The portable-trampoline shebang idiom reads as identity masquerading (false Tier 5) #3133

Found by the first run of the detection-accuracy harness (PR #3130, closes #3117) against the pinned language-crucible corpus (3,072 files / 51 languages, 0.9964 overall).

Measured

Three crucible files are refused as undeterminable at Tier 5, intensity 0.0, each with an Identity Masking anomaly flag — all reproduced directly:

All three use the portable-trampoline idiom

The shebang is deliberately a POSIX shell that re-execs the real interpreter. Verbatim from the corpus:

tcl/sqlite/speedtest.tcl — the canonical Tcl portability trick, straight from sqlite's own test harness:

#!/bin/sh
# the next line restarts using tclsh \
exec tclsh "$0" ${1+"$@"}

tcl/sqlite/testrunner.tcl:

#!/bin/sh
# Script to runs tests for SQLite.  Run with option "help" for more info. \
exec tclsh "$0" "$@"

zig/tigerbeetle/download.ps1 — an sh/PowerShell polyglot:

#!/bin/sh
echo `# <#`
./zig/download.sh
exit

This is NOT #3116, and #3127 does not fix it

Stating this explicitly so nobody closes it as a duplicate. In #3116 the shebang matcher was wrong — unanchored substring matching made tclsh match sh. Here the matcher is right: the shebang genuinely is #!/bin/sh, so basename-exact matching resolves it to shell just as correctly as before, and the conflict still fires.

The defect is not in shebang resolution at all. It is the Identity Conflict Trap treating a legitimate bootstrap as a masquerade.

Severity

Same shape as #3116's: the file is excluded from analysis entirely (intensity 0.0, no rules run) and reported as a security anomaly. So a customer sees the scanner accusing a stock sqlite test script of identity masquerading — a false malware-shaped finding on canonical upstream code.

Fix directions to weigh (un-adjudicated)

1. When the extension's language and the shebang disagree, scan the first few lines for an exec <interpreter> naming the extension's language; treat that as a trampoline and trust the extension.
2. Require the conflicting shebang to be a non-shell interpreter before raising a conflict at all — a generic sh shebang is the standard bootstrap vehicle and carries little identity weight.
3. Keep the extension's verdict but attach an informational note rather than refusing.

The constraint that matters: whatever is chosen must not weaken detection of a genuinely mislabelled executable, which is what the trap exists for. Option 2 is the broadest and therefore needs the most care — it would also stop flagging a real .tcl file that is actually a shell script.

Related

#3116 / #3127 (the shebang-matching bug and its fix — distinct from this), #3117 (the harness that found this).