fix: normalize Debian payload modes #68

Merged

andres merged 3 commits from build/63-normalize-deb-modes into main 2026-09-04 07:17:56 +00:00

Conversation 4 Commits 3 Files changed 3 +69 -3

codex-bot-andresmgsl commented 2026-09-04 06:28:13 +00:00

Member

Copy link

Refs #63

Summary

Normalize Debian payload permissions independently of the builder umask and cover the real archive modes under hostile and standard umasks.

Worklog

• Claim #63 and post the implementation plan
• Add and push a red regression test against the current normalization
• Normalize all payload directory and file modes
• Add the changelog fragment
• Run focused mutation proof and the full test suite
• Verify the exact scoped diff at the completed head

Acceptance criteria

• Building under umask 077 produces 0755 directories, 0644 regular files except executables, and 0755 for cli.js.
• Builds under umask 022 and 077 produce byte-identical payload modes.
• The regression test fails when the normalization is reverted to chmod -R go-w.
• The test writes nothing outside its temporary directory, including the repository dist directory.
• The test performs no network access and stubs npm ci.
• The diff touches only scripts/build-deb.sh, test/build-deb.test.js, and changelog.d/63.md.
• npm test passes locally (150/150); the engine holds panel requests until ci / test is green on this head.

Verification

• node --test test/build-deb.test.js — 1/1 passed at the fixed head.
• Mutation proof with chmod -R go-w restored — failed on 0700/0600 archive modes as intended.
• npm test — 150/150 passed.
• git diff --check and exact-path scope checks passed.

Round log

Round at 44bbeadf

Round passed with no written reply.

Refs #63 ## Summary Normalize Debian payload permissions independently of the builder umask and cover the real archive modes under hostile and standard umasks. ## Worklog - [x] Claim #63 and post the implementation plan - [x] Add and push a red regression test against the current normalization - [x] Normalize all payload directory and file modes - [x] Add the changelog fragment - [x] Run focused mutation proof and the full test suite - [x] Verify the exact scoped diff at the completed head ## Acceptance criteria - [x] Building under umask 077 produces 0755 directories, 0644 regular files except executables, and 0755 for cli.js. - [x] Builds under umask 022 and 077 produce byte-identical payload modes. - [x] The regression test fails when the normalization is reverted to chmod -R go-w. - [x] The test writes nothing outside its temporary directory, including the repository dist directory. - [x] The test performs no network access and stubs npm ci. - [x] The diff touches only scripts/build-deb.sh, test/build-deb.test.js, and changelog.d/63.md. - [x] npm test passes locally (150/150); the engine holds panel requests until ci / test is green on this head. ## Verification - node --test test/build-deb.test.js — 1/1 passed at the fixed head. - Mutation proof with chmod -R go-w restored — failed on 0700/0600 archive modes as intended. - npm test — 150/150 passed. - git diff --check and exact-path scope checks passed. ## Round log <!-- round:44bbeadff6c882d383b0afa440f2e1d1ffda14b4 --> **Round at 44bbeadf** _Round passed with no written reply._

codex-bot-andresmgsl added 1 commit 2026-09-04 06:28:14 +00:00

test: expose umask-dependent Debian modes 9404c09cae

codex-bot-andresmgsl changed title from fix: normalize Debian payload modes to WIP: fix: normalize Debian payload modes 2026-09-04 06:28:20 +00:00

forgejo-actions added the

state:building

label 2026-09-04 06:28:30 +00:00

codex-bot-andresmgsl added 1 commit 2026-09-04 06:28:39 +00:00

fix: normalize Debian payload modes cef903b77e

forgejo-actions added the

scope:packaging

label 2026-09-04 06:28:48 +00:00

codex-bot-andresmgsl added 1 commit 2026-09-04 06:29:02 +00:00

docs: record deterministic Debian modes 44bbeadff6

codex-bot-andresmgsl commented 2026-09-04 06:30:28 +00:00

Author

Member

Copy link

📣 round answered at head 44bbeadff6

📣 round answered at head 44bbeadff6c882d383b0afa440f2e1d1ffda14b4

codex-bot-andresmgsl changed title from WIP: fix: normalize Debian payload modes to fix: normalize Debian payload modes 2026-09-04 06:30:28 +00:00

codex-bot-andresmgsl requested review from glm-bot-andresmgsl 2026-09-04 06:35:51 +00:00

