fix: address provider review feedback

Author: j-curatec

deploy.sh

@@ -41,7 +41,14 @@ done
 echo "[deploy] staging complete runtime tree for $HOST:$DEST"
 REMOTE_STAGE="$(ssh -- "$HOST" "umask 022; mktemp -d '${DEST}.deploy.XXXXXX'")"
 case "$REMOTE_STAGE" in
-  "$DEST".deploy.*) ;;
+  "$DEST".deploy.*)
+    remote_stage_suffix="${REMOTE_STAGE#"$DEST".deploy.}"
+    case "$remote_stage_suffix" in
+      ''|*[!A-Za-z0-9]*)
+        echo "deploy: remote host returned an unsafe staging path: $REMOTE_STAGE" >&2
+        exit 1 ;;
+    esac
+    ;;
   *) echo "deploy: remote host returned an unsafe staging path: $REMOTE_STAGE" >&2; exit 1 ;;
 esac
 
@@ -68,7 +75,14 @@ if [ "$dest" != "/usr/local/emhttp/plugins/ci-runner-farm" ]; then
   exit 1
 fi
 case "$stage" in
-  "$dest".deploy.*) ;;
+  "$dest".deploy.*)
+    stage_suffix="${stage#"$dest".deploy.}"
+    case "$stage_suffix" in
+      ''|*[!A-Za-z0-9]*)
+        echo "deploy: refusing unexpected staging path: $stage" >&2
+        exit 1 ;;
+    esac
+    ;;
   *) echo "deploy: refusing unexpected staging path: $stage" >&2; exit 1 ;;
 esac
 
@@ -99,8 +113,8 @@ chown -R root:root "$stage"
 find "$stage" -type d -exec chmod 0755 {} +
 find "$stage" -type f -exec chmod 0644 {} +
 chmod 0755 "$stage/include/runner-farm.sh"
-find "$stage/nchan" -type f -exec chmod 0755 {} + 2>/dev/null || true
-find "$stage/event" -type f -exec chmod 0755 {} + 2>/dev/null || true
+find "$stage/nchan" -type f -exec chmod 0755 {} +
+find "$stage/event" -type f -exec chmod 0755 {} +
 
 # Use the exact runtime lock location/fallback used by the installed engine. Hold
 # it from the final inactive-state snapshot through the tree swap, preventing a
@@ -261,10 +275,14 @@ esac
 backup="${dest}.deploy-backup.$$"
 rollback() {
   status=$?
+  if [ "$#" -gt 0 ]; then status="$1"; fi
   if [ ! -e "$dest" ] && [ -e "$backup" ]; then mv "$backup" "$dest"; fi
   exit "$status"
 }
-trap rollback ERR HUP INT TERM
+trap rollback ERR
+trap 'rollback 129' HUP
+trap 'rollback 130' INT
+trap 'rollback 143' TERM
 
 if [ -e "$dest" ]; then mv "$dest" "$backup"; fi
 mv "$stage" "$dest"

install-dev.sh

@@ -157,7 +157,6 @@ PY
   IFS=$'\t' read -r PACKAGE_FILE PACKAGE_SHA256 PLUGIN_SHA256 MANIFEST_SHA256 <<< "$values"
   [ -n "$PACKAGE_FILE" ] && [ -n "$PACKAGE_SHA256" ] && [ -n "$PLUGIN_SHA256" ] && [ -n "$MANIFEST_SHA256" ] \
     || die "bundle validator returned an incomplete result"
-  PACKAGE="$BUNDLE_DIR/$PACKAGE_FILE"
 }
 
 if [ "$ACTION" = install ]; then
@@ -233,6 +232,24 @@ canonical_cfg=/boot/config/plugins/ci-runner-farm
 dev_root=/boot/config/ci-runner-farm-dev
 rollback="$dev_root/rollback"
 artifacts="$dev_root/artifacts"
+rollback_tmp=
+commit_tmp=
+cleanup_install_temps() {
+  local status=$?
+  trap - EXIT
+  case "$rollback_tmp" in
+    '') ;;
+    "$dev_root"/.rollback.*) rm -rf -- "$rollback_tmp" || status=1 ;;
+    *) printf 'install-dev remote: refusing to clean unsafe rollback temporary path: %s\n' "$rollback_tmp" >&2; status=1 ;;
+  esac
+  case "$commit_tmp" in
+    '') ;;
+    "$artifacts"/.commit.*) rm -f -- "$commit_tmp" || status=1 ;;
+    *) printf 'install-dev remote: refusing to clean unsafe artifact temporary path: %s\n' "$commit_tmp" >&2; status=1 ;;
+  esac
+  exit "$status"
+}
+trap cleanup_install_temps EXIT
 umask 077
 mkdir -p "$dev_root"
 [ -d "$dev_root" ] && [ ! -L "$dev_root" ] || fail "development state root is unsafe"
@@ -298,6 +315,7 @@ else
   find "$rollback_tmp" -type d -exec chmod 0700 {} +
   find "$rollback_tmp" -type f -exec chmod 0600 {} +
   mv -- "$rollback_tmp" "$rollback"
+  rollback_tmp=
   validate_baseline
 fi
 
