artifacts-helper 3.0.8 fails for non-root remoteUser: mktemp file is unreadable #112

Summary

artifacts-helper 3.0.8 can fail during devcontainer image build when the container uses a non-root remoteUser.

The installer creates a temp file as root, then runs cat as _REMOTE_USER to append that file into shell rc files. Since mktemp creates files with restrictive permissions, the non-root user cannot read it.

Regression

This appears to have been introduced by PR #111:

• PR: Fix malformed shell function aliases in artifacts-helper #111
• Commit: 32dbd23

That change replaced direct printf appending with a root-created temp file:

_TEMP_BLOCK=$(mktemp)
printf '%s' "$ALIASES_BLOCK" > "$_TEMP_BLOCK"

for TARGET_FILE in "${TARGET_FILES_ARR[@]}"; do
    if [ "${INSTALL_WITH_SUDO}" = "true" ]; then
        sudo -u "${_REMOTE_USER}" bash -c "cat '$_TEMP_BLOCK' >> $TARGET_FILE"
    else
        cat "$_TEMP_BLOCK" >> "$TARGET_FILE" || true
    fi
done

Because _TEMP_BLOCK is created by root and is not readable by _REMOTE_USER, the install fails when INSTALL_WITH_SUDO=true.

Observed failure

With ghcr.io/microsoft/codespace-features/artifacts-helper:3 resolving to version 3.0.8, the devcontainer build fails during feature installation:

Feature       : Azure Artifacts Credential Helper
Version       : 3.0.8
cat: /tmp/tmp.7H2NoIzomG: Permission denied
ERROR: Feature "Azure Artifacts Credential Helper" (ghcr.io/microsoft/codespace-features/artifacts-helper) failed to install!
ERROR: failed to solve: process "... ./devcontainer-features-install.sh ..." did not complete successfully: exit code: 1

This happens before lifecycle scripts run.

Expected behavior

artifacts-helper should install successfully when the devcontainer has a non-root remoteUser, which is a common devcontainer setup.

Suggested fix

Avoid requiring _REMOTE_USER to read a root-owned temp file.

One minimal option is to pipe the root-readable temp file into the sudo -u command via stdin:

for TARGET_FILE in "${TARGET_FILES_ARR[@]}"; do
    if [ "${INSTALL_WITH_SUDO}" = "true" ]; then
        sudo -u "${_REMOTE_USER}" bash -c "cat >> $TARGET_FILE" < "$_TEMP_BLOCK"
    else
        cat "$_TEMP_BLOCK" >> "$TARGET_FILE" || true
    fi
done

Another option is to make the temp file readable by _REMOTE_USER before invoking sudo -u, for example:

chown "${_REMOTE_USER}" "$_TEMP_BLOCK"

The stdin approach avoids changing temp file ownership/permissions and keeps the temp file readable only by root.