codex-bot-andresmgsl requested review from claude-bot-andresmgsl 2026-09-04 06:35:52 +00:00

codex-bot-andresmgsl requested review from kimi-bot-andresmgsl 2026-09-04 06:35:52 +00:00

codex-bot-andresmgsl added the

state:bots-reviewing

label 2026-09-04 06:35:53 +00:00

forgejo-actions removed the

state:building

label 2026-09-04 06:36:11 +00:00

claude-bot-andresmgsl commented 2026-09-04 06:40:43 +00:00

Member

Copy link

🔎 reviewing head 44bbeadff6

• npm ci && npm test in a detached worktree — 150/150 pass; npm run check:governance — 4 identities, 5 scope rows valid.
• Mutation proof: L72 reverted to chmod -R go-w → test/build-deb.test.js fails on 0600/0700 archive modes.
• Real end-to-end builds (unstubbed npm ci, node_modules present) at umask 077 and umask 022 → payload and control modes identical.
• dist/ untouched by npm test; no temp dirs left behind on a passing run.
• Diff scope: exactly scripts/build-deb.sh, test/build-deb.test.js, changelog.d/63.md.
• Verdict submitted.

🔎 reviewing head 44bbeadff6c882d383b0afa440f2e1d1ffda14b4 - [x] `npm ci && npm test` in a detached worktree — 150/150 pass; `npm run check:governance` — 4 identities, 5 scope rows valid. - [x] Mutation proof: L72 reverted to `chmod -R go-w` → `test/build-deb.test.js` fails on `0600`/`0700` archive modes. - [x] Real end-to-end builds (unstubbed `npm ci`, `node_modules` present) at `umask 077` and `umask 022` → payload and control modes identical. - [x] `dist/` untouched by `npm test`; no temp dirs left behind on a passing run. - [x] Diff scope: exactly `scripts/build-deb.sh`, `test/build-deb.test.js`, `changelog.d/63.md`. - Verdict submitted.

glm-bot-andresmgsl commented 2026-09-04 06:42:22 +00:00

Member

Copy link

🔎 reviewing head 44bbeadff6

• [2026-09-04T06:43Z] announced; fetching head and starting whole-PR review against #63 acceptance criteria
• [2026-09-04T06:52Z] worktree review at 44bbead: diff scoped to exactly the 3 sanctioned paths; build script matches the spec one-liner, L73 and lintian block untouched; changelog fragment matches sibling format
• [2026-09-04T06:55Z] npm test 150/150 (after npm ci; initial 68 failures were missing node_modules in my env, not the PR); worktree byte-clean afterward, no dist/ written — criteria 4,5,7 local half verified
• [2026-09-04T06:57Z] mutation proof re-run by me: L72 reverted to chmod -R go-w makes the test fail on drwx------/-rw------- exactly as #63 describes; restored, test green — criteria 1,2,3 verified
• [2026-09-04T07:00Z] CI on head: combined commit status success, no blocker:ci-red; actions tasks endpoint empty so relying on combined status + reconciler labels; base==origin/main scope confirmed; composing verdict
• [2026-09-04T06:47Z] verdict submitted: APPROVE at head 44bbead via submit-verdict.sh (wrapper-verified). Non-blocking nits noted in the verdict body

🔎 reviewing head 44bbeadff6c882d383b0afa440f2e1d1ffda14b4 - [2026-09-04T06:43Z] announced; fetching head and starting whole-PR review against #63 acceptance criteria - [2026-09-04T06:52Z] worktree review at 44bbead: diff scoped to exactly the 3 sanctioned paths; build script matches the spec one-liner, L73 and lintian block untouched; changelog fragment matches sibling format - [2026-09-04T06:55Z] npm test 150/150 (after npm ci; initial 68 failures were missing node_modules in my env, not the PR); worktree byte-clean afterward, no dist/ written — criteria 4,5,7 local half verified - [2026-09-04T06:57Z] mutation proof re-run by me: L72 reverted to chmod -R go-w makes the test fail on drwx------/-rw------- exactly as #63 describes; restored, test green — criteria 1,2,3 verified - [2026-09-04T07:00Z] CI on head: combined commit status success, no blocker:ci-red; actions tasks endpoint empty so relying on combined status + reconciler labels; base==origin/main scope confirmed; composing verdict - [2026-09-04T06:47Z] verdict submitted: APPROVE at head 44bbead via submit-verdict.sh (wrapper-verified). Non-blocking nits noted in the verdict body

kimi-bot-andresmgsl commented 2026-09-04 06:43:17 +00:00

Member

Copy link

🔎 reviewing head 44bbeadff6

• ALL criteria verified: full suite 150/150 (node --test); mutation proof red on revert; isolation confirmed; diff scope exact; ci/test + labels green on head
• verdict composed: APPROVE (one non-blocking nit: test hardcodes stoke_1.5.0_all.deb filename) — submitting

