refactor(script): Update archlinux-keyring before pacstrap

Reviewed-on: #29

.gitignore

@@ -1 +1,2 @@
 archzbm_settings.env
+.idea

README.md

@@ -111,7 +111,7 @@ Known options are as follows.
 
 ### Kernel downgrade
 
-By default we install newest `linux` and `linux-headers` packages into a `chroot`. Once we're in that `chroot` we then install newest [AUR zfs-dkms package](https://aur.archlinux.org/packages/zfs-dkms). You may want to override `linux` and `linux-headers` versions we're installing to ensure you end up with a compatible mix between them and `zfs-dkms`.
+By default we install newest `linux` and `linux-headers` packages into a `chroot`. Once we're in that `chroot` we then install newest [AUR zfs-dkms package](https://aur.archlinux.org/packages/zfs-dkms). You may want to override `linux` and `linux-headers` versions to ensure you end up with a compatible mix between them and `zfs-dkms`.
 
 For example:
 ```
@@ -267,7 +267,7 @@ This syntax crutch allows you to use the full range of Dropbear-supported `autho
 
 An interactive questionnaire can guide you through settings and goes like this:
 
-![Command line setup questionnaire](https://i.imgur.com/RhCStdu.gif)
+![Command line setup questionnaire](https://i.imgur.com/OXG75GH.gif)
 
 To do the questionnaire yourself start this script with the `setup` argument:
 
@@ -329,7 +329,7 @@ We strongly suggest to that you:
 - Firstly, refer to a resource such as the [Arch Linux Archive package version list](https://archive.archlinux.org/packages/l/linux/) to find out what newest kernel version this script will install.
 - Secondly, research if newest [AUR zfs-dkms package](https://aur.archlinux.org/packages/zfs-dkms) is compatible with that kernel. Two reasonable points of contact are AUR and its comments section for `zfs-dkms` where users quickly report issues; and the [github.com/openzfs/zfs issues list](https://github.com/openzfs/zfs/issues).
 
-An example for this is that `linux-6.6.1.arch1-1-x86_64` released on Wednesday, November 8, 2023 at a time when newest `zfs-dkms` package version [was 2.2.0](https://aur.archlinux.org/cgit/aur.git/commit/?h=zfs-dkms&id=da1b6372c57b16f2781a7fda2b95971bb392c5ee) which did not compile against `linux` 6.6.x.
+An example for this is that `linux-6.6.1.arch1-1-x86_64` came out on Wednesday, November 8, 2023 at a time when newest `zfs-dkms` package version [was 2.2.0](https://aur.archlinux.org/cgit/aur.git/commit/?h=zfs-dkms&id=da1b6372c57b16f2781a7fda2b95971bb392c5ee) which did not compile against `linux` 6.6.x.
 
 You'd then set for example:
 ```

setup.sh

@@ -70,15 +70,14 @@ function setup_env_vars () {
 
     read -u3 -p 'Please type kernel version to use, leave empty for latest, confirm with <Enter>: ' ARCHZBM_KERNEL_VER
     echo
-    echo
 
     echo 'Do you want compressed datasets?'
-    select arg_compressed in "Compressed" "Uncompressed"; do
+    select arg_compressed in 'Compressed' 'Uncompressed'; do
         case "${arg_compressed}" in
-            Compressed)
+            'Compressed')
                 break
                 ;;
-            Uncompressed)
+            'Uncompressed')
                 ARCHZBM_ZFSPROPS_NO_COMPRESSION='true'
                 break
                 ;;
@@ -86,12 +85,12 @@ function setup_env_vars () {
     done <&3 && echo
 
     echo 'Do you want encrypted datasets?'
-    select arg_encrypted in "Encrypted" "Unencrypted"; do
+    select arg_encrypted in 'Encrypted' 'Unencrypted'; do
         case "${arg_encrypted}" in
-            Encrypted)
+            'Encrypted')
                 break
                 ;;
-            Unencrypted)
+            'Unencrypted')
                 ARCHZBM_ZFSPROPS_NO_ENCRYPTION='true'
                 break
                 ;;
@@ -100,13 +99,13 @@ function setup_env_vars () {
 
