Bootstrap Arch Linux by chroot

Date: 2024-11-10
Tags: FLOSS, Linux, administration

How to install Arch from a Debian or derivative (or other arch), using bootstrap archive and chroot.

Also added some tips for Manjaro-keyring problems, this arch derivative is well known for that.

The command pacstrap also help to install arch, the official tutorial explains how to use it

WIP: Still doesn't manage to have a bootable UEFI+GPT, systemd-boot UEFI Boot Manager, bootable system (See also Archiwiki systemd-boot dedicated page)

About Arch Linux

There are several architecture Arch Linux distribution now, X86_64 (or AMD64), the older non-X86 one was Arch Linux ARM (or ALARM)(https://archlinuxarm.org), but that's also the later and less complete on package conversions, and other non-X86 include at least RISC-V, PowerPC and Loonson architectures, that probably learned from ARM version problems and very efficient to release packages. A multi-architecture unified Arch Linux repository (as for Debian) is on the way, but could still take time. For ARM64, there is also BredOS, specialized on hardware runing with the very powerful Rockchip RK3588.

The Arch Linux Wiki is also a great resources about Linux system administration in general. Other good one is Linux From Scratch (LFS) and it's BLFS (beyond) companion. THere are various architecture specialized version of LFS, like LFS for ARM64, LoongArch (Loongson), MIPS64EL and Cross LFS NG (for crosscompilation)

We describe here how to install it on X86_64, but the process could be the same for RISC-V (need qemu-user-static qemu-user-static-binfmt qemu-system-riscv to do the same thing from an X86_64 desktop and use Felix rootfs for RISC-V instead of Arch Linux default one).

I recommand to make a bootable installation iso first in case of problems.

First get the ISO from ArchLinux website links (mirror or torrent), and verify it via website given sha256sum.

Get to the Last release from the ArchLinux official website download page

Keep the chain at the right of sha256 in "Checksums and signature" section for latter verification and get the iso via:

for bittorrent case, if you don't already use a bittorrent client, install aria2c (depending on your OS, pacman -S aria2c or apt install aria2c) and then get the file:

 aria2c magnet:?xt=urn:btih:186e418c3db64cf184f505ef85d4fa30928e6252&dn=archlinux-2024.11.01-x86_64.iso

or get the file from a mirror with wget or curl (should be already installed):

 curl -OR https://archlinux.mirrors.ovh.net/archlinux/iso/2024.11.01/archlinux-2024.11.01-x86_64.iso

Warning: Lot of people recommand to use dd, and it was natural until few years ago to write iso image on SDcard (via (USB) sdcard reader, I don't use USB pen drive, that are often not reliables).

With dd

dd bs=1024 if=archlinux-2024.11.01-x86_64.iso of=/dev/sdb

There is this result

Périphérique Amorçage Début       Fin  Secteurs Taille Id Type
/dev/sdb1             32768 124735487 124702720  59,5G  7 HPFS/NTFS/exFAT

Result with isoimagewriter:

Périphérique Amorçage   Début     Fin Secteurs Taille Id Type
/dev/sdb1    *             64 2004991  2004928   979M  0 Vide
/dev/sdb2             2004992 2363391   358400   175M ef EFI (FAT-12/16/32)

On Debian and derivatives (Ubuntu PopOS, etc)

apt install wget ztdcat chroot

On Arch Linux and derivatives (Manjaro, etc)

pacman -S arch-install-scripts wget

Get and prepare the filesystem

date=2024.11.01
archive=https://mirror.cyberbits.eu/archlinux/iso/${date}/archlinux-bootstrap-${date}-x86_64.tar.zst
wget https://$mirroir/$archive
mount /dev/sdX /mnt/linux
cd /mnt/linux
zstdcat ~/$archive | tar xf -
mv root.x86_64/* .
rmdir root.x86_64

Push immediatly your SSH public key, it can save lot of time later:

First, if you don't have one:

ssh-keygen -t ed25519

Tip, at the time of the creation an ASCIIart picture is displayed, it is usefull to memorize if a key is the created key Here is a good explanation about "what is the ssh-key random ASCIIart image for?"

mkdir -p /mnt/linux/root/.ssh
cat ~/.ssh/id_ed25519.pub >/mnt/linux/root/.ssh/authorized_keys

After chrooting:

# if you need to clean former keys: rm -rf /etc/pacman.d/gnupg
pacman-key --init
pacman-key --populate archlinux
# if you use manjaro: pacman-key --populate manjaro
pacman -Syu
pacman -S gnupg archlinux-keyring
# if you use manjaro: pacman -S manjaro-keyring

Tip, to renew keys (!!!Not to use here, that's just a tip!!!!):

pacman-key --refresh-keys
pacman-key --populate archlinux
# if you use manjaro: pacman-key --populate manjaro
pacman -Syu
pacman -s gnupg archlinux-keyring
# if you use manjaro: pacman -S manjaro-keyring

Warning, Manjaro is especially buggy/wrongly documented about keyrenew. It can become hell, if you didn't updated it for long time. if after the previous step, package are still not validated, just press n to each removal query (to keep downloaded packages), and unarchive content of the package and install it manually in /var/cache/pacman/pkg. (the last manjaro-keyring package can be found here: https://mirror.easyname.at/manjaro/pool/overlay/):

cd /var/cache/pacman/pkg
mkdir un; cd un
tar xf ../manjaro-keyring-*-any.pkg.tar.zst
cp -a usr/share/pacman/keyrings/* /usr/share/pacman/keyrings/
/usr/bin/pacman-key --populate manjaro
cd ..
rm -R un

It should work fine now, probably still some problem of change in package names/contents/dependencies.

end of tip

base for booting and indispensable tools, linux-firmware will probably be needed by WiFi module

pacman -S linux linux-firmware scx-scheds vi sudo pacman-contrib namcap mlocate rsync wget nvme-cli grub os-prober gparted dosfstools mtools \
    rng-tools lzop squashfs-tools sbsigntools libfido2 usbutils \
    byobu less man brotli unzip bzip3 dpkg rpmextract lhasa gnu-netcat websocat elinks w3m

pacman-contrib is an useful package, containing several tools:

It has mlocate and vim as optional dependencies, both used by pacdiff

Set the password

The root password will be asked two times. Think about change your user password if you make one.

passwd

Time

Set your locale according to your City or Region:

ln -sf /usr/share/zoneinfo/Europe/Paris /etc/localtime

System security

pacman -S --needed rkhunter unhide

Base network

pacman -S --needed networkmanager networkmanager-openvpn nftables unbound

Finish first steps before reboot

Uncomment your used or prefered languages here, some recommande en_US, I never use it, it's still works fine, and then generate the locales:

sed -i s/#fr_FR.UTF-8/fr_FR.UTF-8/g /etc/locale.gen # French from France
sed -i s/#zh_CN.UTF-8/zh_CN.UTF-8/g /etc/locale.gen # Simplified chinese from Mainland China
sed -i s/#zh_SG.UTF-8/zh_SG.UTF-8/g /etc/locale.gen # Simplified chinese from Singapur and Malaysia
sed -i s/#zh_TW.UTF-8/zh_TW.UTF-8/g /etc/locale.gen # Traditonnal chinese from Insular China (Taiwan and Fujian islands), sometime used in mainland too.
sed -i s/#ja_JP.UTF-8/ja_JA.UTF-8/g /etc/locale.gen # Japanese from Honshū
locale-gen # regenerate locales

to be able to boot from your current grub if you use it.

if you have multiple bootable OS think to disable the disabling os OS_PROBER:

sed -i s/#GRUB_DISABLE_OS_PROBER=false/GRUB_DISABLE_OS_PROBER=false/ /etc/default/grub

