From 5a107bee50ac3a02ce95564d3464fce7de1b144b Mon Sep 17 00:00:00 2001
From: Jerod <jerod@synth.sh>
Date: Sat, 24 Oct 2026 13:07:03 -0700
Subject: [PATCH 1/2] fix(tauri): repair AUR SSH and shared validation

---
 js/i18n/README.md                           |  38 +++----
 js/i18n/src/viteConfig.ts                   |   7 +-
 js/inbound/README.md                        |   2 +-
 js/inbound/ReportWizard.svelte              |  14 +--
 js/updater.ts                               |  14 +--
 packaging/tauri/README.md                   |  12 +++
 packaging/tauri/aur/container-entrypoint.sh |  30 ++----
 packaging/tauri/aur/container-publish.sh    |   8 +-
 packaging/tauri/aur/container-ssh.test.sh   |   8 ++
 packaging/tauri/aur/prepare-home.sh         |  34 ++++++
 packaging/tauri/aur/publish.sh              |  13 ++-
 packaging/tauri/aur/ssh-home.test.sh        | 114 ++++++++++++++++++++
 packaging/tauri/test.sh                     |   8 +-
 scripts/update-utils-submodules.mjs         |   2 +-
 scripts/update-utils-submodules.test.mjs    |   3 +-
 15 files changed, 236 insertions(+), 71 deletions(-)
 create mode 100644 packaging/tauri/aur/container-ssh.test.sh
 create mode 100644 packaging/tauri/aur/prepare-home.sh
 create mode 100644 packaging/tauri/aur/ssh-home.test.sh

diff --git a/js/i18n/README.md b/js/i18n/README.md
index 229b14a..0ce6761 100644
--- a/js/i18n/README.md
+++ b/js/i18n/README.md
@@ -9,12 +9,12 @@ This package is consumed via pnpm `link:` (always-symlink), no publish:
 ```jsonc
 // in your app's package.json
 {
-  "dependencies": {
-    "@synthlabs/i18n": "link:../utils/js/i18n",
-  },
-  "devDependencies": {
-    "@inlang/paraglide-js": "^2.16.0",
-  },
+	"dependencies": {
+		"@synthlabs/i18n": "link:../utils/js/i18n"
+	},
+	"devDependencies": {
+		"@inlang/paraglide-js": "^2.16.0"
+	}
 }
 ```
 
@@ -26,30 +26,30 @@ The `@inlang/paraglide-js` peerDep belongs to the consuming app - it owns the ge
 
 ```ts
 // vite.config.ts
-import { sveltekit } from "@sveltejs/kit/vite";
-import { defineConfig } from "vite";
-import { defineParaglide } from "@synthlabs/i18n";
+import { sveltekit } from '@sveltejs/kit/vite';
+import { defineConfig } from 'vite';
+import { defineParaglide } from '@synthlabs/i18n';
 
 export default defineConfig({
-  plugins: [
-    sveltekit(),
-    defineParaglide(), // defaults: project ./project.inlang, outdir ./src/lib/paraglide
-  ],
+	plugins: [
+		sveltekit(),
+		defineParaglide() // defaults: project ./project.inlang, outdir ./src/lib/paraglide
+	]
 });
 ```
 
 Default strategy is `['localStorage', 'preferredLanguage', 'baseLocale']` - right for desktop apps. Override for static sites with locale-prefixed URLs:
 
 ```ts
-defineParaglide({ strategy: ["url", "cookie", "baseLocale"] });
+defineParaglide({ strategy: ['url', 'cookie', 'baseLocale'] });
 ```
 
 ### OS-locale detection
 
 ```ts
-import { detectOsLocale } from "@synthlabs/i18n";
+import { detectOsLocale } from '@synthlabs/i18n';
 
-const locale = detectOsLocale(["en", "ru"], "en");
+const locale = detectOsLocale(['en', 'ru'], 'en');
 // "en-US" → "en", "ru-RU" → "ru", "de-DE" → "en" (fallback)
 ```
 
@@ -104,9 +104,9 @@ Validates that every `messages/<locale>.json` has the same key set as the base l
 ```jsonc
 // package.json
 {
-  "scripts": {
-    "check": "svelte-kit sync && svelte-check && i18n-lint ./messages",
-  },
+	"scripts": {
+		"check": "svelte-kit sync && svelte-check && i18n-lint ./messages"
+	}
 }
 ```
 
diff --git a/js/i18n/src/viteConfig.ts b/js/i18n/src/viteConfig.ts
index 8550922..0d6f2d6 100644
--- a/js/i18n/src/viteConfig.ts
+++ b/js/i18n/src/viteConfig.ts
@@ -1,12 +1,7 @@
 import { paraglideVitePlugin } from '@inlang/paraglide-js';
 
 export type ParaglideStrategy =
-	| 'cookie'
-	| 'url'
-	| 'localStorage'
-	| 'preferredLanguage'
-	| 'baseLocale'
-	| 'globalVariable';
+	'cookie' | 'url' | 'localStorage' | 'preferredLanguage' | 'baseLocale' | 'globalVariable';
 
 export interface DefineParaglideOptions {
 	/** Path to the inlang project. Defaults to `./project.inlang`. */
diff --git a/js/inbound/README.md b/js/inbound/README.md
index 07e0676..fa2a892 100644
--- a/js/inbound/README.md
+++ b/js/inbound/README.md
@@ -5,7 +5,7 @@ opt into custom presentation with `ErrorController` and `connectErrorCapture`.
 
 ```ts
 const errors = new ErrorController({
-  log: error => logHandledError(error.message, error.target ?? 'app')
+	log: (error) => logHandledError(error.message, error.target ?? 'app')
 });
 const unsubscribe = errors.subscribe(render);
 const stopTimers = errors.start();
diff --git a/js/inbound/ReportWizard.svelte b/js/inbound/ReportWizard.svelte
index 276be37..048f5d3 100644
--- a/js/inbound/ReportWizard.svelte
+++ b/js/inbound/ReportWizard.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { onDestroy, onMount, untrack, type Snippet } from 'svelte';
+	import { SvelteSet } from 'svelte/reactivity';
 	import Logger from '$utils/log';
 	import {
 		inboundCapabilities,
@@ -48,7 +49,7 @@
 	type PreviewStep = 'system' | 'build' | 'log' | 'config' | 'error';
 	const isPreview = (step: StepId): step is PreviewStep =>
 		['system', 'build', 'log', 'config', 'error'].includes(step);
-	const loaded = new Set<PreviewStep>(initialError ? ['error'] : []);
+	const loaded = new SvelteSet<PreviewStep>(initialError ? ['error'] : []);
 	let system = $state<SystemInfo | null>(null);
 	let build = $state<BuildInfo | null>(null);
 	let log = $state<LogPreview | null>(null);
@@ -64,9 +65,7 @@
 	let request = 0;
 	const progressSteps = $derived(wizard.visibleSteps());
 	const progressIndex = $derived(progressSteps.indexOf(wizard.step));
-	const progressPosition = $derived(
-		progressIndex >= 0 ? progressIndex : progressSteps.length - 1
-	);
+	const progressPosition = $derived(progressIndex >= 0 ? progressIndex : progressSteps.length - 1);
 
 	async function load(step: PreviewStep | 'capabilities') {
 		const current = ++request;
@@ -185,9 +184,7 @@
 							disabled:
 								busy ||
 								loading ||
-								(!!failure &&
-									(failure.step === 'capabilities' ||
-										wizard.include[failure.step])),
+								(!!failure && (failure.step === 'capabilities' || wizard.include[failure.step])),
 							onclick: () => wizard.next()
 						}
 	);
@@ -370,8 +367,7 @@
 		{@render button({
 			kind: 'back',
 			label: text.back,
-			disabled:
-				loading || busy || ['username', 'sending', 'done', 'failed'].includes(wizard.step),
+			disabled: loading || busy || ['username', 'sending', 'done', 'failed'].includes(wizard.step),
 			onclick: () => wizard.back()
 		})}
 		{@render button(nextAction)}
diff --git a/js/updater.ts b/js/updater.ts
index 386f497..5f7b5db 100644
--- a/js/updater.ts
+++ b/js/updater.ts
@@ -162,11 +162,7 @@ export async function checkForAppUpdates(
 				event.preventDefault();
 
 				if (updateAction.kind === 'external') {
-					await openExternalUpdateUrl(
-						updateAction.url,
-						openReleaseNotes,
-						options.onError
-					);
+					await openExternalUpdateUrl(updateAction.url, openReleaseNotes, options.onError);
 					return;
 				}
 
@@ -225,13 +221,7 @@ async function installUpdate(
 					lastPercent = percent;
 					toast.loading(
 						copy.downloadingProgress(percent),
-						downloadingToastOptions(
-							toastId,
-							copy,
-							releaseUrl,
-							openReleaseNotes,
-							onError
-						)
+						downloadingToastOptions(toastId, copy, releaseUrl, openReleaseNotes, onError)
 					);
 				}
 
diff --git a/packaging/tauri/README.md b/packaging/tauri/README.md
index 1df12bb..7f4436b 100644
--- a/packaging/tauri/README.md
+++ b/packaging/tauri/README.md
@@ -36,3 +36,15 @@ _tauri_smoke_env=('WEBKIT_DISABLE_COMPOSITING_MODE=1')
 
 The shared Arch helpers set `TAURI_PACKAGING_SOURCE_DIR`, `TAURI_PACKAGING_PKGVER`, and
 `TAURI_PACKAGING_PKGREL` while evaluating and building the local PKGBUILD.
+
+## AUR SSH validation
+
+`aur/container-publish.sh --check-access` accepts the same arguments as publication and runs
+only `git ls-remote` after configuring the container account and SSH files. It does not create
+commits or push. The account's registered home and `HOME` both point to the temporary builder
+home, where the supplied SSH directory is installed with private permissions.
+
+Run `bash utils/packaging/tauri/aur/container-ssh.test.sh` from a consuming checkout to test new
+and existing container accounts against a local SSH server. The fixtures verify trusted access,
+reject a different host key, and leave the empty remote unchanged. Docker is required;
+`CONTAINER_RUNTIME` can select another compatible container command.
diff --git a/packaging/tauri/aur/container-entrypoint.sh b/packaging/tauri/aur/container-entrypoint.sh
index 0709178..fad99ce 100755
--- a/packaging/tauri/aur/container-entrypoint.sh
+++ b/packaging/tauri/aur/container-entrypoint.sh
@@ -9,13 +9,18 @@ pkgrel=
 aur_repository=
 git_user_name=
 git_user_email=
+check_access=()
 
 usage() {
-  echo "usage: $0 --project-root PATH --package PATH --release-tag TAG --pkgver VERSION --pkgrel NUMBER --aur-repository URL --git-user-name NAME --git-user-email EMAIL" >&2
+  echo "usage: $0 --project-root PATH --package PATH --release-tag TAG --pkgver VERSION --pkgrel NUMBER --aur-repository URL --git-user-name NAME --git-user-email EMAIL [--check-access]" >&2
 }
 
 while (( $# > 0 )); do
   case "$1" in
+    --check-access)
+      check_access=(--check-access)
+      shift
+      ;;
     --project-root)
       project_root="${2:-}"
       shift 2
@@ -64,28 +69,15 @@ pacman-key --init
 pacman-key --populate archlinux
 pacman -Syu --needed --noconfirm git openssh
 
-build_gid="${HOST_GID:-1000}"
-build_uid="${HOST_UID:-1000}"
-build_group="$(getent group "${build_gid}" | cut -d: -f1 || true)"
-if [[ -z "${build_group}" ]]; then
-  build_group=builder
-  groupadd --gid "${build_gid}" "${build_group}"
-fi
-
-build_user="$(getent passwd "${build_uid}" | cut -d: -f1 || true)"
-if [[ -z "${build_user}" ]]; then
-  build_user=builder
-  useradd --uid "${build_uid}" --gid "${build_group}" --create-home "${build_user}"
-fi
-
 build_home=/tmp/tauri-packaging-builder-home
-install -d -m755 -o "${build_user}" -g "${build_group}" "${build_home}"
-install -d -m700 -o "${build_user}" -g "${build_group}" "${build_home}/.ssh"
-cp -a /run/aur-ssh/. "${build_home}/.ssh/"
-chown -R "${build_user}:${build_group}" "${build_home}/.ssh"
+build_user="$(
+  bash /tauri-packaging/aur/prepare-home.sh \
+    "${HOST_UID:-1000}" "${HOST_GID:-1000}" "${build_home}" /run/aur-ssh
+)"
 
 runuser -u "${build_user}" -- env HOME="${build_home}" \
   /tauri-packaging/aur/publish.sh \
+    "${check_access[@]}" \
     --project-root "${project_root}" \
     --package "${package_path}" \
     --release-tag "${release_tag}" \
diff --git a/packaging/tauri/aur/container-publish.sh b/packaging/tauri/aur/container-publish.sh
index 84c4b74..b41bb5f 100755
--- a/packaging/tauri/aur/container-publish.sh
