From f631d5428baffd475696fed0364bbf99c0ba6e22 Mon Sep 17 00:00:00 2001 From: Sameh Khamis Date: Thu, 24 Sep 2026 22:01:56 -0700 Subject: [PATCH] docs: changelog entry for the macOS chmod fix (#694) Credit the fix in CHANGELOG and tidy the wording of its inline comment. Co-Authored-By: Claude Opus 5.5 (1M context) --- CHANGELOG.md | 5 +++++ server/standalone/key-setup-hardening.mjs | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index dceec6a9c..419c03e45 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +- Saving a key from Provider Settings works again on Macs where Nix or + Homebrew coreutils sit ahead of `/bin` on `PATH`. The credential hardener + now spawns Apple's `/bin/chmod -N` by absolute path; GNU `chmod` has no `-N`, + so the ACL strip failed closed and every save was refused (Arthur Bogaart, #694). + - Render on iPad and iPhone instead of stopping with "An error occurred while rendering." Cesium's per-vertex model atmosphere binds shader `out` parameters directly to varyings, which Apple's Metal/ANGLE backend cannot diff --git a/server/standalone/key-setup-hardening.mjs b/server/standalone/key-setup-hardening.mjs index e2d11182c..78440948c 100644 --- a/server/standalone/key-setup-hardening.mjs +++ b/server/standalone/key-setup-hardening.mjs @@ -125,7 +125,7 @@ export function hardenCredentialFile( if (platform === 'darwin') { // `-N` (strip the ACL) is Apple-only. Spawn /bin/chmod by absolute // path, never by name: a Nix/Homebrew coreutils profile puts GNU chmod - // first on PATH, and GNU chmod rejects `-N` — which read as a + // first on PATH, and GNU chmod rejects `-N` — which was treated as a // hardening failure and refused every save on such machines. const aclRemoval = spawn('/bin/chmod', ['-N', filepath], { stdio: 'ignore',