Arctic Linux - A1

No ISO, no guided installer. Boot any live Linux, partition and format by hand, extract a base tarball, chroot in and alpm add the rest. See the install guide or the deeper walkthrough.

Two tarballs: arctic-linux-def-tarball.tar.xz (busybox init) and arctic-linux-openrc-tarball.tar.xz (OpenRC wired up as init instead) - both boot-tested end to end in QEMU, both reach a working default runlevel. Both ship alpm pre-installed.

What changed

• Config is six small files under /etc/arctic/ instead of one install.conf and one system.conf: pkgs.conf (a mirror alpm keeps in step with add/rem, never a reconcile target), network.conf, users.conf, services.conf, hardware.conf, identity.conf.
• Networking is one stack, live and installed alike: wpa_supplicant + udhcpc via wifi-connect, no NetworkManager anywhere. A successful connect is saved to network.conf; rc.d/wifi reconnects at every boot in the background, never blocking login.
• busybox ships setuid-root with /etc/busybox.conf, fixing non-root ping - granted to root and wheel only, with mount/findfs/traceroute explicitly denied rather than left unlisted.
• New: alpm-strap, genfstab, a real GRUB port, sound-setup/sound-setup-openrc, libcap.
• arctic-rebuild auto-detects which bootloader is installed (limine/grub) when hardware.conf doesn't declare one - it always shipped empty, so the bootloader-config step was silently a no-op before this.

Fixed while verifying the new install path end to end

• Every install hit a kernel panic on first boot - Failed to execute /init (error -2), indistinguishable from /init being missing. arctic-mkinitramfs never created the /lib64 -> usr/lib symlink that busybox's own dynamic linker path needs, so busybox itself couldn't load. Found boot-testing the OpenRC flavor end to end in QEMU; confirmed against a real install too. If you installed from an earlier build of this release, regenerate your initramfs (alpm update, then arctic-mkinitramfs from a chroot or the running system) or reinstall.
• OpenRC's sysctl service called sysctl --system, a GNU procps-ng extension busybox's sysctl doesn't have, and failed on every boot - rewritten around busybox's own -p FILE support.
• OpenRC's keymaps/save-keymaps services need kbd_mode/loadkeys/dumpkeys, which come from a kbd package Arctic doesn't build - dropped from the default boot runlevel rather than failing every boot. Arctic already applies the configured keymap its own way (arctic-rebuild + busybox's loadkmap).
• alpm couldn't find its own libalpm.sh when run by absolute path from a non-Arctic host (alpm-strap's exact use case).
• alpm-repo's index generator had no dedup - two releases of the same package in one directory resolved to whichever sorted first alphabetically, not the newer one.
• The base tarball was missing merged-/usr symlinks, /etc/passwd+group+shadow+nsswitch.conf, /tmp, /home, and the awk/xz/bsdtar packages alpm needs to run at all outside a chroot's PATH.
• rc.boot's fsck step handed fstab's UUID= entries straight to fsck.fat, which - unlike e2fsck - doesn't resolve UUID= itself, so it failed on every boot with a separate FAT /boot partition; and a fsck exit of 1 (errors corrected, the normal outcome of an unclean shutdown) was being treated as a hard failure requiring a repair shell instead of the successful outcome it actually is.
• toybox now builds with tr, stty, expr, diff, more enabled.
• util-linux and util-linux-libs shipped overlapping libmount/libblkid/libuuid, so anything depending on the latter (e2fsprogs, openrc, genfstab's own util-linux dependency) hit a hard file conflict. util-linux now declares replaces="util-linux-libs".
• alpm add's download progress bar only ever showed a start frame and 100% - it polled once a second, and most packages finish inside that window. Polls every 0.2s now.
• Source builds (alpm add -s) run under set -x, so the actual build commands are visible instead of just phase names.
• A source build needing a build tool that was itself part of the same transaction (e.g. alpm add base-devel) failed with a spurious "missing" error - source builds ran before the transaction's own binary installs finished.

Known gaps

• BIOS + GRUB deploy is broken: grub-install --target=i386-pc refuses to write boot sectors because ld.lld miscompiles GRUB's freestanding real-mode kernel.img. BIOS installs should use Limine (needs a small unformatted BIOS-boot partition ahead of a FAT32 /boot); EFI installs are unaffected either way.
• LXQt is not packaged.

sha256 checksums are attached alongside each tarball.