+++ b/packaging/tauri/aur/container-publish.sh
@@ -13,13 +13,18 @@ ssh_dir=
 git_user_name=
 git_user_email=
 container_runtime=docker
+check_access=()
 
 usage() {
-  echo "usage: $0 --project-root PATH --package PATH --release-tag TAG --pkgver VERSION --pkgrel NUMBER --aur-repository URL --ssh-dir PATH --git-user-name NAME --git-user-email EMAIL [--container-runtime COMMAND]" >&2
+  echo "usage: $0 --project-root PATH --package PATH --release-tag TAG --pkgver VERSION --pkgrel NUMBER --aur-repository URL --ssh-dir PATH --git-user-name NAME --git-user-email EMAIL [--container-runtime COMMAND] [--check-access]" >&2
 }
 
 while (( $# > 0 )); do
   case "$1" in
+    --check-access)
+      check_access=(--check-access)
+      shift
+      ;;
     --project-root)
       project_root="${2:-}"
       shift 2
@@ -98,6 +103,7 @@ fi
   --workdir /workspace \
   archlinux:base-devel \
   bash /tauri-packaging/aur/container-entrypoint.sh \
+    "${check_access[@]}" \
     --project-root /workspace \
     --package "${container_package_path}" \
     --release-tag "${release_tag}" \
diff --git a/packaging/tauri/aur/container-ssh.test.sh b/packaging/tauri/aur/container-ssh.test.sh
new file mode 100644
index 0000000..cf20645
--- /dev/null
+++ b/packaging/tauri/aur/container-ssh.test.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+shared_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+"${CONTAINER_RUNTIME:-docker}" run --rm \
+  --volume "${shared_root}:/tauri-packaging:ro" \
+  archlinux:base-devel \
+  bash -c 'pacman -Syu --needed --noconfirm git openssh && bash /tauri-packaging/aur/ssh-home.test.sh'
diff --git a/packaging/tauri/aur/prepare-home.sh b/packaging/tauri/aur/prepare-home.sh
new file mode 100644
index 0000000..7317b6e
--- /dev/null
+++ b/packaging/tauri/aur/prepare-home.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if (( $# != 4 )); then
+  echo "usage: $0 UID GID HOME SSH_DIRECTORY" >&2
+  exit 2
+fi
+
+build_uid="$1"
+build_gid="$2"
+build_home="$3"
+ssh_directory="$4"
+
+build_group="$(getent group "${build_gid}" | cut -d: -f1 || true)"
+if [[ -z "${build_group}" ]]; then
+  build_group="builder-${build_gid}"
+  groupadd --gid "${build_gid}" "${build_group}"
+fi
+
+build_user="$(getent passwd "${build_uid}" | cut -d: -f1 || true)"
+if [[ -z "${build_user}" ]]; then
+  build_user="builder-${build_uid}"
+  useradd --uid "${build_uid}" --gid "${build_group}" \
+    --home-dir "${build_home}" --create-home "${build_user}"
+elif [[ "$(getent passwd "${build_uid}" | cut -d: -f6)" != "${build_home}" ]]; then
+  usermod --home "${build_home}" "${build_user}"
+fi
+
+install -d -m755 -o "${build_user}" -g "${build_group}" "${build_home}"
+install -d -m700 -o "${build_user}" -g "${build_group}" "${build_home}/.ssh"
+cp -a "${ssh_directory}/." "${build_home}/.ssh/"
+find "${build_home}/.ssh" -type f -exec chmod 600 {} +
+chown -R "${build_user}:${build_group}" "${build_home}/.ssh"
+printf '%s\n' "${build_user}"
diff --git a/packaging/tauri/aur/publish.sh b/packaging/tauri/aur/publish.sh
index 6bd9987..9e83dbf 100755
--- a/packaging/tauri/aur/publish.sh
