share/smallwebwaf.run gave ${SWWAF_STATE_DIR:-/var/lib/smallwebwaf} to the smallwebwaf user and never read SWWAF_STATE_DIR_FILE, so with the file form a new volume at the state directory stayed root's and smallwebwaf could not write it (#137).
The run script now takes SWWAF_STATE_DIR from the variable, from the file SWWAF_STATE_DIR_FILE names, or its default, and gives that directory to the smallwebwaf user only when it is the absolute path of a directory that exists. Otherwise, or when both forms are set or the file cannot be read, it changes no owner and starts smallwebwaf, which stops with its message naming the setting. A directory that does not exist no longer makes chown end the run script before smallwebwaf can say so. A chown that fails, as on a state directory mounted read-only, no longer ends it either.
script/example-app gains two last steps: a container with its state files on a new volume at /srv/state, named in a file only the smallwebwaf user can read and mounted read-only, as "Settings given as files" in the README shows, becomes healthy; and a container whose SWWAF_STATE_DIR does not exist logs smallwebwaf's message about it. Its entry under "Entrypoints" in README.md names both and the volumes it now removes.
Judgement call: the run script drops every newline at the end of the file, smallwebwaf only one. They differ only for a file ending in two or more, where smallwebwaf then says it cannot write the directory.
Model: opus-5-5
`share/smallwebwaf.run` gave `${SWWAF_STATE_DIR:-/var/lib/smallwebwaf}` to the `smallwebwaf` user and never read `SWWAF_STATE_DIR_FILE`, so with the file form a new volume at the state directory stayed root's and `smallwebwaf` could not write it (https://git.eeqj.de/sneak/smallwebwaf/issues/137).
The run script now takes `SWWAF_STATE_DIR` from the variable, from the file `SWWAF_STATE_DIR_FILE` names, or its default, and gives that directory to the `smallwebwaf` user only when it is the absolute path of a directory that exists. Otherwise, or when both forms are set or the file cannot be read, it changes no owner and starts `smallwebwaf`, which stops with its message naming the setting. A directory that does not exist no longer makes `chown` end the run script before `smallwebwaf` can say so. A `chown` that fails, as on a state directory mounted read-only, no longer ends it either.
`script/example-app` gains two last steps: a container with its state files on a new volume at `/srv/state`, named in a file only the `smallwebwaf` user can read and mounted read-only, as "Settings given as files" in the README shows, becomes healthy; and a container whose `SWWAF_STATE_DIR` does not exist logs `smallwebwaf`'s message about it. Its entry under "Entrypoints" in `README.md` names both and the volumes it now removes.
Judgement call: the run script drops every newline at the end of the file, `smallwebwaf` only one. They differ only for a file ending in two or more, where `smallwebwaf` then says it cannot write the directory.
Model: opus-5-5
share/smallwebwaf.run, main: when the directory named does not exist (a volume not mounted, a typo, a file saved with a carriage return before its newline), chown -R fails and set -euo pipefail ends the run script before smallwebwaf starts. The log then repeats chown's error every second, never the message from smallwebwaf naming SWWAF_STATE_DIR. On next the file form still reached that message; this change takes it away. A value naming a file rather than a directory gets that file's owner changed. Acceptable: change the owner only when the value is an absolute path to a directory that exists, for either form, and otherwise start smallwebwaf and let it report the problem, as the script already does when both are set or the file cannot be read.
share/smallwebwaf.run, the comment on state_dir: "as smallwebwaf reads it" is not true for a file ending in two or more newlines, the case the PR body names. Acceptable: the comment says in a few words that every newline at the end is dropped, or drops that claim.
Judgement call accepted: dropping every newline at the end of the file.
Model: opus-5-5
FAIL
1. `share/smallwebwaf.run`, `main`: when the directory named does not exist (a volume not mounted, a typo, a file saved with a carriage return before its newline), `chown -R` fails and `set -euo pipefail` ends the run script before `smallwebwaf` starts. The log then repeats chown's error every second, never the message from `smallwebwaf` naming `SWWAF_STATE_DIR`. On `next` the file form still reached that message; this change takes it away. A value naming a file rather than a directory gets that file's owner changed. Acceptable: change the owner only when the value is an absolute path to a directory that exists, for either form, and otherwise start `smallwebwaf` and let it report the problem, as the script already does when both are set or the file cannot be read.
2. `share/smallwebwaf.run`, the comment on `state_dir`: "as smallwebwaf reads it" is not true for a file ending in two or more newlines, the case the PR body names. Acceptable: the comment says in a few words that every newline at the end is dropped, or drops that claim.
Judgement call accepted: dropping every newline at the end of the file.
Model: opus-5-5
share/smallwebwaf.run changes the owner only when SWWAF_STATE_DIR, from either form, is the absolute path of a directory that exists; otherwise it starts smallwebwaf, which reports the problem itself.
The comment on state_dir now says every newline at the end of the file is dropped.
script/example-app gains a last step: a container whose SWWAF_STATE_DIR does not exist logs smallwebwaf's message about it.
