Merge reworked #13690: timezone-derived region and channel mirror prepends
Drop the .cn servers.sed twins, the USTC Arch fallback and the closed #14399 timezone preselection. region.sh follows the installer's marker.
This commit is contained in:
ZacharyZhang-NY committed
commit
4521dac023
25 files changed
+150
-206
No files matched your search
+21
-19
@@ -1,41 +1,43 @@
|
||||
# Regional ISO defaults
|
||||
# Regional defaults
|
||||
|
||||
Regions customize bootstrap defaults independently of update channels. Country identifiers are lowercase, officially assigned ISO 3166-1 alpha-2 codes. `global` is a reserved value for no country-specific additions. Only implemented profiles are accepted; currently `global` and `cn`.
|
||||
Regions customize bootstrap defaults independently of update channels and of the installer's language. Country identifiers are lowercase, officially assigned ISO 3166-1 alpha-2 codes. `global` is a reserved value for no country-specific additions. Only implemented profiles are accepted; currently `global` and `cn`.
|
||||
|
||||
## Runtime configuration
|
||||
|
||||
The ISO installer writes the selected region to `/etc/omarchy/region` before target finalization. It is plain text, not executable configuration. A missing file means `global`; an unsupported value is an error.
|
||||
The ISO installer writes the region it derived to `/etc/omarchy/region` before target finalization. It is plain text, not executable configuration, owned by root and world-readable (`0644`), because refresh renders as the calling user. A missing file means `global`; an unsupported value is an error.
|
||||
|
||||
`omarchy-apply-pacman <stable|rc|edge> [target-root]` restores the selected channel's two pacman templates, runs `default/regions/<region>/pacman/servers.sed` over both when the profile has one, and appends `default/regions/<region>/pacman/{pacman.conf.append,mirrorlist.append}`. Both files are generated before either live file is replaced. Existing files are backed up with `.bak`. Dev uses the edge pacman channel, as before.
|
||||
`omarchy-apply-pacman <stable|rc|edge> [target-root]` restores the selected channel's two pacman templates, appends the region's `pacman.conf.append` to `pacman.conf`, and puts the region's `mirrorlist-<channel>.prepend` ahead of the channel's mirrorlist. Both files are generated before either live file is replaced. Existing files are backed up with `.bak`. Dev uses the edge pacman channel, as before.
|
||||
|
||||
Both installation finalization and `omarchy-refresh-pacman` use this command. Explicit refreshes and channel changes restore regional defaults; ordinary updates do not enforce them. The existing `pre-refresh-pacman` user hook runs after regeneration and before the update, so users can maintain overrides there. Switching to the dev channel refuses a checkout that lacks this machine's region profile, because that checkout's own refresh would otherwise drop the regional repositories. Users can edit the files directly or set the region to `global` before a refresh to stop applying regional repository defaults. This does not uninstall packages or rewrite anything in existing home directories.
|
||||
|
||||
The China profile's `servers.sed` puts a `.omarchy.cn` twin ahead of every `.omarchy.org` server, including the `[omarchy]` package repository, so the channel's own snapshot stays first and `.org` stays the fallback. It then appends USTC's regular Arch mirror and adds the USTC ArchLinuxCN community repository. USTC's mirror, run by the University of Science and Technology of China, and ArchLinuxCN, a long-standing community repository, are the last fallback behind Omarchy's own mirrors in China. USTC is not a stable/RC snapshot replica: missing old packages and newer fallback databases remain compatibility risks.
|
||||
Refresh renders both files as the calling user and gives root only the finished copies, so the sudo boundary stays command-scoped. That boundary does not defend against other code already running as the same user: such code could change the rendered files while refresh waits for the password, as it could alter that user's own environment in other ways.
