iso: fix packages.x86_64 (no inline comments; gstreamer-vaapi -> gst-plugin-va)

Inline comments after a package name broke kitty/flatpak (became invalid names with trailing whitespace). gstreamer-vaapi was removed from Arch. calamares is AUR-only -> commented pending a [tanin] rebuild decision. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-19 22:34:35 +02:00
parent 4722294c24
commit c7039f13b9
100 changed files with 1480 additions and 17 deletions
@@ -0,0 +1,24 @@
+---
+componentName: tanin
+welcomeStyleCalamares: true
+windowExpanding: normal
+
+strings:
+    productName:         TANINUX
+    shortProductName:    TANINUX
+    version:             camel
+    shortVersion:        camel
+    versionedName:       TANINUX (camel)
+    shortVersionedName:  TANINUX
+    bootloaderEntryName:  TANINUX
+    productUrl:          https://taninux.kgva.ch
+    supportUrl:          https://git.openbureau.ch/karim/taninux
+
+# Fuji palette for the installer sidebar (matches the desktop).
+style:
+    sidebarBackground:    "#0f0f0f"
+    sidebarText:          "#f0f0f0"
+    sidebarTextSelect:    "#a39ec4"
+    sidebarTextHighlight: "#a39ec4"
+
+# TODO: add productLogo (logo.png) + a slideshow (show.qml) for polish.
@@ -0,0 +1,9 @@
+---
+efiBootLoader: "systemd-boot"
+kernel:   "/vmlinuz-linux-zen"
+img:      "/initramfs-linux-zen.img"
+fallback: "/initramfs-linux-zen-fallback.img"
+timeout:  "3"
+# Plymouth splash + quiet boot on the installed system.
+kernelParams: [ "quiet", "splash", "rw" ]
+installEFIFallback: true
@@ -0,0 +1,8 @@
+---
+mountOptions:
+  default:  defaults,noatime
+  btrfs:    defaults,noatime,compress=zstd,space_cache=v2
+  efi:      defaults,noatime,umask=0077
+ssdExtraMountOptions:
+  btrfs:    ssd,discard=async
+crypttabOptions: luks
@@ -0,0 +1,37 @@
+---
+# Snapper-friendly Btrfs subvolume layout (@ root + @snapshots at /.snapshots).
+extraMounts:
+- device: proc
+  fs: proc
+  mountPoint: /proc
+- device: sys
+  fs: sysfs
+  mountPoint: /sys
+- device: /dev
+  mountPoint: /dev
+  options: bind
+- device: tmpfs
+  fs: tmpfs
+  mountPoint: /run
+- device: /run/udev
+  mountPoint: /run/udev
+  options: bind
+
+mountOptions:
+- mountPoint: /
+  options: defaults,noatime
+- mountPoint: "*"
+  filesystem: btrfs
+  options: defaults,noatime,compress=zstd
+
+btrfsSubvolumes:
+- mountPoint: /
+  subvolume: /@
+- mountPoint: /home
+  subvolume: /@home
+- mountPoint: /var/cache
+  subvolume: /@cache
+- mountPoint: /var/log
+  subvolume: /@log
+- mountPoint: /.snapshots
+  subvolume: /@snapshots
@@ -0,0 +1,12 @@
+---
+backend: pacman
+pacman:
+  num_retries: 3
+  disable_download_timeout: true
+  needed_only: false
+operations:
+# Strip the live-only installer from the installed target. Everything else was
+# cloned by unpackfs.
+- try_remove:
+  - calamares
+  - cage
@@ -0,0 +1,11 @@
+---
+efiSystemPartition:     "/boot"        # systemd-boot wants the ESP at /boot
+efiSystemPartitionSize: 1024M
+userSwapChoices: [ none, small, suspend ]
+drawNestedPartitions:   true
+alwaysShowPartitionLabels: true
+allowManualPartitioning:   true
+initialPartitioningChoice: erase
+initialSwapChoice:         none
+defaultFileSystemType:     "btrfs"
+availableFileSystemTypes:  [ "btrfs", "ext4" ]
@@ -0,0 +1,13 @@
+---
+services:
+- name: greetd            # the TANINUX login (tanin-greet) — its config is already
+  mandatory: false        #   in place from the tanin-greet package scriptlet
+- name: NetworkManager
+  mandatory: false
+- name: snapper-cleanup.timer
+  mandatory: false
+- name: snapper-timeline.timer
+  mandatory: false
+targets:
+- name: graphical
+  mandatory: true
@@ -0,0 +1,5 @@
+---
+dontChroot: false
+timeout: 30
+script:
+- "flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo"
@@ -0,0 +1,11 @@
+---
+dontChroot: false
+timeout: 120
+# Best-effort snapper setup on the Btrfs target. The @snapshots subvolume is
+# already mounted at /.snapshots (see mount.conf); snapper's own create-config
+# can conflict with a pre-existing /.snapshots, so this is tolerant.
