fix: Linux desktop installer hardening from the #1019 Copilot review - #1023
Merged
Merged
Conversation
Three follow-ups to the Linux AppImage installer: - effectiveInstallDir normalizes a user-supplied --path to an absolute path, so the desktop entry Exec, the ~/.local/bin symlink, and the running-app probe all name the same launchable path regardless of the CWD a relative --path was typed from. - A failed activation flip (temp symlink or rename over current) removes the promoted version dir and the temp symlink, leaving the previous install exactly as it was. - validateExtractedTree requires AppRun to be executable, since the desktop entry and the relaunch both exec it. Also closes the review-pr stage of 260917-ot32 (its findings land here). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
sahil87
added a commit
that referenced
this pull request
Sep 17, 2026
Independent-review follow-ups on the Linux installer: - A same-version `--force` reinstall used to RemoveAll the LIVE version dir before promoting the new tree, so a failed flip left `current` dangling. The live tree is now set aside inside staging and restored by restoreLinuxSwap when promotion or activation fails; rollback failures are reported as warnings instead of swallowed. - The temp activation symlink lives inside staging (same filesystem, so the rename over `current` stays atomic), which removes the stale-tmp pre-clear and the per-branch cleanup. - linuxProbePattern quotes the path for pgrep's ERE, so a --path with regex metacharacters still matches the running app. - Uninstall drops its redundant filepath.Abs — effectiveInstallDir already returns an absolute root. - Records PR #1023 on the 260917-ot32 change. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
sahil87
added a commit
that referenced
this pull request
Sep 17, 2026
…nstall; quote the pgrep pattern (#1024) * fix: same-version reinstall keeps the live tree; quote the pgrep pattern Independent-review follow-ups on the Linux installer: - A same-version `--force` reinstall used to RemoveAll the LIVE version dir before promoting the new tree, so a failed flip left `current` dangling. The live tree is now set aside inside staging and restored by restoreLinuxSwap when promotion or activation fails; rollback failures are reported as warnings instead of swallowed. - The temp activation symlink lives inside staging (same filesystem, so the rename over `current` stays atomic), which removes the stale-tmp pre-clear and the per-branch cleanup. - linuxProbePattern quotes the path for pgrep's ERE, so a --path with regex metacharacters still matches the running app. - Uninstall drops its redundant filepath.Abs — effectiveInstallDir already returns an absolute root. - Records PR #1023 on the 260917-ot32 change. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * chore: record PR #1024 on change 260917-ot32 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #1019 (already merged), addressing the three inline findings Copilot posted on it after the merge.
Changes
effectiveInstallDirnormalizes a user-supplied--pathto an absolute path, so the desktop entryExec, the~/.local/bin/run-kit-desktopsymlink, and the running-app probe all name the same launchable path regardless of the CWD a relative--pathwas typed from.current) now removes the promoted version dir and the temp symlink, leaving the previous install exactly as it was.validateExtractedTreerequiresAppRunto be executable, since the desktop entry and the relaunch both exec it.Tests
TestEffectiveInstallDirRelativePathIsAbsoluteTestInstallLinuxFlipFailureLeavesNothingBehind(a non-empty directory atcurrentforces the rename to fail)TestInstallLinuxInvalidTreeRefusedgains the non-executableAppRuncaseGates:
go test ./internal/desktop/... ./cmd/rk/...green,go vetclean, touched files gofmt-clean.Also finishes the
review-prstage of change 260917-ot32 (its review findings are processed here).🤖 Generated with Claude Code