Outcome of toSystem is not checked against environment changing between runs #23

New Issue

2025-11-12T00:35:07+09:00

ophestra commented

2025-11-12 00:35:07 +09:00

The internal/system partial reversion makes assumption that the outcomes being rolled back is identical. This requires toSystem to reach the exact same outcome every run for any configuration. This is true as long as $TMPDIR and $XDG_RUNTIME_DIR does not change between these runs.

This potential divergence can be mitigated by encoding internal/env outcome in the state store, and recompute toSystem outcome if it differs. Such an implementation comes with non-negligible overhead though.

Since the priv side environment is considered trusted input, If such overhead is deemed unacceptable, this behaviour should be documented instead.

The `internal/system` partial reversion makes assumption that the outcomes being rolled back is identical. This requires `toSystem` to reach the exact same outcome every run for any configuration. This is true as long as `$TMPDIR` and `$XDG_RUNTIME_DIR` does not change between these runs. This potential divergence can be mitigated by encoding `internal/env` outcome in the state store, and recompute `toSystem` outcome if it differs. Such an implementation comes with non-negligible overhead though. Since the priv side environment is considered trusted input, If such overhead is deemed unacceptable, this behaviour should be documented instead.

👍 1

ophestra added the

labels 2025-11-12 00:35:07 +09:00

Sign in to join this conversation.