Repository navigation
fix: small follow-ups -- postinst change log never aborts, openapi version, caller env, run.sh skips (7.3.5) - #9
Merged
Merged
Conversation
added 13 commits
September 27, 2026 15:12
FastAPI fell back to its default version 0.1.0 in the OpenAPI document; it now carries importlib.metadata's version of lmnradius, the debian/changelog version, like GET /v1/version. Opens the 7.3.5 changelog entry.
…r aborts the configure (A6) Up to 7.3.4 set -e let any failing git call in /var/lib/linuxmuster-radius/instances abort the configure and leave the package half-configured. Each git step now prints one WARNING line with the step and the repository when it fails (git's own message stays above it) and the configure goes on; the service handling below is unchanged. An unusable repository is detected once with git rev-parse, and the remaining change-log steps are skipped with that warning. docs/operations.md says how to repair the repository.
…uld not be read (A1) The check after publishing is taken word for word from linuxmusterDEV templates/release.yml (6cd4d2a): immutable=false still says to delete the release and re-run; an unreadable answer fails the job with 'Do not delete it' and the command to check by hand, since the release may well be immutable. The rest of release.yml is unchanged.
…ises anything now (A2) renovate.yml opens with the STATE paragraph of linuxmusterDEV templates/renovate.yml, word for word. renovate.json: the top-level description starts "Renovate is disabled, see renovate.yml", and every description that claims an action says "When enabled", worded as in templates/renovate.json. Text only: no rule, manager or pattern changed (the config validator of the pinned engine passes with --strict).
…ox is not usable now (A5) .claude/settings.json kept the crabbox provider settings (Proxmox API address, token id of the removed crabbox user, node, template, storage, bridge) in this public repository. They belong in the gitignored .claude/settings.local.json only; the versioned file keeps the crabbox permissions. The /test skill and CLAUDE.md say where the settings live and that crabbox cannot lease boxes until Kevin sets it up again. The history still holds the old values.
…ed ci.yml check (A1) The main ruleset requires the ci.yml jobs by name; lockfile, file-tree, install-smoke and upgrade-smoke exist in release.yml too, so a release run on the same commit could report a green check of the same name. Every release.yml job now carries the display name 'release: <job>' with the comment of linuxmusterDEV templates/release.yml (7a5f5ed); job keys and needs are unchanged. The unreadable-state branch of the post-publish check is taken from that template as well (one-line annotation). test_packaging.py: the lockfile jobs are equal but for the display name, and no release job carries a ci.yml check's name.
… gate; skipped is not green (A3, A4) A3 -- the caller's environment. check-lockfiles.sh, build-venv.sh, make-deb.sh, lock_gates.sh and make_deb_checks.sh start with one and the same block, before any other command (even `set`): every shell function of the caller is removed through `builtin` (so exported functions named set, export, unset, compgen or mapfile cannot keep the others; one named `builtin` can, the stated limit), PATH is fixed, and exactly VIRTUAL_ENV, CONDA_PREFIX, PYTHON*, UV_*, PIP_*, GIT_*, PERL5OPT, PERL5LIB, PERLLIB, PERL5DB, MAKEFILES, MAKEFLAGS, GNUMAKEFLAGS, BASH_ENV, ENV and CDPATH are dropped. So the make runs of debian/rules never read the caller's MAKEFILES or MAKEFLAGS (a `-- SHELL=` in MAKEFLAGS ran code there), and dpkg/debhelper never read PERL5OPT. CLAUDE.md, ADR-016, threat-model and test-strategy name exactly these variables and the limits (what bash does before line 1, a function named builtin, the caller's own make, dpkg's config, proxy/CA). test_packaging.py keeps the five blocks identical and first. Tests: lock_gates.sh R1 poisons with exported functions set/export/cd/unset/compgen/mapfile, PERL5OPT/PERL5LIB, CDPATH, and for directly started scripts MAKEFILES/MAKEFLAGS/GNUMAKEFLAGS; it shows each is sharp where nothing removes it, and (LOCK_GATES_DEB) runs make-deb.sh directly under all of it. make_deb_checks.sh builds the dirty checkout with make, Perl and CDPATH poison. k1_wheel.py ships a dirname too. A4 -- run.sh. It removes the caller's functions and CDPATH, BASH_ENV, ENV first and calls /usr/bin/dirname (cold verification r4, F1: a venv's dirname ran before the gate). A skipped step is no longer green: exit 77 if anything was skipped, 1 on a failure, 0 only if every step ran and passed; LMNRADIUS_ALLOW_SKIP=1 accepts skips on purpose. The last line names every step that was not checked, and what a failed gate kept from running. Offline, the gate and the build say "PyPI gave no answer (offline?)" (lockfile_gate.py pypi exits 3 when PyPI does not answer) instead of blaming the uv lock or a hash (cold verification r3, B5/B6).