|
||||
|
||||
## Switching an installed machine
|
||||
The China profile puts Omarchy's China replica of the channel's Arch mirror first (`stable-mirror.omarchy.cn`, `rc-mirror.omarchy.cn`, or `mirror.omarchy.cn` for edge and dev) and keeps the channel's `.org` mirror as the fallback. pacman tries servers in order and moves to the next one when a download fails, including a 404. After three failed downloads from one server, it skips that server for the rest of the transaction. It also takes the package databases from the first server that answers, without comparing them, so the China replicas must carry complete, current metadata. The profile also adds the ArchLinuxCN community repository from USTC's mirror, run by the University of Science and Technology of China. It does not change the `[omarchy]` package repository. ArchLinuxCN is rolling and built against current Arch, while stable and RC are snapshots, so its packages can need newer libraries than a stable machine has.
|
||||
|
||||
`omarchy-region cn|global` switches at runtime. China installs the input method and runs `install/config/region.sh` (region file, developer-mirror drop-ins, locale). It then renders the cn pacman config to a scratch directory, installs the profile `packages` through it, populates the ArchLinuxCN keyring, and only then refreshes pacman on the current channel, so the refresh upgrade already trusts ArchLinuxCN. China also sets up Rime Ice in the person's home. Global undoes the drop-ins and the locale, refreshes pacman back to the channel defaults, and removes the Claude Code API settings from the home; it keeps Rime.
|
||||
## Profile layout
|
||||
|
||||
## ISO builder contract
|
||||
Each profile lives in `default/regions/<code>/`:
|
||||
|
||||
Every ISO carries the China profile, and the person picks the region on the installer's first screen. The companion `omarchy-iso` repository also accepts `--region global|cn`, which only preselects that choice, records it in `/root/omarchy_region`, and adds a region suffix to non-global artifact and offline-cache names. Existing global names remain unchanged.
|
||||
- `timezones`: the timezones that select this region, one per line, with blank lines and `#` comments allowed. List tzdata's backward-compatible names too, since the installer's timezone list includes them. A timezone may belong to at most one profile.
|
||||
- `packages`: additional target packages, in the same format. Every ISO carries every profile's packages in its offline repository; the installer installs them only on targets in that region. A package named `<name>-keyring` is the profile's trust anchor: the builder installs it through Arch's existing trust chain, and a regional target populates the `<name>` keyring.
|
||||
- `pacman/`: `pacman.conf.append`, added after the channel's `pacman.conf`, and one `mirrorlist-<channel>.prepend` per channel (`stable`, `rc`, `edge`), placed ahead of the channel's mirrorlist so the regional mirror is tried first.
|
||||
|
||||
Regional content comes from the same runtime used by the ISO: either the `--local-source` checkout or the downloaded runtime package. A build against a runtime without regional support fails rather than silently producing an ISO without the China choice.
|
||||
## ISO installer contract
|
||||
|
||||
- `packages`: additional target packages, one name per line, with blank lines and `#` comments allowed. The builder bundles them in the offline repository, and the installer installs them only when China is chosen. The source manifest is not modified.
|
||||
- `pacman/`: repository fragments used by the runtime finalizer. The builder also adds the community repository to its writable online config to obtain regional packages; it does not change its Arch channel mirrors.
|
||||
- `timezone` (optional): one zone name, such as `Asia/Shanghai`. The setup form preselects it in the timezone list when the network geo guess is unavailable, which is always the case offline. Both callers pass it: the ISO configurator from its copy of the profile, and first-boot setup from `default/regions/<region>/timezone` for the region in `/etc/omarchy/region`. A successful geo guess still wins, and the person can choose any other zone.
|
||||
- `environment.conf`, `cargo.toml`, `gemrc`: developer-mirror drop-ins that `install/config/region.sh` symlinks into `/etc` and `/.cargo`. `maven-settings.xml` stays in the profile; `MAVEN_ARGS` in `environment.conf` points at it.
|
||||
- `skel/` (optional): new-user defaults. The ISO installer overlays these onto target `/etc/skel` after the base settings packages and before user creation, including installations that defer user creation until first boot. It never overlays existing home directories.
|
||||
There is one ISO for every region. The companion `omarchy-iso` repository reads the profiles from the runtime it bundles, so a region and its repository defaults can never disagree.
