fix(installer): keyring race, unattended password, EFI fallback, rebuild cleanup
Found while testing both installers end-to-end in VMs: - Wait for archiso's pacman-init.service instead of racing it. The installer autostarts at login while the live keyring is still being populated asynchronously, so every package failed with "signature is unknown trust" / "invalid or corrupted package (PGP signature)". Do not run pacman-key --init ourselves (corrupts the half-built keyring); wait, then refresh archlinux-keyring so an ISO built weeks ago still trusts current keys. - archbaseos-guided-install.sh: honor the answerfile's password/luks_password fields; previously it always prompted interactively, so a documented "zero-interaction" netboot/WDS install hung forever with no console. - Install GRUB to the UEFI removable-media fallback (/EFI/BOOT/BOOTX64.EFI) in addition to the NVRAM entry. Without it, an installed disk with empty/cleared NVRAM (fresh board, CMOS reset, or a cloned/redeployed image — the whole point of this installer) shows "No bootable device". Verified: the disk now boots to the login manager with fresh NVRAM. - build.sh: sudo rm -rf the work dir. mkarchiso runs as root and leaves root-owned files if interrupted, so the next plain rm -rf aborted the script under set -e before mkarchiso could run. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MUhrcFU8J1Hnf7vNqNxZNifeat/astal-menu
parent
d0bf9b2f12
commit
405e37d243
|
|
@ -207,6 +207,26 @@ fi
|
|||
############################################
|
||||
# REQUIRED PACKAGES FOR INSTALL ENVIRONMENT
|
||||
############################################
|
||||
# Wait for the live ISO's keyring initialization before any install. archiso
|
||||
# initializes the pacman keyring asynchronously at boot via pacman-init.service
|
||||
# (master-key generation can take a minute+ in VMs with little entropy), and
|
||||
# this installer autostarts at login — racing that service leaves keys
|
||||
# unpopulated/untrusted, so every package fails with "signature is unknown
|
||||
# trust" / "invalid or corrupted package (PGP signature)". Do NOT run
|
||||
# pacman-key --init ourselves here: doing so concurrently with
|
||||
# pacman-init.service corrupts the half-built keyring. Wait, then refresh
|
||||
# archlinux-keyring so an ISO built weeks ago still trusts current packager keys.
|
||||
if systemctl cat pacman-init.service &>/dev/null; then
|
||||
echo "Waiting for pacman keyring initialization (pacman-init.service)..."
|
||||
while [[ "$(systemctl is-active pacman-init.service 2>/dev/null)" == "activating" ]]; do
|
||||
sleep 2
|
||||
done
|
||||
else
|
||||
# Not on archiso (e.g. re-run from an installed system) — ensure a keyring exists.
|
||||
[[ -d /etc/pacman.d/gnupg ]] || { pacman-key --init; pacman-key --populate archlinux; }
|
||||
fi
|
||||
pacman -Sy --noconfirm archlinux-keyring
|
||||
|
||||
# Install tools needed by this script into the live environment before partitioning:
|
||||
# parted — disk partitioning; cryptsetup — LUKS; libfido2/pam-u2f — FIDO2 enrollment.
|
||||
pacman -Sy --noconfirm parted cryptsetup libfido2 pam-u2f
|
||||
|
|
@ -589,6 +609,14 @@ sed -i "s|^GRUB_CMDLINE_LINUX=.*|GRUB_CMDLINE_LINUX=\"$KERNEL_CMD\"|" /etc/defau
|
|||
|
||||
# Install GRUB to the EFI partition; --bootloader-id sets the NVRAM entry name.
|
||||
grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=M-Archy-GRUB
|
||||
# Also install to the UEFI removable-media fallback path (/EFI/BOOT/BOOTX64.EFI).
|
||||
# The --bootloader-id install above only creates an NVRAM boot variable; a machine
|
||||
# whose NVRAM is empty or gets cleared (fresh board, CMOS reset, firmware that
|
||||
# drops stale entries, or — critically for this imaging/netboot installer — a disk
|
||||
# cloned or redeployed to different hardware) then has "No bootable device". The
|
||||
# removable fallback is what firmware boots when no NVRAM entry matches, so it makes
|
||||
# the installed disk portable and self-booting regardless of NVRAM state.
|
||||
grub-install --target=x86_64-efi --efi-directory=/boot --removable
|
||||
# Generate grub.cfg from /etc/default/grub and detected kernels.
|
||||
grub-mkconfig -o /boot/grub/grub.cfg
|
||||
|
||||
|
|
|
|||
|
|
@ -255,17 +255,27 @@ else
|
|||
DRIVE=$(ask "Enter install drive (e.g., /dev/sda)")
|
||||
fi
|
||||
|
||||
# ── Passwords (always interactive; shown in clear text, each entered twice) ────
|
||||
# Never read from the answerfile. Captured once here and reused everywhere so the
|
||||
# operator is never prompted for them again mid-install.
|
||||
USERPASS=$(ask_password "Password for $USERNAME")
