caffeinated-whale-cli 3.1.2__tar.gz → 3.1.3__tar.gz

{caffeinated_whale_cli-3.1.2 → caffeinated_whale_cli-3.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: caffeinated-whale-cli
-Version: 3.1.2
+Version: 3.1.3
 Summary: A CLI tool to help manage Frappe Docker instances.
 Author-email: Christopher McKay <mckay.christopher73@outlook.com>
 License: MIT

{caffeinated_whale_cli-3.1.2 → caffeinated_whale_cli-3.1.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "caffeinated-whale-cli"
-version = "3.1.2"
+version = "3.1.3"
 authors = [
   { name = "Christopher McKay", email = "mckay.christopher73@outlook.com" },
 ]

caffeinated_whale_cli-3.1.3/src/caffeinated_whale_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "3.1.3"

{caffeinated_whale_cli-3.1.2 → caffeinated_whale_cli-3.1.3}/src/caffeinated_whale_cli/core/credbridge.py

@@ -465,6 +465,11 @@ def credential_bridge(container, bench_path: str) -> Iterator[None]:
             sock_name = _SOCK_NAME_FMT.format(uid)
             sock_host = host_dir / sock_name
             helper_host.write_text(_CONTAINER_HELPER_SRC.format(sock_name=sock_name))
+            # The container's frappe git process (a different uid - image default,
+            # aligned host uid, or the low shared-mode service uid) must be able to
+            # OPEN this shim; make it world-readable so it can, regardless of
+            # alignment. See shared_home.secure_bridge_helper.
+            shared_home.secure_bridge_helper(helper_host)
             with contextlib.suppress(FileNotFoundError):
                 sock_host.unlink()
 

{caffeinated_whale_cli-3.1.2 → caffeinated_whale_cli-3.1.3}/src/caffeinated_whale_cli/utils/cred_daemon.py

@@ -295,6 +295,11 @@ def ensure_bridge(container, bench_path: str, project_name: str) -> EnsureOutcom
         else:
             with contextlib.suppress(OSError):
                 helper_host.write_text(credbridge.persistent_helper_unix())
+                # This ensure runs as whoever launched open/start (often NOT the
+                # service account the daemon and remapped frappe user share), so
+                # make the shim world-readable for that frappe uid. See
+                # shared_home.secure_bridge_helper.
+                shared_home.secure_bridge_helper(helper_host)
 
         config_value, added = _ensure_container_config(container, container_dir)
 
@@ -370,9 +375,12 @@ def disable_bridge_artifacts() -> None:
     for project, ws in registry.items():
         host_dir = Path(ws)
         with contextlib.suppress(OSError):
-            (host_dir / credbridge.PERSISTENT_HELPER_NAME).write_text(
-                credbridge.persistent_helper_stub()
-            )
+            stub = host_dir / credbridge.PERSISTENT_HELPER_NAME
+            stub.write_text(credbridge.persistent_helper_stub())
+            # git may still be pointed at this shim (a container that missed the
+            # config unset); the frappe uid must be able to READ it or git hard-
+            # errors instead of the intended silent no-op. See secure_bridge_helper.
+            shared_home.secure_bridge_helper(stub)
         with contextlib.suppress(OSError):
             (host_dir / credbridge.PERSISTENT_SOCK_NAME).unlink(missing_ok=True)
         _best_effort_container_unset(project)
@@ -432,9 +440,12 @@ def _start_unix_listener(
     with contextlib.suppress(FileNotFoundError):
         sock_path.unlink()
     with contextlib.suppress(OSError):
-        (host_dir / credbridge.PERSISTENT_HELPER_NAME).write_text(
-            credbridge.persistent_helper_unix()
-        )
+        helper = host_dir / credbridge.PERSISTENT_HELPER_NAME
+        helper.write_text(credbridge.persistent_helper_unix())
+        # Readable by the container frappe uid regardless of alignment (the shim
+        # carries no secret; the credential stays behind the socket below). See
+        # shared_home.secure_bridge_helper.
+        shared_home.secure_bridge_helper(helper)
 
     srv = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
     prev_cwd = os.getcwd()

{caffeinated_whale_cli-3.1.2 → caffeinated_whale_cli-3.1.3}/src/caffeinated_whale_cli/utils/shared_home.py

@@ -196,6 +196,33 @@ def secure_file_shared_only(path: Path | str) -> None:
     apply_group(path)
 
 
+def secure_bridge_helper(path: Path | str) -> None:
+    """Make a credential-bridge helper SCRIPT readable by the container git process.
+
+    git runs the shim via ``!/usr/bin/python3 <shim>``, so python OPENS the ``.py``
+    as the container's ``frappe`` user - a DIFFERENT identity from whoever wrote
+    it: the image default uid 1000, the aligned host uid, or (shared mode) the low
+    ``cwcli`` service uid. An umask-derived mode plus incidental setgid group
+    inheritance does not reliably grant that user READ, so git dies with
+    ``[Errno 13] Permission denied`` opening the shim before it can even reach the
+    socket. Make it world-READABLE (``0644``) so any container uid can open it
+    regardless of alignment - the 0666-socket rationale, for a file that only
+    needs read. Called after EVERY shim (re)write, because the shim is regenerated
+    per invocation / per boot.
+
+    Safe to widen the read: the AF_UNIX shim carries NO secret (the credential
+    lives behind the socket, which stays group-gated), so exposing the shim only
+    reveals the socket path a non-group user still cannot connect to. ``0644`` is
+    NOT group/world WRITABLE, so it is no code-injection vector for a file git
+    executes - it in fact TIGHTENS the prior umask-``0660`` group-writable shim in
+    shared mode. NOT for the TCP shim, which bakes the per-invocation auth token;
+    that transport is Docker Desktop, which has no host-uid remap and reads the
+    bind mount through its file-sharing layer regardless of host perms.
+    """
+    with contextlib.suppress(OSError):
+        os.chmod(path, 0o644)
+
+
 def apply_process_umask() -> None:
     """Relax the process umask to 0007 in shared mode, so incidental files cwcli
     (or a library) creates inside the setgid tree stay group-writable without an

caffeinated_whale_cli-3.1.2/src/caffeinated_whale_cli/__init__.py

@@ -1 +0,0 @@
-__version__ = "3.1.2"