ISO: flip [breadway] to the signed dl.breadway.dev/arch repo #5

Merged

Breadway merged 1 commit from fix/breadway-repo-signing into main

2026-08-31 19:18:51 +08:00

Breadway commented

2026-08-31 18:23:16 +08:00

Owner

Executes the "After the signed repo exists" plan in docs/signed-repo.md. Not merged-ready until the ISO build + VM verify is done (I can't run sudo ./build-local.sh headless).

The signed repo is live (verified)

https://dl.breadway.dev/arch/x86_64/ serves breadway.db + .files + every .pkg.tar.zst with a detached .sig — all GPG-good against KEYS.asc (56203B86A110695AE7F310934AF3323D678EB5E2, releases@breadway.dev). Rebuilt from the Forgejo Arch registry by signed-repo.yml + scripts/ci-publish-signed-repo.sh. 6 packages: breadlock, calamares, bibata-cursor-theme-bin, yay-bin, zen-browser-bin, zsh-theme-powerlevel10k.

Changes

iso/pacman.conf + iso/airootfs/etc/pacman.conf: section [Breadway.os.git.breadway.dev] → [breadway] (matches breadway.db), Server = https://dl.breadway.dev/arch/$arch, SigLevel = Required. The "Forgejo has no db sigs / KEYS.asc is not a repo key / do NOT flip" comments are removed — both claims are now false (same key signs SHA256SUMS and the repo).
iso/airootfs/etc/pacman.d/breadway-repo.asc (new): the public key baked into the image.
build-local.sh: pacman-key --add + --lsign-key the key into the build host keyring before mkarchiso; drop the obsolete Forgejo-registry URL rewrite (CI_BUILD branch).
iso/airootfs/root/customize_airootfs.sh (new): trust the key in the image keyring → live medium + (via calamares unpackfs) the installed target. archiso prints a deprecation warning for this hook but there's no replacement for "add a repo key to the image keyring" and BOS ships no pacman-init.service.
calamares/post-install.sh: pacman-key --add + --lsign-key in the target chroot as a fallback (unpackfs can skip /etc/pacman.d/gnupg).
README / DESIGN / docs/signed-repo.md updated to "live".

You need to do

sudo ./build-local.sh          # or sudo FAST_BUILD=1 ./build-local.sh

then in a VM off the fresh ISO:

sudo pacman -Sy                     # fetches breadway.db + .sig, no signature error
sudo pacman -S --noconfirm yay-bin  # installs, no key prompt

then run the installer and sudo pacman -Sy again on the installed system.

Likely tweak point: the build-time keyring. mkarchiso here uses pacstrap -G (no host-keyring copy) and there's no gpg_publickey path var in this mkarchiso version — if customize_airootfs.sh runs after [breadway] packages are pacstrapped, the build will fail verifying them before the key is trusted. If so, the fix is to trust the key earlier (a pacman.d/gnupg prepopulated in the profile, or a pre-pacstrap hook in build-local.sh pointing pacstrap at the host keyring with -P/without -G). The VM/build run will show which.