     if [[ "${arg_encrypted}" = 'Encrypted' ]]; then
         echo 'Do you want a custom dataset decryption password?'
-        select arg_custom_dataset_pw in "Yes" "No"; do
+        select arg_custom_dataset_pw in 'Yes' 'No (use '"'"'password'"'"')'; do
             case "${arg_custom_dataset_pw}" in
-                Yes)
+                'Yes')
                     want_custom_dataset_pw='true'
                     break
                     ;;
-                No)
+                'No (use '"'"'password'"'"')')
                     break
                     ;;
             esac
@@ -120,13 +119,13 @@ function setup_env_vars () {
     fi
 
     echo 'Do you want a custom '"'"'root'"'"' user password?'
-    select arg_custom_root_pw in "Yes" "No"; do
+    select arg_custom_root_pw in 'Yes' 'No (use '"'"'password'"'"')'; do
         case "${arg_custom_root_pw}" in
-            Yes)
+            'Yes')
                 want_custom_root_pw='true'
                 break
                 ;;
-            No)
+            'No (use '"'"'password'"'"')')
                 break
                 ;;
         esac
@@ -153,7 +152,7 @@ function setup_env_vars () {
 
     if [[ "${want_ssh_in_zbm}" ]]; then
         echo 'How do you want to assign an IP address in ZFSBootMenu?'
-        select arg_ip_autoconf_method in "Statically" "Dynamically, DHCP" "Dynamically, BOOTP" "Dynamically, RARP"; do
+        select arg_ip_autoconf_method in 'Statically' 'Dynamically, DHCP' 'Dynamically, BOOTP' 'Dynamically, RARP'; do
             case "${arg_ip_autoconf_method}" in
                 'Statically')
                     ARCHZBM_NET_AUTOCONF='none'
@@ -189,7 +188,7 @@ function setup_env_vars () {
         fi
 
         echo 'Do you want a custom SSH listening port?'
-        select arg_custom_ssh_port in "Yes (let me specify)" "No (keep port 22)"; do
+        select arg_custom_ssh_port in 'Yes (let me specify)' 'No (keep port 22)'; do
             case "${arg_custom_ssh_port}" in
                 'Yes (let me specify)')
                     want_custom_ssh_port='true'
@@ -207,7 +206,7 @@ function setup_env_vars () {
         fi
 
         echo 'Do you want the SSH daemon to use a custom keepalive send interval?'
-        select arg_custom_ssh_keepalive_intvl in "Yes (let me specify)" "No (keep 1)"; do
+        select arg_custom_ssh_keepalive_intvl in 'Yes (let me specify)' 'No (keep 1)'; do
             case "${arg_custom_ssh_keepalive_intvl}" in
                 'Yes (let me specify)')
                     want_custom_keepalive_intvl='true'
@@ -283,7 +282,7 @@ function setup_env_vars () {
     fi
 
     if [[ "${want_ssh_in_zbm}" ]]; then
-        echo 'Do you want to define OS root user'"'"'s SSH pub key?'
+        echo 'Do you want to define OS '"'"'root'"'"' user'"'"'s SSH pub key?'
         select arg_root_pub_keys in 'Yes (let me specify)' 'Yes (use ZBM pub keys)' 'No (don'"'"'t enable sshd.service)'; do
             case "${arg_root_pub_keys}" in
                 'Yes (let me specify)')
@@ -430,19 +429,34 @@ function update_pacman_db () {
     systemctl start reflector
     # In an ISO and for the minimal number of packages we need we do not
     # care about partial upgrades
-    pacman -Syyuu --noconfirm
+    #
+    # Are we better off not attempting an upgrade inside the ISO?
+    # Let's try and find out.
+    # while ! pacman -Syyuu --needed --noconfirm --downloadonly; do
+    #     sleep 5
+    # done
+    # pacman -Syyuu --needed --noconfirm
+    pacman -Syy
 }
 
 function install_pkgs () {
     #1.5
     printf -- '%s\n' 'Installing packages ...'
+    while ! pacman -S --needed --noconfirm --downloadonly "${@}"; do
+        sleep 5
+    done
     pacman -S --needed --noconfirm "${@}"
 }
 
 function install_zfs () {
     #1.6
     declare reset_colors='\033[0m'
-    curl -s 'https://raw.githubusercontent.com/eoli3n/archiso-zfs/master/init' | bash
+    if modinfo 'zfs' &>/dev/null; then
+        >&3 printf -- '%s\n' \
+            'ZFS kernel module is loaded, no need to install ...'
+    else
+        curl -s 'https://raw.githubusercontent.com/eoli3n/archiso-zfs/master/init' | bash
+    fi
     printf -- "${reset_colors}"
 }
 
