The signed repo is live: https://dl.breadway.dev/arch/x86_64/ serves
breadway.db + .files + every .pkg.tar.zst with a detached .sig from the
BOS release key (56203B86A110695AE7F310934AF3323D678EB5E2 = KEYS.asc),
rebuilt from the Forgejo Arch registry by signed-repo.yml +
scripts/ci-publish-signed-repo.sh. Verified: db/pkg sigs all GPG-good
against KEYS.asc.
Executes the "After the signed repo exists" plan in docs/signed-repo.md:
- `iso/pacman.conf` + `iso/airootfs/etc/pacman.conf`: section renamed
`[Breadway.os.git.breadway.dev]` → `[breadway]` (matches breadway.db),
`Server = https://dl.breadway.dev/arch/$arch`, `SigLevel = Required`.
The old "Forgejo has no db sigs / KEYS.asc is not a repo key / do NOT
flip" comments are gone — both are now false.
- `iso/airootfs/etc/pacman.d/breadway-repo.asc`: the public key, baked
into the image.
- `build-local.sh`: trust the key in the build host's pacman keyring
before mkarchiso (so pacstrap can verify [breadway] while assembling
the airootfs); drop the now-obsolete Forgejo-registry URL rewrite.
- `iso/airootfs/root/customize_airootfs.sh` (new): trust the key in the
image keyring so the live medium — and, via calamares unpackfs, the
installed target — verify [breadway]. (archiso warns this hook is
deprecated; there is no replacement for "add a repo key to the image
keyring" and BOS ships no pacman-init.service.)
- `calamares/post-install.sh`: `pacman-key --add` + `--lsign-key` the
BOS key in the target chroot as a fallback (unpackfs can skip
/etc/pacman.d/gnupg).
- README.md / DESIGN.md / docs/signed-repo.md updated.
NOT yet done: build the ISO (`sudo ./build-local.sh`) and VM-verify
`pacman -Sy` + a `[breadway]` install with no signature prompt, on both
the live medium and a fresh install. The build-time keyring path
(pacstrap -G vs host keyring vs customize_airootfs) may need a tweak
once the real build runs.
BOS opts in to bakery's system prefix so desktop apps live on @
and ride snapper/grub-btrfs snapshots. The builder home stays
~/.local; build-local.sh copies bins, share/data, and user units
onto the image. Per-user installed.json and the index cache stay
in skel. Recovery is still grub-btrfs, not snapper rollback.
The tagged ISO workflow fetched bos-settings/src/Cargo.toml from the
dev branch (404 after the Tauri split) and cargo-built bread-theme.
bread-theme 0.7.1 is already on the stable index. Stage required bins,
units, breadhelp content, and desktop/license files from the
minisign-verified index instead; optional bread-emit/module-host skip
until bread publishes them. Fail the bake if a required bin is missing.
Derive BREAD_BINS from iso/bread-lockfile.toml and fail the bake when a
listed binary or breadhelp content is missing. Bake bakery share files
and drop breadcast from the copied installed.json. Add WebKitGTK 4.1 for
Tauri bos-settings, remove rustup, and rewrite README/DESIGN to match the
ISO+skel tree.
- .gitignore: ignore the /out/ ISO build dir
- bos-settings: use expect() with messages over unwrap() for piped stdio;
drop a stray blank line
- pacman.conf: reword the SigLevel=Never TODO as a future-improvement note
