fix(deploy): align vector bootstrap identity policy

deploy/vector/reconcile-roles.sh

@@ -1,19 +1,12 @@
 #!/bin/sh
 set -eu
 
-read_secret() {
-  value=$(cat "/run/secrets/$1")
-  if [ -z "$value" ] || printf '%s' "$value" | grep -q '[[:space:]]'; then
-    echo "$1 must be non-empty and contain no whitespace" >&2
-    exit 2
-  fi
-  printf '%s' "$value"
-}
+. /opt/thoth/secret-policy.sh
 
-export PGPASSWORD=$(read_secret vector_bootstrap_password)
-migrator_password=$(read_secret vector_migrator_password)
-reader_password=$(read_secret vector_reader_password)
-writer_password=$(read_secret vector_writer_password)
+export PGPASSWORD=$(read_secret_file /run/secrets/vector_bootstrap_password vector_bootstrap_password)
+migrator_password=$(read_secret_file /run/secrets/vector_migrator_password vector_migrator_password)
+reader_password=$(read_secret_file /run/secrets/vector_reader_password vector_reader_password)
+writer_password=$(read_secret_file /run/secrets/vector_writer_password vector_writer_password)
 
 psql --set=ON_ERROR_STOP=1 \
   --set=migrator_user="$THT_VECTOR_MIGRATOR_USER" \

deploy/vector/rotate-bootstrap-password.py

@@ -12,9 +12,9 @@ from psycopg2 import sql
 
 
 def read_secret(path: str) -> str:
-    value = Path(path).read_text().rstrip("\r\n")
-    if not value or "\x00" in value:
-        raise ValueError("secret must be non-empty and contain no NUL bytes")
+    value = Path(path).read_text()
+    if not value or "\x00" in value or any(character.isspace() for character in value):
+        raise ValueError("secret must be non-empty and contain no whitespace or NUL bytes")
     return value
 
 

deploy/vector/secret-policy.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+validate_secret_file() {
+  secret_path=$1
+  secret_name=$2
+  if [ ! -f "$secret_path" ] || [ ! -r "$secret_path" ] || [ ! -s "$secret_path" ]; then
+    echo "$secret_name must be a readable, non-empty regular file" >&2
+    return 2
+  fi
+  if LC_ALL=C grep -q '[[:space:]]' "$secret_path"; then
+    echo "$secret_name must contain no whitespace" >&2
+    return 2
+  fi
+}
+
+read_secret_file() {
+  validate_secret_file "$1" "$2" || return
+  cat "$1"
+}