Re: [PATCH 0/1] compaudit: add ZSH_COMPLETION_USERS parameter

[Mikael Magnusson <mikachu@xxxxxxxxx>]

On Tue, Jun 30, 2026 at 3:21 PM Petros Amoiridis <petros@xxxxxxxxxxxx> wrote:
>
> Hi,
>
> When a package manager installs zsh completions under a dedicated
> service account, compaudit rejects the files on every shell start,
> because the owner is neither root nor the current user and the
> existing trust list doesn't match. The usual workarounds (compinit
> -u, chowning the files, or dismissing the prompt each time) are all
> unsatisfying.
>
> Concrete cases I've run into:
>
>   - Nix (nixbld* service accounts owning completions under
>     /nix/store)
>   - Workbrew (the 'workbrew' user owning Homebrew completions under
>     /opt/homebrew)
>   - Enterprise deployment tools using service accounts
>
> The attached patch adds a ZSH_COMPLETION_USERS parameter: a
> colon-delimited list of usernames or numeric UIDs appended to
> compaudit's trusted owners list. For example:
>
>   export ZSH_COMPLETION_USERS="workbrew:nixbld"

Why export?

> Trust stays opt-in. The user (or system admin) has to name the
> additional trusted owner, and compaudit still rejects files that are
> world- or group-writable. The list can be per-user in ~/.zshenv or
> system-wide in /etc/zshenv.

Why would you set it in zshenv? Completions are not used in
noninteractive shells.

> There's already precedent in compaudit for trust beyond root and
> $EUID: it tries to trust the owner of the zsh executable, and there
> is a Debian-specific path for /usr/local under the 'staff' group.
> This patch generalizes those exceptions into a parameter users can
> configure.
>
> One implementation note: an earlier draft resolved usernames with
> 'getent passwd', which compaudit itself uses, but the getent shim
> compaudit defines for systems without it doesn't handle 'passwd'
> lookups on macOS. The patch uses 'id -u' instead, which works on
> Linux and macOS without a fallback.

"which compaudit itself uses" doesn't make sense, this is compaudit itself too.

> Happy to iterate on the name, documentation, or parsing. Patch
> follows.

Why can we trust $ZSH_COMPLETION_USERS from the environment if we
can't trust $fpath?

> Best regards,
> Petros Amoiridis
> petros@xxxxxxxxxxxx
>
> Petros Amoiridis (1):
>   compaudit: add ZSH_COMPLETION_USERS parameter
>
>  Completion/compaudit | 27 +++++++++++++++++++++++++++
>  Doc/Zsh/params.yo    | 14 ++++++++++++++
>  2 files changed, 41 insertions(+)
>
> --
> 2.55.0
>
>


-- 
Mikael Magnusson