The index-based probe (d71f34464) checks names against what stable
actually ships, and three declarations never did: stable carries no
'firefox' binary (only firefox-esr), openjdk-11 left after bullseye, and
the Qt GUI ships as 'wireshark' rather than wireshark-qt. Each id has
exactly one consumer (dev-java role, admin-network and dev workstation
bundles), and installing any of the three on Debian stable failed with
'unable to locate package' - these can only go from broken to working.
default-jdk follows the distro default like fedora's
java-latest-openjdk-devel already does; the registry never agreed on a
major across distros (Arch pins 11, RedHat 21). Ubuntu keeps 'firefox'
via a distro override because noble ships no firefox-esr.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Replaces the raw package modules at 76 call sites with package_install, moves
each role's distribution mapping into its own meta/packages.yml, and turns the
inventory PACKAGES variable from source-keyed literal names into a list of
declared package ids. The lint that forbids the raw modules is enabled here,
because the migration burns it down from 76 offenders to zero.
Removes sys-aur, sys-aur-install and sys-package. The AUR build user, the
passwordless pacman rule and the inventory-driven install are part of the plan
the action plugin executes, so the roles no longer carry them.
Declaring the mappings surfaced breakage the raw modules had hidden: on Debian
the `which` binary comes from debianutils, jrnl is in no Debian or Ubuntu
suite, chromium-browser is absent from Debian stable, JDK 11 is unobtainable on
RedHat, wireguard had no RedHat branch at all, qbittorrent was built from the
AUR although Arch ships it in extra, and desk-docker installed a Docker variant
that conflicts with the one sys-svc-container installs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5