fix(qa): make verify-issue-365 chmod only the script it runs (#375) #900

Closed

Brouie wants to merge 1 commit from qa/375-verify-365-make-chmod into main

Brouie commented

2026-06-13 04:23:41 +00:00

(Migrated from gitlab.com)

Fixes the make verify-issue-365 portability nit flagged on #375.

The recipe chmod-ed three scripts, but two of them aren't directly exec'd by the ladder:

scripts/with-node.sh is invoked as bash scripts/with-node.sh ... (no exec bit needed).
scripts/setup-cloud-agent-indexer-postgres.sh isn't invoked by the script at all — the bootstrap path shells make setup-indexer-postgres.

When either of those isn't owned by the invoking user (e.g. a cloud-agent run left one non-user-owned), chmod fails and the whole target errors out before the ladder runs. Now the recipe chmods only the one script it execs (scripts/qa/verify-issue-365.sh), with a - prefix so a no-op chmod can never abort the target.

Verified: make verify-issue-365 runs end-to-end, 3/3 PASS (contract P5 + indexer health API + frontend warning util). One-line recipe change, no script/source changes.

Fixes the `make verify-issue-365` portability nit flagged on #375. The recipe chmod-ed three scripts, but two of them aren't directly exec'd by the ladder: - `scripts/with-node.sh` is invoked as `bash scripts/with-node.sh ...` (no exec bit needed). - `scripts/setup-cloud-agent-indexer-postgres.sh` isn't invoked by the script at all — the bootstrap path shells `make setup-indexer-postgres`. When either of those isn't owned by the invoking user (e.g. a cloud-agent run left one non-user-owned), `chmod` fails and the whole target errors out before the ladder runs. Now the recipe chmods only the one script it execs (`scripts/qa/verify-issue-365.sh`), with a `-` prefix so a no-op chmod can never abort the target. Verified: `make verify-issue-365` runs end-to-end, 3/3 PASS (contract P5 + indexer health API + frontend warning util). One-line recipe change, no script/source changes.

Brouie commented

2026-06-13 04:23:51 +00:00

(Migrated from gitlab.com)

mentioned in issue #375

PlasticDigits commented

2026-06-13 04:25:24 +00:00

(Migrated from gitlab.com)

Security review — MR !900

Commit reviewed: 10893b6b79dd253ffbd67c1840bea326cfab84c5
Scope: Makefile verify-issue-365 target only (chmod surface reduction + - error-ignore on chmod).

Summary

Reviewed the diff and traced execution through scripts/qa/verify-issue-365.sh and its bootstrap path (make setup-indexer-postgres → setup-indexer-postgres recipe, which still chmods scripts/setup-cloud-agent-indexer-postgres.sh). Child steps invoke bash scripts/with-node.sh (interpreter path; exec bit not required).

FINDINGS: 0 medium+

No attacker-controlled inputs reach sinks in the changed lines. Paths are static repo-relative literals. The - prefix on chmod only affects QA portability when the invoking user cannot chmod the target; failure modes are a non-executable script (safe Permission denied) or an already-executable script (unchanged behavior). This target is dev/CI-only and does not touch on-chain contracts, indexer APIs, or frontend runtime.

Outcome: Security review: no medium+ findings on this diff.

Inline threads: none (no findings to anchor).

## Security review — MR !900 **Commit reviewed:** `10893b6b79dd253ffbd67c1840bea326cfab84c5` **Scope:** `Makefile` `verify-issue-365` target only (chmod surface reduction + `-` error-ignore on chmod). ### Summary Reviewed the diff and traced execution through `scripts/qa/verify-issue-365.sh` and its bootstrap path (`make setup-indexer-postgres` → `setup-indexer-postgres` recipe, which still chmods `scripts/setup-cloud-agent-indexer-postgres.sh`). Child steps invoke `bash scripts/with-node.sh` (interpreter path; exec bit not required). **FINDINGS: 0** medium+ No attacker-controlled inputs reach sinks in the changed lines. Paths are static repo-relative literals. The `-` prefix on `chmod` only affects QA portability when the invoking user cannot chmod the target; failure modes are a non-executable script (safe `Permission denied`) or an already-executable script (unchanged behavior). This target is dev/CI-only and does not touch on-chain contracts, indexer APIs, or frontend runtime. **Outcome:** Security review: no medium+ findings on this diff. **Inline threads:** none (no findings to anchor).

Brouie (Migrated from gitlab.com) closed this pull request

2026-06-13 04:27:42 +00:00