iso: fix packages.x86_64 (no inline comments; gstreamer-vaapi -> gst-plugin-va)

Inline comments after a package name broke kitty/flatpak (became invalid names with trailing whitespace). gstreamer-vaapi was removed from Arch. calamares is AUR-only -> commented pending a [tanin] rebuild decision. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-19 22:34:35 +02:00
parent 4722294c24
commit c7039f13b9
100 changed files with 1480 additions and 17 deletions
@@ -0,0 +1,24 @@
+---
+componentName: tanin
+welcomeStyleCalamares: true
+windowExpanding: normal
+
+strings:
+    productName:         TANINUX
+    shortProductName:    TANINUX
+    version:             camel
+    shortVersion:        camel
+    versionedName:       TANINUX (camel)
+    shortVersionedName:  TANINUX
+    bootloaderEntryName:  TANINUX
+    productUrl:          https://taninux.kgva.ch
+    supportUrl:          https://git.openbureau.ch/karim/taninux
+
+# Fuji palette for the installer sidebar (matches the desktop).
+style:
+    sidebarBackground:    "#0f0f0f"
+    sidebarText:          "#f0f0f0"
+    sidebarTextSelect:    "#a39ec4"
+    sidebarTextHighlight: "#a39ec4"
+
+# TODO: add productLogo (logo.png) + a slideshow (show.qml) for polish.
@@ -0,0 +1,9 @@
+---
+efiBootLoader: "systemd-boot"
+kernel:   "/vmlinuz-linux-zen"
+img:      "/initramfs-linux-zen.img"
+fallback: "/initramfs-linux-zen-fallback.img"
+timeout:  "3"
+# Plymouth splash + quiet boot on the installed system.
+kernelParams: [ "quiet", "splash", "rw" ]
+installEFIFallback: true
@@ -0,0 +1,8 @@
+---
+mountOptions:
+  default:  defaults,noatime
+  btrfs:    defaults,noatime,compress=zstd,space_cache=v2
+  efi:      defaults,noatime,umask=0077
+ssdExtraMountOptions:
+  btrfs:    ssd,discard=async
+crypttabOptions: luks
@@ -0,0 +1,37 @@
+---
+# Snapper-friendly Btrfs subvolume layout (@ root + @snapshots at /.snapshots).
+extraMounts:
+- device: proc
+  fs: proc
+  mountPoint: /proc
+- device: sys
+  fs: sysfs
+  mountPoint: /sys
+- device: /dev
+  mountPoint: /dev
+  options: bind
+- device: tmpfs
+  fs: tmpfs
+  mountPoint: /run
+- device: /run/udev
+  mountPoint: /run/udev
+  options: bind
+
+mountOptions:
+- mountPoint: /
+  options: defaults,noatime
+- mountPoint: "*"
+  filesystem: btrfs
+  options: defaults,noatime,compress=zstd
+
+btrfsSubvolumes:
+- mountPoint: /
+  subvolume: /@
+- mountPoint: /home
+  subvolume: /@home
+- mountPoint: /var/cache
+  subvolume: /@cache
+- mountPoint: /var/log
+  subvolume: /@log
+- mountPoint: /.snapshots
+  subvolume: /@snapshots
@@ -0,0 +1,12 @@
+---
+backend: pacman
+pacman:
+  num_retries: 3
+  disable_download_timeout: true
+  needed_only: false
+operations:
+# Strip the live-only installer from the installed target. Everything else was
+# cloned by unpackfs.
+- try_remove:
+  - calamares
+  - cage
@@ -0,0 +1,11 @@
+---
+efiSystemPartition:     "/boot"        # systemd-boot wants the ESP at /boot
+efiSystemPartitionSize: 1024M
+userSwapChoices: [ none, small, suspend ]
+drawNestedPartitions:   true
+alwaysShowPartitionLabels: true
+allowManualPartitioning:   true
+initialPartitioningChoice: erase
+initialSwapChoice:         none
+defaultFileSystemType:     "btrfs"
+availableFileSystemTypes:  [ "btrfs", "ext4" ]
@@ -0,0 +1,13 @@
+---
+services:
+- name: greetd            # the TANINUX login (tanin-greet) — its config is already
+  mandatory: false        #   in place from the tanin-greet package scriptlet
+- name: NetworkManager
+  mandatory: false
+- name: snapper-cleanup.timer
+  mandatory: false
+- name: snapper-timeline.timer
+  mandatory: false
+targets:
+- name: graphical
+  mandatory: true
@@ -0,0 +1,5 @@
+---
+dontChroot: false
+timeout: 30
+script:
+- "flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo"
@@ -0,0 +1,11 @@
+---
+dontChroot: false
+timeout: 120
+# Best-effort snapper setup on the Btrfs target. The @snapshots subvolume is
+# already mounted at /.snapshots (see mount.conf); snapper's own create-config
+# can conflict with a pre-existing /.snapshots, so this is tolerant.
+# snap-pac then auto-snapshots before/after each pacman transaction.
+script:
+- command: "snapper --no-dbus -c root create-config / || true"
+  timeout: 60
+- "snapper --no-dbus -c root set-config NUMBER_LIMIT=10 NUMBER_LIMIT_IMPORTANT=5 TIMELINE_CREATE=no || true"
@@ -0,0 +1,11 @@
+---
+dontChroot: false
+timeout: 30
+# Remove the live-only installer bits from the installed target so it boots the
+# desktop (greetd) instead of auto-launching Calamares.
+script:
+- "rm -f /etc/systemd/system/getty@tty1.service.d/autologin.conf"
+- "rmdir --ignore-fail-on-non-empty /etc/systemd/system/getty@tty1.service.d 2>/dev/null || true"
+- "rm -f /root/.bash_profile"
+- "rm -f /usr/local/bin/tanin-installer"
+- "systemctl set-default graphical.target"
@@ -0,0 +1,7 @@
+---
+# Clone the live squashfs onto the target. Path matches install_dir=tanin,
+# arch=x86_64, airootfs_image_type=squashfs (see profiledef.sh).
+unpack:
+- source: "/run/archiso/bootmnt/tanin/x86_64/airootfs.sfs"
+  sourcefs: "squashfs"
+  destination: ""
@@ -0,0 +1,54 @@
+# Calamares for TANINUX (camel). Model: clone the live system to the target with
+# unpackfs, then configure bootloader (systemd-boot), services (greetd), set up
+# snapper + Flathub, and strip the live-only installer bits.
