Finalize RC4 bootstrap keyring without activating strict signing

build-inputs/omarchy-mac-keyring/PKGBUILD

@@ -1,16 +1,16 @@
 # Maintainer: Omarchy Mac
 
 pkgname=omarchy-mac-keyring
-pkgver=20260913
-pkgrel=1
+pkgver=20260914
+pkgrel=2
 pkgdesc='Omarchy Mac package signing keyring'
 arch=(any)
 url='https://github.com/omarchy-mac/omarchy-mac'
 license=('GPL-3.0-or-later')
 install=$pkgname.install
 source=('omarchy-mac.gpg' 'omarchy-mac-trusted' 'omarchy-mac-revoked')
-sha512sums=('0e411148bf58cb1cf3c1ef544ea0936d82b0d7b3996c3ef3d20ac909959129c1d7cb58dc84ac466cd3e2d75db228aff896640899b4bbbef19e7636f3033a7ea8'
-            '2fb4497f96fd9f446e0177f9dbf8eb34f0ad3dce5fc7fb687312c5e20a1127ceb68f0d6022424f35b37e2a6a91fb097b2212595375fa4d37d7547697b17de86e'
+sha512sums=('3b09ea4dcae2e7957c8543fc926522cb35f19915d5855b998db78761f4d35b04a1409f53726e47267fcfecfd31e66b7d16a8894603dbb20886dd000e4ef984fc'
+            '5ff1f0c04c98963d89a941fe160bb4a3010ee541f1a013931230eae40e1c7f9ea59b867d4241b4d8c1f39387655c8e1794db3912e5c369f9e98883df074d46a7'
             'cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e')
 
 package() {

build-packages.sh

@@ -122,14 +122,53 @@ ensure_snapper_dependency() {
 }
 
 ensure_omarchy_mac_keyring_dependency() {
-  local pkgbuild="$1"
+  local pkgbuild="$1" minimum="20260914-2"
+  local index in_depends=0 found=0 insert_index=0 line scan token suffix operator version replacement
+  local pattern="['\"]omarchy-mac-keyring((>=|<=|=|>|<)([^'\"]+))?['\"]"
+  local -a lines=()
 
   grep -qx 'depends=(' "$pkgbuild" ||
     fail "omarchy PKGBUILD no longer has the expected depends array: $pkgbuild"
-  if ! sed -n '/^depends=(/,/^)/p' "$pkgbuild" |
-    grep -qE "^[[:space:]]*['\"]omarchy-mac-keyring([<>=][^'\"]*)?['\"]([[:space:]]|$)"; then
-    sed -i "/^depends=(/a\\  'omarchy-mac-keyring'" "$pkgbuild"
+  mapfile -t lines <"$pkgbuild"
+  for index in "${!lines[@]}"; do
+    line=${lines[$index]}
+    if [[ $line == 'depends=(' ]]; then
+      in_depends=1
+      insert_index=$index
+    elif [[ $line == ')' ]]; then
+      in_depends=0
+    elif (( in_depends )); then
+      scan=${line%%#*}
+      while [[ $scan =~ $pattern ]]; do
+        token=${BASH_REMATCH[0]}
+        suffix=${BASH_REMATCH[1]}
+        operator=${BASH_REMATCH[2]}
+        version=${BASH_REMATCH[3]}
+        replacement="'omarchy-mac-keyring>=$minimum'"
+        if [[ -n $suffix ]]; then
+          case "$operator" in
+            '>='|'>'|'=')
+              if (( $(vercmp "$version" "$minimum") >= 0 )); then
+                replacement=$token
+              elif [[ $operator == '=' ]]; then
+                fail "Keyring pin predates the required trust transition: $token"
+              fi
+              ;;
+            *) fail "Keyring upper bound needs review for the trust transition: $token" ;;
+          esac
+        fi
+        # Replace only this dependency token, preserving adjacent dependencies.
+        line=${line//"$token"/"$replacement"}
+        scan=${scan#*"$token"}
+        found=1
+      done
+      lines[$index]=$line
+    fi
+  done
+  if (( ! found )); then
+    lines[$insert_index]+=$'\n'"  'omarchy-mac-keyring>=$minimum'"
   fi
+  printf '%s\n' "${lines[@]}" >"$pkgbuild"
 }
 
