kuhyx/testsAndMisc
1
0
Fork 0
mirror of https://github.com/kuhyx/testsAndMisc.git synced 2026-11-10 19:27:03 +01:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

pacman wrapper: drop list-file checks and docs after list retirement

Browse Source 
digital-wellbeing e2a7176 removed the blocked-keyword, white and grey
lists. check_pacman_wrapper no longer looks for them, the VirtualBox note
stops citing pacman policy, and the docs drop the lists and greylist
challenge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Lhzv7c391mTKWfwU17V7Z
This commit is contained in:
Krzysztof Rudnicki 2026-10-17 18:46:17 +02:00
parent cad66c983f
commit ad46fc85a5
13 changed files with 101 additions and 99 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
docs/superpowers/evidence/drop-pacman-policy-lists-2026-10-17.json Normal file
View File

@ -0,0 +1,34 @@
{
"intent": "The pacman wrapper no longer has blocked-keyword, white or grey lists (removed in digital-wellbeing e2a7176); stop the services checker and docs from expecting them.",
"scope": [
"linux_configuration/periodic_background/lib/services_wrappers.sh and its test",
"linux_configuration/periodic_background/lib/services_browser.sh comment + note",
"linux_configuration/.github/copilot-instructions.md and linux_configuration/docs pacman docs",
"Non-goal: the wrapper itself lives in ~/src/digital-wellbeing"
],
"changes": [
"check_pacman_wrapper only checks words.txt as a supporting file, no longer pacman_blocked_keywords.txt / pacman_whitelist.txt",
"test_services_wrappers.sh stages and removes only words.txt",
"VirtualBox n/a note no longer claims it is blocked by pacman policy",
"Docs drop the list files, greylist challenge and comparisons; integrity/immutability text now names the lock lib and pw_*.sh"
],
"verification": [
{
"command": "bash linux_configuration/periodic_background/lib/tests/run_all.sh",
"result": "pass",
"evidence": "test_services_wrappers.sh: 29 passed, 0 failed; All check_and_enable_services test files passed."
},
{
"command": "bash linux_configuration/periodic_background/check_and_enable_services.sh --status",
"result": "pass",
"evidence": "Supporting file exists: /usr/local/bin/words.txt; no list-file lines; 'VirtualBox not installed — not applicable'. Drift flagged as expected until the hourly reinstall deploys digital-wellbeing e2a7176."
}
],
"risks": [
"VirtualBox is now installable without friction; only post-transaction VM removal remains"
],
"rollback": [
"git revert this commit together with digital-wellbeing e2a7176",
"Re-run install_pacman_wrapper.sh and check_and_enable_services.sh --status"
]
}

