Start Here

Installing

Oniomarchy installs onto a working Omarchy system. You don’t reinstall anything and you don’t boot an ISO — you run one script and the security layer lands on top of the desktop you already have.

What you need first

  • Omarchy, already installed. Oniomarchy builds on top of it, so it’s the one thing that has to be there first.
  • Your user password. You’ll be asked for it once, at the start.
  • Room and a little patience. It’s a big toolkit — expect a sizeable download and a real install, not a thirty-second one.

If Omarchy isn’t there, the installer says so and stops rather than making a mess — so there’s nothing to get wrong.

Getting it and running it

git clone https://github.com/SalimRK/oniomarchy.git
cd oniomarchy
./install.sh

That’s the whole thing. The script primes sudo once, then works through the install in order: preflight checks, the applications, the Security menu, the services, the privacy plugins, the Trigger menu, and the theming.

Signed and vetted, not built blind

A plain Arch or AUR setup installs a lot of this kind of tooling by building it from source on your machine — running dozens of build scripts written by strangers, unsigned, straight off the internet, and trusting that each one is honest and still works. Oniomarchy doesn’t. It publishes its own package repository, where every tool is built once, tested on Omarchy, and cryptographically signed ahead of time, then served from fast servers. Your install just downloads those signed binaries and verifies every signature before anything is installed — if a package or the repository index has been tampered with, the install refuses it instead of running it.

That’s both faster and safer: no hours of compiling (and no low-spec machine running out of memory halfway through), and nothing unvetted or unsigned ever executes on your system.

On ARM machines

The signed packages are built for x86_64, which is what nearly every laptop and desktop running Omarchy is. On an aarch64 (ARM) machine the installer still works, but several tools have to be built from source on your machine instead, so expect the run to take considerably longer. Ghidra in particular needs about 4 GB of memory to build; with less than that the installer skips it and tells you why. A few tools land as their command-line builds on ARM (Caido, VeraCrypt) rather than their desktop ones. Any other architecture is refused up front, before anything is changed.

A bare run doesn’t install the entire toolkit — it installs a curated core of 56 tools, the ones useful to almost any engagement. The rest is one flag away. See Choosing what to install below before you run it if you already know you want more (or want to point the install at just one category).

Options

./install.sh              # the normal run — installs core, quiet with a live progress line
./install.sh --pack SPEC  # install exactly the named pack(s) instead of core
./install.sh --list-packs # print every pack name with its tool count, install nothing
./install.sh --verbose    # show every pacman line as it happens
./install.sh --help       # full usage, including the two below
./install.sh --log PATH   # write the run log somewhere specific
./install.sh --no-log     # don't write a log file

The normal run is quiet on purpose. Instead of a wall of package-manager output, you get one live line that redraws in place — the oni banner at the top, then the current step, a progress bar, and a counter. A step that runs long enough to look stuck starts showing its own latest log line underneath, so you can tell “installing a huge dependency tree” apart from “hung.” A step that fails drops out of the quiet view and prints its last thirty lines right there, so you see the actual error without going digging. Reach for --verbose when you want the firehose.

Choosing what to install

Oniomarchy’s tree holds 86 tools across 18 categories. Most of them are useful on any engagement; a handful are specialist gear that’s dead weight unless you actually have the hardware or the use case for them. So the install is split into a core you get by default and packs you opt into by name.

Core is the 14 general categories’ curated tools, plus two specific exceptions pulled in from otherwise-opt-in categories: hexstrike-ai (the AI Tools MCP server Omarchy’s own agent tooling plugs into) and social-engineer-toolkit (the baseline phishing/credential-harvesting framework). That’s 56 tools — a normal pentest laptop, not a full arsenal.

Three categories are opt-in entirely — none of their tools ship in core, because they’re either hardware-gated or stand up infrastructure you may not want by default:

  • Software Defined Radio — useless without an SDR dongle (16 tools)
  • Automotive — needs a CAN-bus interface (can-utils)
  • Social Engineering Tools — gophish, beyond setoolkit already in core

Reach any of it with --pack, which replaces the selection rather than adding to it:

./install.sh --pack core                # identical to the bare default
./install.sh --pack sdr                 # just SDR's curated slice (gqrx, gnuradio, hackrf, chirp-next)
./install.sh --pack sdr-all             # every SDR tool in the tree, all 16
./install.sh --pack all                 # everything — the full 86-tool tree
./install.sh --pack sdr,automotive      # SDR's curated slice + Automotive's, unioned — nothing else
./install.sh --list-packs               # see every pack name and its tool count first

<category> installs that category’s curated slice; <category>-all installs every tool under it, curated or not — useful for a general category too, if you want e.g. every Reverse Engineering tool instead of just the core four. --list-packs is the safe way to check counts and category names before committing to a real run — it installs nothing.

It always writes a log

Every run, in either mode, writes a full log to:

~/.local/state/oniomarchy/install-<timestamp>.log

along with a latest.log symlink pointing at the most recent one. That’s outside the repo on purpose, and it’s the first thing to look at if something didn’t go the way you expected. Use --log PATH to put it elsewhere, or --no-log to skip it.

If a tool fails

The toolkit is big, and the internet is the internet — occasionally a single package fails to download. Oniomarchy is built so that one failed tool doesn’t sink the whole install. If a tool won’t install, the run notes it and keeps going — you still get the Security menu, the services, the privacy layers, and every other tool. At the end it tells you plainly what didn’t make it, so a partial install never passes itself off as a clean one and you know exactly what to look into.

When it’s done

You’ll have the full Security menu in your launcher, the Trigger → Pentest menu with the listener and services, the Tor, MAC and GoDark bar panels, the hardened Firefox ready to go, and Oniomarchy’s branding on your themes. The next page walks you through finding all of it.

From then on, a normal omarchy update keeps all of it current — see Keeping It Up to Date.