+---
+modules-search: [ local, /usr/lib/calamares/modules ]
+
+instances:
+- id:     snapper
+  module: shellprocess
+  config: shellprocess-snapper.conf
+- id:     flathub
+  module: shellprocess
+  config: shellprocess-flathub.conf
+- id:     striplive
+  module: shellprocess
+  config: shellprocess-striplive.conf
+
+sequence:
+- show:
+  - welcome
+  - locale
+  - keyboard
+  - partition
+  - users
+  - summary
+- exec:
+  - partition
+  - mount
+  - unpackfs
+  - machineid
+  - fstab
+  - locale
+  - keyboard
+  - localecfg
+  - luksbootkeyfile
+  - users
+  - networkcfg
+  - hwclock
+  - shellprocess@snapper
+  - shellprocess@flathub
+  - shellprocess@striplive
+  - packages          # remove live-only packages (calamares, cage)
+  - services-systemd  # enable greetd + NetworkManager on the target
+  - mkinitcpio        # regenerate initramfs (plymouth hook)
+  - bootloader        # systemd-boot, kernel cmdline 'quiet splash'
+  - umount
+- show:
+  - finished
+
+branding: tanin
+prompt-install: true
+dont-chroot: false
+oem-setup: false
+disable-cancel: false
@@ -0,0 +1 @@
+archiso
@@ -0,0 +1 @@
+LANG=C.UTF-8
@@ -0,0 +1 @@
+/usr/share/zoneinfo/UTC
@@ -0,0 +1,3 @@
+HOOKS=(base udev microcode modconf kms memdisk archiso archiso_loop_mnt archiso_pxe_common archiso_pxe_nbd archiso_pxe_http archiso_pxe_nfs block filesystems keyboard)
+COMPRESSION="xz"
+COMPRESSION_OPTIONS=(-9e)
@@ -0,0 +1,8 @@
+# mkinitcpio preset file for the 'linux' package on archiso
+
+PRESETS=('archiso')
+
+ALL_kver='/boot/vmlinuz-linux'
+archiso_config='/etc/mkinitcpio.conf.d/archiso.conf'
+
+archiso_image="/boot/initramfs-linux.img"
@@ -0,0 +1,7 @@
+# The broadcom-wl package requires some modules to be disabled in order to use
+# wl. Since the ISO image needs to cover many hardware cases, this file
+# overrides the default blacklist in /usr/lib/modprobe.d/
+#
+# If you need to use wl, you may need to delete this file, then `rmmod` any
+# already-loaded modules that are now blacklisted before proceeding to modprobe
+# wl itself.
@@ -0,0 +1,11 @@
+To install [38;2;23;147;209mArch Linux[0m follow the installation guide:
+https://wiki.archlinux.org/title/Installation_guide
+
+For Wi-Fi, authenticate to the wireless network using the [35miwctl[0m utility.
+For mobile broadband (WWAN) modems, connect with the [35mmmcli[0m utility.
+Ethernet, WLAN and WWAN interfaces using DHCP should work automatically.
+
+After connecting to the internet, the installation guide can be accessed
+via the convenience script [35mInstallation_guide[0m.
+
+[41m [41m [41m [40m [44m [40m [41m [46m [45m [41m [46m [43m [41m [44m [45m [40m [44m [40m [41m [44m [41m [41m [46m [42m [41m [44m [43m [41m [45m [40m [40m [44m [40m [41m [44m [42m [41m [46m [44m [41m [46m [47m [0m
@@ -0,0 +1,25 @@
+# pacman.conf for the LIVE system and (via unpackfs) the installed target.
+# [tanin]'s DB-signing key is imported into the keyring by customize_airootfs.sh,
+# so Optional TrustAll verifies cleanly here (unlike the build conf which uses Never).
+[options]
+HoldPkg     = pacman glibc
+Architecture = auto
+CheckSpace
+SigLevel    = Required DatabaseOptional
+LocalFileSigLevel = Optional
+ParallelDownloads = 5
+Color
+ILoveCandy
+
+[core]
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Include = /etc/pacman.d/mirrorlist
+
+[multilib]
+Include = /etc/pacman.d/mirrorlist
+
+[tanin]
+SigLevel = Optional TrustAll
+Server = https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch
@@ -0,0 +1,13 @@
+# remove from airootfs!
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Package
+Target = pacman-mirrorlist
+
+[Action]
+Description = Uncommenting HTTPS mirrors in /etc/pacman.d/mirrorlist...
+When = PostTransaction
+Depends = pacman-mirrorlist
+Depends = sed
+Exec = /usr/bin/sed -E -i 's/#(Server = https:)/\1/g' /etc/pacman.d/mirrorlist
@@ -0,0 +1,18 @@
+# remove from airootfs!
+# As a workaround for https://bugs.archlinux.org/task/49347 , remove pacman hooks specific to the ISO build process.
+# If not, they would be used when pacstrap is run in the live environment.
+
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Work around FS#49347 by removing custom pacman hooks that are only required during ISO build...
+When = PostTransaction
+Depends = sh
+Depends = coreutils
+Depends = grep
+Exec = /bin/sh -c "rm -- $(grep -Frl 'remove from airootfs' /etc/pacman.d/hooks/)"
@@ -0,0 +1,32 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+xsBNBGo1eZsBCADJBsWkBZL08x/4d/mftfd30rcRkQJVDX3eEMHaZWeUSLfGt5Hj
+m7fYnwnBK29g04UTCjDKRGsvOqukAJQUXGLpLxSPJwsUH+kVKv+8/RCXtrQ6HTCN
+auyZGQ3ST8kcAQ+7jntumTehBt+z4LRGMow71W2JL1oqkMK9hEgAA7dqwEWN4K0w
+DMSd9iZOpN5PPdvVlTsvxU6JflfyLOS3W+geyL2+zFQWMmCcAqkPxTH6yNAfaoLI
+OGR4Mg6MXXdAXbzQKI90445fWGsUX/Ch5ZSWJhJ3wqjUM3r99PErL+C/p0r5wTqv
+LFkjZvauI+oLUZwXrP93qfzTG/iChBG+5sJLABEBAAHNDyhBcmNoIFJlZ2lzdHJ5
+KcLAuwQTAQgAbwWCajV5mwILBwkQtv3zViBq9PY1FAAAAAAAHAAQc2FsdEBub3Rh
+dGlvbnMub3BlbnBncGpzLm9yZ/ekKg/zx/iqmv/2hOAR9m8CFQgCFgACGQECmwMC
+HgEWIQRj8EFYeTI/a/4Pv7K2/fNWIGr09gAAdPIIAI4b/4C83biB4yD10w/u9Feb
+s4fn0nauZ/ayZ1JJaq20Ss2pBZaqETxNdIi9sQpno9BXhBRaNdd6k7YIUK7XTylr
+lk6V6Rhz6NIquGZHmfp1oszL4FjLUM9QoFWQaRY76psBNHWto/GgPpq8GFtVxmVj
+NhOpm/7EcGhniBS+engub7vazVpEIqPycKBBbKSxTvo3hVqsSJpaR2vB1aiLedvY
+luYfu/OIhT7SOOdjYTT18kMJxlwwSnhbl1cl47Jcd/1iQB5nwrWnZy28osfsIhEd
+4lxppWcgQDXWbzBV57HiTbfnNCncmBIhoTmCKRxosWJPiligeqsqoty/B7lBx47O
+wE0EajV5mwEIAO800GVtfe0ZWs+LljaKgkrwWi/u+dsVFgRNWdmqtOBWdszVdxyz
+M0LsNMHHOxAWFfjFFbSO9D06aHgmvzLH0c+fgaJeliXFMYS9nOKS7Q6djnjoYtZc
+CPxac0JlcLiysHyBdatjHHZr6KZvGaoSobzEfASpfYpScvEyGvi3KN2xD6ssw7AY
+GiPof+vAmsfDn0OFo1WRk7eEnoT7JvUx3RrDatXLvBcQRf+49AJvf2lBv0c4tnc8
+9O71wleTHZjL8x0oc3tFDCMBfSGmLzpOaTtgwCPI99yzHeGJGP7JyjUWSAi6WkX4
+COLPhufJC/pJSrvoLa1MzUBU+jfTkJnn8ZkAEQEAAcLArAQYAQgAYAWCajV5mwkQ
+tv3zViBq9PY1FAAAAAAAHAAQc2FsdEBub3RhdGlvbnMub3BlbnBncGpzLm9yZzPl
+jzz26YEAPcqM+A/M9x8CmwwWIQRj8EFYeTI/a/4Pv7K2/fNWIGr09gAAtaMH/3hS
+njGRszJFLsFNUYzgKdv1YYIENsFzSsu00CztKUrYVQxAEOK22mB3a9/3jPlJFSkS
+WR8D2rbC2/HUKhRnHomb8Mri6HzVmGEORuE5kNnZd3ij+Dnv7EsNC7DXmuoCZaFI
+FKYinsLEpo0bZOACaJpGTH4HqNM49Mrq2vREnuDtPdHGEYOs/+VqBt7tpmpIxGLd
