Initialize pacman keys in build containers (#376)

Recreate pacman's local signing key before upgrading packages so keyring install scripts can sign trusted keys. Keep the key out of the builder image and exercise keyring population with a keyless test image.

build/build.sh

@@ -88,6 +88,10 @@ if [[ "$DRY_RUN" != true ]]; then
 
   mkdir -p "$BUILD_OUTPUT_DIR" "$FINAL_OUTPUT_DIR"
 
+  # The image drops pacman's private signing key. Keyring upgrades need a
+  # container-local key to sign newly trusted keys.
+  sudo pacman-key --init || exit 1
+
   # Bring the container up to date before any makedepends are installed. The
   # image is layer-cached, so its glibc drifts behind the mirror while makepkg
   # -s pulls makedepends from the freshly synced database -- a partial upgrade

tests/build-isolation.Dockerfile

@@ -7,5 +7,7 @@ RUN pacman -Syu --noconfirm git jq sudo && \
     printf '#!/bin/bash\nexec /usr/bin/pacman --ask 4 "$@"\n' > /usr/local/bin/pacman-for-makepkg && \
     chmod +x /usr/local/bin/pacman-for-makepkg && \
     mkdir /src && chown builder:builder /src
+# Match the production image, which does not retain pacman's private key.
+RUN rm -rf /etc/pacman.d/gnupg/private-keys-v1.d
 USER builder
 WORKDIR /src

tests/build-isolation.sh

@@ -62,6 +62,17 @@ run_build() {
   "$TEST_ROOT/bin/build" --arch "$TEST_ARCH" --package "$@"
 }
 
+# Exercise keyring population even if the image's keyring package is current.
+fixture keyring ''
+cat >> "$TEST_ROOT/pkgbuilds/keyring/PKGBUILD" <<'EOF'
+check() { sudo pacman-key --populate archlinux; }
+EOF
+run_build keyring > "$TEST_ROOT/keyring.log" 2>&1 || {
+  cat "$TEST_ROOT/keyring.log"
+  exit 1
+}
+printf 'PASS: keyring population works without a private key in the image\n'
+
 fixture omarchy-settings ''
 fixture omarchy "depends=('omarchy-settings=1')"
 fixture omarchy-settings-dev "provides=('omarchy-settings'); conflicts=('omarchy-settings')"