From 0ab27b0bda08c97acdd5c18b3b074b941dba6dd5 Mon Sep 17 00:00:00 2001
From: Bartosz Blizniak <bblizniak@cloudsmith.io>
Date: Fri, 17 Jul 2026 09:55:03 +0100
Subject: [PATCH 1/2] fix: make lock acquisition signal-safe

---
 install.sh         | 23 +++++++++++++++++------
 tests/install.bats | 40 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+), 6 deletions(-)

diff --git a/install.sh b/install.sh
index 5404e76..d209874 100755
--- a/install.sh
+++ b/install.sh
@@ -86,6 +86,11 @@ cleanup() {
   [ -z "$WORK_DIR" ] || rm -rf "$WORK_DIR"
 }
 
+enable_signal_traps() {
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+}
+
 require_https() {
   # Args: <url> <label>
   case "$1" in https://*) return 0 ;; esac
@@ -221,14 +226,21 @@ prepare_destination() {
   mkdir -p "$FINAL_PARENT"
 
   waited=0
-  until mkdir "$lock_dir" 2>/dev/null; do
+  while :; do
+    # Keep acquisition and ownership recording indivisible to signal cleanup.
+    # Ignoring the signals here also protects the external mkdir process.
+    trap '' INT TERM
+    if mkdir "$lock_dir" 2>/dev/null; then
+      LOCK_DIR="$lock_dir"
+      enable_signal_traps
+      break
+    fi
+    enable_signal_traps
+
     [ "$waited" -lt 120 ] || die "timed out waiting for installation lock: $lock_dir"
     sleep 1
     waited=$((waited + 1))
   done
-  # Track the lock for cleanup only once this process owns it, so a waiter
-  # that dies never releases another installer's lock.
-  LOCK_DIR="$lock_dir"
 }
 
 reuse_existing_install() {
@@ -373,8 +385,7 @@ main() {
 }
 
 trap cleanup EXIT
-trap 'exit 130' INT
-trap 'exit 143' TERM
+enable_signal_traps
 
 parse_args "$@"
 set_default_install_root
diff --git a/tests/install.bats b/tests/install.bats
index f2f935e..dbab631 100644
--- a/tests/install.bats
+++ b/tests/install.bats
@@ -627,6 +627,46 @@ executable=$bin_dir/cloudsmith"
   [ -d "$final_parent/.install.lock" ]
 }
 
+@test "a signal during lock acquisition does not leave a stale lock" {
+  build_fixture "$FIXTURE_DIR" "1.19.0" "$TEST_TARGET"
+  local final_parent="$INSTALL_ROOT/1.19.0/$TEST_TARGET"
+  local shim_dir="$BATS_TEST_TMPDIR/signal-mkdir"
+  local signal_marker="$BATS_TEST_TMPDIR/mkdir-sent-signal"
+  mkdir -p "$shim_dir"
+
+  cat > "$shim_dir/mkdir" <<'EOF'
+#!/usr/bin/env sh
+"$REAL_MKDIR" "$@"
+status=$?
+last_arg=
+for arg do last_arg="$arg"; done
+if [ "$status" -eq 0 ]; then
+  case "$last_arg" in
+    */.install.lock)
+      : > "$MKDIR_SIGNAL_MARKER"
+      kill -TERM "$PPID"
+      ;;
+  esac
+fi
+exit "$status"
+EOF
+  chmod +x "$shim_dir/mkdir"
+
+  run --separate-stderr env \
+    PATH="$shim_dir:$PATH" \
+    REAL_MKDIR="$(command -v mkdir)" \
+    MKDIR_SIGNAL_MARKER="$signal_marker" \
+    "$INSTALL_SH" \
+    --version 1.19.0 \
+    --target "$TEST_TARGET" \
+    --install-root "$INSTALL_ROOT" \
+    --manifest-url "$FIXTURE_URL/manifest.txt"
+
+  [ "$status" -eq 0 ]
+  [ -f "$signal_marker" ]
+  [ ! -e "$final_parent/.install.lock" ]
+}
+
 @test "concurrent installs of the same version both succeed" {
   build_fixture "$FIXTURE_DIR" "1.19.0" "$TEST_TARGET"
 