+# snap-pac then auto-snapshots before/after each pacman transaction.
+script:
+- command: "snapper --no-dbus -c root create-config / || true"
+  timeout: 60
+- "snapper --no-dbus -c root set-config NUMBER_LIMIT=10 NUMBER_LIMIT_IMPORTANT=5 TIMELINE_CREATE=no || true"
@@ -0,0 +1,11 @@
+---
+dontChroot: false
+timeout: 30
+# Remove the live-only installer bits from the installed target so it boots the
+# desktop (greetd) instead of auto-launching Calamares.
+script:
+- "rm -f /etc/systemd/system/getty@tty1.service.d/autologin.conf"
+- "rmdir --ignore-fail-on-non-empty /etc/systemd/system/getty@tty1.service.d 2>/dev/null || true"
+- "rm -f /root/.bash_profile"
+- "rm -f /usr/local/bin/tanin-installer"
+- "systemctl set-default graphical.target"
@@ -0,0 +1,7 @@
+---
+# Clone the live squashfs onto the target. Path matches install_dir=tanin,
+# arch=x86_64, airootfs_image_type=squashfs (see profiledef.sh).
+unpack:
+- source: "/run/archiso/bootmnt/tanin/x86_64/airootfs.sfs"
+  sourcefs: "squashfs"
+  destination: ""
@@ -0,0 +1,54 @@
+# Calamares for TANINUX (camel). Model: clone the live system to the target with
+# unpackfs, then configure bootloader (systemd-boot), services (greetd), set up
+# snapper + Flathub, and strip the live-only installer bits.
+---
+modules-search: [ local, /usr/lib/calamares/modules ]
+
+instances:
+- id:     snapper
+  module: shellprocess
+  config: shellprocess-snapper.conf
+- id:     flathub
+  module: shellprocess
+  config: shellprocess-flathub.conf
+- id:     striplive
+  module: shellprocess
+  config: shellprocess-striplive.conf
+
+sequence:
+- show:
+  - welcome
+  - locale
+  - keyboard
+  - partition
+  - users
+  - summary
+- exec:
+  - partition
+  - mount
+  - unpackfs
+  - machineid
+  - fstab
+  - locale
+  - keyboard
+  - localecfg
+  - luksbootkeyfile
+  - users
+  - networkcfg
+  - hwclock
+  - shellprocess@snapper
+  - shellprocess@flathub
+  - shellprocess@striplive
+  - packages          # remove live-only packages (calamares, cage)
+  - services-systemd  # enable greetd + NetworkManager on the target
+  - mkinitcpio        # regenerate initramfs (plymouth hook)
+  - bootloader        # systemd-boot, kernel cmdline 'quiet splash'
+  - umount
+- show:
+  - finished
+
+branding: tanin
+prompt-install: true
+dont-chroot: false
+oem-setup: false
+disable-cancel: false
@@ -0,0 +1 @@
+archiso
@@ -0,0 +1 @@
+LANG=C.UTF-8
@@ -0,0 +1 @@
+/usr/share/zoneinfo/UTC
@@ -0,0 +1,3 @@
+HOOKS=(base udev microcode modconf kms memdisk archiso archiso_loop_mnt archiso_pxe_common archiso_pxe_nbd archiso_pxe_http archiso_pxe_nfs block filesystems keyboard)
+COMPRESSION="xz"
+COMPRESSION_OPTIONS=(-9e)
@@ -0,0 +1,8 @@
+# mkinitcpio preset file for the 'linux' package on archiso
+
+PRESETS=('archiso')
+
+ALL_kver='/boot/vmlinuz-linux'
+archiso_config='/etc/mkinitcpio.conf.d/archiso.conf'
+
+archiso_image="/boot/initramfs-linux.img"
@@ -0,0 +1,7 @@
+# The broadcom-wl package requires some modules to be disabled in order to use
+# wl. Since the ISO image needs to cover many hardware cases, this file
+# overrides the default blacklist in /usr/lib/modprobe.d/
+#
+# If you need to use wl, you may need to delete this file, then `rmmod` any
+# already-loaded modules that are now blacklisted before proceeding to modprobe
+# wl itself.