 # Upstream's package() deletes /etc/mkinitcpio.conf.d wholesale on aarch64,

default/pacman/keyrings/omarchy-mac-trusted

@@ -1 +1 @@
-F3C5AE3FCFFC738C301E30A8F0C548C0D27279F7:4:
+FBD6874D423C418DDB6D143EECE19CDDE306DBD2:4:

docs/arm-package-sources.md

@@ -12,7 +12,7 @@ Use `omarchy update` for system upgrades. A bare `pacman -Syu` does not update t
 
 The fork-owned repository uses distinct `stable`, `rc`, and `edge` release coordinates under `https://github.com/omarchy-mac/omarchy-pkgs-aarch64/releases/download/`. All three lanes provide `omarchy` and `omarchy-settings`; ARM does not request the x86 `omarchy-dev` pair. Channel reporting reads the managed ARM server, so an older installation pointing at `/edge` reports edge even when its installed package names are `omarchy` and `omarchy-settings`.
 
-Omarchy Mac has a separate package-signing primary key, `F3C5AE3FCFFC738C301E30A8F0C548C0D27279F7`. Its exact public bytes ship in `omarchy-mac-keyring`; upstream `omarchy-keyring` remains installed for upstream packages. The 4.0.3rc4 bootstrap is the final unsigned fork transaction and retains the old repository policy only long enough to deliver and populate this trust. The following RC is signed by subkey `6C2597C6E69FC4898D3D560E331307696030285E` and changes the fork policy to `PackageRequired DatabaseRequired TrustedOnly`. Against that signed lane, a client that skipped the bootstrap cannot verify the candidate and stops before changing packages.
+Omarchy Mac's new package-signing primary is `FBD6874D423C418DDB6D143EECE19CDDE306DBD2`, with signing subkey `D791ED0C72439D9F8757421258043B2770A25762`. Only the new fork primary ships in `omarchy-mac-keyring` version `20260914-2`; upstream keyrings remain installed. This local RC4 bootstrap candidate delivers and populates the keyring without changing the existing fork signature policy. New bootstrap configurations use the explicitly disclosed `Optional TrustAll` policy; stricter existing policies are preserved. After actual client delivery and upgrade validation, a separate signed RC5 may activate `PackageRequired DatabaseRequired TrustedOnly`. This candidate contains no strict-signing activation migration, and preparing it does not publish a release.
 
 An explicit channel switch goes through the normal update lock, snapshot and migration pipeline. It stages the current pacman configuration, changing only the managed ARM lane and reapplying the existing explicit upstream graphics policy. Other repository ordering, options and mirror Includes are preserved. Custom or ambiguous ARM server/Include layouts are rejected rather than guessed. ARM refresh uses this same path and no longer runs the reset-only `pre-refresh-pacman` hook, because it does not discard and recreate the user's configuration. The x86 reset path retains that hook; normal update hooks still run after successful migrations.
 
@@ -22,6 +22,16 @@ The persistent configuration is committed only after successful package installa
 
 This freezes one switch transaction, not future distribution upgrades. Arch Linux ARM, Asahi and the explicitly selected upstream graphics stack still resolve according to their rolling policies on the next update. Record their resolved versions when qualifying an RC; a different resolved stack needs new compatibility evidence. Captured repositories use a task directory beneath `${XDG_CACHE_HOME:-$HOME/.cache}/omarchy/channels`, require disk-backed storage with sufficient free space, and are removed after the transaction. Existing package caches are reused without deleting their archives.
 
