From 923c642e08cfa818c0e06718ce509417db7d02bd Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 27 Aug 2026 01:08:29 +0100
Subject: [PATCH] fix(template): if/else instead of `cmd && log || log` for the
 integrity check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Codacy flagged this on berrywiki#28 and was RIGHT — I nearly dismissed it.

launcher.sh.tera carried:

    verify-desktop-integrity.sh --generate 2>/dev/null \
        && log "  + integrity hashes generated" \
        || log "  · integrity hash generation failed (non-fatal)"

In that form, if the command SUCCEEDS but the success-branch `log` fails, the
failure branch fires too — a run that worked reports both "hashes generated"
and "generation failed (non-fatal)". Misleading output rather than a broken
build, so lower severity than Codacy implied: `set -e` does not fire here,
because the command sits on the left of `&&`.

WHY I ALMOST MISSED IT. My first search was `grep -E '&&.*\|\|'` — single-line.
This ternary is spelled across THREE backslash-continued lines, so it never
appears on one line and the grep returned only a benign `A && { B || C; }` at
:125 (a braced compound condition, not a ternary). I was one step from reporting
"misread, no work here". The search's reach was narrower than the conclusion I
was about to draw from it.

The regression test therefore JOINS continuations before checking, so it sees
the multi-line form the grep could not, and it exempts `{ ... }` groups so the
safe compound form at :125 does not false-positive.

Negative-tested: reintroducing the ternary fails the test with the offending
line quoted; restoring the if/else passes. Full workspace suite: 20 passed,
0 failed.

Fixed at the GENERATOR, not in the ~20 emitted launchers — same reasoning as the
shebang fix in #26. A `launch-scaffolder realign` propagates it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/launcher-common/src/template.rs | 36 ++++++++++++++++++++++++++
 templates/launcher.sh.tera             | 12 ++++++---
 2 files changed, 45 insertions(+), 3 deletions(-)

diff --git a/crates/launcher-common/src/template.rs b/crates/launcher-common/src/template.rs
index 492a27b..daac96c 100644
--- a/crates/launcher-common/src/template.rs
+++ b/crates/launcher-common/src/template.rs
@@ -184,6 +184,42 @@ mod tests {
         }
     }
 
+    /// No `cmd && log ... || log ...` ternaries in the template.
+    ///
+    /// In that form a FAILING command on the success branch also fires the
+    /// failure branch, so a run that actually worked reports both "generated"
+    /// and "generation failed". Codacy flagged a real instance of this at
+    /// launcher.sh.tera:410; it was spelled across three continued lines, so a
+    /// single-line grep missed it — hence a test that joins continuations.
+    ///
+    /// `A && { B || C; }` is NOT this bug: the `||` is inside a braced group,
+    /// making it a compound condition rather than a ternary.
+    #[test]
+    fn template_has_no_command_log_ternaries() {
+        // Join backslash continuations so multi-line ternaries are visible.
+        let joined = LAUNCHER_TEMPLATE.replace("\\\n", " ");
+        for (i, line) in joined.lines().enumerate() {
+            let l = line.trim();
+            if l.starts_with('#') {
+                continue; // comments may describe the pattern
+            }
+            if let Some(amp) = l.find("&& log") {
+                if let Some(pipe) = l[amp..].find("|| log") {
+                    // a braced group between them is the safe compound form
+                    let between = &l[amp..amp + pipe];
+                    assert!(
+                        between.contains('{'),
+                        "line {} is a `cmd && log || log` ternary; use if/else so a \
+                         failing log on the success branch cannot fire the failure \
+                         branch: {}",
+                        i + 1,
+                        l
+                    );
+                }
+            }
+        }
+    }
+
     /// The template source must OPEN with the shebang.
     ///
     /// It previously opened with a Tera comment block, so every launcher the
diff --git a/templates/launcher.sh.tera b/templates/launcher.sh.tera
index 51e629f..cf71cf8 100644
--- a/templates/launcher.sh.tera
+++ b/templates/launcher.sh.tera
@@ -407,9 +407,15 @@ do_integ_linux() {
         gio set "$DESKTOP_SHORTCUT_TARGET" "metadata::trusted" true 2>/dev/null || true
     fi
     if [ -x "/var/mnt/eclipse/repos/.desktop-tools/verify-desktop-integrity.sh" ]; then
-        /var/mnt/eclipse/repos/.desktop-tools/verify-desktop-integrity.sh --generate 2>/dev/null \
-            && log "  + integrity hashes generated" \
-            || log "  · integrity hash generation failed (non-fatal)"
+        # if/else, not `cmd && log || log`: in that form a FAILING log on the
+        # success branch also fires the failure branch, so a run that worked
+        # reports both "generated" and "generation failed". The command's own
+        # status is what should choose the message.
+        if /var/mnt/eclipse/repos/.desktop-tools/verify-desktop-integrity.sh --generate 2>/dev/null; then
+            log "  + integrity hashes generated"
+        else
+            log "  · integrity hash generation failed (non-fatal)"
+        fi
     fi
 }