nsaspy/zara
1
0
Fork 0
Code Issues 95 Pull requests 18 Projects Releases Packages Wiki Activity Actions

RAGE #13: fail closed on unknown app executable fallback #232

Open
nsaspy wants to merge 0 commits from rage/13-open-app-allowlist-regression into master
pull from: rage/13-open-app-allowlist-regression
merge into: nsaspy:master
Conversation 0 Commits - Files changed -
nsaspy commented 2026-09-04 22:43:42 +00:00
Owner
Copy link

Reopens/consumes #13 as a current Zara Core regression from exact master 7340ca414fff8b543a3a279acd93c2bb613b1eab.

TDD RED is proven at exact test-only head f7e4698f3afddcec7d5a46a4f96e660a24037cc9: CI #958 failed the required Run all tests step while Android and both shared-mic gates were green. The fixture places unregistered-app on PATH and requires open_app/1 to reject it without invoking a process.

The minimum production fix is now present at exact head 1c9f7fe5c7af64f83b3be29f3a7958fbe5a34fdc: after app_mapping/2 and explicit direct_app/1 both miss, Zara fails closed instead of promoting an arbitrary app token to PATH executable authority. Configured argv mappings and explicit direct-app allowlisting remain unchanged.

No android/** changes and no external repository work. Sibling #307 remains untouched.

RAGE evidence: rage/13-open-app-allowlist-regression.org.

CI #960 is the current exact-head merge authority. Keep draft and do not merge until focused process safety, full repository tests, nix flake check, build/package gates, exact-head Actions, mergeability, and review/thread state are all conclusively green.

Reopens/consumes #13 as a current Zara Core regression from exact master `7340ca414fff8b543a3a279acd93c2bb613b1eab`. TDD RED is proven at exact test-only head `f7e4698f3afddcec7d5a46a4f96e660a24037cc9`: CI #958 failed the required `Run all tests` step while Android and both shared-mic gates were green. The fixture places `unregistered-app` on PATH and requires `open_app/1` to reject it without invoking a process. The minimum production fix is now present at exact head `1c9f7fe5c7af64f83b3be29f3a7958fbe5a34fdc`: after `app_mapping/2` and explicit `direct_app/1` both miss, Zara fails closed instead of promoting an arbitrary app token to PATH executable authority. Configured argv mappings and explicit direct-app allowlisting remain unchanged. No `android/**` changes and no external repository work. Sibling #307 remains untouched. RAGE evidence: `rage/13-open-app-allowlist-regression.org`. CI #960 is the current exact-head merge authority. Keep draft and do not merge until focused process safety, full repository tests, `nix flake check`, build/package gates, exact-head Actions, mergeability, and review/thread state are all conclusively green.
fix: fail closed on unconfigured app launches
Some checks failed
CI / test (pull_request) Failing after 9s
Details
CI / android skeleton gate (pull_request) Failing after 6s
Details
CI / shared mic / Arch Linux (pull_request) Failing after 7m40s
Details
CI / shared mic / Ubuntu 24.04 (pull_request) Failing after 11m55s
Details
1c9f7fe5c7
Some checks failed
CI / test (pull_request) Failing after 9s
Details
CI / android skeleton gate (pull_request) Failing after 6s
Details
CI / shared mic / Arch Linux (pull_request) Failing after 7m40s
Details
CI / shared mic / Ubuntu 24.04 (pull_request) Failing after 11m55s
Details
This branch is already included in the target branch. There is nothing to merge.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin rage/13-open-app-allowlist-regression:rage/13-open-app-allowlist-regression
git switch rage/13-open-app-allowlist-regression

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master
git merge --no-ff rage/13-open-app-allowlist-regression
git switch rage/13-open-app-allowlist-regression
git rebase master
git switch master
git merge --ff-only rage/13-open-app-allowlist-regression
git switch rage/13-open-app-allowlist-regression
git rebase master
git switch master
git merge --no-ff rage/13-open-app-allowlist-regression
git switch master
git merge --squash rage/13-open-app-allowlist-regression
git switch master
git merge --ff-only rage/13-open-app-allowlist-regression
git switch master
git merge rage/13-open-app-allowlist-regression
git push origin master
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
nsaspy/zara!232
No description provided.