Arctic Linux - Alpha 3.1 SS

Fixes the real bug behind "a fresh install still behaves like the live image": arctic-base and alpm bootstrap through a separate packaging step (build/pkg-tools.sh) that reads the source tree directly, not the normal recipe pipeline the live ISO build already used - so every fix from Alpha 3 SS landed on the live ISO and never reached a real arctic-install target, because that step had not been rerun since before any of it existed.

sha256: 5b389f766731e9b1abe65164cca545509c548737a2cf01bfff4f706b6309253c

What this actually fixes on a real install (confirmed missing before, present now, in both the republished package and the built ISO):

• the first-login greeting no longer tells you to run wifi-connect/arctic-install again, as if still on the live image
• wifi-connect has its NetworkManager-conflict detection (was reporting "no networks found" against real hardware in range)
• rc.boot has the coldplug fix - kernel-module loading no longer takes the full ~30s the live ISO never had

Arctic Linux - Alpha 3 SS

First release under the new version scheme: main.bigfix.smallfix plus a stability suffix (U/VS/S/SS, SS = super stable, the top of the scale). This release stabilizes everything since Alpha 2 and closes the release cycle before multilib and Rust work starts on Alpha 4. Development of Alpha 4 might take a couple days.

sha256: a95be074c668ebfd1749b9c191d7a246e63890676c21fb8ad3a6b8457c7af462

Verified this cycle, on a real arctic-install target booted through its own bootloader (not just the sandboxed build host):

• boot to login prompt: ~5.6s, login to shell: ~2s
• clang could not run at all on a freshly installed system - libc++ was never on the dynamic linker's search path. This was masked all cycle by the sandboxed build host's own /etc/ld.so.conf being visible through the bind mount; a real chroot with no host underneath caught it. Every source build (alpm add -s) was broken before this fix.
• every fresh btrfs install kernel-panicked (Attempted to kill init!) - missing rootflags=subvol=@ on the kernel cmdline
• nmtui shipped with a hardcoded build-host path instead of a real libnewt.so soname
• `wifi-connect" and NetworkManager fighting over the same radio, misreported as no networks in range
• coldplug's progress dots never appeared on the default boot entry (the one everyone actually boots from) because they were gated behind a flag that entry always sets
• two real package-manager conflicts: ninja/btop both vendoring googletest libraries that collided with each other, and every desktop profile colliding with the plain foot terminal package's own default config

Arctic Linux - Alpha 2.61

Arctic Linux Alpha 2.61 — Arctic-linux-a2.61.iso, x86_64, 695 MiB.

This is labeled a small fix. It is not one - it is the most severe bug found
in this project so far, and it was found by accident while verifying an
unrelated a2.6 fix. It's staying a2.61 rather than being renumbered, but do
not read the version number as a measure of how serious this was.

Every fresh install on the default filesystem kernel-panicked before it ever booted

KERNEL PANIC!
Please reboot your computer.
Attempted to kill init! exitcode=0x00000100

btrfs is Arctic's default root filesystem, and installing onto it never
worked past the first boot. arctic-install creates the root subvolume as
@ and mounts it at @ correctly during the install itself - but the
bootloader config arctic-boot-strap writes never told the next boot the
same thing. Without rootflags=subvol=@ on the kernel command line, the
initramfs mounts the raw top-level btrfs volume instead of the @
subvolume - the one that actually has a /sbin/init in it. @, @home and
the rest sit one level down, inside that top level, invisible to a plain
mount. switch_root looks for /sbin/init where the kernel just told it
root is, does not find it, and exits - and when the process the kernel
believes is PID 1 exits, this is what happens, always, on every Linux
system. This happened before rc.boot ever ran, before any service, before
anything this project's own boot log could report on.

Fixed by reading the correct subvol= straight back out of /etc/fstab -
genfstab already recorded it correctly the whole time - and adding
rootflags= to the kernel command line Limine and GRUB both write. Verified
by hand-patching a panicking install's limine.conf (confirmed the theory),
then by a completely fresh install through the fixed installer reaching
arctic login: with no hand-editing at all.

If you installed onto btrfs on any earlier a2.x release and it never booted,
this is why, and this is the fix.