@@ -0,0 +1,11 @@
+To install [38;2;23;147;209mArch Linux[0m follow the installation guide:
+https://wiki.archlinux.org/title/Installation_guide
+
+For Wi-Fi, authenticate to the wireless network using the [35miwctl[0m utility.
+For mobile broadband (WWAN) modems, connect with the [35mmmcli[0m utility.
+Ethernet, WLAN and WWAN interfaces using DHCP should work automatically.
+
+After connecting to the internet, the installation guide can be accessed
+via the convenience script [35mInstallation_guide[0m.
+
+[41m [41m [41m [40m [44m [40m [41m [46m [45m [41m [46m [43m [41m [44m [45m [40m [44m [40m [41m [44m [41m [41m [46m [42m [41m [44m [43m [41m [45m [40m [40m [44m [40m [41m [44m [42m [41m [46m [44m [41m [46m [47m [0m
@@ -0,0 +1,25 @@
+# pacman.conf for the LIVE system and (via unpackfs) the installed target.
+# [tanin]'s DB-signing key is imported into the keyring by customize_airootfs.sh,
+# so Optional TrustAll verifies cleanly here (unlike the build conf which uses Never).
+[options]
+HoldPkg     = pacman glibc
+Architecture = auto
+CheckSpace
+SigLevel    = Required DatabaseOptional
+LocalFileSigLevel = Optional
+ParallelDownloads = 5
+Color
+ILoveCandy
+
+[core]
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Include = /etc/pacman.d/mirrorlist
+
+[multilib]
+Include = /etc/pacman.d/mirrorlist
+
+[tanin]
+SigLevel = Optional TrustAll
+Server = https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch
@@ -0,0 +1,13 @@
+# remove from airootfs!
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Package
+Target = pacman-mirrorlist
+
+[Action]
+Description = Uncommenting HTTPS mirrors in /etc/pacman.d/mirrorlist...
+When = PostTransaction
+Depends = pacman-mirrorlist
+Depends = sed
+Exec = /usr/bin/sed -E -i 's/#(Server = https:)/\1/g' /etc/pacman.d/mirrorlist
@@ -0,0 +1,18 @@
+# remove from airootfs!
+# As a workaround for https://bugs.archlinux.org/task/49347 , remove pacman hooks specific to the ISO build process.
+# If not, they would be used when pacstrap is run in the live environment.
+
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Work around FS#49347 by removing custom pacman hooks that are only required during ISO build...
+When = PostTransaction
+Depends = sh
+Depends = coreutils
+Depends = grep
+Exec = /bin/sh -c "rm -- $(grep -Frl 'remove from airootfs' /etc/pacman.d/hooks/)"
@@ -0,0 +1,32 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+xsBNBGo1eZsBCADJBsWkBZL08x/4d/mftfd30rcRkQJVDX3eEMHaZWeUSLfGt5Hj
+m7fYnwnBK29g04UTCjDKRGsvOqukAJQUXGLpLxSPJwsUH+kVKv+8/RCXtrQ6HTCN
+auyZGQ3ST8kcAQ+7jntumTehBt+z4LRGMow71W2JL1oqkMK9hEgAA7dqwEWN4K0w
+DMSd9iZOpN5PPdvVlTsvxU6JflfyLOS3W+geyL2+zFQWMmCcAqkPxTH6yNAfaoLI
+OGR4Mg6MXXdAXbzQKI90445fWGsUX/Ch5ZSWJhJ3wqjUM3r99PErL+C/p0r5wTqv
+LFkjZvauI+oLUZwXrP93qfzTG/iChBG+5sJLABEBAAHNDyhBcmNoIFJlZ2lzdHJ5
+KcLAuwQTAQgAbwWCajV5mwILBwkQtv3zViBq9PY1FAAAAAAAHAAQc2FsdEBub3Rh
+dGlvbnMub3BlbnBncGpzLm9yZ/ekKg/zx/iqmv/2hOAR9m8CFQgCFgACGQECmwMC
+HgEWIQRj8EFYeTI/a/4Pv7K2/fNWIGr09gAAdPIIAI4b/4C83biB4yD10w/u9Feb
+s4fn0nauZ/ayZ1JJaq20Ss2pBZaqETxNdIi9sQpno9BXhBRaNdd6k7YIUK7XTylr
+lk6V6Rhz6NIquGZHmfp1oszL4FjLUM9QoFWQaRY76psBNHWto/GgPpq8GFtVxmVj
+NhOpm/7EcGhniBS+engub7vazVpEIqPycKBBbKSxTvo3hVqsSJpaR2vB1aiLedvY
+luYfu/OIhT7SOOdjYTT18kMJxlwwSnhbl1cl47Jcd/1iQB5nwrWnZy28osfsIhEd
+4lxppWcgQDXWbzBV57HiTbfnNCncmBIhoTmCKRxosWJPiligeqsqoty/B7lBx47O
+wE0EajV5mwEIAO800GVtfe0ZWs+LljaKgkrwWi/u+dsVFgRNWdmqtOBWdszVdxyz
+M0LsNMHHOxAWFfjFFbSO9D06aHgmvzLH0c+fgaJeliXFMYS9nOKS7Q6djnjoYtZc
+CPxac0JlcLiysHyBdatjHHZr6KZvGaoSobzEfASpfYpScvEyGvi3KN2xD6ssw7AY
+GiPof+vAmsfDn0OFo1WRk7eEnoT7JvUx3RrDatXLvBcQRf+49AJvf2lBv0c4tnc8
+9O71wleTHZjL8x0oc3tFDCMBfSGmLzpOaTtgwCPI99yzHeGJGP7JyjUWSAi6WkX4
+COLPhufJC/pJSrvoLa1MzUBU+jfTkJnn8ZkAEQEAAcLArAQYAQgAYAWCajV5mwkQ
+tv3zViBq9PY1FAAAAAAAHAAQc2FsdEBub3RhdGlvbnMub3BlbnBncGpzLm9yZzPl
