Merge nucleic/golden-thistle-badger-sf7s into dev

mkimage/build-rootfs.sh

@@ -30,6 +30,12 @@ SUITE="trixie"
 MIRROR="https://snapshot.debian.org/archive/debian/${SNAPSHOT}/"
 PROFILE="$OS_DIR/mkimage/profiles/$TIER.pkgs"
 [ -f "$PROFILE" ] || { echo "no profile for tier '$TIER' ($PROFILE)" >&2; exit 2; }
+DEBIAN_KEYRING="${DEBIAN_ARCHIVE_KEYRING:-/usr/share/keyrings/debian-archive-keyring.gpg}"
+[ -r "$DEBIAN_KEYRING" ] || {
+  echo "Debian archive keyring not found at $DEBIAN_KEYRING" >&2
+  echo "install a current debian-archive-keyring or set DEBIAN_ARCHIVE_KEYRING" >&2
+  exit 2
+}
 
 pkg_list() { grep -vE '^\s*(#|$)' "$1" | tr '\n' ',' | sed 's/,$//'; }
 INCLUDE="$(pkg_list "$PROFILE")"
@@ -102,6 +108,7 @@ echo "narOS $VERSION/$CHANNEL: tier=$TIER arch=$ARCH snapshot=$SNAPSHOT pool=${P
 mmdebstrap \
   --architectures="$ARCH" \
   --variant=apt \
+  --keyring="$DEBIAN_KEYRING" \
   --include="$INCLUDE" \
   --aptopt='Acquire::Check-Valid-Until "false"' \
   "${HOOKS[@]}" \