show tech · cenko.tech

Making apt repository setup fail where the problem is

Tue, 06 Oct 2026 00:00:00 GMT

bootstrap_linux_pc sets up a fresh Fedora or Ubuntu machine with one command. On Ubuntu it adds the Google Chrome and VS Code apt repositories before installing packages from them.

The symptom

If something goes wrong while adding a repository, you do not find out there. You find out a few steps later, when apt-get update or a package install fails with an error that says nothing about signing keys. I wrote this up as issue #3.

The cause

Each repository was added like this:

curl -fsSL https://dl.google.com/linux/linux_signing_key.pub \
  | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" \
  | sudo tee /etc/apt/sources.list.d/google-chrome.list >/dev/null

Nothing checks whether the key download or the gpg --dearmor step worked. If the download fails, the script carries on and still writes the sources.list.d entry. Apt is now pointed at a repository it has no valid key for, and the failure surfaces later, somewhere else.

The fix

The pull request splits the job into two functions.

add_apt_repo_key() downloads the key to a temporary file, checks the download succeeded and is not empty, then dearmors it. If dearmoring fails, it removes any partial keyring file:

if ! curl -fsSL "$url" -o "$tmp_key"; then
  err "Failed to download signing key from $url"
  rm -f "$tmp_key"
  return 1
fi

if [[ ! -s "$tmp_key" ]]; then
  err "Downloaded signing key from $url is empty."
  rm -f "$tmp_key"
  return 1
fi

add_apt_repo() only writes the repository file if the key step succeeded. If it did not, it names the repository that failed and skips it, instead of leaving a repo file with no matching key:

if ! add_apt_repo_key "$key_url" "$keyring_path"; then
  warn "Skipping $name repository setup — $name install will be skipped."
  return 1
fi

Both repositories now go through add_apt_repo. The already-configured path and the normal success path behave exactly as before.

How I tested it

bash -n distro/ubuntu.sh for syntax.
An Ubuntu 24.04 VM with the key URL blocked through an /etc/hosts entry, to confirm the script now warns and skips cleanly.
A normal run on the same VM, to confirm both repositories are still configured.

The general rule: when a step is a prerequisite for later steps, check it where it happens. An error message that names the real cause saves the next person a long search.

When the AI says the teams are balanced and they are not

Tue, 06 Oct 2026 00:00:00 GMT

footbolski is the app our football group uses to organise matches: people register for a game, an admin keeps player ratings, and an AI splits the confirmed players into two teams. Between August and September I sent it five pull requests. The most interesting one taught me something about where an LLM belongs in a system.

The bug: reasoning that does not match the result

Issue #30: the AI’s explanation said the two highest-rated players were on opposite teams, but the generated teams had both of them on Team A.

I traced the pipeline from the team service through the name-matching code to the prompt. The name matching was correct: it case-folds both sides consistently, so this was not a lookup bug. The real problem was that the reasoning text was saved and shown exactly as the model wrote it, and nothing checked its claims against the team lists the model returned in the same response. The prompt told the model not to put the strongest players together, but nothing enforced that.

My pull request added a deterministic backstop. After the AI’s split is mapped to real players, it checks whether the two highest-scoring players landed on the same side. If they did, it swaps the weaker of the two with the strongest player on the other team, keeping team sizes equal, and adds a note to the displayed reasoning so the admin can see a correction was made.

What the maintainer found next

The maintainer tested the pipeline against a real upcoming match, five live runs. In four of them, the model put the two strongest players on the same team and claimed the opposite. Asked to rank the squad, it returned the correct order, so it knew who was best. And an exhaustive search over every possible split found a far more even one in milliseconds than anything the model produced.

Their conclusion: the backstop works, but it patches one rule and ships the contradiction to users with an apology attached. They pushed a redesign onto the same branch. The model no longer picks teams. It reads the scouting notes and returns structured judgments about each player. Code validates those judgments, a solver finds the actual best split, and only then does the model write an explanation, from the finished split. It cannot describe teams that were not produced.

The other four pull requests

Join WhatsApp group step. New players register in the app but are not necessarily in the WhatsApp group where matches are organised. I added a step to first-time registration: open the group link, then confirm. The confirm checkbox stays disabled until the link has been opened. It is a nudge, not verification, because WhatsApp gives the app no signal when someone joins.
Aerial on player cards, a new Passing rating. The admin had to open every player’s detail view to see the Aerial rating, so I put it on the card. I also added a Passing rating for the team splitter to weigh and, at the admin’s request, removed eight free-text style tags the AI could not meaningfully compare. In the same area I found an import of a function that did not exist, which would fail at runtime and likely meant the AI split path was already broken, and fixed that too.
Backfill for older player cards. The Passing column had no value for players created before it existed, so their cards showed “-/10”. A one-time database migration sets those to the default of 5. Its downgrade is deliberately a no-op, because undoing it could erase real ratings an admin had since set to 5.
Existing members blocked by the WhatsApp step. On a new phone or in a private window, existing members were asked to join a group they were already in. The root cause: “new user” was decided purely from what this browser had stored. The fix also checks the typed name against the real player list, using a full-name match so a stranger who shares a first name with a member still sees the step.