+jzz26YEAPcqM+A/M9x8CmwwWIQRj8EFYeTI/a/4Pv7K2/fNWIGr09gAAtaMH/3hS
+njGRszJFLsFNUYzgKdv1YYIENsFzSsu00CztKUrYVQxAEOK22mB3a9/3jPlJFSkS
+WR8D2rbC2/HUKhRnHomb8Mri6HzVmGEORuE5kNnZd3ij+Dnv7EsNC7DXmuoCZaFI
+FKYinsLEpo0bZOACaJpGTH4HqNM49Mrq2vREnuDtPdHGEYOs/+VqBt7tpmpIxGLd
+TsJNtdroThqle9ghaCwcSqF4YatTGsNpQI68OmkmQc1ybxhzpRdwajrdTrio2pI9
+ZkfLRBu7pRjn5ekDX4JUNkC1VyO4BuZutjtFRh8YAB0TbFfPmdn3i4/gI2u5rSi1
+UT+fYccVqz5tKm/iXTY=
+=6SFS
+-----END PGP PUBLIC KEY BLOCK-----
@@ -0,0 +1 @@
+root:x:0:0:root:/root:/usr/bin/zsh
@@ -0,0 +1 @@
+/run/systemd/resolve/stub-resolv.conf
@@ -0,0 +1 @@
+root::14871::::::
@@ -0,0 +1,3 @@
+# Allow root login using password authentication
+PasswordAuthentication yes
+PermitRootLogin yes
@@ -0,0 +1,2 @@
+[Journal]
+Storage=volatile
@@ -0,0 +1,4 @@
+[Login]
+HandleSuspendKey=ignore
+HandleHibernateKey=ignore
+HandleLidSwitch=ignore
@@ -0,0 +1,22 @@
+[Match]
+Type=ether
+# Exclude virtual Ethernet interfaces
+Kind=!*
+
+[Link]
+RequiredForOnline=routable
+
+[Network]
+DHCP=yes
+MulticastDNS=yes
+
+# systemd-networkd does not set per-interface-type default route metrics
+# https://github.com/systemd/systemd/issues/17698
+# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
+# Use values from NetworkManager. From nm_device_get_route_metric_default in
+# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
+[DHCPv4]
+RouteMetric=100
+
+[IPv6AcceptRA]
+RouteMetric=100
@@ -0,0 +1,20 @@
+[Match]
+Type=wlan
+
+[Link]
+RequiredForOnline=routable
+
+[Network]
+DHCP=yes
+MulticastDNS=yes
+
+# systemd-networkd does not set per-interface-type default route metrics
+# https://github.com/systemd/systemd/issues/17698
+# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
+# Use values from NetworkManager. From nm_device_get_route_metric_default in
+# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
+[DHCPv4]
+RouteMetric=600
+
+[IPv6AcceptRA]
+RouteMetric=600
@@ -0,0 +1,19 @@
+[Match]
+Type=wwan
+
+[Link]
+RequiredForOnline=routable
+
+[Network]
+DHCP=yes
+
+# systemd-networkd does not set per-interface-type default route metrics
+# https://github.com/systemd/systemd/issues/17698
+# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
+# Use values from NetworkManager. From nm_device_get_route_metric_default in
+# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
+[DHCPv4]
+RouteMetric=700
+
+[IPv6AcceptRA]
+RouteMetric=700
@@ -0,0 +1,2 @@
+[Network]
+IPv6PrivacyExtensions=yes
@@ -0,0 +1,4 @@
+# Default systemd-resolved configuration for archiso
+
+[Resolve]
+MulticastDNS=yes
@@ -0,0 +1 @@
+/dev/null
@@ -0,0 +1,10 @@
+[Unit]
+Description=Choose mirror from the kernel command line
+ConditionKernelCommandLine=mirror
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/choose-mirror
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1 @@
+/usr/lib/systemd/system/cloud-config.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/cloud-final.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/cloud-init-local.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/cloud-init-main.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/cloud-init-network.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/ModemManager.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-networkd.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-resolved.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-timesyncd.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=Temporary /etc/pacman.d/gnupg directory
+
+[Mount]
+What=tmpfs
+Where=/etc/pacman.d/gnupg
+Type=tmpfs
+Options=mode=0755,noswap
@@ -0,0 +1,3 @@
+[Service]
+ExecStart=
+ExecStart=-/usr/bin/agetty --autologin root --noclear %I 38400 linux
@@ -0,0 +1,13 @@
+[Unit]
+Description=Unmute All Sound Card Controls For Use With The Live Arch Environment
+# This needs to run after the audio device becomes available.
