fix(installer): keyring race, unattended password, EFI fallback, rebuild cleanup

Found while testing both installers end-to-end in VMs:

- Wait for archiso's pacman-init.service instead of racing it. The installer
  autostarts at login while the live keyring is still being populated
  asynchronously, so every package failed with "signature is unknown trust" /
  "invalid or corrupted package (PGP signature)". Do not run pacman-key --init
  ourselves (corrupts the half-built keyring); wait, then refresh
  archlinux-keyring so an ISO built weeks ago still trusts current keys.
- archbaseos-guided-install.sh: honor the answerfile's password/luks_password
  fields; previously it always prompted interactively, so a documented
  "zero-interaction" netboot/WDS install hung forever with no console.
- Install GRUB to the UEFI removable-media fallback (/EFI/BOOT/BOOTX64.EFI) in
  addition to the NVRAM entry. Without it, an installed disk with empty/cleared
  NVRAM (fresh board, CMOS reset, or a cloned/redeployed image — the whole point
  of this installer) shows "No bootable device". Verified: the disk now boots to
  the login manager with fresh NVRAM.
- build.sh: sudo rm -rf the work dir. mkarchiso runs as root and leaves
  root-owned files if interrupted, so the next plain rm -rf aborted the script
  under set -e before mkarchiso could run.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MUhrcFU8J1Hnf7vNqNxZNi

setup/arch-autoinstall.sh

@@ -207,6 +207,26 @@ fi
 ############################################
 # REQUIRED PACKAGES FOR INSTALL ENVIRONMENT
 ############################################
+# Wait for the live ISO's keyring initialization before any install. archiso
+# initializes the pacman keyring asynchronously at boot via pacman-init.service
+# (master-key generation can take a minute+ in VMs with little entropy), and
+# this installer autostarts at login — racing that service leaves keys
+# unpopulated/untrusted, so every package fails with "signature is unknown
+# trust" / "invalid or corrupted package (PGP signature)". Do NOT run
+# pacman-key --init ourselves here: doing so concurrently with
+# pacman-init.service corrupts the half-built keyring. Wait, then refresh
+# archlinux-keyring so an ISO built weeks ago still trusts current packager keys.
+if systemctl cat pacman-init.service &>/dev/null; then
+    echo "Waiting for pacman keyring initialization (pacman-init.service)..."
+    while [[ "$(systemctl is-active pacman-init.service 2>/dev/null)" == "activating" ]]; do
+        sleep 2
+    done
+else
+    # Not on archiso (e.g. re-run from an installed system) — ensure a keyring exists.
+    [[ -d /etc/pacman.d/gnupg ]] || { pacman-key --init; pacman-key --populate archlinux; }
+fi
+pacman -Sy --noconfirm archlinux-keyring
+
 # Install tools needed by this script into the live environment before partitioning:
 # parted — disk partitioning; cryptsetup — LUKS; libfido2/pam-u2f — FIDO2 enrollment.
 pacman -Sy --noconfirm parted cryptsetup libfido2 pam-u2f
@@ -589,6 +609,14 @@ sed -i "s|^GRUB_CMDLINE_LINUX=.*|GRUB_CMDLINE_LINUX=\"$KERNEL_CMD\"|" /etc/defau
 
 # Install GRUB to the EFI partition; --bootloader-id sets the NVRAM entry name.
 grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=M-Archy-GRUB
+# Also install to the UEFI removable-media fallback path (/EFI/BOOT/BOOTX64.EFI).
+# The --bootloader-id install above only creates an NVRAM boot variable; a machine
+# whose NVRAM is empty or gets cleared (fresh board, CMOS reset, firmware that
+# drops stale entries, or — critically for this imaging/netboot installer — a disk
+# cloned or redeployed to different hardware) then has "No bootable device". The
+# removable fallback is what firmware boots when no NVRAM entry matches, so it makes
+# the installed disk portable and self-booting regardless of NVRAM state.
+grub-install --target=x86_64-efi --efi-directory=/boot --removable
 # Generate grub.cfg from /etc/default/grub and detected kernels.
 grub-mkconfig -o /boot/grub/grub.cfg
 

setup/archbaseos-guided-install.sh

@@ -255,17 +255,27 @@ else
     DRIVE=$(ask "Enter install drive (e.g., /dev/sda)")
 fi
 
-# ── Passwords (always interactive; shown in clear text, each entered twice) ────
-# Never read from the answerfile. Captured once here and reused everywhere so the
-# operator is never prompted for them again mid-install.
-USERPASS=$(ask_password "Password for $USERNAME")
+# ── Passwords ───────────────────────────────────────────────────────────────
+# In answerfile mode, honor a password embedded by the operator (needed for
+# truly unattended netboot/WDS deployments where no one is at the console);
+# otherwise fall back to the interactive prompt. Captured once here and reused
+# everywhere so the operator is never prompted for them again mid-install.
+if $AF_MODE && [[ -n "$(af_get '.password')" ]]; then
+    USERPASS=$(af_get '.password')
+else
+    USERPASS=$(ask_password "Password for $USERNAME")
+fi
 
 # LUKS passphrase — only needed when encrypting. Reused below for luksFormat /
 # open / luksAddKey / cryptenroll so it is typed exactly once (plus confirmation),
 # never again during the destructive phase.
 LUKS_PASS=""
 if [[ "$ENCRYPT_DISK" == "YES" ]]; then
-    LUKS_PASS=$(ask_password "Disk encryption (LUKS) passphrase")
+    if $AF_MODE && [[ -n "$(af_get '.luks_password')" ]]; then
+        LUKS_PASS=$(af_get '.luks_password')
+    else
+        LUKS_PASS=$(ask_password "Disk encryption (LUKS) passphrase")
+    fi
 fi
 
 # ── Final confirmation ────────────────────────────────────────────────────────
@@ -295,6 +305,26 @@ else
     [[ "$_final_ans" == "YES" ]] || { echo "Aborted."; exit 1; }
 fi
 
+# Wait for the live ISO's keyring initialization before any install. archiso
+# initializes the pacman keyring asynchronously at boot via pacman-init.service
+# (master-key generation can take a minute+ in VMs with little entropy), and
+# this installer autostarts at login — racing that service leaves keys
+# unpopulated/untrusted, so every package fails with "signature is unknown
+# trust" / "invalid or corrupted package (PGP signature)". Do NOT run
+# pacman-key --init ourselves here: doing so concurrently with
+# pacman-init.service corrupts the half-built keyring. Wait, then refresh
+# archlinux-keyring so an ISO built weeks ago still trusts current packager keys.
+if systemctl cat pacman-init.service &>/dev/null; then
+    echo "Waiting for pacman keyring initialization (pacman-init.service)..."
+    while [[ "$(systemctl is-active pacman-init.service 2>/dev/null)" == "activating" ]]; do
+        sleep 2
+    done
+else
+    # Not on archiso (e.g. re-run from an installed system) — ensure a keyring exists.
+    [[ -d /etc/pacman.d/gnupg ]] || { pacman-key --init; pacman-key --populate archlinux; }
+fi
+pacman -Sy --noconfirm archlinux-keyring
+
 # Required packages — installed into the live environment before partitioning.
 # -d skips full dependency resolution for speed (these are standalone tools).
 # systemd-ukify included for Unified Kernel Image support if needed post-install.
@@ -579,6 +609,13 @@ sed -i "s|^GRUB_CMDLINE_LINUX=.*|GRUB_CMDLINE_LINUX=\"$GRUB_CMDLINE\"|" /etc/def
 
 # Install GRUB to the EFI partition; --bootloader-id names the NVRAM/EFI menu entry.
 grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=GRUB
+# Also install to the UEFI removable-media fallback path (/EFI/BOOT/BOOTX64.EFI).
+# The --bootloader-id install above only creates an NVRAM boot variable; a machine
+# whose NVRAM is empty or gets cleared (fresh board, CMOS reset, firmware that drops
+# stale entries, or a disk cloned/redeployed to different hardware) then has "No
+# bootable device". The removable fallback is what firmware boots when no NVRAM entry
+# matches, making the installed disk portable and self-booting regardless of NVRAM.
+grub-install --target=x86_64-efi --efi-directory=/boot --removable
 # Generate grub.cfg from /etc/default/grub and discovered kernels/initramfs images.
 grub-mkconfig -o /boot/grub/grub.cfg
 

setup/archiso/build.sh

@@ -132,7 +132,11 @@ fi
 # ── Clean and create working directories ─────────────────────────────────────
 # Remove any previous build artifacts to ensure a clean, reproducible build.
 # mkarchiso can behave unexpectedly if the profile or work directory has stale state.
-rm -rf "$WORK_DIR"
+# Use sudo: mkarchiso runs as root below and leaves root-owned files in WORK_DIR
+# if a prior build was interrupted before its own end-of-script chown; a plain
+# `rm -rf` would then fail on those files and (under set -e) abort the script
+# before mkarchiso ever runs.
+sudo rm -rf "$WORK_DIR"
 mkdir -p "$WORK_DIR" "$OUT_DIR"
 
 # ── Assemble the profile from releng + M-Archy overlay ───────────────────────