From ca1bd18de6dbb51e0b0c9fcfdd2dabffeddd2a6a Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 9 Oct 2026 12:33:41 +0200
Subject: [PATCH] picom: keep the configuration trusted, so only the terminal
 sets the backend (review of #157)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A setting is pasted into picom.conf as it is, so a backend of xrender"; write-pid-path = "… adds an
option of the caller's: picom would then overwrite any file the operator can write. With the file
trusted, both settings are set at the controller's terminal alone until settings are typed and quoted
(hq issue 346).
---
 modules/picom/README.md                        | 5 +++--
 modules/picom/cmd/picom-tools/manifest_test.go | 7 +++++--
 modules/picom/module.json                      | 1 -
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/modules/picom/README.md b/modules/picom/README.md
index 546b7abe..be9a79ba 100644
--- a/modules/picom/README.md
+++ b/modules/picom/README.md
@@ -26,8 +26,9 @@ the machine's graphics driver (novox/hq research 037):
 The defaults are what every machine ran before, so the file filled with them changes nothing. They exist
 for hq issue 345: a window that is mapped but shows nothing (a calendar reminder) or stays stale after a
 workspace switch (a chat window) is a known failure of glx with damage tracking on some drivers, and
-`xrender` or `use-damage` false is how a machine is set to test that. The file is `"trusted": false`: only
-the operator's own compositor reads it, so a verb may set these (issue 339). A changed file is read at
+`xrender` or `use-damage` false is how a machine is set to test that. The file stays trusted, so both are set at the
+controller's terminal alone (issue 339): a value is pasted into picom.conf as it is, and a backend of
+`xrender"; write-pid-path = "…` would add an option of the caller's (hq issue 346). A changed file is read at
 the next `picom_restart` or login: the module has no unit to reload.
 
 ## Tools
diff --git a/modules/picom/cmd/picom-tools/manifest_test.go b/modules/picom/cmd/picom-tools/manifest_test.go
index 98b508ad..b82d8ccc 100644
--- a/modules/picom/cmd/picom-tools/manifest_test.go
+++ b/modules/picom/cmd/picom-tools/manifest_test.go
@@ -76,8 +76,11 @@ func TestTheBackendAndDamageTrackingAreSettingsWithTodaysDefaults(t *testing.T)
 			t.Errorf("the file asks for %q", want)
 		}
 	}
-	if r["trusted"] != false {
-		t.Fatal("only the operator's own compositor reads the file: trusted false, so a verb may set a machine's backend (issue 339)")
+	// Trusted (unmarked): a value is pasted into the file as it is, so `xrender"; write-pid-path = "…`
+	// would add an option of the caller's. Until settings are typed and quoted (hq issue 346), only the
+	// controller's terminal sets them.
+	if _, marked := r["trusted"]; marked {
+		t.Fatal("the file stays trusted: its settings are set at the terminal alone (hq issue 346)")
 	}
 	got := parseRules("picom.conf", withDefaults(c), nil)
 	if got.Global["backend"] != "glx" || got.Global["use-damage"] != "true" || got.Global["vsync"] != "true" {
diff --git a/modules/picom/module.json b/modules/picom/module.json
index cda363c3..99d95644 100644
--- a/modules/picom/module.json
+++ b/modules/picom/module.json
@@ -51,7 +51,6 @@
     },
     {
       "id": "configuration",
-      "trusted": false,
       "type": "file",
       "path": "${machine:account-home}/.config/picom/picom.conf",
       "owner": "${machine:account}",