docs: README claims verify-build covers "nothing the build did not write", which is broader than what is enforced #331
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Found by the review of #330 (#330 (comment)). Documentation precision on a security control, which is why it is in the milestone despite being a one-paragraph change.
check_dist_treeinscript/verify-buildwalks-type f -o -type lonly. A fifo, socket, device node, or empty directory added todist/after the build therefore passes verification. The exclusion is deliberate and correct — the script explains it, and grep on a fifo would hang — and none of those can carry a shippable payload.The problem is only that
README.mdstates the guarantee as "nothing underdist/that the build did not write", which is broader than what the code enforces. #309 exists because this control was trusted beyond what it actually checked; restating it slightly too broadly is the same mistake in miniature. Everything else in the PR's claim was verified as exactly bounded.Definition of done
README.mdstates the enforced guarantee precisely: regular files and symlinks underdist/are covered; fifos, sockets, device nodes and empty directories are not, and why.script/verify-builddescribes itself, so the code and the docs cannot drift.make checkgreen.