Conversation
|
Thank you for this contribution, @atirna — it's a well-built fix for #102: the guarded I verified it hands-on in a real container with Since fork PRs need a maintainer to approve each CI run, I've carried your work in #109 with your commit cherry-picked as-is (you stay the author), plus one cosmetic follow-up on top: the |
Fixes #102. Carries #108 by @atirna — the original commit is cherry-picked with authorship preserved; opened from an in-repo branch so CI runs without the fork-approval step. On top of it there is one cosmetic follow-up commit renaming the test-seam variable `SANDCAT_HOME` → `SANDCAT_USER_HOME` (the former already means "host CLI install dir" in `install.sh`, so one name carried two meanings). ## Summary (from #108) Java trust-store exports move out of `.bashrc` into a guarded `/etc/profile.d/sandcat-java.sh`. The entrypoint sources it after `app-user-init.sh` refreshes the writable trust store, so the agent process — and everything it spawns — inherits `JAVA_HOME` and `JAVA_TOOL_OPTIONS`. Login shells get it via `/etc/profile`, VS Code terminals via the existing `sandcat-*.sh` sourcing block in `/etc/bash.bashrc`. ## Verification - bats: init 162/162, run 9/9 (incl. the PR's three new tests) - Hands-on integration on a real container with `--stacks java` (temurin via devbox): - PID1 (agent process) environment contains both `JAVA_HOME` and `JAVA_TOOL_OPTIONS` (`/proc/1/environ`) - end-to-end: a JVM child with the inherited env fetches `https://example.com` **through the proxy → HTTP 200** (mitmproxy CA honored via the sandcat trust store) - negative control: same fetch with `env -u JAVA_TOOL_OPTIONS` → `PKIX path building failed` — the exact #102 symptom - login shell exports present; `cacerts` refreshed by app-user-init; baseline (GET 200 / POST 403 / no sudoers / no CA private key) unregressed - Reviewer note: `docker compose exec … printenv` can NOT observe these variables — `docker exec` always gets the image's Config.Env, never the entrypoint's; `/proc/1/environ` is the correct probe. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Atirna <288419661+atirna@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
thanks for the detailed read, and for verifying it hands-on. glad the shape fit. |
2 participants
Summary
Moved the Java trust-store exports out of
.bashrcinto a guarded profile script. The entrypoint sources it after refreshing the writable trust store, so the agent process and shells it starts inheritJAVA_HOMEandJAVA_TOOL_OPTIONS.Why
JVM tools launched through non-interactive shells can now use the mitmproxy-aware trust store instead of failing TLS validation.
Verification
bash --noprofile --norcprofile probe: a child shell receives the Java home and copied trust-store options when both are present; non-JVM shells remain unconfigured.Fixes #102