ZacharyZhang-NY/omarchycn
3
4
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases 5 Wiki Activity

Restore strict migration ordering

Browse Source
This commit is contained in:
acrogenesis
2026-08-29 22:42:33 -06:00
parent 4d697a063c
commit f91d2e5453
9 changed files with 110 additions and 156 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/shell.d/fixtures/privileged-heredoc/shutdown-unit-home-execstop.sh
+1 -1
View File
@@ -1,4 +1,4 @@
#!/usr/bin/env bash
#!/bin/bash
# Install Plymouth package
echo "Installing Plymouth..."
test/shell.d/legacy-power-udev-rules-migration-test.sh
+44 -17
View File
@@ -105,7 +105,8 @@ pass "migration removes a Wi-Fi power save rule that runs out of a user home"
fail "migration reloads udev after removing a rule" "$(cat "$CALLS")"
pass "migration reloads udev after removing a rule"
# Both files gone is still one machine-wide reload, not one per file.
# Reload each removed rule immediately, so a later failure cannot leave an
# already-deleted rule active in udevd.
reset_machine
write_vulnerable_power_rule
write_vulnerable_wifi_rule
@@ -113,9 +114,9 @@ run_migration
[[ ! -e $power_rule && ! -e $wifi_rule ]] ||
fail "migration removes both legacy rules in one pass"
(( $(reload_count) == 1 )) ||
fail "migration reloads udev once for both removals" "$(cat "$CALLS")"
pass "migration removes both legacy rules and reloads udev once"
(( $(reload_count) == 2 )) ||
fail "migration reloads udev after each removal" "$(cat "$CALLS")"
pass "migration removes both legacy rules and reloads after each one"
# The second run is what every other account on the machine does, and what a
# user gets from running omarchy-migrate again.
@@ -210,29 +211,55 @@ run_migration
fail "migration removes another user's rule rooted outside /home" "$(cat "$wifi_rule")"
pass "migration removes another user's rule rooted outside /home"
# A user who cannot elevate must leave this repair pending without preventing
# later migrations from running. Once another account removes the machine-wide
# file, the next retry can complete without sudo.
# A user who cannot elevate leaves this migration pending and stops the ordered
# queue. Once an administrator removes the machine-wide file, a retry completes.
reset_machine
write_vulnerable_wifi_rule
defer_file="$test_dir/defer-signal"
defer_token="legacy-udev-repair"
: >"$defer_file"
set +e
HOME="$home_dir" \
OMARCHY_UDEV_RULES_DIR="$rules_dir" \
OMARCHY_MIGRATION_DEFER_FILE="$defer_file" \
OMARCHY_MIGRATION_DEFER_TOKEN="$defer_token" \
PATH="$test_dir/failing-bin:$PATH" \
bash -euo pipefail "$migration" >"$test_dir/defer.out" 2>&1
defer_status=$?
bash -euo pipefail "$migration" >"$test_dir/elevation-failure.out" 2>&1
failure_status=$?
set -e
(( defer_status == 75 )) || fail "migration defers when sudo cannot remove a vulnerable rule" "status=$defer_status"
(( failure_status != 0 )) || fail "migration fails when sudo cannot remove a vulnerable rule"
[[ -e $wifi_rule ]] || fail "migration keeps the vulnerable rule when its elevated removal fails"
[[ $(<"$defer_file") == "$defer_token" ]] || fail "migration authenticates its deferral to the runner"
pass "migration defers instead of blocking the queue when removal cannot elevate"
grep -q 'Ask an administrator to run omarchy-migrate' "$test_dir/elevation-failure.out" ||
fail "migration explains how a non-sudo user can complete the repair" "$(cat "$test_dir/elevation-failure.out")"
pass "migration fails loudly with administrator guidance when removal cannot elevate"
# If the first removal succeeds but the second one cannot elevate, the first
# rule must already have been dropped from the running udevd.
reset_machine
write_vulnerable_power_rule
write_vulnerable_wifi_rule
cat >"$test_dir/failing-bin/sudo" <<'STUB'
#!/bin/bash
printf 'sudo %s\n' "$*" >>"$CALLS"
if [[ $* == *99-wifi-powersave.rules ]]; then
exit 1
fi
exec "$@"
STUB
chmod +x "$test_dir/failing-bin/sudo"
: >"$CALLS"
set +e
HOME="$home_dir" \
OMARCHY_UDEV_RULES_DIR="$rules_dir" \
PATH="$test_dir/failing-bin:$test_dir/bin:$PATH" \
bash -euo pipefail "$migration" >"$test_dir/partial-failure.out" 2>&1
partial_status=$?
