install: stabilize candidate activation

[andrebrait]

Summary

• Force validated repository candidates to mode 0644 immediately before activation, independent of caller umask.
• Normalize candidate URL counts before numeric comparisons.
• Make fetch and published-installer test fixtures independent of option order and host timeout availability.

Verification

• Frozen RED under umask 077: activated conf mode 0600, expected 0644.
• GREEN with unchanged test hash: mode 0644.
• Focused channel/published-installer suites: 94 passed.
• sh -n and ShellCheck severity-info passed.

Refs pfBlockerNG/pfBlockerNG#2926 and pfBlockerNG/pfBlockerNG#2947.

Authored with OMP; no configured GitHub-recognized OMP coauthor identity was available.

Summary by CodeRabbit

• Bug Fixes

  • Improved installer validation when configuration checks return unexpected or empty results.
  • Ensured activated repository configuration files consistently use secure, standard permissions.
  • Added clearer error handling when configuration permissions cannot be applied.

• Tests

  • Added regression coverage for configuration permissions under restrictive system settings.
  • Improved installer test reliability across timeout, URL, and shell execution scenarios.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d0eb7b63-2bd5-489b-884f-4617a06afe58

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5cf2f546-749d-4981-a8ce-9af02f3e9681

📥 Commits

Reviewing files that changed from the base of the PR and between dd14b09 and 85106cb.

📒 Files selected for processing (3)

• scripts/install.sh
• tests/test_channel_install.py
• tests/test_gen_landing.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The installer now normalizes URL validation counts, enforces mode 0644 before activation, and reports permission failures. Tests update URL logging, verify restrictive-umask behavior, and stub timeout for published installer execution.

Changes

Installer hardening

Layer / File(s)	Summary
Validated configuration activation scripts/install.sh, tests/test_channel_install.py	URL count values are coerced to numeric defaults. Validated configuration files are changed to mode 0644 before activation. Tests cover URL logging and restrictive-umask activation.
Published installer test environment tests/test_gen_landing.py	Five published installer tests provide a timeout stub through TIMEOUT_BIN.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 85106

The change stabilizes candidate activation and related test fixtures, with focused checks reported as passing. No actionable merge-blocking risk remains beyond normal checks and review.

Poem

A rabbit checks the counts with care
Then sets the config’s mode fair
Timeout waits in every test
The installer passes its quest
Four-six-four-four guards the lair

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 88.89% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 3 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: stabilizing candidate activation in the installer.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[andrebrait]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Already reviewed the last commit. Use @coderabbitai full review to rerun a review of the entire changeset.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.