A safety-focused USB and SD-card image writer for Omarchy and Arch Linux.
OmaFlash combines a native Quickshell interface with a memory-safe Rust engine. Raw-device access is authorized by UDisks2 and Polkit; the application itself does not run as root and never installs a setuid helper.
- Flash local images or direct HTTPS image links.
- Inspect normal local images by reading at most a 64 KiB probe before target selection.
- Resume downloads and show cancellable progress for downloading, checksum validation, decompression, and extraction.
- Verify an official SHA-256 or SHA-512 checksum before touching the destination.
- Calculate SHA-256 while writing, synchronize the device, and optionally read every written byte back through the same exclusive descriptor.
- Write several drives in one pass while isolating individual target failures.
- Clone removable drives or create raw image backups.
- Restore used media with GPT or MBR and exFAT, FAT32, or ext4.
- Block the running system disk and revalidate target identity immediately before destructive access.
- Follow the active Omarchy color theme while remaining usable on a standalone Arch desktop.
- Operate without telemetry or unsolicited update checks.
| Source | Support |
|---|---|
| Raw images | .iso, .img, .raw, .bin, .dmg |
| Compressed images | gzip, xz, bzip2, zstd |
| Archives | ZIP with explicit member selection when ambiguous |
| Remote images | Direct HTTPS URLs; HTTP requires explicit approval |
| Integrity | Optional published SHA-256 or SHA-512 checksum |
Download omaflash-v0.1.0.tar.gz and SHA256SUMS from the latest release, then verify and install the payload:
sha256sum --check SHA256SUMS
sudo tar --extract --gzip --file omaflash-v0.1.0.tar.gz --directory /
omaflashRuntime requirements are Quickshell 0.3 or newer, UDisks2, Polkit, Qt 6 Declarative, and util-linux. On Omarchy these services are normally already available.
sudo pacman -S --needed rustup udisks2 polkit qt6-declarative util-linux
rustup default stable
git clone https://github.com/Bmontythe3rd/OmaFlash.git
cd OmaFlash
cargo build --locked --release
sudo make installLaunch OmaFlash from the application menu or run omaflash.
- Choose Local ISO / image or ISO web link.
- Optionally enable Verify a published checksum before flashing and enter the complete vendor-provided digest.
- Wait for source inspection to finish, then select one or more destination drives.
- Keep readback verification enabled, review the exact destinations, and choose Flash selected drives.
- Approve the Polkit prompt and leave the media connected through writing, synchronization, and verification.
The default inspection does not pre-hash a normal raw image. OmaFlash calculates SHA-256 over the exact source bytes during the write and compares the optional target readback against that digest. A published checksum is a separate authenticity check and intentionally requires a complete source read before writing begins.
See the user guide for cloning, image backups, recovery formatting, Advanced mode, and cancellation behavior.
OmaFlash treats the QML interface and all path-like input as untrusted. The Rust backend:
- Discovers the complete block-device hierarchy with
lsblk. - Excludes the live root, boot, EFI, and swap hierarchy.
- Selects whole physical devices by a stable identity rather than
/dev/sdXalone. - Requires an exact typed confirmation before exposing non-system internal drives.
- Unmounts child filesystems through UDisks2 and revalidates identity, size, path, and major/minor number.
- Requests one exclusive Polkit-authorized descriptor for writing, final synchronization, and optional readback.
Read the complete security and device-safety policy before changing target selection, authorization, or raw-I/O code. Please report vulnerabilities with a private GitHub security advisory and do not include real device serials or private image URLs in public issues.
Run the application from a checkout:
cargo build
make runRun the release checks:
cargo fmt --all -- --check
cargo clippy --all-targets -- -D warnings
cargo test --locked
cargo build --locked --release
cargo run -- --checkHardware tests are always opt-in and must name an exact disposable device. The CI suite never performs destructive device access.
Project documentation:
OmaFlash is licensed under GPL-3.0-only.