readable.
+# You can copy this file to .dir_colors in your $HOME directory to override
+# the system defaults.
+
+# COLOR needs one of these arguments: 'tty' colorizes output to ttys, but not
+# pipes. 'all' adds color characters to all output. 'none' shuts colorization
+# off.
+COLOR tty
+
+# Below, there should be one TERM entry for each termtype that is colorizable
+TERM ansi
+TERM color_xterm
+TERM color-xterm
+TERM con132x25
+TERM con132x30
+TERM con132x43
+TERM con132x60
+TERM con80x25
+TERM con80x28
+TERM con80x30
+TERM con80x43
+TERM con80x50
+TERM con80x60
+TERM cons25
+TERM console
+TERM cygwin
+TERM dtterm
+TERM dvtm
+TERM dvtm-256color
+TERM Eterm
+TERM eterm-color
+TERM fbterm
+TERM gnome
+TERM gnome-256color
+TERM jfbterm
+TERM konsole
+TERM konsole-256color
+TERM kterm
+TERM linux
+TERM linux-c
+TERM mach-color
+TERM mlterm
+TERM nxterm
+TERM putty
+TERM putty-256color
+TERM rxvt
+TERM rxvt-256color
+TERM rxvt-cygwin
+TERM rxvt-cygwin-native
+TERM rxvt-unicode
+TERM rxvt-unicode256
+TERM rxvt-unicode-256color
+TERM screen
+TERM screen-16color
+TERM screen-16color-bce
+TERM screen-16color-s
+TERM screen-16color-bce-s
+TERM screen-256color
+TERM screen-256color-bce
+TERM screen-256color-s
+TERM screen-256color-bce-s
+TERM screen-256color-italic
+TERM screen-bce
+TERM screen-w
+TERM screen.linux
+TERM screen.xterm-256color
+TERM screen.xterm-new
+TERM st
+TERM st-meta
+TERM st-256color
+TERM st-meta-256color
+TERM tmux
+TERM tmux-256color
+TERM vt100
+TERM xterm
+TERM xterm-new
+TERM xterm-16color
+TERM xterm-256color
+TERM xterm-256color-italic
+TERM xterm-88color
+TERM xterm-color
+TERM xterm-debian
+TERM xterm-termite
+
+# EIGHTBIT, followed by '1' for on, '0' for off. (8-bit output)
+EIGHTBIT 1
+
+#############################################################################
+# Below are the color init strings for the basic file types. A color init
+# string consists of one or more of the following numeric codes:
+#
+# Attribute codes:
+#   00=none 01=bold 04=underscore 05=blink 07=reverse 08=concealed
+# Text color codes:
+#   30=black 31=red 32=green 33=yellow 34=blue 35=magenta 36=cyan 37=white
+# Background color codes:
+#   40=black 41=red 42=green 43=yellow 44=blue 45=magenta 46=cyan 47=white
+#
+# NOTES:
+# - See http://www.oreilly.com/catalog/wdnut/excerpt/color_names.html
+# - Color combinations
+#   ANSI Color code       Solarized  Notes                Universal             SolDark              SolLight
+#   ~~~~~~~~~~~~~~~       ~~~~~~~~~  ~~~~~                ~~~~~~~~~             ~~~~~~~              ~~~~~~~~
+#   00    none                                            NORMAL, FILE          <SAME>               <SAME>
+#   30    black           base02
+#   01;30 bright black    base03     bg of SolDark
+#   31    red             red                             docs & mm src         <SAME>               <SAME>
+#   01;31 bright red      orange                          EXEC                  <SAME>               <SAME>
+#   32    green           green                           editable text         <SAME>               <SAME>
+#   01;32 bright green    base01                          unimportant text      <SAME>
+#   33    yellow          yellow     unclear in light bg  multimedia            <SAME>               <SAME>
+#   01;33 bright yellow   base00     fg of SolLight                             unimportant non-text
+#   34    blue            blue       unclear in dark bg   user customized       <SAME>               <SAME>
+#   01;34 bright blue     base0      fg in SolDark                                                   unimportant text
+#   35    magenta         magenta                         LINK                  <SAME>               <SAME>
+#   01;35 bright magenta  violet                          archive/compressed    <SAME>               <SAME>
+#   36    cyan            cyan                            DIR                   <SAME>               <SAME>
+#   01;36 bright cyan     base1                           unimportant non-text                       <SAME>
+#   37    white           base2
+#   01;37 bright white    base3      bg in SolLight
+#   05;37;41                         unclear in Putty dark
+
+
+### By file type
+
+# global default
+NORMAL 00
+# normal file
+FILE 00
+# directory
+DIR 34
+# 777 directory
+OTHER_WRITABLE 34;40
