mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-14 20:00:48 +01:00
Krzysztof kuhy Rudnicki
f6356d4725
Shell redirections are builtins, so no PATH stub can intercept `cat > /etc/modprobe.d/x.conf`. That left installer scripts unverifiable: stub cp/chmod/ln and the trace is nearly empty, don't and the run rewrites the live system. --prefix redirects HOME and every XDG_* base into a temp tree. XDG_DATA_HOME is exported explicitly, not left to default off HOME: install_leechblock.sh reads it directly and then runs `rsync -a --delete` at it. --bind-abs binds hardcoded absolutes via bwrap --unshare-user --uid 0, leaf directories only. uid 0 is load-bearing beyond permissions: common.sh's require_root does `exec sudo "$0"`, and under the sudo stub that truncated the whole run to one recorded call -- a trace that diffs clean against any split. Binding /etc wholesale was measured to shadow /etc/passwd, collapse $SUDO_USER to /home//, and mask a nested bind, so the scanner never emits it. The trace gains a manifest of every file written, with content hashes. That section is the point: with it, a dropped write in the fixture pair is a one-line diff; with it stripped, the two traces are identical, i.e. the old harness passed that broken split. Hashes normalize the prefix to @PREFIX@ because install_usage_monitoring.sh writes an unquoted heredoc that bakes $HOME into the artifact. Verified: ~/.config/systemd/user, ~/.local/bin, ~/.local/share and /etc/modprobe.d byte-identical before and after; usage-report units still 2. The three prior regressions are now committed fixtures rather than ad-hoc -- one was silently neutered mid-change when a trailing echo added for SC2034 became the function's last statement and turned exit 1 into exit 0. Stub generation moved to lib/ because --prefix pushed the harness to 252 lines, over the cap it exists to serve. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY |
||
|---|---|---|
| .. | ||
| fixtures | ||
| lib | ||
| run_all | ||
| _schema_validation.py | ||
| _session_autopsy_mutations.py | ||
| check_agent_contract.sh | ||
| check_ai_evidence.sh | ||
| check_append_only_sessions.sh | ||
| check_no_binaries.sh | ||
| check_no_dufs_conf.sh | ||
| check_no_inline_python.sh | ||
| check_no_secrets.sh | ||
| check_polling_antipatterns.sh | ||
| check_python_location.sh | ||
| check_requirements_sync.py | ||
| ci_mirror.sh | ||
| disk_cleanup_check.sh | ||
| init_agent_artifacts.sh | ||
| install_hooks.sh | ||
| makepkg-manual-dlagent.sh | ||
| mutate_session_autopsy_hooks.py | ||
| optimize_vscode.py | ||
| pytest_changed_packages.py | ||
| run_prettier_capped.sh | ||
| run_with_heavy_lock.sh | ||
| trace_shell_split.sh | ||
| validate_contract.py | ||
| validate_evidence.py | ||
| verify_shell_split.sh | ||