The kernel-modules step actually got faster, not just less scary

a2.5 made the slow coldplug step at boot print a heartbeat so it stopped
looking hung. It was still slow. This release cuts the actual work: a device
the kernel already bound a driver to is skipped instead of re-probed, and an
alias already queued this boot is not looked up a second time. Measured on a
real /sys tree: 310 devices to consider, 69 already had drivers, 251
candidate aliases collapsed to 59 unique ones after dedup - an 81% cut in
modprobe invocations, each of which was a full process fork re-parsing
modules.dep from scratch. Real hardware, with more devices already bound
before userspace starts than this measurement's host had, should see at
least as large a cut.

Everything from a2.6

Wifi credentials in install.conf actually get used now
(system-connections needed to be 0700, not just the file in it);
wifi-connect recognizes when NetworkManager already owns the radio instead
of blaming signal strength; gmp-alt is built, which is what nftables
needed to install at all; and the wifi-connect / first-boot login messages
are gone rather than trimmed. See the a2.6 notes for the detail on each.

Known

• No web browser; firefox, librewolf, chromium and qutebrowser all need Rust.
• No audio — wireplumber will not build against the packaged lua.
• No terminfo database, so tput does not work.
• ly is not packaged yet.
• initialization freezes at boot; not diagnosed yet.
• The a2.6 claim that nftables now stops cleanly on poweroff is verified only
  as far as "the package now installs" - an actual boot-to-shutdown cycle
  exercising rc.shutdown's stop of it was not completed this round.

Install

dd if=Arctic-linux-a2.61.iso of=/dev/sdX bs=4M status=progress conv=fsync

Run wifi-connect if you need wireless during install; on an installed
system use nmtui. Edit /etc/arctic/install.conf, run arctic-install.

Arctic Linux - Alpha 2.5

Arctic Linux Alpha 2.5 — Arctic-linux-a2.5.iso, x86_64, 695 MiB.

The boot could look hung for twenty seconds with no warning

The coldplug step - "load a driver for every device already present," added
back when the live image had no network at all - walks every modalias
under /sys/devices and runs a separate modprobe for each. A real machine
can have several hundred of these, fully serial, one process fork per device,
and the step printed nothing at all between "Loading kernel modules" and
finishing - which on real hardware took about twenty seconds of a completely
dead screen. That is exactly the shape of a hung boot, and exactly how you
end up holding the power button on a machine that was working the entire
time.

It's backgrounded now and prints a dot once a second while it runs, the same
way wifi-connect's own silent wifi scan already does - a heartbeat instead
of silence.

PAM is packaged

Linux-PAM, library and the standard module set, built against libressl's
absence on purpose (no openssl feature - Arctic links libressl everywhere
and a second TLS library under pam_timestamp was never worth it), with
docs/selinux/audit/nis/logind/elogind off since none of those are packaged.

It's on every install now, in PKGS_MAIN. Nothing is built against it yet -
busybox's login and su need no authentication stack at all, and stay
exactly as they are; see the a2.2 notes for what happened the one time
something here linked libpam without it being packaged on the system at
all. This is what unblocks ly and anything else that wants PAM, without
touching what already works.

Known

• gmp-alt has no binary package, so nftables cannot install and the
  firewall does not come up.
• No web browser; firefox, librewolf, chromium and qutebrowser all need Rust.
• No audio — wireplumber will not build against the packaged lua.
• No terminfo database, so tput does not work.
• ly is not packaged yet - PAM being on the system now is what it was
  waiting on.
• initialization freezes at boot; not diagnosed yet.

Install

dd if=Arctic-linux-a2.5.iso of=/dev/sdX bs=4M status=progress conv=fsync

Run wifi-connect if you need wireless, edit /etc/arctic/install.conf, run
arctic-install.

Arctic Linux - Alpha 2.4

Arctic Linux Alpha 2.4 — Arctic-linux-a2.4.iso, x86_64, 695 MiB.

Wireless on a fresh install was a closed loop: no iw, no way to scan, no way
to install iw because that needs the network iw is what's missing. This
closes it, and fixes what an actual install run on real hardware turned up
along the way.

