requestlog: publish collector-readable evidence boundary

Publish the reviewed Gamertan Web Foundations v0.1.0-preview.6 snapshot with a narrow mode-0640 collector boundary, private mode-0600 default, explicit setgid ownership guidance, and native macOS-safe release verification. Exported from reviewed private source 120d660fa432761f85316ca3dde990e2dd142f19 after trusted Gitea CI run 681 and the complete native Mac verification suite. Material implementation assistance provided by OpenAI Codex; reviewed and verified through the maintainer workflow. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
2026-08-24 17:06:47 -04:00
parent 5563306368
commit a39e8f893c
12 changed files with 110 additions and 21 deletions
@@ -8,7 +8,10 @@ output=$1
 [[ $output = /* && $output != / && ! -e $output ]] || usage
 cd "$root"
 [[ -z $(git status --porcelain=v1 --untracked-files=all) ]] || { echo "private source must be clean" >&2; exit 1; }
-mapfile -t files < <(grep -Ev '^[[:space:]]*(#|$)' scripts/public-snapshot.allow)
+files=()
+while IFS= read -r file; do
+	files+=("$file")
+done < <(grep -Ev '^[[:space:]]*(#|$)' scripts/public-snapshot.allow)
 [[ ${#files[@]} -gt 0 ]] || exit 1
 for file in "${files[@]}"; do
 	[[ $file != /* && $file != *..* ]] || { echo "invalid allowlisted path: $file" >&2; exit 1; }