Skip to content

fix(setup): create GitHub device-flow scratch files owner-only #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
msadig wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(setup): create GitHub device-flow scratch files owner-only #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion skills/setup/scripts/github-device-fetch.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,10 @@

set -euo pipefail

# The cookie jar and env file hold OAuth state; create every file
# and directory owner-only from the start.
umask 0077

ACCESS_URL="${ACCESS_URL:?must be set}"
STATE_DIR="${STATE_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/coder-install}"
mkdir -p "$STATE_DIR"
Expand Down Expand Up @@ -73,7 +77,6 @@ print(f"INTERVAL={int(d.get('interval', 5))}")
print(f"EXPIRES_IN={int(d.get('expires_in', 900))}")
print(f"STATE={shlex.quote(state)}")
PY
chmod 0600 "$DEV_FILE"

# 1d. Print the values once so the calling agent can read them
# out of stdout as well as the file. This script returns
Expand Down
5 changes: 4 additions & 1 deletion skills/setup/scripts/github-device-poll.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,10 @@

set -euo pipefail

# curl rewrites the cookie jar, which ends up holding the admin
# session token; keep it and every other file owner-only.
umask 0077

ACCESS_URL="${ACCESS_URL:?must be set}"
STATE_DIR="${STATE_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/coder-install}"
JAR="$STATE_DIR/github-device.jar"
Expand Down Expand Up @@ -92,7 +96,6 @@ TOKEN="$(awk '$6 == "coder_session_token" { print $7 }' "$JAR" | tail -1)"

CFG="${CODER_CONFIG_DIR:-$HOME/.config/coderv2}"
mkdir -p "$CFG"
umask 0077
echo "Writing Coder server URL to $CFG/url" >&2
printf '%s' "$ACCESS_URL" >"$CFG/url"
echo "Writing Coder admin session token to $CFG/session" >&2
Expand Down