chore: add build runner CAP_SETFCAP check, fix MicroTeX compilation, and fix mono cert-sync

airootfs/root/customize_airootfs.sh

@@ -113,6 +113,18 @@ if [[ -f "${QS_PKG}" ]] && grep -q "^_commit='41651d7" "${QS_PKG}"; then
   sed -i "s|^_commit='41651d7[^']*'|_commit='11ca60be22b063478ed9586ca1d7f92f0f261caf'|" "${QS_PKG}"
 fi
 
+# GCC 16.2 ICEs (segfault in ggc_set_mark) compiling MicroTeX's gtkmm_main.cpp
+# - the LaTeX binary the package ships - under CachyOS's makepkg.conf
+# (-march=native -O3 + -flto=auto), which killed CI run 155. Build it with -O2
+# and no LTO; MicroTeX is tiny, the flags buy nothing. Re-running is a no-op.
+MTX_PKG="${DOTS_REPO}/sdata/dist-arch/illogical-impulse-microtex-git/PKGBUILD"
+if [[ -f "${MTX_PKG}" ]] && ! grep -q '^options=(!lto)' "${MTX_PKG}"; then
+  echo "[customize] Building MicroTeX with -O2 and no LTO (GCC 16 ICE)..."
+  # shellcheck disable=SC2016  # expanded by makepkg, not here
+  sed -i '/^build() {/a\  export CFLAGS="${CFLAGS//-O3/-O2}" CXXFLAGS="${CXXFLAGS//-O3/-O2}"' "${MTX_PKG}"
+  printf '\noptions=(!lto)\n' >> "${MTX_PKG}"
+fi
+
 # ── end4-pC: the default quickshell config, shipped in skel ──────────────────
 # pctrade/end4-pC is a fork of the ii shell config. It lives next to ii in
 # ~/.config/quickshell and does not modify it; which one runs is decided by
@@ -225,11 +237,13 @@ fi
 
 # Rebuild the repo database (CI/update.sh ship a pre-built one alongside the
 # packages) and refresh the live system's copy of it. No network needed: the
-# remote repos were synced during pacstrap.
+# remote repos were synced during pacstrap. No -R: the loop above already
+# deleted the replaced archives, so repo-add's own cleanup only logged a
+# spurious "Cannot remove file" ERROR.
 local_pkgs=(/opt/localrepo/*.pkg.tar.zst)
 if ((${#local_pkgs[@]} > 0)); then
   echo "[customize] Rebuilding local-aur db (${#local_pkgs[@]} packages)..."
-  repo-add -R /opt/localrepo/local-aur.db.tar.gz "${local_pkgs[@]}"
+  repo-add /opt/localrepo/local-aur.db.tar.gz "${local_pkgs[@]}"
   mkdir -p /var/lib/pacman/sync
   cp -fL /opt/localrepo/local-aur.db /var/lib/pacman/sync/local-aur.db
   if [[ -f /opt/localrepo/local-aur.files ]]; then
@@ -237,6 +251,16 @@ if ((${#local_pkgs[@]} > 0)); then
   fi
 fi
 
+# ── mono certificate store ──────────────────────────────────────────────────
+# mono's post_install runs cert-sync during pacstrap, before the
+# post-transaction hook has generated ca-certificates.crt, so the store ships
+# empty ("Couldn't retrieve the file") and mono apps reject every TLS cert.
+if command -v cert-sync &>/dev/null; then
+  echo "[customize] Populating mono certificate store..."
+  cert-sync --quiet /etc/ssl/certs/ca-certificates.crt \
+    || echo "[customize] WARNING: cert-sync failed, mono store left empty" >&2
+fi
+
 # ── makepkg leftovers + throwaway account do not belong in the ISO ──────────
 if [[ -d "${DOTS_REPO}/sdata/dist-arch" ]]; then
   find "${DOTS_REPO}/sdata/dist-arch" -mindepth 2 -maxdepth 2 -type d \

airootfs/usr/local/bin/alvin-install

@@ -743,6 +743,13 @@ install_pacstrap() {
         pacstrap "$TARGET" "${pkgs[@]}" --noconfirm \
         || die "pacstrap failed - the target system is incomplete (output above, full log: $LOG)."
 
+    # mono's post_install runs cert-sync before the post-transaction hook has
+    # generated ca-certificates.crt, leaving mono's certificate store empty.
+    if [[ -x "${TARGET}/usr/bin/cert-sync" ]]; then
+        arch-chroot "$TARGET" cert-sync --quiet /etc/ssl/certs/ca-certificates.crt \
+            >> "$LOG" 2>&1 || warn "cert-sync failed - mono apps may reject TLS certificates."
+    fi
+
     ok "Packages installed."
 }