set -e
(( partial_status != 0 )) || fail "migration fails when the second rule cannot be removed"
[[ ! -e $power_rule && -e $wifi_rule ]] || fail "migration preserves the expected partial-removal state"
(( $(reload_count) == 1 )) ||
fail "migration reloads udev before a later removal failure" "$(cat "$CALLS")"
pass "a later removal failure cannot leave an already-deleted rule loaded"
# Nothing named the wrong binary is ours: the same path with a different command
# is a rule this migration cannot claim to know anything about.
test/shell.d/migrate-scope-test.sh
+22 -60
View File
@@ -76,68 +76,30 @@ grep -q '^before-fail$' "$calls" || fail "migration runner started failing migra
! grep -q '^after-fail$' "$calls" || fail "migration runner stops failing migration under strict mode"
pass "migration runner does not mark failed migrations complete"
deferred_root="$test_tmp/deferred-omarchy"
deferred_home="$test_tmp/deferred-home"
deferred_calls="$test_tmp/deferred-calls"
mkdir -p "$deferred_root/migrations" "$deferred_home"
stdin_root="$test_tmp/stdin-omarchy"
stdin_home="$test_tmp/stdin-home"
stdin_calls="$test_tmp/stdin-calls"
mkdir -p "$stdin_root/migrations" "$stdin_home"
cat >"$deferred_root/migrations/100-deferred.sh" <<'SH'
echo deferred >>"$TEST_CALLS"
printf '%s\n' "$OMARCHY_MIGRATION_DEFER_TOKEN" >"$OMARCHY_MIGRATION_DEFER_FILE"
exit 75
cat >"$stdin_root/migrations/100-reader.sh" <<'SH'
IFS= read -r value
printf 'reader:%s\n' "$value" >>"$TEST_CALLS"
SH
cat >"$deferred_root/migrations/200-after.sh" <<'SH'
echo after >>"$TEST_CALLS"
cat >"$stdin_root/migrations/200-after.sh" <<'SH'
echo after-reader >>"$TEST_CALLS"
SH
HOME="$deferred_home" \
OMARCHY_PATH="$deferred_root" \
TEST_CALLS="$deferred_calls" \
"$ROOT/bin/omarchy-migrate" >"$test_tmp/deferred.out"
printf 'migration input\n' | \
HOME="$stdin_home" \
OMARCHY_PATH="$stdin_root" \
TEST_CALLS="$stdin_calls" \
"$ROOT/bin/omarchy-migrate" >"$test_tmp/stdin.out"
grep -q '^deferred$' "$deferred_calls" || fail "migration runner starts a deferred migration"
grep -q '^after$' "$deferred_calls" || fail "migration runner continues after a deferred migration"
[[ ! -f $deferred_home/.local/state/omarchy/migrations/100-deferred.sh ]] ||
fail "migration runner leaves a deferred migration pending"
[[ -f $deferred_home/.local/state/omarchy/migrations/200-after.sh ]] ||
fail "migration runner records a later successful migration"
grep -q 'was deferred and will be retried later' "$test_tmp/deferred.out" ||
fail "migration runner reports a deferred migration"
pass "migration runner leaves exit-75 migrations pending and continues the queue"
HOME="$deferred_home" OMARCHY_PATH="$deferred_root" \
"$ROOT/bin/omarchy-migrate" --pending >"$test_tmp/deferred-pending.out"
grep -q '^100-deferred\.sh$' "$test_tmp/deferred-pending.out" ||
fail "migration runner still reports a deferred migration as pending"
! grep -q '^200-after\.sh$' "$test_tmp/deferred-pending.out" ||
fail "migration runner does not report the completed later migration as pending"
pass "migration runner reports only the deferred migration as pending"
raw_75_root="$test_tmp/raw-75-omarchy"
raw_75_home="$test_tmp/raw-75-home"
raw_75_calls="$test_tmp/raw-75-calls"
mkdir -p "$raw_75_root/migrations" "$raw_75_home"
cat >"$raw_75_root/migrations/100-child-tempfail.sh" <<'SH'
echo child-tempfail >>"$TEST_CALLS"
bash -c 'exit 75'
SH
cat >"$raw_75_root/migrations/200-after.sh" <<'SH'
echo after-tempfail >>"$TEST_CALLS"
SH
set +e
HOME="$raw_75_home" \
OMARCHY_PATH="$raw_75_root" \
TEST_CALLS="$raw_75_calls" \
"$ROOT/bin/omarchy-migrate" >"$test_tmp/raw-75.out" 2>"$test_tmp/raw-75.err"
raw_75_status=$?
