ISO: flip [breadway] to the signed dl.breadway.dev/arch repo

The signed repo is live: https://dl.breadway.dev/arch/x86_64/ serves
breadway.db + .files + every .pkg.tar.zst with a detached .sig from the
BOS release key (56203B86A110695AE7F310934AF3323D678EB5E2 = KEYS.asc),
rebuilt from the Forgejo Arch registry by signed-repo.yml +
scripts/ci-publish-signed-repo.sh. Verified: db/pkg sigs all GPG-good
against KEYS.asc.

Executes the "After the signed repo exists" plan in docs/signed-repo.md:

- `iso/pacman.conf` + `iso/airootfs/etc/pacman.conf`: section renamed
  `[Breadway.os.git.breadway.dev]` → `[breadway]` (matches breadway.db),
  `Server = https://dl.breadway.dev/arch/$arch`, `SigLevel = Required`.
  The old "Forgejo has no db sigs / KEYS.asc is not a repo key / do NOT
  flip" comments are gone — both are now false.
- `iso/airootfs/etc/pacman.d/breadway-repo.asc`: the public key, baked
  into the image.
- `build-local.sh`: trust the key in the build host's pacman keyring
  before mkarchiso (so pacstrap can verify [breadway] while assembling
  the airootfs); drop the now-obsolete Forgejo-registry URL rewrite.
- `iso/airootfs/root/customize_airootfs.sh` (new): trust the key in the
  image keyring so the live medium — and, via calamares unpackfs, the
  installed target — verify [breadway]. (archiso warns this hook is
  deprecated; there is no replacement for "add a repo key to the image
  keyring" and BOS ships no pacman-init.service.)
- `calamares/post-install.sh`: `pacman-key --add` + `--lsign-key` the
  BOS key in the target chroot as a fallback (unpackfs can skip
  /etc/pacman.d/gnupg).
- README.md / DESIGN.md / docs/signed-repo.md updated.

NOT yet done: build the ISO (`sudo ./build-local.sh`) and VM-verify
`pacman -Sy` + a `[breadway]` install with no signature prompt, on both
the live medium and a fresh install. The build-time keyring path
(pacstrap -G vs host keyring vs customize_airootfs) may need a tweak
once the real build runs.

iso/airootfs/etc/calamares/post-install.sh

@@ -67,15 +67,23 @@ passwd -l root || true
 # over to the target (unpackfs may skip it / perms differ), leaving the installed
 # system unable to verify package signatures — the first `pacman -Syu` then dies
 # with "keyring is not writable / required key missing". Initialise it here so a
-# fresh install can update out of the box. archlinux-keyring is already present
-# and is the only keyring populated — it verifies official Arch packages.
-# [breadway] stays SigLevel=Never (Forgejo does not serve pacman-compatible
-# db signatures). Do not import KEYS.asc here: that key signs ISO SHA256SUMS,
-# not the pacman repo; treating it as a repo key would be a lie.
+# fresh install can update out of the box. archlinux-keyring verifies official
+# Arch packages; the BOS release key (56203B86…, shipped at
+# /etc/pacman.d/breadway-repo.asc) verifies the signed [breadway] repo at
+# dl.breadway.dev/arch — SigLevel = Required there, every package and the db
+# carry a .sig from it.
 # ---------------------------------------------------------------------------
+BREADWAY_KEY_FPR="56203B86A110695AE7F310934AF3323D678EB5E2"
 if command -v pacman-key &>/dev/null; then
     pacman-key --init || echo "WARN: pacman-key --init failed"
     pacman-key --populate archlinux || echo "WARN: pacman-key --populate failed"
+    if [[ -f /etc/pacman.d/breadway-repo.asc ]]; then
+        pacman-key --add /etc/pacman.d/breadway-repo.asc \
+            && pacman-key --lsign-key "$BREADWAY_KEY_FPR" \
+            || echo "WARN: could not trust the [breadway] repo key — pacman -Sy will fail on [breadway]"
+    else
+        echo "WARN: /etc/pacman.d/breadway-repo.asc missing — [breadway] (SigLevel=Required) will not verify"
+    fi
 fi
 