4
linux_configuration/.github/copilot-instructions.md vendored
View File

@ -9,7 +9,7 @@ This repo automates Linux desktop bootstrap, hardening, and i3 setup. It’s pri
- `hosts/install.sh` builds and locks `/etc/hosts` (immutable/append-only; selective unblocks; custom blocks).
- `hosts/guard/` enforcement is provided by guard-lib (`guardctl`, installed outside this repo): a `file-guard` instance per target (`hosts`, `nsswitch`, `resolved`) with a path-watcher, optional RO bind mount, generic pacman hooks, and per-target plugins under `hosts/guard/plugins/`. The pre-guard-lib scripts (`setup_hosts_guard.sh`, `enforce-*.sh`, per-target systemd units, `psychological/unlock-hosts.sh`) are archived at github.com/kuhyx/testsAndMisc-archive — see `./fixes/migrate_hosts_guard_to_guard_lib.sh` for how the migration works.
- periodic_background/digital_wellbeing/pacman/: a policy-aware pacman wrapper with friction mechanics.
- `pacman_wrapper.sh` intercepts transactions, runs hosts-guard pre/post hooks, handles stale db lock, auto-wires maintenance services, and enforces package policy (blocked/whitelisted lists); adds weekend-only “Steam” challenge and a VirtualBox challenge powered by `words.txt`.
- `pacman_wrapper.sh` intercepts transactions, runs hosts-guard pre/post hooks, handles stale db lock, auto-wires maintenance services, adds a weekend-only “Steam” challenge powered by `words.txt`, and removes VirtualBox VMs after each transaction. It has no package block/allow lists (retired 2026-10-17; hosts/DNS blocking covers that).
- `install_pacman_wrapper.sh` backs up `/usr/bin/pacman` to `pacman.orig` and symlinks to the wrapper.
- periodic_background/system-maintenance/: templates and installer for periodic jobs and monitoring.
- `setup_periodic_system.sh` installs: `/usr/local/bin/periodic-system-maintenance.sh`, a timer (`periodic-system-maintenance.timer`), a startup oneshot, and `hosts-file-monitor.service` that restores `/etc/hosts` if tampered. Also installs a browser pre-exec wrapper that re-runs the hosts installer before launching common browsers.
@ -44,7 +44,7 @@ This repo automates Linux desktop bootstrap, hardening, and i3 setup. It’s pri
- Follow the sudo re-exec + idempotent install pattern from `setup_periodic_system.sh` and `./fixes/migrate_hosts_guard_to_guard_lib.sh`.
- Add new periodic behaviors as templates under `periodic_background/system-maintenance/bin` and `.../systemd`, then extend `setup_periodic_system.sh` to install/enable them.
- Extend package policy by updating `periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt` or by adding `check_for_<pkg>` + `prompt_for_<pkg>_challenge` blocks in the wrapper.
- Add package friction by adding `check_for_<pkg>` + `prompt_for_<pkg>_challenge` blocks in the wrapper (now in github.com/kuhyx/digital-wellbeing).
- Run `meta/shell_check.sh` to detect things to fix before committing.
## Detailed LLM Documentation

32
linux_configuration/docs/DOCS-pacman-security-layers.md
View File

@ -4,22 +4,22 @@
The pacman wrapper had two critical security vulnerabilities:
1. **Easy Policy Bypass**: Users could edit `pacman_greylist.txt` to remove "virtualbox", reinstall the wrapper, and bypass all restrictions.
1. **Easy Policy Bypass**: Users could edit the wrapper's helper libs (`pacman_lock_lib.sh`, `pw_*.sh`) to remove restrictions, reinstall the wrapper, and bypass them.
