ISO build: require signatures on Omarchy's own packages
The three configs the build downloads the ISO's packages with had "SigLevel = Optional TrustAll" on [omarchy]. Optional checks a signature when there is one and accepts a package that has none; TrustAll accepts any key in the keyring. So a package whose .sig was missing went onto the ISO unchecked. Without the line, [omarchy] follows the configs' own default, Required DatabaseOptional, which is what an installed system uses. Every package in the repository is signed, and the build adds and signs the release key before its first download, so nothing else changes. [arch-mact2] keeps its own SigLevel = Never: those packages are unsigned upstream.
This commit is contained in:
1 parent
8b17699997
commit
f6377d2f87
3 files changed
-3
No files matched your search
@@ -14,7 +14,6 @@ SigLevel = Required DatabaseOptional
|
||||
LocalFileSigLevel = Optional
|
||||
|
||||
[omarchy]
|
||||
SigLevel = Optional TrustAll
|
||||
Server = https://pkgs.omarchy.org/edge/$arch
|
||||
|
||||
[core]
|
||||
|
||||
@@ -14,7 +14,6 @@ SigLevel = Required DatabaseOptional
|
||||
LocalFileSigLevel = Optional
|
||||
|
||||
[omarchy]
|
||||
SigLevel = Optional TrustAll
|
||||
Server = https://pkgs.omarchy.org/rc/$arch
|
||||
|
||||
[core]
|
||||
|
||||
@@ -14,7 +14,6 @@ SigLevel = Required DatabaseOptional
|
||||
LocalFileSigLevel = Optional
|
||||
|
||||
[omarchy]
|
||||
SigLevel = Optional TrustAll
|
||||
Server = https://pkgs.omarchy.org/stable/$arch
|
||||
|
||||
[core]
|
||||
|
||||
Reference in new issue
Block a user