From 258502526f461ca300fa38354065725304df9c4c Mon Sep 17 00:00:00 2001
From: Afi <toetuuafi@gmail.com>
Date: Sun, 18 Oct 2026 16:19:23 +1030
Subject: [PATCH] Don't run rnfs get while writing the systemd unit
 (install.sh)

A comment added to write_unit's heredoc in 0.1.6 (SUP-6) quoted
`rnfs get` in backticks. The heredoc is unquoted, so it can fill in the
launcher's path, and the shell ran rnfs get while writing the unit: a
usage error at install and update, and a garbled comment line in the
unit. Drop the backticks, and add a test that the heredoc runs nothing but
the launcher's systemd_quote.
---
 install.sh              | 2 +-
 tests/test_packaging.py | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/install.sh b/install.sh
index 4176b4e..a080c96 100755
--- a/install.sh
+++ b/install.sh
@@ -279,7 +279,7 @@ SystemCallArchitectures=native
 # ProtectSystem and PrivateTmp are left out: in a user unit they need unprivileged user namespaces, which some
 # systems turn off. Where that works, add them with the drop-in in contrib/rnfs.service.d/hardening.conf
 # (https://github.com/afit21/rnfs/blob/main/contrib/rnfs.service.d/hardening.conf). UMask is left out too: what
-# `rnfs get` writes gets its permissions from your umask.
+# rnfs get writes gets its permissions from your umask.
 
 [Install]
 WantedBy=default.target
diff --git a/tests/test_packaging.py b/tests/test_packaging.py
index 23694eb..7f4d8aa 100644
--- a/tests/test_packaging.py
+++ b/tests/test_packaging.py
@@ -136,6 +136,15 @@ def test_provenance_names_the_tag(self):
         self.assertIn('*--source-ref*) options="$options --source-ref=refs/tags/$RELEASE_TAG"', verify)
         self.assertIn('*--deny-self-hosted-runners*) options="$options --deny-self-hosted-runners"', verify)
 
+    def test_unit_heredoc_runs_nothing(self):
+        """write_unit's heredoc is unquoted (it fills in the launcher's path), so the shell would run anything in
+        backticks or $(...) there: only the systemd_quote of the launcher may be."""
+        body = shell_function("write_unit")
+        heredoc = body[body.index("<<EOF\n") + len("<<EOF\n"):body.index("\nEOF\n")]
+        self.assertNotIn("`", heredoc)
+        self.assertEqual(re.findall(r"\$\(", heredoc), ["$("])
+        self.assertIn('$(systemd_quote "$LAUNCHER")', heredoc)
+
     def test_unit_matches_contrib(self):
         """install.sh's unit has every [Unit] and [Service] line of contrib/rnfs.service, in order, except
         ExecStart (the launcher's path) and comments (SUP-6)."""