ZacharyZhang-NY/omarchy
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reach the migration's helper through $OMARCHY_PATH rather than by name

Browse Source 
By name, the sudo call resolved through secure_path, which puts /usr/local/bin ahead of /usr/bin and falls back to the caller's PATH where no secure_path is set, so an install could run a different helper than the pinned path did. $OMARCHY_PATH/bin is the package's symlink into /usr/bin on an install and the checkout under a dev link, so neither PATH nor secure_path takes part.

Co-Authored-By: Codex XHigh <noreply@openai.com>
This commit is contained in:
Spencer BullandCodex XHigh committed 2026-09-26 14:49:34 -05:00
1 parent 2ffae36a18
commit 92ef7e9407
2 files changed
+9 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

migrations/1788163635.sh
+5 -4
View File
@@ -1,8 +1,9 @@
echo "Remove legacy temporary passwordless sudo grants" echo "Remove legacy temporary passwordless sudo grants"
# Migration queues are per-user; the privileged repair is once per machine. # Migration queues are per-user; the privileged repair is once per machine.
# By name: secure_path resolves /usr/bin on an install and the checkout under a # The helper beside this migration: the package's /usr/bin copy on an install,
# dev link, where the installed package may predate __migrate. # and under a dev link the checkout's, which may be newer than the package.
if ! omarchy-sudo-passwordless __migration-complete; then helper="$OMARCHY_PATH/bin/omarchy-sudo-passwordless"
sudo omarchy-sudo-passwordless __migrate if ! "$helper" __migration-complete; then
sudo "$helper" __migrate
fi fi
test/shell.d/passwordless-grant-lifecycle-test.sh
+4 -4
View File
@@ -44,11 +44,11 @@ pass "legacy cleanup removes generated rules for any account and quarantines eve
# Run the actual migration queue for separate temporary homes. Sudo only calls # Run the actual migration queue for separate temporary homes. Sudo only calls
# the mapped helper and can be refused without requesting host authorization. # the mapped helper and can be refused without requesting host authorization.
# The migration names the helper rather than a path, so both of its calls reach # The migration reaches the helper through $OMARCHY_PATH, as the package's bin
# the mapped copy through PATH, as they reach a dev checkout's through the link. # links and a dev checkout provide it, so the mapped copy stands in there.
mkdir -p "$test_tmp/source/migrations" mkdir -p "$test_tmp/source/migrations" "$test_tmp/source/bin"
cp "$ROOT/migrations/1788163635.sh" "$test_tmp/source/migrations/" cp "$ROOT/migrations/1788163635.sh" "$test_tmp/source/migrations/"
ln -s ../omarchy-sudo-passwordless "$test_tmp/bin/omarchy-sudo-passwordless" ln -s "$test_tmp/omarchy-sudo-passwordless" "$test_tmp/source/bin/omarchy-sudo-passwordless"
printf 'echo "later migration ran"\n' >"$test_tmp/source/migrations/1788163636.sh" printf 'echo "later migration ran"\n' >"$test_tmp/source/migrations/1788163636.sh"
run_migrations() { run_migrations() {
TEST_MIGRATION=1 OMARCHY_PATH="$test_tmp/source" OMARCHY_MIGRATION_STATE="$test_tmp/$1" \ TEST_MIGRATION=1 OMARCHY_PATH="$test_tmp/source" OMARCHY_MIGRATION_STATE="$test_tmp/$1" \