From a1771b6bb959be8700413d164b71b0e33237733a Mon Sep 17 00:00:00 2001
From: User <user@example.com>
Date: Thu, 20 Aug 2026 16:48:00 +0200
Subject: [PATCH] test: preserve explicit TMPDIR paths

---
 scripts/test-verify-workspace-install-docs.sh |  3 +++
 scripts/verify-workspace-install-docs.sh      | 19 ++++++++++++-------
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/scripts/test-verify-workspace-install-docs.sh b/scripts/test-verify-workspace-install-docs.sh
index 48216af6..8ca51731 100755
--- a/scripts/test-verify-workspace-install-docs.sh
+++ b/scripts/test-verify-workspace-install-docs.sh
@@ -11,6 +11,9 @@ trap 'rm -f "$output" "$verifier_functions"; rm -rf "$negative_root"' EXIT HUP I
 env -u TMPDIR -u THT_AUTH_CONFIG_ROOT \
   "$root/scripts/verify-workspace-install-docs.sh" --fixtures-only >"$output"
 
+env -u THT_AUTH_CONFIG_ROOT TMPDIR=/tmp/ \
+  "$root/scripts/verify-workspace-install-docs.sh" --fixtures-only >"$output"
+
 for fixture in \
   "internal semantic infrastructure documentation contract" \
   "read-only workspace repository and encrypted runtime-secret contract" \
diff --git a/scripts/verify-workspace-install-docs.sh b/scripts/verify-workspace-install-docs.sh
index f3e802c6..7a876303 100755
--- a/scripts/verify-workspace-install-docs.sh
+++ b/scripts/verify-workspace-install-docs.sh
@@ -5,6 +5,11 @@ set -euo pipefail
 root="$(cd "$(dirname "$0")/.." && pwd -P)"
 mode="${1:-}"
 
+tmp_prefix="${TMPDIR:-/tmp}"
+while [[ "$tmp_prefix" != "/" && "$tmp_prefix" == */ ]]; do
+  tmp_prefix="${tmp_prefix%/}"
+done
+
 trim() {
   local value="$1"
   value="${value#"${value%%[![:space:]]*}"}"
@@ -633,7 +638,7 @@ PY
 
 verify_vector_helper_interfaces() {
   local output status
-  output="$(mktemp "${TMPDIR:-/tmp}/thoth-vector-backup-help.XXXXXX")"
+  output="$(mktemp "$tmp_prefix/thoth-vector-backup-help.XXXXXX")"
   set +e
   "$root/scripts/vector-backup.sh" >"$output" 2>&1
   status=$?
@@ -914,7 +919,7 @@ for (const block of [setupPowerShell, healthPowerShell, updatePowerShell, backup
 }
 NODE
   local update_fixture update_script fake_bin calls output status
-  update_fixture="$(mktemp -d "${TMPDIR:-/tmp}/thoth-source-update.XXXXXX")"
+  update_fixture="$(mktemp -d "$tmp_prefix/thoth-source-update.XXXXXX")"
   trap 'rm -rf "$update_fixture"' RETURN
   update_script="$update_fixture/update.sh"
   awk '
@@ -1063,7 +1068,7 @@ if (!warningPattern.test(shell.slice(Math.max(0, rewriteAt - 180), rewriteAt)) |
 }
 NODE
   local repair_root repair_script real_git partial_repo clean_repo partial_output repair_status
-  repair_root="$(mktemp -d "${TMPDIR:-/tmp}/thoth-crlf-repair.XXXXXX")"
+  repair_root="$(mktemp -d "$tmp_prefix/thoth-crlf-repair.XXXXXX")"
   trap 'rm -rf "$repair_root"' RETURN
   repair_script="$repair_root/repair.sh"
   awk '
@@ -1694,7 +1699,7 @@ NODE
 
 verify_caddy_effective_proxy_guide() {
   local adapted
-  adapted="$(mktemp "${TMPDIR:-/tmp}/thoth-caddy-adapted.XXXXXX")"
+  adapted="$(mktemp "$tmp_prefix/thoth-caddy-adapted.XXXXXX")"
   if ! awk '
       /^```caddyfile$/ { code=1; next }
       code && /^```$/ { exit }
@@ -1870,7 +1875,7 @@ verify_local_installation_example() {
   }
 
   local fixture source_copy operator_dir copied_example env_file auth_config_root
-  fixture="$(mktemp -d "${TMPDIR:-/tmp}/thoth local install.XXXXXX")"
+  fixture="$(mktemp -d "$tmp_prefix/thoth local install.XXXXXX")"
   trap 'rm -rf "$fixture"' RETURN
   [[ "$fixture" == *" "* ]] || {
     echo "local installation fixture path does not contain spaces" >&2
@@ -1962,7 +1967,7 @@ verify_server_installation_example() {
   }
 
   local fixture source_copy operator_dir copied_example env_file backup_root auth_config_root
-  fixture="$(mktemp -d "${TMPDIR:-/tmp}/thoth server install.XXXXXX")"
+  fixture="$(mktemp -d "$tmp_prefix/thoth server install.XXXXXX")"
   trap 'rm -rf "$fixture"' RETURN
   [[ "$fixture" == *" "* ]] || {
     echo "server installation fixture path does not contain spaces" >&2
@@ -2149,7 +2154,7 @@ write_private() {
 
 verify_compose_fixtures() {
   local fixture profile rendered auth_config_root
-  fixture="$(mktemp -d "${TMPDIR:-/tmp}/thoth-install-fixtures.XXXXXX")"
+  fixture="$(mktemp -d "$tmp_prefix/thoth-install-fixtures.XXXXXX")"
   trap 'rm -rf "$fixture"' RETURN
   auth_config_root="$fixture/auth-config"
   mkdir -p "$fixture/data/workspace-secrets" "$fixture/pi-state" \