2. **VirtualBox Hosts Bypass**: VirtualBox VMs do not inherit the host's `/etc/hosts` file, allowing complete circumvention of content filtering inside VMs.
## Solution Overview
Implemented a **defense-in-depth** security architecture with multiple layers:
### Layer 1: Immutable Policy Files
### Layer 1: Immutable Lock Lib
- Policy files (`pacman_blocked_keywords.txt`, `pacman_greylist.txt`) are made immutable using `chattr +i`
- The lock lib (`pacman_lock_lib.sh`) is made immutable using `chattr +i`; the `pw_*.sh` libs are only checksummed
- Prevents casual editing without root access and knowledge of filesystem attributes
- Requires explicit `chattr -i` command to modify
### Layer 2: SHA256 Integrity Checks
- SHA256 checksums generated for all policy files during installation
- SHA256 checksums generated for the wrapper libs during installation
- Stored in `/var/lib/pacman-wrapper/policy.sha256` (also made immutable)
- **Every wrapper invocation** verifies file integrity before proceeding
- **Blocks all operations** if tampering is detected
@ -29,11 +29,11 @@ Implemented a **defense-in-depth** security architecture with multiple layers:
- VirtualBox detection is **compiled into the wrapper code**
- Cannot be bypassed by editing any text file
- Catches all packages matching `*virtualbox*` or `*vbox*` patterns
- More difficult challenge than standard greylist:
- 7-letter words (vs 6 for greylist)
- 150 words to memorize (vs 120)
- 120-second timeout (vs 90s)
- 45-second initial delay (vs 30s)
- Difficult word challenge:
- 7-letter words
- 150 words to memorize
- 120-second timeout
- 45-second initial delay
### Layer 4: VirtualBox Enforcement
@ -69,7 +69,7 @@ Implemented a **defense-in-depth** security architecture with multiple layers:
### What's Now Protected
✅ Policy files cannot be easily modified (immutable + checksums)
✅ Wrapper libs cannot be modified unnoticed (lock lib immutable, all libs checksummed)
✅ VirtualBox restrictions are hardcoded (cannot bypass via file editing)
✅ VMs inherit host's content filtering (DNS proxy + shared hosts)
✅ Tampering is immediately detected and blocked
@ -96,7 +96,7 @@ Tests verify:
- Integrity check function exists and is called early
- Hardcoded VirtualBox detection exists
- VirtualBox challenge function exists
- Policy files are made immutable
- The lock lib is made immutable
- VirtualBox enforcement is integrated
- Error handling is proper
@ -109,9 +109,9 @@ sudo ./install_pacman_wrapper.sh
This will:
1. Install wrapper and policy files
1. Install wrapper and wrapper libs
2. Generate SHA256 checksums
3. Make policy files immutable with `chattr +i`
3. Make the lock lib immutable with `chattr +i`
4. Install VirtualBox enforcement script
5. Set up automatic enforcement
@ -128,15 +128,15 @@ This will:
- Must complete difficult word challenge (7-letter words, 120s timeout)
- Enhanced warnings about security implications
- Automatic VM configuration after successful installation
- Cannot bypass by editing policy files
- Cannot bypass by editing wrapper libs
### For Updating Policies
If legitimate policy updates are needed:
```bash
sudo chattr -i /usr/local/bin/pacman_greylist.txt
sudo nano /usr/local/bin/pacman_greylist.txt
sudo chattr -i /usr/local/bin/pacman_lock_lib.sh
sudo nano /usr/local/bin/pacman_lock_lib.sh
cd periodic_background/digital_wellbeing/pacman
sudo ./install_pacman_wrapper.sh # Regenerates checksums
```