@@ -339,18 +357,19 @@ fi
 chmod 0700 "$artifacts"
 
 commit_artifact() {
-  local source="$1" destination="$2" expected="$3" tmp
+  local source="$1" destination="$2" expected="$3"
   if [ -e "$destination" ] || [ -L "$destination" ]; then
     regular_file "$destination" || fail "artifact destination is unsafe: $destination"
     [ "$(sha256_of "$destination")" = "$expected" ] \
       || fail "artifact basename already exists with different bytes: $destination"
     return 0
   fi
-  tmp="$(mktemp "$artifacts/.commit.XXXXXX")"
-  cp -- "$source" "$tmp"
-  chmod 0600 "$tmp"
-  [ "$(sha256_of "$tmp")" = "$expected" ] || fail "artifact changed during commit"
-  mv -- "$tmp" "$destination"
+  commit_tmp="$(mktemp "$artifacts/.commit.XXXXXX")"
+  cp -- "$source" "$commit_tmp"
+  chmod 0600 "$commit_tmp"
+  [ "$(sha256_of "$commit_tmp")" = "$expected" ] || fail "artifact changed during commit"
+  mv -- "$commit_tmp" "$destination"
+  commit_tmp=
   [ "$(sha256_of "$destination")" = "$expected" ] || fail "committed artifact verification failed"
 }
 
@@ -453,7 +472,32 @@ docker_names "GitLab validation jobs" \
 all_names="$(docker ps -a --format '{{.Names}}' 2>/dev/null)" \
   || fail "cannot enumerate Docker names for legacy mirror verification"
 if printf '%s\n' "$all_names" | grep -qxF ci-runner-mirror; then
-  fail "fixed-name registry mirror remains after Stop"
+  legacy_cache_root=/mnt/cache/github-runner
+  cfg="$canonical_cfg/ci-runner-farm.cfg"
+  if [ -e "$cfg" ]; then
+    [ -r "$cfg" ] || fail "cannot read plugin config for legacy mirror verification"
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in ''|\#*) continue ;; esac
+      [ "${line#*=}" = "$line" ] && continue
+      key="${line%%=*}"; value="${line#*=}"
+      key="${key//[[:space:]]/}"
+      [ "$key" = CACHE_ROOT ] || continue
+      value="${value%\"}"; value="${value#\"}"
+      value="${value%\'}"; value="${value#\'}"
+      legacy_cache_root="$value"
+    done < "$cfg"
+  fi
+  legacy_name="$(docker inspect -f '{{.Name}}' ci-runner-mirror 2>/dev/null)" \
+    && legacy_image="$(docker inspect -f '{{.Config.Image}}' ci-runner-mirror 2>/dev/null)" \
+    && legacy_source="$(docker inspect -f '{{range .Mounts}}{{if eq .Destination "/var/lib/registry"}}{{.Source}}{{end}}{{end}}' ci-runner-mirror 2>/dev/null)" \
+    && legacy_env="$(docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' ci-runner-mirror 2>/dev/null)" \
+    || fail "cannot verify fixed-name registry mirror provenance"
+  if [ "$legacy_name" = /ci-runner-mirror ] \
+     && [ "$legacy_image" = registry:2 ] \
+     && [ "$legacy_source" = "$legacy_cache_root/registry-mirror" ] \
+     && printf '%s\n' "$legacy_env" | grep -qx 'REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io'; then
+    fail "fixed-name registry mirror remains after Stop"
+  fi
 fi
 daemon_status=0
 pgrep -f '[r]unner-farm.sh (autoscale-daemon|imageupdate-daemon|reconcile-drain|boot-autostart)' >/dev/null 2>&1 \

