From ec218bade6ca37b1c56cf58368c3513eeea52a43 Mon Sep 17 00:00:00 2001
From: Ryan Hughes <ryan@heyoodle.com>
Date: Fri, 22 May 2026 01:17:45 -0400
Subject: [PATCH] orchestrator: chown finalizer tooling inside target

---
 .../omarchy-iso/orchestrator/phases_impl.py   | 23 +++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py b/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py
index bd9c4c7..124adc6 100644
--- a/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py
+++ b/configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py
@@ -835,9 +835,28 @@ def run_chroot_finalizer(ctx: InstallContext) -> None:
         ["cp", "-a", f"{ctx.omarchy_path}/.", str(target_tooling)],
         check=True,
     )
+    if not (target_tooling / "finalize.sh").exists():
+        raise RuntimeError(
+            f"Copied installer tooling but {target_tooling / 'finalize.sh'} is missing"
+        )
+
+    # Resolve ownership inside the target. The install user exists in
+    # /mnt/etc/passwd, not in the live ISO, and the user's primary group is not
+    # guaranteed to have the same name as the user. The trailing ':' asks chown
+    # to use the user's login group.
     subprocess.run(
-        ["chown", "-R", f"{ctx.username}:{ctx.username}", str(target_tooling)],
-        check=False,
+        [
+            "arch-chroot", str(ctx.target),
+            "chown", "-R", f"{ctx.username}:", "/tmp/omarchy-install",
+        ],
+        check=True,
+    )
+    subprocess.run(
+        [
+            "arch-chroot", "-u", ctx.username, str(ctx.target),
+            "test", "-r", "/tmp/omarchy-install/finalize.sh",
+        ],
+        check=True,
     )
 
     # 5: arch-chroot -u $user → finalize.sh