Adding repositories with local config broken on Arch

[leoratte]

I added Profiles=obs-repos to my mkosi.local.conf and the build broke with:

mkosi -B -f
‣ Running bump script /home/leo/git/particleos/mkosi.bump
‣ Bumping version: 'n/a' → '20260214201224'
‣ Copying in sandbox trees…
‣ Syncing package manager metadata
:: Synchronizing package databases...
 system_systemd_Arch                                      6.8 KiB   103 KiB/s 00:00 [################################################] 100%
 core                                                   123.6 KiB  1585 KiB/s 00:00 [################################################] 100%
 extra                                                    7.9 MiB  11.1 MiB/s 00:01 [################################################] 100%
warning: Public keyring not found; have you run 'pacman-key --init'?
error: system_systemd_Arch: key "713BF72732820778" is unknown
error: keyring is not writable
error: failed to synchronize all databases (unexpected error)
‣ "pacman --root=/buildroot --logfile=/dev/null --dbpath=/var/lib/pacman --cachedir=/var/cache/pacman/mkosi --cachedir=/var/cache/pacman/pkg --hookdir=/buildroot/etc/pacman.d/hooks --arch x86_64 --color auto --noconfirm --sync --refresh" returned non-zero exit code 1.
‣ (sandbox command omitted, rerun with --debug to see the full sandbox command.)

I think this is caused by mkosi commit , which moves pacman keyring initialization after database synchronization in mkosi/init.py.

mkosi.local.conf for reference:

[Distribution]
Distribution=arch

[Config]
Profiles=obs-repos
Profiles=desktop,kde,flathub

[Validation]
SecureBoot=no
SignExpectedPcr=no

I' m trying this on manjaro.

[bluca]

Regression introduced by #4093 as hinted above, minimal reproducer:

[Build]
SandboxTrees=systemd.gpg:/usr/share/pacman/keyrings/systemd.gpg
             systemd-trusted:/usr/share/pacman/keyrings/systemd-trusted
             arch.conf:/etc/pacman.d/systemd.conf

With arch.conf systemd-trusted and systemd.gpg from https://github.com/systemd/particleos/tree/main/mkosi.profiles/obs-repos

[JiwaniZakir]

The key "713BF72732820778" is unknown error confirms pacman is attempting to sync the system_systemd_Arch OBS repository before its signing key has been imported into the keyring. This is consistent with the regression introduced in #4093: by moving pacman-key --init and key population to after the --sync --refresh call in mkosi/__init__.py, any third-party repository (like one added via the obs-repos profile) whose key isn't already trusted will fail at sync time. The fix would need to ensure keyring initialization and any required key imports happen before the first pacman --sync invocation, or that the --sync --refresh step is deferred until the keyring is ready.