+Wants=systemd-udev-settle.service
+After=systemd-udev-settle.service sound.target
+ConditionKernelCommandLine=accessibility=on
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/livecd-sound -u
+
+[Install]
+WantedBy=sound.target
@@ -0,0 +1,20 @@
+[Unit]
+Description=Screen reader service
+After=livecd-alsa-unmuter.service
+Before=getty@tty1.service
+ConditionKernelCommandLine=accessibility=on
+
+[Service]
+Type=oneshot
+TTYPath=/dev/tty13
+ExecStartPre=/usr/bin/chvt 13
+ExecStart=/usr/local/bin/livecd-sound -p
+ExecStartPost=/usr/bin/chvt 1
+ExecStartPost=systemctl start espeakup.service
+StandardInput=tty
+TTYVHangup=yes
+TTYVTDisallocate=yes
+RemainAfterExit=true
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1 @@
+/usr/lib/systemd/system/ModemManager.service
@@ -0,0 +1 @@
+../choose-mirror.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/hv_fcopy_daemon.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/hv_kvp_daemon.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/hv_vss_daemon.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/iwd.service
@@ -0,0 +1 @@
+/etc/systemd/system/livecd-talk.service
@@ -0,0 +1 @@
+../pacman-init.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/sshd.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-networkd.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-resolved.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/vboxservice.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/vmtoolsd.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/vmware-vmblock-fuse.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-networkd-wait-online.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=Initializes Pacman keyring
+Requires=etc-pacman.d-gnupg.mount
+After=etc-pacman.d-gnupg.mount time-sync.target
+BindsTo=etc-pacman.d-gnupg.mount
+Before=archlinux-keyring-wkd-sync.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/bin/pacman-key --init
+ExecStart=/usr/bin/pacman-key --populate
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1 @@
+/usr/lib/systemd/system/pcscd.socket
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-networkd.socket
@@ -0,0 +1 @@
+../livecd-alsa-unmuter.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-time-wait-sync.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/systemd-timesyncd.service
@@ -0,0 +1,6 @@
+# Allow systemd-networkd-wait-online to succeed with one interface, otherwise, if multiple network interfaces exist,
+# network-online.target gets needlessly delayed.
+# See https://wiki.archlinux.org/title/systemd-networkd#systemd-networkd-wait-online
+[Service]
+ExecStart=
+ExecStart=/usr/lib/systemd/systemd-networkd-wait-online --any
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+script_cmdline() {
+    local param
+    for param in $(</proc/cmdline); do
+        case "${param}" in
+            script=*)
+                echo "${param#*=}"
+                return 0
+                ;;
+        esac
+    done
+}
+
+automated_script() {
+    local script rt
+    script="$(script_cmdline)"
+    if [[ -n "${script}" && ! -x /tmp/startup_script ]]; then
+        if [[ "${script}" =~ ^((http|https|ftp|tftp)://) ]]; then
+            printf '%s: downloading %s\n' "$0" "${script}"
+            # there's no synchronization for network availability before executing this script; to ensure the network
+            # is online, we use a transient systemd service that depends on network-online.target to download the
+            # script rather than manually polling the target
+            systemd-run --pty --quiet -p Wants=network-online.target -p After=network-online.target \
+                curl "${script}" --location --retry-connrefused --retry 10 --fail -s -o /tmp/startup_script
+            rt=$?