`git -C /var/lib/linuxmuster-radius/instances log` as root stops at git's "dubious ownership" guard: the repository belongs to lmnradius. install.md now gives `sudo -u lmnradius git -C /var/lib/linuxmuster-radius/instances log`, as operations.md does.
The source tarball also leaves out the two tracked .gitignore files (.gitignore and deploy/e2e/certs/.gitignore), which dpkg-source ignores by default (cold verification r4, F2); the 7.3.5 entry says so, and make-deb.sh's last line names them too.
…ebian/rules; functions . and dirname (A3) From the findings on linuxmuster-squid 7.3.5, checked here: - MAKEOVERRIDES joins the removed variables: in dh's recursive calls of debian/rules it carries variable overrides into the sub-make (shown: a sub-make then sees V=evil). With MAKEFLAGS, GNUMAKEFLAGS and MAKEFILES already removed, `make -i deb` or GNUMAKEFLAGS=-i can no longer carry debian/rules past a failed build-venv.sh (on 7.3.4 they wrote a .deb although the gate refused the lock), and `make deb DEST=...` can no longer move the venv. - Exported functions named . or dirname: radius removes every function before its first command, so they never run; the tests now poison with them as well. lock_gates.sh: functions . and dirname and MAKEOVERRIDES in the R1 poison (each shown sharp); with LOCK_GATES_DEB, `make -i deb` and GNUMAKEFLAGS=-i on a planted lock write no .deb. make_deb_checks.sh: the dirty build runs as `make deb DEST=/opt/zzz-moved` and the venv stays at /opt/linuxmuster-radius/venv. Texts name MAKEOVERRIDES.
…e and quotes its paths (T1) Taken from linuxmusterDEV work/plans/venv-debian-umbau/rules.template (1ab7f8a), identical but for PKG. make splits paths at whitespace: with TMPDIR="/work/odd dir" the unquoted $(ROOT)$(DEST) handed build-venv.sh "/work/odd" as its venv path, and its rm -rf removed that directory (reproduced on 34aff0e). A CURDIR with whitespace now stops the build before anything runs, and the paths are quoted.