 # ---------------------------------------------------------------------------

iso/airootfs/etc/pacman.conf

@@ -32,18 +32,17 @@ Include = /etc/pacman.d/mirrorlist
 # are NOT here; they are bakery-baked into /usr/local at ISO build time.
 #
 # Packages are published to the Forgejo Arch registry (group "os") by the
-# .forgejo/workflows/*.yml workflows in this repo (and breadlock's).
+# .forgejo/workflows/*.yml workflows; scripts/ci-publish-signed-repo.sh then
+# collects them, detach-signs each .pkg.tar.zst with the BOS release key
+# (releases@breadway.dev), runs `repo-add -s`, and publishes the signed db
+# at https://dl.breadway.dev/arch/$arch (signed-repo.yml).
 #
-# Forgejo's Arch package registry does not serve pacman-compatible db
-# signatures. SigLevel = Never is TLS-only integrity: the connection is
-# HTTPS (or rewritten to hestia's localhost:3002 in CI). breadlock (PAM)
-# rides this repo. Do NOT flip to SigLevel = Required unless a signed db
-# has been verified to work — Required without signatures breaks the ISO
-# and every install that uses [breadway]. KEYS.asc is the ISO SHA256SUMS
-# signing key, not a pacman repo key.
+# SigLevel = Required: every package AND the db carry a .sig from key
+# 56203B86A110695AE7F310934AF3323D678EB5E2 — the same key committed as
+# KEYS.asc / etc/pacman.d/breadway-repo.asc, imported into the pacman
+# keyring at build time (build-local.sh), on the live medium, and on the
+# installed target (calamares/post-install.sh).
 # -----------------------------------------------------------------------
-# The section name must match Forgejo's served db filename
-# ({owner}.{group}.{domain}.db) — pacman fetches "<section>.db" from Server.
-[Breadway.os.git.breadway.dev]
-SigLevel = Never
-Server = https://git.breadway.dev/api/packages/Breadway/arch/os/$arch
+[breadway]
+SigLevel = Required
+Server = https://dl.breadway.dev/arch/$arch

iso/airootfs/etc/pacman.d/breadway-repo.asc

@@ -0,0 +1,15 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEakhwGhYJKwYBBAHaRw8BAQdA/sZ/GYec5M2MD+w20mVF5tMUhGji210Dg7zL
+TAhNsg60WUJPUyBSZWxlYXNlIFNpZ25pbmcgKGdpdC5icmVhZHdheS5kZXYvQnJl
+YWR3YXkvYm9zIHJlbGVhc2VzIG9ubHkpIDxyZWxlYXNlc0BicmVhZHdheS5kZXY+
+iJYEExYKAD4WIQRWIDuGoRBpWufzEJNK8zI9Z4614gUCakhwGgIbIwUJA8JnAAUL
+CQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRBK8zI9Z4614ggYAQDP8FTZ14i9YPKD
+ARvZuP5QaYOUFhQ8uyG0CowXKy9O0AEAqYfjnvyJI3N651pVFSNUXyP16w1kMPSs
+K0g3CLsztQ+4OARqSHAaEgorBgEEAZdVAQUBAQdAuJFuy2GHz5m9wXTm/PdSpLE9
+gERwHOLyM1OFuttrJW4DAQgHiH4EGBYKACYWIQRWIDuGoRBpWufzEJNK8zI9Z461
+4gUCakhwGgIbDAUJA8JnAAAKCRBK8zI9Z4614nzLAP9grcIFsAAeCyVKhziHmpXq
+E0Hm6FfIr4sdEf63HZkyfwD/XeKeWfb3EWvVsloJrZZ9tDmR67iK52Hwl82wfFAU
+cAo=
+=Mrh1
+-----END PGP PUBLIC KEY BLOCK-----

iso/airootfs/root/customize_airootfs.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Run by mkarchiso inside the airootfs chroot, after packages are installed
+# and before the squashfs is built. (archiso prints a deprecation warning for
+# this hook, but there is no non-deprecated replacement for "trust an extra
+# pacman repo key in the image keyring", and BOS ships no pacman-init.service.)
+#
+# Purpose: trust the BOS release key (56203B86…) in the image's pacman
+# keyring so the signed [breadway] repo (SigLevel = Required,
+# https://dl.breadway.dev/arch) verifies both on the live medium and — via
+# calamares' unpackfs, which copies this squashfs to the target — on the
+# installed system. calamares/post-install.sh re-does this in the target
+# chroot as a fallback (unpackfs can skip /etc/pacman.d/gnupg).
+set -euo pipefail
+
+BREADWAY_KEY_FPR="56203B86A110695AE7F310934AF3323D678EB5E2"
+KEY_FILE="/etc/pacman.d/breadway-repo.asc"
+
+pacman-key --init
+pacman-key --populate archlinux
+
+if [[ -f "$KEY_FILE" ]]; then
+    pacman-key --add "$KEY_FILE"
+    pacman-key --lsign-key "$BREADWAY_KEY_FPR"
+    echo "customize_airootfs: trusted [breadway] repo key $BREADWAY_KEY_FPR"
+else
+    echo "customize_airootfs: WARNING $KEY_FILE missing; [breadway] will not verify" >&2
+fi