+        else
+            cp "${script}" /tmp/startup_script
+            rt=$?
+        fi
+        if [[ ${rt} -eq 0 ]]; then
+            chmod +x /tmp/startup_script
+            printf '%s: executing automated script\n' "$0"
+            # note that script is executed when other services (like pacman-init) may be still in progress, please
+            # synchronize to "systemctl is-system-running --wait" when your script depends on other services
+            /tmp/startup_script
+        fi
+    fi
+}
+
+if [[ $(tty) == "/dev/tty1" ]]; then
+    automated_script
+fi
@@ -0,0 +1,6 @@
+# Live ISO: on the first console (tty1), launch the TANINUX installer.
+# (On an installed system this file isn't present — Calamares' shellprocess
+#  strips the live-only bits from the target.)
+if [[ "$(tty)" == /dev/tty1 ]] && [[ -z "${WAYLAND_DISPLAY:-}" ]] && ! pgrep -x cage >/dev/null 2>&1; then
+  exec tanin-installer
+fi
@@ -0,0 +1,4 @@
+disable-ccid
+disable-pinpad
+pcsc-driver /usr/lib/libpcsclite.so
+pcsc-shared
@@ -0,0 +1,6 @@
+# fix for screen readers
+if grep -Fqa 'accessibility=' /proc/cmdline &> /dev/null; then
+    setopt SINGLE_LINE_ZLE
+fi
+
+~/.automated_script.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Runs once inside the airootfs chroot during mkarchiso.
+set -e -u
+
+# --- locale ---
+sed -i 's/#\(en_US\.UTF-8 UTF-8\)/\1/' /etc/locale.gen
+locale-gen
+
+# --- trust the [tanin] DB-signing key (so Optional TrustAll verifies) ---
+pacman-key --init
+pacman-key --populate archlinux
+pacman-key --add /etc/pacman.d/tanin-repo.gpg
+pacman-key --lsign-key 63F0415879323F6BFE0FBFB2B6FDF356206AF4F6
+
+# --- services in the LIVE image ---
+systemctl enable NetworkManager.service
+# Live boots to a console on tty1 that auto-launches the installer (cage +
+# calamares) via getty autologin + /root/.bash_profile. No display-manager.
+systemctl set-default multi-user.target
+# greetd is for the TARGET only (Calamares enables it post-install).
+systemctl disable greetd.service 2>/dev/null || true
+
+# --- plymouth: add the hook so the target initramfs shows the splash ---
+# (Calamares regenerates the initramfs on the target; this drop-in is carried
+#  over by unpackfs. 'quiet splash' goes on the kernel cmdline at install time.)
+if ! grep -q plymouth /etc/mkinitcpio.conf 2>/dev/null; then
+  sed -i 's/^\(HOOKS=.*\)\(udev\)/\1\2 plymouth/' /etc/mkinitcpio.conf 2>/dev/null || true
+fi
@@ -0,0 +1,5 @@
+#!/bin/sh
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+exec xdg-open 'https://wiki.archlinux.org/title/Installation_guide'
@@ -0,0 +1,29 @@
+#!/bin/bash
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+get_cmdline() {
+    local param
+    for param in $(</proc/cmdline); do
+        case "${param}" in
+            "${1}="*)
+                echo "${param##*=}"
+                return 0
+                ;;
+        esac
+    done
+}
+
+mirror="$(get_cmdline mirror)"
+[[ "$mirror" == 'auto' ]] && mirror="$(get_cmdline archiso_http_srv)"
+[[ -n "$mirror" ]] || exit 0
+
+mv /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist.orig
+cat >/etc/pacman.d/mirrorlist <<EOF
+#
+# Arch Linux repository mirrorlist
+# Generated by archiso
+#
+
+Server = ${mirror%%/}/\$repo/os/\$arch
+EOF
@@ -0,0 +1,239 @@
+#!/usr/bin/env bash
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+usage() {
+    cat <<-_EOF_
+    live cd sound helper script.