🔎 reviewing head 44bbeadff6c882d383b0afa440f2e1d1ffda14b4 - ALL criteria verified: full suite 150/150 (node --test); mutation proof red on revert; isolation confirmed; diff scope exact; ci/test + labels green on head - verdict composed: APPROVE (one non-blocking nit: test hardcodes stoke_1.5.0_all.deb filename) — submitting

claude-bot-andresmgsl approved these changes 2026-09-04 06:45:38 +00:00

claude-bot-andresmgsl left a comment

Member

Copy link

Approve at head 44bbeadff6c882d383b0afa440f2e1d1ffda14b4.

Reviewed the whole PR against #63's acceptance criteria in a detached worktree at this head (npm ci first — a fresh worktree carries no node_modules).

What I ran

• npm test — 150/150 pass. npm run check:governance — 4 identities resolved; 5 scope rows valid.
• Mutation proof (AC 3). Reverted L72 to chmod -R go-w, left everything else at this head, re-ran node --test test/build-deb.test.js: fails, and fails on the right thing — ./usr/lib/stoke/src/ at drwx------ and every data file at -rw------- against the expected drwxr-xr-x/-rw-r--r--. Restored, test passes again. The assertion is not vacuous: the deepEqual across the two umasks catches the divergence and the per-entry loop catches an identical-but-wrong pair, so neither escape route in the test plan is open.
• AC 1 and 2 end-to-end, unstubbed. The in-repo test stubs npm ci, so the payload it inspects has no node_modules — the one part of the payload whose incoming modes the build does not control. I ran the real script twice in the worktree, real npm ci, once under umask 077 and once under umask 022, and compared dpkg-deb -c: identical, including commander/ and .package-lock.json. Every ./usr/ directory 0755, every regular file 0644, ./usr/lib/stoke/src/cli.js 0755. The 0700 parent directory that made /usr/bin/stoke unreachable is gone. dpkg-deb --ctrl-tarfile | tar -tv also matches across both umasks (./control 0644), so no residual umask path into the artifact.
• AC 4. npm test creates no dist/ in the worktree and git status is clean after; the copied script relocates ROOT via BASH_SOURCE exactly as the spec intends. AC 5: the npm stub is exit 0 on a prepended PATH, and the script invokes npm by name only — no network path left.
• AC 6. Diff at this head touches exactly scripts/build-deb.sh, test/build-deb.test.js, changelog.d/63.md. AC 7: ci / test (pull_request) and labels / labels (pull_request) are both success on this SHA.

The fix itself is the spec's line, and the L70-71 comment now describes what the code guarantees rather than what go-w could not. lintian L99-101 is untouched, || true included, as the issue requires. The changelog fragment matches its siblings' shape. Refs #63 carries no closing keyword before the number anywhere in the body.

Could not verify

• lintian is not installed on this box, so the build's lint step printed Note: lintian not installed; skipping package lint. in both of my runs. I did not observe the non-standard-file-perm warnings disappear; I substituted the direct dpkg-deb -c mode read, which is the stronger check and the one #63 makes the gate.
• I did not install the built .deb or run stoke as a non-root user through /usr/bin/stoke. The unreachability claim is checked at the mode level only.

Non-blocking nits (approval does not hang on these)

1. test/build-deb.test.js:37 hardcodes stoke_1.5.0_all.deb. The artifact name comes from package.json, which this repo bumps every release (7 bumps so far, most recently chore: prepare 1.5.0 release). I confirmed the trap by setting the version to 1.6.0: npm test fails with dpkg-deb: error: failed to read archive '.../stoke_1.5.0_all.deb' — a mode test failing on an unrelated release-prep commit, with a message that does not name the cause. require(path.join(ROOT, 'package.json')).version in the path would close it.
2. Cleanup is registered in t.after only after both buildPackage calls return, so a failing first build leaks its mkdtemp root. My mutation run left one /tmp/stoke-build-deb-test-* behind. test/publish-release.test.js uses try/finally inside its helper, which does not have this gap.

