diff --git a/.gitea/workflows/build-iso.yaml b/.gitea/workflows/build-iso.yaml index 343d27f..19143bb 100644 --- a/.gitea/workflows/build-iso.yaml +++ b/.gitea/workflows/build-iso.yaml @@ -162,6 +162,23 @@ jobs: rmdir "$d" trap - EXIT + - name: Require CAP_SETFCAP for file capabilities + run: | + set -euo pipefail + # Without CAP_SETFCAP, pacstrap cannot restore security.capability + # xattrs ("unable to set CAP_SETFCAP effective capability"), so the + # live ISO silently ships newuidmap/newgidmap, snap-confine, dumpcap, + # kwin_wayland, ... without their capabilities. Fix the runner + # (e.g. allow CAP_SETFCAP in the gitea-runner service) rather than + # building a broken image. + eff="$(awk '/^CapEff:/{print $2}' /proc/self/status)" + if (( (16#$eff >> 31) & 1 )); then + echo "✅ CAP_SETFCAP is available (CapEff=$eff)" + else + echo "❌ CAP_SETFCAP missing (CapEff=$eff) - file capabilities would be dropped from the ISO" >&2 + exit 1 + fi + - name: Build Arch ISO run: | set -euo pipefail diff --git a/AGENTS.md b/AGENTS.md index 3d3b9b5..72b39ea 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -110,6 +110,9 @@ whitespace. - `airootfs/etc/skel/.config/illogical-impulse/presets/` carries the user's presets (`Laptop.json`, `Personal-Performance.json`, `Personal-Performance.zip`). They embed `/home/alvin/...` paths, so wallpapers/screenshots need fixing up after install. - End-4 metapackages are built from `localrepo/end4-pkgbuilds/` (quickshell-git, bibata-modern-classic-bin, microtex-git). - **quickshell pin / Qt 6.12**: end-4 pins quickshell to `41651d7` (Sep 25), which predates upstream fix `5d5d498` (Oct 3, *"use MOC includes instead of opaque pointer definitions — … Qt 6.12 compatibility"*). Arch shipped qt6 6.12.0 on Oct 8 and the old pin died with `Meta Types must be fully defined` in the moc build of quickshell-hyprland-ipc (failed CI run 137). `customize_airootfs.sh` therefore rewrites end-4's `_commit` to `11ca60be` after cloning — but **only** while it still matches `^_commit='41651d7`, so once end-4 bumps their own pin the guard goes inert and theirs wins. `localrepo/check-quickshell-pin.sh` (weekly `pin-check.yaml` job) fails CI if either pin goes stale or loses the fix; it warns instead of failing when end-4's known-stale pin is covered by the override. +- **MicroTeX flags**: the image's `makepkg.conf` is CachyOS's (`-march=native -O3`, LTO). GCC 16.2 hit an internal compiler error (segfault) on MicroTeX's `gtkmm_main.cpp` with it (failed CI run 155; not reproducible locally), so `customize_airootfs.sh` patches end-4's `illogical-impulse-microtex-git` PKGBUILD to `options=(!lto)` + `-O2` (our `localrepo/end4-pkgbuilds/microtex-git` carries the same). +- **CAP_SETFCAP on the runner**: without it pacstrap drops `security.capability` xattrs (newuidmap/newgidmap, snap-confine, dumpcap, kwin_wayland, ...) from the live ISO with only a warning. `build-iso.yaml` fails the job early if the runner lacks it — fix the runner, don't remove the check. +- mono's `cert-sync` runs before `ca-certificates.crt` exists during pacstrap, so `customize_airootfs.sh` (live) and `install_pacstrap` (target) re-run it. - `/etc/skel/.zshrc` is owned by `grml-zsh-config`, so ours is staged as `airootfs/root/.zshrc-skel` and installed by `customize_airootfs.sh` after pacstrap — never add files under `airootfs/` at paths a package owns, or pacstrap aborts with "exists in filesystem". - `packages.x86_64` is sorted alphabetically. Keep it sorted when adding/removing entries. - `airootfs/opt/localrepo/` is a build artifact (gitignored) — never commit it. diff --git a/airootfs/root/customize_airootfs.sh b/airootfs/root/customize_airootfs.sh index 88b0f3f..8ef9c81 100644 --- a/airootfs/root/customize_airootfs.sh +++ b/airootfs/root/customize_airootfs.sh @@ -113,6 +113,18 @@ if [[ -f "${QS_PKG}" ]] && grep -q "^_commit='41651d7" "${QS_PKG}"; then sed -i "s|^_commit='41651d7[^']*'|_commit='11ca60be22b063478ed9586ca1d7f92f0f261caf'|" "${QS_PKG}" fi +# GCC 16.2 ICEs (segfault in