+# symbolic link
+LINK 35
+
+# pipe, socket, block device, character device (blue bg)
+FIFO 30;44
+SOCK 35;44
+DOOR 35;44 # Solaris 2.5 and later
+BLK  33;44
+CHR  37;44
+
+
+#############################################################################
+### By file attributes
+
+# Orphaned symlinks (blinking white on red)
+# Blink may or may not work (works on iTerm dark or light, and Putty dark)
+ORPHAN  05;37;41
+# ... and the files that orphaned symlinks point to (blinking white on red)
+MISSING 05;37;41
+
+# files with execute permission
+EXEC 01;31  # Unix
+.cmd 01;31  # Win
+.exe 01;31  # Win
+.com 01;31  # Win
+.bat 01;31  # Win
+.reg 01;31  # Win
+.app 01;31  # OSX
+
+#############################################################################
+### By extension
+
+# List any file extensions like '.gz' or '.tar' that you would like ls
+# to colorize below. Put the extension, a space, and the color init string.
+# (and any comments you want to add after a '#')
+
+### Text formats
+
+# Text that we can edit with a regular editor
+.txt 32
+.org 32
+.md 32
+.mkd 32
+
+# Source text
+.h 32
+.hpp 32
+.c 32
+.C 32
+.cc 32
+.cpp 32
+.cxx 32
+.objc 32
+.cl 32
+.sh 32
+.bash 32
+.csh 32
+.zsh 32
+.el 32
+.vim 32
+.java 32
+.pl 32
+.pm 32
+.py 32
+.rb 32
+.hs 32
+.php 32
+.htm 32
+.html 32
+.shtml 32
+.erb 32
+.haml 32
+.xml 32
+.rdf 32
+.css 32
+.sass 32
+.scss 32
+.less 32
+.js 32
+.coffee 32
+.man 32
+.0 32
+.1 32
+.2 32
+.3 32
+.4 32
+.5 32
+.6 32
+.7 32
+.8 32
+.9 32
+.l 32
+.n 32
+.p 32
+.pod 32
+.tex 32
+.go 32
+.sql 32
+.csv 32
+.sv 32
+.svh 32
+.v 32
+.vh 32
+.vhd 32
+
+### Multimedia formats
+
+# Image
+.bmp 33
+.cgm 33
+.dl 33
+.dvi 33
+.emf 33
+.eps 33
+.gif 33
+.jpeg 33
+.jpg 33
+.JPG 33
+.mng 33
+.pbm 33
+.pcx 33
+.pdf 33
+.pgm 33
+.png 33
+.PNG 33
+.ppm 33
+.pps 33
+.ppsx 33
+.ps 33
+.svg 33
+.svgz 33
+.tga 33
+.tif 33
+.tiff 33
+.xbm 33
+.xcf 33
+.xpm 33
+.xwd 33
+.xwd 33
+.yuv 33
+
+# Audio
+.aac 33
+.au  33
+.flac 33
+.m4a 33
+.mid 33
+.midi 33
+.mka 33
+.mp3 33
+.mpa 33
+.mpeg 33
+.mpg 33
+.ogg  33
+.opus 33
+.ra 33
+.wav 33
+
+# Video
+.anx 33
+.asf 33
+.avi 33
+.axv 33
+.flc 33
+.fli 33
+.flv 33
+.gl 33
+.m2v 33
+.m4v 33
+.mkv 33
+.mov 33
+.MOV 33
+.mp4 33
+.mp4v 33
+.mpeg 33
+.mpg 33
+.nuv 33
+.ogm 33
+.ogv 33
+.ogx 33
+.qt 33
+.rm 33
+.rmvb 33
+.swf 33
+.vob 33
+.webm 33
+.wmv 33
+
+### Misc
+
+# Binary document formats and multimedia source
+.doc 31
+.docx 31
+.rtf 31
+.odt 31
+.dot 31
+.dotx 31
+.ott 31
+.xls 31
+.xlsx 31
+.ods 31
+.ots 31
+.ppt 31
+.pptx 31
+.odp 31
+.otp 31
+.fla 31
+.psd 31
+
+# Archives, compressed
+.7z   1;35
+.apk  1;35
+.arj  1;35
+.bin  1;35
+.bz   1;35
+.bz2  1;35
+.cab  1;35  # Win
+.deb  1;35
+.dmg  1;35  # OSX
+.gem  1;35
+.gz   1;35
+.iso  1;35
+.jar  1;35
+.msi  1;35  # Win
+.rar  1;35
+.rpm  1;35
+.tar  1;35
+.tbz  1;35
+.tbz2 1;35
+.tgz  1;35
+.tx   1;35
+.war  1;35
+.xpi  1;35
+.xz   1;35
+.z    1;35
+.Z    1;35
+.zip  1;35
+
+# For testing
+.ANSI-30-black 30
+.ANSI-01;30-brblack 01;30
+.ANSI-31-red 31
+.ANSI-01;31-brred 01;31
+.ANSI-32-green 32
+.ANSI-01;32-brgreen 01;32
+.ANSI-33-yellow 33
+.ANSI-01;33-bryellow 01;33
+.ANSI-34-blue 34
+.ANSI-01;34-brblue 01;34
+.ANSI-35-magenta 35
+.ANSI-01;35-brmagenta 01;35
+.ANSI-36-cyan 36
+.ANSI-01;36-brcyan 01;36
+.ANSI-37-white 37
+.ANSI-01;37-brwhite 01;37
+
+#############################################################################
+# Your customizations
+
+# Unimportant text files
+# For universal scheme, use brightgreen 01;32
+# For optimal on light bg (but too prominent on dark bg), use white 01;34
+.log 01;32
+*~ 01;32
+*# 01;32
+#.log 01;34
+#*~ 01;34
+#*# 01;34
+
+# Unimportant non-text files
+# For universal scheme, use brightcyan 01;36
+# For optimal on dark bg (but too prominent on light bg), change to 01;33
+#.bak 01;36
+#.BAK 01;36
+#.old 01;36
+#.OLD 01;36
+#.org_archive 01;36
+#.off 01;36
+#.OFF 01;36
+#.dist 01;36
+#.DIST 01;36
+#.orig 01;36
+#.ORIG 01;36
+#.swp 01;36
+#.swo 01;36
+#*,v 01;36
+.bak 01;33
+.BAK 01;33
+.old 01;33
+.OLD 01;33
+.org_archive 01;33
+.off 01;33
+.OFF 01;33
+.dist 01;33
+.DIST 01;33
+.orig 01;33
+.ORIG 01;33
+.swp 01;33
+.swo 01;33
+*,v 01;33
+
+# The brightmagenta (Solarized: purple) color is free for you to use for your
+# custom file type
+.gpg 34
+.gpg 34
+.pgp 34
+.asc 34
+.3des 34
+.aes 34
+.enc 34
+.sqlite 34

