[kdacosta0]

Jira: SECURESIGN-6182

Backport of #109 to release-1.5. Extracted from #103, where it was unrelated baggage — that PR is about which CLI binaries get downloaded, this is about environment bootstrap on Windows.

The bug

tas-env-variables.sh derives a value from oc only when the variable is unset, for all six variables it manages. Both Windows scripts ignored what the caller had already set and unconditionally overwrote it.

This is not cosmetic. .github/workflows/e2e.yml exports TUF_URL, REKOR_URL, FULCIO_URL and REKOR_UI_URL from kubectl and then sources the env script. On Linux those survive; on Windows all four were discarded and re-derived from a cluster that may answer differently — or not at all.

For OIDC_ISSUER_URL the overwrite was worse than losing a value: the derived URL guesses the Keycloak realm path, and that guess only holds for RHBK, which serves under /realms. Legacy RH-SSO serves under /auth/realms, so a caller that knew its own issuer URL had it silently replaced with a wrong one.

Parity after this PR

Variable	.sh	.ps1	.bat
OIDC_ISSUER_URL	guarded	fixed	fixed
OIDC_CLIENT_ID	guarded	already guarded	already guarded
TUF_URL	guarded	fixed	fixed
FULCIO_URL	guarded	fixed	fixed
REKOR_URL	guarded	fixed	fixed
REKOR_UI_URL	guarded	fixed	fixed

No Go code touched. Merge #109 first.

🤖 Generated with Claude Code

[qodo-for-securesign]

PR Summary by Qodo

Preserve caller-supplied URLs in Windows environment scripts

🐞 Bug fix 🕐 20-40 Minutes

AI Description

• Preserve caller-supplied service and OIDC URLs instead of overwriting them with cluster-derived
 values.
• Use the admitted Keycloak route host when an OIDC issuer URL must be derived.

Diagram

graph TD
  A["Caller environment"] --> B["Windows scripts"] --> C{"URL supplied?"} -- "Yes" --> F["Resolved URLs"] --> G["Sigstore exports"]
  C -- "No" --> D["OpenShift lookups"] --> F
  D --> E["Admitted route host"] --> F

Loading

High-Level Assessment

Guarding lookups in each existing Windows script matches the shell script without adding a shared bootstrap dependency. Unconditional cluster resolution was the source of the bug, while a cross-shell rewrite would add scope without improving this fix.

Files changed (2) +52 / -11

Bug fix (2) +52 / -11

tas-env-variables.batGuard batch URL lookups and use the admitted Keycloak host +12/-5

Guard batch URL lookups and use the admitted Keycloak host

• Preserves caller-supplied TUF, Fulcio, Rekor, Rekor UI, and OIDC issuer URLs. When the issuer is absent, derives it from the route's admitted host; a flat goto avoids premature cmd.exe variable expansion.

tas-env-variables.bat

tas-env-variables.ps1Preserve PowerShell URL overrides during environment bootstrap +40/-6

Preserve PowerShell URL overrides during environment bootstrap

• Uses existing environment values for five URLs and queries oc only for missing ones. Derives a missing OIDC issuer URL from the admitted Keycloak route host rather than the requested host.

tas-env-variables.ps1

[qodo-for-securesign]

Code Review by Qodo

View medium (1)

1. URL query strings corrupt Windows setup 🐞 Bug

Description

The new TUF_URL and REKOR_URL guards retain caller-supplied values that are later expanded into
unquoted set commands. When either URL contains a valid query-string &, Command Prompt treats
the remainder as another command, truncating the derived environment variable and potentially
executing that remainder.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The batch file now preserves caller URLs, but later percent-expands them in unquoted commands; a URL containing `&` truncates derived variables and runs the remainder as a command.

## Fix Focus Areas
- tas-env-variables.bat[7-16]
- tas-env-variables.bat[21-41]

## Recommended Fix
Make every command that uses a caller-supplied URL safe from Command Prompt metacharacter parsing, including derived `set` assignments and diagnostic output. Use safe expansion and quoting throughout, while retaining the variables in the caller's environment after the batch file returns; test with a URL containing `&`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