From 919afd26fdc5b4528f218ae39f44b8cf84827b71 Mon Sep 17 00:00:00 2001
From: rain <rain@melonbread.xyz>
Date: Sun, 21 Jun 2026 20:17:39 -0400
Subject: [PATCH] Guard run_once_10 with os_family conditional + sudo
 everywhere
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Script claimed to be arch-only in its comment but had no actual guard.
The body always ran, so on debian it tried pacman-key (which doesn't
exist), failed with 'command not found', and aborted the whole bootstrap
chain (run_once_20 and run_onchange_30 never executed).

Fixes:
1. Wrap entire body in {{ if eq .os_family "arch" }} ... {{ end }} so
   the script is a no-op on debian (logs a skip message instead of dying)
2. Prepend sudo to pacman-key, pacman -U, pacman -Syu, pacman -S, and
   grep /etc/pacman.conf — same user-vs-root pattern that bit run_once_00
---
 run_once_10-add-chaotic-aur.sh.tmpl | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/run_once_10-add-chaotic-aur.sh.tmpl b/run_once_10-add-chaotic-aur.sh.tmpl
index ab8417e..3d84896 100755
--- a/run_once_10-add-chaotic-aur.sh.tmpl
+++ b/run_once_10-add-chaotic-aur.sh.tmpl
@@ -8,6 +8,9 @@
 #    1. Get and sign the key
 #    2. Install chaotic-keyring + chaotic-mirrorlist
 #    3. Append repo to /etc/pacman.conf
+#
+#  Body is wrapped in an os_family conditional: this script is a no-op on
+#  debian (or anything non-arch).
 # =============================================================================
 set -euo pipefail
 
@@ -17,25 +20,26 @@ die() { printf '\033[1;31m[chaotic ERROR]\033[0m %s\n' "$*" >&2; exit 1; }
 # This script runs as the invoking user; sudo handles elevation for pacman
 # and pacman-key operations below.
 
+{{ if eq .os_family "arch" -}}
 if command -v paru >/dev/null 2>&1; then
     log "paru already installed — skipping chaotic setup"
     exit 0
 fi
 
-# Chaotic's official bootstrap. Run as root because pacman-key needs it.
+# Chaotic's official bootstrap.
 log "fetching chaotic key (3056513887B78AEB)"
-pacman-key --recv-key 3056513887B78AEB
-pacman-key --lsign-key 3056513887B78AEB
+sudo pacman-key --recv-key 3056513887B78AEB
+sudo pacman-key --lsign-key 3056513887B78AEB
 
 log "installing chaotic-keyring and chaotic-mirrorlist"
-pacman -U --noconfirm \
+sudo pacman -U --noconfirm \
     'https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-keyring.pkg.tar.zst' \
     'https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-mirrorlist.pkg.tar.zst'
 
 # Append chaotic repo to pacman.conf if not already present
-if ! grep -q "^\[chaotic-aur\]" /etc/pacman.conf; then
+if ! sudo grep -q "^\[chaotic-aur\]" /etc/pacman.conf; then
     log "appending chaotic-aur to /etc/pacman.conf"
-    cat >> /etc/pacman.conf <<'PACMAN_EOF'
+    sudo tee -a /etc/pacman.conf >/dev/null <<'PACMAN_EOF'
 
 [chaotic-aur]
 Include = /etc/pacman.d/chaotic-mirrorlist
@@ -45,10 +49,14 @@ else
 fi
 
 log "full system sync with chaotic enabled"
-pacman -Syu --noconfirm
+sudo pacman -Syu --noconfirm
 
 log "installing paru from chaotic-aur"
-pacman -S --needed --noconfirm paru
+sudo pacman -S --needed --noconfirm paru
 
 log "chaotic-aur + paru ready"
-paru --version
\ No newline at end of file
+paru --version
+{{ else -}}
+# Not an arch-base box — nothing to do.
+log "skipping chaotic-aur setup (os_family={{ .os_family }}, not arch)"
+{{ end -}}
\ No newline at end of file