dotfiles/gdbinit

@@ -1,5 +1,6 @@
 # General options
 set verbose off
+set confirm off
 set disassembly-flavor intel
 set output-radix 0x10
 set input-radix 10.
@@ -21,62 +22,22 @@ define reg
   info registers
 end
 
-# __________________gdb options_________________
+# Fancy sourcing of modules
+python
+import sys
+import os.path
+gef = os.path.expanduser('~/tools/gef/gef.py')
+pwndbg = os.path.expanduser('~/tools/pwndbg/gdbinit.py')
+peda = os.path.expanduser('~/.peda/peda.py')
+if os.path.isfile(gef):
+  gdb.execute('source {}'.format(gef))
+elif os.path.isfile(pwndbg):
+  sys.path.insert(0, os.path.expanduser('~/tools/pwndbg/vendor'))
+  gdb.execute('source {}'.format(pwndbg))
+elif os.path.isfile(peda):
+  gdb.execute('source {}'.format(peda))
 
-# set to 1 to have ARM target debugging as default, use the "arm" command to switch inside gdb
-set $ARM = 0
-# set to 0 if you have problems with the colorized prompt - reported by Plouj with Ubuntu gdb 7.2
-set $COLOUREDPROMPT = 0
-# Colour the first line of the disassembly - default is green, if you want to change it search for
-# SETCOLOUR1STLINE and modify it :-)
-set $SETCOLOUR1STLINE = 0
-# set to 0 to remove display of objectivec messages (default is 1)
-set $SHOWOBJECTIVEC = 1
-# set to 0 to remove display of cpu registers (default is 1)
-set $SHOWCPUREGISTERS = 1
-# set to 1 to enable display of stack (default is 0)
-set $SHOWSTACK = 1
-# set to 1 to show 4 bytes of the stack at a time for 32bit and 8 bytes for 64bit
-set $STACK_WORDSIZE = 1
-# set to 1 to enable display of data window (default is 0)
-set $SHOWDATAWIN = 0
-# set to 0 to disable coloured display of changed registers
-set $SHOWREGCHANGES = 1
-# set to 1 so skip command to execute the instruction at the new location
-# by default it EIP/RIP will be modified and update the new context but not execute the instruction
-set $SKIPEXECUTE = 0
-# if $SKIPEXECUTE is 1 configure the type of execution
-# 1 = use stepo (do not get into calls), 0 = use stepi (step into calls)
-set $SKIPSTEP = 1
-# show the ARM opcodes - change to 0 if you don't want such thing (in x/i command)
-set $ARMOPCODES = 1
-# x86 disassembly flavor: 0 for Intel, 1 for AT&T
-set $X86FLAVOR = 0
-# use colorized output or not
-set $USECOLOR = 0
-# 64 bit options
-set $64BITS = 0
-# Remote 64 bit debugging
-set $KDP64BITS = -1
-
-set confirm off
-set verbose off
-
-set output-radix 0x10
-set input-radix 0x10
-
-# These make gdb never pause in its output
-set height 0
-set width 0
-
-set $SHOW_CONTEXT = 1
-set $SHOW_NEST_INSN = 0
-
-set $CONTEXTSIZE_STACK = 6
-set $CONTEXTSIZE_DATA  = 8
-set $CONTEXTSIZE_CODE  = 8
-
-# __________________end gdb options_________________
-#
-
-source ~/.reverser-gdbinit
+local_init = os.path.expanduser('~/.gdbinit.local')
+if os.path.isfile(local_init):
+  gdb.execute('source {}'.format(local_init))
+end

dotfiles/gef.rc

@@ -0,0 +1,125 @@
+[context]
+clear_screen = False
+enable = True
+grow_stack_down = False
+ignore_registers = 
+layout = legend regs stack code args source memory threads trace extra
+nb_lines_backtrace = 10
+nb_lines_code = 6
+nb_lines_code_prev = 3
+nb_lines_stack = 8
+nb_lines_threads = -1
+peek_calls = True
+peek_ret = True
+redirect = 
+show_registers_raw = False
+show_stack_raw = False
+
+[dereference]
+max_recursion = 7
+
+[entry-break]
+entrypoint_symbols = main _main __libc_start_main __uClibc_main start _start
+
+[gef-remote]
+clean_on_exit = False
+
+[gef]
+autosave_breakpoints_file = 
+debug = False
+disable_color = False
+extra_plugins_dir = 
+follow_child = True
+readline_compat = False
+
+[got]
+function_not_resolved = yellow
+function_resolved = green
+
+[heap-analysis-helper]
+check_double_free = True
+check_free_null = False
+check_heap_overlap = True
+check_uaf = True
+check_weird_free = True
+
+[heap-chunks]
+peek_nb_byte = 16
+
+[hexdump]
+always_show_ascii = False
+
+[highlight]
+regex = False
+
+[ida-interact]
+host = 127.0.0.1
+port = 1337
+sync_cursor = False
+
+[pattern]
+length = 1024
+
+[pcustom]
+struct_path = /tmp/gef/structs
+
+[process-search]
+ps_command = /bin/ps auxww
+
+[syscall-args]
+path = /tmp/gef/syscall-tables
+
+[theme]
+address_code = red
+address_heap = green
+address_stack = pink
+context_title_line = gray
+context_title_message = cyan
+default_title_line = gray
+default_title_message = cyan
+dereference_base_address = cyan
+dereference_code = gray
+dereference_register_value = bold blue
+dereference_string = yellow
+disassemble_current_instruction = green
+registers_register_name = blue
+registers_value_changed = bold red
+source_current_line = green
+table_heading = blue
+
+[trace-run]
+max_tracing_recursion = 1
+tracefile_prefix = ./gef-trace-
+
+[aliases]
+pf = print-format
+status = process-status
+binaryninja-interact = ida-interact
+bn = ida-interact
+binja = ida-interact
+lookup = scan
+grep = search-pattern
+xref = search-pattern
+flags = edit-flags
+sc-search = shellcode search
+sc-get = shellcode get
+ps = process-search
+start = entry-break
+nb = name-break
+ctx = context
+telescope = dereference
+pattern offset = pattern search
+hl = highlight
+highlight ls = highlight list
+hll = highlight list
+hlc = highlight clear
+highlight set = highlight add
+hla = highlight add
+highlight delete = highlight remove
+highlight del = highlight remove
+highlight unset = highlight remove
+highlight rm = highlight remove
+hlr = highlight remove
+fmtstr-helper = format-string-helper
+screen-setup = tmux-setup
+

