build-local.sh permanently changes the build host's pacman keyring #38

New issue

Closed

opened 2026-09-26 07:28:37 +08:00 by Breadway · 2 comments

Breadway commented

2026-09-26 07:28:37 +08:00

Owner

Problem

Lines 60-63 of build-local.sh run pacman-key --init and pacman-key --lsign-key for the BOS release key in the host keyring. From then on the host fully trusts that key for any repo, and the script doesn't mention it.

Fix

Use a throwaway keyring for the build (mkarchiso honours the pacman.conf passed via -C; set GPGDir in the staged iso/pacman.conf to a temporary directory, then init and populate it). Or at minimum, prompt first and print how to undo it (pacman-key --delete 5620...).

Acceptance

After a local build, pacman-key --list-keys 56203B86... on the host shows nothing (or the user explicitly agreed).

Source: BOS v0.6.2 source review (tag dated 2026-09-19); line numbers refer to that tree. Read AGENTS.md first. One issue per branch/PR, match existing style. Add a CHANGELOG [Unreleased] entry.

## Problem Lines 60-63 of `build-local.sh` run `pacman-key --init` and `pacman-key --lsign-key` for the BOS release key in the **host** keyring. From then on the host fully trusts that key for any repo, and the script doesn't mention it. ## Fix Use a throwaway keyring for the build (mkarchiso honours the pacman.conf passed via `-C`; set `GPGDir` in the staged `iso/pacman.conf` to a temporary directory, then init and populate it). Or at minimum, prompt first and print how to undo it (`pacman-key --delete 5620...`). ## Acceptance After a local build, `pacman-key --list-keys 56203B86...` on the host shows nothing (or the user explicitly agreed). --- Source: BOS v0.6.2 source review (tag dated 2026-09-19); line numbers refer to that tree. Read AGENTS.md first. One issue per branch/PR, match existing style. Add a CHANGELOG `[Unreleased]` entry.

Breadway added the

build

security

labels

2026-09-26 07:28:38 +08:00

Breadway referenced this issue from a pull request that will close it,

2026-09-30 02:23:58 +08:00

build-local.sh permanently changes the build host's pacman keyring #58

Breadway commented

2026-09-30 02:24:07 +08:00

Author

Owner

Implemented on fix/bos-38-pacman-keyring: build-local now uses a temporary staged GPGDir, initializes and populates it with Arch and Breadway keys, and removes it on exit. Updated the signed-repo docs and Unreleased changelog.

PR: #58

Verified bash -n build-local.sh, git diff --check, and that pacman-conf resolves the staged GPGDir. Full ISO build was not run per AGENTS.md.

Implemented on `fix/bos-38-pacman-keyring`: build-local now uses a temporary staged GPGDir, initializes and populates it with Arch and Breadway keys, and removes it on exit. Updated the signed-repo docs and Unreleased changelog. PR: https://git.breadway.dev/Breadway/bos/pulls/58 Verified `bash -n build-local.sh`, `git diff --check`, and that `pacman-conf` resolves the staged GPGDir. Full ISO build was not run per AGENTS.md.

Breadway commented

2026-09-30 02:28:30 +08:00

Author

Owner

Reviewed PR #58 against BOS-38.

Acceptance criteria:

A local build must leave the host pacman keyring without the Breadway release key. The staged config sets a temporary GPGDir and removes it on exit in build-local.sh:28-34; keyring initialization, Arch key population, key import, and local signing all use that staged config in build-local.sh:59-68.
Package signature verification during the build must still trust both Arch and Breadway. build-local.sh:61-68 initializes the isolated ring, populates Arch's keys, and trusts the Breadway key there; mkarchiso uses the staged profile config. The documentation now reflects this scope in docs/signed-repo.md:149-156.
Record the user-visible change in the Unreleased changelog. CHANGELOG.md:23-25.

No tests were added. The reported shell syntax, diff whitespace, and pacman-conf GPGDir checks are useful, but do not exercise a complete ISO build or directly assert the host ring remains unchanged after one. The repo's AGENTS.md says not to run an ISO build unless explicitly asked. The implementation is scoped and the pacman-key calls do select the alternate config. I found no code issue in the diff.

CI status is unavailable: BOS has no ordinary PR CI, and Forgejo reports zero commit statuses for head c648283f. The PR is mergeable with no reported conflicts. This is the release-sensitive BOS repo, so I am leaving BOS-38 in REVIEW for the maintainer to land once the local validation is accepted.

Reviewed PR #58 against BOS-38. Acceptance criteria: 1. A local build must leave the host pacman keyring without the Breadway release key. The staged config sets a temporary GPGDir and removes it on exit in `build-local.sh:28-34`; keyring initialization, Arch key population, key import, and local signing all use that staged config in `build-local.sh:59-68`. 2. Package signature verification during the build must still trust both Arch and Breadway. `build-local.sh:61-68` initializes the isolated ring, populates Arch's keys, and trusts the Breadway key there; mkarchiso uses the staged profile config. The documentation now reflects this scope in `docs/signed-repo.md:149-156`. 3. Record the user-visible change in the Unreleased changelog. `CHANGELOG.md:23-25`. No tests were added. The reported shell syntax, diff whitespace, and pacman-conf GPGDir checks are useful, but do not exercise a complete ISO build or directly assert the host ring remains unchanged after one. The repo's AGENTS.md says not to run an ISO build unless explicitly asked. The implementation is scoped and the pacman-key calls do select the alternate config. I found no code issue in the diff. CI status is unavailable: BOS has no ordinary PR CI, and Forgejo reports zero commit statuses for head `c648283f`. The PR is mergeable with no reported conflicts. This is the release-sensitive BOS repo, so I am leaving BOS-38 in REVIEW for the maintainer to land once the local validation is accepted.

Breadway closed this issue

2026-09-30 02:29:02 +08:00