-
Notifications
You must be signed in to change notification settings - Fork 0
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
Repo ids are case-sensitive registry keys but case-insensitive APFS paths: a re-cased download mints a second entry over the same directory, and removing it os.RemoveAll's the original model's weights
bugSomething isn't workingSomething isn't workingStatus: Open.#34 In REPPL/Bauhaus;DefaultRoot adopts /Users/Shared/Bauhaus on "exists and is writable" alone: any unprivileged account can create it in the world-writable /Users/Shared and become the owner of every other account's data root — no admin install required
bugSomething isn't workingSomething isn't workingStatus: Open.#33 In REPPL/Bauhaus;EnsureDirs creates and chmods the layout directories through symlinks: a
logs(ormodels/hf) symlink planted in the setgid shared root silently widens an arbitrary victim-owned directory to 3775bugSomething isn't workingSomething isn't workingStatus: Open.#32 In REPPL/Bauhaus;Shared-cache mode: the venv interpreter (and uv) are executed on a bare existence check — EnsureDirs never creates or modes
venv, so any staff account can plant<root>/venv/bin/pythonplus the MLX marker and get code execution under every other account's uidbugSomething isn't workingSomething isn't workingStatus: Open.#31 In REPPL/Bauhaus;Gateway loopback auth exemption has no Host allow-list (its loopbackOnly sibling does): with an API key configured, a DNS-rebound page reads GET /v1/models and /health unauthenticated
bugSomething isn't workingSomething isn't workingStatus: Open.#30 In REPPL/Bauhaus;Download validation (validateModelDir) omits the shard-completeness check its rescan sibling has: a model missing an index-named shard is marked StateReady, advertised on /v1/models, but can never load
bugSomething isn't workingSomething isn't workingStatus: Open.#29 In REPPL/Bauhaus;Shared-cache mode: a peer account is misclassified holderForeign and refuses to start, instead of deferring to the running server as a client (0600 instance.token unreadable across accounts)
bugSomething isn't workingSomething isn't workingStatus: Open.#28 In REPPL/Bauhaus;Instance-token read (readInstanceToken) uses a raw os.ReadFile in the shared root: a planted FIFO wedges a peer's startup and a symlink is silently followed (unhardened read sibling of #19/#21)
bugSomething isn't workingSomething isn't workingStatus: Open.#27 In REPPL/Bauhaus;hub.WantedFiles de-duplicates file paths case-sensitively, defeating its anti-race guard on macOS's case-insensitive filesystem for a repo with two case-only-differing files
bugSomething isn't workingSomething isn't workingStatus: Open.#26 In REPPL/Bauhaus;registry.Open loads registry.json entries without the ValidRepoID gate its sibling Rescan enforces — a planted invalid-repo_id entry becomes an undeletable phantom served on /v1/models
bugSomething isn't workingSomething isn't workingStatus: Open.#25 In REPPL/Bauhaus;Download destination is reached through symlink-followable ancestors: a planted models/<org> symlink in the shared cache redirects a victim's download writes outside the models tree (os.Root confines descendants, not the ancestors used to open it)
bugSomething isn't workingSomething isn't workingStatus: Open.#24 In REPPL/Bauhaus;Registry Delete trusts the stored
pathfield: a planted registry.json in the shared root makes os.RemoveAll delete an arbitrary victim-owned path under the victim's euidbugSomething isn't workingSomething isn't workingStatus: Open.#23 In REPPL/Bauhaus;