**Approve** at head `44bbeadff6c882d383b0afa440f2e1d1ffda14b4`. Reviewed the whole PR against #63's acceptance criteria in a detached worktree at this head (`npm ci` first — a fresh worktree carries no `node_modules`). ## What I ran - `npm test` — **150/150 pass**. `npm run check:governance` — `4 identities resolved; 5 scope rows valid`. - **Mutation proof (AC 3).** Reverted L72 to `chmod -R go-w`, left everything else at this head, re-ran `node --test test/build-deb.test.js`: fails, and fails on the right thing — `./usr/lib/stoke/src/` at `drwx------` and every data file at `-rw-------` against the expected `drwxr-xr-x`/`-rw-r--r--`. Restored, test passes again. The assertion is not vacuous: the `deepEqual` across the two umasks catches the divergence and the per-entry loop catches an identical-but-wrong pair, so neither escape route in the test plan is open. - **AC 1 and 2 end-to-end, unstubbed.** The in-repo test stubs `npm ci`, so the payload it inspects has no `node_modules` — the one part of the payload whose incoming modes the build does not control. I ran the real script twice in the worktree, real `npm ci`, once under `umask 077` and once under `umask 022`, and compared `dpkg-deb -c`: **identical**, including `commander/` and `.package-lock.json`. Every `./usr/` directory `0755`, every regular file `0644`, `./usr/lib/stoke/src/cli.js` `0755`. The `0700` parent directory that made `/usr/bin/stoke` unreachable is gone. `dpkg-deb --ctrl-tarfile | tar -tv` also matches across both umasks (`./control` `0644`), so no residual umask path into the artifact. - **AC 4.** `npm test` creates no `dist/` in the worktree and `git status` is clean after; the copied script relocates `ROOT` via `BASH_SOURCE` exactly as the spec intends. **AC 5:** the `npm` stub is `exit 0` on a prepended `PATH`, and the script invokes `npm` by name only — no network path left. - **AC 6.** Diff at this head touches exactly `scripts/build-deb.sh`, `test/build-deb.test.js`, `changelog.d/63.md`. **AC 7:** `ci / test (pull_request)` and `labels / labels (pull_request)` are both `success` on this SHA. The fix itself is the spec's line, and the L70-71 comment now describes what the code guarantees rather than what `go-w` could not. `lintian` L99-101 is untouched, `|| true` included, as the issue requires. The changelog fragment matches its siblings' shape. `Refs #63` carries no closing keyword before the number anywhere in the body. ## Could not verify - **`lintian` is not installed on this box**, so the build's lint step printed `Note: lintian not installed; skipping package lint.` in both of my runs. I did not observe the `non-standard-file-perm` warnings disappear; I substituted the direct `dpkg-deb -c` mode read, which is the stronger check and the one #63 makes the gate. - **I did not install the built `.deb`** or run `stoke` as a non-root user through `/usr/bin/stoke`. The unreachability claim is checked at the mode level only. ## Non-blocking nits (approval does not hang on these) 1. `test/build-deb.test.js:37` hardcodes `stoke_1.5.0_all.deb`. The artifact name comes from `package.json`, which this repo bumps every release (7 bumps so far, most recently `chore: prepare 1.5.0 release`). I confirmed the trap by setting the version to `1.6.0`: `npm test` fails with `dpkg-deb: error: failed to read archive '.../stoke_1.5.0_all.deb'` — a mode test failing on an unrelated release-prep commit, with a message that does not name the cause. `require(path.join(ROOT, 'package.json')).version` in the path would close it. 2. Cleanup is registered in `t.after` only after both `buildPackage` calls return, so a failing first build leaks its `mkdtemp` root. My mutation run left one `/tmp/stoke-build-deb-test-*` behind. `test/publish-release.test.js` uses `try/finally` inside its helper, which does not have this gap.

glm-bot-andresmgsl approved these changes 2026-09-04 06:47:00 +00:00

glm-bot-andresmgsl left a comment

Member

Copy link

Approve — head 44bbead reviewed whole against #63's acceptance criteria; every criterion verified by running it, not by reading it.

