chore: add build runner CAP_SETFCAP check, fix MicroTeX compilation, and fix mono cert-sync

.gitea/workflows/build-iso.yaml

@@ -162,6 +162,23 @@ jobs:
           rmdir "$d"
           trap - EXIT
 
+      - name: Require CAP_SETFCAP for file capabilities
+        run: |
+          set -euo pipefail
+          # Without CAP_SETFCAP, pacstrap cannot restore security.capability
+          # xattrs ("unable to set CAP_SETFCAP effective capability"), so the
+          # live ISO silently ships newuidmap/newgidmap, snap-confine, dumpcap,
+          # kwin_wayland, ... without their capabilities. Fix the runner
+          # (e.g. allow CAP_SETFCAP in the gitea-runner service) rather than
+          # building a broken image.
+          eff="$(awk '/^CapEff:/{print $2}' /proc/self/status)"
+          if (( (16#$eff >> 31) & 1 )); then
+            echo "✅ CAP_SETFCAP is available (CapEff=$eff)"
+          else
+            echo "❌ CAP_SETFCAP missing (CapEff=$eff) - file capabilities would be dropped from the ISO" >&2
+            exit 1
+          fi
+
       - name: Build Arch ISO
         run: |
           set -euo pipefail

AGENTS.md

@@ -110,6 +110,9 @@ whitespace.
 - `airootfs/etc/skel/.config/illogical-impulse/presets/` carries the user's presets (`Laptop.json`, `Personal-Performance.json`, `Personal-Performance.zip`). They embed `/home/alvin/...` paths, so wallpapers/screenshots need fixing up after install.
 - End-4 metapackages are built from `localrepo/end4-pkgbuilds/` (quickshell-git, bibata-modern-classic-bin, microtex-git).
 - **quickshell pin / Qt 6.12**: end-4 pins quickshell to `41651d7` (Sep 25), which predates upstream fix `5d5d498` (Oct 3, *"use MOC includes instead of opaque pointer definitions — … Qt 6.12 compatibility"*). Arch shipped qt6 6.12.0 on Oct 8 and the old pin died with `Meta Types must be fully defined` in the moc build of quickshell-hyprland-ipc (failed CI run 137). `customize_airootfs.sh` therefore rewrites end-4's `_commit` to `11ca60be` after cloning — but **only** while it still matches `^_commit='41651d7`, so once end-4 bumps their own pin the guard goes inert and theirs wins. `localrepo/check-quickshell-pin.sh` (weekly `pin-check.yaml` job) fails CI if either pin goes stale or loses the fix; it warns instead of failing when end-4's known-stale pin is covered by the override.
+- **MicroTeX flags**: the image's `makepkg.conf` is CachyOS's (`-march=native -O3`, LTO). GCC 16.2 hit an internal compiler error (segfault) on MicroTeX's `gtkmm_main.cpp` with it (failed CI run 155; not reproducible locally), so `customize_airootfs.sh` patches end-4's `illogical-impulse-microtex-git` PKGBUILD to `options=(!lto)` + `-O2` (our `localrepo/end4-pkgbuilds/microtex-git` carries the same).
+- **CAP_SETFCAP on the runner**: without it pacstrap drops `security.capability` xattrs (newuidmap/newgidmap, snap-confine, dumpcap, kwin_wayland, ...) from the live ISO with only a warning. `build-iso.yaml` fails the job early if the runner lacks it — fix the runner, don't remove the check.
+- mono's `cert-sync` runs before `ca-certificates.crt` exists during pacstrap, so `customize_airootfs.sh` (live) and `install_pacstrap` (target) re-run it.
 - `/etc/skel/.zshrc` is owned by `grml-zsh-config`, so ours is staged as `airootfs/root/.zshrc-skel` and installed by `customize_airootfs.sh` after pacstrap — never add files under `airootfs/` at paths a package owns, or pacstrap aborts with "exists in filesystem".
 - `packages.x86_64` is sorted alphabetically. Keep it sorted when adding/removing entries.
 - `airootfs/opt/localrepo/` is a build artifact (gitignored) — never commit it.

airootfs/root/customize_airootfs.sh

@@ -113,6 +113,18 @@ if [[ -f "${QS_PKG}" ]] && grep -q "^_commit='41651d7" "${QS_PKG}"; then
   sed -i "s|^_commit='41651d7[^']*'|_commit='11ca60be22b063478ed9586ca1d7f92f0f261caf'|" "${QS_PKG}"
 fi
 