dotfiles/gemini/settings.json

@@ -0,0 +1,22 @@
+{
+  "security": {
+    "auth": {
+      "selectedType": "oauth-personal"
+    }
+  },
+  "context": {
+    "fileName": [
+      "AGENTS.md",
+      "GEMINI.md"
+    ]
+  },
+  "selectedAuthType": "gemini-api-key",
+  "general": {
+    "vimMode": true,
+    "sessionRetention": {
+      "enabled": true,
+      "maxAge": "30d",
+      "warningAcknowledged": true
+    }
+  }
+}

dotfiles/gitconfig

@@ -1,15 +1,99 @@
 [user]
   name = David Tomaschik
-  email = david@systemoverlord.com
-[push]
-  default = current
+  useConfigOnly = true
+
 [core]
   excludesfile = ~/.gitignore
+  editor = vim
+  whitespace = trailing-space,space-before-tab
+  pager = command -v delta >/dev/null 2>&1 && delta || less -eFiJM~ -j3
+
+[color]
+  diff = auto
+  status = auto
+
+[diff]
+  tool = vimdiff
+  colorMoved = default
+
+[difftool]
+  prompt = false
+
+[alias]
+  st = status
+  last = log -1 HEAD
+  # Thanks to
+  # http://durdn.com/blog/2012/11/22/must-have-git-aliases-advanced-examples/
+  logs = log --pretty=format:"%C(yellow)%h%Cred%d\\ %Creset%s%Cblue\\ [%cn]" --decorate
+  lg = log -p
+  ll = log --pretty=format:"%C(yellow)%h%Cred%d\\ %Creset%s%Cblue\\ [%cn]" --decorate --numstat
+  files = ls-files
+  ls = ls-files
+  lol = log --graph --pretty=format:'%C(yellow)%h%Creset %an: %s - %Creset %C(yellow)%d%Creset %Cblue(%cr)%Creset' --abbrev-commit --date=relative
+  f = "!git ls-files | grep -i"
+  logtree = log --graph --oneline --decorate --all
+
+[push]
+  default = current
+
 [web]
   browser = chrome
+
 [github]
   user = matir
+
+# Site specific config
 [url "https://github.com/"]
-  insteadOf = github://
+  insteadOf = "github:"
+  insteadOf = "github://"
+
 [url "ssh://git@github.com/"]
-  pushInsteadOf = github://
+  pushInsteadOf = "github:"
+  pushInsteadOf = "github://"
+  pushInsteadOf = "https://github.com/"
+
+[url "git://gist.github.com/"]
+  insteadOf = "gist:"
+
+[url "git@gist.github.com:"]
+  pushInsteadOf = "gist:"
+  pushInsteadOf = "git://gist.github.com/"
+
+[credential]
+  helper = cache --timeout=36000
+
+[receive]
+  denyCurrentBranch = updateInstead
+
+[merge]
+  tool = vimdiff
+  conflictstyle = diff3
+
+[mergetool]
+  prompt = false
+
+[pull]
+  rebase = false
+
+[init]
+  defaultBranch = main
+
+[interactive]
+  diffFilter = command -v delta >/dev/null 2>&1 && delta || cat
+
+[delta]
+  navigate = true
+  line-numbers = true
+
+[filter "lfs"]
+  required = true
+  clean = git-lfs clean -- %f
+  smudge = git-lfs smudge -- %f
+  process = git-lfs filter-process
+
+[include]
+  path = ~/.gitconfig.d/override
+  path = ~/.gitconfig.d/local
+
+[includeIf "gitdir:~/personal/"]
+  path = ~/.gitconfig.d/personal

dotfiles/gitconfig.d/override

@@ -0,0 +1,5 @@
+[user]
+  email = david@systemoverlord.com
+
+[github]
+  user = matir

dotfiles/gitconfig.d/personal

@@ -0,0 +1,2 @@
+[user]
+  email = david@systemoverlord.com

dotfiles/gitignore

@@ -1,3 +1,4 @@
+# Common trash (metadata, backup files, etc.)
 .DS_Store
 .DS_Store?
 ._*
@@ -8,3 +9,32 @@ Thumbs.db
 *.swp
 *~
 *.bak
+
+# Object files
+*.py[co]
+*.[oa]
+
+# Try to avoid accidentally checking in private keys
+id_rsa
+id_ecdsa
+id_ed25519
+
+# Kicad backup files
+*.kicad_pcb-bak
+
+# Mypy cache path
+.mypy_cache
+
+# These files should basically never be committed
+.env
+
+# Mise local
+mise.local.toml
+
+# AI Tool Configs
+.aider/
+.claude/
+.continue/
+.copilot/
+.cursor/
+.gemini/

dotfiles/gnupg/dirmngr.conf

@@ -0,0 +1 @@
+keyserver hkps://keys.openpgp.org

dotfiles/gnupg/gpg-agent.conf

@@ -1,5 +1,3 @@
-enable-ssh-support
-use-standard-socket
 default-cache-ttl 7200
 default-cache-ttl-ssh 7200
 max-cache-ttl 86400

dotfiles/gnupg/gpg.conf

@@ -1,10 +1,10 @@
 use-agent
 # HKPS requires gnupg-curl for gpg1
-keyserver hkps://hkps.pool.sks-keyservers.net
-# Unfortunately, the path must be fully-qualified
-keyserver-options auto-key-retrieve ca-cert-file=/home/david/.gnupg/sks-keyservers.pem
+keyserver hkps://keyserver.ubuntu.com
+keyserver-options auto-key-retrieve no-honor-keyserver-url
 auto-key-locate keyserver
 personal-digest-preferences SHA256
 cert-digest-algo SHA256
 default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
 cipher-algo AES256
+default-key 7FD58D9A196DCEEEAD671F94F4D7A7915DEA789B

