sig: remove hardcoded tmp path, replace os.execute with dawio #12

New issue

Open

opened 2026-05-26 05:28:45 +02:00 by michael · 0 comments

michael commented

2026-05-26 05:28:45 +02:00

Owner

Findings

1. Hardcoded temp path

local TMPDIR = ".temp/sig-verify" violates the no-hardcoded-tmp-prefix
rule (DAW/fragjan#73). The temp directory must come in as a parameter,
e.g. via opts.temp_dir.

2. Direct os.execute calls and local wrapper

A local execute() wrapper around os.execute is defined and used
four times. This bypasses daw.common.sys entirely.
The wrapper must be removed and replaced with out:run_rc().

3. No dawio / daw.common.sys used at all

daw.common.sys is not required anywhere in this file.
All I/O and shell execution must go through sys.new().
Without it, handle injection and testability are not possible.

Acceptance Criteria

TMPDIR removed, temp path passed via opts.temp_dir
Local execute() wrapper removed
os.execute calls replaced with out:run_rc()
daw.common.sys required and used consistently
Tests pass after changes

## Findings ### 1. Hardcoded temp path `local TMPDIR = ".temp/sig-verify"` violates the no-hardcoded-tmp-prefix rule (DAW/fragjan#73). The temp directory must come in as a parameter, e.g. via opts.temp_dir. ### 2. Direct os.execute calls and local wrapper A local `execute()` wrapper around `os.execute` is defined and used four times. This bypasses `daw.common.sys` entirely. The wrapper must be removed and replaced with `out:run_rc()`. ### 3. No dawio / daw.common.sys used at all `daw.common.sys` is not required anywhere in this file. All I/O and shell execution must go through `sys.new()`. Without it, handle injection and testability are not possible. ## Acceptance Criteria - [ ] `TMPDIR` removed, temp path passed via opts.temp_dir - [ ] Local `execute()` wrapper removed - [ ] `os.execute` calls replaced with `out:run_rc()` - [ ] `daw.common.sys` required and used consistently - [ ] Tests pass after changes

michael added the

labels

2026-05-26 05:28:45 +02:00