Trayscale: Tailscale in the tray, and overrides back above Wolfi

.claude/skills/fork-merge/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fork-merge
-description: Bring a Construct-Linux fork (Orchis, Tela, Bibata, Vitals, Dash to Panel, Tiling Shell, AppIndicator, Caffeine, Clipboard Indicator) up to its upstream and move its recipe's pin, resolving what task fork:sync could not. Use when asked to update, sync or rebase a fork, port or review upstream's changes, resolve a fork's merge, or when a watch issue says "update: <fork> is N commit(s) behind".
+description: Bring a Construct-Linux fork (Orchis, Tela, Bibata, Vitals, Dash to Panel, Tiling Shell, AppIndicator, Caffeine, Clipboard Indicator, Trayscale) up to its upstream and move its recipe's pin, resolving what task fork:sync could not. Use when asked to update, sync or rebase a fork, port or review upstream's changes, resolve a fork's merge, or when a watch issue says "update: <fork> is N commit(s) behind".
 ---
 
 # Fork merge

README.md

@@ -14,16 +14,16 @@ rough edges, and say where they are.
 - **GNOME 51** on Wayland, with GNOME's core apps (Files, Text Editor, Calendar, Maps, Software,
   Papers, ...), Firefox, Ptyxis and Ghostty, and Flatpak with Flathub, where Chrome comes from.
   For work: Docker and containerd, VS Code (Microsoft's build, under its license), gcc, make and
-  git, Tailscale, CUPS, OpenSSH.
+  git, Tailscale (with Trayscale in the tray), CUPS, OpenSSH.
 - **Its own look**: Orchis in Construct's colours for the shell, GTK 3 and libadwaita apps alike,
   following the light/dark switch; Tela icons; Bibata's cursor. A top bar with the clock and
   indicators on the right, and a small centred dock. Extensions: AppIndicator, Caffeine, Clipboard
   Indicator, Dash to Panel, Desktop Icons, Drive Menu, Just Perfection, Night Theme Switcher,
   Tiling Shell, User Theme, Vitals, Workspace Indicator.
-- **Built for GNOME 51, fixed where it is not**: the theme, the icons, the cursor and six of the
-  extensions come from [forks](https://github.com/Construct-Linux) with a `gnome-51` branch -
-  upstream's issues triaged against this stack, one commit per fix - and each recipe pins its
-  commit and names the fixes it takes.
+- **Built for GNOME 51, fixed where it is not**: the theme, the icons, the cursor, six of the
+  extensions and Trayscale come from [forks](https://github.com/Construct-Linux) with a
+  `gnome-51` branch - upstream's issues triaged against this stack, one commit per fix - and each
+  recipe pins its commit and names the fixes it takes.
 - **What Wolfi lacks is built here**: 208 melange recipes in `recipes/` - the GNOME stack, and
   Wolfi packages rebuilt where Wolfi's fall short (mesa with Intel's drivers and Vulkan, PipeWire
   with Bluetooth audio, systemd with TPM2 and sysupdate, ...).