26
linux_configuration/docs/DOCS-pacman-wrapper-security.md
View File

@ -8,35 +8,35 @@ This document describes the security enhancements made to the pacman wrapper to
The original pacman wrapper had the following vulnerabilities:
1. **Easy Policy Bypass**: Users could edit `pacman_greylist.txt` or `pacman_blocked_keywords.txt` to remove restrictions, then reinstall the wrapper.
1. **Easy Policy Bypass**: Users could edit the wrapper's helper libs (`pacman_lock_lib.sh`, `pw_*.sh`) to remove restrictions, then reinstall the wrapper.
2. **VirtualBox Hosts Bypass**: VirtualBox VMs do not inherit the host machine's `/etc/hosts` file, allowing users to bypass content filtering within VMs.
3. **No Tamper Detection**: The wrapper had no mechanism to detect if policy files had been modified.
3. **No Tamper Detection**: The wrapper had no mechanism to detect if wrapper libs had been modified.
## Solutions Implemented
### 1. Policy File Integrity Checks
### 1. Wrapper Lib Integrity Checks
**File**: `periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh`
The installer now:
- Generates SHA256 checksums of all policy files during installation
- Generates SHA256 checksums of all wrapper libs during installation
- Stores checksums in `/var/lib/pacman-wrapper/policy.sha256`
- Makes the integrity file immutable using `chattr +i`
- Makes policy files (`pacman_blocked_keywords.txt`, `pacman_greylist.txt`) immutable
- Makes the lock lib (`pacman_lock_lib.sh`) immutable
**File**: `periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh`
The wrapper now:
- Verifies policy file integrity on **every invocation**
- Verifies wrapper lib integrity on **every invocation**
- Compares current file checksums against stored checksums
- **Blocks all operations** if tampering is detected
- Displays security warnings and instructs user to reinstall
**Benefits**:
- Cannot bypass restrictions by editing policy files
- Cannot bypass restrictions by editing wrapper libs
- Tampering is immediately detected and blocked
- Must use `chattr -i` (requires root) to modify files, making bypass harder
@ -44,7 +44,7 @@ The wrapper now:
**File**: `periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh`
Added hardcoded VirtualBox detection that **cannot be bypassed** by editing policy files:
Added hardcoded VirtualBox detection that **cannot be bypassed** by editing wrapper libs:
```bash
function is_virtualbox_package() {
@ -61,9 +61,9 @@ This function:
**Enhanced Challenge**:
- 7-letter words (harder than greylist's 6-letter words)
- 150 words to memorize (more than greylist's 120)
- 120-second timeout (longer than greylist's 90s)
- 7-letter words
- 150 words to memorize
- 120-second timeout
- 45-second initial delay (psychological friction)
- 30-50 second post-challenge delay
@ -128,13 +128,13 @@ The installer now:
### What's Protected
1. **Policy files cannot be easily modified**:
1. **Wrapper libs cannot be easily modified**:
- Immutable attribute prevents casual editing
- Requires `chattr -i` which requires root and knowledge
- Changes are detected on next wrapper invocation
2. **VirtualBox restrictions are hardcoded**:
- Cannot remove by editing policy files
- Cannot remove by editing wrapper libs
- Would require modifying the wrapper code itself
- Integrity checks would detect wrapper modification

17
linux_configuration/docs/pacman-wrapper/DOCS-testing-and-usage.md
View File

@ -28,22 +28,21 @@ sudo ./install_pacman_wrapper.sh
This will:
- Install the wrapper and policy files
- Install the wrapper and wrapper libs
- Generate integrity checksums
- Make policy files immutable
- Make the lock lib immutable
- Install VirtualBox enforcement script
### Updating Policy Files
### Updating Wrapper Libs
If you need to legitimately update policy files:
If you need to legitimately update wrapper libs:
```bash
# Remove immutable attribute
sudo chattr -i /usr/local/bin/pacman_blocked_keywords.txt
sudo chattr -i /usr/local/bin/pacman_greylist.txt
sudo chattr -i /usr/local/bin/pacman_lock_lib.sh
# Edit files as needed
sudo nano /usr/local/bin/pacman_greylist.txt
sudo nano /usr/local/bin/pacman_lock_lib.sh
# Reinstall wrapper to update checksums
cd periodic_background/digital_wellbeing/pacman
@ -78,7 +77,7 @@ sudo chmod +x /usr/local/bin/vbox_sync.sh
These enhancements follow the principle of **defense in depth**:
- **Layer 1**: Immutable policy files (prevents casual editing)
- **Layer 1**: Immutable lock lib (prevents casual editing)
- **Layer 2**: Integrity checksums (detects tampering)
- **Layer 3**: Hardcoded restrictions (cannot bypass via files)
- **Layer 4**: VirtualBox enforcement (prevents VM bypass)
@ -91,7 +90,7 @@ Each layer adds difficulty, making circumvention progressively harder while main
Potential improvements:
1. **Digital signatures**: Sign the wrapper script itself to detect modifications
2. **Remote policy updates**: Fetch policy files from a trusted source
2. **Remote updates**: Fetch wrapper libs from a trusted source
3. **Logging**: Log all wrapper invocations and challenges to detect patterns
4. **Time-based restrictions**: Different rules for different times/days
5. **Multi-factor challenges**: Combine word challenges with other verification methods

12
linux_configuration/docs/security-hardening/DOCS-01-current-state.md
View File

@ -80,20 +80,18 @@
**Files involved:**
- [periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh](../periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh) (823 lines)
- [periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt](../periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt)
- [periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh](../periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh)
**Current Protection:**
1. ✅ Policy file integrity verification (SHA256)
2. ✅ Blocked keywords list
3. ✅ Greylist with challenge
4. ✅ VirtualBox hardcoded check (cannot bypass via policy files)
5. ✅ Steam weekend-only restriction
1. ✅ Wrapper lib integrity verification (SHA256)
2. ✅ VirtualBox hardcoded check (cannot bypass via wrapper libs)
3. ✅ Steam weekend-only restriction
_Note: the package policy lists (blocked keywords, whitelist, greylist) were retired 2026-10-17; hosts/DNS blocking covers them._
**VULNERABILITIES IDENTIFIED:**
- ❌ **Google Chrome not blocked** - `google-chrome` and `google-chrome-stable` missing from blocked list
- ❌ No automatic LeechBlock installation when browsers are detected
- ❌ User can download `.deb`/`.tar.gz` and install manually

9
linux_configuration/docs/security-hardening/DOCS-03-implementation.md
View File

