max / alloy
- Co-Authored-By
- Claude Opus 5 (1M context) <noreply@anthropic.com>
- Claude-Session
- https://claude.ai/code/session_01WFBzMprSmNCfvdj2cGZyka
3 files changed,
+34 insertions,
-1 deletion
| @@ -117,7 +117,7 @@ | |||
| 117 | 117 | echo "== probe: skipped; the dials above are already a refusal" | |
| 118 | 118 | elif [ "${2:-}" = "--fast" ]; then | |
| 119 | 119 | echo | |
| 120 | - | echo "== probe: skipped (--fast); dials and guards only" | |
| 120 | + | echo "== probe: skipped (--fast); dials, modes and guards only" | |
| 121 | 121 | else | |
| 122 | 122 | pkgset="$(sed -n 's/^PKGSET: //p' "$out")" | |
| 123 | 123 | drop="$(sed -n 's/^TMPFILES-DROP: //p' "$out")" | |
| @@ -237,6 +237,39 @@ | |||
| 237 | 237 | fi | |
| 238 | 238 | fi | |
| 239 | 239 | ||
| 240 | + | # == modes ================================================================== | |
| 241 | + | # | |
| 242 | + | # Every script this image installs into /usr/bin has to be executable in the | |
| 243 | + | # repo, because the COPY that places it preserves the mode git recorded. A 0644 | |
| 244 | + | # script is installed, present, readable, and silently never runs: the unit that | |
| 245 | + | # calls it fails at exec time on a machine nobody is watching. | |
| 246 | + | # | |
| 247 | + | # Learned expensively on 2026-09-08. usr/bin/alloy-usb-notify and | |
| 248 | + | # usr/bin/alloy-usb-seed were committed 0644, and the Containerfile's own | |
| 249 | + | # assertion caught the first of them at STEP 84 of 104, roughly twenty minutes | |
| 250 | + | # into a mint. That assertion is right to exist and stays; this check answers | |
| 251 | + | # the same question in a millisecond, before anything is built. | |
| 252 | + | # | |
| 253 | + | # It is a medium finding rather than a host one: the mode is in the commit, so | |
| 254 | + | # the image is wrong wherever it is built. | |
| 255 | + | echo | |
| 256 | + | echo "== modes: every /usr/bin script executable, as the COPY will place it" | |
| 257 | + | modes_bad=0 | |
| 258 | + | while read -r mode _ _ path; do | |
| 259 | + | case "$mode" in | |
| 260 | + | 100755) ;; | |
| 261 | + | *) printf ' FAIL %-52s mode %s; installed but never runs\n' "$path" "$mode" | |
| 262 | + | modes_bad=1 ;; | |
| 263 | + | esac | |
| 264 | + | done <<EOF | |
| 265 | + | $(git -C "$REPO_ROOT" ls-files -s usr/bin/ usr/libexec/ 2>/dev/null) | |
| 266 | + | EOF | |
| 267 | + | if [ "$modes_bad" -eq 0 ]; then | |
| 268 | + | echo " ok: $(git -C "$REPO_ROOT" ls-files usr/bin/ usr/libexec/ 2>/dev/null | wc -l) scripts, all executable" | |
| 269 | + | else | |
| 270 | + | rc=1 | |
| 271 | + | fi | |
| 272 | + | ||
| 240 | 273 | # The guards run out here rather than in the container, because they read sibling | |
| 241 | 274 | # repos under ~/Code that the container has no business mounting. They are plain | |
| 242 | 275 | # greps and need no Fedora anything. |