the assembly root's bootstrap.py: a paste word that begins with = is expanded by zsh, the NOT INITIALIZED line is neither quoted nor a paste word, and _paste_word asks the stdout's codec where git is handed the filesystem's bytes #961

Goal: every command line the assembly root's bootstrap.py prints for a person to paste reads back as itself in dash, bash and zsh.

Filed by lane openRepoShape-5, from rv932's independent review of #944 (#932) at ec2017cf (#944 issuecomment-6252637720): its SHOULD 1, SHOULD 3 and NITs 2 to 5. #944 lands first; this is what it leaves.

State at #944's head ec2017cf (templates/assembly-root/scripts/bootstrap.py):

• A leading = (SHOULD 1). _paste_word (:826-828) returns shlex.quote's word unchanged, and shlex.quote leaves =x bare. zsh expands a bare word that begins with = to the path of a command:

  • =ls becomes /usr/bin/ls, with no error;
  • =x stops the line with zsh: x not found.

  Measured with zsh 5.9: 75 of 76 such words fail, and only = alone reads back. dash and bash read them all.

  The case is reachable, because validate-manifest.py's _leg_path_findings (:803-829) accepts a leg path that begins with =. repo_shape.shell_quoted already quotes a leading = (family.py and siblings.py print commands with unquoted paths, so under a folder with a space the member-git-dir-cached remedy's rm -rf would delete the wrong directory, and add's push line fails #486). bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944's new test pins the row ("=x", "=x").

• The NOT INITIALIZED line (SHOULD 3). git submodule update --init {spelled(path)} (:1139-1141; :1057-1058 at 5017830) is neither quoted nor a paste word. Measured:

  • my spec gives two pathspecs;
  • sp\udcffec names no path;
  • =spec is expanded by zsh.

• The codec (NIT 2). _prints_as_it_is (:774-782) asks the stdout's codec, while git is handed os.fsencode's bytes. Under a latin-1 or cp1252 stdout, origin/café gets the quoted word and is printed as the byte e9, but the ref is c3 a9. This is not a regression, because 5017830 does the same.

• The round-trip guard (NIT 3). On POSIX the guard at :833 keeps today's text for sp\udcc3\udca9c, yet "$(printf -- 'sp\303\251c')" reads back exactly those bytes.

• Surviving mutants (NIT 4). R6 (except UnicodeEncodeError alone) and R8 (encode("utf-8", "surrogateescape") instead of os.fsencode) survive bootstrap.py: the merge --ff-only, --continue and --abort lines it prints word a leg's path and an upstream as a shell reads them back, so a byte that is not UTF-8 is a printf and no longer escape text that names no ref (#932) #944's 124 tests.

• Stale words (NIT 5). These no longer match the code:

  • tests/test_bootstrap_after_bump.py:536-538 (the command is "spelled");
  • the new test file's docstring (:17-21);
  • the module paragraph (:50-56).

Direction.

• In _paste_word, quote a word that begins with =, as shell_quoted does, and change the test row to '=x'.
• Print the NOT INITIALIZED command with _paste_word. That line sits where Every Path.is_file() / is_dir() / exists() guard in the shipped tools answers False to any OSError on Python 3.14 (3.12 and 3.13 raise PermissionError), so a directory this user cannot search reads as ABSENT: validate-pins.py skips its workflow @<sha> check, update-shape.py says copy-missing and update-pin-missing ("adopt the project") for files that are there, the doctor says DRIFTED (5 copy-missing), and bump-leg.py's remaining guards, and every other tool's, skip or misreport instead of refusing by name #430's slice D (the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958) moved it, so land after the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958, or let the assembly root's validate-manifest.py and bootstrap.py: a path this user cannot read is named, never read as absent, so a scripts/ nobody may search no longer SKIPs every validator into bootstrap ok (#430, slice D) #958 take it.
• Compare the stdout's codec with sys.getfilesystemencoding() before keeping a quoted non-ASCII word.
• Loosen the POSIX round-trip guard to what can be pasted.
• Add unit rows that kill R6 and R8.
• Bring the docstrings up to date.

Verify. rv932's probes cover this: every byte from 0x01 to 0xff, plus about 160 special names, through _paste_word, then sh -c 'printf %s "$1"' x <word> under dash, bash and zsh 5.9. The result must be 0 mismatches, a leading = included.

Overlaps. #944 (lands first), #948 (#896, which adds a switch line) and #958 (#430 slice D) all edit bootstrap.py. This goes after all three. bootstrap.py is a pinned copy, so every project re-pins it.

Size: S.

Milestone: none set; lane 3's call.

Lane: openreposhape-5 (openRepoShape-5)