mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 12:27:50 +01:00
Krzysztof kuhy Rudnicki
66c4698194
Some checks failed
Pre-commit checks / pre-commit (push) Has been cancelled
Replaces the bespoke chattr/bind-mount/systemd-watcher implementations for /etc/hosts and /etc/shutdown-schedule.conf with the new shared guard-lib (~/guard-lib, guardctl), so screen-locker and steam-backlog-enforcer's new block-gaming feature stop maintaining parallel copies of the same tamper-resistance mechanism. - pacman_wrapper.sh: pre/post hook fallbacks now call guard-lib's generic unlock-all/relock-all scripts (covers every registered guard instance, not just /etc/hosts) - setup_midnight_shutdown.sh: installs/updates its guarded config via guardctl file-guard instead of hand-rolled chattr + systemd unit generation; the schedule ratchet logic (block-if-more-lenient) stays bespoke since guardctl's generic unlock can't represent it - new hosts/guard/plugins/nsswitch-plugin.sh, resolved-plugin.sh Also fixes, at user's request even though pre-existing: 3 shellcheck SC2329 false positives in pacman_wrapper.sh (functions invoked indirectly by name, not actually dead) and 1 SC2001 style warning (echo|sed VM-name extraction replaced with parameter expansion, verified equivalent output). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AFNiYQQgSLAkiBXswyimPq
47 lines
3.2 KiB
JSON
47 lines
3.2 KiB
JSON
{
|
|
"intent": "Replace hosts-guard/shutdown-schedule-guard's bespoke chattr/bind-mount/systemd-watcher implementations with the shared guard-lib (guardctl) primitives.",
|
|
"scope": [
|
|
"linux_configuration/scripts/periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh",
|
|
"linux_configuration/scripts/periodic_background/digital_wellbeing/setup_midnight_shutdown.sh",
|
|
"linux_configuration/scripts/periodic_background/hosts/guard/plugins/nsswitch-plugin.sh (new)",
|
|
"linux_configuration/scripts/periodic_background/hosts/guard/plugins/resolved-plugin.sh (new)"
|
|
],
|
|
"changes": [
|
|
"Renamed pacman_wrapper.sh's hosts-only pre/post hook fallback functions to call guard-lib's generic unlock-all/relock-all scripts (covers hosts, nsswitch, resolved, shutdown-schedule from one place)",
|
|
"setup_midnight_shutdown.sh now installs/updates its guarded config via guardctl file-guard (install, canonical-path, status) instead of hand-writing chattr calls and systemd path/service units",
|
|
"Added nsswitch-plugin.sh / resolved-plugin.sh guard hooks for the hosts-file guard's dependent configs",
|
|
"Fixed 3 pre-existing shellcheck SC2329 false positives in pacman_wrapper.sh (load_policy_lists, is_blocked_package_name, is_greylisted_package_name, is_steam_package are invoked indirectly by name, not misses) with disable comments explaining the indirect-call pattern",
|
|
"Fixed a pre-existing SC2001 style warning: replaced an echo|sed VM-name extraction with bash parameter expansion (${line#\"}/${vm_name%%\"*}), verified to produce identical output"
|
|
],
|
|
"verification": [
|
|
{
|
|
"command": "shellcheck <all 4 changed files>",
|
|
"result": "pass",
|
|
"evidence": "0 warnings/errors, including the 3 previously-flagged SC2329 and 1 SC2001 findings"
|
|
},
|
|
{
|
|
"command": "bash -n <all 4 changed files>",
|
|
"result": "pass",
|
|
"evidence": "syntax OK on all 4 files"
|
|
},
|
|
{
|
|
"command": "pre-commit run --files <changed files + this evidence/contract pair>",
|
|
"result": "pass",
|
|
"evidence": "All hooks passed (ai-evidence-contract, ai-multifile-contract, shellcheck, codespell, secret scan, etc.)"
|
|
},
|
|
{
|
|
"command": "live verification of the guard-lib migration end-to-end",
|
|
"result": "pass",
|
|
"evidence": "Performed in steam-backlog-enforcer's block-gaming feature session: guardctl file-guard sync/pacman-unlock round-trips confirmed live against /etc/hosts, and a real 1-day block-gaming test run exercised the shared guard-lib package-block + file-guard primitives this migration depends on"
|
|
}
|
|
],
|
|
"risks": [
|
|
"setup_midnight_shutdown.sh's create_config_guard() now hard-requires guardctl on PATH; if ~/guard-lib isn't installed on a fresh machine, first run will error instead of silently falling back",
|
|
"test_pacman_wrapper_security.sh already referenced a stale pre-reorg path (scripts/digital_wellbeing/... instead of scripts/periodic_background/digital_wellbeing/...) before this change and still does - not fixed here, out of scope"
|
|
],
|
|
"rollback": [
|
|
"git revert the commit",
|
|
"Re-run setup_midnight_shutdown.sh's old chattr-based path if guard-lib is removed (not needed unless guard-lib itself is rolled back)"
|
|
]
|
|
}
|