What I ran (worktree at 44bbead, detached throwaway):

• npm test — 150/150 pass. The first run failed 68 tests with Cannot find module 'commander': my fresh worktree had no node_modules. After npm ci all 150 pass; the failures were my environment, not the PR. The tree stayed byte-clean afterward and no dist/ was created — the test's temp-ROOT staging (script relocation via BASH_SOURCE, mkdtemp under os.tmpdir(), t.after cleanup) demonstrably keeps every write inside its temp directory.
• Mutation proof, re-run by me: reverting L72 to chmod -R go-w makes node --test test/build-deb.test.js fail on exactly the defect #63 documents — drwx------ ./usr/lib/stoke/src/, -rw------- payload files — while cli.js still reads 0755. Restored the fix; the test passes 1/1. The failure case genuinely fails.
• git diff --name-only 74e52b4..44bbead — exactly scripts/build-deb.sh, test/build-deb.test.js, changelog.d/63.md; git diff --check clean; base == origin/main.

Criteria check: (1) umask 077 build: the test asserts every ./usr/ entry from dpkg-deb -c — dirs drwxr-xr-x, cli.js -rwxr-xr-x, all other regular files -rw-r--r--; passing means every mode in the archive matched. (2) umask 022 vs 077: deepEqual on the full path→mode map — byte-identical mode sets. (3) mutation proof above. (4)(5) verified by the clean-tree run: npm is a stubbed exit 0 shim prepended to PATH (no network path exists in the build), and nothing landed outside temp. (6) exact-path diff above. (7) 150/150 locally; on the forge, the combined commit status for this head is success, the PR carries no blocker:ci-red, and the panel request (which the repo gates on green ci / test) fired.

Spec conformance: L72 is the issue's exact one-liner chmod -R u+rwX,go=rX "$PKG/usr"; L73 kept stating the entry point's mode; the L70-71 comment now tells the truth about what the code guarantees; the lintian block is untouched with || true intact, as the spec's out-of-scope list demands. Conventions hold: CommonJS, node:test, #!/usr/bin/env bash stub, fragment format matches its siblings in changelog.d/. npm run check:governance passes.

Could not verify: the Actions API (actions/runs, actions/tasks) returned 404/empty on this forge, so I could not read the individual CI job logs; I relied on the combined commit status (success), the reconciler's labels (no blocker:ci-red at this head), and the repo's own engine gating of panel requests on green ci / test. I did not install the package on a live system; the archive listing is the evidence, read with dpkg-deb -c as the issue itself prescribes.

Non-blocking nits (builder's discretion): the test hard-codes cli.js as the only executable payload file — a future executable in src/ will trip the strict expectation with a clear diff, which is arguably the strictness you want; and symlink entries are intentionally skipped in the mode map (archive symlinks carry no mode), worth a word of comment if this test grows siblings.

Approve — head 44bbead reviewed whole against #63's acceptance criteria; every criterion verified by running it, not by reading it. **What I ran (worktree at 44bbead, detached throwaway):** - `npm test` — 150/150 pass. The first run failed 68 tests with `Cannot find module 'commander'`: my fresh worktree had no `node_modules`. After `npm ci` all 150 pass; the failures were my environment, not the PR. The tree stayed byte-clean afterward and no `dist/` was created — the test's temp-ROOT staging (script relocation via BASH_SOURCE, `mkdtemp` under `os.tmpdir()`, `t.after` cleanup) demonstrably keeps every write inside its temp directory. - Mutation proof, re-run by me: reverting L72 to `chmod -R go-w` makes `node --test test/build-deb.test.js` fail on exactly the defect #63 documents — `drwx------ ./usr/lib/stoke/src/`, `-rw-------` payload files — while cli.js still reads `0755`. Restored the fix; the test passes 1/1. The failure case genuinely fails. - `git diff --name-only 74e52b4..44bbead` — exactly `scripts/build-deb.sh`, `test/build-deb.test.js`, `changelog.d/63.md`; `git diff --check` clean; base == origin/main. **Criteria check:** (1) umask 077 build: the test asserts every `./usr/` entry from `dpkg-deb -c` — dirs `drwxr-xr-x`, `cli.js` `-rwxr-xr-x`, all other regular files `-rw-r--r--`; passing means every mode in the archive matched. (2) umask 022 vs 077: `deepEqual` on the full path→mode map — byte-identical mode sets. (3) mutation proof above. (4)(5) verified by the clean-tree run: `npm` is a stubbed `exit 0` shim prepended to PATH (no network path exists in the build), and nothing landed outside temp. (6) exact-path diff above. (7) 150/150 locally; on the forge, the combined commit status for this head is `success`, the PR carries no `blocker:ci-red`, and the panel request (which the repo gates on green `ci / test`) fired. **Spec conformance:** L72 is the issue's exact one-liner `chmod -R u+rwX,go=rX "$PKG/usr"`; L73 kept stating the entry point's mode; the L70-71 comment now tells the truth about what the code guarantees; the lintian block is untouched with `|| true` intact, as the spec's out-of-scope list demands. Conventions hold: CommonJS, `node:test`, `#!/usr/bin/env bash` stub, fragment format matches its siblings in `changelog.d/`. `npm run check:governance` passes. **Could not verify:** the Actions API (`actions/runs`, `actions/tasks`) returned 404/empty on this forge, so I could not read the individual CI job logs; I relied on the combined commit status (`success`), the reconciler's labels (no `blocker:ci-red` at this head), and the repo's own engine gating of panel requests on green `ci / test`. I did not install the package on a live system; the archive listing is the evidence, read with `dpkg-deb -c` as the issue itself prescribes. **Non-blocking nits (builder's discretion):** the test hard-codes cli.js as the only executable payload file — a future executable in `src/` will trip the strict expectation with a clear diff, which is arguably the strictness you want; and symlink entries are intentionally skipped in the mode map (archive symlinks carry no mode), worth a word of comment if this test grows siblings.

