Issue 346: user-dirs.dirs is trusted again for now (mesh-catalog #158), the stop-gap before the fix

2026-10-09 12:40:26 +02:00
parent 79f31ca113
commit 0ff6bd2267
2 changed files with 6 additions and 3 deletions
@@ -48,8 +48,9 @@ the format has no way to end a statement or a quoted string within a line.

 - Any caller of the `settings` verb (an agent session, a tool) can rewrite a desktop program's
  configuration beyond the key it was given, as the operator's account.
- Two files are marked untrusted on main today. The survey in [01-diagnosis.md](01-diagnosis.md) judges
+- Two files were marked untrusted on main. The survey in [01-diagnosis.md](01-diagnosis.md) judges
  both: the `xdg` module's `user-dirs.dirs` is open to the same injection, `dunst`'s `dunstrc` is not.
+  `user-dirs.dirs` is made trusted again for now (mesh-catalog #158).

 ## What is asked

@@ -27,8 +27,10 @@ a node.
 Mergeable JSON files ("any mergeable file takes any key", issue 340) are not pasted: values are merged as
 JSON and encoded by the encoder. They are outside this defect.

-**Recommendation for now:** mark `user-dirs.dirs` trusted again (terminal-only) in a catalogue change, as
-`picom.conf` was kept in mesh-catalog #157. `dunstrc` may stay as it is.
+**Done for now (2026-10-09):** `user-dirs.dirs` is marked trusted again (terminal-only) in mesh-catalog
+#158, as `picom.conf` was kept in mesh-catalog #157. A test in each module fails if its file carries a
+trusted marking, naming this issue. `dunstrc` stays as it is. This is the stop-gap, not the fix: the
+fix below still stands.

 ## The fix proposed