From 7e362eba35cc933d708374b6070e67160652989b Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Wed, 26 Aug 2026 20:20:12 -0700
Subject: [PATCH] fix(crabbox): keep bootstrap runtimes accessible under
 private umasks (#130627)

Install public Node and Corepack artifacts in one strict root child shell
with umask 022, leaving the caller's private umask unchanged.

The real sanitized AWS bootstrap failed with exit 127 under umask 0077:
root-owned 0700 installation directories hid the installed Node binary
from the non-root caller. The same-host corrected run completed the
pinned Node 24.19.0/pnpm 11.22.0 install and verified readable public
artifacts, caller umask 0077, temporary HOME 0700, and private files 0600.

Existing bootstrap tests: 2 passed. Shell checks and both required
independent reviews passed. The real privileged-install reproduction is
retained instead of adding a brittle extracted-source installer harness.
---
 scripts/crabbox-untrusted-bootstrap.sh | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/scripts/crabbox-untrusted-bootstrap.sh b/scripts/crabbox-untrusted-bootstrap.sh
index bc340adef0de..1c9ab8326e1a 100755
--- a/scripts/crabbox-untrusted-bootstrap.sh
+++ b/scripts/crabbox-untrusted-bootstrap.sh
@@ -67,19 +67,28 @@ trap cleanup EXIT
   /usr/bin/grep "  ${archive}\$" SHASUMS256.txt | /usr/bin/sha256sum -c -
 )
 
-sudo /bin/rm -rf -- "$install_root" "$corepack_home"
-sudo /usr/bin/mkdir -p "$install_root" "$corepack_home"
-sudo /usr/bin/tar -xJf "$tmp_dir/$archive" -C "$install_root" --strip-components=1
-sudo /usr/bin/env \
+# Only public toolchain artifacts need shared access; keep caller state private.
+sudo /bin/bash -s -- "$install_root" "$corepack_home" "$tmp_dir/$archive" "$pnpm_spec" <<'INSTALL'
+set -euo pipefail
+umask 022
+install_root="$1"
+corepack_home="$2"
+archive_path="$3"
+pnpm_spec="$4"
+/bin/rm -rf -- "$install_root" "$corepack_home"
+/usr/bin/mkdir -p "$install_root" "$corepack_home"
+/usr/bin/tar -xJf "$archive_path" -C "$install_root" --strip-components=1
+/usr/bin/env \
   COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \
   COREPACK_HOME="$corepack_home" \
   PATH="$install_root/bin:/usr/bin:/bin" \
   "$install_root/bin/corepack" enable --install-directory "$install_root/bin"
-sudo /usr/bin/env \
+/usr/bin/env \
   COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \
   COREPACK_HOME="$corepack_home" \
   PATH="$install_root/bin:/usr/bin:/bin" \
   "$install_root/bin/corepack" prepare "$pnpm_spec" --activate
+INSTALL
 
 for tool in node npm npx corepack pnpm pnpx; do
   if [[ -e "$install_root/bin/$tool" ]]; then