set -e
(( raw_75_status == 75 )) ||
fail "migration runner preserves an unmarked child exit 75" "status=$raw_75_status"
grep -q '^child-tempfail$' "$raw_75_calls" || fail "migration runner starts the exit-75 child"
! grep -q '^after-tempfail$' "$raw_75_calls" || fail "migration runner stops after an unmarked exit 75"
[[ ! -f $raw_75_home/.local/state/omarchy/migrations/100-child-tempfail.sh ]] ||
fail "migration runner leaves an unmarked exit-75 migration incomplete"
pass "migration runner does not mistake a child EX_TEMPFAIL for intentional deferral"
grep -q '^reader:migration input$' "$stdin_calls" ||
fail "migration runner preserves the caller's stdin for a migration" "$(cat "$stdin_calls")"
grep -q '^after-reader$' "$stdin_calls" ||
fail "a migration reading stdin does not swallow later queue entries" "$(cat "$stdin_calls")"
[[ -f $stdin_home/.local/state/omarchy/migrations/100-reader.sh &&
-f $stdin_home/.local/state/omarchy/migrations/200-after.sh ]] ||
fail "migration runner marks both stdin-isolated migrations complete"
pass "migration queue uses a private file descriptor instead of migration stdin"
test/shell.d/privileged-heredoc-test.sh
+4 -2
View File
@@ -475,8 +475,8 @@ privileged_destination() {
while ((follow < ${#scan_lines[@]})); do
hop=${scan_lines[follow]}
follow=$((follow + 1))
line_carries_destination "$hop" "$dest" || continue
[[ $hop =~ (^|[[:space:]])(install|cp|mv)([[:space:]]|$) ]] || continue
line_carries_destination "$hop" "$dest" || continue
while IFS= read -r hop_dest; do
[[ $hop_dest == $'\002elevated' ]] && continue
[[ $hop_dest == "$dest" ]] && continue
@@ -761,7 +761,9 @@ shell_sources() {
local file first
while IFS= read -r -d '' file; do
grep -Iq . "$file" 2>/dev/null || continue
# Binary files and sources with no heredoc operator have nothing this check
# can classify. Filter them before collect_vars and the line-by-line scan.
grep -Iq '<<' "$file" 2>/dev/null || continue
case $file in
*.sh | *.hook)
test/shell.d/retired-installer-artifacts-migration-test.sh
+7 -7
View File
@@ -571,8 +571,8 @@ FAIL_DAEMON_RELOAD_ONCE_MARKER="$reload_failure_seen" run_migration
reload_status=$?
set -e
(( reload_status == 75 )) ||
fail "migration defers after a failed daemon-reload" "status=$reload_status"
(( reload_status != 0 )) ||
fail "migration fails after a failed daemon-reload" "status=$reload_status"
[[ ! -e $plymouth_unit && -e $reload_needed_marker && ! -e $machine_marker ]] ||
fail "migration records the pending reload without marking the repair complete"
@@ -606,15 +606,15 @@ HOME="$home_dir" \
gate_status=$?
set -e
(( gate_status == 75 )) ||
fail "migration defers when it cannot elevate to inspect the sudoers directory" "status=$gate_status$(printf '\n%s' "$(cat "$test_dir/gate.out")")"
(( gate_status != 0 )) ||
fail "migration fails when it cannot elevate to inspect the sudoers directory" "status=$gate_status$(printf '\n%s' "$(cat "$test_dir/gate.out")")"
[[ -e $readable/first-run ]] ||
fail "migration keeps a live grant when elevation fails"
[[ ! -e $machine_marker ]] ||
fail "migration leaves the machine repair unmarked when elevation fails"
grep -q 'will retry it later' "$test_dir/gate.out" ||
fail "migration says why it could not inspect the directory" "$(cat "$test_dir/gate.out")"
pass "migration defers without marking a readable sudoers directory repaired when elevation fails"
grep -q 'An administrator must run omarchy-migrate' "$test_dir/gate.out" ||
fail "migration explains how the machine-wide repair can complete" "$(cat "$test_dir/gate.out")"
pass "migration fails without marking the machine repaired and names the administrator action"
# After one privileged account completes the machine repair, a non-sudo user
# can finish their per-user migration without probing sudo again.