A fresh install could not get onto wireless, ever

iw was on the live image (so the live session could scan and connect) but
was never part of what lands on the installed system. PKGS_NET carried
networkmanager, wpa_supplicant, curl and dbus — no iw, no
wireless-regdb. First boot of a finished install had wpa_supplicant to
associate with a network, and nothing that could find one to associate with:

Wireless? Run wifi-connect ...
!! iw is not installed - cannot scan (alpm add iw)
> doas alpm add iw
E: wget: bad address 'raw.githubusercontent.com'

iw and wireless-regdb are in PKGS_NET now, so a fresh install can scan
and connect the moment it boots, exactly like the live session it was
installed from.

Installing network tools is not optional any more

PKGS_NET failing used to print a warning and continue. A machine that boots
with no network path, can't reach a repository, and can't scan for one either
is a worse failure than stopping the install while the medium is still in the
drive — so this step is bail now, the same as the base system and the
kernel.

The installer fetches repositories itself, first

alpm fetch all used to be something you ran by hand before arctic-install,
or the install proceeded against whatever the live session's package index
happened to already be — current if someone remembered to sync it, stale
otherwise. It is the first thing arctic-install does now, before it even
looks at the target disk.

A failed install left the disk mounted for the next attempt to trip over

mke2fs refuses outright to format a mounted device - "is mounted; will not
make a filesystem here!" - which is correct and unhelpful when the reason it's
mounted is that the previous attempt failed without cleaning up. Two fixes:

• make_root_fs unmounts the target device from wherever it's currently
  mounted before it tries to format it.
• bail unmounts everything under the target, deepest path first, on any
  failure - so a retry starts clean instead of needing umount -R by hand.

The console

• The prompt is one line. It printed user@host path on one line and a
  colour-coded > on a line of its own below it. The arrow is the end of the
  same line now; the colour still marks root and the last exit status.
• Tab completion works without a hidden prompt. compinit checks that
  every directory in $fpath has sane permissions, and asks what to do about
  it when one doesn't - a prompt with no terminal history to answer it, on a
  fresh boot, that silently disabled every completion after it. -u skips
  the check; Arctic controls those permissions itself.
• The first-login message has no mascot, matching the live session's
  welcome screen from a2.2 - a first login is not the place for one either,
  and neither is a message someone will see once and then never again.

Known

• gmp-alt has no binary package, so nftables cannot install and the
  firewall does not come up.
• No web browser; firefox, librewolf, chromium and qutebrowser all need Rust.
• No audio — wireplumber will not build against the packaged lua.
• No terminfo database, so tput does not work.
• initialization freezes at boot; not diagnosed yet.

Install

dd if=Arctic-linux-a2.4.iso of=/dev/sdX bs=4M status=progress conv=fsync

Run wifi-connect if you need wireless, edit /etc/arctic/install.conf, run
arctic-install.

Arctic Linux - Alpha 2.3

Arctic Linux Alpha 2.3 — Arctic-linux-a2.3.iso, x86_64, 695 MiB.

Several a2.2 installs failed with only "the base system failed to install" on
screen and nothing more useful in the log. This is a fix for that failure mode
itself, not for one specific cause of it — whatever actually goes wrong during
an install is now visible.

The installer was throwing away its own error

target_alpm, the function every install step runs alpm through, called alpm
plain with no output capture at all:

target_alpm() {
    ALPM_ROOT="$TARGET" ALPM_YES=1 alpm "$@"
}

Every failing step reports itself with bail "... - see $LOGF", and the log
had nothing in it beyond the step name — alpm's actual reason, whatever it
was, went to the terminal and nowhere else. On a serial console or a
screenshot taken after the fact, that reason is gone. "the base system failed
to install" was the entire post-mortem, every time, regardless of cause.

alpm's output is captured into the install log now, and bail prints the last
twelve lines of the log instead of just the one sentence it was called with.
The next installer failure — whatever it turns out to be — will say why on the
screen that shows the failure, not require a chroot and a manual read of a log
file to find out.

busybox is the explicit default in install.conf

A_INIT already defaulted to busybox in the installer itself as of a2.2.
The commented example line in install.conf still read
#A_INIT=initialization, which is the one line most likely to get uncommented
by someone reading the file top to bottom looking for what to turn on. It
reads #A_INIT=busybox now, with a note on why initialization is not it yet.

Known

• The specific cause of the a2.2 base-install failures is not yet identified —
  this release makes it visible, not fixed. If it recurs, the on-screen output
  now names it.
• gmp-alt has no binary package, so nftables cannot install and the firewall
  does not come up.
• No web browser; firefox, librewolf, chromium and qutebrowser all need Rust.
• No audio — wireplumber will not build against the packaged lua.
• No terminfo database, so tput does not work.
• initialization freezes at boot; not diagnosed yet.

