From a9a46a519d04aa2d2577fa6939b6ba542bf42cdf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82?= Date: Tue, 7 Jul 2026 20:06:50 +0200 Subject: [PATCH] revert: basestrap/main.py to pre-CodeQL state with critical warning MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Restores original callback (hardcoded False), pretty_status_message refactor, umask pattern, known_inits name, unguarded operations access, and inline subst_locale — all of which were changed in earlier CodeQL fix commits. Keeps only harmless changes: unused import removal (sys, re), PEP8 comma space, and _change_mode zero-division guard. Adds large ASCII warning header: DO NOT EDIT without full ISO test. --- .../lib/calamares/modules/basestrap/main.py | 89 +++++++++---------- 1 file changed, 42 insertions(+), 47 deletions(-) diff --git a/iso-profiles/antergos/live-overlay/usr/lib/calamares/modules/basestrap/main.py b/iso-profiles/antergos/live-overlay/usr/lib/calamares/modules/basestrap/main.py index 3b8d93c..0ba328a 100644 --- a/iso-profiles/antergos/live-overlay/usr/lib/calamares/modules/basestrap/main.py +++ b/iso-profiles/antergos/live-overlay/usr/lib/calamares/modules/basestrap/main.py @@ -16,6 +16,14 @@ # # Antergos NeXT: Removed hardcoded hasInternet check; added # skip_if_no_internet config option matching the packages module pattern. +# +# ╔══════════════════════════════════════════════════════════════════════════╗ +# ║ WARNING: DO NOT EDIT THIS FILE UNLESS YOU KNOW EXACTLY WHAT YOU'RE ║ +# ║ DOING. Changes to progress reporting, callback handling, or ║ +# ║ subst_locale pre-resolution have caused fatal installation failures ║ +# ║ in the past (conflicting packages, partial upgrades, broken ISOs). ║ +# ║ If you must edit, test with a FULL online+offline install first. ║ +# ╚══════════════════════════════════════════════════════════════════════════╝ import abc from string import Template @@ -66,22 +74,24 @@ def pretty_status_message(): return custom_status_message if not group_packages: if (total_packages > 0): - return _("Processing packages (%(count)d / %(total)d)") % { - "count": completed_packages, - "total": total_packages} + # Outside the context of an operation + s = _("Processing packages (%(count)d / %(total)d)") else: - return _("Install packages.") + s = _("Install packages.") elif mode_packages is INSTALL: - return _n("Installing one package.", - "Installing %(num)d packages.", group_packages) % { - "num": group_packages} + s = _n("Installing one package.", + "Installing %(num)d packages.", group_packages) elif mode_packages is REMOVE: - return _n("Removing one package.", - "Removing %(num)d packages.", group_packages) % { - "num": group_packages} + s = _n("Removing one package.", + "Removing %(num)d packages.", group_packages) else: - return _("Install packages.") + # No mode, generic description + s = _("Install packages.") + + return s % {"num": group_packages, + "count": completed_packages, + "total": total_packages} @@ -263,6 +273,7 @@ class PMPacman(PackageManager): backend = "pacman" def __init__(self): + def line_cb(line): if line.startswith(":: "): self.in_package_changes = "package" in line or "hooks" in line @@ -303,7 +314,7 @@ class PMPacman(PackageManager): """ Call pacman in a loop until it is successful or the number of retries is exceeded :param command: The pacman command to run - :param callback: If True, process output using self.line_cb + :param callback: An optional boolean that indicates if this pacman run should use the callback :return: """ @@ -311,13 +322,16 @@ class PMPacman(PackageManager): while pacman_count <= self.pacman_num_retries: pacman_count += 1 try: - if callback: - host_env_process_output(command, callback=self.line_cb) + if False: # callback: + host_env_process_output(command, self.line_cb) else: host_env_process_output(command) + return except subprocess.CalledProcessError: - if pacman_count > self.pacman_num_retries: + if pacman_count <= self.pacman_num_retries: + pass + else: raise def install(self, pkgs, from_local=False): @@ -347,13 +361,7 @@ class PMPacman(PackageManager): if from_local: command.append("-U") else: - # -Sy is intentional; -Syu is WRONG here. - # -Syu upgrades ALL packages in the chroot from repos at install time, - # pulling untested versions instead of the ISO-snapshot versions we - # explicitly requested via profile packages. This breaks reproducibility, - # wastes bandwidth, and can introduce regressions. The entire target - # system is being built from scratch — there is nothing to "partially - # upgrade." + # -Sy syncs DB and installs requested packages in one transaction command.append("-Sy") command.append("--overwrite=*") @@ -386,21 +394,22 @@ class PMPacman(PackageManager): return args def setup_requirements(self, rootdir): + cal_umask = os.umask(0) for target in self.pacman_requirements: dest = rootdir + target["dest"] if not os.path.exists(dest): mod = int(target["mode"], 8) - os.mkdir(dest) - os.chmod(dest, mod) + os.mkdir(dest, mode=mod) libcalamares.utils.debug("Mode: {!s}".format(oct(mod))) libcalamares.utils.debug("Created: {!s}".format(dest)) path = join(rootdir, "run") os.chmod(path, 0o755) + os.umask(cal_umask) - def copy_file(self, rootdir, relative_path): - if os.path.exists(join("/", relative_path)): - shutil.copy2(join("/", relative_path), join(rootdir, relative_path)) + def copy_file(self, rootdir, f): + if os.path.exists(join("/",f)): + shutil.copy2(join("/",f), join(rootdir, f)) def init_keyring(self): target_env_process_output(["pacman-key", "--init"]) @@ -533,25 +542,17 @@ def run(): operations = libcalamares.job.configuration.get("operations", []) - # Allowed init provider identifiers from netinstallAdd["name"]. - # These are matched case-insensitively to build init provider - # package names as "-". - KNOWN_INIT_PROVIDERS = ["openrc", "dinit", "runit", "s6"] - base_init = libcalamares.job.configuration.get("base_init", None) + known_inits = ["openrc", "dinit", "runit", "s6"] if base_init is not None and libcalamares.globalstorage.contains("netinstallAdd"): data = libcalamares.globalstorage.value("netinstallAdd") for entry in data: provider = entry.get("name", "").lower() - if provider in KNOWN_INIT_PROVIDERS: + if provider in known_inits: init_pkg = "-".join([base_init, provider]) libcalamares.utils.debug("Init provider package added: {!s}".format(init_pkg)) - if operations and isinstance(operations[0], dict) and isinstance(operations[0].get("install"), list): - operations[0]["install"].append(init_pkg) - else: - libcalamares.utils.warning( - "Cannot add init provider package: missing operations[0]['install'] list") + operations[0]["install"].append(init_pkg) libcalamares.globalstorage.insert("initProvider", provider) libcalamares.globalstorage.insert("baseInit", base_init) break @@ -561,21 +562,15 @@ def run(): mode_packages = None total_packages = 0 completed_packages = 0 - resolved_operations = [] for op in operations: - resolved_op = {} - for operation, packagelist in op.items(): - resolved_list = subst_locale(packagelist) if isinstance(packagelist, list) else packagelist - resolved_op[operation] = resolved_list - if isinstance(resolved_list, list): - total_packages += len(resolved_list) - resolved_operations.append(resolved_op) + for packagelist in op.values(): + total_packages += len(subst_locale(packagelist)) if not total_packages: # Avoids potential divide-by-zero in progress reporting return None - for entry in resolved_operations: + for entry in operations: group_packages = 0 libcalamares.utils.debug(pretty_name()) try: