Builds a full dev workstation from a bare Arch Linux install. https://git.cjennings.net/archsetup/atom?h=claude%2Fhungry-franklin-09fffc 2026-07-20T20:44:29+00:00 2026-07-20T20:44:29+00:00 Craig Jennings c@cjennings.net 2026-07-20T20:44:29+00:00 urn:sha1:a55800c79ab1fe55cba151018ad849750b4e5946 The installer copied /etc/sudoers.pacnew over /etc/sudoers with no validation. A malformed pacnew that sudo refuses to parse would replace a working sudoers with an unparseable one, locking out privilege escalation right before the NOPASSWD rule gets appended. replace_sudoers_pacnew now runs `visudo -cf` on the pacnew first and only copies a file that validates; a failure warns and leaves the current sudoers in place. Extracted the logic into a function taking the pacnew and target as positional args defaulting to the system paths, so the guard can run against fixtures.