+++ b/packaging/tauri/aur/publish.sh
@@ -10,13 +10,18 @@ pkgrel=
 aur_repository=
 git_user_name=
 git_user_email=
+check_access=0
 
 usage() {
-  echo "usage: $0 --project-root PATH --package PATH --release-tag TAG --pkgver VERSION --pkgrel NUMBER --aur-repository URL --git-user-name NAME --git-user-email EMAIL" >&2
+  echo "usage: $0 --project-root PATH --package PATH --release-tag TAG --pkgver VERSION --pkgrel NUMBER --aur-repository URL --git-user-name NAME --git-user-email EMAIL [--check-access]" >&2
 }
 
 while (( $# > 0 )); do
   case "$1" in
+    --check-access)
+      check_access=1
+      shift
+      ;;
     --project-root)
       project_root="${2:-}"
       shift 2
@@ -63,6 +68,12 @@ fi
 
 project_root="$(cd -- "${project_root}" && pwd)"
 package_path="$(realpath -e -- "${package_path}")"
+if (( check_access )); then
+  git ls-remote "${aur_repository}" >/dev/null
+  echo 'AUR SSH access verified without publishing'
+  exit 0
+fi
+
 template="${project_root}/packaging/aur/PKGBUILD.in"
 aur_dir="$(mktemp -d "${TMPDIR:-/tmp}/tauri-packaging-aur.XXXXXXXX")"
 push_output="$(mktemp "${TMPDIR:-/tmp}/tauri-packaging-aur-push.XXXXXXXX.log")"
diff --git a/packaging/tauri/aur/ssh-home.test.sh b/packaging/tauri/aur/ssh-home.test.sh
new file mode 100644
index 0000000..0371555
--- /dev/null
+++ b/packaging/tauri/aur/ssh-home.test.sh
@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+fixtures="$(mktemp -d /tmp/tauri-ssh-test.XXXXXXXX)"
+server_pid=
+cleanup() {
+  if [[ -n "${server_pid}" ]]; then
+    kill "${server_pid}" 2>/dev/null || true
+    wait "${server_pid}" 2>/dev/null || true
+  fi
+  rm -rf -- "${fixtures}"
+}
+trap cleanup EXIT
+chmod 755 "${fixtures}"
+
+fail() {
+  cat "${fixtures}/server.log" >&2 || true
+  echo "SSH fixture failure: $*" >&2
+  exit 1
+}
+
+useradd --user-group --create-home fixture-aur
+usermod --password '*' fixture-aur
+git init --bare "${fixtures}/remote.git"
+chown -R fixture-aur:fixture-aur "${fixtures}/remote.git"
+mkdir "${fixtures}/client"
+ssh-keygen -q -t ed25519 -N '' -f "${fixtures}/host"
+ssh-keygen -q -t ed25519 -N '' -f "${fixtures}/wrong-host"
+ssh-keygen -q -t ed25519 -N '' -f "${fixtures}/client/id_ed25519"
+cp "${fixtures}/client/id_ed25519.pub" "${fixtures}/authorized_keys"
+chmod 644 "${fixtures}/authorized_keys"
+printf '[127.0.0.1]:2222 %s\n' "$(cut -d' ' -f1,2 "${fixtures}/host.pub")" \
+  >"${fixtures}/client/known_hosts"
+cat >"${fixtures}/client/config" <<'EOF'
+Host 127.0.0.1
+  IdentityFile ~/.ssh/id_ed25519
+  IdentitiesOnly yes
+  StrictHostKeyChecking yes
+  UserKnownHostsFile ~/.ssh/known_hosts
+  GlobalKnownHostsFile /dev/null
+  BatchMode yes
+EOF
+cat >"${fixtures}/sshd_config" <<EOF
+Port 2222
+ListenAddress 127.0.0.1
+HostKey ${fixtures}/host
+PidFile ${fixtures}/sshd.pid
+AuthorizedKeysFile ${fixtures}/authorized_keys
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PermitRootLogin no
+StrictModes no
+UsePAM no
+AllowUsers fixture-aur
+EOF
+install -d -m755 /run/sshd /var/empty
+/usr/bin/sshd -D -f "${fixtures}/sshd_config" -E "${fixtures}/server.log" &
+server_pid=$!
