Repository navigation
fix(secrets): keep passwords out of process arguments, previews and errors - #55
Merged
Merged
Conversation
…rrors Every database password went into the command text (PGPASSWORD=... psql), so it sat in the running step's arguments, which ps shows every local user, including another instance's Odoo user; the plan preview and a failed step's error printed it again, as they printed odoo.conf's passwords. A step now carries its secrets in Command.env and what the preview shows in Command.display, masked. libpq clients take PGPASSWORD (and a 10 s connect timeout) from the environment, SQL with a password goes to psql on stdin, files are written atomically with their content in the environment, and a failure names the step. Also: dependencies are checked by distribution name first, as Odoo does; the health check reaches a socket database; a failed export no longer crashes; the report's database list no longer matches by prefix. tools/verify_secrets.py runs the steps and looks at ps.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every database password went into the command text (
PGPASSWORD=… psql,psql -c "CREATE ROLE … PASSWORD '…'"). A step runs asbash -lc "<command>", so the password sat in that process's arguments — visible to every local user viaps, another instance's Odoo user included — for the whole step (a longpg_dump/pg_restore). The plan preview printed it, withodoo.conf'sadmin_passwd/db_passwordin its heredoc, and a failed step's error printed the command again.Changes
Commandgainsenv(secrets, in the step's environment — readable only by root) anddisplay(what the preview shows, secrets masked).pg_env()gives libpq itsPGPASSWORDplusPGCONNECT_TIMEOUT=10(a blackholed remote DB used to hang probes for minutes). SQL holding a password goes to psql on stdin (<<<"$OIM_SQL").write_text_file_command: atomic (private temp file, chmod, rename) with the content in the environment; preview shows the file masked.PGPASSWORD=/password-SQL sites converted (system, planners, addons, common, health, purge, manage, backup_restore).python-stdnumwas "MISSING"); health check reaches a Unix-socket DB (db_host = False); exportOSErrorno longer crashes; server report's DB list no longer matches by prefix.OpenSpec change:
secrets-out-of-sight(execution-safety, addon-inventory).Verification
pytest194 passed;ruff,openspecclean; ShellCheck clean on the generated install/DB/update commands.tools/verify_secrets.py(new) — 12/12: a password inCommand.envnever appears inpswhile the step runs, while the oldPGPASSWORD=form does (negative control); files written exactly, mode 640, no temp left, preview masked; a failure's error has no secret; the role SQL on stdin creates the role with its password in a throwaway PostgreSQL.tools/verify_data_safety.py,tools/verify_ops_configs.pyandtools/verify_neutralisation.py(real Odoo 18) still pass.Assisted-by: Claude