96 lines
3.4 KiB
Bash
Executable File
96 lines
3.4 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
validate_secret_file() {
|
|
secret_path=$1
|
|
secret_name=$2
|
|
if [ -L "$secret_path" ] || [ ! -f "$secret_path" ] || [ ! -r "$secret_path" ] || [ ! -s "$secret_path" ]; then
|
|
echo "$secret_name must be a readable, non-empty regular file" >&2
|
|
return 2
|
|
fi
|
|
if LC_ALL=C grep -q '[[:space:]]' "$secret_path"; then
|
|
echo "$secret_name must contain no whitespace" >&2
|
|
return 2
|
|
fi
|
|
mode=$(stat -c '%a' "$secret_path" 2>/dev/null || stat -f '%Lp' "$secret_path" 2>/dev/null) || return 2
|
|
case "$secret_path:$mode" in
|
|
/run/secrets/*:444|/run/secrets/*:400|/run/secrets/*:600|*:600|*:400) ;;
|
|
*) echo "$secret_name must have mode 0600 or stricter (Docker secrets may be 0444)" >&2; return 2 ;;
|
|
esac
|
|
}
|
|
|
|
read_secret_file() {
|
|
validate_secret_file "$1" "$2" || return
|
|
cat "$1"
|
|
}
|
|
|
|
# Validate the bundle without printing any value. Keep this parser aligned with
|
|
# the backend loader: comments/blank lines are allowed, while syntax, allowlist,
|
|
# duplicates, empty values, file size, and line size are fail-closed.
|
|
validate_bundle() {
|
|
bundle_path=$1
|
|
if [ -L "$bundle_path" ] || [ ! -f "$bundle_path" ] || [ ! -r "$bundle_path" ] || [ ! -s "$bundle_path" ]; then
|
|
echo "secret bundle must be a readable, non-empty regular file" >&2
|
|
return 2
|
|
fi
|
|
mode=$(stat -c '%a' "$bundle_path" 2>/dev/null || stat -f '%Lp' "$bundle_path" 2>/dev/null) || return 2
|
|
case "$bundle_path:$mode" in
|
|
/run/secrets/*:444|/run/secrets/*:400|/run/secrets/*:600|*:600|*:400) ;;
|
|
*) echo "secret bundle must have mode 0600 or stricter (Docker secrets may be 0444)" >&2; return 2 ;;
|
|
esac
|
|
size=$(stat -c '%s' "$bundle_path" 2>/dev/null || stat -f '%z' "$bundle_path" 2>/dev/null) || return 2
|
|
if [ "$size" -gt 65536 ]; then
|
|
echo "secret bundle exceeds the 64KiB limit" >&2
|
|
return 2
|
|
fi
|
|
awk '
|
|
{ sub(/\r$/, "", $0) }
|
|
length($0) > 16384 { exit 9 }
|
|
/^[[:space:]]*$/ || /^[[:space:]]*#/ { next }
|
|
/^[A-Z][A-Z0-9_]*=/ {
|
|
key=$0; sub(/=.*/, "", key)
|
|
val=$0; sub(/^[^=]*=/, "", val)
|
|
if (key !~ /^(THT_MODEL_API_KEY|THT_DWH_API_KEY|THT_VEC_API_KEY|THT_VEC_WRITE_API_KEY|THT_CA|THT_SSL_CA|THT_VECTOR_BOOTSTRAP_PASSWORD|THT_VECTOR_MIGRATOR_PASSWORD|THT_VECTOR_READER_PASSWORD|THT_VECTOR_WRITER_PASSWORD|PI_PROVIDER_API_KEY)$/) exit 6
|
|
if (val == "" || ++seen[key] > 1) exit 7
|
|
next
|
|
}
|
|
{ exit 4 }
|
|
' "$bundle_path" || {
|
|
echo "secret bundle syntax is invalid" >&2
|
|
return 2
|
|
}
|
|
}
|
|
|
|
# Read one value from the deployment bundle without putting the bundle itself in
|
|
# a service environment. Values selected for credentials must contain no spaces.
|
|
read_bundle_secret() {
|
|
bundle_path=$1
|
|
bundle_key=$2
|
|
validate_bundle "$bundle_path" || return
|
|
case "$bundle_key" in
|
|
THT_[A-Z0-9_]*|PI_PROVIDER_API_KEY) ;;
|
|
*) echo "invalid secret bundle key" >&2; return 2 ;;
|
|
esac
|
|
value=$(awk -v wanted="$bundle_key" '
|
|
{ sub(/\r$/, "", $0) }
|
|
/^[[:space:]]*$/ || /^[[:space:]]*#/ { next }
|
|
/^[A-Z][A-Z0-9_]*=/ {
|
|
key=$0; sub(/=.*/, "", key)
|
|
val=$0; sub(/^[^=]*=/, "", val)
|
|
if (key == wanted) {
|
|
found=1; print val
|
|
}
|
|
next
|
|
}
|
|
{ exit 4 }
|
|
END { if (!found) exit 5 }
|
|
' "$bundle_path") || {
|
|
echo "$bundle_key is unavailable in secret bundle" >&2
|
|
return 3
|
|
}
|
|
if [ -z "$value" ] || printf '%s' "$value" | LC_ALL=C grep -q '[[:space:]]'; then
|
|
echo "$bundle_key must contain no whitespace" >&2
|
|
return 2
|
|
fi
|
|
printf '%s' "$value"
|
|
}
|