+TsJNtdroThqle9ghaCwcSqF4YatTGsNpQI68OmkmQc1ybxhzpRdwajrdTrio2pI9
+ZkfLRBu7pRjn5ekDX4JUNkC1VyO4BuZutjtFRh8YAB0TbFfPmdn3i4/gI2u5rSi1
+UT+fYccVqz5tKm/iXTY=
+=6SFS
+-----END PGP PUBLIC KEY BLOCK-----
@@ -0,0 +1 @@
+root:x:0:0:root:/root:/usr/bin/zsh
@@ -0,0 +1 @@
+/run/systemd/resolve/stub-resolv.conf
@@ -0,0 +1 @@
+root::14871::::::
@@ -0,0 +1,3 @@
+# Allow root login using password authentication
+PasswordAuthentication yes
+PermitRootLogin yes
@@ -0,0 +1,2 @@
+[Journal]
+Storage=volatile
@@ -0,0 +1,4 @@
+[Login]
+HandleSuspendKey=ignore
+HandleHibernateKey=ignore
+HandleLidSwitch=ignore
@@ -0,0 +1,22 @@
+[Match]
+Type=ether
+# Exclude virtual Ethernet interfaces
+Kind=!*
+
+[Link]
+RequiredForOnline=routable
+
+[Network]
+DHCP=yes
+MulticastDNS=yes
+
+# systemd-networkd does not set per-interface-type default route metrics
+# https://github.com/systemd/systemd/issues/17698
+# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
+# Use values from NetworkManager. From nm_device_get_route_metric_default in
+# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
+[DHCPv4]
+RouteMetric=100
+
+[IPv6AcceptRA]
+RouteMetric=100
@@ -0,0 +1,20 @@
+[Match]
+Type=wlan
+
+[Link]
+RequiredForOnline=routable
+
+[Network]
+DHCP=yes
+MulticastDNS=yes
+
+# systemd-networkd does not set per-interface-type default route metrics
+# https://github.com/systemd/systemd/issues/17698
+# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
+# Use values from NetworkManager. From nm_device_get_route_metric_default in
+# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
+[DHCPv4]
+RouteMetric=600
+
+[IPv6AcceptRA]
+RouteMetric=600
@@ -0,0 +1,19 @@
+[Match]
+Type=wwan
+
+[Link]
+RequiredForOnline=routable
+
+[Network]
+DHCP=yes
+
+# systemd-networkd does not set per-interface-type default route metrics
+# https://github.com/systemd/systemd/issues/17698
+# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
+# Use values from NetworkManager. From nm_device_get_route_metric_default in
+# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
+[DHCPv4]
+RouteMetric=700
+
+[IPv6AcceptRA]
+RouteMetric=700
@@ -0,0 +1,2 @@
+[Network]
+IPv6PrivacyExtensions=yes
@@ -0,0 +1,4 @@
+# Default systemd-resolved configuration for archiso
+
+[Resolve]
+MulticastDNS=yes
@@ -0,0 +1 @@
+/dev/null
@@ -0,0 +1,10 @@
+[Unit]
+Description=Choose mirror from the kernel command line
+ConditionKernelCommandLine=mirror
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/choose-mirror
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1 @@
+/usr/lib/systemd/system/cloud-config.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/cloud-final.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/cloud-init-local.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/cloud-init-main.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/cloud-init-network.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/ModemManager.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-networkd.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-resolved.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-timesyncd.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=Temporary /etc/pacman.d/gnupg directory
+
+[Mount]
+What=tmpfs
+Where=/etc/pacman.d/gnupg
+Type=tmpfs
+Options=mode=0755,noswap
@@ -0,0 +1,3 @@
+[Service]
+ExecStart=
+ExecStart=-/usr/bin/agetty --autologin root --noclear %I 38400 linux
@@ -0,0 +1,13 @@
+[Unit]
+Description=Unmute All Sound Card Controls For Use With The Live Arch Environment
+# This needs to run after the audio device becomes available.
+Wants=systemd-udev-settle.service
+After=systemd-udev-settle.service sound.target
+ConditionKernelCommandLine=accessibility=on
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/livecd-sound -u
+
+[Install]
+WantedBy=sound.target
@@ -0,0 +1,20 @@
+[Unit]
+Description=Screen reader service
+After=livecd-alsa-unmuter.service
+Before=getty@tty1.service
+ConditionKernelCommandLine=accessibility=on
+
+[Service]
+Type=oneshot
+TTYPath=/dev/tty13
+ExecStartPre=/usr/bin/chvt 13
+ExecStart=/usr/local/bin/livecd-sound -p
+ExecStartPost=/usr/bin/chvt 1
+ExecStartPost=systemctl start espeakup.service
+StandardInput=tty
+TTYVHangup=yes
+TTYVTDisallocate=yes
+RemainAfterExit=true
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1 @@
+/usr/lib/systemd/system/ModemManager.service
@@ -0,0 +1 @@
+../choose-mirror.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/hv_fcopy_daemon.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/hv_kvp_daemon.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/hv_vss_daemon.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/iwd.service
@@ -0,0 +1 @@
+/etc/systemd/system/livecd-talk.service
@@ -0,0 +1 @@
+../pacman-init.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/sshd.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-networkd.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-resolved.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/vboxservice.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/vmtoolsd.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/vmware-vmblock-fuse.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-networkd-wait-online.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=Initializes Pacman keyring
+Requires=etc-pacman.d-gnupg.mount
+After=etc-pacman.d-gnupg.mount time-sync.target
+BindsTo=etc-pacman.d-gnupg.mount
+Before=archlinux-keyring-wkd-sync.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/bin/pacman-key --init
+ExecStart=/usr/bin/pacman-key --populate
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1 @@
+/usr/lib/systemd/system/pcscd.socket
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-networkd.socket
@@ -0,0 +1 @@
+../livecd-alsa-unmuter.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-time-wait-sync.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-timesyncd.service
@@ -0,0 +1,6 @@
+# Allow systemd-networkd-wait-online to succeed with one interface, otherwise, if multiple network interfaces exist,
+# network-online.target gets needlessly delayed.
