alvinlolloandClaude Opus 5.5 03f0ca05e0 fix(build): Verify cachyos and chaotic-aur signatures at ISO build time ...

Both repos used SigLevel = Optional TrustAll, so unsigned or tampered
packages went straight into the ISO. Inherit Required DatabaseOptional
from [options] and have build-iso import + lsign both signing keys.

Also in build-iso: detach only loop devices backed by the work dir
(losetup -D hit every loop on the runner host) and drop the ?token=
download fallback that put the API token into access logs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-11 17:39:22 +11:00

..

workflows

fix(build): Verify cachyos and chaotic-aur signatures at ISO build time

2026-10-11 17:39:22 +11:00