From 445db3279278e7a1c61b039aa607044f370b20b0 Mon Sep 17 00:00:00 2001
From: David Heinemeier Hansson <david@hey.com>
Date: Fri, 7 Aug 2026 16:51:01 -0700
Subject: [PATCH] Make OEM state world-readable for user-context finalization

The Node tarball in /var/lib/omarchy/oem/packages is read by
omarchy-finalize-user running as the freshly created user; a 0700 directory
forced the offline install onto its network fallback. The only secret inside
(luks-key) is itself 0600 root.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 bin/omarchy-iso-test                          | 24 ++++++++++++++++++-
 .../omarchy-iso/orchestrator/phases_impl.py   |  4 +++-
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/bin/omarchy-iso-test b/bin/omarchy-iso-test
index 316acec..3fadb7d 100755
--- a/bin/omarchy-iso-test
+++ b/bin/omarchy-iso-test
@@ -293,6 +293,28 @@ type_text() {
       :) press shift-semicolon ;;
       @) press shift-2 ;;
       \|) press shift-backslash ;;
+      ";") press semicolon ;;
+      "'") press apostrophe ;;
+      '"') press shift-apostrophe ;;
+      "=") press equal ;;
+      "+") press shift-equal ;;
+      "%") press shift-5 ;;
+      "&") press shift-7 ;;
+      "*") press shift-8 ;;
+      "(") press shift-9 ;;
+      ")") press shift-0 ;;
+      "<") press shift-comma ;;
+      ">") press shift-dot ;;
+      "!") press shift-1 ;;
+      "#") press shift-3 ;;
+      '$') press shift-4 ;;
+      "?") press shift-slash ;;
+      "~") press shift-grave_accent ;;
+      "\\") press backslash ;;
+      "[") press bracket_left ;;
+      "]") press bracket_right ;;
+      "{") press shift-bracket_left ;;
+      "}") press shift-bracket_right ;;
       *) echo "type_text: unsupported character: $ch" >&2; return 1 ;;
     esac
     sleep 0.05
@@ -673,7 +695,7 @@ drive_oem_setup() {
   capture_console "success-oem-02-password"
   press ret
 
-  wait_for_screen "match the password" 60
+  wait_for_screen "Confirm" 60
   type_text "$GUEST_PASSWORD"
   press ret
 
diff --git a/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py b/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py
index 32cf4ed..e2613f8 100644
--- a/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py
+++ b/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py
@@ -1169,9 +1169,11 @@ NODE_PACKAGES_DIR = Path("/opt/packages")
 
 
 def stage_oem_state(ctx: InstallContext) -> None:
+    # World-readable: first-boot finalization reads the Node tarball as the
+    # new user. The only secret inside (luks-key) is itself 0600 root.
     oem_dir = ctx.target / OEM_STATE_DIR
     oem_dir.mkdir(parents=True, exist_ok=True)
-    oem_dir.chmod(0o700)
+    oem_dir.chmod(0o755)
 
     _stage_node_tarball(ctx, oem_dir)