+# See https://wiki.archlinux.org/title/systemd-networkd#systemd-networkd-wait-online
+[Service]
+ExecStart=
+ExecStart=/usr/lib/systemd/systemd-networkd-wait-online --any
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+script_cmdline() {
+    local param
+    for param in $(</proc/cmdline); do
+        case "${param}" in
+            script=*)
+                echo "${param#*=}"
+                return 0
+                ;;
+        esac
+    done
+}
+
+automated_script() {
+    local script rt
+    script="$(script_cmdline)"
+    if [[ -n "${script}" && ! -x /tmp/startup_script ]]; then
+        if [[ "${script}" =~ ^((http|https|ftp|tftp)://) ]]; then
+            printf '%s: downloading %s\n' "$0" "${script}"
+            # there's no synchronization for network availability before executing this script; to ensure the network
+            # is online, we use a transient systemd service that depends on network-online.target to download the
+            # script rather than manually polling the target
+            systemd-run --pty --quiet -p Wants=network-online.target -p After=network-online.target \
+                curl "${script}" --location --retry-connrefused --retry 10 --fail -s -o /tmp/startup_script
+            rt=$?
+        else
+            cp "${script}" /tmp/startup_script
+            rt=$?
+        fi
+        if [[ ${rt} -eq 0 ]]; then
+            chmod +x /tmp/startup_script
+            printf '%s: executing automated script\n' "$0"
+            # note that script is executed when other services (like pacman-init) may be still in progress, please
+            # synchronize to "systemctl is-system-running --wait" when your script depends on other services
+            /tmp/startup_script
+        fi
+    fi
+}
+
+if [[ $(tty) == "/dev/tty1" ]]; then
+    automated_script
+fi
@@ -0,0 +1,6 @@
+# Live ISO: on the first console (tty1), launch the TANINUX installer.
+# (On an installed system this file isn't present — Calamares' shellprocess
+#  strips the live-only bits from the target.)
+if [[ "$(tty)" == /dev/tty1 ]] && [[ -z "${WAYLAND_DISPLAY:-}" ]] && ! pgrep -x cage >/dev/null 2>&1; then
+  exec tanin-installer
+fi
@@ -0,0 +1,4 @@
+disable-ccid
+disable-pinpad
+pcsc-driver /usr/lib/libpcsclite.so
+pcsc-shared
@@ -0,0 +1,6 @@
+# fix for screen readers
+if grep -Fqa 'accessibility=' /proc/cmdline &> /dev/null; then
+    setopt SINGLE_LINE_ZLE
+fi
+
+~/.automated_script.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Runs once inside the airootfs chroot during mkarchiso.
+set -e -u
+
+# --- locale ---
+sed -i 's/#\(en_US\.UTF-8 UTF-8\)/\1/' /etc/locale.gen
+locale-gen
+
+# --- trust the [tanin] DB-signing key (so Optional TrustAll verifies) ---
+pacman-key --init
+pacman-key --populate archlinux
+pacman-key --add /etc/pacman.d/tanin-repo.gpg
+pacman-key --lsign-key 63F0415879323F6BFE0FBFB2B6FDF356206AF4F6
+
+# --- services in the LIVE image ---
+systemctl enable NetworkManager.service
+# Live boots to a console on tty1 that auto-launches the installer (cage +
+# calamares) via getty autologin + /root/.bash_profile. No display-manager.
+systemctl set-default multi-user.target
+# greetd is for the TARGET only (Calamares enables it post-install).
+systemctl disable greetd.service 2>/dev/null || true
+
+# --- plymouth: add the hook so the target initramfs shows the splash ---
+# (Calamares regenerates the initramfs on the target; this drop-in is carried
+#  over by unpackfs. 'quiet splash' goes on the kernel cmdline at install time.)
+if ! grep -q plymouth /etc/mkinitcpio.conf 2>/dev/null; then
+  sed -i 's/^\(HOOKS=.*\)\(udev\)/\1\2 plymouth/' /etc/mkinitcpio.conf 2>/dev/null || true
+fi
@@ -0,0 +1,5 @@
+#!/bin/sh
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+exec xdg-open 'https://wiki.archlinux.org/title/Installation_guide'
@@ -0,0 +1,29 @@
+#!/bin/bash
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+get_cmdline() {
+    local param
+    for param in $(</proc/cmdline); do
+        case "${param}" in
+            "${1}="*)
+                echo "${param##*=}"
+                return 0
+                ;;
+        esac
+    done
+}
+
+mirror="$(get_cmdline mirror)"
+[[ "$mirror" == 'auto' ]] && mirror="$(get_cmdline archiso_http_srv)"
+[[ -n "$mirror" ]] || exit 0
+
+mv /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist.orig
+cat >/etc/pacman.d/mirrorlist <<EOF
+#
+# Arch Linux repository mirrorlist
+# Generated by archiso
+#
+
+Server = ${mirror%%/}/\$repo/os/\$arch
+EOF
@@ -0,0 +1,239 @@
+#!/usr/bin/env bash
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+usage() {
+    cat <<-_EOF_
+    live cd sound helper script.
+    Usage: livecdsound [OPTION]
+    OPTIONS
+        -u, --unmute      unmute all sound cards
+        -p, --pick        select a card for speech output
+        -h, --help        Show this usage message
+
+_EOF_
+}
+
+bugout() {
+    printf "/usr/local/bin/livecdsound: programming error"
+    stat_fail
+}
+
+echo_card_indices() {
+    if [[ -f /proc/asound/cards ]]; then
+        sed -n -e's/^[[:space:]]*\([0-7]\)[[:space:]].*/\1/p' /proc/asound/cards
+    fi
+}
+
+# The following functions try to set many controls.
+# No card has all the controls and so some of the attempts are bound to fail.
+# Because of this, the functions can't return useful status values.
