yay (yay-bin, AUR-only like calamares/bibata) republished to [breadway] via
the same PKGBUILD + Forgejo workflow pattern, so users can reach the wider
AUR beyond bakery's bread ecosystem.
Disk encryption: Calamares' partition module already has LUKS support
enabled by default, but the checkbox led nowhere — no cryptsetup on the
live/target image, no mkinitcpio encrypt hook, no GRUB cryptodisk wiring.
An encrypted install would partition fine and then never boot. Added
cryptsetup, pinned luksGeneration to luks1 (GRUB doesn't support LUKS2 +
Argon2id), and post-install.sh now detects an encrypted root (lsblk TYPE
== crypt) and conditionally adds the encrypt hook + GRUB_ENABLE_CRYPTODISK +
--modules="cryptodisk luks luks2" on both grub-install passes. No effect on
a normal unencrypted install.
Secure Boot: self-signed via sbctl (shipped in packages.x86_64). BOS can't
ship a Microsoft-signed shim without going through Microsoft's own paid
UEFI CA process, so post-install.sh enrolls BOS's own keys automatically
only when the firmware is already in Setup Mode (sbctl status --json),
signs the kernel/bootloader, and leaves it alone otherwise — sbctl's own
pacman hook re-signs on every future kernel/GRUB update, no further
wiring needed.
Release signing: generated a dedicated Ed25519 "BOS Release Signing" key
(not reused from anything else), stored as the GPG_PRIVATE_KEY Forgejo
Actions secret. release-iso.yml now generates SHA256SUMS and a detached
SHA256SUMS.asc signature alongside every ISO upload; public key committed
at KEYS.asc with verification instructions in the README.
README updated: fixed a stale "greetd + tuigreet" line (breadgreet since
round 3), documented yay/encryption/secure-boot/verification.
Boot-critical (each confirmed with a real boot/install cycle, not just
code review):
- Live ISO's liveuser shell is zsh, but Hyprland autostart was written
to .bash_profile (never runs) — moved to .zprofile, and switched to
start-hyprland (Hyprland's own watchdog wrapper; raw `exec Hyprland`
is no longer the recommended launch method).
- copytoram (self-enables on most real hardware: non-optical boot +
image < 4GiB + enough free RAM) unmounts /run/archiso/bootmnt, which
unpackfs.conf and bos-copy-kernel both hardcoded as their source —
broke the installer outright on real hardware, confirmed by forcing
copytoram=y. Added a resolver step for unpackfs, and switched the
kernel copy to /usr/lib/modules/$(uname -r)/vmlinuz (part of the live
squashfs itself, unaffected by copytoram).
- BIOS installs got no bootloader — post-install.sh only ever ran the
UEFI grub-install path despite BOS shipping bios.syslinux. Added a
BIOS branch with disk auto-detection.
- @snapshots/@log/@cache were never real: iso/partition.conf's
btrfsSubvolumes key isn't part of this Calamares version's partition
module schema at all (same class of bug as the userShell fix below —
silently ignored). Calamares only natively creates @ and @home.
post-install.sh now creates the three subvolumes by hand after
unpackfs, migrates existing /var/log + /var/cache content into them
before mounting over, and adds the fstab entries — verified end to
end on real hardware, including grub-btrfs generating bootable
snapshot menu entries. The unmount step in the existing snapper
create-config dance also gained retry + lazy-unmount fallback after
a real chroot run hit a transient busy-mount race.
- Default shell was bash instead of zsh post-install: users.conf's
top-level `userShell` key isn't part of this Calamares version's
users module schema either — the real key is nested (user.shell).
- graphical-session.target ships RefuseManualStart=yes (systemd
convention), so the earlier attempt to activate it from hyprland.lua
silently failed and breadclipd (WantedBy=graphical-session.target)
never started. Starts breadclipd.service directly instead.
- /etc/os-release was never set (showed "Arch Linux"); live boot never
had quiet/splash/plymouth wired in (raw kernel scroll the whole
time) despite BOS already shipping a complete bread-logo+spinner
plymouth theme for the installed system.
Also: generalized build-local.sh's per-service skel baking (previously
only breadd.service was hand-committed; breadbox-sync/breadmill/
breadclipd never shipped), added the four new bakery packages to
BREAD_BINS, removed the redundant cliphist/fzf clipboard pipeline in
favor of breadclip, mirrored fastfetch's bread-logo config into skel,
and fixed a stale bos-update comment.
