fix: the install verb redacts its warnings, and no test touches /Applications - #53
Merged
Merged
Conversation
Four rows, each a seam answering with the home path inside a sentence somebody else wrote, held to a report that prints none of them as they came. Three are red before the fix (iss-2609120438396694). Assisted-by: Claude:claude-fable-5-1 Claude-Session: https://claude.ai/code/session_01RooZgUESQnVnievtn48pHo
…home The quit, firewall and launch warnings and the nothing-to-repair line printed the error text as it came, and one of them redacted the destination on the same line while the error beside it was not. All four now pass the text through redact, the way the failure line always did. The refusal at the top of RunInstall stays as it is: it is the live-environment guard's own sentence or a home directory that could not be resolved, and neither carries a path of this account's (iss-2609120438396694). Assisted-by: Claude:claude-fable-5-1 Claude-Session: https://claude.ai/code/session_01RooZgUESQnVnievtn48pHo
With the guard open, the live install environment's destination is this account's own on every Mac, and the destination probe answers without asking. Red before the fix on a Mac whose /Applications is writable, which is every CI runner (iss-2609120444017291). Assisted-by: Claude:claude-fable-5-1 Claude-Session: https://claude.ai/code/session_01RooZgUESQnVnievtn48pHo
The live install and update environments choose their destination by asking whether this account can write /Applications, which creates and removes a file there; the tests that open the live-environment guard built those environments, so a unit test wrote into the machine's applications directory and raced the installer tripwire in the merge queue. The probe is now a variable, and the one door into the live environment inside a test swaps it for an answer that touches nothing, restored when that test ends (iss-2609120444017291). Assisted-by: Claude:claude-fable-5-1 Claude-Session: https://claude.ai/code/session_01RooZgUESQnVnievtn48pHo
The exemption for the writability probe's file was a belt over a race whose source is now closed: no test binary creates that file. A listing that ignores nothing is the stronger tripwire. Assisted-by: Claude:claude-fable-5-1 Claude-Session: https://claude.ai/code/session_01RooZgUESQnVnievtn48pHo
Both issues move to resolved with their fixing commits; the changelog carries the user-facing half under [Unreleased]. Assisted-by: Claude:claude-fable-5-1 Claude-Session: https://claude.ai/code/session_01RooZgUESQnVnievtn48pHo
The review found the nothing-to-repair row vacuous: installedAt's sentences carry no path, so the row passed on the destination already redacted beside it. Three rows remain, each red without its fix. Assisted-by: Claude:claude-fable-5-1 Claude-Session: https://claude.ai/code/session_01RooZgUESQnVnievtn48pHo
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two lifecycle captures from the security review of #50
iss-2609120438396694 —
gropius installprinted error text unredacted. The quit, firewall and launch warnings and the nothing-to-repair line wrote the error as it came, home path inside it, and one of them redacted the destination on the same line while the error beside it was not. All four now pass throughredact, the way the failure line always did. Held byTestInstallWarningsAreRedacted: three rows, each a seam answering with the home path inside a sentence somebody else wrote, watched red before the fix. CHANGELOG carries it under[Unreleased]→ Fixed.iss-2609120444017291 — a unit test created a file in the Mac's /Applications. The live install and update environments choose their destination by probing whether this account can write /Applications, and the tests that open the live-environment guard built those environments, so the suite wrote into the machine's applications directory and raced the installer tripwire in the merge queue (seen on #50). The probe is now a package variable, and
allowLiveEnvInTest, the one door into the live environment inside a test, swaps it for an answer that touches nothing, restored on cleanup. Held byTestTheGuardCanBeOpenedForOneTest, red on this Mac before the fix. With the source closed, the tripwire's exemption for the probe's file name is removed, so it counts every entry again.Gates.
make test(race) green, 23 packages;gofmt -l .empty;go vet ./...clean;abcd docs lint0 findings. Independent review: SHIP, with one minor finding (a vacuous test row) fixed in the last commit.https://claude.ai/code/session_01RooZgUESQnVnievtn48pHo