5f58756837
werkrevisor 0.57.0: review-report uses prlens.ASSET_PREFIX; Scenario#129.03 runs a GREEN dry run
83f489aad4
hs-review draws the diagrams also for GREEN; a run without new diagrams shows none of an earlier run
No change; the finding does not hold for docker run --env-file. docker/cli's parser (pkg/kvfile/kvfile.go, parseKeyValueFile) interprets neither quotes nor escapes: it trims leading whitespace…
e9c77a3328
Review: a line of 64 KiB stays on the command line; two builds may create the env-file directory together
Fixed in e9c77a3: fits also requires the UTF-8 line KEY=VALUE to stay below 64 KiB; a longer one stays --env KEY=VALUE on the command line, as before. DockerEnvFileUnitTest covers a 70 KiB…
Fixed in e9c77a3: SecretFiles.createDirectoriesOwnerOnly takes a directory that another thread created in the meantime and fails only if the path is no directory. DockerEnvFileUnitTest starts…
Fixed in a9f44a8: the export is a plain assignment now, so set -e stops fetch with the exit code of the host. test_fetch_stops_if_the_host_holds_no_single_value exited with 0 without the…
Fixed in 425a99d, by a different route rather than a longer list: a Docker build's values no longer enter the docker client's environment at all. DockerEnvFile writes them to a 0600 file in…
425a99d8e6
Review: a Docker build's values go through a 0600 --env-file, not the docker client's environment
dd927f45b7
Review round 4: unreadable backups stop purge; fetch brings a missing old value into secrets.env; local errors exit with 2
Answer to the review of 241535b, fixed in dd927f4:
- The three ORANGE findings: fixed, see the threads.
- YELLOW security concern of the model (unreadable backups in
purge): the same as the…
Fixed in dd927f4: holding() returns the backups it cannot read or parse apart; check names them and exits with 2, purge refuses before it removes anything. Test `test_a_backup_it_cannot_par…
Fixed in dd927f4: from_secrets_file prints the reason and exits with 2 for a file it cannot read or parse and for a missing key; probe and digest exit with 2 then. Test `test_a_secrets_file…
Fixed in dd927f4: the new tools/rotate-secret fetch mih09 <KEY> copies the value that all machine configs hold into a secrets.env without the key, through pipes only (the host part export…