Pin Terra through repos.override.d so terra-release updates stop undoing it

setup/scripts/install-packages

@@ -729,7 +729,8 @@ _publish_repository_pair() {
 
 # Reads the gpgkey of the single enabled Terra identity out of dnf's effective
 # configuration, applying the structural safety rules either way: one enabled
-# identity, named terra, with every signature check turned on.
+# identity, named terra, with package signature checks turned on (and, in the
+# pinned form, repository metadata checks too).
 #
 # With require_pinned set it additionally demands Panama's own reviewed baseurl
 # and key path. Without it, the answer is just "what trust root is this machine
@@ -772,7 +773,11 @@ _effective_terra_key() {
 				bad = 1
 			}
 			if (values["gpgcheck"] != "1" || values["pkg_gpgcheck"] != "1" \
-				|| values["repo_gpgcheck"] != "1" || values["gpgkey"] == "") bad = 1
+				|| values["gpgkey"] == "") bad = 1
+			# Metadata signing is part of the pin, not of what adoption accepts:
+			# terra-release ships repo_gpgcheck=0, and the override adoption
+			# writes turns it back on.
+			if (require_pinned != "" && values["repo_gpgcheck"] != "1") bad = 1
 			trusted_key = values["gpgkey"]
 		}
 		BEGIN {
@@ -864,10 +869,12 @@ _terra_effective_status() {
 #
 # The trust root is the signing key, not the URL it is served from. A machine
 # that installed Terra the way Terra documents has terra-release's own repo
-# file: a metalink instead of the reviewed baseurl, and the key at
-# RPM-GPG-KEY-terra44 rather than Panama's renamed copy. Every signature check
-# is already on, and that key is the same fingerprint this repository reviewed
-# and pinned. Cosmetics, in other words -- not a compromised trust root.
+# file: a metalink instead of the reviewed baseurl, the key at
+# RPM-GPG-KEY-terra44 rather than Panama's renamed copy, and (since
+# terra-release 44-11) repo_gpgcheck=0. Package signature checks are on, and
+# that key is the same fingerprint this repository reviewed and pinned. The pin
+# adoption writes restores metadata checking, so none of that is a compromised
+# trust root.
 #
 # Refusing it outright built a gate with no door. install_terra_repository
 # declined to touch a machine terra-release had already reached, so an ordinary
@@ -1002,33 +1009,51 @@ install_rpmfusion_repositories() {
 # trust root rolls back. The effective state is re-read afterwards, because the
 # only acceptable proof that adoption worked is the check that judged it.
 #
-# terra-release owns /etc/yum.repos.d/terra.repo, so a later update to that
-# package restores the stock file. That is fine and deliberate: the next run
-# adopts it again, which is why adoption has to be repeatable rather than a
-# one-time migration.
+# Panama's Terra pin, as a dnf repos.override.d drop-in on top of whatever
+# /etc/yum.repos.d/terra.repo says. terra-release owns that file and replaces
+# it on every update (an edited copy is set aside as terra.repo.rpmsave), so a
+# pin written there lasted only until the next terra-release release. Nothing
+# owns the override directory, and its values win over the repo file's.
+TERRA_OVERRIDE=/etc/dnf/repos.override.d/80-panama-terra.repo
+
+_write_terra_pin() {
+	printf '%s\n' \
+		'[terra]' \
+		'name=Panama reviewed Terra 44' \
+		"baseurl=${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
+		'metalink=' \
+		'mirrorlist=' \
+		'enabled=1' \
+		'gpgcheck=1' \
+		'repo_gpgcheck=1' \
+		'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' > "$1"
+	chmod 0600 "$1"
+}
+
+_ensure_override_dir() {
+	[[ -d "$PANAMA_SYSTEM_ETC/dnf/repos.override.d" ]] && return 0
+	sudo mkdir -p -- /etc/dnf/repos.override.d
+}
+
+# A stock terra-release file (or one an older Panama rewrote) gets the pin laid
+# over it. Adoption stays repeatable: if the override is ever removed, the next
+# run puts it back.
 adopt_terra_repository() {
 	local work staged_key staged_repo status=0 effective_status=0
 	work="$(mktemp -d)" || return 1
 	chmod 0700 "$work"
 	staged_key="$work/terra44.asc"
-	staged_repo="$work/terra.repo"
+	staged_repo="$work/80-panama-terra.repo"
 	if ! _stage_reviewed_key "$PANAMA_PATH/setup/provenance/keys/terra44.asc" "$staged_key" \
 		TERRA_FINGERPRINT AE09157A4DE88B497EA1D5D300CDAB43DE226D6F; then
 		rm -rf -- "$work"
 		return 1
 	fi
-	printf '%s\n' \
-		'[terra]' \
-		'name=Panama reviewed Terra 44' \
-		"baseurl=${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
-		'enabled=1' \
-		'gpgcheck=1' \
-		'repo_gpgcheck=1' \
-		'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' > "$staged_repo"
-	chmod 0600 "$staged_repo"
-	_publish_repository_pair \
+	_write_terra_pin "$staged_repo"
+	_ensure_override_dir || status=$?
+	(( status == 0 )) && { _publish_repository_pair \
 		"$staged_key" /etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama \
-		"$staged_repo" /etc/yum.repos.d/terra.repo || status=$?
+		"$staged_repo" "$TERRA_OVERRIDE" || status=$?; }
 	if (( status == 0 )); then
 		_terra_effective_status || effective_status=$?
 		(( effective_status == 0 )) || status="$TERRA_TRUST_FAILURE_STATUS"
@@ -1064,7 +1089,7 @@ install_terra_repository() {
 	work="$(mktemp -d)" || return 1
 	chmod 0700 "$work"
 	staged_key="$work/terra44.asc"
-	staged_repo="$work/terra.repo"
+	staged_repo="$work/80-panama-terra.repo"
 	if ! _stage_reviewed_key "$PANAMA_PATH/setup/provenance/keys/terra44.asc" "$staged_key" \
 		TERRA_FINGERPRINT AE09157A4DE88B497EA1D5D300CDAB43DE226D6F; then
 		rm -rf -- "$work"
@@ -1074,15 +1099,7 @@ install_terra_repository() {
 		rm -rf -- "$work"
 		return 1
 	}
-	printf '%s\n' \
-		'[terra]' \
-		'name=Panama reviewed Terra 44' \
-		"baseurl=${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
-		'enabled=1' \
-		'gpgcheck=1' \
-		'repo_gpgcheck=1' \
-		'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' > "$staged_repo"
-	chmod 0600 "$staged_repo"
+	_write_terra_pin "$staged_repo"
 	status=0
 	sudo dnf install -y \
 		--repofrompath "terra,${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
@@ -1091,7 +1108,10 @@ install_terra_repository() {
 		--setopt=terra.gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama \
 		terra-release || status=$?
 	if (( status == 0 )); then
-		sudo install -m 0644 "$staged_repo" /etc/yum.repos.d/terra.repo || status=$?
+		_ensure_override_dir || status=$?
+	fi
+	if (( status == 0 )); then
+		sudo install -m 0644 "$staged_repo" "$TERRA_OVERRIDE" || status=$?
 	fi
 	if (( status == 0 )); then
 		effective_status=0