Install

dd if=Arctic-linux-a2.3.iso of=/dev/sdX bs=4M status=progress conv=fsync

Run wifi-connect if you need wireless, edit /etc/arctic/install.conf, run
arctic-install.

Arctic Linux - Alpha 2.2

Arctic Linux Alpha 2.2 — Arctic-linux-a2.2.iso, x86_64, 695 MiB.

Alpha 2.1's live image and installer worked on real hardware. The installed
system it produced could not be logged into. This fixes that and the rest of
what a first real install turned up.

No installed system could be logged into

arctic login: apiwo
/bin/login: error while loading shared libraries: libpam.so.0

util-linux-libs — a package whose name, description and recipe comment all
say "libblkid, libmount and libuuid only" — was running a plain
make DESTDIR=... install and shipping util-linux's entire program set:
dmesg, kill, mount, su, agetty, blkid, and /bin/login.

busybox provides /bin/login as an applet symlink and busybox links nothing
at all. util-linux's login links libpam, which Arctic does not have and does
not build. Every base install pulls in util-linux-libs, because libblkid and
libmount are what the installer and mount need — so every install replaced a
working login with one that could not start.

It is built --disable-all-programs with the five libraries enabled by name,
and package() removes every binary directory afterwards, because one stray
login here is a machine nobody can log into. The package now ships 45 files
and not one of them is a program.

dwm could not start

dwm: error while loading shared libraries: libharfbuzz.so.0

freetype links libharfbuzz.so.0 and does not declare harfbuzz, so nothing
ever installed it. Declared on dwm for now rather than on freetype: freetype
and harfbuzz link each other, and that cycle is not something to introduce
into the base dependency graph in a bugfix release. The general fix — auditing
every package's real linkage against what it declares — is still outstanding
and this is the second package it has bitten.

Every installed machine called itself Alpha 1.1

arctic-install carried its own VERSION="Arctic Linux - Alpha 1.1" literal
and write_release() copied it into the installed system's
/etc/arctic-release. So every machine installed from every image since a1.1
was branded Alpha 1.1, and the boot banner that reads that file said so on
every boot. The installer reads the version off the live system it is running
from now, so it cannot drift again.

The boot output

• The banner is gone. It printed the release above every boot, which is
  not information anyone needs at every boot — and was wrong for months
  besides. arcticfetch answers that question when it is asked.
• No more per-service timings. A line is [ done ], [ fail ] or
  [ skip ]. The elapsed time was noise; whether the thing came up is the
  point. The total is still printed once at the end.

initialization is no longer the default

A_INIT defaulted to initialization, and a machine installed with it froze
partway through boot and never reached a login. An init is the one component
where a bad default cannot be recovered from without another medium, so the
default is busybox — the init every image here has actually booted.

A_INIT=initialization still works and is still where Arctic is going. It is
a deliberate choice now rather than what you get by not choosing.

Cosmetic

• Limine's backdrop was 5f5bc6, a violet that read as a pink wash behind the
  boot menu. It matches the terminal background now.
• The ASCII penguin is gone from the live session.

Known

• The install-to-disk path in this image is not re-verified end to end;
  the fixes above are verified against the built packages and the built image.
• No web browser; firefox, librewolf, chromium and qutebrowser all need Rust.
• No audio — wireplumber will not build against the packaged lua.
• No terminfo database, so tput does not work.
• gmp-alt has no binary package, so nftables cannot install and the firewall
  does not come up.
• gtk3 in the repository is corrupt (no .PKGINFO).
• initialization freezes at boot; not diagnosed yet.

Install

dd if=Arctic-linux-a2.2.iso of=/dev/sdX bs=4M status=progress conv=fsync

Run wifi-connect if you need wireless, edit /etc/arctic/install.conf, run
arctic-install.

Arctic Linux - Alpha 2.1

Arctic Linux Alpha 2.1 — Arctic-linux-a2.1.iso, x86_64, 695 MiB.

A bugfix for Alpha 2, which shipped with wireless broken by the fix that was
supposed to repair it.