src/usr/local/emhttp/plugins/ci-runner-farm/default.Dockerfile

@@ -34,6 +34,7 @@ RUN printf '%s\n' \
   '( while true; do docker info >/dev/null 2>&1 || { rm -f /var/run/docker.pid; service docker start >>/var/log/dockerd.log 2>&1; }; sleep 3; done ) &' \
   '# wait for first readiness before the runner accepts jobs' \
   'for i in $(seq 1 90); do docker info >/dev/null 2>&1 && break; sleep 1; done' \
+  'docker info >/dev/null 2>&1 || { echo "Docker did not become ready" >&2; exit 1; }' \
   'exec "$@"' \
   > /usr/local/bin/wait-docker.sh \
  && chmod +x /usr/local/bin/wait-docker.sh

src/usr/local/emhttp/plugins/ci-runner-farm/default.github.Dockerfile

@@ -34,6 +34,7 @@ RUN printf '%s\n' \
   '( while true; do docker info >/dev/null 2>&1 || { rm -f /var/run/docker.pid; service docker start >>/var/log/dockerd.log 2>&1; }; sleep 3; done ) &' \
   '# wait for first readiness before the runner accepts jobs' \
   'for i in $(seq 1 90); do docker info >/dev/null 2>&1 && break; sleep 1; done' \
+  'docker info >/dev/null 2>&1 || { echo "Docker did not become ready" >&2; exit 1; }' \
   'exec "$@"' \
   > /usr/local/bin/wait-docker.sh \
  && chmod +x /usr/local/bin/wait-docker.sh

src/usr/local/emhttp/plugins/ci-runner-farm/include/providers/github.sh

@@ -163,7 +163,8 @@ github_registry_credentials() {
 }
 
 github_build_args() {
-  local idx="$1" name="${2:-${NAME_PREFIX}-${idx}}" role="${CRF_CONTAINER_ROLE:-runner}"
+  local idx="$1"
+  local name="${2:-${NAME_PREFIX}-${idx}}" role="${CRF_CONTAINER_ROLE:-runner}"
   ARGS=(
     -d --restart=no
     --name "$name" --hostname "$name"

src/usr/local/emhttp/plugins/ci-runner-farm/include/providers/gitlab.sh

@@ -742,7 +742,8 @@ gitlab_write_config() {
 }
 
 gitlab_build_manager_args() {
-  local idx="$1" name="${2:-${NAME_PREFIX}-${idx}}" dir sock sockdir socket_mount authdir slot_ca
+  local idx="$1"
+  local name="${2:-${NAME_PREFIX}-${idx}}" dir sock sockdir socket_mount authdir slot_ca
   gitlab_validate_settings || return 1
   gitlab_token_ready || { err "no valid GitLab glrt- runner token configured"; return 1; }
   gitlab_write_config "$idx" "$name" || { err "could not write GitLab config for $name"; return 1; }

tests/config-parity.sh

@@ -42,9 +42,9 @@ declare -A ENG CFGV UIV
 # plugin config. PHP's INI scanner accepts `;` comments, not shell-style `#`
 # comments on current Unraid releases; catch a file that is textually correct
 # for the shell tests but unusable by the webGUI.
-command -v php >/dev/null 2>&1 || bad "php is required to validate default.cfg"
-if command -v php >/dev/null 2>&1 \
-   && ! php -r '$v = parse_ini_file($argv[1]); exit(is_array($v) ? 0 : 1);' "$CFG"; then
+if ! command -v php >/dev/null 2>&1; then
+  bad "php is required to validate default.cfg"
+elif ! php -r '$v = parse_ini_file($argv[1]); exit(is_array($v) ? 0 : 1);' "$CFG"; then
   bad "default.cfg is not valid for PHP parse_ini_file (and therefore Unraid parse_plugin_cfg)"
 fi
 

tests/deploy-uninstall-safety.sh

@@ -8,7 +8,7 @@ DEPLOY="deploy.sh"
 BUILD="build-plg.sh"
 
 fail() { printf 'DEPLOY/UNINSTALL SAFETY FAIL: %s\n' "$*" >&2; exit 1; }
-first_line() { grep -nF -- "$2" "$1" | head -1 | cut -d: -f1; }
+first_line() { grep -nF -- "$2" "$1" | head -1 | cut -d: -f1 || true; }
 
