egbt/secrets
1
0
Fork 0
Code Issues Pull requests Projects Releases 13 Packages Wiki Activity Actions

fix: rekey and list recurse into nested manifest blobs (EGB-677 stage 1)

Browse source 
Pre-landing review (testing + checklist specialists, reproduced) caught a
data-loss bug: cmd_rekey's decrypt/re-encrypt globs were non-recursive and
only special-cased external/. Nested manifest dotenv blobs
(<project>/<relpath>.age, new this branch) were never visited, so after a key
rotation they stayed encrypted under the discarded old key = permanently
undecryptable. cmd_list had the same blind spot (cosmetic: nested entries
invisible in listings).

Both now walk the entire project tree with `find -type f` (bash 3.2 safe,
includes dotfiles natively), unifying top-level / nested / external blobs into
one recursive pass and dropping the now-redundant external/ special-casing.

Regression tests: nested-blob rekey round-trip (survives rotation) + list
shows nested entry. Full suite 193/193.
This commit is contained in:
Brian Majewski 2026-06-07 13:12:27 -07:00
parent 5489f89446
commit c6ea724ddb
2 changed files with 70 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

33
test/manifest.bats
View file

@ -698,3 +698,36 @@ m_nojq_path() {
run jq -r '.external | length' .secrets.json
[ "$output" = "1" ]
}
# ─── J: rekey + list recurse into nested manifest blobs (data-loss guard) ──────
@test "rekey re-encrypts a nested manifest dotenv blob (survives rotation)" {
# Regression: cmd_rekey's non-recursive glob skipped <project>/<relpath>.age
# blobs, leaving them on the old key = permanently undecryptable after rotation.
init_with_remote
create_project_dir nestrekey
mkdir -p packages/web
echo "N=nested" > packages/web/.env.development
"$SECRETS_BIN" add packages/web/.env.development >/dev/null
"$SECRETS_BIN" push >/dev/null 2>&1
[ -f "$SECRETS_DIR/nestrekey/packages/web/.env.development.age" ]
run "$SECRETS_BIN" rekey
[ "$status" -eq 0 ]
rm -rf packages
run "$SECRETS_BIN" pull nestrekey
[ "$status" -eq 0 ]
[ -f packages/web/.env.development ]
[ "$(cat packages/web/.env.development)" = "N=nested" ]
}
@test "list shows a nested manifest blob" {
init_with_remote
create_project_dir nestlist
mkdir -p packages/web
echo "N=nested" > packages/web/.env.development
"$SECRETS_BIN" add packages/web/.env.development >/dev/null
"$SECRETS_BIN" push >/dev/null 2>&1
run "$SECRETS_BIN" list
[ "$status" -eq 0 ]
[[ "$output" == *"packages/web/.env.development"* ]] || false
}