Repository navigation
Canary knows exit 5, refusal names the country, dumps are 0600 - #19
Merged
Merged
Conversation
jehrr
marked this pull request as ready for review
October 7, 2026 13:39
Three small findings from the 2026-10 audit, each checked against the code: - canary.yml: its exit-code switch had no branch for 5, so a stale MEDIAMARKT_PROXY secret read "Unexpected exit code 5". It now says the page was never obtained and what to check. README's exit table still described 5 as "Remote API error" only. - page_flow.BLOCK_COUNTRY_HINT, logged by all three engines on a refusal: the 403 body is identical for a datacentre address and a residential one in the wrong country, so the line names both causes. - output_writer.open_private: raw page dumps were created with the default umask. All 15 dump writers in four files now use it. - README: note on the macOS system-Python urllib3/LibreSSL warning. New smoke check for all four, each controlled by planting its fault and confirming the named check goes red. Not changed: lock files (they would disable the canary's daily test of new releases), the canary's dump artifact (it is the debugging tool), the mirror/canonical-repo question (undecided). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
jehrr
force-pushed
the
canary-exit5-and-dump-perms
branch
from
October 15, 2026 21:59
6268856 to
0fa7d78
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three small findings from the 2026-10 audit of the 2parser mirror, each re-checked against this code before changing it.
Found while checking: the daily canary is red in 28 of the last 30 runs (here and in the mirror), all
Unexpected exit code 5. Exit 5 means the page was never obtained, which points at an expiredMEDIAMARKT_PROXYsecret. The secret itself needs refreshing by a person; this PR does not fix that. It only makes the canary say what happened.canary.yml: add the missing5)branch. README's exit table described 5 only as "Remote API error", now corrected.page_flow.BLOCK_COUNTRY_HINT, logged by all three engines on a refusal: the 403 body is the same for a datacentre address and a residential one in the wrong country (README: a German address is accepted by .de/.es/.pl, refused by the other seven).output_writer.open_private: raw dumps (--dump-html,_debug.html) were created with the default umask. All 15 writers in four files use it now.Evidence:
smoke_test: OK. New checktest_dumps_private_canary_and_block_hint. Controls planted one by one, each went red on its named check: plainopen()back in selenium,5)removed from canary, hint removed from pyppeteer,chmodbroken. One control (os.openmode alone) stays green by design, because thechmodafter it duplicates it; theos.openmode only closes the window before the chmod, which a test cannot see.Not changed, and why: lock files (would disable the canary's daily test of new releases); the canary's dump artifact (it is the debugging tool, per the comment in the workflow); which repo is canonical vs the
2parser/mediamarkt-parsermirror (undecided). Unchanged because unproven: no live run, since there is no working residential exit here.🤖 Generated with Claude Code