David Heinemeier HanssonandClaude Fable 5
5e80c917ea
Fresh installs on real hardware failed pacstrap with "keyring is not writable" and "required key missing from keyring". The offline repo's SigLevel = Optional TrustAll was not the bypass it appeared to be: Optional verifies whenever a .sig file exists — and every package in the offline mirror ships one — while pacstrap's pacman -r relocates the install root but not GpgDir, so verification runs against the LIVE keyring. That silently made every install depend on archiso's boot-time pacman-init.service having finished: fast in QEMU, minutes-or-never on real hardware, where pacstrap then raced it and lost. The mirror ships inside the ISO, whose integrity is already covered by the airootfs sha512 and the ISO signature, so pacman-level signature verification adds nothing. Set SigLevel = Never so installs never touch the live keyring. The target still gets its own keyring via pacstrap -K plus the archlinux-keyring/omarchy-keyring package hooks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
26 lines
1.0 KiB
Plaintext
26 lines
1.0 KiB
Plaintext
#
|
|
# /etc/pacman.conf
|
|
#
|
|
# See the pacman.conf(5) manpage for option and repository directives
|
|
[options]
|
|
HoldPkg = pacman glibc
|
|
Architecture = auto
|
|
NoProgressBar
|
|
ParallelDownloads = 5
|
|
|
|
# By default, pacman accepts packages signed by keys that its local keyring
|
|
# trusts (see pacman-key and its man page), as well as unsigned packages.
|
|
SigLevel = Required DatabaseOptional
|
|
LocalFileSigLevel = Optional
|
|
|
|
# No signature checks for the offline mirror: it ships inside the ISO, whose
|
|
# integrity is already covered by the airootfs sha512 and the ISO signature.
|
|
# "Optional TrustAll" is NOT a bypass — Optional verifies whenever a .sig file
|
|
# exists (they all do), and pacstrap verifies against the LIVE keyring (pacman
|
|
# -r relocates the root but not GpgDir). That made installs depend on archiso's
|
|
# slow boot-time pacman-init.service having finished, which stalled or failed
|
|
# pacstrap on real hardware with "required key missing from keyring".
|
|
[offline]
|
|
SigLevel = Never
|
|
Server = file:///var/cache/omarchy/mirror/offline/
|