chore: add build runner CAP_SETFCAP check, fix MicroTeX compilation, and fix mono cert-sync

2026-10-11 19:41:08 +11:00
parent b68623a782
commit 3275ec9845
5 changed files with 56 additions and 2 deletions
@@ -162,6 +162,23 @@ jobs:
          rmdir "$d"
          trap - EXIT

+      - name: Require CAP_SETFCAP for file capabilities
+        run: |
+          set -euo pipefail
+          # Without CAP_SETFCAP, pacstrap cannot restore security.capability
+          # xattrs ("unable to set CAP_SETFCAP effective capability"), so the
+          # live ISO silently ships newuidmap/newgidmap, snap-confine, dumpcap,
+          # kwin_wayland, ... without their capabilities. Fix the runner
+          # (e.g. allow CAP_SETFCAP in the gitea-runner service) rather than
+          # building a broken image.
+          eff="$(awk '/^CapEff:/{print $2}' /proc/self/status)"
+          if (( (16#$eff >> 31) & 1 )); then
+            echo "✅ CAP_SETFCAP is available (CapEff=$eff)"
+          else
+            echo "❌ CAP_SETFCAP missing (CapEff=$eff) - file capabilities would be dropped from the ISO" >&2
+            exit 1
+          fi
+
      - name: Build Arch ISO
        run: |
          set -euo pipefail