@@ -764,27 +778,30 @@ function install_archlinux () {
     #1.12
     pacman_dl_parallel
     pacman_dont_check_space
-    pacstrap /mnt              \
-        base                   \
-        base-devel             \
-        linux                  \
-        linux-headers          \
-        linux-firmware         \
-        amd-ucode              \
-        efibootmgr             \
-        vim                    \
-        git                    \
-        iwd                    \
-        networkmanager         \
-        network-manager-applet \
-        dialog                 \
-        os-prober              \
-        reflector              \
-        bluez                  \
-        bluez-utils            \
-        man-db                 \
-        xdg-utils              \
-        xdg-user-dirs
+    pacman --noconfirm -S archlinux-keyring
+    while ! pacstrap /mnt              \
+                base                   \
+                base-devel             \
+                linux                  \
+                linux-headers          \
+                linux-firmware         \
+                amd-ucode              \
+                efibootmgr             \
+                vim                    \
+                git                    \
+                iwd                    \
+                networkmanager         \
+                network-manager-applet \
+                dialog                 \
+                os-prober              \
+                reflector              \
+                bluez                  \
+                bluez-utils            \
+                man-db                 \
+                xdg-utils              \
+                xdg-user-dirs; do
+        sleep 5
+    done
 }
 
 function gen_fstab () {
@@ -920,8 +937,49 @@ function add_zfs_hook_to_initramfs () {
         '/mnt/etc/mkinitcpio.conf'
 }
 
-function set_initramfs_build_list () {
+function replace_systemd_initramfs_with_udev () {
     #1.17
+    # Replace systemd-boot hooks with udev hooks in initramfs. For some odd
+    # reason we have not yet understood the modern default on a fresh Arch
+    # Linux installation ('systemd' and 'sd-vconsole' hooks) doesn't cleanly
+    # boot into a boot environment via ZFSBootMenu.
+    #
+    # 1. If we left both hooks in place we'd see an error related
+    # to '/dev/gpt-auto-root'; that can be worked around by loading the 'vfat'
+    # module via the 'MODULES=(...)' array in '/etc/mkinitcpio.conf'.
+    #
+    # 2. On next try we see the system failing into an emergency shell at a
+    # later point in initramfs execution due to a failure with
+    # 'initrd-switch-root.service'. Since the 'systemd' hook disables the
+    # 'root' account we enter a non-functional emergency shell. See
+    # https://wiki.archlinux.org/title/Mkinitcpio section 6.7 "Cannot open
+    # access to console, the root account is locked" where we learn that we can
+    # install AUR package initcpio-hook-shadowcopy and load the 'shadowcopy'
+    # hook right after the 'systemd' hook in order to get a fully functional
+    # emergency shell.
+    #
+    # 3. On next try 'initrd-switch-root.service' fails into a functional
+    # emergency shell which allows us to check systemd status of
+    # 'initrd-switch-root.service'. This seems to tell us that '/sysroot' is
+    # wanted but missing which appears to be true.
+    #
+    # At this point in December 2025 we stopped investigating how to properly
+    # pair 'systemd' and 'sd-vconsole' hooks with ZFSBootMenu. We're instead
+    # replacing both as follows:
+    #
+    #     systemd <--> udev
+    # sd-vconsole <--> consolefont
+    #
+    # This cleanly boots a boot environment. Further investigation may be
+    # warranted at a later date. For now this workaround is good enough.
+    in_file_in_array_insert_n_before_m '/mnt/etc/mkinitcpio.conf' 'HOOKS' 'udev' 'systemd'
+    in_file_in_array_remove_n '/mnt/etc/mkinitcpio.conf' 'HOOKS' 'systemd'
+    in_file_in_array_insert_n_before_m '/mnt/etc/mkinitcpio.conf' 'HOOKS' 'consolefont' 'sd-vconsole'
+    in_file_in_array_remove_n '/mnt/etc/mkinitcpio.conf' 'HOOKS' 'sd-vconsole'
+}
+
+function set_initramfs_build_list () {
+    #1.18
     # No need to build fallback initramfs, our new fallback is ZFS snapshots
     sed -ri \
         -e '/^#/d' \
@@ -935,7 +993,7 @@ function set_initramfs_build_list () {
 }
 