+# GCC 16.2 ICEs (segfault in ggc_set_mark) compiling MicroTeX's gtkmm_main.cpp
+# - the LaTeX binary the package ships - under CachyOS's makepkg.conf
+# (-march=native -O3 + -flto=auto), which killed CI run 155. Build it with -O2
+# and no LTO; MicroTeX is tiny, the flags buy nothing. Re-running is a no-op.
+MTX_PKG="${DOTS_REPO}/sdata/dist-arch/illogical-impulse-microtex-git/PKGBUILD"
+if [[ -f "${MTX_PKG}" ]] && ! grep -q '^options=(!lto)' "${MTX_PKG}"; then
+  echo "[customize] Building MicroTeX with -O2 and no LTO (GCC 16 ICE)..."
+  # shellcheck disable=SC2016  # expanded by makepkg, not here
+  sed -i '/^build() {/a\  export CFLAGS="${CFLAGS//-O3/-O2}" CXXFLAGS="${CXXFLAGS//-O3/-O2}"' "${MTX_PKG}"
+  printf '\noptions=(!lto)\n' >> "${MTX_PKG}"
+fi
+
 # ── end4-pC: the default quickshell config, shipped in skel ──────────────────
 # pctrade/end4-pC is a fork of the ii shell config. It lives next to ii in
 # ~/.config/quickshell and does not modify it; which one runs is decided by
@@ -225,11 +237,13 @@ fi
 
 # Rebuild the repo database (CI/update.sh ship a pre-built one alongside the
 # packages) and refresh the live system's copy of it. No network needed: the
-# remote repos were synced during pacstrap.
+# remote repos were synced during pacstrap. No -R: the loop above already
+# deleted the replaced archives, so repo-add's own cleanup only logged a
+# spurious "Cannot remove file" ERROR.
 local_pkgs=(/opt/localrepo/*.pkg.tar.zst)
 if ((${#local_pkgs[@]} > 0)); then
   echo "[customize] Rebuilding local-aur db (${#local_pkgs[@]} packages)..."
-  repo-add -R /opt/localrepo/local-aur.db.tar.gz "${local_pkgs[@]}"
+  repo-add /opt/localrepo/local-aur.db.tar.gz "${local_pkgs[@]}"
   mkdir -p /var/lib/pacman/sync
   cp -fL /opt/localrepo/local-aur.db /var/lib/pacman/sync/local-aur.db
   if [[ -f /opt/localrepo/local-aur.files ]]; then
@@ -237,6 +251,16 @@ if ((${#local_pkgs[@]} > 0)); then
   fi
 fi
 
+# ── mono certificate store ──────────────────────────────────────────────────
+# mono's post_install runs cert-sync during pacstrap, before the
+# post-transaction hook has generated ca-certificates.crt, so the store ships
+# empty ("Couldn't retrieve the file") and mono apps reject every TLS cert.
+if command -v cert-sync &>/dev/null; then
+  echo "[customize] Populating mono certificate store..."
+  cert-sync --quiet /etc/ssl/certs/ca-certificates.crt \
+    || echo "[customize] WARNING: cert-sync failed, mono store left empty" >&2
+fi
+
 # ── makepkg leftovers + throwaway account do not belong in the ISO ──────────
 if [[ -d "${DOTS_REPO}/sdata/dist-arch" ]]; then
   find "${DOTS_REPO}/sdata/dist-arch" -mindepth 2 -maxdepth 2 -type d \

airootfs/usr/local/bin/alvin-install

@@ -743,6 +743,13 @@ install_pacstrap() {
         pacstrap "$TARGET" "${pkgs[@]}" --noconfirm \
         || die "pacstrap failed - the target system is incomplete (output above, full log: $LOG)."
 
+    # mono's post_install runs cert-sync before the post-transaction hook has
+    # generated ca-certificates.crt, leaving mono's certificate store empty.
+    if [[ -x "${TARGET}/usr/bin/cert-sync" ]]; then
+        arch-chroot "$TARGET" cert-sync --quiet /etc/ssl/certs/ca-certificates.crt \
+            >> "$LOG" 2>&1 || warn "cert-sync failed - mono apps may reject TLS certificates."
+    fi
+
     ok "Packages installed."
 }
 

localrepo/end4-pkgbuilds/microtex-git/PKGBUILD

@@ -18,6 +18,8 @@ depends=(
 makedepends=("git" "cmake")
 source=("git+${url}.git")
 sha256sums=("SKIP")
+# -O3 + LTO (CachyOS makepkg.conf) make GCC 16.2 ICE on gtkmm_main.cpp
+options=(!lto)
 
 prepare() {
   cd $_pkgname
@@ -26,6 +28,7 @@ prepare() {
 }
 
 build() {
+  export CFLAGS="${CFLAGS//-O3/-O2}" CXXFLAGS="${CXXFLAGS//-O3/-O2}"
   cd $_pkgname
   cmake -B build -S . -DCMAKE_BUILD_TYPE=None
   cmake --build build