From 8cfd71c6f7dff4d4c4720c581cba022cde3205bd Mon Sep 17 00:00:00 2001
From: Nucleic <andrew@blakeslee.me>
Date: Sat, 18 Jul 2026 17:09:47 -0700
Subject: [PATCH] Merge nucleic/golden-thistle-badger-sf7s into dev

---
 mkimage/build-rootfs.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/mkimage/build-rootfs.sh b/mkimage/build-rootfs.sh
index de26500..2747375 100755
--- a/mkimage/build-rootfs.sh
+++ b/mkimage/build-rootfs.sh
@@ -30,6 +30,12 @@ SUITE="trixie"
 MIRROR="https://snapshot.debian.org/archive/debian/${SNAPSHOT}/"
 PROFILE="$OS_DIR/mkimage/profiles/$TIER.pkgs"
 [ -f "$PROFILE" ] || { echo "no profile for tier '$TIER' ($PROFILE)" >&2; exit 2; }
+DEBIAN_KEYRING="${DEBIAN_ARCHIVE_KEYRING:-/usr/share/keyrings/debian-archive-keyring.gpg}"
+[ -r "$DEBIAN_KEYRING" ] || {
+  echo "Debian archive keyring not found at $DEBIAN_KEYRING" >&2
+  echo "install a current debian-archive-keyring or set DEBIAN_ARCHIVE_KEYRING" >&2
+  exit 2
+}
 
 pkg_list() { grep -vE '^\s*(#|$)' "$1" | tr '\n' ',' | sed 's/,$//'; }
 INCLUDE="$(pkg_list "$PROFILE")"
@@ -102,6 +108,7 @@ echo "narOS $VERSION/$CHANNEL: tier=$TIER arch=$ARCH snapshot=$SNAPSHOT pool=${P
 mmdebstrap \
   --architectures="$ARCH" \
   --variant=apt \
+  --keyring="$DEBIAN_KEYRING" \
   --include="$INCLUDE" \
   --aptopt='Acquire::Check-Valid-Until "false"' \
   "${HOOKS[@]}" \