✨ feat(build): bundle every region profile offline

- ✨ one iso serves every region, so regional packages ride in the offline repo without being installed by default
- 🔒 verify each regional keyring through arch's trust chain before downloading its packages

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QuATgjU4mnqpqSLAKMQ14g

builder/build-iso.sh

@@ -41,11 +41,14 @@ pacman-key --lsign-key 40DFB630FF42BCFFB047046CF0134EE680CAC571
 pacman --config /configs/pacman-online-${OMARCHY_MIRROR}.conf --noconfirm -Sy omarchy-keyring
 pacman-key --populate omarchy
 
-# Append the [omarchy] repo to the container's /etc/pacman.conf so subsequent
-# tools (notably makepkg in build-omarchy-packages.sh) can resolve omarchy-
-# only build deps like limine-snapper-sync and limine-mkinitcpio-hook.
+# Put OPR first in the container too so makepkg resolves the same overrides
+# as the online installer configuration.
 if ! grep -q '^\[omarchy\]' /etc/pacman.conf; then
-  awk '/^\[omarchy\]/,/^$/' /configs/pacman-online-${OMARCHY_MIRROR}.conf >> /etc/pacman.conf
+  opr_section=$(awk '/^\[omarchy\]/,/^$/' /configs/pacman-online-${OMARCHY_MIRROR}.conf)
+  awk -v opr="$opr_section" '/^\[core\]/ { print opr; print "" } { print }' \
+    /etc/pacman.conf >/tmp/pacman-opr-first.conf
+  install -m 644 /tmp/pacman-opr-first.conf /etc/pacman.conf
+  rm -f /tmp/pacman-opr-first.conf
 fi
 
 # Build locations
@@ -139,6 +142,7 @@ sed -i -E '/^(linux|broadcom-wl)$/d' "$build_cache_dir/packages.x86_64"
 # already in the mirror and we filter them out below. Without it, pacman -Syw
 # pulls the published omarchy* from the network mirror like any other package.
 if [[ -d /omarchy-source ]]; then
+  runtime_root=/omarchy-source
   base_pkg_lists=(/omarchy-source/install/omarchy-base.packages /omarchy-source/install/omarchy-other.packages)
   setup_form=/omarchy-source/install/provisioning/setup-form.sh
 else
@@ -161,6 +165,9 @@ else
   # build here (set -e) with a bare "Not found in archive" instead of the
   # actionable error below.
   bsdtar -xf "$omarchy_pkg" -C /tmp/omarchy-pkglists usr/share/omarchy/install/provisioning/setup-form.sh 2>/dev/null || true
+  # Likewise optional: a runtime predating region profiles ships none.
+  bsdtar -xf "$omarchy_pkg" -C /tmp/omarchy-pkglists usr/share/omarchy/default/regions 2>/dev/null || true
+  runtime_root=/tmp/omarchy-pkglists/usr/share/omarchy
   setup_form=/tmp/omarchy-pkglists/usr/share/omarchy/install/provisioning/setup-form.sh
 fi
 
@@ -187,6 +194,13 @@ if [[ ! -f $setup_form ]]; then
 fi
 cp "$setup_form" "$build_cache_dir/airootfs/usr/share/omarchy-iso/setup-form.sh"
 
+# Every region's packages ride in the offline mirror, and its community
+# repositories join a writable copy of the online config to download them.
+online_config=/tmp/omarchy-pacman-online.conf
+cp "/configs/pacman-online-${OMARCHY_MIRROR}.conf" "$online_config"
+bash /builder/prepare-regions.sh "$runtime_root/default/regions" \
+  "$build_cache_dir/airootfs/usr/share/omarchy-iso" "$online_config"
+
 # Collect every package we want available in the offline mirror.
 declare -a all_packages
 mapfile -t all_packages < <(
@@ -194,6 +208,9 @@ mapfile -t all_packages < <(
     cat "$build_cache_dir/packages.x86_64"
     grep -hv '^#\|^$' "${base_pkg_lists[@]}"
     grep -hv '^#\|^$' /builder/archinstall.packages
+    # Downloaded but not installed: the installer adds a region's packages
+    # only to targets in that region.
+    grep -hsv '^#\|^$' "$build_cache_dir"/airootfs/usr/share/omarchy-iso/regions/*/packages || true
     # Always include the selected Omarchy packages so the target install can
     # find the runtime and companion packages in the offline mirror.
     printf '%s\n' "$OMARCHY_RUNTIME_PACKAGE" "$OMARCHY_SETTINGS_PACKAGE" "$OMARCHY_NVIM_PACKAGE"
@@ -232,7 +249,7 @@ fi
 
 mkdir -p /tmp/offlinedb
 download_offline_packages() {
-  pacman --config /configs/pacman-online-${OMARCHY_MIRROR}.conf --noconfirm -Syw \
+  pacman --config "$online_config" --noconfirm -Syw \
     "${all_packages[@]}" --cachedir "$offline_mirror_dir/" --dbpath /tmp/offlinedb --needed
 }
 