Still not fully tested end to end. The live image is verified on real
hardware and in a VM; the install-to-disk path and wireless association are
code-verified against the binaries Arctic actually ships, not exercised to
completion. Treat it as a test image.

-f is not an option this wpa_supplicant has

Alpha 2 fixed the real wireless bug — wpa_passphrase reading from a pipe
exits 1 without writing anything, so the config had no network= block — and
then broke wireless a second way while adding diagnostics for the first.

The supplicant was invoked with -f <logfile> so a failed association would
leave something to read. -f is compiled in by CONFIG_DEBUG_FILE, and
Arctic's wpa_supplicant does not set it. An unknown option makes
wpa_supplicant print its usage and exit without ever touching the radio,
so association could not even be attempted — and the "log" the failure path
then printed was that usage text:

!! NETGEAR24 did not come up after 30s
   no control socket - wpa_supplicant is not running
   last lines of /run/arctic/wpa_supplicant-wlan0.log:
     -p = driver parameters
     -P = PID file
     -q = decrease debugging verbosity (-qq even less)
     ...

The option had been checked with wpa_supplicant -h on the build host,
whose wpa_supplicant is built with CONFIG_DEBUG_FILE and accepts -f
perfectly. Against the binary Arctic ships:

$ strings usr/sbin/wpa_supplicant | grep -E '^  -[fBc] '
  -B = run daemon in the background
  -c = Configuration file

Shell redirection does the same job and cannot be refused.

A supplicant that never started counted as started

-B forks, so the exit status says nothing about whether the daemon survived,
and a build that refuses an option can exit 0 having printed usage. That is
why the failure surfaced thirty seconds later as a timeout rather than
immediately as "it did not start". The control socket and the process are what
get checked now, within five seconds.

DHCP

udhcpc was called without -s, relying on busybox's compiled-in default
script path. That path is correct and the script is on the image, so this was
not broken — but a lease that is obtained and never applied is indistinguishable
from no lease at all, so the script is named explicitly now, the way
rc.d/network already named it. Its output goes to
/run/arctic/udhcpc-<iface>.log instead of /dev/null, and a failure prints
the tail of it.

Everything from Alpha 2

Still in this image: the wpa_passphrase fix, the missing ctrl_interface,
the installer dropping the quoted psk, wireless-regdb for the 5 GHz
regulatory domain, the root=PARTUUID= → UUID= change that is what lets an
installed system boot at all, the console width and per-service timings, and
the live session printing how to install Arctic instead of a hardware
inventory. See the Alpha 2 notes for the detail on each.

Known

• No web browser; firefox, librewolf, chromium and qutebrowser all need Rust.
• No audio — wireplumber will not build against the packaged lua.
• No terminfo database, so tput does not work.
• gmp-alt has no binary package, so nftables cannot install and the firewall
  does not come up. The install succeeds regardless.
• gtk3 in the repository is corrupt (no .PKGINFO) and cannot be installed.
• Declared dependencies are not checked against real linkage; dwm installs and
  then fails on libharfbuzz.so.0.

Install

dd if=Arctic-linux-a2.1.iso of=/dev/sdX bs=4M status=progress conv=fsync

Run wifi-connect if you need wireless, edit /etc/arctic/install.conf, run
arctic-install.

sha256  cadf9cb207973d8f57a71bafeb6d425b843959ab5275a49ae97bf13bd65a547f

Arctic Linux - Alpha 2 (not fully tested)

Arctic Linux Alpha 2 — Arctic-linux-a2.iso, x86_64, 695 MiB.

Not fully tested. The live image is verified — it boots, the greeting,
console and regulatory database were checked on a running machine. The
install-to-disk path carries fixes that are reasoned and code-verified but
whose end-to-end run was not completed before release, and the wireless
fix could not be exercised in a virtual machine because there is no wireless
hardware in one. Treat this as a test image. Keep a copy of anything that
matters on the disk you point it at.

Alpha 1 ran from a1 to a1.24. This is the start of the second line, and it is
mostly two things that had never worked at all.

Wireless could never have associated

wifi-connect wrote its wpa_supplicant configuration by piping the passphrase
into wpa_passphrase, to keep it out of a command line every process can read.

wpa_passphrase turns terminal echo off before reading, so it calls
tcgetattr on its stdin. On a pipe that fails with ENOTTY and it exits 1
having written nothing:

$ printf 'testpass123\n' | wpa_passphrase TestNet
exit=1   stdout: (empty)
stderr: tcgetattr: Inappropriate ioctl for device

Its stderr went to /dev/null and its exit status was never checked, so what
landed on disk was a configuration file with no network= block in it.
wpa_supplicant started perfectly, associated with nothing, and thirty seconds
later blamed the passphrase. The passphrase was never wrong.