|
||||
# ── Passwords ───────────────────────────────────────────────────────────────
|
||||
# In answerfile mode, honor a password embedded by the operator (needed for
|
||||
# truly unattended netboot/WDS deployments where no one is at the console);
|
||||
# otherwise fall back to the interactive prompt. Captured once here and reused
|
||||
# everywhere so the operator is never prompted for them again mid-install.
|
||||
if $AF_MODE && [[ -n "$(af_get '.password')" ]]; then
|
||||
USERPASS=$(af_get '.password')
|
||||
else
|
||||
USERPASS=$(ask_password "Password for $USERNAME")
|
||||
fi
|
||||
|
||||
# LUKS passphrase — only needed when encrypting. Reused below for luksFormat /
|
||||
# open / luksAddKey / cryptenroll so it is typed exactly once (plus confirmation),
|
||||
# never again during the destructive phase.
|
||||
LUKS_PASS=""
|
||||
if [[ "$ENCRYPT_DISK" == "YES" ]]; then
|
||||
if $AF_MODE && [[ -n "$(af_get '.luks_password')" ]]; then
|
||||
LUKS_PASS=$(af_get '.luks_password')
|
||||
else
|
||||
LUKS_PASS=$(ask_password "Disk encryption (LUKS) passphrase")
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── Final confirmation ────────────────────────────────────────────────────────
|
||||
|
|
@ -295,6 +305,26 @@ else
|
|||
[[ "$_final_ans" == "YES" ]] || { echo "Aborted."; exit 1; }
|
||||
fi
|
||||
|
||||
# Wait for the live ISO's keyring initialization before any install. archiso
|
||||
# initializes the pacman keyring asynchronously at boot via pacman-init.service
|
||||
# (master-key generation can take a minute+ in VMs with little entropy), and
|
||||
# this installer autostarts at login — racing that service leaves keys
|
||||
# unpopulated/untrusted, so every package fails with "signature is unknown
|
||||
# trust" / "invalid or corrupted package (PGP signature)". Do NOT run
|
||||
# pacman-key --init ourselves here: doing so concurrently with
|
||||
# pacman-init.service corrupts the half-built keyring. Wait, then refresh
|
||||
# archlinux-keyring so an ISO built weeks ago still trusts current packager keys.
|
||||
if systemctl cat pacman-init.service &>/dev/null; then
|
||||
echo "Waiting for pacman keyring initialization (pacman-init.service)..."
|
||||
while [[ "$(systemctl is-active pacman-init.service 2>/dev/null)" == "activating" ]]; do
|
||||
sleep 2
|
||||
done
|
||||
else
|
||||
# Not on archiso (e.g. re-run from an installed system) — ensure a keyring exists.
|
||||
[[ -d /etc/pacman.d/gnupg ]] || { pacman-key --init; pacman-key --populate archlinux; }
|
||||
fi
|
||||
pacman -Sy --noconfirm archlinux-keyring
|
||||
|
||||
# Required packages — installed into the live environment before partitioning.
|
||||
# -d skips full dependency resolution for speed (these are standalone tools).
|
||||
# systemd-ukify included for Unified Kernel Image support if needed post-install.
|
||||
|
|
@ -579,6 +609,13 @@ sed -i "s|^GRUB_CMDLINE_LINUX=.*|GRUB_CMDLINE_LINUX=\"$GRUB_CMDLINE\"|" /etc/def
|
|||
|
||||
# Install GRUB to the EFI partition; --bootloader-id names the NVRAM/EFI menu entry.
|
||||
grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=GRUB
|
||||
# Also install to the UEFI removable-media fallback path (/EFI/BOOT/BOOTX64.EFI).
|
||||
# The --bootloader-id install above only creates an NVRAM boot variable; a machine
|
||||
# whose NVRAM is empty or gets cleared (fresh board, CMOS reset, firmware that drops
|
||||
# stale entries, or a disk cloned/redeployed to different hardware) then has "No
|
||||
# bootable device". The removable fallback is what firmware boots when no NVRAM entry
|
||||
# matches, making the installed disk portable and self-booting regardless of NVRAM.
|
||||
grub-install --target=x86_64-efi --efi-directory=/boot --removable
|
||||
# Generate grub.cfg from /etc/default/grub and discovered kernels/initramfs images.
|
||||
grub-mkconfig -o /boot/grub/grub.cfg
|
||||
|
||||
|
|
|
|||
|
|
@ -132,7 +132,11 @@ fi
|
|||
# ── Clean and create working directories ─────────────────────────────────────
|
||||
# Remove any previous build artifacts to ensure a clean, reproducible build.
|
||||
# mkarchiso can behave unexpectedly if the profile or work directory has stale state.
|
||||
rm -rf "$WORK_DIR"
|
||||
# Use sudo: mkarchiso runs as root below and leaves root-owned files in WORK_DIR
|
||||
# if a prior build was interrupted before its own end-of-script chown; a plain
|
||||
# `rm -rf` would then fail on those files and (under set -e) abort the script
|
||||
# before mkarchiso ever runs.
|
||||
sudo rm -rf "$WORK_DIR"
|
||||
mkdir -p "$WORK_DIR" "$OUT_DIR"
|
||||
|
||||
# ── Assemble the profile from releng + M-Archy overlay ───────────────────────
|
||||
|
|
|
|||
Loading…
Reference in New Issue