Fix staging evidence validation on macOS

ab247b5146ed · AtlantisPleb · 10d ago · parent 6389cbdc1edb

Fix staging evidence validation on macOS

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified ops/staging/validate-report.sh

Diff

1 file changed, +2 -2

  exit 1
}

report_dir=$(CDPATH= cd -- "$(dirname -- "$report")" && pwd)
report_dir=$(realpath "$(dirname -- "$report")")
refs=$(mktemp /tmp/openagents-staging-report-refs.XXXXXX)
cleanup() {
  unlink "$refs" 2>/dev/null || true

    exit 1
  fi

  mode_bits=$(stat -c '%a' "$evidence_path")
  mode_bits=$(stat -c '%a' "$evidence_path" 2>/dev/null || stat -f '%Lp' "$evidence_path")
  case "$mode_bits" in
    400 | 600) ;;
    *) echo "evidence file must not grant group or world access: $relative_path" >&2; exit 1 ;;

151	151		`exit 1`
152	152		`}`
153	153
154		-	`report_dir=$(CDPATH= cd -- "$(dirname -- "$report")" && pwd)`
	154	+	`report_dir=$(realpath "$(dirname -- "$report")")`
155	155		`refs=$(mktemp /tmp/openagents-staging-report-refs.XXXXXX)`
156	156		`cleanup() {`
157	157		`unlink "$refs" 2>/dev/null \|\| true`

198	198		`exit 1`
199	199		`fi`
200	200
201		-	`mode_bits=$(stat -c '%a' "$evidence_path")`
	201	+	`mode_bits=$(stat -c '%a' "$evidence_path" 2>/dev/null \|\| stat -f '%Lp' "$evidence_path")`
202	202		`case "$mode_bits" in`
203	203		`400 \| 600) ;;`
204	204		`*) echo "evidence file must not grant group or world access: $relative_path" >&2; exit 1 ;;`