Lists every apt package, cargo tool, and install-script binary with its
upstream, grouped by how it arrives — the three build deps are separated
out since they exist only to compile the cargo tools and nothing uses them
at runtime, and rustup is placed with the tools that force it rather than
listed as a peer.
Records the reasons that are invisible from the package list: bat's binary
is batcat on Ubuntu so the cat alias depends on it, jq backs the Claude
statusline, and rustup uses --no-modify-path because conf.d/rustup.fish
already sources cargo's env.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Document how to bring chezmoi up on another VPS without the provisioning
layer, and record the chezmoi behaviours that caused real breakage here.
The umask trap is the load-bearing one: chezmoi derives modes from the
umask at apply time rather than preserving them, so the atuin key dir and
config need both the private_ attribute and umask = 0o022 to land at 0700
and 0600. The apply-into-head SIGPIPE is the other: it truncates the apply
and reports head's exit status, so a partial apply looks successful.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Two layers with a deliberate privilege split: setup.sh does the root work
(apt, rustup, cargo tools, starship, chsh) and hands off to chezmoi, which
owns everything under $HOME.
Tools are built with `cargo install --locked` to match the versions currently
running rather than whatever apt ships, at the cost of a 10-20 min cold setup.
Excluded on purpose: the atuin sync key and ~/.git-credentials (secrets),
~/.claude/settings.json (per-box decision), fnm/opencode conf.d (out of scope),
and fish_variables (machine-local).
chezmoi tracks only the executable and private attributes and derives modes
from the umask, so setup.sh pins umask 022 and atuin uses private_ to keep
0700/0600. Without both, a 002 umask silently relaxes them to 0775/0664.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
