fix(installer): stop resurrecting files FOG has dropped from management/other

[mastacontrola]

Follow-up to #1344. _variables.scss was still on the live tree after an installfog.sh run, and this is why.

What was happening

configureHttpd() does rm -rf $webdirdest and rebuilds from source, so an upgrade genuinely gets the new release — then it restores loose files from the pre-wipe backup of management/other/, which is where an administrator's own files live (ca.cert.pem, a logo, whatever they put there).

Deciding "ours or theirs" was done from a hardcoded list:

find .../management/other/ -maxdepth 1 -type f \
  -not -name gpl-3.0.txt -a -not -name index.php -a -not -name 'ca.*'

That list is a second, hand-kept description of what the release ships, and it drifted the first time FOG dropped a file it had been shipping there. _variables.scss — the Font Awesome 4 icon list #1344 deleted — was not on it, so every install classified it as the administrator's and copied it back out of the backup. It could never leave an upgraded server, on any install, ever.

Three kinds of FOG-owned file, three different answers

The first attempt at this got it wrong, and the test is what said so.

1. What this release ships. Asked of the source tree now, so it cannot drift from what is actually shipped.
2. What FOG shipped there in the past and dropped. The source tree cannot see these — a file the release no longer ships is indistinguishable from one the administrator put there. So retirement is recorded in retired_web_other, which is append-only: add a name there in the same commit that removes the file from packages/web.
3. ca.* — not shipped in the tree at all, but minted into that directory by _installCATrustAnchor(). Restoring the previous one over a freshly generated CA hands the server a stale trust anchor: the certificate fog-client pins and iPXE is built against. Kept named, because there is nothing to derive it from.

The source-tree test alone does not fix the reported symptom. With only that change, _variables.scss is still absent from the source tree and still restored. Only (2) closes it — that is why the retired list exists rather than being one more thing to remember.

Pinned

tests/webroot-preserved-files.test.sh executes the loop against a fixture rather than reading it — a textual check passes on a loop that names the right variables and gets the logic backwards, and the logic is the whole change. It also pins that the decision is not made from a hand-kept list of shipped files again, and that the ca.* exclusion survives being tidied away as redundant.

Mutation-verified, four mutants, all killed:

Mutant	Result
drop the retired list	the dropped file is resurrected
drop the source-tree test	a shipped file is overwritten from the backup
drop the ca.* exclusion	the stale CA is restored over the new one
invert the source-tree test	shipped files overwritten and the administrator's own file lost

Suite: 146 passed, 0 failed. No root, no network, no FOG install needed to run it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XqpPXAk7bEm8huH9WkiGk6