 lock_line="$(first_line "$DEPLOY" 'flock -w 20 8')"
 manager_check_line="$(first_line "$DEPLOY" 'owned_managers="$(docker ps -a')"
@@ -24,6 +24,25 @@ grep -qF 'COPYFILE_DISABLE=1 tar --no-xattrs -C "$SRC" -cf - .' "$DEPLOY" \
   || fail "deploy does not suppress macOS AppleDouble metadata at the source"
 grep -qF "find \"\$stage\" -name '._*' -print" "$DEPLOY" \
   || fail "deploy does not reject AppleDouble metadata in the staged runtime"
+grep -qF 'remote_stage_suffix="${REMOTE_STAGE#"$DEST".deploy.}"' "$DEPLOY" \
+  && grep -qF 'stage_suffix="${stage#"$dest".deploy.}"' "$DEPLOY" \
+  && [ "$(grep -cF "''|*[!A-Za-z0-9]*)" "$DEPLOY" || true)" -eq 2 ] \
+  || fail "deploy does not require a nonempty alphanumeric staging suffix locally and remotely"
+for executable_tree in nchan event; do
+  grep -qxF "find \"\$stage/$executable_tree\" -type f -exec chmod 0755 {} +" "$DEPLOY" \
+    || fail "deploy does not propagate $executable_tree permission failures"
+done
+grep -qF 'trap rollback ERR' "$DEPLOY" \
+  && grep -qF 'if [ "$#" -gt 0 ]; then status="$1"; fi' "$DEPLOY" \
+  || fail "deploy rollback does not preserve ERR status separately from signals"
+for signal_trap in \
+  "trap 'rollback 129' HUP" \
+  "trap 'rollback 130' INT" \
+  "trap 'rollback 143' TERM"
+do
+  grep -qF "$signal_trap" "$DEPLOY" \
+    || fail "deploy rollback lacks nonzero signal status: $signal_trap"
+done
 if sed -n "${lock_line},${swap_line}p" "$DEPLOY" | grep -F 'flock -u 8' >/dev/null; then
   fail "deploy releases fleet.lock before the staged tree swap"
 fi
@@ -125,9 +144,11 @@ printf '%s\n' "$remove_block" | grep -qF 'if ! rm -rf -- "\$PLGDIR" || [ -e "\$P
 printf '%s\n' "$remove_block" | grep -qF 'if ! rm -f -- "\$CFGDIR"/${NAME}-*.tgz; then' \
   || fail "plugin remove action does not fail on cached-package deletion"
 
-runtime_delete_line="$(printf '%s\n' "$remove_block" | grep -nF 'if ! rm -rf -- "\$PLGDIR"' | head -1 | cut -d: -f1)"
-package_delete_line="$(printf '%s\n' "$remove_block" | grep -nF 'if ! rm -f -- "\$CFGDIR"/${NAME}-*.tgz' | head -1 | cut -d: -f1)"
-success_line="$(printf '%s\n' "$remove_block" | grep -nF 'ci-runner-farm removed. Config + credentials left' | head -1 | cut -d: -f1)"
+runtime_delete_line="$(printf '%s\n' "$remove_block" | grep -nF 'if ! rm -rf -- "\$PLGDIR"' | head -1 | cut -d: -f1 || true)"
+package_delete_line="$(printf '%s\n' "$remove_block" | grep -nF 'if ! rm -f -- "\$CFGDIR"/${NAME}-*.tgz' | head -1 | cut -d: -f1 || true)"
+success_line="$(printf '%s\n' "$remove_block" | grep -nF 'ci-runner-farm removed. Config + credentials left' | head -1 | cut -d: -f1 || true)"
+[ -n "$runtime_delete_line" ] && [ -n "$package_delete_line" ] && [ -n "$success_line" ] \
+  || fail "could not locate runtime deletion, cached-package deletion, and uninstall success"
 [ "$runtime_delete_line" -lt "$success_line" ] && [ "$package_delete_line" -lt "$success_line" ] \
   || fail "plugin remove action can announce success before cleanup completes"
 