dotfiles/inputrc

@@ -0,0 +1,4 @@
+set editing-mode vi
+
+set keymap vi
+set convert-meta on

dotfiles/ipython.py

@@ -0,0 +1,10 @@
+try:
+    import os, IPython
+    from traitlets import config
+    os.environ['PYTHONSTARTUP'] = ''  # Prevent running this again
+    cfg = config.Config()
+    cfg.TerminalIPythonApp.display_banner = False
+    IPython.start_ipython(config=cfg)
+    raise SystemExit
+except ImportError:
+    pass

dotfiles/ipython/profile_default/ipython_config.py

@@ -0,0 +1,611 @@
+# Configuration file for ipython.
+
+#------------------------------------------------------------------------------
+# InteractiveShellApp(Configurable) configuration
+#------------------------------------------------------------------------------
+
+## A Mixin for applications that start InteractiveShell instances.
+#  
+#  Provides configurables for loading extensions and executing files as part of
+#  configuring a Shell environment.
+#  
+#  The following methods should be called by the :meth:`initialize` method of the
+#  subclass:
+#  
+#    - :meth:`init_path`
+#    - :meth:`init_shell` (to be implemented by the subclass)
+#    - :meth:`init_gui_pylab`
+#    - :meth:`init_extensions`
+#    - :meth:`init_code`
+
+## Execute the given command string.
+#c.InteractiveShellApp.code_to_run = ''
+
+## Run the file referenced by the PYTHONSTARTUP environment variable at IPython
+#  startup.
+c.InteractiveShellApp.exec_PYTHONSTARTUP = False
+
+## List of files to run at IPython startup.
+#c.InteractiveShellApp.exec_files = []
+
+## lines of code to run at IPython startup.
+#c.InteractiveShellApp.exec_lines = []
+
+## A list of dotted module names of IPython extensions to load.
+#c.InteractiveShellApp.extensions = []
+
+## dotted module name of an IPython extension to load.
+#c.InteractiveShellApp.extra_extension = ''
+
+## A file to be run
+#c.InteractiveShellApp.file_to_run = ''
+
+## Enable GUI event loop integration with any of ('glut', 'gtk', 'gtk2', 'gtk3',
+#  'osx', 'pyglet', 'qt', 'qt4', 'qt5', 'tk', 'wx', 'gtk2', 'qt4').
+#c.InteractiveShellApp.gui = None
+
+## Should variables loaded at startup (by startup files, exec_lines, etc.) be
+#  hidden from tools like %who?
+#c.InteractiveShellApp.hide_initial_ns = True
+
+## Configure matplotlib for interactive use with the default matplotlib backend.
+#c.InteractiveShellApp.matplotlib = None
+
+## Run the module as a script.
+#c.InteractiveShellApp.module_to_run = ''
+
+## Pre-load matplotlib and numpy for interactive use, selecting a particular
+#  matplotlib backend and loop integration.
+#c.InteractiveShellApp.pylab = None
+
+## If true, IPython will populate the user namespace with numpy, pylab, etc. and
+#  an ``import *`` is done from numpy and pylab, when using pylab mode.
+#  
+#  When False, pylab mode should not import any names into the user namespace.
+#c.InteractiveShellApp.pylab_import_all = True
+
+## Reraise exceptions encountered loading IPython extensions?
+#c.InteractiveShellApp.reraise_ipython_extension_failures = False
+
+#------------------------------------------------------------------------------
+# Application(SingletonConfigurable) configuration
+#------------------------------------------------------------------------------
+
+## This is an application.
+
+## The date format used by logging formatters for %(asctime)s
+#c.Application.log_datefmt = '%Y-%m-%d %H:%M:%S'
+
+## The Logging format template
+#c.Application.log_format = '[%(name)s]%(highlevel)s %(message)s'
+
+## Set the log level by value or name.
+#c.Application.log_level = 30
+
+#------------------------------------------------------------------------------
+# BaseIPythonApplication(Application) configuration
+#------------------------------------------------------------------------------
+
+## IPython: an enhanced interactive Python shell.
+
+## Whether to create profile dir if it doesn't exist
+#c.BaseIPythonApplication.auto_create = False
+
+## Whether to install the default config files into the profile dir. If a new
+#  profile is being created, and IPython contains config files for that profile,
+#  then they will be staged into the new directory.  Otherwise, default config
+#  files will be automatically generated.
+#c.BaseIPythonApplication.copy_config_files = False
+
+## Path to an extra config file to load.
+#  
+#  If specified, load this config file in addition to any other IPython config.
+#c.BaseIPythonApplication.extra_config_file = ''
+
+## The name of the IPython directory. This directory is used for logging
+#  configuration (through profiles), history storage, etc. The default is usually
+#  $HOME/.ipython. This option can also be specified through the environment
+#  variable IPYTHONDIR.
+#c.BaseIPythonApplication.ipython_dir = ''
+
+## Whether to overwrite existing config files when copying
+#c.BaseIPythonApplication.overwrite = False
+
+## The IPython profile to use.
+#c.BaseIPythonApplication.profile = 'default'
+
+## Create a massive crash report when IPython encounters what may be an internal
+#  error.  The default is to append a short message to the usual traceback
+#c.BaseIPythonApplication.verbose_crash = False
+
+#------------------------------------------------------------------------------
+# TerminalIPythonApp(BaseIPythonApplication,InteractiveShellApp) configuration
+#------------------------------------------------------------------------------
+
+## Whether to display a banner upon starting IPython.
+#c.TerminalIPythonApp.display_banner = True
+
+## If a command or file is given via the command-line, e.g. 'ipython foo.py',
+#  start an interactive shell after executing the file or command.
+#c.TerminalIPythonApp.force_interact = False
+
+## Class to use to instantiate the TerminalInteractiveShell object. Useful for
+#  custom Frontends
+#c.TerminalIPythonApp.interactive_shell_class = 'IPython.terminal.interactiveshell.TerminalInteractiveShell'
+
+## Start IPython quickly by skipping the loading of config files.
+#c.TerminalIPythonApp.quick = False
+
+#------------------------------------------------------------------------------
+# InteractiveShell(SingletonConfigurable) configuration