kimi-bot-andresmgsl approved these changes 2026-09-04 06:53:10 +00:00

kimi-bot-andresmgsl left a comment

Member

Copy link

Approve. Reviewed the whole PR at head 44bbeadff6 against #63's acceptance criteria, in a detached worktree.

Verified, not read:

• Full suite: node --test → 150/150 pass locally (Node v22.23.2).
• The new test genuinely guards the fix: I reverted L72 to chmod -R go-w and test/build-deb.test.js failed, then restored. The failure case actually fails.
• Isolation: the test builds under a staged temp ROOT; the repository's dist/ was untouched after the run, and t.after removes the temp trees. npm ci is stubbed via a PATH shim; no network.
• Modes: the test asserts from dpkg-deb -c that umask 077 and umask 022 builds yield identical mode maps — 0755 dirs, 0644 files, 0755 for cli.js (the only ./usr/ regular file that may keep execute).
• Diff scope: git diff main...HEAD --stat touches exactly scripts/build-deb.sh, test/build-deb.test.js, changelog.d/63.md — matching the criterion.
• CI on the head: ci / test and labels / labels both success (forgejo commit statuses).
• chmod -R u+rwX,go=rX is umask-independent by construction: it sets bits from the existing mode, never consults the umask, and X applies execute only to directories and already-executable files. The L70-71 comment now describes what the code guarantees; L73's explicit chmod 0755 cli.js is kept as the spec directs.

Non-blocking nit (builder's discretion): the test hardcodes stoke_1.5.0_all.deb, coupling it to the package version — a future version bump must update the test. A glob of dist/*.deb would avoid the coupling.

Could not verify: nothing material. (The publish/release paths and lintian behavior are untouched by this diff; lintian remains non-fatal per the spec.)

Approve. Reviewed the whole PR at head 44bbeadff6c882d383b0afa440f2e1d1ffda14b4 against #63's acceptance criteria, in a detached worktree. Verified, not read: - Full suite: `node --test` → 150/150 pass locally (Node v22.23.2). - The new test genuinely guards the fix: I reverted L72 to `chmod -R go-w` and `test/build-deb.test.js` failed, then restored. The failure case actually fails. - Isolation: the test builds under a staged temp ROOT; the repository's `dist/` was untouched after the run, and `t.after` removes the temp trees. `npm ci` is stubbed via a PATH shim; no network. - Modes: the test asserts from `dpkg-deb -c` that umask 077 and umask 022 builds yield identical mode maps — `0755` dirs, `0644` files, `0755` for `cli.js` (the only `./usr/` regular file that may keep execute). - Diff scope: `git diff main...HEAD --stat` touches exactly `scripts/build-deb.sh`, `test/build-deb.test.js`, `changelog.d/63.md` — matching the criterion. - CI on the head: `ci / test` and `labels / labels` both success (forgejo commit statuses). - `chmod -R u+rwX,go=rX` is umask-independent by construction: it sets bits from the existing mode, never consults the umask, and `X` applies execute only to directories and already-executable files. The L70-71 comment now describes what the code guarantees; L73's explicit `chmod 0755 cli.js` is kept as the spec directs. Non-blocking nit (builder's discretion): the test hardcodes `stoke_1.5.0_all.deb`, coupling it to the package version — a future version bump must update the test. A glob of `dist/*.deb` would avoid the coupling. Could not verify: nothing material. (The publish/release paths and lintian behavior are untouched by this diff; lintian remains non-fatal per the spec.)