From c817f1c5b4ee5fc693f7e9c6d58545b6c1384ea4 Mon Sep 17 00:00:00 2001
From: Bartosz Blizniak <bblizniak@cloudsmith.io>
Date: Fri, 17 Jul 2026 10:23:17 +0100
Subject: [PATCH 2/2] fix: preserve lock acquisition cancellation

---
 install.sh         | 13 +++++++++----
 tests/install.bats |  9 +++++----
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/install.sh b/install.sh
index d209874..f0d6a4f 100755
--- a/install.sh
+++ b/install.sh
@@ -227,15 +227,20 @@ prepare_destination() {
 
   waited=0
   while :; do
-    # Keep acquisition and ownership recording indivisible to signal cleanup.
-    # Ignoring the signals here also protects the external mkdir process.
-    trap '' INT TERM
-    if mkdir "$lock_dir" 2>/dev/null; then
+    pending_signal_status=0
+    trap 'pending_signal_status=130' INT
+    trap 'pending_signal_status=143' TERM
+
+    # Defer cancellation until ownership is known. The subshell prevents a
+    # process-group signal from killing mkdir after it creates the lock.
+    if (trap '' INT TERM; CLOUDSMITH_CLI_LOCK_OWNER_PID=$$ mkdir "$lock_dir") 2>/dev/null; then
       LOCK_DIR="$lock_dir"
       enable_signal_traps
+      [ "$pending_signal_status" -eq 0 ] || exit "$pending_signal_status"
       break
     fi
     enable_signal_traps
+    [ "$pending_signal_status" -eq 0 ] || exit "$pending_signal_status"
 
     [ "$waited" -lt 120 ] || die "timed out waiting for installation lock: $lock_dir"
     sleep 1
diff --git a/tests/install.bats b/tests/install.bats
index dbab631..0e22058 100644
--- a/tests/install.bats
+++ b/tests/install.bats
@@ -627,7 +627,7 @@ executable=$bin_dir/cloudsmith"
   [ -d "$final_parent/.install.lock" ]
 }
 
-@test "a signal during lock acquisition does not leave a stale lock" {
+@test "a signal during lock acquisition exits without leaving a stale lock" {
   build_fixture "$FIXTURE_DIR" "1.19.0" "$TEST_TARGET"
   local final_parent="$INSTALL_ROOT/1.19.0/$TEST_TARGET"
   local shim_dir="$BATS_TEST_TMPDIR/signal-mkdir"
@@ -635,7 +635,7 @@ executable=$bin_dir/cloudsmith"
   mkdir -p "$shim_dir"
 
   cat > "$shim_dir/mkdir" <<'EOF'
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 "$REAL_MKDIR" "$@"
 status=$?
 last_arg=
@@ -644,7 +644,7 @@ if [ "$status" -eq 0 ]; then
   case "$last_arg" in
     */.install.lock)
       : > "$MKDIR_SIGNAL_MARKER"
-      kill -TERM "$PPID"
+      kill -TERM "$CLOUDSMITH_CLI_LOCK_OWNER_PID"
       ;;
   esac
 fi
@@ -662,9 +662,10 @@ EOF
     --install-root "$INSTALL_ROOT" \
     --manifest-url "$FIXTURE_URL/manifest.txt"
 
-  [ "$status" -eq 0 ]
+  [ "$status" -eq 143 ]
   [ -f "$signal_marker" ]
   [ ! -e "$final_parent/.install.lock" ]
+  [ ! -e "$final_parent/cloudsmith/cloudsmith" ]
 }
 
 @test "concurrent installs of the same version both succeed" {