Ship the Brave sandbox review fix in v0.1.3 #8

Merged

mathieu merged 2 commits from fix/issue-7-still-failling-on-a-regular-brave-bin-package into main

2026-08-29 12:50:11 +00:00

hephaistos commented

2026-08-29 12:42:28 +00:00

Owner

Fixes #7

Root cause

The narrow brave-bin Chromium sandbox classification was merged in PR #6, but the installable AUR recipe still pinned v0.1.2. A normal package update therefore kept running the old generic high-risk setuid rule and blocked before the new medium-review behavior could run.

Changes

release the merged Brave sandbox review behavior as signed tag v0.1.3;
synchronize the Python, man-page, PKGBUILD, template, and .SRCINFO versions;
pin the installable recipe to the verified v0.1.3 Forgejo archive checksum;
add packaging regression coverage requiring the fix to ship in v0.1.3 or newer and keeping version surfaces synchronized.

Verification

PYTHONPATH=src python3 -W error -m unittest tests.test_packaging tests.test_rules -v — 11 passed
make test — 36 passed
bash -n aur/PKGBUILD packaging/PKGBUILD.template — passed
python3 -m compileall -q src tests — passed
git diff --check — passed
namcap /work/aur/PKGBUILD in archlinux:base — clean
downloaded v0.1.3 archive SHA-256 matches a191f82c44f57a32fc7f8a6b8703ebe7bd41b3a043aa2d7ea37049270d0e0efb

Risks

The release does not broadly allow setuid operations. Only the already-reviewed exact brave-bin single-target Chromium sandbox command becomes medium risk and still requires explicit terminal approval; unknown setuid/setgid/setcap operations remain high and blocking.

Review guidance

Confirm the recipe points to v0.1.3, the archive checksum matches, all version surfaces agree, and the existing narrow rule tests remain unchanged and green.

Fixes #7 ## Root cause The narrow `brave-bin` Chromium sandbox classification was merged in PR #6, but the installable AUR recipe still pinned v0.1.2. A normal package update therefore kept running the old generic high-risk setuid rule and blocked before the new medium-review behavior could run. ## Changes - release the merged Brave sandbox review behavior as signed tag `v0.1.3`; - synchronize the Python, man-page, PKGBUILD, template, and `.SRCINFO` versions; - pin the installable recipe to the verified v0.1.3 Forgejo archive checksum; - add packaging regression coverage requiring the fix to ship in v0.1.3 or newer and keeping version surfaces synchronized. ## Verification - `PYTHONPATH=src python3 -W error -m unittest tests.test_packaging tests.test_rules -v` — 11 passed - `make test` — 36 passed - `bash -n aur/PKGBUILD packaging/PKGBUILD.template` — passed - `python3 -m compileall -q src tests` — passed - `git diff --check` — passed - `namcap /work/aur/PKGBUILD` in `archlinux:base` — clean - downloaded `v0.1.3` archive SHA-256 matches `a191f82c44f57a32fc7f8a6b8703ebe7bd41b3a043aa2d7ea37049270d0e0efb` ## Risks The release does not broadly allow setuid operations. Only the already-reviewed exact `brave-bin` single-target Chromium sandbox command becomes medium risk and still requires explicit terminal approval; unknown setuid/setgid/setcap operations remain high and blocking. ## Review guidance Confirm the recipe points to `v0.1.3`, the archive checksum matches, all version surfaces agree, and the existing narrow rule tests remain unchanged and green.

hephaistos added 2 commits

2026-08-29 12:42:28 +00:00

release: prepare v0.1.3 packaging a77964c75f

packaging: pin v0.1.3 release archive 52b790cf18

hephaistos referenced this pull request

2026-08-29 12:42:47 +00:00

still failling on a regular brave-bin package #7