Based upon examining both a minimal test image generated that uses pacstrap and looking at the pacstrap help, at least the following information seems to be moved onto the new system:
- package repository lists and their identity authentication.
- you pacman keyring (which is a web of trust style authentication.
Both of these can at least leak some identification information and the keyring could include your identity depending on your previous activity.
If you have a private/organisational package repository that is either a local mirror to speed up operations / reduce internet traffic or contains 'approved' packages then you mirror list provides internal networking details.
Your pacman keyring could either contain a link to your GnuPG public key or someone else's from your organisation for packages that are unique to you / your company. Allowing access to and analysis of your key ring can allow an attacker to find uncommon keys as a likely originator identification of the image.
Most of this probably only matters for organisations that have a policy of attack mitigation (reduce the amount of unnecessary information irrespective of apparent risk as a simple risk reduction measure since it is hard to predict with accuracy what might become important).
The pacman help provides you with a way to not move these over:
$ pacstrap -h
usage: pacstrap [options] root [packages...]
-C config Use an alternate config file for pacman
-c Use the package cache on the host, rather than the target
-G Avoid copying the host's pacman keyring to the target
-i Avoid auto-confirmation of package selections
-M Avoid copying the host's mirrorlist to the target
-h Print this help message
pacstrap installs packages to the specified new root directory. If no packages
are given, pacstrap defaults to the "base" group.
So the -G and -M options will prevent copying over this information, however you will have to re-populate these on the new installation. A new keyring can be generate using:
pacman-key --init && pacman-key --populate archlinux
An 'appropriate' mirror list (whatever that means for a given situation) can be prepared and placed at /etc/pacman.d/mirrorlist