From d644d71eec671d684e5c915c03c068b83f027205 Mon Sep 17 00:00:00 2001 From: Tobias Kaupat Date: Sun, 18 Oct 2026 11:06:20 +0200 Subject: [PATCH] fix: keep backup.sh executable in the sabotage self test The sed+mv rewrite left backup.sh at mode 644, so /bin/backup in the sabotage image was not executable and the suite failed for the wrong reason. Restore the executable bit and make --sabotage fail when backup.sh is not executable or the log contains 'permission denied'. Co-Authored-By: Claude Sonnet 5.5 --- test/run.sh | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/test/run.sh b/test/run.sh index a878ccd..c3b69d9 100644 --- a/test/run.sh +++ b/test/run.sh @@ -88,10 +88,16 @@ if [ "$SABOTAGE" -eq 1 ]; then # No `sed -i`: its argument differs between GNU and BSD (macOS) sed. sed 's|^restic backup |true |' "$tmp/backup.sh" > "$tmp/backup.sh.new" \ && mv "$tmp/backup.sh.new" "$tmp/backup.sh" + # mv keeps the mode of the new file (644); Dockerfile COPY has no chmod. + chmod +x "$tmp/backup.sh" if ! grep -q '^true ' "$tmp/backup.sh"; then echo "sabotage patch did not apply, backup.sh changed shape" >&2 exit 2 fi + if [ ! -x "$tmp/backup.sh" ]; then + echo "SABOTAGE CHECK INVALID: sabotaged backup.sh is not executable" >&2 + exit 2 + fi build_image "$tmp" restic-backup-docker:sabotage || exit 2 echo ">>> running compat suite against the sabotaged image (failure expected)" sabotage_log="${tmp}/compat.log" @@ -102,6 +108,11 @@ if [ "$SABOTAGE" -eq 1 ]; then exit 1 fi cat "$sabotage_log" + # Red for the wrong reason (e.g. a non-executable /bin/backup) proves nothing. + if grep -qi 'permission denied' "$sabotage_log"; then + echo "SABOTAGE CHECK INVALID: log contains 'permission denied', suite failed for the wrong reason" >&2 + exit 2 + fi # Any red test would do for "it failed"; a broken test environment is red too. # Demand the assertions that are about the backup itself. missing=0