+## RC4 trust bootstrap qualification
+
+The primary changed before signing activation to finalize signing-key management; this is housekeeping, not a compromise response. The package ships only the new primary and an empty `omarchy-mac-revoked` file. Population does not remove previously installed keys: a host that already trusted the old primary retains that trust, while a fresh host receives only the new fork primary. No migration deletes or revokes old or unrelated trust.
+
+Publish the reviewed `omarchy-mac-keyring` package at `20260914-2` or newer with the RC4 package pair before asking clients to run this source's migrations. Both the pending bootstrap migration and its successor require that installed version. A source/manual update ahead of package publication stops with an explanatory error and remains pending; it must not skip the failed migration or weaken signature policy to continue.
+
+Before RC4 publication, qualify the actual artifacts on a fresh base and an existing installation. Include a real prior-keyring upgrade and verify that the new primary becomes trusted, old and unrelated installed trust survives, completed migration markers stay skipped, and pending markers appear only after successful trust population. The opt-in native package test covers disposable package hooks and trust when run directly on Arch Linux ARM; it is intentionally separate from the hosted Ubuntu/nspawn install workflow and does not replace physical Mac installation and upgrade qualification.
+
+A development host that already ran the later strict-signing migration cannot install unsigned RC4 under `PackageRequired DatabaseRequired TrustedOnly`. A migration-marker fixture does not prove that transaction works. Use a clean disposable baseline with the supported RC4 policy for the unsigned canary; do not automatically reset a host's stricter policy or delete its migration markers. Qualify strict signing separately with the signed candidate.
+
 ## Fresh Apple Silicon installation
 
 `./install.sh --channel rc` (or `OMARCHY_MIRROR=rc ./install.sh`) installs the published lane's captured `omarchy`/`omarchy-settings` pair. It verifies availability, resolves dependencies and downloads under the configured signature policy before changing locale, packages or active repository configuration. If the base has no managed ARM section, preflight adds one only to its candidate; custom or hidden managed sections must be configured explicitly. The rc4 bootstrap retains the existing `Optional TrustAll` fork policy because its archive and database are intentionally unsigned. This is the final use of that trust model. The following signed RC requires trusted package and database signatures. Required upstream graphics signatures remain required throughout.

install.sh

@@ -11,7 +11,7 @@ set -euo pipefail
 readonly checkout="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 readonly package_output="$checkout/build-output"
 readonly asahi_alarm_key="12CE6799A94A3F1B5DDFFE88F576553597FB8FEB"
-readonly omarchy_mac_key="F3C5AE3FCFFC738C301E30A8F0C548C0D27279F7"
+readonly omarchy_mac_key="FBD6874D423C418DDB6D143EECE19CDDE306DBD2"
 source "$checkout/install/helpers/arm-package-sources.sh"
 source "$checkout/install/helpers/arm-channel.sh"
 install_channel="${OMARCHY_MIRROR:-}"

install/helpers/arm-channel.sh

@@ -211,6 +211,22 @@ omarchy_arm_channel_key_fingerprints() {
     awk -F: '$1 == "fpr" { print $10 }' | sort
 }
 