 function add_zfs_files_to_new_os () {
-    #1.18
+    #1.19
     for zfs_file in '/etc/hostid' '/etc/zfs/zpool.cache' $([[ ! "${ARCHZBM_ZFSPROPS_NO_ENCRYPTION}" ]] && printf -- '%s' '/etc/zfs/'"${zpool_name}"'.key'); do
         rsync -av --itemize-changes {'','/mnt'}"${zfs_file}"
     done
@@ -1035,12 +1093,12 @@ function get_aur_helper () {
     usermod --append --groups 'wheel' 'build'
     printf -- '%s\n' '%wheel ALL=(ALL:ALL) NOPASSWD: ALL' > '/etc/sudoers.d/10-wheel-group-no-passwd-prompt'
     pushd /tmp
-    git clone https://aur.archlinux.org/paru-bin.git
-    chown -R 'build:' 'paru-bin'
-    pushd 'paru-bin'
+    git clone https://aur.archlinux.org/paru-git.git
+    chown -R 'build:' 'paru-git'
+    pushd 'paru-git'
     sudo --user 'build' makepkg -si --noconfirm
     popd
-    rm -rf 'paru-bin'
+    rm -rf 'paru-git'
     popd
 }
 
@@ -1279,7 +1337,7 @@ function get_disks_with_one_efipart () {
     # Find disks that have exactly one EFI partition and where that EFI
     # partition is partition number 1. We expect exactly one disk to meet
     # these criteria. Anything else and we bail.
-    disks_with_one_efipart="$(lsblk --output PATH,PARTTYPE --json --tree | jq --raw-output '.[][] | select(.children | length > 0) | select( any (.children[]; (.path | test("^[^[:digit:]]+1")) and (.parttype=="'"${partition_types[gpt_efi]}"'")) and ([select(.children[].parttype=="'"${partition_types[gpt_efi]}"'")] | length == 1) ) | .path')"
+    disks_with_one_efipart="$(lsblk --output PATH,PARTTYPE --json --tree | jq --raw-output '.[][] | select(.children | length > 0) | select( any (.children[]; (.path | test("^[^[:digit:]]+(.*?[[:digit:]]+p)?1")) and (.parttype=="'"${partition_types[gpt_efi]}"'")) and ([select(.children[].parttype=="'"${partition_types[gpt_efi]}"'")] | length == 1) ) | .path')"
     if [[ "$(wc -l <<<"${disks_with_one_efipart}")" -eq '1' ]] && [[ "$(wc -c <<<"${disks_with_one_efipart}")" -gt '1' ]]; then
         printf -- '%s' "${disks_with_one_efipart}"
         return 0
@@ -1289,6 +1347,10 @@ function get_disks_with_one_efipart () {
 
 function install_os_in_chroot () {
     #2.2
+    dd if='/dev/zero' of='/swapfile' bs='1M' count='2048'
+    losetup '/dev/loop9' '/swapfile'
+    mkswap '/dev/loop9'
+    swapon '/dev/loop9'
     ### Reinit keyring
     # As keyring is initialized at boot, and copied to the install dir with pacstrap, and ntp is running
     # Time changed after keyring initialization, it leads to malfunction
@@ -1296,6 +1358,9 @@ function install_os_in_chroot () {
     rm -rf '/etc/pacman.d/gnupg'
     pacman-key --init
     pacman-key --populate archlinux
+    while ! pacman -S archlinux-keyring --noconfirm --downloadonly; do
+        sleep 5
+    done
     pacman -S archlinux-keyring --noconfirm
 
     locale-gen
@@ -1332,6 +1397,9 @@ function install_os_in_chroot () {
         add_syslinux_pacman_hook
     fi
     add_zbm_pacman_hook
+    swapoff '/dev/loop9'
+    losetup -d '/dev/loop9'
+    rm '/swapfile'
 }
 
 function set_root_pw () {
@@ -1553,8 +1621,9 @@ function main () {
         set_hostname                                #1.14
         set_locale                                  #1.15
         add_zfs_hook_to_initramfs                   #1.16
-        set_initramfs_build_list                    #1.17
-        add_zfs_files_to_new_os                     #1.18
+        replace_systemd_initramfs_with_udev         #1.17
+        set_initramfs_build_list                    #1.18
+        add_zfs_files_to_new_os                     #1.19
         enter_chroot                                #2.1
         # We're done in chroot
         finalize_os_setup                           #3.1