GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues 7 Pull requests 5 Projects Releases Packages Wiki Activity Actions

deploy plan: NetworkTagSecret step: openssl failure appends nothing; empty or indented key line handled #20

Merged
heimdall merged 1 commit from libby/networktagsecret-hardening into heimdall/deploy-main-plan 2026-11-09 19:29:14 +00:00 AGit
Conversation 0 Commits 1 Files changed 1 +20 -5
libby commented 2026-11-09 15:52:48 +00:00
Member
Copy link

Docs only, one commit on heimdall/deploy-main-plan (c049793e, which already holds #19). #15 is not yet merged into main, so this targets the plan branch.

Env step 3 (docs/deploy-main-to-live.md), ConceptVotes__NetworkTagSecret:

  • (a) The value is generated into a variable and checked before anything is written: a failed openssl, or fewer than 32 characters, appends nothing and exits 1.
  • (b) The guard matches the key with leading spaces. A key line with an empty or whitespace-only value counts as NOT set: the command reports it and exits 1 without appending a duplicate (the operator fixes it by hand). A commented-out line is not a key.
  • Unchanged: mode 600, owner bifrost, nothing printed (messages carry no value), length checked by count only.

Tested the exact script text from the doc in temp directories (stub openssl where noted): absent key -> appended, 64 chars, mode 600, one backup; re-run (existing value) -> left unchanged, no backup; empty value -> reported, nothing appended; whitespace-only value -> same; leading-space key -> left unchanged; openssl failing -> nothing appended; openssl returning a short value -> nothing appended; commented line -> treated as absent, appended. Not tested on the host (sudo, chown bifrost). A KEY="" (quoted empty) line counts as set; the target then fails its startup check, so it is caught at start.

🤖 Generated with Claude Code

Docs only, one commit on `heimdall/deploy-main-plan` (c049793e, which already holds #19). #15 is not yet merged into main, so this targets the plan branch. Env step 3 (`docs/deploy-main-to-live.md`), `ConceptVotes__NetworkTagSecret`: - (a) The value is generated into a variable and checked before anything is written: a failed `openssl`, or fewer than 32 characters, appends nothing and exits 1. - (b) The guard matches the key with leading spaces. A key line with an empty or whitespace-only value counts as NOT set: the command reports it and exits 1 without appending a duplicate (the operator fixes it by hand). A commented-out line is not a key. - Unchanged: mode 600, owner `bifrost`, nothing printed (messages carry no value), length checked by count only. Tested the exact script text from the doc in temp directories (stub `openssl` where noted): absent key -> appended, 64 chars, mode 600, one backup; re-run (existing value) -> left unchanged, no backup; empty value -> reported, nothing appended; whitespace-only value -> same; leading-space key -> left unchanged; `openssl` failing -> nothing appended; `openssl` returning a short value -> nothing appended; commented line -> treated as absent, appended. Not tested on the host (`sudo`, `chown bifrost`). A `KEY=""` (quoted empty) line counts as set; the target then fails its startup check, so it is caught at start. 🤖 Generated with [Claude Code](https://claude.com/claude-code) 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
heimdall merged commit 4254566147 into heimdall/deploy-main-plan 2026-11-09 19:29:14 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
GameCult/Bifrost!20
No description provided.