feat(package-firewall): generate complete pacman.conf for aur setup

In addition to the staged mirrorlist fragment, write a self-contained
pacman.conf whose [core]/[extra]/[multilib] repos point at the /arch prefix.
It drives a no-root dry-run (pacman --config <this> --dbpath <tmp> -Syp <pkg>)
and serves as the reference for the /etc/pacman.conf merge.

Author: 0x73746F66

pkg/packagefirewall/config.go

@@ -112,6 +112,14 @@ func ConfigFiles(eco Ecosystem, opts ConfigOptions) ([]ConfigFile, error) {
 				Content:    archMirrorlist(opts),
 				Structured: true,
 			},
+			{
+				// A complete, ready-to-use pacman config pointing the official repos
+				// at the /arch prefix. Usable directly (pacman --config <this> -Syp ...)
+				// and as the reference for the /etc/pacman.conf merge.
+				Path:       filepath.Join(home, ".config", "vulnetix", "package-firewall", "pacman.conf"),
+				Content:    pacmanConfig(opts),
+				Structured: true,
+			},
 		}, nil
 	default:
 		return nil, fmt.Errorf("automatic %s configuration is not implemented yet", eco.DisplayName)
@@ -508,6 +516,31 @@ func archMirrorlist(opts ConfigOptions) string {
 	}, "\n")
 }
 
+// pacmanConfig is a complete pacman configuration whose official repositories
+// ([core], [extra], [multilib]) are served through the /arch firewall prefix.
+// It is self-contained so it can drive a scoped, no-root test
+// (`pacman --config <this> --dbpath <tmp> --cachedir <tmp> -Syp <pkg>`) and also
+// serves as the reference for merging the Server lines into /etc/pacman.conf.
+func pacmanConfig(opts ConfigOptions) string {
+	server := withBasicAuth(archBaseURL(opts), opts.OrgID, opts.APIKey) + "/$repo/os/$arch"
+	repo := func(name string) string {
+		return strings.Join([]string{"[" + name + "]", "Server = " + server, ""}, "\n")
+	}
+	return strings.Join([]string{
+		"# Vulnetix Package Firewall — pacman config for the Arch official repos.",
+		"# Scoped test (no root):",
+		"#   pacman --config " + "<this file>" + " --dbpath /tmp/vx-db --cachedir /tmp/vx-cache -Syp <pkg>",
+		"# Or merge the [core]/[extra]/[multilib] Server lines into /etc/pacman.conf.",
+		"[options]",
+		"Architecture = auto",
+		"SigLevel = Required DatabaseOptional",
+		"",
+		repo("core"),
+		repo("extra"),
+		repo("multilib"),
+	}, "\n")
+}
+
 func yamlString(s string) string {
 	return strconv.Quote(s)
 }

pkg/packagefirewall/config_test.go

@@ -291,8 +291,8 @@ func TestAURConfig(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(files) != 3 {
-		t.Fatalf("aur files = %d, want 3 (paru.conf + yay config.json + mirrorlist)", len(files))
+	if len(files) != 4 {
+		t.Fatalf("aur files = %d, want 4 (paru.conf + yay config.json + mirrorlist + pacman.conf)", len(files))
 	}
 
 	// paru.conf
@@ -367,4 +367,17 @@ func TestAURConfig(t *testing.T) {
 	if !strings.Contains(files[2].Content, want) {
 		t.Errorf("mirrorlist missing %q:\n%s", want, files[2].Content)
 	}
+
+	// complete pacman.conf (official repos via /arch)
+	if files[3].Path != "/home/test/.config/vulnetix/package-firewall/pacman.conf" {
+		t.Fatalf("pacman.conf path = %q", files[3].Path)
+	}
+	for _, want := range []string{
+		"[core]", "[extra]", "[multilib]",
+		"Server = https://org-123:secret@packages.vulnetix.com/arch/$repo/os/$arch",
+	} {
+		if !strings.Contains(files[3].Content, want) {
+			t.Errorf("pacman.conf missing %q:\n%s", want, files[3].Content)
+		}
+	}
 }

pkg/packagefirewall/detect.go

@@ -50,6 +50,7 @@ func ConfigPaths(eco Ecosystem, home string) []string {
 			filepath.Join(home, ".config", "paru", "paru.conf"),
 			filepath.Join(home, ".config", "yay", "config.json"),
 			filepath.Join(home, ".config", "vulnetix", "package-firewall", "arch-mirrorlist"),
+			filepath.Join(home, ".config", "vulnetix", "package-firewall", "pacman.conf"),
 		}
 	default:
 		return nil