mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 22:34:02 +01:00
Krzysztof kuhy Rudnicki
4eedc17b17
The 316-line installer was 66 over the 250-line cap. The managed-copy helpers, the /usr/local/bin install step, the integrity + drift manifest, and the immutability/LeechBlock/VirtualBox payloads move into a sibling lib/, leaving a 128-line entry. What stays in the entry is chosen by what the harness can execute, not by taste. `--bind-abs /usr/bin` removes the directory bwrap needs to exec anything, so the trace stops at `ln -sf ... /usr/bin/pacman` with exit 1 on EPERM. That line onwards, plus the `if [ ! -L /usr/bin/pacman ]` backup branch whose guard is false on this machine, therefore never run under trace — moving them would have shipped code no diff could check. They stay put. Everything else is proven: the before/after traces are identical, including all 16 generated-file hashes. pacman_wrapper at 548fc2b53ee4cea6 is the one that matters most — it is post-`sed -i`, so it catches a reorder of the rewrite relative to the copy. The path definitions stay in the entry too, for a linter reason rather than a runtime one: a definitions-only lib assigns without referencing, which is SC2034 on 36 variables, and suppressions are not allowed. Libs that only reference globals are fine. `export` would have silenced it while leaking 40 variables into every child process, which the trace cannot see. Eight assertions across two test libs grep the installer's source text; five needed widening to search entry+lib/. TEST 9's `chattr +i` grep caught the move as a genuine failure first, which is what prompted enumerating the rest. No assertion was weakened. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
21 lines
3.1 KiB
JSON
21 lines
3.1 KiB
JSON
{
|
|
"title": "Split install_pacman_wrapper.sh under the 250-line cap",
|
|
"objective": "Bring linux_configuration/scripts/periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh (316 lines) under the repo-wide 250-line file cap by moving its middle steps into a sibling lib/, with byte-identical runtime behaviour proven by an executed before/after trace, and without relocating any statement the trace harness cannot reach.",
|
|
"acceptance_criteria": [
|
|
"install_pacman_wrapper.sh and all four new lib/*.sh files are each at most 250 lines.",
|
|
"meta/scripts/trace_shell_split.sh with the four required --bind-abs flags produces an identical trace before and after: same exit status (1, at the unbindable /usr/bin symlink), same stubbed call, and all 16 generated-file content hashes unchanged -- notably pacman_wrapper at sha=548fc2b53ee4cea6, which proves the sed -i still runs after the copy, and source.sha256 at sha=4c928a499d437070.",
|
|
"Nothing that was moved into a lib sits at or after the ln -sf /usr/bin/pacman line, nor inside the `if [ ! -L /usr/bin/pacman ]` backup branch, since neither executes under the harness.",
|
|
"linux_configuration/tests/test_pacman_wrapper_security.sh produces output byte-identical to its pre-split run, with all of its installer source-text assertions intact and none weakened.",
|
|
"shellcheck clean at the real gate (pre-commit run shellcheck) and shfmt clean on every touched file, with zero suppressions -- no # shellcheck disable, no per-file ignores, and no `export` used to silence SC2034.",
|
|
"The verification runs write nothing outside the trace prefix: /usr/bin/pacman still symlinks to /usr/local/bin/pacman_wrapper and `pacman --version` still works."
|
|
],
|
|
"out_of_scope": [
|
|
"Any behaviour change, including reordering the sed -i relative to the wrapper copy.",
|
|
"Weakening any assertion in test_pacman_wrapper_security.sh or its libs; only the search PATH of installer source-text greps may widen to include lib/.",
|
|
"The pre-existing single failure in test_security_hardening.sh ('Compulsive block wrappers installed'), which fails identically at HEAD and belongs to block_compulsive_opening.sh -- explicitly out of scope.",
|
|
"Fixing the pre-existing repo-wide jscpd overage caused by vendored .venv site-packages.",
|
|
"Wiring the file-length pre-commit hook -- it must land last."
|
|
],
|
|
"verifier": "meta/scripts/trace_shell_split.sh install_pacman_wrapper.sh --prefix <fresh-empty-dir> --bind-abs /usr/local/bin --bind-abs /usr/local/share/digital_wellbeing --bind-abs /usr/local/share/digital_wellbeing/virtualbox --bind-abs /var/lib/pacman-wrapper, captured at HEAD and again after the split, then diff of the two traces (must be empty); diff of test_pacman_wrapper_security.sh output before and after (must be empty); diff of test_security_hardening.sh output before and after (must be empty, both exit 1); pre-commit run shellcheck --files <all touched>; shfmt -d; jscpd as the git hook runs it, measured in a clean worktree with the changes applied; bash ~/utils/scripts/check_file_length.sh --all; ls -la /usr/bin/pacman plus pacman --version."
|
|
}
|