From 5fee7868b3835e60393a12295e0218cfa58ae2c2 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Sat, 19 Sep 2026 05:34:17 -0700 Subject: [PATCH] fix(playbooks): don't let the preserve step depend on its own guard /etc/restic is 0700 root, so before elway 754db4b this step's creates: guard evaluated unprivileged, always reported the file absent, and the step re-ran on every invocation. A plain cp -p would then have overwritten the preserved ORIGINAL with the current post-repair file -- destroying the one thing the step exists to keep. Verified it never fired: the preserved copy still holds the original (md5 7b42324c, mtime 2026-04-21) and differs from the live hook (c79bef9a, 2026-09-15). The guard is fixed now, but a destructive step should not depend on its guard being right. --- playbooks/ana-docker-backup-repair.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/playbooks/ana-docker-backup-repair.yaml b/playbooks/ana-docker-backup-repair.yaml index 61809de..63660ef 100644 --- a/playbooks/ana-docker-backup-repair.yaml +++ b/playbooks/ana-docker-backup-repair.yaml @@ -1,7 +1,13 @@ steps: - name: Preserve the previous hook sudo: true - shell: cp -p /etc/restic/pre-backup.sh /etc/restic/pre-backup.sh.before-repair-20260910 + # ⚠ -n as well as -p. /etc/restic is 0700 root, so before elway 754db4b + # the `creates:` guard evaluated unprivileged, always said "absent", and + # this step re-ran on every invocation — a plain `cp -p` would then have + # overwritten the preserved ORIGINAL with the current post-repair file, + # destroying the one thing the step exists to keep. The guard is fixed, + # but a destructive step should not depend on its guard being right. + shell: cp -np /etc/restic/pre-backup.sh /etc/restic/pre-backup.sh.before-repair-20260910 creates: /etc/restic/pre-backup.sh.before-repair-20260910 - name: Install corrected canonical hook sudo: true