Await safety uncertain in agoric-cli/src/cosmos.js

[erights]

agoric-sdk/packages/agoric-cli/src/cosmos.js

Line 88 in a1dedea

const exitStatus = await pspawn('docker', ['pull', IMAGE]);

The triage at #6219 currently classifies this as

// This await is safe because "terminal-control-flow"

and suppresses the warning. However, at https://github.com/Agoric/agoric-sdk/pull/6219/files#r972609594 @dtribble says

I disagree here. Since the line below the if is a recursive call, if opts.dockerTag && ! popts.pull then this will infinite loop within a turn.

Git blame shows @michaelfig as the ones who should probably investigate this, so I'm assigning to them. Feel free to reassign as appropriate of course. Since @dtribble noticed the unsafety I missed, adding him too.

Because @dtribble also writes

That's not something an attacker can supply, so this is low risk.

I omit the security label.