+    Usage: livecdsound [OPTION]
+    OPTIONS
+        -u, --unmute      unmute all sound cards
+        -p, --pick        select a card for speech output
+        -h, --help        Show this usage message
+
+_EOF_
+}
+
+bugout() {
+    printf "/usr/local/bin/livecdsound: programming error"
+    stat_fail
+}
+
+echo_card_indices() {
+    if [[ -f /proc/asound/cards ]]; then
+        sed -n -e's/^[[:space:]]*\([0-7]\)[[:space:]].*/\1/p' /proc/asound/cards
+    fi
+}
+
+# The following functions try to set many controls.
+# No card has all the controls and so some of the attempts are bound to fail.
+# Because of this, the functions can't return useful status values.
+
+# $1 <card id>
+# $2 <control>
+# $3 <level>
+unmute_and_set_level() {
+    [[ -n "$3" && -n "$2" && -n "$1" ]] || bugout
+    systemd-cat -t "livecdsound" printf "Setting: %s on card: %s to %s\n" "$2" "$1" "$3"
+    systemd-cat -t "livecdsound" amixer -c "$1" set "$2" "$3" unmute
+    return 0
+}
+
+# $1 <card id>
+# $2 <control>
+mute_and_zero_level() {
+    [[ -n "$1" && -n "$2" ]] || bugout
+    systemd-cat -t "livecdsound" printf "Muting control: %s on card: %s\n" "$2" "$1"
+    systemd-cat -t "livecdsound" amixer -c "$1" set "$2" "0%" mute
+    return 0
+}
+
+# $1 <card ID>
+# $2 <control>
+# $3 "on" | "off"
+switch_control() {
+    [[ -n "$3" && -n "$1" ]] || bugout
+    systemd-cat -t "livecdsound" printf "Switching control: %s on card: %s to %s\n" "$2" "$1" "$3"
+    systemd-cat -t "livecdsound" amixer -c "$1" set "$2" "$3"
+    return 0
+}
+
+# $1 <card ID>
+sanify_levels_on_card() {
+    unmute_and_set_level "$1" "Front" "80%"
+    unmute_and_set_level "$1" "Master" "80%"
+    unmute_and_set_level "$1" "Master Mono" "80%"
+    unmute_and_set_level "$1" "Master Digital" "80%"   # E.g., cs4237B
+    unmute_and_set_level "$1" "Playback" "80%"
+    unmute_and_set_level "$1" "Headphone" "100%"
+    unmute_and_set_level "$1" "PCM" "80%"
+    unmute_and_set_level "$1" "PCM,1" "80%"   # E.g., ess1969
+    unmute_and_set_level "$1" "DAC" "80%"     # E.g., envy24, cs46xx
+    unmute_and_set_level "$1" "DAC,0" "80%"   # E.g., envy24
+    unmute_and_set_level "$1" "DAC,1" "80%"   # E.g., envy24
+    unmute_and_set_level "$1" "Synth" "80%"
+    unmute_and_set_level "$1" "CD" "80%"
+    unmute_and_set_level "$1" "PC Speaker" "100%"
+
+    mute_and_zero_level "$1" "Mic"
+    mute_and_zero_level "$1" "IEC958"         # Ubuntu #19648
+
+    # Intel P4P800-MX
+    switch_control "$1" "Master Playback Switch" on
+    switch_control "$1" "Master Surround" on
+
+    # Trident/YMFPCI/emu10k1:
+    unmute_and_set_level "$1" "Wave" "80%"
+    unmute_and_set_level "$1" "Music" "80%"
+    unmute_and_set_level "$1" "AC97" "80%"
+
+    # DRC:
+    unmute_and_set_level "$1" "Dynamic Range Compression" "80%"
+
+    # Required for HDA Intel (hda-intel):
+    unmute_and_set_level "$1" "Front" "80%"
+
+    # Required for SB Live 7.1/24-bit (ca0106):
+    unmute_and_set_level "$1" "Analog Front" "80%"
+
+    # Required at least for Via 823x hardware on DFI K8M800-MLVF Motherboard
+    switch_control "$1" "IEC958 Capture Monitor" off
+
+    # Required for hardware allowing toggles for AC97 through IEC958,
+    #  valid values are 0, 1, 2, 3. Needs to be set to 0 for PCM1.
