ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-27 12:56:01 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(crabbox): keep bootstrap runtimes accessible under private umasks (#130627)

Browse Source 
Install public Node and Corepack artifacts in one strict root child shell
with umask 022, leaving the caller's private umask unchanged.

The real sanitized AWS bootstrap failed with exit 127 under umask 0077:
root-owned 0700 installation directories hid the installed Node binary
from the non-root caller. The same-host corrected run completed the
pinned Node 24.19.0/pnpm 11.22.0 install and verified readable public
artifacts, caller umask 0077, temporary HOME 0700, and private files 0600.

Existing bootstrap tests: 2 passed. Shell checks and both required
independent reviews passed. The real privileged-install reproduction is
retained instead of adding a brittle extracted-source installer harness.
This commit is contained in:
Peter Steinberger
2026-08-26 20:20:12 -07:00
committed by GitHub
parent ed79e67276
commit 7e362eba35
1 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/crabbox-untrusted-bootstrap.sh
+14 -5
View File
@@ -67,19 +67,28 @@ trap cleanup EXIT
/usr/bin/grep " ${archive}\$" SHASUMS256.txt | /usr/bin/sha256sum -c -
)
sudo /bin/rm -rf -- "$install_root" "$corepack_home"
sudo /usr/bin/mkdir -p "$install_root" "$corepack_home"
sudo /usr/bin/tar -xJf "$tmp_dir/$archive" -C "$install_root" --strip-components=1
sudo /usr/bin/env \
# Only public toolchain artifacts need shared access; keep caller state private.
sudo /bin/bash -s -- "$install_root" "$corepack_home" "$tmp_dir/$archive" "$pnpm_spec" <<'INSTALL'
set -euo pipefail
umask 022
install_root="$1"
corepack_home="$2"
archive_path="$3"
pnpm_spec="$4"
/bin/rm -rf -- "$install_root" "$corepack_home"
/usr/bin/mkdir -p "$install_root" "$corepack_home"
/usr/bin/tar -xJf "$archive_path" -C "$install_root" --strip-components=1
/usr/bin/env \
COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \
COREPACK_HOME="$corepack_home" \
PATH="$install_root/bin:/usr/bin:/bin" \
"$install_root/bin/corepack" enable --install-directory "$install_root/bin"
sudo /usr/bin/env \
/usr/bin/env \
COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \
COREPACK_HOME="$corepack_home" \
PATH="$install_root/bin:/usr/bin:/bin" \
"$install_root/bin/corepack" prepare "$pnpm_spec" --activate
INSTALL
for tool in node npm npx corepack pnpm pnpx; do
if [[ -e "$install_root/bin/$tool" ]]; then