+# Trust the pinned new primary only inside the private transaction keyring.
+omarchy_arm_channel_trust_fork() {
+  local keyring="$1"
+  local active_key="FBD6874D423C418DDB6D143EECE19CDDE306DBD2"
+  local fork_keyfile="${OMARCHY_SIGNING_SOURCE:-$OMARCHY_PATH}/default/pacman/keyrings/omarchy-mac.gpg"
+  if ! sudo gpg --homedir "$keyring" --batch --list-keys "$active_key" >/dev/null 2>&1; then
+    [[ -f $fork_keyfile && ! -L $fork_keyfile ]] || {
+      echo "Pinned Omarchy Mac signing key is missing or unsafe: $fork_keyfile" >&2
+      return 1
+    }
+    sudo pacman-key --gpgdir "$keyring" --add "$fork_keyfile" || return 1
+  fi
+  omarchy_arm_channel_key_fingerprints "$keyring" | grep -qxF "$active_key" || return 1
+  sudo pacman-key --gpgdir "$keyring" --lsign-key "$active_key" || return 1
+}
+
 # Preflight has no installed-package/config/keyring side effects. The caller
 # retains this directory until applying or abandoning the captured transaction.
 omarchy_arm_channel_prepare() {
@@ -250,19 +266,7 @@ omarchy_arm_channel_prepare() {
   if [[ $allow_new == "fresh" ]]; then
     sudo pacman-key --gpgdir "$stage/keyring" --lsign-key "$key"
   fi
-  # The fork key is source-pinned. Import exactly those committed bytes rather
-  # than consulting a keyserver, then verify the full primary fingerprint.
-  local fork_key="F3C5AE3FCFFC738C301E30A8F0C548C0D27279F7"
-  local fork_keyfile="${OMARCHY_SIGNING_SOURCE:-$OMARCHY_PATH}/default/pacman/keyrings/omarchy-mac.gpg"
-  if ! sudo gpg --homedir "$stage/keyring" --batch --list-keys "$fork_key" >/dev/null 2>&1; then
-    [[ -f $fork_keyfile && ! -L $fork_keyfile ]] || {
-      echo "Pinned Omarchy Mac signing key is missing or unsafe: $fork_keyfile" >&2
-      return 1
-    }
-    sudo pacman-key --gpgdir "$stage/keyring" --add "$fork_keyfile"
-    omarchy_arm_channel_key_fingerprints "$stage/keyring" | grep -qxF "$fork_key" || return 1
-  fi
-  sudo pacman-key --gpgdir "$stage/keyring" --lsign-key "$fork_key"
+  omarchy_arm_channel_trust_fork "$stage/keyring" || return 1
   omarchy_arm_channel_key_fingerprints "$stage/keyring" >"$stage/keys-before"
   local -a probe=(--config "$stage/resolved.conf" --dbpath "$stage/db" --cachedir "$stage/cache" --gpgdir "$stage/keyring" --logfile "$stage/preflight.log")
   sudo env OMARCHY_UPDATE_PACMAN=1 pacman "${probe[@]}" -Sy --noconfirm

migrations/1789316115.sh

@@ -1,15 +1,36 @@
 echo "Trust packages signed by Omarchy Mac"
 
-readonly omarchy_mac_signing_key='F3C5AE3FCFFC738C301E30A8F0C548C0D27279F7'
+readonly omarchy_mac_signing_key='FBD6874D423C418DDB6D143EECE19CDDE306DBD2'
 
 # The package is a dependency of omarchy, but keep this self-repairing for a
 # partial/manual upgrade. Do not weaken the repository policy to fetch it.
 if omarchy-pkg-missing omarchy-mac-keyring; then
   omarchy-pkg-add omarchy-mac-keyring
 fi
 
-sudo pacman-key --populate omarchy-mac
-sudo pacman-key --finger "$omarchy_mac_signing_key" | tr -d '[:space:]' | grep -qF "$omarchy_mac_signing_key"
+# The helper may skip an unavailable package, and an installed older package
+# does not satisfy the bootstrap. Check before explicit trust population or
+# completing this marker so a checkout ahead of publication fails clearly.
+# If the helper installs a package, that package's own scriptlets still run.
+installed_keyring=$(pacman -Q omarchy-mac-keyring) || {
+  echo "Omarchy Mac keyring 20260914-2 or newer is required; install the reviewed RC4 keyring package before retrying this migration." >&2
+  exit 1
+}
+installed_version=${installed_keyring#* }
+version_comparison=$(vercmp "$installed_version" 20260914-2) || exit 1
+if (( version_comparison < 0 )); then
+  echo "Omarchy Mac keyring 20260914-2 or newer is required (installed: $installed_version); complete the reviewed RC4 package upgrade before retrying this migration." >&2
+  exit 1
+fi
+
+sudo pacman-key --populate omarchy-mac || {
+  echo "Could not populate Omarchy Mac signing trust; this migration remains pending." >&2
+  exit 1
+}
+if ! sudo pacman-key --finger "$omarchy_mac_signing_key" | tr -d '[:space:]' | grep -qF "$omarchy_mac_signing_key"; then
+  echo "The required Omarchy Mac signing primary $omarchy_mac_signing_key is missing after keyring population." >&2
+  exit 1
+fi
 