+
+# $1 <card id>
+# $2 <control>
+# $3 <level>
+unmute_and_set_level() {
+    [[ -n "$3" && -n "$2" && -n "$1" ]] || bugout
+    systemd-cat -t "livecdsound" printf "Setting: %s on card: %s to %s\n" "$2" "$1" "$3"
+    systemd-cat -t "livecdsound" amixer -c "$1" set "$2" "$3" unmute
+    return 0
+}
+
+# $1 <card id>
+# $2 <control>
+mute_and_zero_level() {
+    [[ -n "$1" && -n "$2" ]] || bugout
+    systemd-cat -t "livecdsound" printf "Muting control: %s on card: %s\n" "$2" "$1"
+    systemd-cat -t "livecdsound" amixer -c "$1" set "$2" "0%" mute
+    return 0
+}
+
+# $1 <card ID>
+# $2 <control>
+# $3 "on" | "off"
+switch_control() {
+    [[ -n "$3" && -n "$1" ]] || bugout
+    systemd-cat -t "livecdsound" printf "Switching control: %s on card: %s to %s\n" "$2" "$1" "$3"
+    systemd-cat -t "livecdsound" amixer -c "$1" set "$2" "$3"
+    return 0
+}
+
+# $1 <card ID>
+sanify_levels_on_card() {
+    unmute_and_set_level "$1" "Front" "80%"
+    unmute_and_set_level "$1" "Master" "80%"
+    unmute_and_set_level "$1" "Master Mono" "80%"
+    unmute_and_set_level "$1" "Master Digital" "80%"   # E.g., cs4237B
+    unmute_and_set_level "$1" "Playback" "80%"
+    unmute_and_set_level "$1" "Headphone" "100%"
+    unmute_and_set_level "$1" "PCM" "80%"
+    unmute_and_set_level "$1" "PCM,1" "80%"   # E.g., ess1969
+    unmute_and_set_level "$1" "DAC" "80%"     # E.g., envy24, cs46xx
+    unmute_and_set_level "$1" "DAC,0" "80%"   # E.g., envy24
+    unmute_and_set_level "$1" "DAC,1" "80%"   # E.g., envy24
+    unmute_and_set_level "$1" "Synth" "80%"
+    unmute_and_set_level "$1" "CD" "80%"
+    unmute_and_set_level "$1" "PC Speaker" "100%"
+
+    mute_and_zero_level "$1" "Mic"
+    mute_and_zero_level "$1" "IEC958"         # Ubuntu #19648
+
+    # Intel P4P800-MX
+    switch_control "$1" "Master Playback Switch" on
+    switch_control "$1" "Master Surround" on
+
+    # Trident/YMFPCI/emu10k1:
+    unmute_and_set_level "$1" "Wave" "80%"
+    unmute_and_set_level "$1" "Music" "80%"
+    unmute_and_set_level "$1" "AC97" "80%"
+
+    # DRC:
+    unmute_and_set_level "$1" "Dynamic Range Compression" "80%"
+
+    # Required for HDA Intel (hda-intel):
+    unmute_and_set_level "$1" "Front" "80%"
+
+    # Required for SB Live 7.1/24-bit (ca0106):
+    unmute_and_set_level "$1" "Analog Front" "80%"
+
+    # Required at least for Via 823x hardware on DFI K8M800-MLVF Motherboard
+    switch_control "$1" "IEC958 Capture Monitor" off
+
+    # Required for hardware allowing toggles for AC97 through IEC958,
+    #  valid values are 0, 1, 2, 3. Needs to be set to 0 for PCM1.
+    unmute_and_set_level "$1" "IEC958 Playback AC97-SPSA" "0"
+
+    # Required for newer Via hardware
+    unmute_and_set_level "$1" "VIA DXS,0" "80%"
+    unmute_and_set_level "$1" "VIA DXS,1" "80%"
+    unmute_and_set_level "$1" "VIA DXS,2" "80%"
+    unmute_and_set_level "$1" "VIA DXS,3" "80%"
+
+    # Required on some notebooks with ICH4:
+    switch_control "$1" "Headphone Jack Sense" off
+    switch_control "$1" "Line Jack Sense" off
+
+    # Some machines need one or more of these to be on;
+    # others need one or more of these to be off:
+
+    switch_control "$1" "Audigy Analog/Digital Output Jack" on
+    switch_control "$1" "SB Live Analog/Digital Output Jack" on
+
+    # D1984 -- Thinkpad T61/X61
+    switch_control "$1" "Speaker" on
+    switch_control "$1" "Headphone" on
+
+    # HDA-Intel w/ "Digital" capture mixer (See Ubuntu #193823)
+    unmute_and_set_level "$1" "Digital" "80%"
+
+    return 0
+}
+
+# $1 <card ID> | "all"
+sanify_levels() {
+    local ttsdml_returnstatus=0
+    local card
+    case "$1" in
+        all)
+            for card in $(echo_card_indices); do
+                sanify_levels_on_card "$card" || ttsdml_returnstatus=1
+            done
+            ;;
+        *)
+            sanify_levels_on_card "$1" || ttsdml_returnstatus=1
+            ;;
+    esac
+    return "$ttsdml_returnstatus"
+}
+
+# List all cards that *should* be usable for PCM audio.  In my experience,
+# the console speaker (handled by the pcsp driver) isn't a suitable playback
+# device, so we'll exclude it.
+list_non_pcsp_cards() {
+    for card in $(echo_card_indices); do
+        local cardfile="/proc/asound/card${card}/id"
+        if [[ -r "$cardfile" && -f "$cardfile" && "$(cat "$cardfile")" != pcsp ]]; then
+            echo "$card"
+        fi
+    done
+}
+
+# Properly initialize the sound card so that we have audio at boot.
+unmute_all_cards() {
+    sanify_levels all
+}
+
+is_numeric() {
+    local str="$1"
+    [[ "$str" =~ ^[0-9]+$ ]]
+}
+
+set_default_card() {
+    local card="$1"
+    sed -e "s/%card%/$card/g" </usr/local/share/livecd-sound/asound.conf.in \
+        >/etc/asound.conf
+}
+
+play_on_card() {
+    local card="$1" file="$2"
+    aplay -q "-Dplughw:$card,0" "$file"
+}
+
+# If there are multiple usable sound cards, prompt the user to choose one,
+# using auditory feedback.
+pick_a_card() {
+    set -f
+    mapfile -t usable_cards < <(list_non_pcsp_cards)
+    num_usable_cards="${#usable_cards[@]}"
+
+    if (( num_usable_cards == 1 )); then
+        systemd-cat -t "livecdsound" printf "Only one sound card is detected\n"
+        exit 0
+    fi
+    systemd-cat -t "livecdsound" printf "multiple sound cards detected\n"
+    for card in "${usable_cards[@]}"; do
+        if ! is_numeric "$card"; then
+            continue
+        fi
+        play_on_card "$card" /usr/share/livecd-sounds/pick-a-card.wav &
+    done
+    wait
+    sleep 1
+    for card in "${usable_cards[@]}"; do
+        if ! is_numeric "$card"; then
+            continue
+        fi
+        play_on_card "$card" /usr/share/livecd-sounds/beep.wav
+        if read -r -t 10; then
+            systemd-cat -t "livecdsound" printf "Selecting %s sound card as default\n" "$card"
+            set_default_card "$card"
+            break
+        fi
+    done
+}
+
+if (( $# == 0 )); then
+    echo "error: No argument passed."
+    exit 1
+fi
+while [[ "${1}" != "" ]]; do
+    case ${1} in
+        -h|--help)
+            usage
+            exit
+            ;;
+        -u|--unmute)
+            systemd-cat -t "livecdsound" printf "Unmuting all cards"
+            unmute_all_cards
+            ;;
+        -p|--pick)
+            pick_a_card
+            ;;
+        *)
+            echo "error: Unsupported argument"
+            usage
+            exit 1
+            ;;
+    esac
+    shift
+done
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# Launch the Calamares installer fullscreen in a cage kiosk compositor (Wayland,
+# straight on DRM — no display-manager needed in the live session).