The block is written directly now — wpa_supplicant derives the key from a
quoted passphrase itself, and wpa_passphrase's own output carries the
plaintext in a #psk= comment beside the hash anyway, so the indirection was
protecting nothing. 0600 either way, and it refuses to continue if no network
block landed.

Three more, all on the same path:

• Nothing wrote a ctrl_interface, so wpa_supplicant opened no control
  socket, every wpa_cli call failed silently — including the association
  check in the wait loop — and the error message told you to run
  wpa_cli -i wlan0 status, which could only answer Could not connect to wpa_supplicant. It prints the real wpa_state and the supplicant log now.
• The installer dropped the key it was carrying across. It read the psk
  with grep -v '^"', deliberately skipping a quoted passphrase, which would
  have written an open-network profile for a WPA network. Both forms accepted.
• No regulatory database on the image, so the kernel stayed in world
  domain 00 where most 5 GHz channels are receive-only: the access point
  shows in a scan and the card is forbidden to transmit to it.
  wireless-regdb is 17 KiB and ships now; WIFI_COUNTRY=US wifi-connect
  sets a domain.

No installed system could boot

The installer wrote root=PARTUUID= on the kernel command line and into
fstab. Arctic always boots through an initramfs, and the initramfs resolves
root= with busybox findfs, which implements LABEL= and UUID= and
nothing else:

# findfs UUID=f1832033-6264-4f35-8f81-43170e93a396
/dev/vda3
# findfs PARTUUID=9813faed-6c1b-4e86-808b-61e6498d25db
Usage: findfs LABEL=label | UUID=uuid

Every install finished, reported success, and then stopped at no device matches PARTUUID=... in the initramfs shell with the disk sitting right
there. busybox blkid does not report PARTUUID either, so nothing on the
machine could have resolved it. /boot in fstab had the same problem.

Both are UUID= now, falling back to PARTUUID= then the device path;
arctic-boot-strap re-derives rather than copying a PARTUUID out of an older
fstab; and the initramfs falls back to LABEL=arctic-root, which every
filesystem the installer makes carries, so a machine installed by an older
version comes up too.

The firewall had no package

A_FIREWALL=y is the default and nftables had no binary in any repository, so
the installer compiled it inside the target and failed with "C compiler cannot
create executables" — and reported success anyway. It would not build on the
host either: configure probes for readline inside -ledit, which Arctic's
libedit does not provide. Built --with-cli=no, which drops nft -i and
nothing else, and packaged with libnftnl.

The boot and the console

• The whole boot was right-aligned against column 80 of a 240-column
  console. The width was measured when rc.lib was sourced — the first
  thing rc.boot does, before /dev is mounted — so every boot took the
  80-column fallback. Measured at first use and cached now.
• Every service reported t=0.0s: one decimal place, and almost
  everything starts in under a tenth of a second.
• A failure before /run/arctic existed printed a shell error on top of
  itself — a redirection that cannot be opened is reported by the shell
  before 2>/dev/null is in effect.
• The live session says how to install it instead of running
  arcticfetch. Three steps, the alpm commands, where the configuration
  lives, and arctic-chroot for repair. arcticfetch is still there to run,
  and no longer reports sh for a session running zsh.

Known

• No web browser: firefox, librewolf, chromium and qutebrowser all need Rust.
• No audio — wireplumber will not build against the packaged lua.
• No terminfo database, so tput does not work.
• Declared dependencies are still not checked against real linkage; dwm
  installs and then fails on libharfbuzz.so.0.
• gtk3 in the repository is corrupt (no .PKGINFO) and cannot be installed.
• LXDE and LXQt have recipes but no packages.

Install

dd if=Arctic-linux-a2.iso of=/dev/sdX bs=4M status=progress conv=fsync

Run wifi-connect if you need wireless, edit /etc/arctic/install.conf, run
arctic-install.

sha256  b4972b233eda64f30717d8271f2787b752f3315a326d40f2836f6e56491fdf2b