Pin Terra through repos.override.d so terra-release updates stop undoing it

setup/provenance/README.md

@@ -159,8 +159,12 @@ installed. Its effective `terra` configuration reported `gpgcheck = 1`,
 `pkg_gpgcheck = 1`, and `repo_gpgcheck = 1`; no GPG-bypass option was used.
 The package's own `/etc/yum.repos.d/terra.repo` uses its Terra metalink and
 `RPM-GPG-KEY-terra44`. That differs from Panama's deliberately staged local
-key/base-URL file in `install-packages`, which replaces the release-generated
-file only after this verified bootstrap step.
+key and base URL. `install-packages` applies those after this verified
+bootstrap step as `/etc/dnf/repos.override.d/80-panama-terra.repo`, which dnf
+lays over the package's file. The pin does not edit `terra.repo` itself,
+because terra-release replaces that file on every update. Release 44-11 did
+so on 2026-10-28, shipping `repo_gpgcheck=0`, and every Panama machine
+stopped installing packages until the pin moved to the override directory.
 
 Although the command runner returned after 30 seconds while DNF was still
 loading metadata, Podman's retained event log records the exact command's

setup/scripts/install-packages

@@ -729,7 +729,8 @@ _publish_repository_pair() {
 
 # Reads the gpgkey of the single enabled Terra identity out of dnf's effective
 # configuration, applying the structural safety rules either way: one enabled
-# identity, named terra, with every signature check turned on.
+# identity, named terra, with package signature checks turned on (and, in the
+# pinned form, repository metadata checks too).
 #
 # With require_pinned set it additionally demands Panama's own reviewed baseurl
 # and key path. Without it, the answer is just "what trust root is this machine
@@ -772,7 +773,11 @@ _effective_terra_key() {
 				bad = 1
 			}
 			if (values["gpgcheck"] != "1" || values["pkg_gpgcheck"] != "1" \
-				|| values["repo_gpgcheck"] != "1" || values["gpgkey"] == "") bad = 1
+				|| values["gpgkey"] == "") bad = 1
+			# Metadata signing is part of the pin, not of what adoption accepts:
+			# terra-release ships repo_gpgcheck=0, and the override adoption
+			# writes turns it back on.
+			if (require_pinned != "" && values["repo_gpgcheck"] != "1") bad = 1
 			trusted_key = values["gpgkey"]
 		}
 		BEGIN {
@@ -864,10 +869,12 @@ _terra_effective_status() {
 #
 # The trust root is the signing key, not the URL it is served from. A machine
 # that installed Terra the way Terra documents has terra-release's own repo
-# file: a metalink instead of the reviewed baseurl, and the key at
-# RPM-GPG-KEY-terra44 rather than Panama's renamed copy. Every signature check
-# is already on, and that key is the same fingerprint this repository reviewed
-# and pinned. Cosmetics, in other words -- not a compromised trust root.
+# file: a metalink instead of the reviewed baseurl, the key at
+# RPM-GPG-KEY-terra44 rather than Panama's renamed copy, and (since
+# terra-release 44-11) repo_gpgcheck=0. Package signature checks are on, and
+# that key is the same fingerprint this repository reviewed and pinned. The pin
+# adoption writes restores metadata checking, so none of that is a compromised
+# trust root.
 #
 # Refusing it outright built a gate with no door. install_terra_repository
 # declined to touch a machine terra-release had already reached, so an ordinary
@@ -1002,33 +1009,51 @@ install_rpmfusion_repositories() {
 # trust root rolls back. The effective state is re-read afterwards, because the
 # only acceptable proof that adoption worked is the check that judged it.
 #
-# terra-release owns /etc/yum.repos.d/terra.repo, so a later update to that
-# package restores the stock file. That is fine and deliberate: the next run
-# adopts it again, which is why adoption has to be repeatable rather than a
-# one-time migration.
+# Panama's Terra pin, as a dnf repos.override.d drop-in on top of whatever
+# /etc/yum.repos.d/terra.repo says. terra-release owns that file and replaces
+# it on every update (an edited copy is set aside as terra.repo.rpmsave), so a
+# pin written there lasted only until the next terra-release release. Nothing
+# owns the override directory, and its values win over the repo file's.
+TERRA_OVERRIDE=/etc/dnf/repos.override.d/80-panama-terra.repo
+
+_write_terra_pin() {
+	printf '%s\n' \
+		'[terra]' \
+		'name=Panama reviewed Terra 44' \
+		"baseurl=${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
+		'metalink=' \
+		'mirrorlist=' \
+		'enabled=1' \
+		'gpgcheck=1' \
+		'repo_gpgcheck=1' \
+		'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' > "$1"
+	chmod 0600 "$1"
+}
+
+_ensure_override_dir() {
+	[[ -d "$PANAMA_SYSTEM_ETC/dnf/repos.override.d" ]] && return 0
+	sudo mkdir -p -- /etc/dnf/repos.override.d
+}
+
+# A stock terra-release file (or one an older Panama rewrote) gets the pin laid
+# over it. Adoption stays repeatable: if the override is ever removed, the next
+# run puts it back.
 adopt_terra_repository() {
 	local work staged_key staged_repo status=0 effective_status=0
 	work="$(mktemp -d)" || return 1
 	chmod 0700 "$work"
 	staged_key="$work/terra44.asc"
-	staged_repo="$work/terra.repo"
+	staged_repo="$work/80-panama-terra.repo"
 	if ! _stage_reviewed_key "$PANAMA_PATH/setup/provenance/keys/terra44.asc" "$staged_key" \
 		TERRA_FINGERPRINT AE09157A4DE88B497EA1D5D300CDAB43DE226D6F; then
 		rm -rf -- "$work"
 		return 1
 	fi
-	printf '%s\n' \
-		'[terra]' \
-		'name=Panama reviewed Terra 44' \
-		"baseurl=${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
-		'enabled=1' \
-		'gpgcheck=1' \
-		'repo_gpgcheck=1' \
-		'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' > "$staged_repo"
-	chmod 0600 "$staged_repo"
-	_publish_repository_pair \
+	_write_terra_pin "$staged_repo"
+	_ensure_override_dir || status=$?
+	(( status == 0 )) && { _publish_repository_pair \
 		"$staged_key" /etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama \
-		"$staged_repo" /etc/yum.repos.d/terra.repo || status=$?
+		"$staged_repo" "$TERRA_OVERRIDE" || status=$?; }
 	if (( status == 0 )); then
 		_terra_effective_status || effective_status=$?
 		(( effective_status == 0 )) || status="$TERRA_TRUST_FAILURE_STATUS"
@@ -1064,7 +1089,7 @@ install_terra_repository() {
 	work="$(mktemp -d)" || return 1
 	chmod 0700 "$work"
 	staged_key="$work/terra44.asc"
-	staged_repo="$work/terra.repo"
+	staged_repo="$work/80-panama-terra.repo"
 	if ! _stage_reviewed_key "$PANAMA_PATH/setup/provenance/keys/terra44.asc" "$staged_key" \
 		TERRA_FINGERPRINT AE09157A4DE88B497EA1D5D300CDAB43DE226D6F; then
 		rm -rf -- "$work"
@@ -1074,15 +1099,7 @@ install_terra_repository() {
 		rm -rf -- "$work"
 		return 1
 	}
-	printf '%s\n' \
-		'[terra]' \
-		'name=Panama reviewed Terra 44' \
-		"baseurl=${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
-		'enabled=1' \
-		'gpgcheck=1' \
-		'repo_gpgcheck=1' \
-		'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' > "$staged_repo"
-	chmod 0600 "$staged_repo"
+	_write_terra_pin "$staged_repo"
 	status=0
 	sudo dnf install -y \
 		--repofrompath "terra,${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
@@ -1091,7 +1108,10 @@ install_terra_repository() {
 		--setopt=terra.gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama \
 		terra-release || status=$?
 	if (( status == 0 )); then
-		sudo install -m 0644 "$staged_repo" /etc/yum.repos.d/terra.repo || status=$?
+		_ensure_override_dir || status=$?
+	fi
+	if (( status == 0 )); then
+		sudo install -m 0644 "$staged_repo" "$TERRA_OVERRIDE" || status=$?
 	fi
 	if (( status == 0 )); then
 		effective_status=0