tests/gitlab-runner-lint.sh

@@ -21,6 +21,8 @@ GITLAB_URL=https://gitlab.example.test
 # version/length/CRC separators that originally exposed a stale local parser.
 GITLAB_RUNNER_TOKEN=glrt-AAECAwQFBgcICQoLDA0OD286MQpwOjIKdTozCnQ6Mw8.01.170z6aiyq
 GITLAB_RUNNER_IMAGE="$(sed -n 's/^GITLAB_RUNNER_IMAGE="\([^"]*\)".*/\1/p' src/usr/local/emhttp/plugins/ci-runner-farm/default.cfg | head -1)"
+[ -n "$GITLAB_RUNNER_IMAGE" ] \
+  || { echo "gitlab-runner-lint: could not read GITLAB_RUNNER_IMAGE from default.cfg" >&2; exit 1; }
 CACHE_ROOT="$tmp/cache"
 CACHE_MOUNTS=''
 RUNNER_CPUS='2'
@@ -35,8 +37,11 @@ mkdir -p "$CACHE_ROOT"
 # can open the configured path as well as parse it.
 if [ -r /etc/ssl/certs/ca-certificates.crt ]; then
   cp /etc/ssl/certs/ca-certificates.crt "$GITLAB_CA_FILE"
-else
+elif [ -r /etc/ssl/cert.pem ]; then
   cp /etc/ssl/cert.pem "$GITLAB_CA_FILE"
+else
+  echo "gitlab-runner-lint: no host CA bundle found for the self-managed CA case" >&2
+  exit 1
 fi
 printf '%s' "$GITLAB_RUNNER_TOKEN" > "$GITLAB_RUNNER_TOKEN_FILE"
 reload_secret_files

tests/install-dev-safety.sh

@@ -8,12 +8,17 @@ INSTALLER=install-dev.sh
 fail() { printf 'INSTALL-DEV SAFETY FAIL: %s\n' "$*" >&2; exit 1; }
 line_of() {
   local value
-  value="$(grep -nF -- "$2" "$1" | head -1 | cut -d: -f1)"
+  value="$(grep -nF -- "$2" "$1" | head -1 | cut -d: -f1 || true)"
   [ -n "$value" ] || fail "missing contract: $2"
   printf '%s\n' "$value"
 }
 
 bash -n "$INSTALLER" || fail "installer has invalid shell syntax"
+missing_line_output="$( (line_of "$INSTALLER" '__install_dev_missing_contract_probe__') 2>&1 || true)"
+case "$missing_line_output" in
+  *'missing contract: __install_dev_missing_contract_probe__'*) ;;
+  *) fail "line_of suppresses its focused missing-contract diagnostic" ;;
+esac
 
 # The local bundle is authenticated before the first remote mutation, and the
 # lock-protected live deployment completes before flash state is created.
@@ -37,6 +42,9 @@ do
 done
 grep -qF 'case "${HOST#root@}"' "$INSTALLER" || fail "host shell syntax is not rejected"
 if grep -qF 'set -x' "$INSTALLER"; then fail "installer enables shell tracing"; fi
+if grep -qF 'PACKAGE="$BUNDLE_DIR/$PACKAGE_FILE"' "$INSTALLER"; then
+  fail "installer retains the unused PACKAGE assignment"
+fi
 
