fix: change archzfs SigLevel from Optional TrustAll to Never

Optional TrustAll is misleading — it implies signature checking when
none is actually happening. Use Never to match the installer and be
explicit. Repo is served over HTTPS; GPG adds no value in build env.

1 files changed, 3 insertions, 1 deletions

diff --git a/build.sh b/build.sh
index a169cae..8bb7893 100755
--- a/build.sh
+++ b/build.sh
@@ -140,12 +140,14 @@ if [[ -f "$PROFILE_DIR/airootfs/etc/mkinitcpio.d/linux.preset" ]]; then
 fi
 
 # Add archzfs repository to pacman.conf
+# SigLevel=Never: archzfs GPG key import is unreliable in clean build environments;
+# repo is explicitly added and served over HTTPS, GPG adds no real value here
 info "Adding archzfs repository..."
 cat >> "$PROFILE_DIR/pacman.conf" << 'EOF'
 
 [archzfs]
 Server = https://archzfs.com/$repo/$arch
-SigLevel = Optional TrustAll
+SigLevel = Never
 EOF
 
 # Add ZFS and our custom packages