!!!WARNING!! this is for BIOS/MBR mode parition disk and installing on first disk, replace /dev/sda by the real disk

parted /dev/sdb
> set 2 bios_grub on

Install grub

grub-install --target=i386-pc /dev/sda
grub-mkconfig -o /boot/grub/grub.cfg

!!!warning, thing to change device, here is for UEFI/GPT mode You need to mount the boot partition (type ef02) first:

parted /dev/sdx set X bios_grub on
mkdir -p /boot/
mount /dev/sdxX -o umask=0077 /boot/
#grub-install --target=x86_64-efi  --bootloader-id=grub_uefi --recheck
#grub-mkconfig -o /boot/grub/grub.cfg # for os_probe and install current prefs
mkinitcpio -P
bootctl --esp-path=/boot --boot-path=/boot install
cat >/boot/loader/loader.conf <<EOF
default arch.conf
timeout 3
editor no
EOF
dev=`df | grep /$ | awk '{print $1}'`
ID=`blkid $dev | cut -d '"' -f 10`
cat >/boot/loader/entries/arch.conf <<EOF
title Arch Linux
linux /vmlinuz-linux
initrd /initramfs-linux.img
options root=PARTUUID=${ID} rw
EOF

Last steps before reboot

# What does systemctl enable NetworkManager (the dispatcher has a different name)
ln -s /usr/lib/systemd/system/NetworkManager.service /etc/systemd/system/multi-user.target.wants/
ln -s /usr/lib/systemd/system/NetworkManager-dispatcher.service /etc/systemd/system/dbus-org.freedesktop.nm-dispatcher.service
ln -s /usr/lib/systemd/system/NetworkManager-wait-online.service /etc/systemd/system/network-online.target.wants/

# What does systemctl enable unbound (for uncensored domain name service resolution and cache)
ln -s /usr/lib/systemd/system/unbound.service /etc/systemd/system/multi-user.target.wants/

# !!! Warning !!! You will have to set in Network-manager "network address only" with DHCP, and 
# add 127.0.0.1 as DNS to access to unbound.
# Manually add ``namserver 127.0.0.1`` in /etc/resolv.conf can work for few minutes, before
# Network-manager set it back to default DHCP set one

# generate sshd keys (would be done, if you want or don't want to use it
# avoid DSA (disabled on recent OS due to security reason) and ECDSA (enable as default on Ubuntu)
SSHETC=/etc/ssh
ssh-keygen -t rsa -b 4096 -f ${SSHETC}/ssh_host_rsa_key -N ""
ssh-keygen -t ed25519 -f ${SSHETC}/ssh_host_ed25519_key -N ""

#####!!!!! if you want to enable sshd !!!! THINK TO VERIFY FIREWALL RULES !!!!####
ln -s /usr/lib/systemd/system/sshd.service /etc/systemd/system/multi-user.target.wants/

First steps after reboot

It will probably ask you which keyboard choose etc.

Start and enable essential services for network

systemctl start NetworkManager;systemctl enable NetworkManager
systemctl start unbound; systemctl enable unbound # resolution without censorship
systemctl start nftables; systemctl enable nftables # minimal protection from external intrusions
systemctl start bluetooth.service; systemctl enable bluetooth.service

Warning, by default nftables accept SSH from everywhere, you can comment the following line in /etc/nftables.conf if you don't need it:

sed -i s/tcp dport ssh accept/# tcp dport ssh accept/ /etc/nftables.conf

If swap is needed

swapfile=/data/swapfile
fallocate -l 16G $swapfile
chmod 600 $swapfile
mkswap $swapfile

echo "${swapfile}   none  swap  sw 0  0" >>/etc/fstab

Network diagnostic tools

pacman -S --needed iputils dnsutils tcpdump net-tools geoip2-database whois wireshark-cli wireshark-qt

Base for developers

Note: strace is a useful debug tool, it allow to trace what do a binary at runing time

pacman -S --needed base-devel man-pages git gdb strace lua luajit cmake meson ninja scons clang cython rust emscripten wabt go gnuplot luarocks lua-sec python-mathplotlib
go telemetry off

AUR

YYaaayyy!!

Need to have a non-root user, we call it "utilisateur" here, feel free to change it:

usr=utilisateur
useadd -m ${usr}             # choose the password, it will be asked for sudoing
mkdir /home/$usr
chown -R $usr:$usr /home/$usr
groupmod -U $usr wheel       # needed to install package via sudo when using yay.

bootstraping AUR with yay

su - $usr
mkdir -p ~/.cache/yay/yay
cd ~/.cache/yay/yay
curl -OR 'https://aur.archlinux.org/cgit/aur.git/plain/PKGBUILD?h=yay'
makepkg -A
sudo pacman -U yay-*.pkg.tar.*

More developers tools

nice and light code editor (and it's plugins)

pacman -S --needed geany-plugins

Some game engines and devs tools

pacman -S --needed love raylib retroarch gamemode sdl3 sdl2 sdl2_gfx sdl2_image sdl2_mixer sdl2_sound sdl2_ttf sdl2_net smpeg tiled

yay -S sokol-git

bluetooth

pacman -S --needed bluez bluez-utils bluez-hid2hci bluez-mesh bluez-tools ell sbc blendr dnsmasq

remote desktop/commands using terminal

pacman -S --needed ueberzugpp minicom xterm menyoki kitty libsixel lsix

Multimedia

base audio and video

pacman -S --needed pipewire pipewire-pulse pipewire-jack pipewire-libcamera \
     pipewire-v4l2 gst-plugin-pipewire cmus xfce4-pulseaudio-plugin pavucontrol \
     gifsicle fzf

!!! pulseaudio-bluetooth conflicte, déjà inclus dans pipewire de base !!!

yay -S yt-x gum chafa icat imgcat

gum chafa icat imgcat are optional dependencies:

Bitmap graphics format and tools

pacman -S --needed pngquant optipng graphicsmagick jpegoptim openjpeg2 jxrlib libavif python-imagesize

 yay -S --needed python-pyguetzli python-mozjpeg-lossless-optimization

Vector graphics format and tools

pacman -S --needed svgo scour svgcleaner nanosvg pdf2svg png2svg python-tinycss2 python-cairosvg python-svglib python-svgwrite

I put several option to compact/clean svg for light file release (Web, ingame etc), SVGo, Scour, SVGcleaner. optiimg also manage SVG but depends on KDE desktop SVGcleaner is the more complete, but you could like others? If you want to use Svgo, that lake of applying transform (SVGCleaner has it), you can use inkscape-applytransforms. It needs python-tinycss2, but it is not wrote as dependency on this old and unmaintained package.

yay -S inkscape-applytransforms

Graphic tools for linking audio components

pacman -S --needed helvum qpwgraph

Audio

Audio formats and tools

pacman -S --needed bass faad flac libavcodec libmad libmpcdec libvorbis libsndfile libsoxr opus libogg mac \
   libid3tag libsamplerate twolame openal sox

MIDI

pacman -S --needed fluidsynth wildmidi sonviox rtmidi

Music trackers

pacman -S --needed libmikmod libmodplug libsidplayfp # trackers mods

Various MIDI and synthesizers editor/tools

pacman -S vmpk timidity++ muse zynaddsubfx qtractor rtmidi patroneo qmidiarp lmms ardour cardinal python-aubio musescore

Interface

GUI

pacman -S --needed xfce4 redshift lightdm lightdm-gkt-greater xorg-xkill xorg-xwininfo \
  xorg-xauth xf86-input-evdev \
  xfce4-pulseaudio-plugin xfce4-volumed-pulse \
  xfce4-netload-plugin libnm libnma libnma-gtk4 network-manager-applet blueman \
  xfce4-verve-plugin xfce4-power-manager \
  xfce4-notes-plugin xfce4-places-plugin xfce4-screenshooter xfce4-screensaver \
  geeqie fbida gphoto2

alternative to pavucontrol+xfce4-volumed-pulse

Probably not the most interesting, could depand on personal choices

pacman -S --needed xfce4-mixer

pour import/export configured panels:

pacman -S --needed xfce4-panel-profiles

optionel for menu, see XFCE4-whiskermenu-plugin

pacman -S xfce4-whiskermenu-plugin

complex scripts input (mostly Asian)

pacman -S --needed ibus-libpinyin ibus-anthy ibus-hangul ibus-unikey ibus-table
cat >>.xprofile <<EOF
GTK_IM_MODULE=ibus
QT_IM_MODULE=ibus
XMODIFIERS=@im=ibus
ibus-daemon -rxRd
EOF

