fix: source /etc/os-release in a subshell — it clobbers $VERSION #5

Merged

dan-claude-bot merged 1 commit from fix/os-release-clobbers-version into main

2026-07-11 19:39:32 +00:00

dan-claude-bot commented

2026-07-11 19:38:10 +00:00

(Migrated from github.com)

The bug

rig runner install fails on Debian 13 at the download step:

rig-runner: downloading actions/runner 13 (trixie) (x64)
curl: (3) URL rejected: Malformed input to a URL function

Hit live on the CX43 ci-runner bootstrap (first real run of the PR #3 + #4 path).

runner-install.sh sources /etc/os-release in the main shell for the Debian-family guard. On Debian that file defines VERSION="13 (trixie)", which silently overwrites the script's own $VERSION:

with no pin, the [ -z "$VERSION" ] latest-release resolution is skipped entirely and the OS string is spliced into the download URL;
with --version <pin>, the pin is clobbered the same way — guards run after arg parsing, so there is no working invocation on Debian.

The fix

Read ID/ID_LIKE via a $( . /etc/os-release && printf … ) subshell so nothing leaks into the script's namespace. Applied to bootstrap.sh too — same pattern, no colliding variable today, same landmine.

Added a harness check that fails on any future main-shell sourcing of /etc/os-release under commands/.

Verification

bash test/cli.sh → 28 passed, 0 failed (incl. the new guard)
shellcheck clean on both scripts
resolution path sanity-checked: releases/latest redirect → 2.335.1 → tarball URL answers 302

🤖 Generated with Claude Code

## The bug `rig runner install` fails on Debian 13 at the download step: ``` rig-runner: downloading actions/runner 13 (trixie) (x64) curl: (3) URL rejected: Malformed input to a URL function ``` Hit live on the CX43 ci-runner bootstrap (first real run of the PR #3 + #4 path). `runner-install.sh` sources `/etc/os-release` in the main shell for the Debian-family guard. On Debian that file defines `VERSION="13 (trixie)"`, which **silently overwrites the script's own `$VERSION`**: - with no pin, the `[ -z "$VERSION" ]` latest-release resolution is skipped entirely and the OS string is spliced into the download URL; - with `--version <pin>`, the pin is clobbered the same way — guards run after arg parsing, so there is no working invocation on Debian. ## The fix Read `ID`/`ID_LIKE` via a `$( . /etc/os-release && printf … )` subshell so nothing leaks into the script's namespace. Applied to `bootstrap.sh` too — same pattern, no colliding variable today, same landmine. Added a harness check that fails on any future main-shell sourcing of `/etc/os-release` under `commands/`. ## Verification - `bash test/cli.sh` → 28 passed, 0 failed (incl. the new guard) - shellcheck clean on both scripts - resolution path sanity-checked: `releases/latest` redirect → `2.335.1` → tarball URL answers 302 🤖 Generated with [Claude Code](https://claude.com/claude-code)

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/rig#5

No description provided.