Remove pacman-init.service from releng

pacman-init.service causes more problems than it's worth.

Due to archlinux-keyring bloat, it takes too long to finish making it possible to corrupt the keyring if pacman or pacstrap is used before pacman-init.service is done.

If the timezone is in UTC+X, gpg as run by pacman-key will create and sign the keys with a future timestamp causing issues when updating the pacman keyring.

The solutions were to either:

* Automate more. Enable systemd-timesyncd.service and systemd-time-wait-sync.service. Order pacman-init.service after time-sync.target.
* Automate less. Get rid of pacman-init.service entirely.

"Automating more" just means more automagic that makes the releng profile differ from a newly installed system. Which in turn gives false expectations for those installing Arch.

This change will require that users manually initialize the pacman keyring and populate the keys in the live environment. I.e. these commands will now need to be run manually:

    # pacman-key --init
    # pacman-key --populate

Alternatively, using the latest Arch Linux keyring from the repos:

    # pacman-key --init
    # pacman -Sy archlinux-keyring

Regardless of the chosen commands, they should be run after the system time is synced via NTP.

Fixes #190
Fixes #191
This commit is contained in:
nl6720 2022-08-31 15:53:23 +03:00
parent 674f004170
commit de8923f8b2
No known key found for this signature in database
GPG key ID: 5CE88535E188D369
2 changed files with 0 additions and 14 deletions

View file

@ -1,13 +0,0 @@
[Unit]
Description=Initializes Pacman keyring
Requires=etc-pacman.d-gnupg.mount
After=etc-pacman.d-gnupg.mount
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/pacman-key --init
ExecStart=/usr/bin/pacman-key --populate
[Install]
WantedBy=multi-user.target