Resstart user session should be needed

mesa (display, compositing, 3d, video acceleration)

pacman -S --needed libdrm mesa mesa-utils ibva-mesa-driver vulkan-mesa-layers vulkan-swrast mesa-vdpau mesa-utils opencl-rusticl-mesa opencl-clover-mesa spirv-tools vulkan-tools glad

Depending on your architecture and applications:

Some video drivers could be needed depending on your platform/VPU/GPU, to avoir to overload CPU:

Archive and compression

pacman -S --needed file-roller p7zip unrar brotli zdstd xz

Drawing and animation

pacman -S --needed gimp mypaint krita inkscape pencil2d opentoonz tupitube qstopmotion

yay -S glaxnimate

3D modeling, rendering and animation

Blender is the reference tool for building 3D worlds, pictures, animation. It also contains Grease Pencil, a pouwerful 2d animation tool, that allow mixing of both 2d and 3d animation.

pacman -S --needed blender

video formats

pacman -S --needed gst-libav gst-plugins-good gst-plugins-bad gst-plugins-ugly x264 x265 libmatroska libtheora \

video conversion (beside great ffmpeg, could expand it)

pacman -S --needed svt-av1 svt-hevc svt-vp9 v4l-utils

video base tools

pacman -S --needed asciinema ffmpeg gpac mpv yt-dlp rtmpdump atomicparsley vlc lua-socket live-media ttf-dejavu \
  libxvmc libxxf86vm libva libvdpau libvdpau-gl libvdpau-va-gl av1an ffms2 mkvtoolnix-cli vokoscreen \
  python-mutagen python-pycryptodome python-pycryptodomex python-websockets python-brotli python-brotlicffi \
  python-xattr python-pyxattr  python-secretstorage

Non-linear video editors

pacman -S kdenlive shotcut bigsh0t

Note taking

Xournalpp is a graphic and vector note taking application

pacman -S --needed xournalpp

fonts

pacman -S --needed opendesktop-fonts ttf-liberation ttf-liberation-mono-nerd ttf-linux-libertine-g

fonts++

pacman -S --needed noto-fonts noto-fonts-emoji noto-fonts-extra noto-fonts-cjk ttf-arphic-ukai ttf-arphic-uming

Fonts editors and managers

pacman -S --needed birdfont fontforge font-manager

Remote desktop

X11 has XDMCP for remote display

pacman -S --needed libxdmcp xwaylandvideobridge wayvnc tigervnc

Chat

pacman -S --needed dino telegram-desktop hexchat

Cross complation and assembly

RISC-V and ARM in general

pacman -S --needed riscv32-elf-binutils riscv64-linux-gnu-gcc riscv64-linux-gnu-gdb aarch64-linux-gnu-gcc aarch64-linux-gnu-gdb

Assembler specialized for barebone use on RISC-V GD32V

yay -S python-bronzebeard

fast emulators for RISC-V system

yay -S rvvm libriscv

Flash RISC-V WCH (CH32, etc) boards

yay -S wlink

Emulation of x86_64 on ARM, Loongson or RISC-V

pacman -S --needed box64

Cross tool for retrocomputing

Z80

Z80 include MSX, Amstrad, Sinclair,...

yay -S asmsx z80asm cpctools

65xx (6502, 6510 etc)

For 65xx (dxa65 = debbuger, xa package is available via pacman for assembler/linker), including C64/VIC20,Oric,Apple][,Atar2600/400/800... cc65 is also a C compiler and a linker with intersting libs and tools

pacman -S xa
yay -S dxa65 dasm cc65

Archtecture agnostic

Multi 8 bits arch (65xx, 68xx (as Vectrex), z80) and 16/32 bits (for vasm) including ARM, PPC, 68K, jagrisc, x86, naked_asm: most ISA even RISC-V, Xtensa and WebAssembly, wla_dx: GB-Z80/Z80/Z80N/6502/65C02/65CE02/65816/68000/6800/6801/6809/8008/8080/HUC6280/SPC-700/SuperFX

Pacman -S asxxxx vasm crasm-git naken-asm wla-dx-git

emulators to run and test your code

pacman -S --needed mame fs-uae-launcher hatari vice stella libretro retroarch
yay -S caparice32-git openmsx fuse-emulator oricutron vecx-git xcpc zesarux z26