+exec cage -s -- calamares
@@ -0,0 +1,3 @@
+Defaults node
+defaults.ctl.card %card%;
+defaults.pcm.card %card%;
@@ -0,0 +1,2 @@
+arch-install-scripts
+base
@@ -0,0 +1,5 @@
+title    Arch Linux install medium (%ARCH%, UEFI)
+sort-key 01
+linux    /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-zen
+initrd   /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-zen.img
+options  archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID%
@@ -0,0 +1,5 @@
+title    Arch Linux install medium (%ARCH%, UEFI) with speech
+sort-key 02
+linux    /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-zen
+initrd   /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-zen.img
+options  archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on
@@ -0,0 +1,4 @@
+title    Memtest86+
+sort-key 03
+efi      /boot/memtest86+/memtest.efi
+architecture x64
@@ -0,0 +1,3 @@
+timeout 15
+default 01-archiso-linux.conf
+beep on
@@ -0,0 +1,112 @@
+# Load partition table and file system modules
+insmod part_gpt
+insmod part_msdos
+insmod fat
+insmod iso9660
+insmod ntfs
+insmod ntfscomp
+insmod exfat
+insmod udf
+
+# Use graphics-mode output
+if loadfont "${prefix}/fonts/unicode.pf2" ; then
+    insmod all_video
+    set gfxmode="auto"
+    terminal_input console
+    terminal_output console
+fi
+
+# Enable serial console
+insmod serial
+insmod usbserial_common
+insmod usbserial_ftdi
+insmod usbserial_pl2303
+insmod usbserial_usbdebug
+if serial --unit=0 --speed=115200; then
+    terminal_input --append serial
+    terminal_output --append serial
+fi
+
+# Get a human readable platform identifier
+if [ "${grub_platform}" == 'efi' ]; then
+    archiso_platform='UEFI'
+elif [ "${grub_platform}" == 'pc' ]; then
+    archiso_platform='BIOS'
+else
+    archiso_platform="${grub_cpu}-${grub_platform}"
+fi
+
+# Set default menu entry
+default=archlinux
+timeout=15
+timeout_style=menu
+
+
+# Menu entries
+
+menuentry "Arch Linux install medium (%ARCH%, ${archiso_platform})" --class arch --class gnu-linux --class gnu --class os --id 'archlinux' {
+    set gfxpayload=keep
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-zen archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID%
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-zen.img
+}
+
+menuentry "Arch Linux install medium with speakup screen reader (%ARCH%, ${archiso_platform})" --hotkey s --class arch --class gnu-linux --class gnu --class os --id 'archlinux-accessibility' {
+    set gfxpayload=keep
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-zen archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-zen.img
+}
+
+
+if [ "${grub_platform}" == 'efi' -a "${grub_cpu}" == 'x86_64' -a -f '/boot/memtest86+/memtest.efi' ]; then
+    menuentry 'Run Memtest86+ (RAM test)' --class memtest86 --class memtest --class gnu --class tool {
+        set gfxpayload=800x600,1024x768
+        linux /boot/memtest86+/memtest.efi
+    }
+fi
+if [ "${grub_platform}" == 'pc' -a -f '/boot/memtest86+/memtest' ]; then
+    menuentry 'Run Memtest86+ (RAM test)' --class memtest86 --class memtest --class gnu --class tool {
+        set gfxpayload=800x600,1024x768
+        linux /boot/memtest86+/memtest
+    }
+fi
+if [ "${grub_platform}" == 'efi' ]; then
+    if [ "${grub_cpu}" == 'x86_64' -a -f '/shellx64.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellx64.efi
+        }
+    elif [ "${grub_cpu}" == 'i386' -a -f '/shellia32.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellia32.efi
+        }
+    elif [ "${grub_cpu}" == 'arm64' -a -f '/shellaa64.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellaa64.efi
+        }
+    elif [ "${grub_cpu}" == 'riscv64' -a -f '/shellriscv64.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellriscv64.efi
+        }
+    elif [ "${grub_cpu}" == 'loongarch64' -a -f '/shellloongarch64.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellloongarch64.efi
+        }
+    fi
+
+    menuentry 'UEFI Firmware Settings' --id 'uefi-firmware' {
+        fwsetup
+    }
+fi
+
+menuentry 'System shutdown' --class shutdown --class poweroff {
+    echo 'System shutting down...'
+    halt
+}
+
+menuentry 'System restart' --class reboot --class restart {
+    echo 'System rebooting...'
+    reboot
+}
+
+
+# GRUB init tune for accessibility
+play 600 988 1 1319 4
@@ -0,0 +1,85 @@
+# https://www.supergrubdisk.org/wiki/Loopback.cfg
+
+# Search for the ISO volume
+search --no-floppy --set=archiso_img_dev --file "${iso_path}"
+probe --set archiso_img_dev_uuid --fs-uuid "${archiso_img_dev}"
+
+# Get a human readable platform identifier
+if [ "${grub_platform}" == 'efi' ]; then
+    archiso_platform='UEFI'
+elif [ "${grub_platform}" == 'pc' ]; then
+    archiso_platform='BIOS'
+else
+    archiso_platform="${grub_cpu}-${grub_platform}"
+fi
+
+# Set default menu entry
+default=archlinux
+timeout=15
+timeout_style=menu
+
+
+# Menu entries
+
+menuentry "Arch Linux install medium (%ARCH%, ${archiso_platform})" --class arch --class gnu-linux --class gnu --class os --id 'archlinux' {
+    set gfxpayload=keep
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-zen archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}"
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-zen.img
+}
+
+menuentry "Arch Linux install medium with speakup screen reader (%ARCH%, ${archiso_platform})" --hotkey s --class arch --class gnu-linux --class gnu --class os --id 'archlinux-accessibility' {
+    set gfxpayload=keep
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-zen archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}" accessibility=on
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-zen.img
+}
+
+
+if [ "${grub_platform}" == 'efi' -a "${grub_cpu}" == 'x86_64' -a -f '/boot/memtest86+/memtest.efi' ]; then
+    menuentry 'Run Memtest86+ (RAM test)' --class memtest86 --class memtest --class gnu --class tool {
+        set gfxpayload=800x600,1024x768
+        linux /boot/memtest86+/memtest.efi
+    }
+fi
+if [ "${grub_platform}" == 'pc' -a -f '/boot/memtest86+/memtest' ]; then
+    menuentry 'Run Memtest86+ (RAM test)' --class memtest86 --class memtest --class gnu --class tool {
+        set gfxpayload=800x600,1024x768
+        linux /boot/memtest86+/memtest
+    }
+fi
+if [ "${grub_platform}" == 'efi' ]; then
+    if [ "${grub_cpu}" == 'x86_64' -a -f '/shellx64.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellx64.efi
+        }
+    elif [ "${grub_cpu}" == 'i386' -a -f '/shellia32.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellia32.efi
+        }
+    elif [ "${grub_cpu}" == 'arm64' -a -f '/shellaa64.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellaa64.efi
+        }
+    elif [ "${grub_cpu}" == 'riscv64' -a -f '/shellriscv64.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellriscv64.efi
+        }
+    elif [ "${grub_cpu}" == 'loongarch64' -a -f '/shellloongarch64.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellloongarch64.efi
+        }
+    fi
+
+    menuentry 'UEFI Firmware Settings' --id 'uefi-firmware' {
+        fwsetup
+    }
+fi
+
+menuentry 'System shutdown' --class shutdown --class poweroff {
+    echo 'System shutting down...'
+    halt
+}
+
+menuentry 'System restart' --class reboot --class restart {
+    echo 'System rebooting...'