 # Policy remains unchanged for this one disclosed bootstrap transaction. The
 # next, signed RC carries a successor migration that requires both package and

migrations/1789407944.sh

@@ -0,0 +1,24 @@
+echo "Populate the finalized Omarchy Mac signing keyring"
+
+# A successor is required for clients that already marked earlier migrations
+# complete. Never remove existing keys or change repository signature policy.
+installed=$(pacman -Q omarchy-mac-keyring) || {
+  echo "Install the reviewed Omarchy Mac keyring package first." >&2
+  exit 1
+}
+version=${installed#* }
+comparison=$(vercmp "$version" 20260914-2) || exit 1
+if (( comparison < 0 )); then
+  echo "Omarchy Mac keyring 20260914-2 or newer is required." >&2
+  exit 1
+fi
+
+sudo pacman-key --populate omarchy-mac || {
+  echo "Could not populate Omarchy Mac signing trust; this migration remains pending." >&2
+  exit 1
+}
+omarchy_mac_signing_key=FBD6874D423C418DDB6D143EECE19CDDE306DBD2
+if ! sudo pacman-key --finger "$omarchy_mac_signing_key" | tr -d '[:space:]' | grep -qF "$omarchy_mac_signing_key"; then
+  echo "The required Omarchy Mac signing primary $omarchy_mac_signing_key is missing after keyring population." >&2
+  exit 1
+fi

test/fixtures/omarchy-mac-keyring-20260913-1/PKGBUILD

@@ -0,0 +1,19 @@
+# Maintainer: Omarchy Mac
+
+pkgname=omarchy-mac-keyring
+pkgver=20260913
+pkgrel=1
+pkgdesc='Omarchy Mac package signing keyring'
+arch=(any)
+url='https://github.com/omarchy-mac/omarchy-mac'
+license=('GPL-3.0-or-later')
+install=$pkgname.install
+source=('omarchy-mac.gpg' 'omarchy-mac-trusted' 'omarchy-mac-revoked')
+sha512sums=('0e411148bf58cb1cf3c1ef544ea0936d82b0d7b3996c3ef3d20ac909959129c1d7cb58dc84ac466cd3e2d75db228aff896640899b4bbbef19e7636f3033a7ea8'
+            '2fb4497f96fd9f446e0177f9dbf8eb34f0ad3dce5fc7fb687312c5e20a1127ceb68f0d6022424f35b37e2a6a91fb097b2212595375fa4d37d7547697b17de86e'
+            'cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e')
+
+package() {
+  install -D -m0644 -t "$pkgdir/usr/share/pacman/keyrings/" \
+    omarchy-mac.gpg omarchy-mac-trusted omarchy-mac-revoked
+}

test/fixtures/omarchy-mac-keyring-20260913-1/README.md

@@ -0,0 +1,5 @@
+# Shipped quattro keyring package fixture
+
+These five package sources are copied byte-for-byte from `origin/quattro` commit `04862a02c556b5c4305b2ea3430e9d2cfaab66c4`: `build-inputs/omarchy-mac-keyring/{PKGBUILD,omarchy-mac-keyring.install}` and `default/pacman/keyrings/{omarchy-mac.gpg,omarchy-mac-trusted,omarchy-mac-revoked}`. The package version is `20260913-1`. This provenance identifier is informational; running the test requires no Git history or remote access.
+
+The fixture contains only public certificates, public trust metadata, and package source. It models the old-primary-only package shipped on the quattro baseline, does not revoke keys, and is the real predecessor for upgrade testing. `SHA256SUMS` binds the five original files. The native test verifies this manifest before building and checks that upgrading adds the new primary without disturbing existing old or unrelated client trust.

test/fixtures/omarchy-mac-keyring-20260913-1/SHA256SUMS

@@ -0,0 +1,5 @@
+c749142502810e7a0e002d1a01b34cfe43169c57cd1b820415eb1c6e4c123826  PKGBUILD
+604333c2027bf219ad759d7c1e8f8238a6fc3405f8fdb7ab8757c51c27b1cf60  omarchy-mac-keyring.install
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  omarchy-mac-revoked
+aad605b6a64277974467fe9c6c74c345d3e095cf19eb8853eec4803faf180268  omarchy-mac-trusted
+6e2801dc5c790b817fa5fc99cb2f4b93063042cbc94b2eb9c0e80026d97c6ca0  omarchy-mac.gpg

