Fix path construction to be compatible with CI
What the developer wrote
Authored by kdmukai
Fix path construction to be compatible with CI
What changed, and why it matters
This commit changes how the app finds its own source-code folder so it works correctly in automated build environments. The old code assumed the project path always contained the literal text '/src' and used string splitting, which could fail or behave unexpectedly on some systems. The new code walks up a fixed number of parent directories. There is no direct security vulnerability here, but the old approach could have produced wrong paths in unusual environments.
No immediate security action required. Treat as a normal reliability/maintenance fix. If reviewing, verify that the fixed number of parent-directory traversals matches the actual installed package layout in all supported deployment contexts.
Security signals we found
Path construction changed from string splitting to os.path.join
Old logic depended on literal '/src' substring in absolute path
Potential for incorrect directory resolution in non-standard environments
Evidence from the diff
The patch replaces string-based path construction (rsplit(‘/src’, 1)) with os.path.join and relative parent-directory traversal in src/seedsigner/helpers/version.py. The affected methods locate the .git directory and the src directory for computing a ‘last modified’ timestamp. The change is framed as CI compatibility, not a security fix. The previous string-splitting logic could produce incorrect paths if the absolute path did not contain ‘/src’ exactly, or if path separators differed (e.g., Windows backslashes), potentially causing the code to operate on an unintended directory. No exploit primitive is introduced or removed by this diff.
Changed components
src/seedsigner/helpers/version.pyInspect captured patch +6 / −2
diff --git a/src/seedsigner/helpers/version.py b/src/seedsigner/helpers/version.py
index a807554..7136358 100644
--- a/src/seedsigner/helpers/version.py
+++ b/src/seedsigner/helpers/version.py
@@ -24,7 +24,9 @@ class Version:
def _get_dot_git_dir(cls) -> str:
# If it exists, the .git dir will be in the project root
path = os.path.dirname(os.path.abspath(__file__))
- project_root = path.rsplit("/src", 1)[0]
+
+ # Have to back out of "helpers" and "seedsigner" and "src" dirs
+ project_root = os.path.join(path, "..", "..", "..")
return os.path.join(project_root, ".git")
@@ -94,7 +96,9 @@ class Version:
"""
try:
path = os.path.dirname(os.path.abspath(__file__))
- src_path = path.rsplit("/src", 1)[0] + "/src"
+
+ # Have to back out of "helpers" and "seedsigner" dirs
+ src_path = os.path.join(path, "..", "..")
last_modified = 0.0
num_files = 0
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.