The image rootfs is a squashfs, not a pacman install, so /var/lib/pacman
(-> /storage/.pacman/db) ships empty: on every device `pacman -Q` returns 0
and `pacman -Qu` finds nothing, so archr-update / `pacman -Syu` reports "No
updates available" even when the repo carries newer base packages. The
headline 2.0 update path therefore only ever installed user addons, never
upgraded the base system (confirmed live: local/ holds only ALPM_DB_VERSION).
Fix in two self-contained parts (no image-build wiring, so the seed always
matches the build that produced it):
- gen-pacman-repo: after building the sync db, register every just-built
package as installed (`pacman -U --dbonly`, files already in the squashfs)
and publish the resulting local/ tree as <repo>-localdb.tar.gz alongside
the packages.
- autostart/004-seed-pacmandb: on first boot, if the local db is still empty
(only ALPM_DB_VERSION) and the network is up, pull <repo>-localdb.tar.gz
from the configured release channel and extract it into
/storage/.pacman/db. Idempotent and skipped once the db is populated, so a
user's own pacman activity is never clobbered.
PENDING VALIDATION: needs a full build + repo publish to confirm the seed is
produced and that `pacman -Syu` then sees base upgrades. Best-effort on the
generator side (logs a warning rather than failing the repo build).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
awk -F'"' '/^PKG_VERSION/ ...' pulls the literal string out of the
package.mk, but a handful of packages set their version dynamically:
PKG_VERSION="$(get_pkg_version gstreamer)"
The build system resolves that at build time and the install_pkg dir
ends up correctly named (gst-libav-1.27.1/). The packager, though, was
storing the raw "$(get_pkg_version gstreamer)" string, which then
went through the charset filter and became ".get_pkg_version.gstreamer."
in the asset name. Five packages slipped through in the first
repo-dev release with broken names (gst-libav, gst-plugins-good,
vitaquake2-{rogue,xatrix,zaero}-lr).
Detect any '$(' or '${' in the version string and treat it as
"unresolved", which trips the existing dirname-suffix fallback.
27 ArchR packages use this pattern; the fix covers all of them.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
First repo-dev release uploaded 1000/1078 assets before hitting
GitHub's documented per-release limit of 1000 assets. The cap is
hit because every package shipped a paired .sig, doubling the
count without adding meaningful security.
The trust path now flows entirely through the database:
- archr-keyring ships the master public key.
- archr.db.sig proves the db came from the maintainer.
- The db records the SHA256 of every package; pacman re-hashes
after download and refuses mismatches.
To compromise a package the attacker would have to publish a
modified db that lists their hash, which requires the signing
subkey. The per-package .sig was redundant against this attack.
This is the same model Arch Linux ARM, EndeavourOS and SteamOS
use in production.
pacman.conf SigLevel flips from "Required DatabaseOptional" to
"PackageOptional DatabaseRequired"; comment expanded so a future
reader sees the why.
gen-pacman-repo drops the `gpg --detach-sign` step inside
build_one_pkg(); repo-add --sign still signs the db at the end.
Asset count shrinks from 1078 to 543 (535 packages + 8 db
artifacts), which fits comfortably in a single GitHub Release.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Three bugs caught while smoke-testing against an existing
build.ArchR-RK3326.aarch64/install_pkg tree:
1. BUILD_DIR auto-detection glob did not include the trailing arch
suffix, so build.ArchR-RK3326.aarch64 never matched. Now matches
build.*-RK3326*aarch64*.
2. Version sanitization used `echo | tr -c '[charset]' '.'` which
turns the trailing newline into a stray '.', producing versions
like "1.0.8." that pacman refuses. Swapped to printf.
3. Package layout was wrong for pacman 7 repo-add:
- .PKGINFO must be the FIRST entry in the tar (pacman streams it).
- No "./" prefix on file names (matches makepkg output).
- .PKGINFO needs `pkgbase` and `xdata = pkgtype=pkg` lines, not
just `pkgname`.
Rewrote the packing block to assemble an explicit file list with
.PKGINFO first, then tar -T.
Also: install_pkg name extraction is more robust now — sed strips
both 40-char git hashes and semver suffixes to recover the real
package name, and the package.mk lookup uses find rather than
literal globbing so packages nested at any depth are found.
