eric/ReleaseKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Use external temporary storage for release builds

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-06 01:00:11 +00:00
parent 4dee2841e0
commit 8b417760c6
8 changed files with 109 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
docs/roadmap/remediation.md
View File

@@ -230,6 +230,8 @@ offline suite, and compiled-export/import checks pass.
### R6 — Medium: Builds require a writable parent of the repository
Status: Resolved.
Category: Inadvertently strengthened filesystem prerequisite.
**Evidence:** [Candidate builds](../../internal/build/candidate.go), around line 21,
@@ -250,6 +252,11 @@ adding broad output-directory restrictions.
read-only repository parent and a usable system temporary directory. Generated
candidate output still leaves the worktree clean.
**Resolution:** Candidate and CLI delivery builds use shared system temporary
storage allocated by `internal/tempdir`, with worktree containment checks and
caller-owned cleanup. Regressions execute both operations with read-only
repository parents and confirm clean worktrees. Affected suites pass.
### R7 — Medium: Attachment origin restrictions exceed credential isolation
Category: Inadvertently strengthened prohibition.