 # Baseline creation is one-time and copies exactly the public canonical
 # descriptor plus the one package it references.  It must not sweep or copy the
@@ -53,6 +61,22 @@ for contract in \
 do
   grep -qF -- "$contract" "$INSTALLER" || fail "missing rollback-baseline contract: $contract"
 done
+cleanup_function_line="$(line_of "$INSTALLER" 'cleanup_install_temps() {')"
+cleanup_trap_line="$(line_of "$INSTALLER" 'trap cleanup_install_temps EXIT')"
+rollback_tmp_line="$(line_of "$INSTALLER" '  rollback_tmp="$(mktemp -d "$dev_root/.rollback.XXXXXX")"')"
+commit_tmp_line="$(line_of "$INSTALLER" '  commit_tmp="$(mktemp "$artifacts/.commit.XXXXXX")"')"
+[ "$cleanup_function_line" -lt "$cleanup_trap_line" ] \
+  && [ "$cleanup_trap_line" -lt "$rollback_tmp_line" ] \
+  && [ "$cleanup_trap_line" -lt "$commit_tmp_line" ] \
+  || fail "temporary-path cleanup is not armed before temporary paths are created"
+for contract in \
+  '"$dev_root"/.rollback.*) rm -rf -- "$rollback_tmp" || status=1' \
+  '"$artifacts"/.commit.*) rm -f -- "$commit_tmp" || status=1' \
+  '  rollback_tmp=' \
+  '  commit_tmp='
+do
+  grep -qF -- "$contract" "$INSTALLER" || fail "missing temporary cleanup contract: $contract"
+done
 if grep -Eq 'cp[[:space:]]+-R.*(canonical_cfg|/boot/config/plugins/ci-runner-farm)' "$INSTALLER"; then
   fail "installer recursively copies the persistent config/credential directory"
 fi
@@ -98,6 +122,22 @@ for resource in \
 do
   grep -qF -- "$resource" "$INSTALLER" || fail "rollback omits empty check: $resource"
 done
+for contract in \
+  'legacy_name="$(docker inspect -f '\''{{.Name}}'\'' ci-runner-mirror 2>/dev/null)"' \
+  'legacy_image="$(docker inspect -f '\''{{.Config.Image}}'\'' ci-runner-mirror 2>/dev/null)"' \
+  'legacy_source="$(docker inspect -f '\''{{range .Mounts}}{{if eq .Destination "/var/lib/registry"}}{{.Source}}{{end}}{{end}}'\'' ci-runner-mirror 2>/dev/null)"' \
+  'REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io' \
+  '[ "$legacy_name" = /ci-runner-mirror ]' \
+  '[ "$legacy_image" = registry:2 ]' \
+  '[ "$legacy_source" = "$legacy_cache_root/registry-mirror" ]'
+do
+  grep -qF -- "$contract" "$INSTALLER" || fail "rollback omits legacy mirror provenance: $contract"
+done
+legacy_name_line="$(line_of "$INSTALLER" 'legacy_name="$(docker inspect')"
+legacy_tuple_line="$(line_of "$INSTALLER" '  if [ "$legacy_name" = /ci-runner-mirror ]')"
+legacy_fail_line="$(line_of "$INSTALLER" '    fail "fixed-name registry mirror remains after Stop"')"
+[ "$legacy_name_line" -lt "$legacy_tuple_line" ] && [ "$legacy_tuple_line" -lt "$legacy_fail_line" ] \
+  || fail "an unrelated fixed-name mirror can still trigger rollback failure before provenance matches"
 rollback_block="$(awk '
   /^ssh -- "\$HOST" \/bin\/bash -s <<'"'"'REMOTE_ROLLBACK'"'"'$/ { emit=1 }
   emit { print }
@@ -120,6 +160,35 @@ fi
 # deploy/SSH commands.  The remote heredocs are deliberately not executed.
 tmp="$(mktemp -d)"
 trap 'rm -rf "$tmp"' EXIT
+
+# Execute the install transaction's actual EXIT-trap function against both
+# temporary path classes. An implicit set -e failure must retain its non-zero
+# status while removing the baseline directory and the artifact staging file.
+cleanup_function="$(awk '
+  /^cleanup_install_temps\(\) \{$/ { emit=1 }
+  emit { print }
+  emit && /^}$/ { exit }
+' "$INSTALLER")"
+[ -n "$cleanup_function" ] || fail "could not extract temporary cleanup function"
+cleanup_root="$tmp/cleanup-probe"
+cleanup_artifacts="$cleanup_root/artifacts"
+cleanup_rollback="$cleanup_root/.rollback.ABC123"
+cleanup_commit="$cleanup_artifacts/.commit.ABC123"
+mkdir -p "$cleanup_rollback" "$cleanup_artifacts"
+printf 'partial artifact\n' >"$cleanup_commit"
+cleanup_probe="$tmp/cleanup-probe.sh"
+{
+  printf '%s\n' '#!/usr/bin/env bash' 'set -euo pipefail'
+  printf '%s\n' 'dev_root="$1"' 'artifacts="$2"' 'rollback_tmp="$3"' 'commit_tmp="$4"'
+  printf '%s\n' "$cleanup_function"
+  printf '%s\n' 'trap cleanup_install_temps EXIT' 'false'
+} >"$cleanup_probe"
+if bash "$cleanup_probe" "$cleanup_root" "$cleanup_artifacts" "$cleanup_rollback" "$cleanup_commit"; then
+  fail "temporary cleanup probe lost the triggering failure status"
+fi
+[ ! -e "$cleanup_rollback" ] || fail "rollback temporary directory survived a transaction failure"
+[ ! -e "$cleanup_commit" ] || fail "artifact temporary file survived a transaction failure"
+
 repo="$tmp/repo"
 mkdir -p "$repo/tmp/dev-package" "$tmp/bin"
 cp "$INSTALLER" "$repo/install-dev.sh"