ggc_set_mark) compiling MicroTeX's gtkmm_main.cpp +# - the LaTeX binary the package ships - under CachyOS's makepkg.conf +# (-march=native -O3 + -flto=auto), which killed CI run 155. Build it with -O2 +# and no LTO; MicroTeX is tiny, the flags buy nothing. Re-running is a no-op. +MTX_PKG="${DOTS_REPO}/sdata/dist-arch/illogical-impulse-microtex-git/PKGBUILD" +if [[ -f "${MTX_PKG}" ]] && ! grep -q '^options=(!lto)' "${MTX_PKG}"; then + echo "[customize] Building MicroTeX with -O2 and no LTO (GCC 16 ICE)..." + # shellcheck disable=SC2016 # expanded by makepkg, not here + sed -i '/^build() {/a\ export CFLAGS="${CFLAGS//-O3/-O2}" CXXFLAGS="${CXXFLAGS//-O3/-O2}"' "${MTX_PKG}" + printf '\noptions=(!lto)\n' >> "${MTX_PKG}" +fi + # ── end4-pC: the default quickshell config, shipped in skel ────────────────── # pctrade/end4-pC is a fork of the ii shell config. It lives next to ii in # ~/.config/quickshell and does not modify it; which one runs is decided by @@ -225,11 +237,13 @@ fi # Rebuild the repo database (CI/update.sh ship a pre-built one alongside the # packages) and refresh the live system's copy of it. No network needed: the -# remote repos were synced during pacstrap. +# remote repos were synced during pacstrap. No -R: the loop above already +# deleted the replaced archives, so repo-add's own cleanup only logged a +# spurious "Cannot remove file" ERROR. local_pkgs=(/opt/localrepo/*.pkg.tar.zst) if ((${#local_pkgs[@]} > 0)); then echo "[customize] Rebuilding local-aur db (${#local_pkgs[@]} packages)..." - repo-add -R /opt/localrepo/local-aur.db.tar.gz "${local_pkgs[@]}" + repo-add /opt/localrepo/local-aur.db.tar.gz "${local_pkgs[@]}" mkdir -p /var/lib/pacman/sync cp -fL /opt/localrepo/local-aur.db /var/lib/pacman/sync/local-aur.db if [[ -f /opt/localrepo/local-aur.files ]]; then @@ -237,6 +251,16 @@ if ((${#local_pkgs[@]} > 0)); then fi fi +# ── mono certificate store ────────────────────────────────────────────────── +# mono's post_install runs cert-sync during pacstrap, before the +# post-transaction hook has generated ca-certificates.crt, so the store ships +# empty ("Couldn't retrieve the file") and mono apps reject every TLS cert. +if command -v cert-sync &>/dev/null; then + echo "[customize] Populating mono certificate store..." + cert-sync --quiet /etc/ssl/certs/ca-certificates.crt \ + || echo "[customize] WARNING: cert-sync failed, mono store left empty" >&2 +fi + # ── makepkg leftovers + throwaway account do not belong in the ISO ────────── if [[ -d "${DOTS_REPO}/sdata/dist-arch" ]]; then find "${DOTS_REPO}/sdata/dist-arch" -mindepth 2 -maxdepth 2 -type d \ diff --git a/airootfs/usr/local/bin/alvin-install b/airootfs/usr/local/bin/alvin-install index bd040fb..31ed1ea 100755 --- a/airootfs/usr/local/bin/alvin-install +++ b/airootfs/usr/local/bin/alvin-install @@ -743,6 +743,13 @@ install_pacstrap() { pacstrap "$TARGET" "${pkgs[@]}" --noconfirm \ || die "pacstrap failed - the target system is incomplete (output above, full log: $LOG)." + # mono's post_install runs cert-sync before the post-transaction hook has + # generated ca-certificates.crt, leaving mono's certificate store empty. + if [[ -x "${TARGET}/usr/bin/cert-sync" ]]; then + arch-chroot "$TARGET" cert-sync --quiet /etc/ssl/certs/ca-certificates.crt \ + >> "$LOG" 2>&1 || warn "cert-sync failed - mono apps may reject TLS certificates." + fi + ok "Packages installed." } diff --git a/localrepo/end4-pkgbuilds/microtex-git/PKGBUILD b/localrepo/end4-pkgbuilds/microtex-git/PKGBUILD index b8bb738..b0c1157 100644 --- a/localrepo/end4-pkgbuilds/microtex-git/PKGBUILD +++ b/localrepo/end4-pkgbuilds/microtex-git/PKGBUILD @@ -18,6 +18,8 @@ depends=( makedepends=("git" "cmake") source=("git+${url}.git") sha256sums=("SKIP") +# -O3 + LTO (CachyOS makepkg.conf) make GCC 16.2 ICE on gtkmm_main.cpp +options=(!lto) prepare() { cd $_pkgname @@ -26,6 +28,7 @@ prepare() { } build() { + export CFLAGS="${CFLAGS//-O3/-O2}" CXXFLAGS="${CXXFLAGS//-O3/-O2}" cd $_pkgname cmake -B build -S . -DCMAKE_BUILD_TYPE=None cmake --build build