From 3ed912b5ed70772e6e6ee94514d6c926532ee13d Mon Sep 17 00:00:00 2001 From: librelad Date: Wed, 19 Aug 2026 00:29:48 +0100 Subject: [PATCH] fix(validation): name the keys in the shared-secret failure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The duplicate-value check strips quotes off the value, then looked the keys back up with grep -F "=$value" while the file stores ="$value" — so the lookup never matched and the failure read "these keys share one value: — a secret should never be reused", naming nothing. A failure report that cannot tell you which keys collided is barely better than no check. Found while confirming the check still holds now that configBackfillAllApps (741edfd) resolves RANDOMIZED during an update as well as an install, which gives a shared placeholder a second way to reach a deployed config. Co-Authored-By: Claude Opus 5 --- scripts/validation/validate_config.sh | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/scripts/validation/validate_config.sh b/scripts/validation/validate_config.sh index fb66642..7c36c2f 100644 --- a/scripts/validation/validate_config.sh +++ b/scripts/validation/validate_config.sh @@ -102,12 +102,16 @@ _lpvCheckDeployedSecrets() # Two different keys holding one value is what a shared placeholder looks # like after substitution. Short values are skipped: "true", "admin" and # friends repeat legitimately. + # The value arrives here unquoted (the sed/tr below strip them) while the + # file stores it quoted, so the key lookup has to put the quotes back — + # grepping for = against ="" matches nothing and the message + # names no keys, which is worse than useless in a failure report. local v while IFS= read -r v; do [[ ${#v} -ge 12 ]] || continue local keys - keys=$(grep -F "=$v" "$file" | cut -d= -f1 | tr '\n' ' ') - _lpvFail "$app: these keys share one value: ${keys}— a secret should never be reused." + keys=$(grep -F "=\"$v\"" "$file" | cut -d= -f1 | tr '\n' ' ') + _lpvFail "$app: ${keys}share one value — a generated secret should never be reused." done < <(grep -oE '^CFG_[A-Z0-9_]+="[^"]{12,}"$' "$file" \ | sed 's/^[^=]*=//' | tr -d '"' | sort | uniq -d) }