Smoke test confirms repo-add accepts the resulting archive, signs
archr.db with the configured signer, and emits the expected
symlinks archr.db -> archr.db.tar.gz.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Decision: pacman repo lives on GitHub Releases at
archr-linux/archr-repo. No VPS, no repo.arch-r.io. Google Drive stays
out of runtime (backup/archive only). Cloudflare R2 fallback deferred.
Detail in docs/release-policy.md.
archr-update rewritten end-to-end:
- 188 lines of dead POST-to-update.arch-r.io code replaced by an
87-line wrapper around pacman -Syu. The POST endpoint never existed
so there is no legacy compat to preserve.
- subcommands: check, update, info. system.cfg "updates.branch" maps
to repo-stable / repo-next / repo-dev tags on archr-linux/archr-repo;
the mirrorlist is rewritten on every invocation so channel switches
are immediate.
pacman.conf rebuilt around a single [archr] repo (Arch Linux ARM
upstream removed). SigLevel starts at "Required DatabaseOptional"
during bootstrap; will tighten to "Required" once the production
master key signs the .db.
pacman-init reachability test points at github.com and the keyring
populate target is "archr" instead of "archlinuxarm".
archr-keyring repurposed: the three archlinuxarm keyring files are
removed; package.mk now expects archr.gpg / archr-trusted /
archr-revoked under keys/ and ships empty placeholders until the real
ArchR master key is generated.
scripts/repo/gen-pacman-repo + README: take the build.*-RK3326 tree
that "make docker-RK3326" leaves behind, package each install_pkg/<x>
as a .pkg.tar.zst with synthesized .PKGINFO, run repo-add to build
archr.db, optionally GPG-sign everything. Emits a `gh release create`
command for the publish step. CI hook left as a follow-up.
docs/improvements.md 2.1 marked partial: client and build script are
ready; what blocks the first usable release is generating the GPG
master key, creating archr-linux/archr-repo on GitHub, and one manual
publish for the repo-dev tag to validate the end-to-end loop.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
scripts/image: rewrite /etc/os-release block to the freedesktop layout
expected by third-party tools. ID_LIKE=arch is the change that makes
ArchR detect-cleanly as Arch family across distros, package managers
and analytics. PRETTY_NAME, ANSI_COLOR, LOGO, DOCUMENTATION_URL,
SUPPORT_URL and BUG_REPORT_URL added on top, with sensible fallbacks
from GIT_ORGANIZATION/GIT_REPO when the user has not overridden them
in distributions/ArchR/options.
Drop the empty /etc/archr-release sentinel file alongside os-release.
Arch ships /etc/arch-release the same way (empty by convention) for
tools that detect distro family by file presence rather than by parsing
os-release.
distributions/ArchR/options: fix typo HOME_URL "arc-r.io" -> "arch-r.io".
projects/ArchR/packages/archr: ship archr(7) under /usr/share/man/man7.
First man page of the distro, covers the public command surface
(archr-update, archr-config, archr-systems, etc.), the file locations
that matter (/etc/os-release, /etc/archr-release, /storage layout) and
the architectural decision recorded today (LibreELEC-style read-only
rootfs + storage overlay is by design, not technical debt; SteamOS
validates the model).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Bump Mesa version from 26.0.3 to 26.0.5 with updated SHA256 checksum.
- Modify RK3326 device tree to increase regulator max voltage for ARM.
- Update OPP settings in RK3326 DTS patch for improved performance.
- Add Python3 and xz to PortMaster dependencies.
- Enhance PortMaster startup script for better directory handling and cleanup.
- Implement HDMI resolution check with timeout in autostart script.
- Add turbo mode configuration to system settings.
- Refactor CPU frequency functions to utilize available frequencies more effectively.
- Update Dolphin emulator scripts to improve gptokeyb process handling.
- Introduce new systemd configuration for timesyncd to optimize polling intervals.
- Set uinput permissions in udev rules for better controller input handling.
- Adjust emulator package.mk to optimize performance for RK3326.
- Modify mkimage script to ensure proper FAT32 formatting and filesystem checks.
- Enhance benchmark script to auto-detect device-specific paths and improve logging.
Douglas Teles
sydarn
tiopex
spycat88
sydarn
rocknix
Philippe Simons