fix(test): skip TestLocalResolver_BubblesUpCopyFailure when uid==0 #184

2026-05-09T22:23:31Z

core-devops commented

2026-05-09 22:23:31 +00:00

Summary

Fix TestLocalResolver_BubblesUpCopyFailure which silently passed when running as uid==0
os.Chmod(dst, 0o555) is advisory for root -- it silently passes
A previous /dev/full symlink attempt also failed: Go's os.MkdirAll resolves the symlink during traversal; the kernel allows mkdir("/dev/full") as a device-table entry, and io.Copy to /dev/full returns nil with 0 bytes written
The fix mirrors TestLocalResolver_CopyFileSourceUnreadable: skip when os.Getuid() == 0

Test plan

go test ./internal/plugins/... -run TestLocalResolver_BubblesUpCopyFailure -v -> PASS
go test ./internal/plugins/... -> all 31 tests PASS

🤖 Generated with Claude Code

## Summary - Fix `TestLocalResolver_BubblesUpCopyFailure` which silently passed when running as uid==0 - `os.Chmod(dst, 0o555)` is advisory for root -- it silently passes - A previous `/dev/full` symlink attempt also failed: Go's `os.MkdirAll` resolves the symlink during traversal; the kernel allows `mkdir("/dev/full")` as a device-table entry, and `io.Copy` to `/dev/full` returns nil with 0 bytes written - The fix mirrors `TestLocalResolver_CopyFileSourceUnreadable`: skip when `os.Getuid() == 0` ## Test plan - [x] `go test ./internal/plugins/... -run TestLocalResolver_BubblesUpCopyFailure -v` -> PASS - [x] `go test ./internal/plugins/...` -> all 31 tests PASS 🤖 Generated with [Claude Code](https://claude.com/claude-code)

core-devops added 1 commit 2026-05-09 22:23:31 +00:00

fix(test): skip TestLocalResolver_BubblesUpCopyFailure when uid==0

sop-tier-check / tier-check (pull_request) Failing after 4s

Details

Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 4s

Details

audit-force-merge / audit (pull_request) Has been skipped

Details

e65633bf15

os.Chmod(dst, 0o555) silently passes when os.Geteuid() == 0 because
root bypasses POSIX permission checks. A previous attempt to use a
symlink to /dev/full also fails: Go's os.MkdirAll resolves the symlink
during path traversal and the kernel allows mkdir("/dev/full") as a
device-table entry — io.Copy to /dev/full then succeeds with 0 bytes
written and returns nil.

The honest, consistent fix mirrors TestLocalResolver_CopyFileSourceUnreadable:
skip when running as root. The write-failure propagation logic is
exercised correctly in non-root CI environments.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

core-devops closed this pull request

2026-05-09 22:24:31 +00:00

hongming referenced this issue from a commit

2026-05-18 08:51:23 +00:00

fix(ws-server): fail-closed on unresolvable template runtime (controlplane#188)

hongming referenced this pull request

2026-05-18 08:51:36 +00:00

fix(ws-server): fail-closed on unresolvable template runtime (controlplane#188) #1489

infra-runtime-be referenced this issue from a commit

2026-05-18 11:24:52 +00:00

fix(ws-server): fail-closed on unresolvable template runtime (controlplane#188)

core-fe referenced this issue from a commit