Douglas Teles
3d18661bf8
The image rootfs is a squashfs, not a pacman install, so /var/lib/pacman (-> /storage/.pacman/db) ships empty: on every device `pacman -Q` returns 0 and `pacman -Qu` finds nothing, so archr-update / `pacman -Syu` reports "No updates available" even when the repo carries newer base packages. The headline 2.0 update path therefore only ever installed user addons, never upgraded the base system (confirmed live: local/ holds only ALPM_DB_VERSION). Fix in two self-contained parts (no image-build wiring, so the seed always matches the build that produced it): - gen-pacman-repo: after building the sync db, register every just-built package as installed (`pacman -U --dbonly`, files already in the squashfs) and publish the resulting local/ tree as <repo>-localdb.tar.gz alongside the packages. - autostart/004-seed-pacmandb: on first boot, if the local db is still empty (only ALPM_DB_VERSION) and the network is up, pull <repo>-localdb.tar.gz from the configured release channel and extract it into /storage/.pacman/db. Idempotent and skipped once the db is populated, so a user's own pacman activity is never clobbered. PENDING VALIDATION: needs a full build + repo publish to confirm the seed is produced and that `pacman -Syu` then sees base upgrades. Best-effort on the generator side (logs a warning rather than failing the repo build). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
scripts/repo
Tooling for the GitHub-Releases-as-pacman-mirror workflow described in
docs/release-policy.md. The end result is a tag like repo-stable
on archr-linux/archr-repo with the assembled .pkg.tar.zst files
and signed metadata.
gen-pacman-repo
Reads the finished build tree (build.*-RK3326/install_pkg/<pkg>/)
that make docker-RK3326 leaves behind, packs each <pkg> directory
into a <pkg>-<version>-1-aarch64.pkg.tar.zst, generates the
.PKGINFO sidecar that pacman needs, and runs repo-add to build
archr.db and archr.files.
Run after a successful build:
BUILD_DIR=build.ArchR-RK3326.aarch64-2026.06-devel \
OUT_DIR=/tmp/repo-out \
CHANNEL=dev \
SIGNER= \
scripts/repo/gen-pacman-repo
Then upload:
gh release create repo-dev \
--repo archr-linux/archr-repo \
--title "ArchR repo dev $(date +%Y%m%d)" \
/tmp/repo-out/*
GPG signing
For production releases, set SIGNER=<fingerprint> and have the
agent (or a YubiKey-backed agent) ready. repo-add --sign will sign
the .db as it walks the package list, and each .pkg.tar.zst gets a
.sig as well.
The master key whose public half is bundled into the archr-keyring
package must include <fingerprint> either directly or as a signed
subkey, otherwise pacman-key --populate archr on the client will
not extend trust to packages signed by it.
Channels and tag mapping
archr-update rewrites /etc/pacman.d/mirrorlist based on
system.cfg "updates.branch":
| Channel value | Mirror tag on archr-linux/archr-repo |
|---|---|
stable (default) |
repo-stable |
next |
repo-next |
dev |
repo-dev |
The promotion workflow (dev -> next -> stable) is documented in
docs/release-policy.md.