+ready=0
+for _ in {1..50}; do
+  if ssh-keyscan -p 2222 127.0.0.1 >/dev/null 2>&1; then
+    ready=1
+    break
+  fi
+  sleep 0.1
+done
+(( ready )) || fail 'fixture SSH server did not start'
+
+mkdir "${fixtures}/project"
+touch "${fixtures}/project/sample.pkg.tar.zst"
+repository="ssh://fixture-aur@127.0.0.1:2222${fixtures}/remote.git"
+check_access() {
+  runuser -u "${build_user}" -- env HOME="${build_home}" \
+    bash "${script_dir}/publish.sh" --check-access \
+      --project-root "${fixtures}/project" \
+      --package "${fixtures}/project/sample.pkg.tar.zst" \
+      --release-tag app-1.0.0-test --pkgver 1.0.0 --pkgrel 1 \
+      --aur-repository "${repository}" \
+      --git-user-name Fixture --git-user-email fixture@example.invalid
+}
+
+for scenario in new existing; do
+  build_uid=20001
+  build_gid=20001
+  if [[ "${scenario}" == existing ]]; then
+    build_uid=20002
+    build_gid=20002
+    groupadd --gid "${build_gid}" existing-builder
+    useradd --uid "${build_uid}" --gid "${build_gid}" \
+      --home-dir "${fixtures}/original-home" --create-home existing-builder
+  fi
+  build_home="${fixtures}/${scenario}-home"
+  build_user="$(bash "${script_dir}/prepare-home.sh" \
+    "${build_uid}" "${build_gid}" "${build_home}" "${fixtures}/client")"
+  [[ "$(getent passwd "${build_uid}" | cut -d: -f6)" == "${build_home}" ]] \
+    || fail "${scenario}: passwd home differs from HOME"
+  [[ "$(stat -c '%a' "${build_home}/.ssh")" == 700 ]] || fail 'SSH directory permissions'
+  [[ "$(stat -c '%a' "${build_home}/.ssh/id_ed25519")" == 600 ]] || fail 'key permissions'
+  check_access || fail "${scenario}: trusted SSH access was rejected"
+  printf '[127.0.0.1]:2222 %s\n' "$(cut -d' ' -f1,2 "${fixtures}/wrong-host.pub")" \
+    >"${build_home}/.ssh/known_hosts"
+  if check_access >"${fixtures}/rejected.log" 2>&1; then
+    fail "${scenario}: untrusted host key was accepted"
+  fi
+  grep -q 'Host key verification failed' "${fixtures}/rejected.log" \
+    || fail "${scenario}: failure did not reject the host key"
+  echo "passed: ${scenario} account, trusted access and rejected host key"
+done
+
+remote_refs="$(runuser -u fixture-aur -- git --git-dir="${fixtures}/remote.git" for-each-ref)"
+[[ -z "${remote_refs}" ]] \
+  || fail 'access checks changed the remote repository'
+echo 'AUR SSH home and read-only access tests passed'
diff --git a/packaging/tauri/test.sh b/packaging/tauri/test.sh
index 602ce66..a9f8603 100755
--- a/packaging/tauri/test.sh
+++ b/packaging/tauri/test.sh
@@ -3,7 +3,7 @@ set -euo pipefail
 
 script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 
-bash -n \
+for script in \
   "${script_dir}/build.sh" \
   "${script_dir}/install.sh" \
   "${script_dir}/platform.sh" \
@@ -15,11 +15,17 @@ bash -n \
   "${script_dir}/arch/verify-installed.sh" \
   "${script_dir}/aur/container-entrypoint.sh" \
   "${script_dir}/aur/container-publish.sh" \
+  "${script_dir}/aur/container-ssh.test.sh" \
+  "${script_dir}/aur/prepare-home.sh" \
+  "${script_dir}/aur/ssh-home.test.sh" \
   "${script_dir}/aur/publish.sh" \
   "${script_dir}/aur/render.sh" \
   "${script_dir}/aur/render.test.sh" \
   "${script_dir}/aur/version-is-newer.sh" \
   "${script_dir}/aur/version-is-newer.test.sh"
+do
+  bash -n "${script}"
+done
 
 "${script_dir}/install.test.sh"
 
diff --git a/scripts/update-utils-submodules.mjs b/scripts/update-utils-submodules.mjs
