Fimeg/souveraine
Watch
1
0
Fork
You've already forked souveraine
 0
Code Releases Activity

docs: bootstrap private pacman archive securely

Browse source
This commit is contained in:
Fimeg 2026-07-12 22:46:37 -04:00
commit 048f180105
2 changed files with 30 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

16
packaging/arch/souveraine-edge.conf
View file

@ -1,15 +1,19 @@
# Install a local copy of this file as /etc/pacman.d/souveraine-edge.conf, then
# add `Include = /etc/pacman.d/souveraine-edge.conf` to /etc/pacman.conf.
#
# This is a private, LAN-only archive. Replace __LOCAL_GITEA_TOKEN__ and
# __ARCH__ in the *installed* copy with the local-Gitea token and the machine's
# architecture (aarch64 on the phone, x86_64 on the laptop). Do not commit
# those replacements.
# Keep the installed file root-readable only (mode 0600).
# This is a private, LAN-only archive. Replace __ARCH__ in the *installed*
# copy with the machine's architecture (aarch64 on the phone, x86_64 on the
# laptop).
#
# Pacman intentionally does not forward credentials embedded in Server URLs.
# Install `souveraine-pacman-fetch` as /usr/local/libexec/souveraine-pacman-fetch,
# add it as XferCommand under [options] in /etc/pacman.conf, and create
# /etc/pacman.d/souveraine-gitea.netrc (root:alpm, 0640) with the local-Gitea
# token. The wrapper uses that credential only for 10.10.20.120.
#
# Bootstrap the archive key first:
# pacman-key --add souveraine-archive-key.asc
# pacman-key --lsign-key 3CD9E99E222C2A174986FC9AFF4949AA20C8E911
[souveraine-__ARCH__]
SigLevel = Required DatabaseRequired
Server = http://__LOCAL_GITEA_TOKEN__@10.10.20.120:4455/Fimeg/souveraine/releases/download/edge
Server = http://10.10.20.120:4455/Fimeg/souveraine/releases/download/edge

20
packaging/arch/souveraine-pacman-fetch Executable file
View file

@ -0,0 +1,20 @@
#!/bin/sh
# Pacman's DownloadUser cannot read root-only credentials. Keep the LAN Gitea
# token in /etc/pacman.d/souveraine-gitea.netrc (root:alpm, 0640), and use it
# only for the private Souveraine archive. All other repositories are fetched
# normally, without credentials.
set -eu
out=$1
url=$2
case "$url" in
http://10.10.20.120:4455/*)
exec /usr/bin/curl -L -f \
--netrc-file /etc/pacman.d/souveraine-gitea.netrc \
-o "$out" "$url"
;;
*)
exec /usr/bin/curl -L -f -o "$out" "$url"
;;
esac