+#------------------------------------------------------------------------------
+
+## An enhanced, interactive shell for Python.
+
+## 'all', 'last', 'last_expr' or 'none', 'last_expr_or_assign' specifying which
+#  nodes should be run interactively (displaying output from expressions).
+#c.InteractiveShell.ast_node_interactivity = 'last_expr'
+
+## A list of ast.NodeTransformer subclass instances, which will be applied to
+#  user input before code is run.
+#c.InteractiveShell.ast_transformers = []
+
+## Automatically run await statement in the top level repl.
+#c.InteractiveShell.autoawait = True
+
+## Make IPython automatically call any callable object even if you didn't type
+#  explicit parentheses. For example, 'str 43' becomes 'str(43)' automatically.
+#  The value can be '0' to disable the feature, '1' for 'smart' autocall, where
+#  it is not applied if there are no more arguments on the line, and '2' for
+#  'full' autocall, where all callable objects are automatically called (even if
+#  no arguments are present).
+#c.InteractiveShell.autocall = 0
+
+## Autoindent IPython code entered interactively.
+#c.InteractiveShell.autoindent = True
+
+## Enable magic commands to be called without the leading %.
+#c.InteractiveShell.automagic = True
+
+## The part of the banner to be printed before the profile
+#c.InteractiveShell.banner1 = "Python 3.7.3rc1 (default, Mar 13 2019, 11:01:15) \nType 'copyright', 'credits' or 'license' for more information\nIPython 7.5.0 -- An enhanced Interactive Python. Type '?' for help.\n"
+
+## The part of the banner to be printed after the profile
+#c.InteractiveShell.banner2 = ''
+
+## Set the size of the output cache.  The default is 1000, you can change it
+#  permanently in your config file.  Setting it to 0 completely disables the
+#  caching system, and the minimum value accepted is 3 (if you provide a value
+#  less than 3, it is reset to 0 and a warning is issued).  This limit is defined
+#  because otherwise you'll spend more time re-flushing a too small cache than
+#  working
+#c.InteractiveShell.cache_size = 1000
+
+## Use colors for displaying information about objects. Because this information
+#  is passed through a pager (like 'less'), and some pagers get confused with
+#  color codes, this capability can be turned off.
+#c.InteractiveShell.color_info = True
+
+## Set the color scheme (NoColor, Neutral, Linux, or LightBG).
+#c.InteractiveShell.colors = 'Neutral'
+
+## 
+#c.InteractiveShell.debug = False
+
+## Don't call post-execute functions that have failed in the past.
+#c.InteractiveShell.disable_failing_post_execute = False
+
+## If True, anything that would be passed to the pager will be displayed as
+#  regular output instead.
+#c.InteractiveShell.display_page = False
+
+## (Provisional API) enables html representation in mime bundles sent to pagers.
+#c.InteractiveShell.enable_html_pager = False
+
+## Total length of command history
+#c.InteractiveShell.history_length = 10000
+
+## The number of saved history entries to be loaded into the history buffer at
+#  startup.
+#c.InteractiveShell.history_load_length = 1000
+
+## 
+#c.InteractiveShell.ipython_dir = ''
+
+## Start logging to the given file in append mode. Use `logfile` to specify a log
+#  file to **overwrite** logs to.
+#c.InteractiveShell.logappend = ''
+
+## The name of the logfile to use.
+#c.InteractiveShell.logfile = ''
+
+## Start logging to the default log file in overwrite mode. Use `logappend` to
+#  specify a log file to **append** logs to.
+#c.InteractiveShell.logstart = False
+
+## Select the loop runner that will be used to execute top-level asynchronous
+#  code
+#c.InteractiveShell.loop_runner = 'IPython.core.interactiveshell._asyncio_runner'
+
+## 
+#c.InteractiveShell.object_info_string_level = 0
+
+## Automatically call the pdb debugger after every exception.
+#c.InteractiveShell.pdb = False
+
+## Deprecated since IPython 4.0 and ignored since 5.0, set
+#  TerminalInteractiveShell.prompts object directly.
+#c.InteractiveShell.prompt_in1 = 'In [\\#]: '
+
+## Deprecated since IPython 4.0 and ignored since 5.0, set
+#  TerminalInteractiveShell.prompts object directly.
+#c.InteractiveShell.prompt_in2 = '   .\\D.: '
+
+## Deprecated since IPython 4.0 and ignored since 5.0, set
+#  TerminalInteractiveShell.prompts object directly.
+#c.InteractiveShell.prompt_out = 'Out[\\#]: '
+
+## Deprecated since IPython 4.0 and ignored since 5.0, set
+#  TerminalInteractiveShell.prompts object directly.
+#c.InteractiveShell.prompts_pad_left = True
+
+## 
+#c.InteractiveShell.quiet = False
+
+## 
+#c.InteractiveShell.separate_in = '\n'
+
+## 
+#c.InteractiveShell.separate_out = ''
+
+## 
+#c.InteractiveShell.separate_out2 = ''
+
+## Show rewritten input, e.g. for autocall.
+#c.InteractiveShell.show_rewritten_input = True
+
+## Enables rich html representation of docstrings. (This requires the docrepr
+#  module).
+#c.InteractiveShell.sphinxify_docstring = False
+
+## 
+#c.InteractiveShell.wildcards_case_sensitive = True
+
+## Switch modes for the IPython exception handlers.
+#c.InteractiveShell.xmode = 'Context'
+
+#------------------------------------------------------------------------------
+# TerminalInteractiveShell(InteractiveShell) configuration
+#------------------------------------------------------------------------------
+
+## Set to confirm when you try to exit IPython with an EOF (Control-D in Unix,
+#  Control-Z/Enter in Windows). By typing 'exit' or 'quit', you can force a
+#  direct exit without any confirmation.
+#c.TerminalInteractiveShell.confirm_exit = True
+
+## Options for displaying tab completions, 'column', 'multicolumn', and
+#  'readlinelike'. These options are for `prompt_toolkit`, see `prompt_toolkit`
+#  documentation for more information.
+#c.TerminalInteractiveShell.display_completions = 'multicolumn'
+
+## Shortcut style to use at the prompt. 'vi' or 'emacs'.
+c.TerminalInteractiveShell.editing_mode = 'vi'
+
+## Set the editor used by IPython (default to $EDITOR/vi/notepad).
+#c.TerminalInteractiveShell.editor = 'vim'
+
+## Allows to enable/disable the prompt toolkit history search
+#c.TerminalInteractiveShell.enable_history_search = True
+
