mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 15:34:06 +01:00
Krzysztof kuhy Rudnicki
0734e06ca5
fresh-install/main.sh calls git clone against live AUR URLs, makepkg, and curl -- none of which belong in the default stub set, since plenty of scripts read git state harmlessly and a blanket git stub would change what they see rather than protect anything. --stub git,curl,makepkg shadows them for one run. Verified: both calls are captured in the trace with no repo cloned and no network hit, and the two regression fixtures still behave (exit 1 for the set -e tail, four circular-name-reference warnings for the nameref). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
42 lines
2.1 KiB
JSON
42 lines
2.1 KiB
JSON
{
|
|
"intent": "Let trace_shell_split.sh shadow additional binaries per run, so scripts that clone from AUR or build packages can be traced without touching the network or the package set.",
|
|
"scope": [
|
|
"meta/scripts/trace_shell_split.sh",
|
|
"Non-goal: git/curl/wget/makepkg are deliberately not added to the default set"
|
|
],
|
|
"changes": [
|
|
"Rename STUBBED_COMMANDS to DEFAULT_STUBBED_COMMANDS and add a --stub a,b,c flag whose names are shadowed for that run only.",
|
|
"Document why git and friends stay out of the default set: many scripts read git state harmlessly, so a blanket stub would change what they observe rather than protect anything."
|
|
],
|
|
"verification": [
|
|
{
|
|
"command": "trace_shell_split.sh on a fixture calling `git clone` and `curl`, with --stub git,curl,makepkg",
|
|
"result": "pass",
|
|
"evidence": "Trace captured 'git clone https://example.com/repo.git' and 'curl -sL https://example.com/x'; stdout reached 'reached the end'. No repository was cloned and no request left the machine."
|
|
},
|
|
{
|
|
"command": "Regression: the `set -e` function-tail fixture",
|
|
"result": "pass",
|
|
"evidence": "Still exit status 1 with an empty trace and no stdout -- the --stub change did not weaken detection."
|
|
},
|
|
{
|
|
"command": "Regression: the self-referencing nameref fixture",
|
|
"result": "pass",
|
|
"evidence": "Still four 'circular name reference' warnings captured in stderr."
|
|
},
|
|
{
|
|
"command": "shellcheck meta/scripts/trace_shell_split.sh; shfmt -d meta/scripts/trace_shell_split.sh",
|
|
"result": "pass",
|
|
"evidence": "Both exit 0 with no output."
|
|
}
|
|
],
|
|
"risks": [
|
|
"A caller who forgets --stub for a script that shells out to git or curl gets a real clone or a real request. The header comment tells the reader to grep for network and build verbs first; that remains a human step.",
|
|
"IFS-splitting the --stub value means a binary name containing a comma cannot be passed, which no real binary does."
|
|
],
|
|
"rollback": [
|
|
"Revert the commit; the harness returns to a fixed default stub list.",
|
|
"Re-run the three fixtures and confirm the same exit statuses."
|
|
]
|
|
}
|