Executes the "After the signed repo exists" plan in `docs/signed-repo.md`. **Not merged-ready until the ISO build + VM verify is done** (I can't run `sudo ./build-local.sh` headless). ## The signed repo is live (verified) `https://dl.breadway.dev/arch/x86_64/` serves `breadway.db` + `.files` + **every** `.pkg.tar.zst` with a detached `.sig` — all GPG-good against `KEYS.asc` (`56203B86A110695AE7F310934AF3323D678EB5E2`, `releases@breadway.dev`). Rebuilt from the Forgejo Arch registry by `signed-repo.yml` + `scripts/ci-publish-signed-repo.sh`. 6 packages: breadlock, calamares, bibata-cursor-theme-bin, yay-bin, zen-browser-bin, zsh-theme-powerlevel10k. ## Changes - **`iso/pacman.conf`** + **`iso/airootfs/etc/pacman.conf`**: section `[Breadway.os.git.breadway.dev]` → `[breadway]` (matches `breadway.db`), `Server = https://dl.breadway.dev/arch/$arch`, `SigLevel = Required`. The "Forgejo has no db sigs / KEYS.asc is not a repo key / do NOT flip" comments are **removed — both claims are now false** (same key signs SHA256SUMS *and* the repo). - **`iso/airootfs/etc/pacman.d/breadway-repo.asc`** (new): the public key baked into the image. - **`build-local.sh`**: `pacman-key --add` + `--lsign-key` the key into the *build host* keyring before mkarchiso; drop the obsolete Forgejo-registry URL rewrite (`CI_BUILD` branch). - **`iso/airootfs/root/customize_airootfs.sh`** (new): trust the key in the *image* keyring → live medium + (via calamares `unpackfs`) the installed target. archiso prints a deprecation warning for this hook but there's no replacement for "add a repo key to the image keyring" and BOS ships no `pacman-init.service`. - **`calamares/post-install.sh`**: `pacman-key --add` + `--lsign-key` in the target chroot as a fallback (unpackfs can skip `/etc/pacman.d/gnupg`). - README / DESIGN / docs/signed-repo.md updated to "live". ## You need to do ```sh sudo ./build-local.sh # or sudo FAST_BUILD=1 ./build-local.sh ``` then in a VM off the fresh ISO: ```sh sudo pacman -Sy # fetches breadway.db + .sig, no signature error sudo pacman -S --noconfirm yay-bin # installs, no key prompt ``` then run the installer and `sudo pacman -Sy` again on the installed system. **Likely tweak point:** the build-time keyring. mkarchiso here uses `pacstrap -G` (no host-keyring copy) and there's no `gpg_publickey` path var in this mkarchiso version — if `customize_airootfs.sh` runs *after* `[breadway]` packages are pacstrapped, the build will fail verifying them before the key is trusted. If so, the fix is to trust the key earlier (a `pacman.d/gnupg` prepopulated in the profile, or a pre-pacstrap hook in `build-local.sh` pointing `pacstrap` at the host keyring with `-P`/without `-G`). The VM/build run will show which.

Breadway added 2 commits 2026-08-31 18:23:16 +08:00

iso: add external-monitors bread module for zero-config docking b38bbbac1a

ISO: flip [breadway] to the signed dl.breadway.dev/arch repo 98cfe9d60b

The signed repo is live: https://dl.breadway.dev/arch/x86_64/ serves
breadway.db + .files + every .pkg.tar.zst with a detached .sig from the
BOS release key (56203B86A110695AE7F310934AF3323D678EB5E2 = KEYS.asc),
rebuilt from the Forgejo Arch registry by signed-repo.yml +
scripts/ci-publish-signed-repo.sh. Verified: db/pkg sigs all GPG-good
against KEYS.asc.

Executes the "After the signed repo exists" plan in docs/signed-repo.md:

- `iso/pacman.conf` + `iso/airootfs/etc/pacman.conf`: section renamed
  `[Breadway.os.git.breadway.dev]` → `[breadway]` (matches breadway.db),
  `Server = https://dl.breadway.dev/arch/$arch`, `SigLevel = Required`.
  The old "Forgejo has no db sigs / KEYS.asc is not a repo key / do NOT
  flip" comments are gone — both are now false.
- `iso/airootfs/etc/pacman.d/breadway-repo.asc`: the public key, baked
  into the image.
- `build-local.sh`: trust the key in the build host's pacman keyring
  before mkarchiso (so pacstrap can verify [breadway] while assembling
  the airootfs); drop the now-obsolete Forgejo-registry URL rewrite.
- `iso/airootfs/root/customize_airootfs.sh` (new): trust the key in the
  image keyring so the live medium — and, via calamares unpackfs, the
  installed target — verify [breadway]. (archiso warns this hook is
  deprecated; there is no replacement for "add a repo key to the image
  keyring" and BOS ships no pacman-init.service.)
- `calamares/post-install.sh`: `pacman-key --add` + `--lsign-key` the
  BOS key in the target chroot as a fallback (unpackfs can skip
  /etc/pacman.d/gnupg).
- README.md / DESIGN.md / docs/signed-repo.md updated.

NOT yet done: build the ISO (`sudo ./build-local.sh`) and VM-verify
`pacman -Sy` + a `[breadway]` install with no signature prompt, on both
the live medium and a fresh install. The build-time keyring path
(pacstrap -G vs host keyring vs customize_airootfs) may need a tweak
once the real build runs.