[PATCH 0/1] compaudit: add ZSH_COMPLETION_USERS parameter

[Petros Amoiridis <petros@xxxxxxxxxxxx>]

Hi,

When a package manager installs zsh completions under a dedicated
service account, compaudit rejects the files on every shell start,
because the owner is neither root nor the current user and the
existing trust list doesn't match. The usual workarounds (compinit
-u, chowning the files, or dismissing the prompt each time) are all
unsatisfying.

Concrete cases I've run into:

  - Nix (nixbld* service accounts owning completions under
    /nix/store)
  - Workbrew (the 'workbrew' user owning Homebrew completions under
    /opt/homebrew)
  - Enterprise deployment tools using service accounts

The attached patch adds a ZSH_COMPLETION_USERS parameter: a
colon-delimited list of usernames or numeric UIDs appended to
compaudit's trusted owners list. For example:

  export ZSH_COMPLETION_USERS="workbrew:nixbld"

Trust stays opt-in. The user (or system admin) has to name the
additional trusted owner, and compaudit still rejects files that are
world- or group-writable. The list can be per-user in ~/.zshenv or
system-wide in /etc/zshenv.

There's already precedent in compaudit for trust beyond root and
$EUID: it tries to trust the owner of the zsh executable, and there
is a Debian-specific path for /usr/local under the 'staff' group.
This patch generalizes those exceptions into a parameter users can
configure.

One implementation note: an earlier draft resolved usernames with
'getent passwd', which compaudit itself uses, but the getent shim
compaudit defines for systems without it doesn't handle 'passwd'
lookups on macOS. The patch uses 'id -u' instead, which works on
Linux and macOS without a fallback.

Happy to iterate on the name, documentation, or parsing. Patch
follows.

Best regards,
Petros Amoiridis
petros@xxxxxxxxxxxx

Petros Amoiridis (1):
  compaudit: add ZSH_COMPLETION_USERS parameter

 Completion/compaudit | 27 +++++++++++++++++++++++++++
 Doc/Zsh/params.yo    | 14 ++++++++++++++
 2 files changed, 41 insertions(+)

--
2.55.0