ISO build: require signatures on Omarchy's own packages

The three configs the build downloads the ISO's packages with had
"SigLevel = Optional TrustAll" on [omarchy]. Optional checks a signature
when there is one and accepts a package that has none; TrustAll accepts
any key in the keyring. So a package whose .sig was missing went onto the
ISO unchecked.

Without the line, [omarchy] follows the configs' own default, Required
DatabaseOptional, which is what an installed system uses. Every package
in the repository is signed, and the build adds and signs the release
key before its first download, so nothing else changes. [arch-mact2]
keeps its own SigLevel = Never: those packages are unsigned upstream.
This commit is contained in:
Emir Beganovic committed 2026-10-09 20:20:30 +02:00
1 parent 8b17699997
commit f6377d2f87
3 files changed
-3

No files matched your search

-1
View File
@@ -14,7 +14,6 @@ SigLevel = Required DatabaseOptional
LocalFileSigLevel = Optional
[omarchy]
SigLevel = Optional TrustAll
Server = https://pkgs.omarchy.org/edge/$arch
[core]
-1
View File
@@ -14,7 +14,6 @@ SigLevel = Required DatabaseOptional
LocalFileSigLevel = Optional
[omarchy]
SigLevel = Optional TrustAll
Server = https://pkgs.omarchy.org/rc/$arch
[core]
-1
View File
@@ -14,7 +14,6 @@ SigLevel = Required DatabaseOptional
LocalFileSigLevel = Optional
[omarchy]
SigLevel = Optional TrustAll
Server = https://pkgs.omarchy.org/stable/$arch
[core]