@ -57,16 +57,10 @@ Changes needed:
- Add input focus grabbing to prevent Alt+Tab escape
- Disable window close keyboard shortcuts
## 4. PACMAN WRAPPER - Chrome Block + LeechBlock Auto-Install
## 4. PACMAN WRAPPER - LeechBlock Auto-Install
Location: periodic_background/digital_wellbeing/pacman/
Changes needed to pacman_blocked_keywords.txt:
- Add: google-chrome
- Add: google-chrome-stable
- Add: chromium
- Add: ungoogled-chromium
New behavior in pacman_wrapper.sh:
- After ANY browser is detected installed (via pacman -Qq check):
- Automatically run install_leechblock.sh if it exists
@ -166,7 +160,6 @@ Modified files:
- hosts/guard/setup_hosts_guard.sh (add nsswitch protection)
- periodic_background/digital_wellbeing/setup_midnight_shutdown.sh (remove helpful messages)
- periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt (add chrome)
- periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh (leechblock auto-install)
- periodic_background/digital_wellbeing/block_compulsive_opening.sh (auto-close timer)
- periodic_background/digital_wellbeing/youtube-music-wrapper.sh (daemon integration)

17
linux_configuration/docs/security-hardening/DOCS-04-agent-personas.md
View File

@ -85,27 +85,22 @@ FILES YOU KNOW:
- periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh - Main wrapper (823 lines)
- periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh - Backs up real pacman
- periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt - Always blocked
- periodic_background/digital_wellbeing/pacman/pacman_whitelist.txt - Exceptions to keywords
- periodic_background/digital_wellbeing/pacman/pacman_greylist.txt - Challenge required
- periodic_background/digital_wellbeing/pacman/words.txt - Word scramble challenge words
- /var/lib/pacman-wrapper/policy.sha256 - Integrity checksums
KEY CONCEPTS:
- Real pacman at /usr/bin/pacman.orig, wrapper symlinked to /usr/bin/pacman
- Policy integrity verification via SHA256 before ANY operation
- Three tiers: blocked (always denied), greylist (challenge), whitelist (bypass)
- VirtualBox check is HARDCODED (cannot bypass via policy files)
- Wrapper lib integrity verification via SHA256 before ANY operation
- Package policy lists (blocked/greylist/whitelist) were retired 2026-10-17; hosts/DNS blocking covers them
- VirtualBox check is HARDCODED (cannot bypass via wrapper libs)
- Steam is weekend-only with word scramble challenge
POLICY ENFORCEMENT:
1. Load policy lists from text files
2. Verify integrity hashes match
3. Check if package matches blocked keywords (unless whitelisted)
4. Check if greylisted (requires challenge)
5. After transaction, remove any blocked packages that got installed
1. Verify integrity hashes match
2. Apply the hardcoded checks (VirtualBox challenge, Steam weekend challenge)
3. Auto-install LeechBlock when a browser is installed
HOSTS INTEGRATION:

12
linux_configuration/docs/security-hardening/DOCS-05-llm-readmes.md
View File

@ -68,14 +68,13 @@ Intercept pacman to enforce package installation policies.
````
## Policy Files
## Files
| File | Purpose |
|------|---------|
| pacman_blocked_keywords.txt | Substring match = always blocked |
| pacman_whitelist.txt | Exact names that bypass blocking |
| pacman_greylist.txt | Requires challenge to install |
| words.txt | Word scramble challenge source |
_Package policy lists (blocked keywords, whitelist, greylist) were retired 2026-10-17; hosts/DNS blocking covers them._
## Hardcoded Checks (cannot bypass via files)
- VirtualBox → security challenge + hosts enforcement
- Steam → weekend-only + word scramble
@ -85,11 +84,8 @@ Intercept pacman to enforce package installation policies.
2. Periodic maintenance (auto-setup if missing)
3. VirtualBox hosts enforcement
## Adding Blocks
## Updating the wrapper
```bash
# Edit the blocked keywords file
echo "newpackage" >> pacman_blocked_keywords.txt
# Re-run installer to update checksums
sudo ./install_pacman_wrapper.sh
````

9
linux_configuration/docs/security-hardening/DOCS-06-test-template.md
View File

@ -50,13 +50,6 @@ else
test_result "pacman wrapper installed" "fail"
fi
# Test 5: google-chrome is blocked
if grep -qi "google-chrome" ~/src/testsAndMisc/linux_configuration/scripts/periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt; then
test_result "google-chrome in blocked list" "pass"
else
test_result "google-chrome in blocked list" "fail"
fi
# Summary
echo ""
echo "=========================================="
@ -75,6 +68,6 @@ This analysis identifies critical vulnerabilities and provides a comprehensive i
1. **nsswitch.conf bypass** - Completely unprotected, defeats all hosts protections
2. **Information disclosure** - Shutdown system tells users how to bypass
3. **App lifetime** - Compulsive blockers don't limit session duration
4. **Browser gaps** - Chrome not blocked, no LeechBlock auto-install
4. **Browser gaps** - no LeechBlock auto-install
The implementation prompt above should be used in a focused coding session to address all issues systematically.

12
linux_configuration/periodic_background/lib/services_browser.sh
View File

@ -72,14 +72,12 @@ check_vbox_hosts() {
local issues=()
# Only check if VirtualBox is installed.
# This is NOT "skipped" in the sense of ducking a check: VirtualBox is absent
# AND deliberately blocked by pacman policy — pacman_blocked_keywords.txt lists
# virtualbox/vbox with the comment "can bypass /etc/hosts restrictions", which
# is the very thing this check enforces. With no VirtualBox there are no VMs to
# enforce /etc/hosts inside, so the check is genuinely not applicable. Report
# n/a so it reads as deliberate rather than something that got ducked.
# This is NOT "skipped" in the sense of ducking a check: with no VirtualBox
# there are no VMs to enforce /etc/hosts inside, so the check is genuinely not
# applicable. Report n/a so it reads as deliberate rather than something that
# got ducked.
if ! command -v VBoxManage &>/dev/null; then
note "VirtualBox not installed (blocked by pacman policy) — not applicable"
note "VirtualBox not installed — not applicable"
set_service_status "vbox_hosts" "n/a"
return
fi

8
linux_configuration/periodic_background/lib/services_wrappers.sh
View File

@ -50,13 +50,11 @@ check_pacman_wrapper() {
fi
# Check supporting files
for file in words.txt pacman_blocked_keywords.txt pacman_whitelist.txt; do
if [[ -f "${SYSROOT}/usr/local/bin/$file" ]]; then
msg "Supporting file exists: ${SYSROOT}/usr/local/bin/$file"
if [[ -f "${SYSROOT}/usr/local/bin/words.txt" ]]; then
msg "Supporting file exists: ${SYSROOT}/usr/local/bin/words.txt"
else
warn "Supporting file missing: ${SYSROOT}/usr/local/bin/$file"
warn "Supporting file missing: ${SYSROOT}/usr/local/bin/words.txt"
fi
done
# Content drift — the check everything above misses. A correct symlink and a
# present file say nothing about WHICH version is deployed.

4
linux_configuration/periodic_background/lib/tests/test_services_wrappers.sh
View File

@ -23,8 +23,6 @@ stage_pacman_ok() {
sysfile usr/bin/pacman.orig
ln -sf "${SERVICES_ROOT}/usr/local/bin/pacman_wrapper" "${SERVICES_ROOT}/usr/bin/pacman"
sysfile usr/local/bin/words.txt
sysfile usr/local/bin/pacman_blocked_keywords.txt
sysfile usr/local/bin/pacman_whitelist.txt
(cd "${SERVICES_ROOT}" && sha256sum usr/local/bin/pacman_wrapper >"$PACMAN_WRAPPER_MANIFEST")
}
@ -110,7 +108,7 @@ _t_called 'ran install_pacman_wrapper' "a missing .orig backup runs the installe
echo "== check_pacman_wrapper: missing supporting files only warn =="
reset_state
stage_pacman_ok
sysrm usr/local/bin/words.txt usr/local/bin/pacman_whitelist.txt
sysrm usr/local/bin/words.txt
run_pacman_check >"${TEST_TMPDIR}/out.txt"
_t_called_in "$(cat "${TEST_TMPDIR}/out.txt")" "Supporting file missing" "a missing supporting file is reported"
_t_not_called 'ran install_pacman_wrapper' "but it does not trigger a reinstall"