forked from heavy-duty/box
dc09d54cbe
It was never a test bug. box-firewall.sh decided the host's entire firewall stance with `ufw status | grep -q "Status: active"`, and "Status: active" is the FIRST line ufw prints: grep -q matches it and exits immediately, closing the pipe while ufw is still writing the rest of the table, so ufw dies of SIGPIPE. grep returned 0, but under the script's own `set -o pipefail` the PIPELINE returns 141 (PIPESTATUS = "141 0") — the if reads false, and a host with UFW plainly active takes the nft-fallback branch and never builds the DNS carve-out. `ufw status` is now read once into a variable and matched with [[ ]]: no reader means no early exit means no race. The stale-rule scan reads the same snapshot, so the branch decision and the converge loop cannot disagree. Separately, test/cli.sh now asserts that each shimmed run logged ufw mutations at all, before the content greps, and dumps $WFW, the log and the run's stderr when it did not — so the next occurrence reports its own cause instead of four content-free grep failures. Closes #102 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| box-firewall.service | ||
| box-firewall.sh | ||
| grant-user.sh | ||
| migrate-host.sh | ||
| revoke-user.sh | ||
| setup-host.sh | ||
| teardown-host.sh | ||