Only works if your username is "user": fixing hardcoded home paths

Tue, 06 Oct 2026 00:00:00 GMT

opencode-voice adds push-to-talk voice control for the OpenCode CLI on Hyprland/Wayland: hold a key, speak, release. It is a set of shell scripts, a Python transcription daemon and a systemd user service.

The symptom

Reading the code, I noticed several scripts and the systemd unit pointed at /home/user/.... That only works if your login name is literally user. On any other account:

the scripts put a directory that does not exist on PATH,
OPENCODE_BIN points at a binary that is not there,
the systemd service cannot start, because its ExecStart path does not exist.

I reported it as issue #1. I found it by reading the code, not by running it on a second account, and the issue says so.

The fix

Shell scripts get the home directory from $HOME, and systemd user units get it from the %h specifier.

# before
export PATH="/home/user/.opencode/bin:/home/user/.local/bin:/usr/bin:/bin"
OPENCODE_BIN="/home/user/.opencode/bin/opencode"

# after
export PATH="$HOME/.opencode/bin:$HOME/.local/bin:/usr/bin:/bin"
OPENCODE_BIN="${OC_VOICE_OPENCODE:-$HOME/.opencode/bin/opencode}"

# opencode-voice.service
# %h expands to the user's home; edit if the repo lives elsewhere.
ExecStart=%h/Projects/opencode-voice/voice-daemon.sh

OC_VOICE_OPENCODE is a new, optional override for people who installed OpenCode somewhere else. The default location is unchanged, and the README mentions the new variable.

Testing, honestly

I was on Windows, so I could not run the project’s unit tests (they execute the shell scripts directly). What I did check:

bash -n on every script and python -m py_compile on the Python files.
A dry run as a pretend user: HOME=/home/alice OC_VOICE_DRYRUN=1 bash voice-cmd.sh "open opencode and start working" resolves the binary to /home/alice/.opencode/bin/opencode, and OC_VOICE_OPENCODE=/opt/oc overrides it.
grep -rn /home/user over the repository finds nothing.

The pull request listed what was and was not tested, and the maintainer merged it the same day.

Redesigning a unit converter with no dependencies

Tue, 06 Oct 2026 00:00:00 GMT

unit-converter started as a small Node.js server that converts length, weight and temperature. This pull request gave it a new interface and more to convert, with one rule: no npm dependencies.

What changed

A carpenter’s-rule look. An ink-coloured shell around a boxwood-yellow working surface, with a tick-mark scale that shows where your answer sits. It is responsive down to phone width.

Live conversion. With JavaScript on, the answer updates as you type. You can swap units, copy the result, and click any unit in the all-units table to make it the target. The scale switches between linear and logarithmic.

Shareable links. Every conversion has a URL:

/length?value=12&from=inch&to=centimeter

Four new categories: area, volume (US customary units), speed and time, joining length, weight and temperature.

It still works without JavaScript. The form posts back to the same page and the server renders the result and the table. I checked this with JavaScript turned off, as well as at desktop and phone widths.

Keeping it dependency-free

The whole app is server.js (an HTTP server using Node’s built-in modules), converters.js and a few static files (the stylesheet, the browser script and the icon). converters.js holds the unit definitions and conversion logic, and loads both in Node and in the browser. The server and the live page use the same code, so they cannot disagree about an answer.

Tests

npm test runs plain assert checks. The new categories got their own cases, plus one loop that guards every unit at once:

// every unit has a display symbol, and every category converts to itself unchanged
for (const [key, cat] of Object.entries(categories)) {
  for (const u of Object.keys(cat.units)) {
    assert.ok(cat.symbols[u], `${key}/${u} has a symbol`);
    eq(key, 42, u, u, 42);
  }
}

That loop catches a unit added without a display symbol, and any unit whose definition is broken badly enough that converting it to itself changes the value. The fixed cases above it check the actual factors.

Try it

It needs Node.js 18 or newer:

npm start

Then open http://localhost:3000.

Making a Webex bot say which space it means

Tue, 06 Oct 2026 00:00:00 GMT

eurl is an open-source Webex bot that gives a Webex space a short public join link. Type eurl url in a space and the bot replies with the link and who is allowed to use it.

The symptom

The reply always looked like this:

Only users in the domain(s) example.com can join this space using https://eurl.io/#1A2B3C-AB

Inside the space, that is fine. But people copy that sentence out of the space and paste it into other chats, wikis and emails, and once it leaves the room, “this space” points at nothing. Issue #12 reported exactly that back in 2023.

