Arctic Linux 2026.07.31

LUKS disk encryption, fonts, and a Slackware-style package browser - plus the dependency bug that would have made encryption silently unusable.

Installer: many more options

arctic-conf grew three new steps:

• Disk encryption - full-disk LUKS2, asked once per install, sitting under whichever filesystem was chosen (every one except zfs, which has its own native encryption).
• Fonts - a checklist: JetBrains Mono, Nerd Font symbols, Noto, Noto Emoji, DejaVu, Liberation.
• Extra packages - a Slackware-style category browser instead of one long list: terminals, editors, browsers, media, developer tools, virtualisation/containers, gaming, CLI utilities, office/comms.

Making encryption actually boot

Three things had to exist that did not:

1. arctic-mkinitramfs did not exist at all, despite being called from four places. Arctic's kernel builds its storage/filesystem drivers directly in, so a plain install never needed an initramfs - but an encrypted root needs a passphrase prompt before anything else, and dm-crypt is the one thing this kernel keeps as a module. Written now: bundles cryptsetup + the crypto/dm-crypt modules only when /etc/crypttab has a real entry, generates an /init that reads rd.luks.uuid= off the kernel command line and retries the passphrase up to 5 times.
2. cryptsetup could not run - libpopt.so.0, and nothing in Arctic ever packaged popt. Added it as its own port, rebuilt cryptsetup, and verified for real: a full luksFormat → open → close cycle against a loopback file through Arctic's own dynamic linker, including confirming a wrong passphrase is correctly rejected.
3. cryptsetup was not reachable during the live install session, only after chrooting into the target. Added a live self-install (ensure_cryptsetup) from the same bundled repo the rest of the installer already uses.

Also renamed arctic-service to service, and recovered a tmux build fix that a manifest edit had silently clobbered (now protected so it can't happen again).

Full details in docs/STATUS.md.