docs: remove outdated hash-includes-perms-owner gap#5
Merged
Conversation
…validations Implement all 6 gaps from the algorithm specification: Phase 1 — Permission preset mappings: - Fix Private preset: 755→700 (not 600) for directories - Add reverse_map_permissions for CopyToSource - Fix resolve_file_perms to store mapped target perms in state Phase 2 — Directory permission warnings: - Warn on directory perm/owner mismatches (don't modify) - Use dir_perms preset for expected directory permissions Phase 3 — Security: foreign dir owner edge case: - Skip files with no explicit owner in foreign-owned directories Phase 4 — Deviating directories validation: - Check deviating entries after sync, warn on mismatches - Canonicalize deviating paths in config loading Phase 5 — Target-to-source validation: - Validate target perms/owner before CopyToSource - Skip files with unexpected perms using reverse mapping Phase 6 — Action feasibility validation: - Add failed_checks field to all Change variants - Implement validate_actions in changes pipeline - Show failed counts in status (long+short format) - Print warnings and skip failed changes in sync 6 new e2e tests (85 total, 55 unit tests passing)
- Remove unused imports in e2e tests (deno lint) - Fix copy-to-source-owner test: target file must have configured owner for Phase 5 validation to pass (root:root not user:user)
Avoid exact stderr matching for deviating directory warnings to support macOS where user/group names differ from Linux runners.
…ce check - Foreign-dir owner check now only runs when security bypass is false (trusted root-owned configs skip the check) - CopyToSource feasibility no longer requires source parent to exist (it is created by create_dir_all during copy)
nknapp
commented
Jul 14, 2026
| [[sync.deviating]] | ||
| path = "/etc/ssh" | ||
| path = "./target/special-dir" | ||
| permissions = "700" |
Owner
Author
There was a problem hiding this comment.
permissions should not be allowed anymore
nknapp
commented
Jul 14, 2026
|
|
||
| assertEquals(await testbed.readTestDir(), [ | ||
| "user:user | 0644 | 0 | config.cfgsync.state | CFGSYNC_STATE", | ||
| `user:user | 0644 | 0 | config.cfgsync.state | CFGSYNC_STATE`, |
nknapp
commented
Jul 14, 2026
| files: [ | ||
| "user:user | 0755 | 0 | config.toml | __CONFIG_TOML__", | ||
| "user:user | 0755 | 0 | source/", | ||
| "user:user | 0755 | 0 | target/", |
Owner
Author
There was a problem hiding this comment.
Set the directory to root:root as well
The permissions field on sync.deviating entries was never used effectively. Deviating entry validation now only checks owner.
nknapp
commented
Jul 14, 2026
| permission skips: 1 | ||
| `, | ||
| stderr: deindent` | ||
| Permission warning: directory 'subdir' has 0o755, should be 0o700 (run as root to fix) |
Owner
Author
There was a problem hiding this comment.
Instead of 0o755 write 755
nknapp
commented
Jul 14, 2026
| globs = ["**/*.conf"] | ||
| `, | ||
| files: [ | ||
| "user:user | 0755 | 0 | config.toml | __CONFIG_TOML__", |
…target dir
- Change {:o} instead of 0o{:o} in all permission warning messages
- Set target/ directory owner to root:root in copy-to-source-owner test
- Update all e2e tests to match new warning format (644/600 instead of 0o644/0o600)
Script automates verification, commit, push, and CI wait. AGENTS.md now references the script instead of listing steps manually.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The spec and implementation both now use content-only hashing (XXH3_128 over file contents). This gap was resolved in a previous PR.