There are a bunch of retroarch/libretro emulators, I let you search in packages with 'libretro' search query

FPGA/serial

pacman -S --needed openfpgaloader tinyprog yosys iverilog verilator graphviz xdot yices cvc4 z3 vtr \
  python-pythondata-cpu-picorv32 python-pythondata-cpu-vexriscv python-litex gtkwave
yay -S surfer-waveform-git

AUR part

This order need to be respected due to current (november 2024) problems with packages settings:

yay -S prjapicula prjtrellis-db-git

yay -S nextpnr-git silice-git

Android mangement

pacman -S --needed android-file-transfer android-tools android-udev scrcpy smali

Android on desktop

pacman -S -needed waydroid

Waydroid is an Android system in a windows (of full screen if needed), it uses the same ISA than your desktop, so if you use another ISA than ARM, a bunch application couldn't work on your system, depending on how it is packaged. It uses containers (LXC) to work.

Emulation and Virtual Machines

Qemu is both a virtual machine that work in with Linux kernel KVM (Kernel Virtual Machine), using hardware privileges separation features, and an emulator, emulating most processors architectures (ISA). Both can be mexed togeher to emulate a whole system or with qemu-user-static, execute foreign architecture commands only. In this last case, the syscall will be mapped to the actual running architecture syscall. It's not efficient as, for example, RVVM for emulating RISC-V or box86 for emulating x86 (32-bits) and box64 for emulating x86_64/AMD64 (64-bits) architectures as examples, but it is very complete general solution.

All cases

pacman -S --needed qemu-full qemu-user-static qemu-user-static-binfmt tinyemu

Tools for managine VM

virt-manager is a GTK desktop interface for managing KVM+Qemu vitual machines.

pacman -S --needed virt-manager virt-install virt-viewer virt-what

pacman -S --needed lxc lxcfs incus lua-filesystem lua-alt-getopt xdelta3

Note: you can share filesystems between host and guest in unprivileged mode (better for security). If you want to have write access, by default you need to map user/group UID to 100000 + the guest UID (100000 for root and UID 33 become 100033 as examples). Can be interesting to limit write access to some portions of disk to still have dynamic data content that can't be executed and unmodifiable executables => W^X (write xor execute)).

Scanner

Simple-scan is relatively simple, and will install scanner dependencies, depending on scanner vendor it could be interesting to add specialized tools (hplip for hp, for epson, etc) sane-airscan and sane-gt68xx-firmware can be necessary with some config Only simple-scan and some Qt/KDE equivalent are available in default arch, I tend to prefer xsane than is plain X but more powerful. Il is available only with AUR (see below)

pacman -S --needed simple-scan

cartography

pacman -S  kosmindoormap osmin marble-maps gnome-maps offroad

The Editor:

pacman -S josm

Others:

AUR (TODO: dispatche them in previous sections)

network

yay -S curl-http3-ngtcp2 curl-quiche-git

Scanner

xsane is a bit old-fashioned looking, but have far more option than Gnome/KDE alternatives and has a Gimp plugin:

yay -S xsane

There is also a Gimp plugin

yay -S xsane-gimp

Graphics and animation

Pixelart animation software

yay -S libresprite

### whiteboard

Drawpile is a collaborative whiteboard and animation software that support tablet pressure/tilt and network

You can install meta-package that will install localy both client and server, or just install client or server, depending on your will:

yay -S drawpile libmicrohttpd

You can also install both on desktop and don't start server.

To start server:

drawpile-srv

fantasycomputer and fantasyconsoles

yay -S tic80-pro-git meg4-git microw8-src

Game background tiles editor

pacman -S tiled

Codecs

yay -S optivorbis

Video DownloadHelper browser plugin companion

Warning, this package is not very good, it reinstall its own version of nodejs, instead of using the one on the system.

yay -S vdhcoapp

Alternatively, the application itself say to use this:

curl -sSLf https://github.com/aclap-dev/vdhcoapp/releases/latest/download/install.sh | bash

## Music creation

yay -S zrythm
Tags: FLOSS, Linux, administration