+    reboot
+}
@@ -0,0 +1,183 @@
+alsa-utils
+amd-ucode
+arch-install-scripts
+archinstall
+b43-fwcutter
+base
+bcachefs-tools
+bind
+bolt
+brltty
+broadcom-wl
+btrfs-progs
+clonezilla
+cloud-init
+cryptsetup
+darkhttpd
+ddrescue
+dhcpcd
+diffutils
+dmidecode
+dmraid
+dnsmasq
+dosfstools
+e2fsprogs
+edk2-shell
+efibootmgr
+espeakup
+ethtool
+exfatprogs
+f2fs-tools
+fatresize
+foot-terminfo
+fsarchiver
+gpart
+gpm
+gptfdisk
+grml-zsh-config
+grub
+hdparm
+hyperv
+intel-ucode
+irssi
+iw
+iwd
+jfsutils
+kitty-terminfo
+ldns
+less
+lftp
+libfido2
+libusb-compat
+linux-zen
+linux-atm
+linux-firmware
+linux-firmware-marvell
+livecd-sounds
+lsscsi
+lvm2
+lynx
+man-db
+man-pages
+mc
+mdadm
+memtest86+
+memtest86+-efi
+mkinitcpio
+mkinitcpio-archiso
+mkinitcpio-nfs-utils
+mmc-utils
+modemmanager
+mtools
+nano
+nbd
+ndisc6
+nfs-utils
+nilfs-utils
+nmap
+ntfs-3g
+nvme-cli
+open-iscsi
+open-vm-tools
+openconnect
+openpgp-card-tools
+openssh
+openvpn
+partclone
+parted
+partimage
+pcsclite
+ppp
+pptpclient
+pv
+qemu-guest-agent
+refind
+reflector
+rsync
+rxvt-unicode-terminfo
+screen
+sdparm
+sequoia-sq
+sg3_utils
+smartmontools
+sof-firmware
+squashfs-tools
+sudo
+syslinux
+systemd-resolvconf
+tcpdump
+terminus-font
+testdisk
+tmux
+tpm2-tools
+tpm2-tss
+udftools
+usb_modeswitch
+usbmuxd
+usbutils
+vim
+virtualbox-guest-utils-nox
+vpnc
+wireless-regdb
+wireless_tools
+wpa_supplicant
+wvdial
+xdg-utils
+xfsprogs
+xl2tpd
+zsh
+# TANINUX additions — appended to releng's packages.x86_64 by bootstrap-profile.sh.
+# (bootstrap also swaps the live kernel linux -> linux-zen.)
+# The live ISO IS the installable system (Calamares clones it via unpackfs).
+
+# --- the whole TANINUX desktop (niri/eww/greeter/theme/apps from [tanin]) ---
+tanin-desktop
+
+# --- kernel (zen) ---
+linux-zen
+linux-zen-headers
+
+# --- Btrfs + automatic snapshots (pre-update rollback via snapper) ---
+btrfs-progs
+snapper
+snap-pac
+
+# --- boot splash ---
+plymouth
+
+# --- live installer (removed from target by Calamares' packages module) ---
+calamares
+cage
+
+# --- target bootloader = systemd-boot (part of systemd) + UEFI var tool ---
+efibootmgr
+
+# --- partitioning / filesystems ---
+gptfdisk
+dosfstools
+e2fsprogs
+
+# --- preinstalled apps (decided) ---
+firefox
+thunderbird
+kitty                 # extra terminal (foot stays the niri/eww default)
+nautilus
+flatpak               # Flathub remote configured post-install
+# paru                # AUR helper — MUST be rebuilt into [tanin] first (else build fails)
+
+# --- media bundle ---
+mpv
+loupe
+gst-plugins-good
+gst-plugins-bad
+gst-plugins-ugly
+gst-libav
+gstreamer-vaapi
+
+# --- fonts & emoji ---
+noto-fonts
+noto-fonts-emoji
+noto-fonts-cjk
+
+# --- utilities ---
+file-roller
@@ -0,0 +1,25 @@
+# Build-time pacman.conf for mkarchiso (pulls live packages incl. tanin-desktop).
+# Replaces releng's pacman.conf. [tanin] is added so the airootfs can include
+# our packages. SigLevel=Never on [tanin] keeps the BUILD simple (no keyring
+# bootstrap during mkarchiso); the LIVE/target keyring trusts the key properly
+# (see airootfs/etc/pacman.conf + customize_airootfs.sh).
+[options]
+HoldPkg     = pacman glibc
+Architecture = auto
+CheckSpace
+SigLevel    = Required DatabaseOptional
+LocalFileSigLevel = Optional
+ParallelDownloads = 5
+
+[core]
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Include = /etc/pacman.d/mirrorlist
+
+[multilib]
+Include = /etc/pacman.d/mirrorlist
+
+[tanin]
+SigLevel = Never
+Server = https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# TANINUX (camel) archiso profile — overrides releng's profiledef.sh.
+# shellcheck disable=SC2034
+iso_name="taninux"
+iso_label="TANINUX_$(date +%Y%m)"
+iso_publisher="TANINUX <https://taninux.kgva.ch>"
+iso_application="TANINUX (camel) — niri/eww desktop · live + Calamares installer"
+iso_version="$(date +%Y.%m.%d)"
+install_dir="tanin"
+buildmodes=('iso')
+bootmodes=('bios.syslinux.mbr' 'bios.syslinux.eltorito'
+           'uefi-x64.systemd-boot.esp' 'uefi-x64.systemd-boot.eltorito')
+arch="x86_64"
+pacman_conf="pacman.conf"
+airootfs_image_type="squashfs"
+airootfs_image_tool_options=('-comp' 'zstd' '-Xcompression-level' '19' '-b' '1M')
+bootstrap_tarball_compression=('zstd' '-c' '-T0' '--auto-threads=logical' '--long' '-19')
+file_permissions=(
+  ["/etc/shadow"]="0:0:400"
+  ["/etc/gshadow"]="0:0:400"
+  ["/root"]="0:0:750"
+  ["/root/customize_airootfs.sh"]="0:0:755"
+  ["/usr/local/bin/tanin-installer"]="0:0:755"
+)
@@ -0,0 +1,28 @@
+SERIAL 0 115200
+UI vesamenu.c32
+MENU TITLE Arch Linux
+MENU BACKGROUND splash.png
+
+MENU WIDTH 78
+MENU MARGIN 4
+MENU ROWS 7
+MENU VSHIFT 10
+MENU TABMSGROW 14
+MENU CMDLINEROW 14
+MENU HELPMSGROW 16
+MENU HELPMSGENDROW 29
+
+# Refer to https://wiki.syslinux.org/wiki/index.php/Comboot/menu.c32
+
+MENU COLOR border       30;44   #40ffffff #a0000000 std
+MENU COLOR title        1;36;44 #9033ccff #a0000000 std
+MENU COLOR sel          7;37;40 #e0ffffff #20ffffff all
+MENU COLOR unsel        37;44   #50ffffff #a0000000 std
+MENU COLOR help         37;40   #c0ffffff #a0000000 std
+MENU COLOR timeout_msg  37;40   #80ffffff #00000000 std
+MENU COLOR timeout      1;37;40 #c0ffffff #00000000 std
+MENU COLOR msg07        37;40   #90ffffff #a0000000 std
+MENU COLOR tabmsg       31;40   #30ffffff #00000000 std
+
+MENU CLEAR
+MENU IMMEDIATE
@@ -0,0 +1,32 @@
+LABEL arch_nbd
+TEXT HELP
+Boot the Arch Linux install medium using NBD.
