From ba33832f08fd0094723529c2fc668373bd5771f8 Mon Sep 17 00:00:00 2001 From: Karim Date: Fri, 19 Jun 2026 19:22:24 +0200 Subject: [PATCH] Document Gitea Arch DB-signing key import for [tanin] The Gitea Arch registry signs the repo DB with its own key (63F0415879323F6BFE0FBFB2B6FDF356206AF4F6); import it via .../arch/repository.key + pacman-key --lsign-key before -Sy. Co-Authored-By: Claude Opus 4.8 --- distro/camel.toml | 3 ++- distro/tanin.pacman.conf | 14 +++++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/distro/camel.toml b/distro/camel.toml index 5e400dc..d5ac25d 100644 --- a/distro/camel.toml +++ b/distro/camel.toml @@ -45,7 +45,8 @@ repo_name = "tanin" status = "LIVE — hosted on the Gitea Arch registry, 9 packages, public, pacman-usable" server = "https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch" code_host = "https://git.openbureau.ch/karim/taninux" # PKGBUILD source clones -siglevel = "Optional TrustAll" # TODO: tighten to "Required" + ship the key +siglevel = "Optional TrustAll" # works once Gitea's DB-signing key is imported +db_key = "Gitea signs the repo DB with 63F0415879323F6BFE0FBFB2B6FDF356206AF4F6; import via .../arch/repository.key + pacman-key --lsign-key. ISO/Calamares must import it too." publish = "packaging/publish-tanin-repo.sh (needs a write:package token); Gitea builds the DB server-side" vanity = "taninux.kgva.ch can reverse-proxy / front this later" diff --git a/distro/tanin.pacman.conf b/distro/tanin.pacman.conf index 4dd3ca2..9f62c92 100644 --- a/distro/tanin.pacman.conf +++ b/distro/tanin.pacman.conf @@ -1,6 +1,18 @@ # [tanin] — TANINUX (camel) binary repo, hosted on the Gitea Arch registry. -# Append this block to /etc/pacman.conf, then: sudo pacman -Sy +# +# The Gitea Arch registry SIGNS the repo DB with its own key, so that key must +# be imported + locally signed first (one time), then add the repo block below. +# +# curl -s https://git.openbureau.ch/api/packages/karim/arch/repository.key \ +# | sudo pacman-key --add - +# sudo pacman-key --lsign-key 63F0415879323F6BFE0FBFB2B6FDF356206AF4F6 +# +# Then append this to /etc/pacman.conf and: sudo pacman -Sy # sudo pacman -S tanin-desktop # pulls the whole niri/eww desktop +# +# (Quick alternative without importing the key: set `SigLevel = Never` below — +# less secure, skips all signature checks. The ISO/Calamares should import the +# key into the live + target keyring instead.) [tanin] SigLevel = Optional TrustAll Server = https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch