From 79610c3c6753645cd7781b0e5bf600978e20a2bc Mon Sep 17 00:00:00 2001
From: T2an <104208819+T2an@users.noreply.github.com>
Date: Tue, 22 Sep 2026 10:32:17 +0200
Subject: [PATCH] autoinstall-terminal: fail on error instead of reporting a
 false success

Nothing after the disk-mount check checked its own exit status, so a
failing nixos-install (or Secure Boot enrollment, or key provisioning)
still ended with "Installation is complete." Wraps that section in a
subshell with set -e and checks its exit code before reporting success;
the install log is still saved to the target disk either way.
---
 lib/default.nix | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/lib/default.nix b/lib/default.nix
index f9ddd35e..98a8f368 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -382,15 +382,24 @@ rec {
                           log_error "/mnt is not a mountpoint or resides on a /tmpfs. The installation cannot succeed. Exiting."
                           exit 1
                         fi
-                        ${optionalString createSecureBootKeys createSecureBootKeysScript}
-                        box_message "Burning the image on ${mainDisk}..."
-                        ${installProcedureScript config}
-                        ${optionalString enrollSecureBootKeys secureBootEnrollmentScript}
-                        ${optionalString (preprovisionOptions.tpm2HostKeys or false) tpm2ProvisionScript}
-                        ${optionalString (preprovisionOptions.ageHostKeys or false) ageKeysProvisionScript}
-                        ${postInstallScript}
-                        lsblk
-                        log_info "Installation is complete. You can now reboot in the installed system."
+                        (
+                          set -e
+                          ${optionalString createSecureBootKeys createSecureBootKeysScript}
+                          box_message "Burning the image on ${mainDisk}..."
+                          ${installProcedureScript config}
+                          ${optionalString enrollSecureBootKeys secureBootEnrollmentScript}
+                          ${optionalString (preprovisionOptions.tpm2HostKeys or false) tpm2ProvisionScript}
+                          ${optionalString (preprovisionOptions.ageHostKeys or false) ageKeysProvisionScript}
+                          ${postInstallScript}
+                        )
+                        INSTALL_FAILED=$?
+                        if [ "$INSTALL_FAILED" -ne 0 ]; then
+                          log_error "Installation failed."
+                          box_message "Installation aborted: see /tmp/install.log for details."
+                        else
+                          lsblk
+                          log_info "Installation is complete. You can now reboot in the installed system."
+                        fi
 
                         if [ -f "$INSTALL_LOG" ]; then
                           mkdir -p /mnt/var/log
@@ -398,6 +407,10 @@ rec {
                           log_info "Install log saved to /var/log/securix-install.log on the target system."
                         fi
 
+                        if [ "$INSTALL_FAILED" -ne 0 ]; then
+                          exit 1
+                        fi
+
               '')
             ];
           }