Fix installer keyring and runtime validation #1

Merged

spalencsar merged 1 commit from agent/fix-installer-keyring-runtime into main

2026-07-29 08:31:18 +02:00

spalencsar commented

2026-07-29 08:29:03 +02:00

(Migrated from github.com)

What changed

initialize a persistent Arch Linux Pacman keyring in the installed target
declare Python as a direct Calamares runtime dependency
rebuild stale UrsaOS packages during ISO creation
reject installer packages with unresolved runtime libraries before mkarchiso
extend validation, release checks, changelog, and installer/build documentation

Why

The live-copy install could retain the temporary live keyring, causing unknown trust signature failures after reboot. Separately, an outdated installer package could be selected for a new ISO and link against an obsolete Python ABI, preventing Calamares from opening.

Impact

Fresh targets can perform verified Arch package transactions normally, and ISO builds fail early instead of shipping a stale or ABI-incomplete Calamares binary.

Validation

./scripts/validate-profile.sh
bash -n scripts/build-iso.sh scripts/validate-profile.sh packages/pkgbuilds/ursaos-installer/prepare-target
git diff --check
built ursaos-installer 0.1.0-12; extracted Calamares runtime links resolve
built ursaos-2026.07.29-x86_64.iso
SHA-256: a9e32809bfc26fc8fc92fb56289892dd64f50f32e875bbf0b129920a3fa1f820
BIOS/MBR install, reboot, login, Niri+DMS, and target sudo pacman -Syu validated during development

## What changed - initialize a persistent Arch Linux Pacman keyring in the installed target - declare Python as a direct Calamares runtime dependency - rebuild stale UrsaOS packages during ISO creation - reject installer packages with unresolved runtime libraries before `mkarchiso` - extend validation, release checks, changelog, and installer/build documentation ## Why The live-copy install could retain the temporary live keyring, causing `unknown trust` signature failures after reboot. Separately, an outdated installer package could be selected for a new ISO and link against an obsolete Python ABI, preventing Calamares from opening. ## Impact Fresh targets can perform verified Arch package transactions normally, and ISO builds fail early instead of shipping a stale or ABI-incomplete Calamares binary. ## Validation - `./scripts/validate-profile.sh` - `bash -n scripts/build-iso.sh scripts/validate-profile.sh packages/pkgbuilds/ursaos-installer/prepare-target` - `git diff --check` - built `ursaos-installer 0.1.0-12`; extracted Calamares runtime links resolve - built `ursaos-2026.07.29-x86_64.iso` - SHA-256: `a9e32809bfc26fc8fc92fb56289892dd64f50f32e875bbf0b129920a3fa1f820` - BIOS/MBR install, reboot, login, Niri+DMS, and target `sudo pacman -Syu` validated during development

👍 1