From 2192b5a2df3078fba88b0d044903dfcc945d89f6 Mon Sep 17 00:00:00 2001 From: Brian Majewski Date: Sun, 7 Jun 2026 16:18:16 -0700 Subject: [PATCH] fix: tighten _store_format parse + correct finalize crash-orphan comment (EGB-703 review) Self-review of the data-safety paths (verdict SHIP-SAFE) flagged two non-blocking nits, both fixed: - _store_format used `tr -dc '0-9'` which read garbage like "v2"/"x2x" as v2. Tightened to a strict exact match (modulo line endings) so only "2" reads as v2; anything else falls back to v1, the safe default. - The stamp-before-delete comment claimed a re-run "cleans" crash-orphaned v1 blobs; it doesn't (finalize early-returns once the store is v2). Corrected to note the orphans are harmless and `verify` flags them for manual removal. --- secrets | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/secrets b/secrets index 600a25e..2328fdc 100755 --- a/secrets +++ b/secrets @@ -529,7 +529,11 @@ STORE_FORMAT_FILE_NAME=".secrets-format" _store_format() { local f="$SECRETS_DIR/$STORE_FORMAT_FILE_NAME" v if [ -f "$f" ]; then - v=$(head -1 "$f" 2>/dev/null | tr -dc '0-9') + # Strict exact match (modulo line endings): only a marker of exactly "2" + # reads as v2. Anything else (empty, "20", "v2", garbage) ⇒ v1 — the safe + # default, since misreading v2-as-v1 only triggers a harmless re-migrate + # while v1-as-v2 would mislocate blobs. + v=$(head -1 "$f" 2>/dev/null | tr -d '\r\n') [ "$v" = "2" ] && { echo 2; return; } fi echo 1 @@ -2233,7 +2237,9 @@ $untwinned cd into each project and run 'secrets migrate', then re-run 'secrets # Stamp the marker FIRST, then drop v1 blobs. If finalize crashes between # the two, the store reads as v2 and the (verified) v2 twins serve every - # upgraded client; leftover v1 blobs are harmless orphans a re-run cleans. + # upgraded client; any leftover v1 blobs are harmless orphans (referenced by + # no v2 suffix lookup) that `secrets verify` will flag and the operator can + # remove. A re-run of --finalize early-returns (store is already v2). printf '2\n' > "$SECRETS_DIR/$STORE_FORMAT_FILE_NAME" while IFS= read -r f; do [ -f "$f" ] || continue