image/apko.lock.yaml

@@ -18,8 +18,8 @@ contents:
     - at-spi2-core-lang=2.62.1-r1
     - baobab=50.0-r0
     - bibata-cursor-theme=2.0.7-r5
-    - bluez=5.87-r5
-    - bluez-doc=5.87-r5
+    - bluez=5.88-r1
+    - bluez-doc=5.88-r1
     - bolt=0.9.11-r1
     - ccid=1.8.4-r0
     - code=1.144.0-r0
@@ -70,10 +70,10 @@ contents:
     - ghostty=1.3.1-r1
     - ghostty-lang=1.3.1-r1
     - gjs=1.90.1-r0
-    - glib=2.90.1-r1
-    - glib-dev=2.90.1-r1
-    - glib-doc=2.90.1-r1
-    - glib-lang=2.90.1-r1
+    - glib=2.90.1-r3
+    - glib-dev=2.90.1-r3
+    - glib-doc=2.90.1-r3
+    - glib-lang=2.90.1-r3
     - glib-networking=2.90.1-r0
     - glib-networking-lang=2.90.1-r0
     - glibmm=2.90.0-r0
@@ -148,7 +148,7 @@ contents:
     - grilo-plugins-lang=0.3.18-r0
     - gsettings-desktop-schemas=51.0-r0
     - gsound=1.0.3-r0
-    - gst-plugins-bad-1.28=1.28.8-r3
+    - gst-plugins-bad-1.28=1.28.9-r1
     - gst-plugins-good-1.28=1.28.8-r1
     - gst-plugins-rs=0.15.4-r1
     - gtk-frdp=0.2.0_git20260724-r0
@@ -206,10 +206,10 @@ contents:
     - libsoup3-lang=3.8.1-r0
     - libspelling=0.4.10-r0
     - libspelling-lang=0.4.10-r0
-    - libsystemd=262.1-r5
-    - libsystemd-compression-libs=262.1-r5
-    - libsystemd-shared=262.1-r5
-    - libudev=262.1-r5
+    - libsystemd=262.2-r2
+    - libsystemd-compression-libs=262.2-r2
+    - libsystemd-shared=262.2-r2
+    - libudev=262.2-r2
     - libwacom=2.20.0-r0
     - libxmlb=0.3.29-r0
     - localsearch=3.12.0-r1
@@ -238,7 +238,6 @@ contents:
     - networkmanager-openvpn=1.12.5-r0
     - networkmanager-openvpn-lang=1.12.5-r0
     - networkmanager-wifi=1.58.1-r0
-    - nss-mdns=0.15.1-r0
     - openssh-client=10.6_p1-r1
     - openssh-keygen=10.6_p1-r1
     - openssh-server=10.6_p1-r1
@@ -255,8 +254,9 @@ contents:
     - papers-lang=51.1-r0
     - pcsc-lite=2.5.3-r3
     - pcsc-lite-doc=2.5.3-r3
-    - pipewire=1.6.11-r3
-    - pipewire-pulse=1.6.11-r3
+    - pipewire=1.6.11-r4
+    - pipewire-doc=1.6.11-r4
+    - pipewire-pulse=1.6.11-r4
     - plymouth=26.134.222_git20260929-r0
     - power-profiles-daemon=0.30-r0
     - ptyxis=50.1-r1
@@ -283,23 +283,25 @@ contents:
     - speech-dispatcher-lang=0.12.1-r0
     - sudo=1.9.17_p2-r13
     - sudo-doc=1.9.17_p2-r13
-    - systemd=262.1-r5
-    - systemd-boot=262.1-r5
-    - systemd-container=262.1-r5
-    - systemd-init=262.1-r5
-    - systemd-logind-service=262.1-r5
-    - systemd-systemctl=262.1-r5
-    - systemd-sysupdate=262.1-r5
-    - systemd-timesyncd=262.1-r5
-    - systemd-userdb=262.1-r5
+    - systemd=262.2-r2
+    - systemd-boot=262.2-r2
+    - systemd-container=262.2-r2
+    - systemd-doc=262.2-r2
+    - systemd-init=262.2-r2
+    - systemd-logind-service=262.2-r2
+    - systemd-systemctl=262.2-r2
+    - systemd-sysupdate=262.2-r2
+    - systemd-timesyncd=262.2-r2
+    - systemd-userdb=262.2-r2
     - task=3.54.0-r6
     - tecla=51.0-r0
-    - tela-icon-theme=2026.08.10-r3
+    - tela-icon-theme=2026.08.10-r4
     - tinysparql=3.12.0-r0
     - tinysparql-lang=3.12.0-r0
     - totem-pl-parser=3.26.7-r0
     - totem-pl-parser-lang=3.26.7-r0
-    - udev=262.1-r5
+    - trayscale=0.21.0-r2
+    - udev=262.2-r2
     - udisks2=2.11.2-r0
     - udisks2-lang=2.11.2-r0
     - upower=1.91.5-r0
@@ -681,6 +683,7 @@ contents:
     - harfbuzz=15.0.0-r3
     - heimdal-libs=7.8.0-r55
     - hicolor-icon-theme=0.18-r8
+    - hwdata-pci=0.413-r0
     - hwdata-usb=0.412-r0
     - i2c-tools-doc=4.4-r14
     - icu78-data-full=78.3-r4
@@ -936,6 +939,7 @@ contents:
     - ngtcp2=1.26.0-r0
     - npth-libs=1.8-r16
     - nsenter=2.42.4-r2
+    - nss-mdns=0.15.1-r0
     - oniguruma=6.9.10-r7
     - opencore-amr=0.1.6-r6
     - openh264=2.7.0-r0

image/apko.yaml

@@ -304,8 +304,10 @@ contents:
     - iptables-nft
     # nft, which loads the firewall (usr/lib/construct/firewall.nft).
     - nftables
-    # Tailscale (usr/lib/systemd/system/tailscaled.service).
+    # Tailscale (usr/lib/systemd/system/tailscaled.service), and Trayscale for it from the tray
+    # (the AppIndicator extension shows the icon).
     - tailscale
+    - trayscale
     # Manuals: man (man-db, its index baked at build: etc/man_db.conf) and the pages of every
     # command the root has, which Wolfi puts in <name>-doc and nothing installs unless it is named
     # here. go run ./cmd/image check-docs (in task rootfs) fails the build when one is missing, and
@@ -381,6 +383,7 @@ contents:
     - pciutils-doc
     - pcsc-lite-doc
     - perl-doc
+    - pipewire-doc
     - pkgconf-doc
     - polkit-doc
     - powertop-doc
@@ -394,6 +397,7 @@ contents:
     - sqlite-doc
     - stress-ng-doc
     - sudo-doc
+    - systemd-doc
     - tiff-doc
     - vim-doc
     - wireguard-tools-doc

image/initrd/apko.lock.yaml

@@ -14,19 +14,19 @@ contents:
     - device-mapper-event-libs=2.03.44-r1
     - device-mapper-libs=2.03.44-r1
     - duktape=2.7.0-r3
-    - glib=2.90.1-r1
+    - glib=2.90.1-r3
     - libfido2=1.17.0-r9
-    - libsystemd=262.1-r5
-    - libsystemd-compression-libs=262.1-r5
-    - libsystemd-shared=262.1-r5
-    - libudev=262.1-r5
+    - libsystemd=262.2-r2
+    - libsystemd-compression-libs=262.2-r2
+    - libsystemd-shared=262.2-r2
+    - libudev=262.2-r2
     - lvm2=2.03.44-r1
     - pcsc-lite=2.5.3-r3
     - plymouth=26.134.222_git20260929-r0
-    - systemd=262.1-r5
-    - systemd-boot=262.1-r5
-    - systemd-systemctl=262.1-r5
-    - udev=262.1-r5
+    - systemd=262.2-r2
+    - systemd-boot=262.2-r2
+    - systemd-systemctl=262.2-r2
+    - udev=262.2-r2
     # Wolfi's: as pinned, or at Wolfi's newest with task lock -- -all.
     - bash=5.3-r14
     - bash-binsh=5.3-r14

image/rootfs/etc/dconf/db/local.d/00-construct

@@ -66,6 +66,11 @@ custom-command='distrobox enter wolfi'
 [org/gnome/desktop/wm/preferences]
 button-layout='appmenu:minimize,maximize,close'
 
+# Tray icons with the top bar's own padding (Orchis's $panel_button_hpadding), like the other
+# buttons: compact mode, on by default, sets 10 px on each of them by hand.
+[org/gnome/shell/extensions/appindicator]
+compact-mode-enabled=false
+
 # The layout: GNOME's top bar stays, with the clock and every indicator on the right, and Dash to
 # Panel becomes a small dock, centred at the bottom and sized to its icons. Its per-monitor keys
 # are JSON by monitor id, falling back to the index: "0" to "2" cover three monitors whatever

image/rootfs/etc/xdg/autostart/dev.deedles.Trayscale.desktop

@@ -0,0 +1,11 @@
+# Trayscale at login, in the tray only (the AppIndicator extension shows it): Tailscale's state and
+# its exit node a click away, without a window. GDM's greeter starts from its own autostart
+# directory, not this one.
+[Desktop Entry]
+Type=Application
+Name=Trayscale
+Icon=dev.deedles.Trayscale
+Exec=trayscale --hide-window
+NoDisplay=true
+OnlyShowIn=GNOME;
+X-GNOME-Autostart-enabled=true

recipes/bluez.yaml

@@ -5,9 +5,10 @@
 # Generated from https://git.alpinelinux.org/aports/plain/main/bluez/APKBUILD
 package:
   name: bluez
-  version: "5.87"
-  # Replaces Wolfi's bluez 5.87 (epoch 4): see the header.
-  epoch: 5
+  version: "5.88"
+  # Replaces Wolfi's bluez 5.88 (epoch 0), whose recipe Wolfi's index carries before GitHub does:
+  # see the header.
+  epoch: 1
   description: Tools for the Bluetooth protocol stack
   copyright:
     - license: GPL-2.0 AND LGPL-2.1 AND BSD-2-Clause AND MIT
@@ -54,7 +55,7 @@ pipeline:
     with:
       repository: https://github.com/bluez/bluez
       tag: ${{package.version}}
-      expected-commit: 65d11edee469c24dcc8d075b8be9c040cebaaf98
+      expected-commit: 34b6f8e0e998728ce9e8e64e280d9d390c511804
 