+    unmute_and_set_level "$1" "IEC958 Playback AC97-SPSA" "0"
+
+    # Required for newer Via hardware
+    unmute_and_set_level "$1" "VIA DXS,0" "80%"
+    unmute_and_set_level "$1" "VIA DXS,1" "80%"
+    unmute_and_set_level "$1" "VIA DXS,2" "80%"
+    unmute_and_set_level "$1" "VIA DXS,3" "80%"
+
+    # Required on some notebooks with ICH4:
+    switch_control "$1" "Headphone Jack Sense" off
+    switch_control "$1" "Line Jack Sense" off
+
+    # Some machines need one or more of these to be on;
+    # others need one or more of these to be off:
+
+    switch_control "$1" "Audigy Analog/Digital Output Jack" on
+    switch_control "$1" "SB Live Analog/Digital Output Jack" on
+
+    # D1984 -- Thinkpad T61/X61
+    switch_control "$1" "Speaker" on
+    switch_control "$1" "Headphone" on
+
+    # HDA-Intel w/ "Digital" capture mixer (See Ubuntu #193823)
+    unmute_and_set_level "$1" "Digital" "80%"
+
+    return 0
+}
+
+# $1 <card ID> | "all"
+sanify_levels() {
+    local ttsdml_returnstatus=0
+    local card
+    case "$1" in
+        all)
+            for card in $(echo_card_indices); do
+                sanify_levels_on_card "$card" || ttsdml_returnstatus=1
+            done
+            ;;
+        *)
+            sanify_levels_on_card "$1" || ttsdml_returnstatus=1
+            ;;
+    esac
+    return "$ttsdml_returnstatus"
+}
+
+# List all cards that *should* be usable for PCM audio.  In my experience,
+# the console speaker (handled by the pcsp driver) isn't a suitable playback
+# device, so we'll exclude it.
+list_non_pcsp_cards() {
+    for card in $(echo_card_indices); do
+        local cardfile="/proc/asound/card${card}/id"
+        if [[ -r "$cardfile" && -f "$cardfile" && "$(cat "$cardfile")" != pcsp ]]; then
+            echo "$card"
+        fi
+    done
+}
+
+# Properly initialize the sound card so that we have audio at boot.
+unmute_all_cards() {
+    sanify_levels all
+}
+
+is_numeric() {
+    local str="$1"
+    [[ "$str" =~ ^[0-9]+$ ]]
+}
+
+set_default_card() {
+    local card="$1"
+    sed -e "s/%card%/$card/g" </usr/local/share/livecd-sound/asound.conf.in \
+        >/etc/asound.conf
+}
+
+play_on_card() {
+    local card="$1" file="$2"
+    aplay -q "-Dplughw:$card,0" "$file"
+}
+
+# If there are multiple usable sound cards, prompt the user to choose one,
+# using auditory feedback.
+pick_a_card() {
+    set -f
+    mapfile -t usable_cards < <(list_non_pcsp_cards)
+    num_usable_cards="${#usable_cards[@]}"
+
+    if (( num_usable_cards == 1 )); then
+        systemd-cat -t "livecdsound" printf "Only one sound card is detected\n"
+        exit 0
+    fi
+    systemd-cat -t "livecdsound" printf "multiple sound cards detected\n"
+    for card in "${usable_cards[@]}"; do
+        if ! is_numeric "$card"; then
+            continue
+        fi
+        play_on_card "$card" /usr/share/livecd-sounds/pick-a-card.wav &
+    done
+    wait
+    sleep 1
+    for card in "${usable_cards[@]}"; do
+        if ! is_numeric "$card"; then
+            continue
+        fi
+        play_on_card "$card" /usr/share/livecd-sounds/beep.wav
+        if read -r -t 10; then
+            systemd-cat -t "livecdsound" printf "Selecting %s sound card as default\n" "$card"
+            set_default_card "$card"
+            break
+        fi
+    done
+}
+
+if (( $# == 0 )); then
+    echo "error: No argument passed."
+    exit 1
+fi
+while [[ "${1}" != "" ]]; do
+    case ${1} in
+        -h|--help)
+            usage
+            exit
+            ;;
+        -u|--unmute)
+            systemd-cat -t "livecdsound" printf "Unmuting all cards"
+            unmute_all_cards
+            ;;
+        -p|--pick)
+            pick_a_card
+            ;;
+        *)
+            echo "error: Unsupported argument"
+            usage
+            exit 1
+            ;;
+    esac
+    shift
+done
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# Launch the Calamares installer fullscreen in a cage kiosk compositor (Wayland,
+# straight on DRM — no display-manager needed in the live session).
+exec cage -s -- calamares
@@ -0,0 +1,3 @@
+Defaults node
+defaults.ctl.card %card%;
+defaults.pcm.card %card%;
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/cloud-config.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/cloud-final.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/cloud-init-local.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/cloud-init-main.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/cloud-init-network.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/ModemManager.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/systemd-networkd.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/systemd-resolved.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/systemd-timesyncd.service`
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/hv_fcopy_daemon.service`