From f6377d2f872db13c1a5b099f1017d424730cabff Mon Sep 17 00:00:00 2001 From: Emir Beganovic Date: Fri, 9 Oct 2026 20:20:30 +0200 Subject: [PATCH] ISO build: require signatures on Omarchy's own packages The three configs the build downloads the ISO's packages with had "SigLevel = Optional TrustAll" on [omarchy]. Optional checks a signature when there is one and accepts a package that has none; TrustAll accepts any key in the keyring. So a package whose .sig was missing went onto the ISO unchecked. Without the line, [omarchy] follows the configs' own default, Required DatabaseOptional, which is what an installed system uses. Every package in the repository is signed, and the build adds and signs the release key before its first download, so nothing else changes. [arch-mact2] keeps its own SigLevel = Never: those packages are unsigned upstream. --- configs/pacman-online-edge.conf | 1 - configs/pacman-online-rc.conf | 1 - configs/pacman-online-stable.conf | 1 - 3 files changed, 3 deletions(-) diff --git a/configs/pacman-online-edge.conf b/configs/pacman-online-edge.conf index 8f280f4..78bd534 100644 --- a/configs/pacman-online-edge.conf +++ b/configs/pacman-online-edge.conf @@ -14,7 +14,6 @@ SigLevel = Required DatabaseOptional LocalFileSigLevel = Optional [omarchy] -SigLevel = Optional TrustAll Server = https://pkgs.omarchy.org/edge/$arch [core] diff --git a/configs/pacman-online-rc.conf b/configs/pacman-online-rc.conf index f9f9020..ad32bf3 100644 --- a/configs/pacman-online-rc.conf +++ b/configs/pacman-online-rc.conf @@ -14,7 +14,6 @@ SigLevel = Required DatabaseOptional LocalFileSigLevel = Optional [omarchy] -SigLevel = Optional TrustAll Server = https://pkgs.omarchy.org/rc/$arch [core] diff --git a/configs/pacman-online-stable.conf b/configs/pacman-online-stable.conf index 9589e62..2fced75 100644 --- a/configs/pacman-online-stable.conf +++ b/configs/pacman-online-stable.conf @@ -14,7 +14,6 @@ SigLevel = Required DatabaseOptional LocalFileSigLevel = Optional [omarchy] -SigLevel = Optional TrustAll Server = https://pkgs.omarchy.org/stable/$arch [core]