From ffab2481a713a7279f9f6a4940fbd248c05fa143 Mon Sep 17 00:00:00 2001 From: speak-agent Date: Thu, 27 Aug 2026 23:30:45 +0800 Subject: [PATCH] The sandbox's /tmp is separate from the host's, not fresh each time MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ⚠️ The head of this file said `--sandbox' gives "a fresh /tmp". Measured 2026-08-27: two invocations of the same environment, and the second found the directory the first had made; the host's `/tmp' had neither. Both halves matter and they are different claims. SEPARATE is what makes staging from outside impossible, which is why the sandbox is used at all. FRESH is what a check that must not read its own last answer would need, and it is not true --- so the project directory is removed before it is written, which this script already did and now says why. --- tools/sandbox-closure.sh | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/tools/sandbox-closure.sh b/tools/sandbox-closure.sh index 5b7c8a1..6d3304e 100644 --- a/tools/sandbox-closure.sh +++ b/tools/sandbox-closure.sh @@ -24,8 +24,15 @@ # # WHY A SANDBOX. A machine that has been developing these packages has every one # of them installed, and would answer for its own state rather than for the -# index. `xlings subos --sandbox --cmd` gives a fresh environment, and a -# fresh `/tmp` with it --- so nothing may be staged outside. +# index. `xlings subos --sandbox --cmd` gives an environment of its own, +# and a `/tmp` of its own with it --- so nothing may be staged from outside. +# +# ⚠️ SEPARATE IS NOT FRESH, AND THIS COMMENT SAID FRESH. Measured 2026-08-27: +# two invocations of the same environment, and the second found the directory +# the first had made; the host's `/tmp` had neither. So the `/tmp` is not the +# host's --- which is what matters for staging --- and it is not new each time, +# which is what matters for a check that must not read its own last answer. +# That is why the project directory below is REMOVED before it is written. # # It asks two questions, because they fail independently: # @@ -116,6 +123,10 @@ got="$(mcpp --version | awk '{print $2}')" echo " mcpp is $got" say "a project that names only published versions" +# Removed rather than merely created: see the note about `/tmp' at the head of +# this file. A directory left by the previous run would be built again, and a +# build that succeeded against the previous release would look exactly like one +# that succeeded against this one. rm -rf /tmp/closure && mkdir -p /tmp/closure/src && cd /tmp/closure cat > mcpp.toml <