From a0af824d09dda45a52b4ad2ff0d337bc5ed7c568 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20SAILLANT?=
 <108685187+electron-rare@users.noreply.github.com>
Date: Wed, 11 Mar 2026 07:00:17 +0100
Subject: [PATCH] fix(security): temp dir perms 0700 + macOS bash compat
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- cad_runtime.py: chmod 0o777 → 0o700 for temp directories
- setup_repo.sh: replace mapfile with while-read for bash 3.2

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 gh_setup_and_patches/setup_repo.sh | 4 +++-
 tools/cad_runtime.py               | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/gh_setup_and_patches/setup_repo.sh b/gh_setup_and_patches/setup_repo.sh
index 14b19d0..c39806e 100755
--- a/gh_setup_and_patches/setup_repo.sh
+++ b/gh_setup_and_patches/setup_repo.sh
@@ -186,7 +186,9 @@ setup_branch_protection() {
   # These MUST match the check names you see in PR -> Checks.
   # If you change workflow/job names, update this list.
   local -a contexts=()
-  mapfile -t contexts < <(load_required_contexts)
+  while IFS= read -r line; do
+    contexts+=("${line}")
+  done < <(load_required_contexts)
 
   # JSON array for contexts
   local contexts_json
diff --git a/tools/cad_runtime.py b/tools/cad_runtime.py
index 3f16e75..a88b195 100644
--- a/tools/cad_runtime.py
+++ b/tools/cad_runtime.py
@@ -28,7 +28,7 @@ def ensure_cad_home() -> Path:
 def create_runtime_temp_dir(prefix: str) -> Path:
     ensure_cad_home()
     path = Path(tempfile.mkdtemp(prefix=f"{prefix}-", dir=CAD_HOME))
-    os.chmod(path, 0o777)
+    os.chmod(path, 0o700)
     return path