+It allows you to install Arch Linux or perform system maintenance.
+ENDTEXT
+MENU LABEL Arch Linux install medium (%ARCH%, NBD)
+LINUX ::/%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-zen
+INITRD ::/%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-zen.img
+APPEND archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% archiso_nbd_srv=${pxeserver} cms_verify=y
+SYSAPPEND 3
+
+LABEL arch_nfs
+TEXT HELP
+Boot the Arch Linux live medium using NFS.
+It allows you to install Arch Linux or perform system maintenance.
+ENDTEXT
+MENU LABEL Arch Linux install medium (%ARCH%, NFS)
+LINUX ::/%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-zen
+INITRD ::/%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-zen.img
+APPEND archisobasedir=%INSTALL_DIR% archiso_nfs_srv=${pxeserver}:/run/archiso/bootmnt cms_verify=y
+SYSAPPEND 3
+
+LABEL arch_http
+TEXT HELP
+Boot the Arch Linux live medium using HTTP.
+It allows you to install Arch Linux or perform system maintenance.
+ENDTEXT
+MENU LABEL Arch Linux install medium (%ARCH%, HTTP)
+LINUX ::/%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-zen
+INITRD ::/%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-zen.img
+APPEND archisobasedir=%INSTALL_DIR% archiso_http_srv=http://${pxeserver}/ cms_verify=y
+SYSAPPEND 3
@@ -0,0 +1,5 @@
+INCLUDE archiso_head.cfg
+
+INCLUDE archiso_pxe-linux.cfg
+
+INCLUDE archiso_tail.cfg
@@ -0,0 +1,20 @@
+LABEL arch
+TEXT HELP
+Boot the Arch Linux install medium on BIOS.
+It allows you to install Arch Linux or perform system maintenance.
+ENDTEXT
+MENU LABEL Arch Linux install medium (%ARCH%, BIOS)
+LINUX /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-zen
+INITRD /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-zen.img
+APPEND archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID%
+
+# Accessibility boot option
+LABEL archspeech
+TEXT HELP
+Boot the Arch Linux install medium on BIOS with speakup screen reader.
+It allows you to install Arch Linux or perform system maintenance with speech feedback.
+ENDTEXT
+MENU LABEL Arch Linux install medium (%ARCH%, BIOS) with ^speech
+LINUX /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-zen
+INITRD /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-zen.img
+APPEND archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on
@@ -0,0 +1,8 @@
+INCLUDE archiso_head.cfg
+
+DEFAULT arch
+TIMEOUT 150
+
+INCLUDE archiso_sys-linux.cfg
+
+INCLUDE archiso_tail.cfg
@@ -0,0 +1,35 @@
+LABEL existing
+TEXT HELP
+Boot an existing operating system.
+Press TAB to edit the disk and partition number to boot.
+ENDTEXT
+MENU LABEL Boot existing OS
+COM32 chain.c32
+APPEND hd0 0
+
+# https://www.memtest.org/
+LABEL memtest
+MENU LABEL Run Memtest86+ (RAM test)
+LINUX /boot/memtest86+/memtest
+
+# https://wiki.syslinux.org/wiki/index.php/Hdt_(Hardware_Detection_Tool)
+LABEL hdt
+MENU LABEL Hardware Information (HDT)
+COM32 hdt.c32
+APPEND modules_alias=hdt/modalias.gz pciids=hdt/pciids.gz
+
+LABEL reboot
+TEXT HELP
+Reboot computer.
+The computer's firmware must support APM.
+ENDTEXT
+MENU LABEL Reboot
+COM32 reboot.c32
+
+LABEL poweroff
+TEXT HELP
+Power off computer.
+The computer's firmware must support APM.
+ENDTEXT
+MENU LABEL Power Off
+COM32 poweroff.c32
@@ -0,0 +1,11 @@
+DEFAULT select
+
+LABEL select
+COM32 whichsys.c32
+APPEND -pxe- pxe -sys- sys -iso- sys
+
+LABEL pxe
+CONFIG archiso_pxe.cfg
+
+LABEL sys
+CONFIG archiso_sys.cfg
@@ -1,55 +1,58 @@
 # TANINUX additions — appended to releng's packages.x86_64 by bootstrap-profile.sh.
+# IMPORTANT: pacman package lists do NOT allow inline comments. Keep every
+# comment on its own line — a stray "# ..." after a package name turns the whole
+# line into an invalid package (that was the kitty/flatpak "target not found").
 # (bootstrap also swaps the live kernel linux -> linux-zen.)
-# The live ISO IS the installable system (Calamares clones it via unpackfs).

-# --- the whole TANINUX desktop (niri/eww/greeter/theme/apps from [tanin]) ---
+# the whole TANINUX desktop (niri/eww/greeter/theme/apps from [tanin])
 tanin-desktop

-# --- kernel (zen) ---
+# kernel (zen)
 linux-zen
 linux-zen-headers

-# --- Btrfs + automatic snapshots (pre-update rollback via snapper) ---
+# Btrfs + automatic snapshots
 btrfs-progs
 snapper
 snap-pac

-# --- boot splash ---
+# boot splash
 plymouth

-# --- live installer (removed from target by Calamares' packages module) ---
-calamares
+# live installer host (cage). calamares is AUR -> rebuild into [tanin] first,
+# then uncomment (see BUILD.md). archinstall (TUI) is already in the releng base.
 cage
+#calamares

-# --- target bootloader = systemd-boot (part of systemd) + UEFI var tool ---
+# target bootloader
 efibootmgr

-# --- partitioning / filesystems ---
+# partitioning / filesystems
 gptfdisk
 dosfstools
 e2fsprogs

-# --- preinstalled apps (decided) ---
+# preinstalled apps
 firefox
 thunderbird
-kitty                 # extra terminal (foot stays the niri/eww default)
+kitty
 nautilus
-flatpak               # Flathub remote configured post-install
-# paru                # AUR helper — MUST be rebuilt into [tanin] first (else build fails)
+flatpak
+#paru

-# --- media bundle ---
+# media (gstreamer-vaapi was removed from Arch -> gst-plugin-va is the successor)
 mpv
 loupe
 gst-plugins-good
 gst-plugins-bad
 gst-plugins-ugly
 gst-libav
-gstreamer-vaapi
+gst-plugin-va

-# --- fonts & emoji ---
+# fonts & emoji
 noto-fonts
 noto-fonts-emoji
 noto-fonts-cjk

-# --- utilities ---
+# utilities
 file-roller
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/cloud-config.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/cloud-final.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/cloud-init-local.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/cloud-init-main.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/cloud-init-network.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/ModemManager.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/systemd-networkd.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/systemd-resolved.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/systemd-timesyncd.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/hv_fcopy_daemon.service`