Merge remote-tracking branch 'origin/master' into flea-0.3.5

pkgbuilds/flea/.omarchy/upstream.sh

@@ -1,6 +1,12 @@
 #!/bin/bash
 # Verify Flea's published source archive against its checksum manifest when a
-# newer stable release exists, then check its root and required security fixes.
+# newer stable release exists, then check its root.
+#
+# Through 0.1.x this also grepped the source for the upstream security fixes
+# Omarchy once carried as patches, so the package could not move to a release
+# that lacked them. Every release since 0.1.5 has had them, and matching
+# literal source lines only ever caught renames (#488, 0.3.5's
+# open_if_regular_with_meta), never a regression.
 set -euo pipefail
 
 REPO='thisisgm/flea'
@@ -74,38 +80,6 @@ if [[ $served_roots != "$expected_root" ]]; then
   exit 1
 fi
 
-archive_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/archive.rs")
-archiveops_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/archiveops.rs")
-run_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/run.rs")
-archivereq_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/archivereq.rs")
-archivework_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/archivework.rs")
-mediaprobe_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/mediaprobe.rs")
-metareq_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/metareq.rs")
-sharelink_qml=$(tar -xOzf "$tarball" "$expected_root/ui/ShareLink.qml")
-copyfile_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/copyfile.rs")
-regfile_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/regfile.rs")
-
-# Every check below pins a literal line except the O_NOFOLLOW one. That check
-# guards a property -- the copy opens its source with O_NOFOLLOW, so a symlink
-# swapped in cannot redirect the read -- and pinning the exact call expression
-# made it assert the spelling instead. v0.3.0 moved the first argument from
-# `src` to `src.at` when directory-relative opens landed, kept O_NOFOLLOW, and
-# hardened symlink handling further; the literal still refused it. Match the
-# call and the flag together so a rename cannot read as a removed fix, while
-# dropping O_NOFOLLOW still fails.
-if ! grep -Fq 'a.push("--".to_string());' <<<"$archive_rs" ||
-  ! grep -Fq 'let input = std::fs::canonicalize(input)' <<<"$archiveops_rs" ||
-  ! grep -Fq 'if op != "compress" && op != "extract"' <<<"$run_rs$archivereq_rs" ||
-  ! grep -Fq 'the sandbox is unavailable: bwrap or prlimit is not on PATH' <<<"$archivework_rs" ||
-  ! grep -Fq 'if !sandbox::available()' <<<"$mediaprobe_rs" ||
-  ! grep -Fq 'if !sandbox::available()' <<<"$metareq_rs" ||
-  ! grep -Fq 'copyToClipboard.command = ["wl-copy", url]' <<<"$sharelink_qml" ||
-  ! grep -Eq 'open_if_regular\(.*O_NOFOLLOW' <<<"$copyfile_rs" ||
-  ! grep -Fq '.custom_flags(O_NONBLOCK | extra_flags)' <<<"$regfile_rs"; then
-  printf 'Release %s does not contain every required upstream security fix\n' "$best_tag" >&2
-  exit 1
-fi
-
 jq -n \
   --arg pkgver "$best_version" \
   --arg published_at "$best_published_at" \

pkgbuilds/flea/PKGBUILD

@@ -116,7 +116,12 @@ check() {
   # back to the next create, so on the builder's /tmp the stranger is
   # identical and undo walks it back. tmpfs allocates inode numbers from a
   # counter and never reuses one, which is what the test assumes.
+  # copymanifest's garbage-stream test opens its O_TMPFILE manifest in its
+  # own test dir; the module's other tests must stay off tmpfs, because
+  # Writer::create wants a runtime dir on a different filesystem from the
+  # copy and finds none when both live on /dev/shm.
   local -a filesystem_tests=(
+    backend::copymanifest::tests::a_garbage_stream_falls_back_with_the_tree_untouched
     backend::menu_actions::tests::
     backend::menudelete::tests::
     backend::redo::tests::