…t; build-venv.sh refuses a bad venv path (P1-P3, T2) P1: check-lockfiles.sh, build-venv.sh, make-deb.sh, run.sh, lock_gates.sh and make_deb_checks.sh start with one block: unless this is the clean run already, the script execs itself again as `/usr/bin/env -i <allowlist> /bin/bash -p "$0" --lmnradius-clean-env "$@"`. The allowlist is PATH=/usr/sbin:/usr/bin:/sbin:/bin, LANG/LC_ALL=C.UTF-8 and, where set, HOME, TMPDIR, the proxy variables (both spellings), SSL_CERT_FILE, SSL_CERT_DIR, REQUESTS_CA_BUNDLE, PIP_CERT and the repository's own switches (LMNRADIUS_ALLOW_REAL, LMNRADIUS_ALLOW_SKIP, LMNRADIUS_CALLER_PATH, LOCK_GATES_DEB, LOCK_GATES_VERBOSE). bash -p imports no function and reads no BASH_ENV, ENV, SHELLOPTS or BASHOPTS; up to the exec only keywords, assignments and one absolute command run, with POSIXLY_CORRECT set so that the special builtin exec beats any exported function (a function named builtin or exec no longer matters). The per-variable removal list is gone. The Makefile starts make-deb.sh, and run.sh its gate, with /bin/bash -p, so SHELLOPTS=noexec cannot turn them into a silent success. run.sh keeps the caller's PATH aside and gives it back only after the gate passed (lint, unit, e2e use the caller's tools on purpose). P2: CLAUDE.md, ADR-016, threat-model, test-strategy, the Makefile and the script headers name the allowlist; the limits are only what runs before the restart (the caller's shell with BASH_ENV/SHELLOPTS, LD_PRELOAD for it and /usr/bin/env, the caller's own make) and what the allowlist passes on purpose (files under HOME, proxy/CA). P3: lock_gates.sh R1 poisons with GCONV_PATH (a gconv module), LD_LIBRARY_PATH (a libz.so.1 filter), TAR_OPTIONS, MAKEFLAGS/GNUMAKEFLAGS with -i, PERL5OPT, PYTHONPATH and exported functions set, export, ., builtin, exec, exit, shift, dirname and more -- each shown sharp -- and checks the verdicts, no .deb and no marker, also for `SHELLOPTS=noexec make deb`; the block itself run under all of it holds only the allowlist, no function, bash -p. make_deb_checks.sh builds the dirty checkout under TAR_OPTIONS, SHELLOPTS=noexec and the functions as well, and (T1) a TMPDIR with a space is refused by debian/rules while a same-named directory survives. T2: build-venv.sh refuses, before anything runs, a venv path that is not absolute, contains whitespace or . / .. / // components, or does not end in /opt/linuxmuster-radius/venv. Package content is unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Small follow-ups (linuxmusterDEV
work/tasks/kleine-nacharbeiten-2026-09-27.md, radius part: A1–A6, R1–R3). New top changelog entry 7.3.5 (lmn73). Nothing is merged or tagged here.Package (what changes on a server)
/openapi.jsonreports the package version (importlib.metadata) instead of FastAPI's default 0.1.0; testtest_openapi_reports_the_package_version.set -e, package left half-configured). Each failure prints onelinuxmuster-radius: WARNING: instance change log …: '<step>' failed; …line on stderr below git's own message; configure and service handling go on as before.docs/operations.mdsays how to repair..gitignorefiles are not in it either).Build, tests, CI (not in the .deb)
templates/release.yml(no advice to delete a release whose state could not be read); every job namedrelease: <job>, so no release.yml check carries the name of a required ci.yml check.check-lockfiles.sh,build-venv.sh,make-deb.sh,lock_gates.sh,make_deb_checks.shstart with one identical block: the caller's shell functions removed throughbuiltin, fixed PATH, exactlyVIRTUAL_ENV CONDA_PREFIX PYTHON* UV_* PIP_* GIT_* PERL5OPT PERL5LIB PERLLIB PERL5DB MAKEFILES MAKEFLAGS GNUMAKEFLAGS BASH_ENV ENV CDPATHdropped (the make runs of debian/rules no longer see the caller's MAKEFILES/MAKEFLAGS). Texts name exactly these; lock_gates.sh R1 and make_deb_checks.sh poison with all of them and show each is sharp./usr/bin/dirname(cold r4 F1); skipped is not green (exit 77,LMNRADIUS_ALLOW_SKIP=1to accept), the last line names what was not checked; offline the gate/build say "PyPI gave no answer (offline?)" (cold r3 B5/B6)..claude/settings.jsonholds no lab endpoints any more (they belong in the gitignored settings.local.json); crabbox is not usable at the moment.sudo -u lmnradius git -C /var/lib/linuxmuster-radius/instances log(as root git refuses: dubious ownership).No ci.yml job was added, renamed or removed (the required-checks list stays as it is).