+## Enable vi (v) or Emacs (C-X C-E) shortcuts to open an external editor. This is
+#  in addition to the F2 binding, which is always enabled.
+#c.TerminalInteractiveShell.extra_open_editor_shortcuts = False
+
+## Provide an alternative handler to be called when the user presses Return. This
+#  is an advanced option intended for debugging, which may be changed or removed
+#  in later releases.
+#c.TerminalInteractiveShell.handle_return = None
+
+## Highlight matching brackets.
+#c.TerminalInteractiveShell.highlight_matching_brackets = True
+
+## The name or class of a Pygments style to use for syntax highlighting. To see
+#  available styles, run `pygmentize -L styles`.
+#c.TerminalInteractiveShell.highlighting_style = traitlets.Undefined
+
+## Override highlighting format for specific tokens
+#c.TerminalInteractiveShell.highlighting_style_overrides = {}
+
+## Enable mouse support in the prompt (Note: prevents selecting text with the
+#  mouse)
+#c.TerminalInteractiveShell.mouse_support = False
+
+## Display the current vi mode (when using vi editing mode).
+#c.TerminalInteractiveShell.prompt_includes_vi_mode = True
+
+## Class used to generate Prompt token for prompt_toolkit
+#c.TerminalInteractiveShell.prompts_class = 'IPython.terminal.prompts.Prompts'
+
+## Use `raw_input` for the REPL, without completion and prompt colors.
+#  
+#  Useful when controlling IPython as a subprocess, and piping STDIN/OUT/ERR.
+#  Known usage are: IPython own testing machinery, and emacs inferior-shell
+#  integration through elpy.
+#  
+#  This mode default to `True` if the `IPY_TEST_SIMPLE_PROMPT` environment
+#  variable is set, or the current terminal is not a tty.
+#c.TerminalInteractiveShell.simple_prompt = False
+
+## Number of line at the bottom of the screen to reserve for the completion menu
+#c.TerminalInteractiveShell.space_for_menu = 6
+
+## Automatically set the terminal title
+#c.TerminalInteractiveShell.term_title = True
+
+## Customize the terminal title format.  This is a python format string.
+#  Available substitutions are: {cwd}.
+#c.TerminalInteractiveShell.term_title_format = 'IPython: {cwd}'
+
+## Use 24bit colors instead of 256 colors in prompt highlighting. If your
+#  terminal supports true color, the following command should print 'TRUECOLOR'
+#  in orange: printf "\x1b[38;2;255;100;0mTRUECOLOR\x1b[0m\n"
+#c.TerminalInteractiveShell.true_color = False
+
+#------------------------------------------------------------------------------
+# HistoryAccessor(HistoryAccessorBase) configuration
+#------------------------------------------------------------------------------
+
+## Access the history database without adding to it.
+#  
+#  This is intended for use by standalone history tools. IPython shells use
+#  HistoryManager, below, which is a subclass of this.
+
+## Options for configuring the SQLite connection
+#  
+#  These options are passed as keyword args to sqlite3.connect when establishing
+#  database connections.
+#c.HistoryAccessor.connection_options = {}
+
+## enable the SQLite history
+#  
+#  set enabled=False to disable the SQLite history, in which case there will be
+#  no stored history, no SQLite connection, and no background saving thread.
+#  This may be necessary in some threaded environments where IPython is embedded.
+#c.HistoryAccessor.enabled = True
+
+## Path to file to use for SQLite history database.
+#  
+#  By default, IPython will put the history database in the IPython profile
+#  directory.  If you would rather share one history among profiles, you can set
+#  this value in each, so that they are consistent.
+#  
+#  Due to an issue with fcntl, SQLite is known to misbehave on some NFS mounts.
+#  If you see IPython hanging, try setting this to something on a local disk,
+#  e.g::
+#  
+#      ipython --HistoryManager.hist_file=/tmp/ipython_hist.sqlite
+#  
+#  you can also use the specific value `:memory:` (including the colon at both
+#  end but not the back ticks), to avoid creating an history file.
+#c.HistoryAccessor.hist_file = ''
+
+#------------------------------------------------------------------------------
+# HistoryManager(HistoryAccessor) configuration
+#------------------------------------------------------------------------------
+
+## A class to organize all history-related functionality in one place.
+
+## Write to database every x commands (higher values save disk access & power).
+#  Values of 1 or less effectively disable caching.
+#c.HistoryManager.db_cache_size = 0
+
+## Should the history database include output? (default: no)
+#c.HistoryManager.db_log_output = False
+
+#------------------------------------------------------------------------------
+# ProfileDir(LoggingConfigurable) configuration
+#------------------------------------------------------------------------------
+
+## An object to manage the profile directory and its resources.
+#  
+#  The profile directory is used by all IPython applications, to manage
+#  configuration, logging and security.
+#  
+#  This object knows how to find, create and manage these directories. This
+#  should be used by any code that wants to handle profiles.
+
+## Set the profile location directly. This overrides the logic used by the
+#  `profile` option.
+#c.ProfileDir.location = ''
+
+#------------------------------------------------------------------------------
+# BaseFormatter(Configurable) configuration
+#------------------------------------------------------------------------------
+
+## A base formatter class that is configurable.
+#  
+#  This formatter should usually be used as the base class of all formatters. It
+#  is a traited :class:`Configurable` class and includes an extensible API for
+#  users to determine how their objects are formatted. The following logic is
+#  used to find a function to format an given object.
+#  
+#  1. The object is introspected to see if it has a method with the name
+#     :attr:`print_method`. If is does, that object is passed to that method
+#     for formatting.
+#  2. If no print method is found, three internal dictionaries are consulted
+#     to find print method: :attr:`singleton_printers`, :attr:`type_printers`
+#     and :attr:`deferred_printers`.
