Hashiru v1.2.0

The installer now tells you what it's doing, how long it took, what went wrong, and — after the fact — whether your machine still matches what it installed.

New

Install progress & timing

install.sh shows [4/9] Running: 30-desktop.sh per stage, times each one, and ends with a per-stage timing table and total (Hashiru installation complete in 9m 42s). Failures print the exact resume command and the log path.

Warnings digest + first-login notice

Warnings from any stage (a flaky AUR build, a stow conflict) are collected and replayed in one block at the end of the run — and shown once more on your first interactive login, then archived. After an unattended ISO install, this is how you find out something didn't build, instead of it scrolling off the firstboot console eight minutes before the reboot.

doctor.sh — health check

./doctor.sh

Read-only audit of an installed machine: every package manifest, system services and timers, Hyprland/PipeWire, zsh stack, zram/snapper, dotfiles and stow state. Warnings vs. failures are distinguished (missing AUR packages warn; missing repo packages fail) and it exits non-zero on failures. It found two real bugs in its first hour of existence (see Fixed).

Stage selection

./install.sh --list      # show stages
./install.sh 30          # one stage (as before)
./install.sh 30+         # stage 30 and everything after — resume a failed run
./install.sh --from 30   # same as 30+
./install.sh 30 35       # just these stages

Install provenance

Every full run stamps /etc/hashiru-release with the commit and date the machine was bootstrapped from. doctor.sh reports it.

Faster installs: mirror ranking

Stage 10 now runs reflector (https, 10 latest, sorted by rate) before the system update — previously the heaviest download of the machine's life ran on whatever mirrorlist archinstall left behind. Never fatal: if reflector fails, the install proceeds on stock mirrors and the digest notes it.

sudo keep-alive

Manual runs cache sudo once up front and keep the timestamp fresh in the background, so a long install no longer pauses on a hidden password prompt mid-AUR-build. (Unattended firstboot never needed this.)

Hardened live-installer disk picker

The stage0 disk list now shows only real installable disks (no loop/zram devices), marks the medium the installer itself booted from (<< live installer medium) and refuses to target it, rejects partitions (/dev/nvme0n1p1) with a helpful message, and the final confirmation echoes the size and model of the disk you're about to erase.

Fixed

• Fresh installs always failed to stow bash — useradd seeds /etc/skel/.bashrc into every new home and stow refuses to replace a real file. Pristine skel copies are now removed before stowing; modified files are left alone. (Found by the warnings digest on its first run.)
• tmux.service was never enabled on machines where stow ran first — stow places the unit symlink itself, and the old install block skipped the systemctl --user enable whenever the link already existed, leaving session restore dead at login. Link and enable are now independent steps. (Found by doctor.sh.)
• tree-sitter-cli removed from dev.txt — leftover from the neovim-nightly days, no longer needed.

Upgrading an existing machine

No action required. Optionally:

./doctor.sh          # see what drifted
./install.sh 10+     # re-run stages to converge (also stamps /etc/hashiru-release)

ISO

hashiru-2026.07.13-x86_64.iso attached, built from this tag

sha256: dd30e249ba8a3af2a35c5b9f1141688f4b4d963b63e4348e2dbe7b709a3d2b05

Hashiru v1.1.0

First-boot reliability

• Network race fixed. require_network now does an HTTPS check (curl -fsI) retried for up to a minute instead of a single ping, and first-boot enables NetworkManager-wait-online.service so After=network-online.target actually waits for DHCP before the bootstrap runs.
• Re-run guard. On success the first-boot unit removes /etc/hashiru-firstboot.env, so ConditionPathExists permanently blocks any re-run even if the unit is re-enabled.
• Reproducible installs. The build records git rev-parse HEAD at ISO build time and the installed system does a git checkout --detach onto exactly that commit. The build warns loudly on a dirty working tree and falls back to main for non-git checkouts. The /opt/hashiru staging clone is removed after being copied into the user's home.

New: GRUB stage (scripts/15-grub.sh)

• Adds a GRUB config stage that sets GRUB_INIT_TUNE and regenerates grub.cfg. Skips cleanly when GRUB isn't the bootloader (e.g. systemd-boot).

Installer hardening (stage0.sh)

• Fails fast with a clear message on BIOS/CSM boot (Hashiru installs UEFI).
• Rejects disks smaller than ~16 GiB before archinstall emits a cryptic mid-partitioning error.
• Passes secrets to jq via $ENV instead of --arg, so passwords never appear in /proc/*/cmdline.
• Deletes the plaintext creds file after a successful install (kept on failure for debugging).
• Accepts no as well as n for the LUKS-reuse prompt.

Other fixes

• Snapper ALLOW_USERS no longer aborts under set -e when the line is absent — it now appends a fresh one.
• 30-desktop.sh refuses to append TTY auto-start through a symlink (which would write into the dotfiles repo) and warns instead.
• 20-aur.sh cleans the yay build dir via an EXIT trap; removed dead backup_file/copy_config from lib/common.sh.
• New CI: .github/workflows/lint.yml runs shellcheck -x on push/PR.

Hashiru v1.0.0

My personal Arch + Hyprland bootstrap. Bare metal to an encrypted Wayland desktop in ~10 minutes.

• Live ISO installer: prompts for the basics, installs encrypted base Arch via archinstall, runs all Hashiru stages on first boot.
• LUKS encryption, btrfs + Snapper, Hyprland/Wayland, PipeWire, zsh, dev tools, dotfiles.
• Guided WiFi in the installer, carried over to the installed system.

ISO installer tested on Thinkpad P43s/T14s