🤖 verification skills: harden check.sh and verify.sh argument and file handling (#391 follow-ups)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 76/100
Research direction
Read hack/formal/aigatewaykey/check.sh and .mux/skills/verify-coder-k8s/scripts/verify.sh. Check how check.sh parses --config, --out, and --set, then inspect load_run and the EXIT traps in verify.sh. Done when missing option values exit 2, run.env is rejected if it is a symlink or has group/other write bits, and trap handling works with a single quote in VERIFY_RUN_DIR; no test or run command is named in the issue.
Written by the indexing model from the issue text.
Description
Follow-ups from Codex review round 4 on #391. Under the review limit for #391 (rounds 4 to 6 fix blockers only), I judged these minor and deferred them.
hack/formal/aigatewaykey/check.sh:--config,--outor--setas the last argument exits 1 ("unbound variable"). Exit 1 means a rule violation. A malformed call must exit 2. Fix: check that each option has a value before reading$2..mux/skills/verify-coder-k8s/scripts/verify.shload_run: before it sourcesrun.env, check that the file is a regular file (not a symlink) with no group or other write bits. Launch creates it with mode 0600 in a private run dir, so this matters only after someone changes its mode.verify.shEXIT traps (coder-apiport-forward, temp files): the traps build shell code from expanded paths. A'inVERIFY_RUN_DIRbreaks the trap and leaves the port-forward running. Use a trap function that reads already-set variables.
Trigger: the next change to either script.
Generated with mux • Model: anthropic:claude-opus-5-5 • Thinking: high
- Dominant language
- Go
- Stars
- 5
- Forks
- 3
- Avg merge
- 2h 56m
- Merged PRs (30d)
- 163
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from coder/coder-k8s
-
CoderWorkspacePoolMember checkCreate: trust only Coder's own 404 on the name lookup (before PR 12)Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
TestReconcile_LicenseRotationUploadsNewSecretValue fails at -count=3 (reuses a control plane name)Open
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
CoderMCPServer Kind E2E follow-upsPossibly taken @ThomasK33 claimed this 15 days ago. Open
coder/coder-k8s#390 · 1 assignee ·
Maintainers usually reply within 1 day
-
CoderMCPServer delete and RBAC test follow-upsPossibly taken @ThomasK33 claimed this 15 days ago. Open
coder/coder-k8s#378 · 1 assignee ·
Maintainers usually reply within 1 day
-
Ownership proof for Coder IDs recorded in controller status (D11 B)Possibly taken @ThomasK33 claimed this 15 days ago. Open
coder/coder-k8s#372 · 1 assignee ·
Maintainers usually reply within 1 day
Similar issues
-
area:web p3
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Lets-Parley/Parley#912 ·
Maintainers usually reply within 1 day
-
enhancement help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Git-Hospital/githealthcheck#61 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
afreidah/s3-orchestrator#1824 ·
Maintainers usually reply within 1 day
-
Type: Bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
projectdiscovery/notify#569 ·
-
internal
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day