   - uses: autoconf/configure
     with:
@@ -76,7 +77,8 @@ pipeline:
       make DESTDIR="${{targets.destdir}}" install install-pluginLTLIBRARIES
       install -Dm755 test/simple-agent "${{targets.destdir}}"/usr/bin/bluez-simple-agent
       install -Dm755 tools/btmgmt -t "${{targets.destdir}}"/usr/bin/
-      install -Dm755 attrib/gatttool -t "${{targets.destdir}}"/usr/bin/
+      # gatttool, deprecated since 5.x, is gone in 5.88 (attrib/ removed): bluetoothctl's gatt
+      # menu does what it did.
 
       install -Dm644 obexd/src/org.bluez.obex.service \
         "${{targets.destdir}}"/usr/share/dbus-1/services/org.bluez.obex.service

recipes/glib.yaml

@@ -5,10 +5,13 @@
 # put Firefox before or after Google Chrome by the session (patch upstream-ready, in glib/).
 # Its package tests are left out: they use Wolfi's own test pipelines, which melange build does
 # not run.
+# Wolfi's epochs 1 and 2 of the same 2.90.1 (LTO, a static build, and its own patch putting
+# GChecksum and GHmac on OpenSSL 4's libcrypto) are not taken: the desktop needs none of them,
+# and they would make glib, under every app, depend on libcrypto. The epoch stays above Wolfi's.
 package:
   name: glib
   version: "2.90.1"
-  epoch: 1
+  epoch: 3
   description: Common C routines used by Gtk+ and other libs
   copyright:
     - license: LGPL-2.1-or-later

recipes/gst-plugins-bad-1.28.yaml

@@ -6,8 +6,8 @@
 # carried: nothing on the desktop uses WebRTC through GStreamer.
 package:
   name: gst-plugins-bad-1.28
-  version: "1.28.8"
-  epoch: 3
+  version: "1.28.9"
+  epoch: 1
   description: GStreamer streaming media framework bad plug-ins
   copyright:
     - license: LGPL-2.1
@@ -76,7 +76,7 @@ pipeline:
     with:
       repository: https://github.com/GStreamer/gstreamer
       tag: ${{package.version}}
-      expected-commit: 1b2a95a1b72787cda146b46df9605b168e5b683b
+      expected-commit: 3ced45da096032bdac8e0922faa492a079c3180e
 
   - working-directory: subprojects/gst-plugins-bad
     pipeline:

recipes/pipewire.yaml

@@ -1,8 +1,9 @@
 package:
   name: pipewire
   version: "1.6.11"
-  # Replaces Wolfi's pipewire 1.6.11 (epoch 1), which lacks the bluez5 and GStreamer plugins.
-  epoch: 3
+  # Replaces Wolfi's pipewire 1.6.11 (epoch 2), which lacks the bluez5 and GStreamer plugins. Its
+  # manual pages are built as Wolfi's are, in pipewire-doc: without ours, apko would take Wolfi's.
+  epoch: 4
   description: Server and user space API to deal with multimedia pipelines
   copyright:
     - license: MIT
@@ -19,6 +20,7 @@ environment:
       - build-base
       - busybox
       - dbus-dev
+      - doxygen
       - glib-dev
       - gst-plugins-base-dev
       - gstreamer-dev
@@ -27,6 +29,7 @@ environment:
       - meson
       - ninja
       - opus-dev
+      - python3
       - readline-dev
       - sbc-dev
       - systemd-dev
@@ -47,7 +50,7 @@ pipeline:
   # x11 and libcanberra serve only the X11 bell module, which a Wayland session never loads.
   - uses: meson/configure
     with:
-      opts: -Dsession-managers=[] -Ddocs=disabled -Dman=disabled -Dtests=disabled -Dinstalled_tests=disabled -Dexamples=disabled -Dgstreamer=enabled -Dgstreamer-device-provider=enabled -Dlibsystemd=enabled -Dlogind=enabled -Dlogind-provider=libsystemd -Dsystemd-system-service=disabled -Dsystemd-user-service=enabled -Dsystemd-user-unit-dir=/usr/lib/systemd/user -Dudev=enabled -Dalsa=enabled -Dpipewire-alsa=enabled -Dpipewire-jack=disabled -Djack=disabled -Djack-devel=false -Dpipewire-v4l2=disabled -Dv4l2=enabled -Dlibcamera=enabled -Dbluez5=enabled -Dbluez5-backend-native-mm=disabled -Dbluez5-backend-ofono=disabled -Dbluez5-backend-hsphfpd=disabled -Dbluez5-codec-aptx=disabled -Dbluez5-codec-ldac=disabled -Dbluez5-codec-ldac-dec=disabled -Dbluez5-codec-aac=disabled -Dbluez5-codec-lc3plus=disabled -Dbluez5-codec-lc3=disabled -Dbluez5-codec-opus=enabled -Dbluez5-codec-g722=disabled -Dbluez5-plc-spandsp=disabled -Dopus=enabled -Dlibusb=disabled -Dvulkan=disabled -Dffmpeg=disabled -Dpw-cat-ffmpeg=disabled -Dsdl2=disabled -Dsndfile=enabled -Dlibmysofa=disabled -Dlibpulse=disabled -Droc=disabled -Davahi=disabled -Decho-cancel-webrtc=disabled -Draop=disabled -Dlv2=disabled -Dx11=disabled -Dx11-xfixes=disabled -Dlibcanberra=disabled -Dflatpak=disabled -Dreadline=enabled -Dselinux=disabled -Dlibffado=disabled -Dsnap=disabled -Debur128=disabled -Dfftw=disabled -Donnxruntime=disabled -Dcompress-offload=disabled -Devl=disabled
+      opts: -Dsession-managers=[] -Ddocs=disabled -Dman=enabled -Dtests=disabled -Dinstalled_tests=disabled -Dexamples=disabled -Dgstreamer=enabled -Dgstreamer-device-provider=enabled -Dlibsystemd=enabled -Dlogind=enabled -Dlogind-provider=libsystemd -Dsystemd-system-service=disabled -Dsystemd-user-service=enabled -Dsystemd-user-unit-dir=/usr/lib/systemd/user -Dudev=enabled -Dalsa=enabled -Dpipewire-alsa=enabled -Dpipewire-jack=disabled -Djack=disabled -Djack-devel=false -Dpipewire-v4l2=disabled -Dv4l2=enabled -Dlibcamera=enabled -Dbluez5=enabled -Dbluez5-backend-native-mm=disabled -Dbluez5-backend-ofono=disabled -Dbluez5-backend-hsphfpd=disabled -Dbluez5-codec-aptx=disabled -Dbluez5-codec-ldac=disabled -Dbluez5-codec-ldac-dec=disabled -Dbluez5-codec-aac=disabled -Dbluez5-codec-lc3plus=disabled -Dbluez5-codec-lc3=disabled -Dbluez5-codec-opus=enabled -Dbluez5-codec-g722=disabled -Dbluez5-plc-spandsp=disabled -Dopus=enabled -Dlibusb=disabled -Dvulkan=disabled -Dffmpeg=disabled -Dpw-cat-ffmpeg=disabled -Dsdl2=disabled -Dsndfile=enabled -Dlibmysofa=disabled -Dlibpulse=disabled -Droc=disabled -Davahi=disabled -Decho-cancel-webrtc=disabled -Draop=disabled -Dlv2=disabled -Dx11=disabled -Dx11-xfixes=disabled -Dlibcanberra=disabled -Dflatpak=disabled -Dreadline=enabled -Dselinux=disabled -Dlibffado=disabled -Dsnap=disabled -Debur128=disabled -Dfftw=disabled -Donnxruntime=disabled -Dcompress-offload=disabled -Devl=disabled
 
   - uses: meson/compile
 
@@ -56,6 +59,11 @@ pipeline:
   - uses: strip
 
 subpackages:
+  - name: pipewire-doc
+    description: pipewire manual pages
+    pipeline:
+      - uses: split/manpages
+
   - name: pipewire-dev
     pipeline:
       - uses: split/dev