- Add enforce-resolved.sh: validates ReadEtcHosts=yes, prevents
DNSOverTLS bypass, removes drop-in overrides, locks drop-in dir
- Add resolved-guard.path/service: watches /etc/systemd/resolved.conf
and its drop-in directory for tampering
- Update pacman hooks to unlock/relock nsswitch.conf and resolved.conf
alongside /etc/hosts during package transactions
- Extend setup_hosts_guard.sh with --skip-resolved option, resolved
canonical snapshot, drop-in directory locking, and enforcement
- Add resolved.conf checks to check_and_enable_services.sh: validates
ReadEtcHosts, DNSOverTLS, drop-in overrides, immutable attribute,
and resolved-guard.path status with auto-fix capability
Fixed on live system: ReadEtcHosts was set to 'no' and nsswitch.conf
was missing 'files' in the hosts line, completely bypassing /etc/hosts.
- Fix startup_monitor check to verify timer instead of service
- Fix pacman hooks filename check (10-unlock-etc-hosts.hook, 90-relock-etc-hosts.hook)
- Add re-verification after fixes to update status correctly
- Set immutable attribute before bind mount in pacman-post-relock-hosts.sh
- Add new check_and_enable_services.sh script for verifying all digital wellbeing services
- Replace 'A && B || C' patterns with proper if-then-else statements (SC2015)
- Add check_for_virtualbox function to invoke prompt_for_virtualbox_challenge (SC2317)
- Fix install_launcher function to escape variable in heredoc (SC2119/SC2120)
- Apply shfmt formatting to ensure consistent style
Fixes 7 SC2015 violations, 1 SC2317 violation, and 1 SC2119/SC2120 pair.
All 79 shell files now pass shellcheck without errors.
