mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 16:14:12 +01:00
Krzysztof kuhy Rudnicki
0aa78ea7aa
transcribe.sh 473 -> 39, setup_activitywatch.sh 457 -> 102 and setup_wireguard_ssh.sh 464 -> 136. enforce_vbox_hosts.sh is reverted: its seam landed inside a heredoc and the resulting lib had an unterminated here-document. That is the worst failure yet, because shellcheck reported it only as SC1094 on the caller - which reads like a nicety, not a file that will not parse. The verifier now runs bash -n over every lib before linting the entry and names the offending file; proven by corrupting a copy and restoring it. Also guarded a cd before `git clone ... .`, which would otherwise have cloned an AUR repo into the caller's directory. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
50 lines
3.5 KiB
JSON
50 lines
3.5 KiB
JSON
{
|
|
"intent": "Split three more linux_configuration scripts, and harden the verifier after a split silently corrupted a file.",
|
|
"scope": [
|
|
"misc/testsAndMisc-bash/transcribe.sh (473 -> 39) + transcribe_pkgmgr, transcribe_deps, transcribe_venv",
|
|
"single_use/features/setup_activitywatch.sh (457 -> 102) + aw_install, aw_service, aw_autostart",
|
|
"single_use/features/setup_wireguard_ssh.sh (464 -> 136) + wg_keys, wg_firewall, wg_sshd",
|
|
"meta/scripts/verify_shell_split.sh (lib parse check moved ahead of the entry lint)",
|
|
"Deferred and fully restored: virtualbox/enforce_vbox_hosts.sh (443)",
|
|
"Non-goal: no script executed"
|
|
],
|
|
"changes": [
|
|
"Nine libs across three scripts, each needing a second carve after the first pass.",
|
|
"enforce_vbox_hosts.sh was reverted because the split landed INSIDE a heredoc: the resulting lib had an unterminated here-document and bash -n rejected it outright. This is the first split in the whole effort to produce a file that does not parse, and it is the most dangerous failure mode yet - shellcheck reported it only as SC1094 'parsing of sourced file failed' on the caller, which reads like a linting nicety rather than a broken file.",
|
|
"The verifier now runs bash -n over every lib BEFORE linting the entry, and names the offending lib with a hint about heredocs. Proven in both directions on a deliberately corrupted copy.",
|
|
"Fixed another unguarded cd, this one before `git clone ... .` - a failed cd would have cloned an AUR repo into the caller's working directory.",
|
|
"ALLOW_WEB and ALLOW_DNS are declared in the entry, set by the arg parser in one lib and read by the ruleset builder in another; exported, which is what SC2034 asks for and makes the three-way contract explicit."
|
|
],
|
|
"verification": [
|
|
{
|
|
"command": "meta/scripts/verify_shell_split.sh per script",
|
|
"result": "fail then pass",
|
|
"evidence": "All three now report 'libs sourced, functions defined'. Four real failures on the way: chained libs in all three, the unguarded cd, the exported flags, and the vbox heredoc corruption."
|
|
},
|
|
{
|
|
"command": "append an unterminated heredoc to a lib, re-run the verifier, restore",
|
|
"result": "pass",
|
|
"evidence": "Reports the here-document parse failure and exits non-zero; passes again once restored. Tested in both directions, because a check that never fires is worse than none."
|
|
},
|
|
{
|
|
"command": "git checkout HEAD -- enforce_vbox_hosts.sh, rm its lib dir, bash -n and shellcheck -x",
|
|
"result": "pass",
|
|
"evidence": "Restored to 443 lines, parses and lints clean."
|
|
},
|
|
{
|
|
"command": "pre-commit run --files <13 changed files>",
|
|
"result": "pass",
|
|
"evidence": "Clean, including shellcheck over each lib in isolation."
|
|
}
|
|
],
|
|
"risks": [
|
|
"None of the three was run: they install CUDA runtimes and AUR packages, start user services, and rewrite sshd and nftables configuration.",
|
|
"The heredoc failure means the function-boundary heuristic the splitter uses is not safe on files with heredocs at top level. bash -n now catches it, but only after the fact - the splitter itself still has no awareness of heredocs.",
|
|
"enforce_vbox_hosts.sh stays at 443 lines and needs a seam chosen by hand, outside any heredoc."
|
|
],
|
|
"rollback": [
|
|
"git revert the commit; the three scripts return to their previous sizes, the nine libs disappear, and the verifier loses its parse check.",
|
|
"After rollback, re-run bash -n and shellcheck on the restored scripts."
|
|
]
|
|
}
|