trim down install, tighten sshd

migrations/1793452584.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# The SSH server now accepts keys only (system/sshd.sh). A machine someone has
+# logged in to over SSH with a password is left as it is, so nobody loses a
+# way in; it's told how to switch instead.
+SSHD_CONF=/etc/ssh/sshd_config.d/10-coredesktop-keys-only.conf
+
+[ -f "$SSHD_CONF" ] && exit 0
+
+if sudo journalctl -q --no-pager -u sshd.service \
+    | grep -qE 'Accepted (password|keyboard-interactive)'; then
+  echo "Someone has logged in to this machine over SSH with a password, so SSH still accepts passwords."
+  echo "To allow keys only, add your public key to ~/.ssh/authorized_keys, then run:"
+  echo "  bash ~/.local/share/coredesktop/system/sshd.sh"
+  exit 0
+fi
+
+bash "$HOME/.local/share/coredesktop/system/sshd.sh"

migrations/1793452585.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+# ~/.bashrc pointed SSH_AUTH_SOCK at Bitwarden's SSH agent even when Bitwarden
+# wasn't running it, which broke ssh and ssh-add for everyone else. Swap that
+# line, where it was, for bitwarden.sh's, which only does so while it is.
+OLD='export SSH_AUTH_SOCK="$HOME/.bitwarden-ssh-agent.sock"'
+NEW='if [ -S "$HOME/.bitwarden-ssh-agent.sock" ]; then export SSH_AUTH_SOCK="$HOME/.bitwarden-ssh-agent.sock"; fi'
+
+[ -f ~/.bashrc ] || exit 0
+grep -qxF "$OLD" ~/.bashrc || exit 0
+
+tmp="$(mktemp ~/.bashrc.XXXXXX)" || exit 1
+awk -v old="$OLD" -v new="$NEW" '$0 == old { print new; next } { print }' ~/.bashrc > "$tmp" \
+  && cat "$tmp" > ~/.bashrc
+status=$?
+rm -f "$tmp"
+exit $status

migrations/1793452586.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# CoreDesktop no longer installs Sonarr, qBittorrent, or the tools it had two
+# of: borg (restic does backups), lsd (eza), screen (tmux) and asdf-vm (mise).
+# Remove them once. Install one again yourself and update leaves it alone.
+# Their data stays: Sonarr's in /var/lib/sonarr, qBittorrent's in ~/.var/app.
+DROPPED=(sonarr-bin borg lsd screen asdf-vm)
+
+if systemctl is-enabled -q sonarr.service 2> /dev/null || systemctl is-active -q sonarr.service 2> /dev/null; then
+  echo "Stopping Sonarr..."
+  sudo systemctl disable --now sonarr.service || exit 1
+fi
+
+for pkg in "${DROPPED[@]}"; do
+  # The exact name: pacman -Q also matches a package that only provides it
+  [ "$(pacman -Qq "$pkg" 2> /dev/null)" = "$pkg" ] || continue
+
+  # Something else still needs it: leave it to go with that, as an orphan
+  if [ "$(LC_ALL=C pacman -Qi "$pkg" | awk -F' *: *' '/^Required By/ { print $2 }')" != "None" ]; then
+    sudo pacman -D --asdeps "$pkg" > /dev/null || exit 1
+    continue
+  fi
+
+  echo "Removing $pkg..."
+  sudo pacman -Rns --noconfirm "$pkg" || exit 1
+done
+
+if flatpak info --system org.qbittorrent.qBittorrent &> /dev/null; then
+  echo "Removing qBittorrent..."
+  sudo flatpak uninstall --system --noninteractive org.qbittorrent.qBittorrent || exit 1
+fi
+exit 0