Builds a full dev workstation from a bare Arch Linux install. https://git.cjennings.net/archsetup/atom?h=main 2026-07-20T17:44:01+00:00 2026-07-20T17:44:01+00:00 Craig Jennings c@cjennings.net 2026-07-20T17:44:01+00:00 urn:sha1:dffecf528cd20af2bd4437df567896ce03cabe2f gpg writes its output at the process umask (often 0644), so the plaintext mail password was world-readable between the decrypt and the chmod. I extracted decrypt_to_secure, which runs the decrypt in a 0077 umask subshell so the file is 0600 from creation. A fake-gpg test pins that the write runs under the tight umask.