+#  
+#  Users should use these dictionaries to register functions that will be used to
+#  compute the format data for their objects (if those objects don't have the
+#  special print methods). The easiest way of using these dictionaries is through
+#  the :meth:`for_type` and :meth:`for_type_by_name` methods.
+#  
+#  If no function/callable is found to compute the format data, ``None`` is
+#  returned and this format type is not used.
+
+## 
+#c.BaseFormatter.deferred_printers = {}
+
+## 
+#c.BaseFormatter.enabled = True
+
+## 
+#c.BaseFormatter.singleton_printers = {}
+
+## 
+#c.BaseFormatter.type_printers = {}
+
+#------------------------------------------------------------------------------
+# PlainTextFormatter(BaseFormatter) configuration
+#------------------------------------------------------------------------------
+
+## The default pretty-printer.
+#  
+#  This uses :mod:`IPython.lib.pretty` to compute the format data of the object.
+#  If the object cannot be pretty printed, :func:`repr` is used. See the
+#  documentation of :mod:`IPython.lib.pretty` for details on how to write pretty
+#  printers.  Here is a simple example::
+#  
+#      def dtype_pprinter(obj, p, cycle):
+#          if cycle:
+#              return p.text('dtype(...)')
+#          if hasattr(obj, 'fields'):
+#              if obj.fields is None:
+#                  p.text(repr(obj))
+#              else:
+#                  p.begin_group(7, 'dtype([')
+#                  for i, field in enumerate(obj.descr):
+#                      if i > 0:
+#                          p.text(',')
+#                          p.breakable()
+#                      p.pretty(field)
+#                  p.end_group(7, '])')
+
+## 
+#c.PlainTextFormatter.float_precision = ''
+
+## Truncate large collections (lists, dicts, tuples, sets) to this size.
+#  
+#  Set to 0 to disable truncation.
+#c.PlainTextFormatter.max_seq_length = 1000
+
+## 
+#c.PlainTextFormatter.max_width = 79
+
+## 
+#c.PlainTextFormatter.newline = '\n'
+
+## 
+#c.PlainTextFormatter.pprint = True
+
+## 
+#c.PlainTextFormatter.verbose = False
+
+#------------------------------------------------------------------------------
+# Completer(Configurable) configuration
+#------------------------------------------------------------------------------
+
+## Enable unicode completions, e.g. \alpha<tab> . Includes completion of latex
+#  commands, unicode names, and expanding unicode characters back to latex
+#  commands.
+#c.Completer.backslash_combining_completions = True
+
+## Enable debug for the Completer. Mostly print extra information for
+#  experimental jedi integration.
+#c.Completer.debug = False
+
+## Activate greedy completion PENDING DEPRECTION. this is now mostly taken care
+#  of with Jedi.
+#  
+#  This will enable completion on elements of lists, results of function calls,
+#  etc., but can be unsafe because the code is actually evaluated on TAB.
+#c.Completer.greedy = False
+
+## Experimental: restrict time (in milliseconds) during which Jedi can compute
+#  types. Set to 0 to stop computing types. Non-zero value lower than 100ms may
+#  hurt performance by preventing jedi to build its cache.
+#c.Completer.jedi_compute_type_timeout = 400
+
+## Experimental: Use Jedi to generate autocompletions. Default to True if jedi is
+#  installed.
+#c.Completer.use_jedi = True
+
+#------------------------------------------------------------------------------
+# IPCompleter(Completer) configuration
+#------------------------------------------------------------------------------
+
+## Extension of the completer class with IPython-specific features
+
+## DEPRECATED as of version 5.0.
+#  
+#  Instruct the completer to use __all__ for the completion
+#  
+#  Specifically, when completing on ``object.<tab>``.
+#  
+#  When True: only those names in obj.__all__ will be included.
+#  
+#  When False [default]: the __all__ attribute is ignored
+#c.IPCompleter.limit_to__all__ = False
+
+## Whether to merge completion results into a single list
+#  
+#  If False, only the completion results from the first non-empty completer will
+#  be returned.
+#c.IPCompleter.merge_completions = True
+
+## Instruct the completer to omit private method names
+#  
+#  Specifically, when completing on ``object.<tab>``.
+#  
+#  When 2 [default]: all names that start with '_' will be excluded.
+#  
+#  When 1: all 'magic' names (``__foo__``) will be excluded.
+#  
+#  When 0: nothing will be excluded.
+#c.IPCompleter.omit__names = 2
+
+#------------------------------------------------------------------------------
+# ScriptMagics(Magics) configuration
+#------------------------------------------------------------------------------
+
+## Magics for talking to scripts
+#  
+#  This defines a base `%%script` cell magic for running a cell with a program in
+#  a subprocess, and registers a few top-level magics that call %%script with
+#  common interpreters.
+
+## Extra script cell magics to define
+#  
+#  This generates simple wrappers of `%%script foo` as `%%foo`.
+#  
+#  If you want to add script magics that aren't on your path, specify them in
+#  script_paths
+#c.ScriptMagics.script_magics = []
+
+## Dict mapping short 'ruby' names to full paths, such as '/opt/secret/bin/ruby'
+#  
+#  Only necessary for items in script_magics where the default path will not find
+#  the right interpreter.
+#c.ScriptMagics.script_paths = {}
+
+#------------------------------------------------------------------------------
+# LoggingMagics(Magics) configuration
+#------------------------------------------------------------------------------
+
+## Magics related to all logging machinery.
+
+## Suppress output of log state when logging is enabled
+#c.LoggingMagics.quiet = False
+
+#------------------------------------------------------------------------------
+# StoreMagics(Magics) configuration
+#------------------------------------------------------------------------------
+
+## Lightweight persistence for python variables.
+#  
+#  Provides the %store magic.
+
+## If True, any %store-d variables will be automatically restored when IPython
+#  starts.
+#c.StoreMagics.autorestore = False