|
||||
|
||||
For China, the builder installs `archlinuxcn-keyring` using the existing Arch trust chain before downloading other regional packages. Signature or keyring failures abort the build; no unverified keyserver trust or online signature bypass is added. The keyring is also installed on the target from the offline package set, then initialized and populated before online repositories are enabled. The ISO's existing offline repository verification policy is unchanged.
|
||||
- **Build:** every profile's `packages` go into the offline repository, but not into the base package list. The builder adds each profile's community repository to its writable online config to download them; it does not change its Arch channel mirrors.
|
||||
- **Install:** the installer maps the timezone the user picked to a region through the `timezones` files; a timezone no profile lists means `global`. It shows the result on the summary screen. Unattended installs can set the region explicitly instead. For a regional install it installs the profile's packages from the offline repository and writes `/etc/omarchy/region`; the runtime finalizer then applies the fragments.
|
||||
- **Deferred installs** have no timezone until first boot, so they are `global` unless the unattended configuration sets a region.
|
||||
|
||||
For China, the builder installs `archlinuxcn-keyring` using the existing Arch trust chain before downloading ArchLinuxCN packages. Signature or keyring failures abort the build; no unverified keyserver trust or online signature bypass is added. On a China target the installer installs the keyring from the offline repository, then initializes and populates it before the online repositories are enabled. Global targets never populate ArchLinuxCN's keys. The ISO's existing offline repository verification policy is unchanged.
|
||||
|
||||
## Scope of the China profile
|
||||
|
||||
The China profile provides repository and developer-mirror defaults and preselects `Asia/Shanghai` as the timezone. System language, the Rime input method and China Apps come from `install/config/region.sh` and `manual/52-china.md`, not from the profile files.
|
||||
The China profile provides repository defaults only. Language is a separate installer choice, not part of a region: a Chinese speaker outside China keeps global mirrors, and a China install in English still gets the regional ones.
|
||||
|
||||
## Remaining release validation
|
||||
|
||||
Unit tests cover region/channel independence, package-list augmentation, keyring failure handling, pre-user defaults, generated pacman contents, repeat application, and refresh ordering; refresh itself is exercised only inside the sudo-boundary sandbox. They do not establish live mirror availability, real package trust, or successful offline installation. Before distribution, build from matching local checkouts on an x86_64 builder and run the disposable-VM acceptance workflow in `agents/skills/acceptance-tests.md`.
|
||||
Unit tests cover region/channel independence, the timezone mapping, generated pacman contents, repeat application, and refresh ordering; refresh itself is exercised only inside the sudo-boundary sandbox. They do not establish live mirror availability, real package trust, or successful offline installation. Before distribution, build from matching local checkouts on an x86_64 builder and run the disposable-VM acceptance workflow in `agents/skills/acceptance-tests.md`.
|
||||
|
||||
The China acceptance run must install without network access, boot to a new user, including deferred first-boot user creation, and keep the regional mirrors, repository, marker, and keyring trust through `stable`, `rc`, and `edge` refreshes.
|
||||
The acceptance run must install without network access in both directions: a non-China timezone must produce pacman files byte for byte identical to the channel templates, and `Asia/Shanghai` must produce the China profile, boot to a new user, and keep the regional mirrors, repository, marker, and keyring trust through `stable`, `rc`, and `edge` refreshes.
|
||||
@@ -279,8 +279,6 @@ There is no version file at runtime. `omarchy-version` derives the version from
|
||||
linked checkout, and `omarchy-version-channel` sniffs the mirrorlist and
|
||||
pacman.conf to answer which channel is active.
|
||||
|
||||
On a China machine (`/etc/omarchy/region` holds `cn`), `omarchy-apply-pacman` runs `default/regions/cn/pacman/servers.sed` over the copied templates, which puts a `.omarchy.cn` twin ahead of every `.omarchy.org` server. The update never recopies these files, and a migration that edits a `Server` line must edit its `.cn` twin the same way, as `1788112314.sh` does, so the twins survive every `omarchy update`.
|
||||
|
||||
## Update-related binaries
|
||||
|
||||
This inventory is intentionally opinionated. Some commands are useful as stable
|
||||
|
||||
Reference in new issue
Block a user