test/fixtures/omarchy-mac-keyring-20260913-1/omarchy-mac-keyring.install

@@ -0,0 +1,11 @@
+post_upgrade() {
+  if [ -x usr/bin/pacman-key ] && usr/bin/pacman-key -l >/dev/null 2>&1; then
+    usr/bin/pacman-key --populate omarchy-mac
+  else
+    echo ' >>> Initialize pacman-key, then run pacman-key --populate omarchy-mac.'
+  fi
+}
+
+post_install() {
+  post_upgrade
+}

test/fixtures/omarchy-mac-keyring-20260913-1/omarchy-mac-trusted

@@ -0,0 +1 @@
+F3C5AE3FCFFC738C301E30A8F0C548C0D27279F7:4:

test/fixtures/omarchy-mac-keyring-20260913-1/omarchy-mac.gpg

@@ -0,0 +1,16 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEaqbKtRYJKwYBBAHaRw8BAQdAI7gUCEOd14QplbZ12KYIV7XkM+/wyPPG9QBz
+mPvV5bW0G09tYXJjaHkgTWFjIFBhY2thZ2UgU2lnbmluZ4iWBBMWCgA+FiEE88Wu
+P8/8c4wwHjCo8MVIwNJyefcFAmqmyrUCGwEFCQlmAYAFCwkIBwIGFQoJCAsCBBYC
+AwECHgECF4AACgkQ8MVIwNJyefc4HgEArUgsUks8G6WRTBV5Ef52/djRyIGu7Uai
+e5Ih8U3XB9gA/RjtlKVqC3E00ZhN5m4Oc2IbfPNZr8Oh7ZlYdvFq148BuDMEaqbK
+3xYJKwYBBAHaRw8BAQdAWA4H8/FHdnZP1Z9NeFkFNmMNIJyDT66oSHcGCxBjLIOI
+9AQYFgoAJhYhBPPFrj/P/HOMMB4wqPDFSMDScnn3BQJqpsrfAhsCBQkB4TOAAIAJ
+EPDFSMDScnn3dSAEGRYKAB0WIQRsJZfG5p/EiY09Vg4zEwdpYDAoXgUCaqbK3wAK
+CRAzEwdpYDAoXvBSAPMGvUcm9mi64yMqX3nkMsi1H7HuvdXmBaRgyllBrqYRAQDA
+xFiDGYOtJqPZwpcIupeEn0Z62ScAwjBS5ONqXNfdAjvBAP41jIblDA42gFKa/G8b
+xL9fy7HGsg/zpEFBnGsA/EB03wEA02k2hYO0FuV7qo3pmqVqR0MIVygZLEA2sGWB
+Jyvh8wU=
+=iEoD
+-----END PGP PUBLIC KEY BLOCK-----

test/fixtures/omarchy-mac-keyring-20260914-1/PKGBUILD

@@ -0,0 +1,19 @@
+# Maintainer: Omarchy Mac
+
+pkgname=omarchy-mac-keyring
+pkgver=20260914
+pkgrel=1
+pkgdesc='Omarchy Mac package signing keyring'
+arch=(any)
+url='https://github.com/omarchy-mac/omarchy-mac'
+license=('GPL-3.0-or-later')
+install=$pkgname.install
+source=('omarchy-mac.gpg' 'omarchy-mac-trusted' 'omarchy-mac-revoked')
+sha512sums=('1372202bdde5a3f8a79caceed4cff537012f7c1000a63e3cde808842fa913248b5d139641e9dcde378713b18658df8ace30b315a7193415402f614c70ad267a2'
+            '9414cc6dfca81c1eb098e23908c4e9bfb4bf5ab75ddb75e8b538c204e64ab2e3869f6e91f59886625d6fd0c53c1837db9184b12e4e4450c25175f221ffeca9f9'
+            'cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e')
+
+package() {
+  install -D -m0644 -t "$pkgdir/usr/share/pacman/keyrings/" \
+    omarchy-mac.gpg omarchy-mac-trusted omarchy-mac-revoked
+}