fix: ensure Helm prerequisites on Tier 0 install path (Bugbot #383)

scripts/lib/setup-linux.sh

@@ -473,6 +473,28 @@ install_helm() {
   success "System tools"
 }
 
+# _ensure_helm_prereqs — install_helm shells to get-helm-3, which verifies its
+# download checksum with `openssl` and unpacks a tarball with `tar`. The full
+# flow guarantees both via install_system_deps (see the matching note there), but
+# the Tier 0 fast path skips install_system_deps entirely — so on a minimal host
+# that lacks them (Amazon Linux 2023, minimal RHEL) the Helm install would die
+# cryptically AFTER we promised a zero-privilege install (Bugbot #383).
+#
+# We MUST NOT install them here: on Tier 0 every package install needs sudo
+# ($PM_INSTALL is sudo-prefixed and setup_pm isn't even run on this path), and a
+# docker-group user without root would hit a password prompt / failure on the
+# "no administrator rights needed" path. Hosts that already have a usable Docker
+# almost always have openssl+tar, so the common case is a silent no-op; when they
+# are genuinely absent, surface the real constraint up front instead of silently
+# sudo-ing or failing mid-install.
+_ensure_helm_prereqs() {
+  local missing=()
+  has openssl || missing+=(openssl)
+  has tar     || missing+=(tar)
+  [ ${#missing[@]} -eq 0 ] && return 0
+  error "Helm's installer needs these packages, which aren't installed: ${missing[*]}. This zero-privilege (Tier 0) path won't install system packages for you — install ${missing[*]} once (your package manager, or ask an administrator), then re-run this installer. Details: docs/rfcs/0001-least-privilege-install.md"
+}
+
 # ── GPU setup dispatch ───────────────────────────────────────────────────────
 dispatch_gpu_setup() {
   case "$GPU_VENDOR" in
@@ -605,6 +627,10 @@ install_linux() {
   # INSTALL is skipped.
   if [ "${INSTALL_TIER:-}" = "0" ]; then
     info "Using the container runtime already on this machine — no administrator rights needed."
+    # get-helm-3 (run by install_helm) needs openssl+tar; the full flow installs
+    # them in install_system_deps, which this path skips — verify they're present
+    # up front rather than sudo them in on the zero-privilege path (Bugbot #383).
+    _ensure_helm_prereqs
     _install_userspace_tools
     _tier0_gpu_flags
     return 0

scripts/manifest.sha256

@@ -5,7 +5,7 @@ e862f8adcd84b9a9bef777c2091c5296e51eb73a761ce3a1f89e66f4225da679  scripts/lib/pr
 7977ef12a16fc6aee1c2824cae13bd1450f7fe1c1345323292e4a14decbfe83f  scripts/lib/gpu-nvidia.sh
 f62a13e5229af07b053b54b66456e0aaf29b64a5eace079c7d19947020603594  scripts/lib/gpu-amd.sh
 cdc27b7929c42713e84006010aee06585d95102fa34798ee5a80ff7f05e33799  scripts/lib/setup-macos.sh
-ce603301f68e509e263a3fb344d3aa86fca1521de9a6cdf1924e909ab7f6caad  scripts/lib/setup-linux.sh
+9674bc93f5927fff59bfe04bc902834fbc17acc6f543de6f76fcab5916602a54  scripts/lib/setup-linux.sh
 30665bcfacdbb52cbde6ea18b6d64ba6fc92fd7167e9da4310a10a5f03ddb910  scripts/lib/cluster.sh
 045caf6efeb583e5005d881d9281edae6a6aedf8f318b0a4021964b3b4b29cc5  scripts/lib/gpu-plugins.sh
 187c64bacce371a01dc327135e5d4bb6c8dcd0f707f0ca41aa2e9661c4a213a9  scripts/lib/install-client-helm.sh

scripts/tests/setup-linux.bats

@@ -111,6 +111,29 @@ setup() {
   [[ "$output" != *"Installing tar"* ]]
 }
 
+# ── _ensure_helm_prereqs: Tier 0 skips install_system_deps, so guard helm's
+# openssl+tar deps up front instead of letting get-helm-3 die mid-install after
+# promising a zero-privilege path (Bugbot #383). We can't sudo them in on Tier 0.
+@test "_ensure_helm_prereqs: openssl + tar present -> silent no-op (exit 0)" {
+  PRESENT_CMDS="docker openssl tar"
+  run _ensure_helm_prereqs
+  [ "$status" -eq 0 ]
+}
+@test "_ensure_helm_prereqs: both missing -> fatal, names openssl+tar and the zero-privilege constraint" {
+  PRESENT_CMDS="docker"            # neither openssl nor tar
+  run _ensure_helm_prereqs
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"openssl"* ]]
+  [[ "$output" == *"tar"* ]]
+  [[ "$output" == *"Tier 0"* ]]     # honest about why we won't install them
+}
+@test "_ensure_helm_prereqs: only tar missing -> fatal, names tar (not openssl)" {
+  PRESENT_CMDS="docker openssl"    # openssl present, tar absent
+  run _ensure_helm_prereqs
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"tar"* ]]
+}
+
 # ── install_docker_engine: branch selection ────────────────────────────────
 @test "install_docker_engine: Amazon Linux -> dnf docker" {
   PRESENT_CMDS="dnf"; TEST_DISTRO=amzn; write_os_release
@@ -451,6 +474,7 @@ _stub_install_steps() {
   install_kubectl()      { record "install_kubectl"; }
   install_k3d()          { record "install_k3d"; }
   install_helm()         { record "install_helm"; }
+  _ensure_helm_prereqs() { record "_ensure_helm_prereqs"; }
 }
 
 @test "install_linux: Tier 0 skips every privileged step, installs only user-space tools" {
@@ -467,6 +491,7 @@ _stub_install_steps() {
   mock_calls | grep -q install_kubectl
   mock_calls | grep -q install_k3d
   mock_calls | grep -q install_helm
+  mock_calls | grep -q _ensure_helm_prereqs   # openssl+tar checked before helm (Bugbot #383)
   ! mock_calls | grep -q preflight_sudo
   ! mock_calls | grep -q install_docker_engine
   ! mock_calls | grep -q install_system_deps