The cause

The message text was a fixed string. The bot already knew the space’s name: sendJoinDetails() receives the whole publicspace record, and its title field is stored and kept in sync through the rooms:updated webhook. It just never used it.

The fix

Use the title when there is one, and keep the old wording when there is not, so older records without a stored title cannot end up with an empty name in bold:

// fall back to "this space" for older records where title wasn't yet stored
var spaceName = publicspace.title ? "**"+publicspace.title+"**" : "this space";

Both reply variants (open space, and locked space where the bot is not a moderator) now use spaceName instead of the literal text. After the change:

Only users in the domain(s) example.com can join The Greatest Webex Team room ever! using https://eurl.io/#1A2B3C-AB

No schema change and no extra API call: the data was already there.

What I could not test

The repository has no test suite, and running the bot needs a live MongoDB instance and a real bot token, which I did not have. The pull request says so plainly and asks the maintainers to check it against a real space, including one with a blank title to exercise the fallback. It is still open.

An interactive WireGuard server installer

Tue, 06 Oct 2026 00:00:00 GMT

The toor11/scripts repository is a collection of system administration scripts. It had an openvpn-install.sh but nothing for WireGuard, and its dozen scripts had no index. My pull request added both: a README describing every script, and wireguard-install.sh, written in the same interactive style as the OpenVPN installer.

What the script does

Run it as root:

sudo ./wireguard-install.sh

The first run asks a few questions, each with a default you can accept: the server’s public IP or hostname, the UDP port (51820), the public network interface, the tunnel subnet (10.66.66.0/24), the first client’s name and the DNS server to push to clients (1.1.1.1). Then it:

Detects the distribution and installs WireGuard and qrencode with apt, dnf, yum or pacman.
Generates the server key pair and writes /etc/wireguard/wg0.conf.
Turns on IPv4 forwarding in /etc/sysctl.d/99-wireguard-forward.conf.
Adds NAT with iptables rules that come up and go down with the interface:

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Opens the UDP port in ufw or firewalld, whichever is active.
Starts and enables wg-quick@wg0.
Creates the first client: its own key pair plus a preshared key, a client config, and a QR code printed in the terminal for the WireGuard phone app.

Every later run shows a menu instead: add a client, revoke a client, or uninstall. Adding or revoking a client reloads the WireGuard interface so the change applies straight away.

Forcing Windows 11 to install the full language pack

Sat, 05 Sep 2026 00:00:00 GMT

Changing the display language in Settings → Time & language → Language & region on Windows 11 sometimes installs only a simplified, partial language pack. Some of the interface switches over, but many system elements, menus and dialogs stay in the old language, even after several restarts.

I hit this when switching a Polish install of Windows 11 to English. The same thing can happen when you add a language, such as fr-FR, to a system that was installed from an ISO in a different language.

The symptom

Some UI elements switch to the new language.
Many system menus and dialogs stay in the old one.
Restarting does not help, no matter how many times.

The fix

One PowerShell script, run as Administrator. Set $targetLanguage to the language you want, for example en-US, en-GB, pl-PL, fr-FR or pt-BR:

# --- Variables ---
$targetLanguage = "en-US" # Change to en-GB if you prefer British English

# --- Install Language Pack ---
Install-Language -Language $targetLanguage

# --- Set User Display Language ---
Set-WinUserLanguageList $targetLanguage -Force

# --- Copy Settings to System and Welcome Screen ---
Copy-UserInternationalSettingsToSystem -WelcomeScreen $True -NewUser $True

# --- Force a Restart to Apply Changes ---
Restart-Computer -Force

What each step does

Cmdlet	What it does
`Install-Language`	Forces the full language pack instead of the simplified one Settings installs.
`Set-WinUserLanguageList`	Makes the target language the active one for the current user.
`Copy-UserInternationalSettingsToSystem`	Copies the language and regional settings to system processes, the Welcome and lock screen, and new user accounts.
`Restart-Computer -Force`	Restarts straight away so the change applies everywhere.

Copy-UserInternationalSettingsToSystem needs both -WelcomeScreen and -NewUser. Leave one out and PowerShell stops to ask for it. Set -NewUser $False if future accounts should keep the old language.

Good to know

It needs Windows 11 22H2 or later, because that is where Install-Language first appeared. It also needs an internet connection and an Administrator session.
The install can look stuck for up to about 20 minutes. It is not. Let it run.
Set-WinUserLanguageList replaces your whole language list. To keep another language installed for typing, pass an array instead:

Set-WinUserLanguageList @("en-US","pl-PL") -Force

tip: if the script is blocked

If PowerShell refuses to run scripts, lift the execution policy for this session only, then run the script again:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

If Install-Language is not recognised on your build, the fallback is Add-WindowsCapability, adjusting the language tag as needed:

Add-WindowsCapability -Online -Name "Language.Basic~~~en-US~0.0.1.0"

The script and the full instructions are in the repository on GitHub.