From 052767961cb6d83632d79dd64c139bc1371f3637 Mon Sep 17 00:00:00 2001
From: Sertug17 <104278804+Sertug17@users.noreply.github.com>
Date: Wed, 2 Sep 2026 21:00:44 +0300
Subject: [PATCH] fix: monitoring.md permissions note and arcup checksum
 filename validation

docs/monitoring.md: the troubleshooting section for Prometheus permissions
errors contradicted the compose.yaml's own user: "0" setting. Updated to
clarify that user: "0" prevents this in most configurations, retain the
queries.active symptom string operators search for in logs, and note the
two cases (userns-remap, SELinux) where the error can still surface.

arcup/arcup: verify_checksum_file had three related defects in the six
lines that parse the .sha256 entry:
- bare-hash input (no filename field) silently skipped filename validation
- no-trailing-newline input was misreported as an empty file
- CRLF line endings corrupted the filename comparison and error message
Fixed by reading via tr -d '\r' | head -n1 and checking emptiness on the
resulting string, then reading into variables with a here-string.

arcup/test_arcup.sh: added bare-hash test case to test_checksum_validation.

Fixes #315, #316
---
 arcup/arcup         | 8 ++++++--
 arcup/test_arcup.sh | 2 ++
 docs/monitoring.md  | 7 +++++--
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/arcup/arcup b/arcup/arcup
index 3590cd36..4f64a7f9 100755
--- a/arcup/arcup
+++ b/arcup/arcup
@@ -654,11 +654,13 @@ verify_checksum_file() {
     local archive_path="$1"
     local checksum_path="$2"
     local archive_name="$3"
-    local expected_checksum expected_name actual_checksum
+    local expected_checksum expected_name actual_checksum line
 
-    if ! read -r expected_checksum expected_name < "$checksum_path"; then
+    line=$(tr -d '\r' < "$checksum_path" | head -n1)
+    if [[ -z "$line" ]]; then
         error "Checksum file is empty: $checksum_path"
     fi
+    read -r expected_checksum expected_name <<< "$line"
 
     if [[ ! "$expected_checksum" =~ ^[0-9A-Fa-f]{64}$ ]]; then
         error "Checksum file has invalid SHA-256 hash: $checksum_path"
@@ -670,6 +672,8 @@ verify_checksum_file() {
         if [[ "$expected_name" != "$archive_name" ]]; then
             error "Checksum file is for '$expected_name', expected '$archive_name'"
         fi
+    elif [[ -n "$archive_name" ]]; then
+        error "Checksum file contains no filename field; expected '$archive_name'"
     fi
 
     actual_checksum=$(compute_sha256 "$archive_path")
diff --git a/arcup/test_arcup.sh b/arcup/test_arcup.sh
index 49021191..497efe7a 100755
--- a/arcup/test_arcup.sh
+++ b/arcup/test_arcup.sh
@@ -119,6 +119,8 @@ test_checksum_validation() {
 
     printf '%s  other-asset.tar.gz\n' "$checksum" > "$checksum_file"
     expect_fail "checksum filename mismatch fails" verify_checksum_file "$archive" "$checksum_file" "$archive_name"
+    printf '%s\n' "$checksum" > "$checksum_file"
+    expect_fail "checksum file without filename field fails" verify_checksum_file "$archive" "$checksum_file" "$archive_name"
 }
 
 test_download_error_lists_assets() {
diff --git a/docs/monitoring.md b/docs/monitoring.md
index c0f2c09f..24d0c696 100644
--- a/docs/monitoring.md
+++ b/docs/monitoring.md
@@ -276,8 +276,11 @@ Also confirm that the SSH tunnel is still running.
 
 ### Prometheus is restarting with a permissions error
 
-If Prometheus logs include an error about `queries.active` or write permission
-under `/prometheus`, fix the ownership of the local data directory:
+The `compose.yaml` above runs Prometheus with `user: "0"` (root), which prevents
+this error in most configurations. If you removed `user: "0"` to run Prometheus
+as a non-root user, or if Prometheus logs an error about `queries.active` or write
+permission under `/prometheus`, restore ownership of the data directory to match
+Prometheus's default UID:
 
 ```sh
 sudo chown -R 65534:65534 "$ARC_MONITORING"/prometheus-data