Improve detection/setting of the PATH environment variable
Metadata
Current evaluation
Generalize empty-PATH detection: oci.py set_default_path() only sets PATH when base == 'bare', so non-bare images with empty PATH stay vulnerable. PR #1113 attempts the generalization; no maintainer decision yet.
Suggested action: keep open
Reason: The gap is real in current code: oci.py:431 `set_default_path(self, base)` returns early unless `base != "bare"`, while the issue explicitly asks to cover 'any case where the PATH is empty'. Commenter RafaelJohn9's claim that '#725 fixed this' is only partly correct — #725 (merged as b81a12c8, changelog 1.6.0) introduced the bare-only guard rather than generalizing it, and unit tests still assert that ubuntu@24.04/22.04/20.04 bases trigger no PATH config (test_oci.py:1063-1076). The work is already attempted in open PR #1113 (unreviewed, 218 days stale) which skopeo-inspects the image env and sets Pebble.DEFAULT_ENV_PATH only when PATH is missing/empty, so the issue remains valid and needs maintainer direction on that PR rather than closure; it is a defensive hardening with no currently-failing reproduction, hence moderate impact/actionability.
Evaluated by: mr-cal-bot
Issue body
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
32
Quick Win:
11
Complexity:
35
Confidence:
72
Actionability:
55
|
keep open | Generalize empty-PATH detection: oci.py set_default_path() only sets PATH when base == 'bare', so non-bare images with empty PATH stay vulnerable. PR #1113 attempts the generalization; no maintainer decision yet. | |
| qwen/qwen3.6-35b-a3b |
Impact:
30
Quick Win:
19
Complexity:
20
Confidence:
85
Actionability:
80
|
keep open | Generalize PATH detection beyond bare-based rocks to cover any case where PATH is empty. Currently only applies to bare bases; PR #725 addressed bare rocks but not the broader generalization. | |
| qwen/qwen3.8-27b |
Impact:
45
Quick Win:
32
Staleness:
65
Complexity:
30
Confidence:
75
Support Request:
10
|
keep open | Rockcraft issue to generalize empty-PATH detection beyond bare-based rocks; set_default_path still only handles bare. Labeled good first issue, last activity 381 days ago. A contributor claimed #725 fixed it, but code confirms it's unfixed. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
75
Complexity:
20
Confidence:
85
Support Request:
10
|
close stale | Requests generalizing empty PATH detection for security. Labeled good first issue. Appears resolved by PR #725, but remains open due to lack of maintainer action. Last activity 340 days ago. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
10
Complexity:
15
Confidence:
90
Support Request:
0
|
close stale | Issue requests generalizing PATH environment variable validation to cover all bases for security. Last comment indicates it appears resolved by PR #725. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
80
Complexity:
15
Confidence:
90
Support Request:
0
|
close stale | Requests generalizing empty PATH detection for security. Marked as fixed in PR #725 by a contributor, currently inactive awaiting closure. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/rockcraft#725
(confidence 90%)
Merged as b81a12c8; introduced set_default_path() with the bare-only guard and the 1.6.0 changelog entry, but did not perform the generalization requested here.
-
Related To:
canonical/rockcraft#1113
(confidence 85%)
Open, unreviewed PR implementing exactly this generalization (inspect image env, set Pebble.DEFAULT_ENV_PATH only if PATH missing/empty); should be triaged before further work.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1113 oci: set default PATH when missing or empty | rockcraft | open | Generalizes empty-PATH protection for OCI rocks beyond bare bases: set_default_path() now skopeo-inspects the final image env after set_environment() and writes Pebble.DEFAULT_ENV_PATH only if PATH is missing/empty. Open218 days, 0 reviews, author pinged 3x. |