index 785529e..34b6a60 100644
--- a/scripts/update-utils-submodules.mjs
+++ b/scripts/update-utils-submodules.mjs
@@ -39,7 +39,7 @@ export function createGhApi({ env = process.env, execute = spawnSync } = {}) {
     if (result.error) throw new GitHubApiError(result.error.message);
     if (result.status !== 0) {
       let response;
-      try { response = JSON.parse(result.stdout); } catch {}
+      try { response = JSON.parse(result.stdout); } catch { response = undefined; }
       const status = Number(response?.status || result.stderr?.match(/\(HTTP (\d{3})\)/)?.[1]) || undefined;
       throw new GitHubApiError(response?.message || result.stderr?.trim() || `gh exited ${result.status}`, status);
     }
diff --git a/scripts/update-utils-submodules.test.mjs b/scripts/update-utils-submodules.test.mjs
index dfcd18e..ee4db91 100644
--- a/scripts/update-utils-submodules.test.mjs
+++ b/scripts/update-utils-submodules.test.mjs
@@ -1,6 +1,7 @@
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
 import test from 'node:test';
+import { fileURLToPath } from 'node:url';
 import {
   createGhApi, formatSummary, GitHubApiError, parseArguments, propagate,
   readRegistry, resolveTarget, SOURCE_REPOSITORY, SUBMODULE_URL,
@@ -346,7 +347,7 @@ test('CLI defaults to dry run and refuses ambiguous modes and malformed argument
 });
 
 test('the CLI exits unsuccessfully before network access if write credentials are missing', () => {
-  const result = spawnSync(process.execPath, [new URL('./update-utils-submodules.mjs', import.meta.url).pathname, '--write'], {
+  const result = spawnSync(process.execPath, [fileURLToPath(new URL('./update-utils-submodules.mjs', import.meta.url)), '--write'], {
     encoding: 'utf8', env: { ...process.env, GH_TOKEN: '', UTILS_UPDATER_APP_SLUG: '' },
   });
   assert.equal(result.status, 1);

From 2f641c67439d9dcbfbe36c00b8e4a7ca63d0d904 Mon Sep 17 00:00:00 2001
From: Jerod <jerod@synth.sh>
Date: Sat, 24 Oct 2026 13:23:18 -0700
Subject: [PATCH 2/2] fix(tauri): restore SSH permissions after copying

---
 packaging/tauri/aur/prepare-home.sh  | 1 +
 packaging/tauri/aur/ssh-home.test.sh | 1 +
 2 files changed, 2 insertions(+)

diff --git a/packaging/tauri/aur/prepare-home.sh b/packaging/tauri/aur/prepare-home.sh
index 7317b6e..2e79b98 100644
--- a/packaging/tauri/aur/prepare-home.sh
+++ b/packaging/tauri/aur/prepare-home.sh
@@ -29,6 +29,7 @@ fi
 install -d -m755 -o "${build_user}" -g "${build_group}" "${build_home}"
 install -d -m700 -o "${build_user}" -g "${build_group}" "${build_home}/.ssh"
 cp -a "${ssh_directory}/." "${build_home}/.ssh/"
+chmod 700 "${build_home}/.ssh"
 find "${build_home}/.ssh" -type f -exec chmod 600 {} +
 chown -R "${build_user}:${build_group}" "${build_home}/.ssh"
 printf '%s\n' "${build_user}"
diff --git a/packaging/tauri/aur/ssh-home.test.sh b/packaging/tauri/aur/ssh-home.test.sh
index 0371555..7269343 100644
--- a/packaging/tauri/aur/ssh-home.test.sh
+++ b/packaging/tauri/aur/ssh-home.test.sh
@@ -25,6 +25,7 @@ usermod --password '*' fixture-aur
 git init --bare "${fixtures}/remote.git"
 chown -R fixture-aur:fixture-aur "${fixtures}/remote.git"
 mkdir "${fixtures}/client"
+chmod 755 "${fixtures}/client"
 ssh-keygen -q -t ed25519 -N '' -f "${fixtures}/host"
 ssh-keygen -q -t ed25519 -N '' -f "${fixtures}/wrong-host"
 ssh-keygen -q -t ed25519 -N '' -f "${fixtures}/client/id_ed25519"