The guard exists so a stranger's install is never pointed at the
maintainer's forge — a property of what an install executes and ships
(bootstrap.sh, firstboot.sh, configs/, iso/), not of documentation.
Grep only those paths, so README/docs may link to the canonical forge
(fixes the red master from the build-status badge).
The runner never re-pulls a cached mutable tag, so :latest rotted until its
glibc was too old for the runner's injected node (checkout failed on
GLIBC_2.44 — every red build since Jul 13). A dated tag forces a fresh pull
and makes the build base reproducible.
mkarchiso's chroot phase needs devtmpfs mounts (init-userns CAP_SYS_ADMIN),
which rules out any LXC-nested runner; the job belongs to the gitea-runner VM.
The old comment pointed at the retired tendrildev builder.
The config's custom-commands run as root during install, so a config poisoned
by a compromised mirror was root RCE — TLS covers the transport, not the
upstream. Verify it before the @@BASE@@ substitution:
- default: SHA-256 pinned in the script (kept in lockstep with the config);
ARCH_TURNKEY_CONFIG_SHA256 overrides it, =skip opts out. Catches drift,
truncation, and a mirror poisoning only the config.
- ARCH_TURNKEY_PUBKEY: require + verify a detached GPG signature
(configs/archinstall.json.sig) against an out-of-band key — the only mode
that resists a fully compromised upstream.
Document both knobs in the README and CHANGELOG.
shellcheck flags 'sudo doesn't affect redirects', which matters when redirecting into a
root-owned file. /dev/tty is the invoking user's own controlling terminal and the redirect
is what gives nmtui a terminal at all, so the warning does not apply here.
Also drop a stale message referencing a forge that a generic install has no knowledge of.
The README promised ISO downloads from a Releases page that does not and cannot exist here —
the ISO was only ever built by a runner on the author's own forge. Say plainly that you build
it yourself, and why no prebuilt image is published.
Remove the last references to private infrastructure: the entry-point script's usage comment,
the CI runner registration, the nginx template, the install doc's hardcoded user and its
pointer to a private recovery doc, and the ISO publisher metadata.
Add the MIT LICENSE the project needed to be reusable at all, a CHANGELOG, and GitHub CI —
shellcheck, syntax, config validation, and a guard that fails the build if private
infrastructure is ever referenced from this public repo again.
The install hardcoded one specific forge: bootstrap and the archinstall custom-commands
fetched from a private Gitea, and firstboot cloned a private dotfiles repo from it. Anyone
else cloning this got an installer that could not work and that pointed at a repo they
cannot read.
Split the two phases. The base install (LUKS + btrfs + snapper + yay) is now generic and
runs from a fresh clone with no configuration. The personal phase (vault unlock, forge key
registration, dotfiles, yadm bootstrap) reads a gitignored site.env; with none present
firstboot reports what it is skipping and leaves a complete system.
One fetch root, ARCH_TURNKEY_BASE, now feeds bootstrap, the archinstall custom-commands
(via an @@BASE@@ placeholder) and the ISO autorun, defaulting to the public mirror. iso/build.sh
bakes site.env into a custom ISO so an unattended personal install stays one boot.
Split the linear script into require_network/detect_class/install_yay/load_secrets/
register_ssh_key/pull_dotfiles orchestrated by main(). Also: report yay build
success/failure explicitly (was silently swallowed), DRY the Gitea SSH host/port into
vars, and read all interactive prompts from /dev/tty (robust past the tee logging
redirect). shellcheck-clean; external command set unchanged.
- bootstrap.sh: detect target disk by lsblk TYPE=disk (excl. zram/loop/rom) instead
of a loop|sr0 grep that could false-positive
- firstboot-once: grant the user a transient NOPASSWD sudoers drop-in for the firstboot
run so setup is truly hands-off, removed as soon as firstboot returns
- archinstall.json: drop the '//' pseudo-comment keys (guarded against stricter schema
validation; the guidance lives in the docs)
- iso/build.sh: compute the ISO label in bash and inject the literal, dropping the
two-stage '$(date)'-in-profiledef eval
- README/INSTALL: firstboot AUTO-runs on first boot (was documented as a manual step);
document the Vaultwarden unlock + API SSH-key auto-registration; fix stale line count
- gpg no longer takes the archive passphrase on its command line (was briefly visible
in /proc/<pid>/cmdline to other local users); piped via fd 0 instead
- archinstall.json: list curl explicitly — custom-commands + firstboot call it directly
and today it only arrives transitively through git's dependencies
Build the standard yay package; makepkg -sir pulls the prebuilt go makedepend to
compile it, then removes go so the toolchain doesn't linger on the fresh install.
- Remove configs/provision-lvm.sh (LVM+ext4 diverged from the Btrfs+snapper path;
archinstall handles the disk layout, and INSTALL.md documents the manual fallback)
- archinstall.json: add yadm + pinentry to base packages so firstboot doesn't
runtime-install them (pacman -S --needed was already idempotent, the checks were noise)
- firstboot.sh: build yay-bin instead of yay (prebuilt binary; no Go toolchain to
compile), drop the redundant command -v checks + pinentry/yadm pacman calls
flan
flan