fix(vector): close local pgvector final review

2026-07-12 02:48:10 +02:00
parent 407c4a6faf
commit 6c67235caf
16 changed files with 265 additions and 28 deletions
@@ -11,6 +11,13 @@ trap 'rm -rf "$tmp"' EXIT HUP INT TERM
 printf 'has newline\n' >"$tmp/newline"
 printf 'has space' >"$tmp/space"
 printf 'safe-quoted-\047-dollar-$' >"$tmp/valid"
+printf 'docker-secret' >"$tmp/docker"
+printf 'owner-readonly' >"$tmp/readonly"
+printf 'too-open' >"$tmp/open"
+chmod 0600 "$tmp/valid"
+chmod 0444 "$tmp/docker"
+chmod 0400 "$tmp/readonly"
+chmod 0640 "$tmp/open"

 for invalid in empty newline space; do
  if validate_secret_file "$tmp/$invalid" "$invalid" >/dev/null 2>&1; then
@@ -19,6 +26,15 @@ for invalid in empty newline space; do
  fi
 done
 validate_secret_file "$tmp/valid" valid
+validate_secret_file "$tmp/readonly" readonly
+if validate_secret_file "$tmp/docker" docker >/dev/null 2>&1; then
+  echo "secret policy accepted world-readable host secret" >&2
+  exit 1
+fi
+if validate_secret_file "$tmp/open" open >/dev/null 2>&1; then
+  echo "secret policy accepted group-readable host secret" >&2
+  exit 1
+fi
 test "$(read_secret_file "$tmp/valid" valid)" = "safe-quoted-'-dollar-$"

 echo "shared vector secret policy contracts passed."