Repository navigation
Fix srv1 deploy main-red: shell.Exec.Run script receiver sh -> bash (pipefail) - #6746
Merged
Merged
Conversation
…pipefail) #6711 fixed the deploy E2BIG by routing the script through stdin (sh -s), which let the script actually RUN — exposing the next bug: the live_deploy apply script uses `set -euo pipefail` (emit.dag:73,120), a bash builtin option. `sh -s` runs it under /bin/sh = dash on srv1, which rejects `-o pipefail`: sh: 1: set: Illegal option -o pipefail -> exit 2 -> host_effect_apply fail-closed -> deploy_dashboard_srv1 red on main. Root: a §3 receiver fork — the ssh path already declares the script receiver as `bash -s` (ssh_transport_witness_test.dag ssh_exec_script_remote_receiver), but the local Run transport used `sh -s`. Dissolve the fork: Run -> `["bash", "-s"]`, one script receiver for both paths. (Check stays `sh -c` — it runs short POSIX probes, not pipefail scripts.) Proven by execution: - Direct: printf 'set -euo pipefail\necho ok' | sh -s => Illegal option -o pipefail | bash -s => ok - Witness shell_exec_run_argv_embed_witnesses extended: asserts the apply script requires bash (contains pipefail) AND Run uses `["bash", "-s"]` and not `["sh","-s"]`. GREEN on the fix; FAIL when reverted to sh -s (discriminating RED control). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Symptom (main-red, operator-flagged)
deploy_dashboard_srv1fails on main after #6711:Root cause
#6711 fixed the deploy E2BIG by routing the script through stdin (
sh -s) instead of embedding it in argv. That let the script actually run — exposing the next bug: thelive_deployapply script usesset -euo pipefail(emit.dag:73,120), a bash builtin option.sh -sruns it under/bin/sh= dash on srv1, which rejects-o pipefail→ exit 2 →host_effect_applyfail-closed → red.It's a §3 receiver fork: the ssh path already declares the script receiver as
bash -s(ssh_exec_script_remote_receiver), but the local Run transport usedsh -s. This dissolves the fork — Run →["bash", "-s"], one script receiver for both paths.Checkstayssh -c(short POSIX probes, no pipefail).Proven by execution
printf 'set -euo pipefail\necho ok' | sh -s→Illegal option -o pipefail;| bash -s→ok.shell_exec_run_argv_embed_witnessesextended: asserts the apply script requires bash (containspipefail) and Run uses["bash", "-s"](not["sh", "-s"]). GREEN on the fix; FAIL when reverted tosh -s(discriminating RED control, verified locally).🤖 Generated with Claude Code