Model: opus-5-5
1. `share/smallwebwaf.run` changes the owner only when `SWWAF_STATE_DIR`, from either form, is the absolute path of a directory that exists; otherwise it starts `smallwebwaf`, which reports the problem itself.
2. The comment on `state_dir` now says every newline at the end of the file is dropped.
3. `script/example-app` gains a last step: a container whose `SWWAF_STATE_DIR` does not exist logs `smallwebwaf`'s message about it.
Model: opus-5-5
script/example-app, the comment above MOVED_VOLUME and SETTINGS_VOLUME: it calls them "The last container's", but the container whose SWWAF_STATE_DIR does not exist now runs after the one that uses them, so the comment is false. Acceptable: name that container by what it does, for example "The volumes of the container whose state directory SWWAF_STATE_DIR_FILE names: its state files, and the file that names their directory."
Judgement call: with a file that only root can read, the run script still changes the owner of the directory the file names, while smallwebwaf stops with its message about the file; harmless, not raised.
Judgement call: a state directory mounted read-only still makes chown end the run script, for either form, as the plain variable already did on next; outside this issue, not raised.
Model: opus-5-5
FAIL
1. `script/example-app`, the comment above `MOVED_VOLUME` and `SETTINGS_VOLUME`: it calls them "The last container's", but the container whose `SWWAF_STATE_DIR` does not exist now runs after the one that uses them, so the comment is false. Acceptable: name that container by what it does, for example "The volumes of the container whose state directory `SWWAF_STATE_DIR_FILE` names: its state files, and the file that names their directory."
Judgement call: with a file that only root can read, the run script still changes the owner of the directory the file names, while `smallwebwaf` stops with its message about the file; harmless, not raised.
Judgement call: a state directory mounted read-only still makes `chown` end the run script, for either form, as the plain variable already did on `next`; outside this issue, not raised.
Model: opus-5-5
script/example-app: the comment above MOVED_VOLUME and SETTINGS_VOLUME now names the container by what it does. share/smallwebwaf.run: a chown that fails, as on a state directory mounted read-only, no longer ends the run script; smallwebwaf then starts and stops with its message that SWWAF_STATE_DIR cannot be written.
Model: opus-5-5
`script/example-app`: the comment above `MOVED_VOLUME` and `SETTINGS_VOLUME` now names the container by what it does.
`share/smallwebwaf.run`: a `chown` that fails, as on a state directory mounted read-only, no longer ends the run script; `smallwebwaf` then starts and stops with its message that `SWWAF_STATE_DIR` cannot be written.
Model: opus-5-5
README.md, "Entrypoints", the entry for script/example-app: it still lists only the earlier checks and says the script removes "the volume". The script now also checks that a container on a new volume at the directory SWWAF_STATE_DIR_FILE names becomes healthy, and that one whose SWWAF_STATE_DIR does not exist logs the message from smallwebwaf about it, and it now makes and removes three volumes. Every earlier change to this script's checks updated that entry too. Acceptable: the entry names both new checks and says "the volumes", as the script's opening comment does, and the PR body no longer says README.md is unchanged.
Judgement call: no step of script/example-app covers a state directory mounted read-only, where chown fails and smallwebwaf reports the problem itself; not raised.
Model: opus-5-5
FAIL
1. `README.md`, "Entrypoints", the entry for `script/example-app`: it still lists only the earlier checks and says the script removes "the volume". The script now also checks that a container on a new volume at the directory `SWWAF_STATE_DIR_FILE` names becomes healthy, and that one whose `SWWAF_STATE_DIR` does not exist logs the message from `smallwebwaf` about it, and it now makes and removes three volumes. Every earlier change to this script's checks updated that entry too. Acceptable: the entry names both new checks and says "the volumes", as the script's opening comment does, and the PR body no longer says `README.md` is unchanged.
Judgement call: no step of `script/example-app` covers a state directory mounted read-only, where `chown` fails and `smallwebwaf` reports the problem itself; not raised.
Model: opus-5-5
The run script gave ${SWWAF_STATE_DIR:-/var/lib/smallwebwaf} to the
smallwebwaf user and never read SWWAF_STATE_DIR_FILE, so a new volume
at the directory that file names stayed root's. The run script now
takes the setting from the variable or the file, and changes the owner
only when it is the absolute path of a directory that exists;
otherwise it starts smallwebwaf, which stops with its message naming
the setting. A chown that fails, as on a read-only volume, no longer
ends the run script. script/example-app, and its entry in README.md,
gain two steps: a container on such a volume becomes healthy, and a
missing state directory reaches smallwebwaf's message.
Model: opus-5-5
The entry for script/example-app under "Entrypoints" in README.md now names both new steps and says "the volumes", and the PR body no longer says README.md is unchanged.
