From 1c912658aa7f2defc7de34a9bf40d4d06b4c1e91 Mon Sep 17 00:00:00 2001
From: Kros Dai <xdanger@gmail.com>
Date: Thu, 8 Oct 2026 15:03:31 -0400
Subject: [PATCH] =?UTF-8?q?=E2=9C=A8=20feat(build):=20bundle=20every=20reg?=
 =?UTF-8?q?ion=20profile=20offline?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- :sparkles: one iso serves every region, so regional packages ride in the offline repo without being installed by default
- :lock: verify each regional keyring through arch's trust chain before downloading its packages

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QuATgjU4mnqpqSLAKMQ14g
---
 builder/build-iso.sh       | 18 ++++++++++++++++--
 builder/prepare-regions.sh | 37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 2 deletions(-)
 create mode 100644 builder/prepare-regions.sh

diff --git a/builder/build-iso.sh b/builder/build-iso.sh
index 86ffae4..17a50f7 100755
--- a/builder/build-iso.sh
+++ b/builder/build-iso.sh
@@ -142,6 +142,7 @@ sed -i -E '/^(linux|broadcom-wl)$/d' "$build_cache_dir/packages.x86_64"
 # already in the mirror and we filter them out below. Without it, pacman -Syw
 # pulls the published omarchy* from the network mirror like any other package.
 if [[ -d /omarchy-source ]]; then
+  runtime_root=/omarchy-source
   base_pkg_lists=(/omarchy-source/install/omarchy-base.packages /omarchy-source/install/omarchy-other.packages)
   setup_form=/omarchy-source/install/provisioning/setup-form.sh
 else
@@ -164,6 +165,9 @@ else
   # build here (set -e) with a bare "Not found in archive" instead of the
   # actionable error below.
   bsdtar -xf "$omarchy_pkg" -C /tmp/omarchy-pkglists usr/share/omarchy/install/provisioning/setup-form.sh 2>/dev/null || true
+  # Likewise optional: a runtime predating region profiles ships none.
+  bsdtar -xf "$omarchy_pkg" -C /tmp/omarchy-pkglists usr/share/omarchy/default/regions 2>/dev/null || true
+  runtime_root=/tmp/omarchy-pkglists/usr/share/omarchy
   setup_form=/tmp/omarchy-pkglists/usr/share/omarchy/install/provisioning/setup-form.sh
 fi
 
@@ -190,6 +194,13 @@ if [[ ! -f $setup_form ]]; then
 fi
 cp "$setup_form" "$build_cache_dir/airootfs/usr/share/omarchy-iso/setup-form.sh"
 
+# Every region's packages ride in the offline mirror, and its community
+# repositories join a writable copy of the online config to download them.
+online_config=/tmp/omarchy-pacman-online.conf
+cp "/configs/pacman-online-${OMARCHY_MIRROR}.conf" "$online_config"
+bash /builder/prepare-regions.sh "$runtime_root/default/regions" \
+  "$build_cache_dir/airootfs/usr/share/omarchy-iso" "$online_config"
+
 # Collect every package we want available in the offline mirror.
 declare -a all_packages
 mapfile -t all_packages < <(
@@ -197,6 +208,9 @@ mapfile -t all_packages < <(
     cat "$build_cache_dir/packages.x86_64"
     grep -hv '^#\|^$' "${base_pkg_lists[@]}"
     grep -hv '^#\|^$' /builder/archinstall.packages
+    # Downloaded but not installed: the installer adds a region's packages
+    # only to targets in that region.
+    grep -hsv '^#\|^$' "$build_cache_dir"/airootfs/usr/share/omarchy-iso/regions/*/packages || true
     # Always include the selected Omarchy packages so the target install can
     # find the runtime and companion packages in the offline mirror.
     printf '%s\n' "$OMARCHY_RUNTIME_PACKAGE" "$OMARCHY_SETTINGS_PACKAGE" "$OMARCHY_NVIM_PACKAGE"
@@ -235,7 +249,7 @@ fi
 
 mkdir -p /tmp/offlinedb
 download_offline_packages() {
-  pacman --config /configs/pacman-online-${OMARCHY_MIRROR}.conf --noconfirm -Syw \
+  pacman --config "$online_config" --noconfirm -Syw \
     "${all_packages[@]}" --cachedir "$offline_mirror_dir/" --dbpath /tmp/offlinedb --needed
 }
 
@@ -253,7 +267,7 @@ fi
 # newest version of every cached package name) removes packages that have left
 # the lists or dependency closure, such as an old Electron major version.
 if ! resolved_package_files="$(
-  pacman --config "/configs/pacman-online-${OMARCHY_MIRROR}.conf" --noconfirm \
+  pacman --config "$online_config" --noconfirm \
     --dbpath /tmp/offlinedb -S --print --print-format '%f' "${all_packages[@]}"
 )"; then
   echo "ERROR: could not resolve the package files required by the offline mirror" >&2
diff --git a/builder/prepare-regions.sh b/builder/prepare-regions.sh
new file mode 100644
index 0000000..e7743b0
--- /dev/null
+++ b/builder/prepare-regions.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+# Ship every region profile from the bundled runtime, so one ISO serves every
+# region. The installer picks a profile from the target's timezone; this only
+# stages the profiles and makes their packages downloadable. Repository
+# defaults stay in the runtime, not in a second set of ISO-specific templates.
+set -euo pipefail
+
+regions="$1"
+iso_payload="$2"
+online_config="$3"
+
+# A runtime predating region profiles ships none; the ISO then installs
+# global targets only, exactly as before.
+if [[ ! -d $regions ]]; then
+  echo "Runtime ships no region profiles; every install will be global."
+  exit 0
+fi
+
+cp -a "$regions" "$iso_payload/regions"
+
+for profile in "$regions"/*/; do
+  # Only the community repositories are needed to download regional packages.
+  # Keep the channel's build mirrors intact; target mirrors are set later by
+  # the runtime's own pacman finalizer.
+  printf '\n' >> "$online_config"
+  cat "$profile/pacman/pacman.conf.append" >> "$online_config"
+
+  # Each keyring package must be signed by a key Arch already trusts. Do not
+  # bootstrap trust from an unchecked keyserver response or disable signatures.
+  # https://github.com/archlinuxcn/repo#usage
+  mapfile -t keyring_packages < <(grep -hv '^#\|^$' "$profile/packages" | grep -- '-keyring$' || true)
+  if (( ${#keyring_packages[@]} > 0 )); then
+    pacman --config "$online_config" --noconfirm -Sy --needed "${keyring_packages[@]}"
+    pacman-key --populate "${keyring_packages[@]%-keyring}"
+  fi
+done