From 5afc9e14951d529688370f87f5c189a003fc8037 Mon Sep 17 00:00:00 2001
From: Ryan Hughes <ryan@heyoodle.com>
Date: Mon, 24 Aug 2026 12:53:14 -0400
Subject: [PATCH] Revert "Require signed packages from the Omarchy repository"

Reverts 39cffb8f, which landed on quattro through an accidental direct
push. The change returns for review as a pull request.
---
 default/pacman/pacman-edge.conf   |  1 +
 default/pacman/pacman-rc.conf     |  1 +
 default/pacman/pacman-stable.conf |  1 +
 migrations/1787589206.sh          | 20 --------------------
 4 files changed, 3 insertions(+), 20 deletions(-)
 delete mode 100644 migrations/1787589206.sh

diff --git a/default/pacman/pacman-edge.conf b/default/pacman/pacman-edge.conf
index a968d26d..d83befca 100644
--- a/default/pacman/pacman-edge.conf
+++ b/default/pacman/pacman-edge.conf
@@ -26,6 +26,7 @@ Include = /etc/pacman.d/mirrorlist
 Include = /etc/pacman.d/mirrorlist
 
 [omarchy]
+SigLevel = Optional TrustAll
 Server = https://pkgs.omarchy.org/edge/$arch
 
 # Repositories for debug symbol packages.
diff --git a/default/pacman/pacman-rc.conf b/default/pacman/pacman-rc.conf
index cf8ca40a..50d2e498 100644
--- a/default/pacman/pacman-rc.conf
+++ b/default/pacman/pacman-rc.conf
@@ -26,4 +26,5 @@ Include = /etc/pacman.d/mirrorlist
 Include = /etc/pacman.d/mirrorlist
 
 [omarchy]
+SigLevel = Optional TrustAll
 Server = https://pkgs.omarchy.org/edge/$arch
diff --git a/default/pacman/pacman-stable.conf b/default/pacman/pacman-stable.conf
index 7e4b5538..5dafbc84 100644
--- a/default/pacman/pacman-stable.conf
+++ b/default/pacman/pacman-stable.conf
@@ -26,4 +26,5 @@ Include = /etc/pacman.d/mirrorlist
 Include = /etc/pacman.d/mirrorlist
 
 [omarchy]
+SigLevel = Optional TrustAll
 Server = https://pkgs.omarchy.org/stable/$arch
diff --git a/migrations/1787589206.sh b/migrations/1787589206.sh
deleted file mode 100644
index 928905a9..00000000
--- a/migrations/1787589206.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-echo "Require signed packages from the Omarchy repository"
-
-# The [omarchy] repo predates the Omarchy packaging key, so existing installs
-# carry a SigLevel override that also accepts unsigned packages. Packages are
-# signed now, so drop the override and let the repo inherit the global
-# SigLevel = Required DatabaseOptional like every other repo. Machine-wide and
-# self-detecting, so another user's rerun no-ops.
-omarchy_sig_override='SigLevel = Optional TrustAll'
-
-if [[ -f /etc/pacman.conf ]] &&
-  sed -n '/^\[omarchy\]/,/^\[/p' /etc/pacman.conf | grep -qxF "$omarchy_sig_override"; then
-  # Requiring signatures with an untrusted packaging key would fail every
-  # omarchy transaction, including the one that could repair it.
-  if omarchy-pkg-missing omarchy-keyring ||
-    ! sudo pacman-key --list-keys 40DFB630FF42BCFFB047046CF0134EE680CAC571 &>/dev/null; then
-    omarchy-update-keyring
-  fi
-
-  sudo sed -i "/^\[omarchy\]/,/^\[/{/^$omarchy_sig_override$/d}" /etc/pacman.conf
-fi