The layout check skips comments, but the already-fixed check matched `include system-auth` anywhere on a line, so a comment such as `# auth include system-auth` made the migration skip a stack that still listed bare pam_unix, and it was marked complete with the lockout still missing.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`sudo tee` truncates the live PAM file before writing it, so a migration interrupted in between left /etc/pam.d/polkit-1 empty; the next run then failed the layout check, exited 0, and was marked complete with polkit authentication broken. sed -i writes a temporary file and renames it into place, as the setup commands already do, so the original stays intact until the rewrite is whole and a failed sed needs no restore.
The test's broken-write stub now empties the file instead of discarding the write, so the restore assertion fails if the restore is removed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Codex Medium <noreply@openai.com>
Address review feedback on the polkit faillock migration:
- Match only the exact stack the setup commands wrote and replace just the bare
pam_unix lines, preserving comments and the hardware-auth lines. An
administrator-authored polkit-1 carrying any other directive is left
untouched, rather than rebuilt from scratch.
- Also repair the markerless post-removal layout: both remove commands strip
their own marker lines but leave the bare pam_unix stack behind, so keying on
a hardware-auth marker skipped those machines permanently.
- Exit non-zero when the backup cannot be created or the rewrite cannot be
verified (after restoring). omarchy-migrate runs under set -e and records a
migration complete unconditionally after it returns, so a failed repair must
fail loudly to be retried instead of silently marked done.
- Add test/shell.d/security-polkit-migration-test.sh covering the fingerprint,
FIDO2, combined, and markerless layouts, comment preservation, idempotence, an
untouched administrator stack, and the refused-sudo and unverifiable-write
failure paths.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
