Skip to content

Harden assimilate.sh: arch-aware delta, quoted $HOME, perms#18

Open
akan72 wants to merge 1 commit into
mainfrom
akan72/assimilate-fixes
Open

Harden assimilate.sh: arch-aware delta, quoted $HOME, perms#18
akan72 wants to merge 1 commit into
mainfrom
akan72/assimilate-fixes

Conversation

@akan72
Copy link
Copy Markdown
Owner

@akan72 akan72 commented May 29, 2026

Summary

Branch 6: harden assimilate.sh and bash_profile.

  • Arch-aware delta install: detect arch with uname -m. Apple Silicon uses the pinned aarch64-apple-darwin tarball; Intel Macs fall back to brew install git-delta.
  • Quote $HOME in bash_profile: if [ -f "$HOME/.bashrc" ]
  • chmod 600 ~/.gitconfig and chmod 700 ~/.ssh (when present) after symlinking

Note on arch detection: delta v0.19.2 ships no x86_64-apple-darwin build (only aarch64-apple-darwin for macOS). So the literal "select x86_64-apple-darwin" would 404. There's no pinned tarball to checksum-verify on Intel, so the Intel path falls back to Homebrew instead.

Why & alternatives (from explanations.txt — Branch 6)

Change Why Alternatives
Arch detection for delta aarch64-apple-darwin was hardcoded — breaks on Intel Macs. Drop the pinned tarball entirely and use brew install git-delta (the pinned approach exists due to brew bottle ABI drift).
Quote $HOME in bash_profile [ -f $HOME/.bashrc ] breaks on paths with spaces. Defensive. Skip — username has no spaces.
chmod 600 on sensitive symlinks Defense against world-readable secrets. Skip — home dir is probably mode 700.

Note: Branches 6 and 11 both touch assimilate.sh; expect a trivial conflict to resolve when merging the second one.

- delta install: detect arch with uname -m. Apple Silicon uses the pinned
  aarch64-apple-darwin tarball; Intel Macs fall back to 'brew install git-delta'
  (delta ships no x86_64-apple-darwin build, so there's no pinned tarball to verify)
- bash_profile: quote $HOME in the .bashrc test/source (handles paths with spaces)
- chmod 600 ~/.gitconfig and chmod 700 ~/.ssh (when present) after symlinking
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant