Fix four audit findings

- patch/apply.sh: replace sed with Python+env-var for PATCH_DIR
  substitution into sitecustomize.py; sed's & and | metacharacters
  silently corrupt or truncate the output for paths containing those
  chars; Python str.replace has no metacharacter issues; also write to
  a tmp file and mv atomically so a failed substitution never leaves
  an empty sitecustomize.py at the destination
- recover.sh: fix re-enable hint from $PATCH_DIR/apply.sh to
  $PATCH_DIR/patch/apply.sh (apply.sh moved into patch/ subdirectory)
- install.sh + uninstall.sh: match PREINIT hook on comment field
  ("TrueCloud provider patch (S3/B2)") instead of exact script path;
  exact-path match breaks when the repo is moved after install —
  uninstall leaves the stale hook registered (fires on every boot),
  and reinstall creates a duplicate entry; install.sh now also updates
  the script path on re-run so a moved repo self-corrects

This commit is contained in:

flan

2026-06-15 17:36:58 +00:00

parent 70e84038d6

commit 6a8ed7fa67

4 changed files with 18 additions and 8 deletions

									
										recover.sh
									
		+1
		-1
	
												View File
												
				@@ -45,4 +45,4 @@ fi

				echo ""

				echo "To re-enable the patch once you have investigated:"

				echo "  rm $PATCH_DIR/disabled"

				echo "  bash $PATCH_DIR/apply.sh"

				echo "  bash $PATCH_DIR/patch/apply.sh"