@@ -250,7 +267,7 @@ fi
 # newest version of every cached package name) removes packages that have left
 # the lists or dependency closure, such as an old Electron major version.
 if ! resolved_package_files="$(
-  pacman --config "/configs/pacman-online-${OMARCHY_MIRROR}.conf" --noconfirm \
+  pacman --config "$online_config" --noconfirm \
     --dbpath /tmp/offlinedb -S --print --print-format '%f' "${all_packages[@]}"
 )"; then
   echo "ERROR: could not resolve the package files required by the offline mirror" >&2

builder/prepare-regions.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+
+# Ship every region profile from the bundled runtime, so one ISO serves every
+# region. The installer picks a profile from the target's timezone; this only
+# stages the profiles and makes their packages downloadable. Repository
+# defaults stay in the runtime, not in a second set of ISO-specific templates.
+set -euo pipefail
+
+regions="$1"
+iso_payload="$2"
+online_config="$3"
+
+# A runtime predating region profiles ships none; the ISO then installs
+# global targets only, exactly as before.
+if [[ ! -d $regions ]]; then
+  echo "Runtime ships no region profiles; every install will be global."
+  exit 0
+fi
+
+cp -a "$regions" "$iso_payload/regions"
+
+for profile in "$regions"/*/; do
+  # Only the community repositories are needed to download regional packages.
+  # Keep the channel's build mirrors intact; target mirrors are set later by
+  # the runtime's own pacman finalizer.
+  printf '\n' >> "$online_config"
+  cat "$profile/pacman/pacman.conf.append" >> "$online_config"
+
+  # Each keyring package must be signed by a key Arch already trusts. Do not
+  # bootstrap trust from an unchecked keyserver response or disable signatures.
+  # https://github.com/archlinuxcn/repo#usage
+  mapfile -t keyring_packages < <(grep -hv '^#\|^$' "$profile/packages" | grep -- '-keyring$' || true)
+  if (( ${#keyring_packages[@]} > 0 )); then
+    pacman --config "$online_config" --noconfirm -Sy --needed "${keyring_packages[@]}"
+    pacman-key --populate "${keyring_packages[@]%-keyring}"
+  fi
+done

configs/pacman-online-edge.conf

@@ -13,6 +13,10 @@ ParallelDownloads = 5
 SigLevel    = Required DatabaseOptional
 LocalFileSigLevel = Optional
 
+[omarchy]
+SigLevel = Optional TrustAll
+Server = https://pkgs.omarchy.org/edge/$arch
+
 [core]
 Server = https://mirror.omarchy.org/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
@@ -25,10 +29,6 @@ Include = /etc/pacman.d/mirrorlist
 Server = https://mirror.omarchy.org/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
 
-[omarchy]
-SigLevel = Optional TrustAll
-Server = https://pkgs.omarchy.org/edge/$arch
-
 [arch-mact2]
 Server = https://mirror.funami.tech/arch-mact2/os/x86_64
 Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release

configs/pacman-online-rc.conf

@@ -13,6 +13,10 @@ ParallelDownloads = 5
 SigLevel    = Required DatabaseOptional
 LocalFileSigLevel = Optional
 
+[omarchy]
+SigLevel = Optional TrustAll
+Server = https://pkgs.omarchy.org/rc/$arch
+
 [core]
 Server = https://rc-mirror.omarchy.org/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
@@ -25,10 +29,6 @@ Include = /etc/pacman.d/mirrorlist
 Server = https://rc-mirror.omarchy.org/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
 
-[omarchy]
-SigLevel = Optional TrustAll
-Server = https://pkgs.omarchy.org/rc/$arch
-
 [arch-mact2]
 Server = https://mirror.funami.tech/arch-mact2/os/x86_64
 Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release

configs/pacman-online-stable.conf

@@ -13,6 +13,10 @@ ParallelDownloads = 5
 SigLevel    = Required DatabaseOptional
 LocalFileSigLevel = Optional
 
+[omarchy]
+SigLevel = Optional TrustAll
+Server = https://pkgs.omarchy.org/stable/$arch
+
 [core]
 Server = https://stable-mirror.omarchy.org/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
@@ -25,10 +29,6 @@ Include = /etc/pacman.d/mirrorlist
 Server = https://stable-mirror.omarchy.org/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
 
-[omarchy]
-SigLevel = Optional TrustAll
-Server = https://pkgs.omarchy.org/stable/$arch
-
 [arch-mact2]
 Server = https://mirror.funami.tech/arch-mact2/os/x86_64
 Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release