Fixed pacman keyring initialization.

archlinux-base/build-rootfs.sh

@@ -105,23 +105,21 @@ rm -f \
     "$sha256sums" \
     "$b2sums"
 
+# Some tools invoked in the chroot write to /dev/null. The bootstrap archive
+# ships an empty /dev, so provide a temporary node until the rootfs is finalized.
+mknod -m 666 "$rootfs_dir/dev/null" c 1 3
+
 # The bootstrap tarball does not include an initialized pacman keyring.
 section "Initializing pacman keyring"
-rm -rf "$rootfs_dir/etc/pacman.d/gnupg"
-pacman-key --gpgdir "$rootfs_dir/etc/pacman.d/gnupg" --init
-pacman-key --gpgdir "$rootfs_dir/etc/pacman.d/gnupg" \
-    --populate-from "$rootfs_dir/usr/share/pacman/keyrings" \
-    --populate archlinux
+chroot "$rootfs_dir" /usr/bin/rm -rf /etc/pacman.d/gnupg
+chroot "$rootfs_dir" /usr/bin/pacman-key --init
+chroot "$rootfs_dir" /usr/bin/pacman-key --populate archlinux
 
 # Pin package updates to the Logal Arch mirror as well.
 section "Configuring rootfs for updates"
 printf '%s\n' "Server = https://mirrors.logal.dev/archlinux/\$repo/os/\$arch" \
     > "$rootfs_dir/etc/pacman.d/mirrorlist"
 
-# Some install scripts write to /dev/null. The bootstrap archive ships an empty
-# /dev, so provide a temporary node for the chrooted pacman transaction.
-mknod -m 666 "$rootfs_dir/dev/null" c 1 3
-
 # Give the chroot DNS resolution for package downloads, then restore the
 # bootstrap resolver placeholder before packaging.
 chroot "$rootfs_dir" /usr/bin/mv /etc/resolv.conf /etc/resolv.conf.bootstrap