forked from heavy-duty/box
256ded2e92
The sweep added in #107 matched `ufw status[^|]*\| *grep` — every historical instance, and none of the equivalent spellings. `head -n1`, `sed -n '1p;q'`, `awk '/x/ {print; exit}'` and `read` all close the pipe early, SIGPIPE the writer, and yield the same 141 under pipefail. The pin guarded the instance spelling of the very thing it existed to generalise. Both halves of the matcher are alternations now. Readers are deliberately not narrowed to the early-exit spellings: telling `grep -q` from `grep -c` by regex is precision that rots, and all six `ufw status` sites in the tree already capture first, so banning the pipe outright costs nothing real. Writers gain `incus config trust list`. host/revoke-user.sh:206 piped it into `grep -q` as the --purge leftover assert, under `set -euo pipefail` — so unlike drill/wipe.sh nothing but the writer's size was holding it, and left of `&&` a 141 is set -e-exempt too. It would have read as "no leftover cert" on a host that still trusts the revoked user's certificate and called the purge complete: fail-open, on the path whose job is to prove access is gone. Now captured into `trust_csv` and matched with `[[ ]]`, with a leading newline so the first CSV row anchors like the `^` it replaces. Writers are enumerated rather than generalised — ~150 legitimate `| grep` sites exist under host/ and drill/, nearly all re-reading a captured string — so the sweep claims only what it can check. The `id -nG | tr | grep -qx` shapes in grant/revoke/setup are left alone: single tiny writes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| box-firewall.service | ||
| box-firewall.sh | ||
| grant-user.sh | ||
| migrate-host.sh | ||
| revoke-user.sh | ||
| setup-host.sh | ||
| teardown-host.sh | ||