docs: close stale cmail umask task (fixed in a3a87da)

1 files changed, 3 insertions, 1 deletions

diff --git a/todo.org b/todo.org
index b1e93ad..5be73aa 100644
--- a/todo.org
+++ b/todo.org
@@ -1486,7 +1486,9 @@ CLOSED: [2026-07-20 Mon]
 Fixed in 6de55d2: run_step records the state marker whenever the step function returns (a return past error_fatal's exit means only a non-fatal warning is left), added local to run_step/show_status, and captured pacman's real exit in the refresh loop. TDD via tests/installer-steps/test_run_step.py.
 Grading: Major severity (resume re-runs steps and can abort on a survivable warning) x some (a step whose last action is a non-fatal failure) = P3 = [#C].
 archsetup:298 marks a step complete only when its function returns 0, but error_warn/run_task return 1, so a non-fatal-failing step never writes its marker and re-runs on resume. Also archsetup:1034 reports =$?= of the =false= test, not pacman's real exit code; and run_step locals (290/318) leak to global scope. Fix: step functions =return 0= explicitly (or gate run_step on a per-step error flag); capture the real exit code; add =local=. See findings doc (S1).
-** TODO [#C] cmail password decrypted world-readable before chmod :bug:security:solo:quick:cmail:
+** DONE [#C] cmail password decrypted world-readable before chmod :bug:security:solo:quick:cmail:
+CLOSED: [2026-07-20 Mon]
+Already fixed in dffecf5 (before this session): decrypt_to_secure wraps the gpg decrypt in a 0077-umask subshell so the file is 0600 from creation, with tests/cmail/ verifying the umask at write time. The task was stale; verified green and closed.
 Grading: security carve-out — brief local plaintext exposure of the mail password, requires a concurrent local shell during install; narrow window = low severity = P3 = [#C].
 scripts/cmail-setup-finish.sh:52 gpg-decrypts to ~/.config/.cmailpass at the process umask (often 0644), then chmod 600 on the next line. Fix: =(umask 077; gpg ... --output ...)= or decrypt to a mktemp 0600 file and mv into place (mirror the import-wireguard mktemp -d 0700 pattern). See findings doc (S4).
 ** DONE [#C] Installer sudoers.pacnew blind copy risks lockout :bug:solo:quick: