From f9ea5a74e985788a4eb50c8f103229224a169afb Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Tue, 6 Oct 2026 03:39:07 +0000
Subject: [PATCH] Refresh apt package lists once in script/bootstrap (closes
 #115)

pkg_install ran apt-get install without apt-get update. The Gitea runner
image starts with empty package lists, so installing anything it lacks,
such as Go, failed with "Unable to locate package". The apt branch now
runs apt-get update before its first install and skips it on later
calls, so a repository's own section needs no refresh of its own.

Model: opus-5-5
---
 TODO.md          |  6 ++++++
 script/bootstrap | 10 +++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/TODO.md b/TODO.md
index 901e61d..feeff5d 100644
--- a/TODO.md
+++ b/TODO.md
@@ -21,6 +21,12 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-06: The canonical `script/bootstrap` now runs `apt-get update` once,
+  before the first `apt-get install` of a run (issue 115). The Gitea runner
+  image starts with empty package lists, so installing anything it lacks, such
+  as Go, failed with `Unable to locate package`. A repository's own section no
+  longer needs a refresh of its own; `sneak/bsfirehose` and `sneak/dnswatcher`
+  drop theirs at their next re-vendor.
 - 2026-10-06: `REPO_POLICIES.md` and both checklists now say that a checkout
   whose `.git` is a file, a linked worktree or a repository checked out as a
   submodule, is the exception to a plain `docker build .` succeeding (issue
diff --git a/script/bootstrap b/script/bootstrap
index 3c5ce34..799f256 100755
--- a/script/bootstrap
+++ b/script/bootstrap
@@ -19,6 +19,7 @@ YARN_VERSION="1.22.22"
 
 PKGMGR=""
 SUDO=""
+APT_UPDATED=""
 
 detect_pkgmgr() {
     [ -n "$PKGMGR" ] && return 0
@@ -47,7 +48,14 @@ pkg_install() {
     detect_pkgmgr
     case "$PKGMGR" in
         nix) nix-env -iA "nixpkgs.$1" ;;
-        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
+        apt)
+            # Package lists may be empty (fresh images); refresh once per run.
+            if [ -z "$APT_UPDATED" ]; then
+                $SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
+                APT_UPDATED=1
+            fi
+            $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2"
+            ;;
         brew) brew install "$3" ;;
         apk) apk add --no-cache "$4" ;;
     esac