Summary
External-account executable configuration names and validates timeout_millis in milliseconds, but PluggableCredentials#subprocess_with_timeout passes the value directly to Timeout.timeout, whose argument is seconds. A configured 30000 therefore waits 30,000 seconds rather than 30 seconds.
Proposed correction
Convert milliseconds with timeout_millis / 1000.0 at the Timeout boundary. Candidate: 6635ab3114ddc9307cb9719b40e4ac83cb389fef on 1.17.4/current main (01431c9ecd59e1efc5d262694971ded925044fdc).
The focused clock/timeout model observes 30.0 seconds instead of 30000. The cumulative suite passes 659 RSpec examples (20 expected pending), 103 Minitest runs /201 assertions and four integration runs /41 assertions, plus RuboCop, syntax, YARD and package/install checks.
I used an AI coding assistant during source review and verification. I am opening an issue first because repository policy requires tests, a changelog and a Google CLA for pull requests; this audit cannot alter repository tests and no CLA was signed as part of it.
Summary
External-account executable configuration names and validates
timeout_millisin milliseconds, butPluggableCredentials#subprocess_with_timeoutpasses the value directly toTimeout.timeout, whose argument is seconds. A configured30000therefore waits 30,000 seconds rather than 30 seconds.Proposed correction
Convert milliseconds with
timeout_millis / 1000.0at the Timeout boundary. Candidate:6635ab3114ddc9307cb9719b40e4ac83cb389fefon 1.17.4/currentmain(01431c9ecd59e1efc5d262694971ded925044fdc).The focused clock/timeout model observes 30.0 seconds instead of 30000. The cumulative suite passes 659 RSpec examples (20 expected pending), 103 Minitest runs /201 assertions and four integration runs /41 assertions, plus RuboCop, syntax, YARD and package/install checks.
I used an AI coding assistant during source review and verification. I am opening an issue first because repository policy requires tests, a changelog and a Google CLA for pull requests; this audit cannot alter repository tests and no CLA was signed as part of it.