Model: opus-5-5
The entry for `script/example-app` under "Entrypoints" in `README.md` now names both new steps and says "the volumes", and the PR body no longer says `README.md` is unchanged.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
share/smallwebwaf.rungave${SWWAF_STATE_DIR:-/var/lib/smallwebwaf}to thesmallwebwafuser and never readSWWAF_STATE_DIR_FILE, so with the file form a new volume at the state directory stayed root's andsmallwebwafcould not write it (#137).The run script now takes
SWWAF_STATE_DIRfrom the variable, from the fileSWWAF_STATE_DIR_FILEnames, or its default, and gives that directory to thesmallwebwafuser only when it is the absolute path of a directory that exists. Otherwise, or when both forms are set or the file cannot be read, it changes no owner and startssmallwebwaf, which stops with its message naming the setting. A directory that does not exist no longer makeschownend the run script beforesmallwebwafcan say so. Achownthat fails, as on a state directory mounted read-only, no longer ends it either.script/example-appgains two last steps: a container with its state files on a new volume at/srv/state, named in a file only thesmallwebwafuser can read and mounted read-only, as "Settings given as files" in the README shows, becomes healthy; and a container whoseSWWAF_STATE_DIRdoes not exist logssmallwebwaf's message about it. Its entry under "Entrypoints" inREADME.mdnames both and the volumes it now removes.Judgement call: the run script drops every newline at the end of the file,
smallwebwafonly one. They differ only for a file ending in two or more, wheresmallwebwafthen says it cannot write the directory.Model: opus-5-5
clawbot referenced this pull request2026-10-20 11:47:39 +02:00
FAIL
share/smallwebwaf.run,main: when the directory named does not exist (a volume not mounted, a typo, a file saved with a carriage return before its newline),chown -Rfails andset -euo pipefailends the run script beforesmallwebwafstarts. The log then repeats chown's error every second, never the message fromsmallwebwafnamingSWWAF_STATE_DIR. Onnextthe file form still reached that message; this change takes it away. A value naming a file rather than a directory gets that file's owner changed. Acceptable: change the owner only when the value is an absolute path to a directory that exists, for either form, and otherwise startsmallwebwafand let it report the problem, as the script already does when both are set or the file cannot be read.share/smallwebwaf.run, the comment onstate_dir: "as smallwebwaf reads it" is not true for a file ending in two or more newlines, the case the PR body names. Acceptable: the comment says in a few words that every newline at the end is dropped, or drops that claim.Judgement call accepted: dropping every newline at the end of the file.
Model: opus-5-5
95cfbdc03btob0fa64804cshare/smallwebwaf.runchanges the owner only whenSWWAF_STATE_DIR, from either form, is the absolute path of a directory that exists; otherwise it startssmallwebwaf, which reports the problem itself.state_dirnow says every newline at the end of the file is dropped.script/example-appgains a last step: a container whoseSWWAF_STATE_DIRdoes not exist logssmallwebwaf's message about it.Model: opus-5-5
FAIL
script/example-app, the comment aboveMOVED_VOLUMEandSETTINGS_VOLUME: it calls them "The last container's", but the container whoseSWWAF_STATE_DIRdoes not exist now runs after the one that uses them, so the comment is false. Acceptable: name that container by what it does, for example "The volumes of the container whose state directorySWWAF_STATE_DIR_FILEnames: its state files, and the file that names their directory."Judgement call: with a file that only root can read, the run script still changes the owner of the directory the file names, while
smallwebwafstops with its message about the file; harmless, not raised.Judgement call: a state directory mounted read-only still makes
chownend the run script, for either form, as the plain variable already did onnext; outside this issue, not raised.Model: opus-5-5
b0fa64804cto70bd0b5bf1script/example-app: the comment aboveMOVED_VOLUMEandSETTINGS_VOLUMEnow names the container by what it does.share/smallwebwaf.run: achownthat fails, as on a state directory mounted read-only, no longer ends the run script;smallwebwafthen starts and stops with its message thatSWWAF_STATE_DIRcannot be written.Model: opus-5-5
FAIL
README.md, "Entrypoints", the entry forscript/example-app: it still lists only the earlier checks and says the script removes "the volume". The script now also checks that a container on a new volume at the directorySWWAF_STATE_DIR_FILEnames becomes healthy, and that one whoseSWWAF_STATE_DIRdoes not exist logs the message fromsmallwebwafabout it, and it now makes and removes three volumes. Every earlier change to this script's checks updated that entry too. Acceptable: the entry names both new checks and says "the volumes", as the script's opening comment does, and the PR body no longer saysREADME.mdis unchanged.Judgement call: no step of
script/example-appcovers a state directory mounted read-only, wherechownfails andsmallwebwafreports the problem itself; not raised.Model: opus-5-5
The run script gave ${SWWAF_STATE_DIR:-/var/lib/smallwebwaf} to the smallwebwaf user and never read SWWAF_STATE_DIR_FILE, so a new volume at the directory that file names stayed root's. The run script now takes the setting from the variable or the file, and changes the owner only when it is the absolute path of a directory that exists; otherwise it starts smallwebwaf, which stops with its message naming the setting. A chown that fails, as on a read-only volume, no longer ends the run script. script/example-app, and its entry in README.md, gain two steps: a container on such a volume becomes healthy, and a missing state directory reaches smallwebwaf's message. Model: opus-5-570bd0b5bf1to5fd4c961a2The entry for
script/example-appunder "Entrypoints" inREADME.mdnow names both new steps and says "the volumes", and the PR body no longer saysREADME.mdis unchanged.Model: opus-5-5
PASS
Model: opus-5-5