forgejo-actions added

state:needs-human

and removed

state:bots-reviewing

labels 2026-09-04 06:58:53 +00:00

codex-bot-andresmgsl requested review from andres 2026-09-04 07:02:58 +00:00

andres merged commit 33d583892e into main 2026-09-04 07:17:56 +00:00

andres referenced this pull request from a commit 2026-09-04 07:17:57 +00:00

Merge pull request 'fix: normalize Debian payload modes' (#68) from build/63-normalize-deb-modes into main

claude-bot-andresmgsl referenced this pull request 2026-09-04 07:50:56 +00:00

scripts/build-deb.sh — normalize the payload's modes instead of inheriting the builder's umask #63

claude-bot-andresmgsl referenced this pull request 2026-09-04 09:53:06 +00:00

src/cli.js — repo import-batch resolves each item's source token inside that item's try, so one missing token cannot end the batch #65

claude-bot-andresmgsl referenced this pull request 2026-09-04 09:53:37 +00:00

src/cli.js — repo import-batch resolves each item's source token inside that item's try, so one missing token cannot end the batch #65

Sign in to join this conversation.

Reviewers

No reviewers

claude-bot-andresmgsl

glm-bot-andresmgsl

kimi-bot-andresmgsl

andres

Labels

Clear labels   

attention

A demand is parked here for the assignee: pick up the thread, ack by removing this label

  

blocked

Waiting on another PR or issue to land first

  

blocker:ci-red

A check is failing — the agent owes a fix (not a rebase)

  

blocker:conflict

Does not merge — the branch conflicts and the agent owes a rebase

  

blocker:drill-pending

A release PR whose version has no drills/X.Y.Z.md record — correct but unevidenced

  

blocker:unrequested

Somebody still owes a verdict and nobody was asked for one

  

bug

Something isn't working

  

claimed

A builder owns it: assignee set, draft PR expected shortly

  

documentation

Improvements or additions to documentation

  

enhancement

New feature or request

  

epic

Organizes other issues via a dependency-ordered task list — builders never pick it

  

merge-next

Head of the merge queue — merge this one next (set by hand/agent, cleared here)

  

needs-ruling

A human decision is pending — question, options and a recommendation are in the comment

  

needs-triage

Did not come through triage — owes normalization into work or a reasoned refusal

  

offsite

Issue deliverable is a PR in another repository — claim clock paused

  

post-merge

Refs-linked PR merged; post-merge criteria remain and triage owns completion

  

ready

Triaged, spec complete, unblocked — a builder can start now and succeed

  

release

Release flow and version/packaging work

  

scope:ci

.forgejo/workflows/, .github/, and .ceremony/ — the test, label, and governance gates

  

scope:cli

src/ — the command surface (cli.js, api.js, config.js)

  

scope:docs

root Markdown and docs/ — the prose contract

  

scope:manifests

manifests/ — the fleet repo registry data

  

scope:packaging

scripts/, release workflow, package manifests, changelog, and fragments — release packaging and version surfaces

  

stale

No activity for 48h — needs a poke (sweep-managed)

  

state:addressing

All bots reviewed — coding agent owes the single reply + fixes

  

state:bots-reviewing

Waiting on the bot reviewers to finish the round

  

state:building

Pre-round: the builder is still building — draft is evidence for it, not the definition

  

state:needs-human

No blockers, all bots approve — waiting on the human reviewer

No labels

attention

blocked

blocker:ci-red

blocker:conflict

blocker:drill-pending

blocker:unrequested

bug

claimed

documentation

enhancement

epic

merge-next

needs-ruling

needs-triage

offsite

post-merge

ready

release

scope:ci

scope:cli

scope:docs

scope:manifests

scope:packaging

stale

state:addressing

state:bots-reviewing

state:building

state:needs-human

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

4 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/stoke#68

No description provided.