mirror of
https://github.com/trailofbits/buttercup
synced 2026-06-21 14:11:39 +00:00
Henrik Brodin
a3d805cb35
* ci: shell-quote env values for system integration tests Two bugs in the env file step prevented the weekly System Integration Tests from ever passing since #427 (2026-01-26): 1. The deletion regex `/^KEY=/` did not match the template's `export KEY=replace-me` lines, leaving stale `replace-me` placeholders in the file alongside the appended real values. 2. Appended values were not shell-quoted, so `source ./env` in deployment/crs-architecture.sh treated whitespace and metacharacters as shell syntax. The `OTEL_TOKEN` secret (a `Bearer <token>` header) tripped this with `command not found` on the token component. The same gap was a code-execution sink: a secret containing `$(...)` or backticks would execute on the runner at source time. Fix: strip with `(export[[:space:]]+)?` so template lines are actually removed, and write with `printf 'export %s=%q\n'` so every value is shell-escaped — defending against both whitespace and injection. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * ci: drop placeholder block from ci-env.template The placeholder lines (`export KEY=replace-me`) only existed because the pre-rewrite step substituted into them with `sed -i "s|KEY=.*|...|"`. The new `printf %q` write path doesn't need them, so removing them at the source eliminates the entire delete-then-rewrite dance. Drops `strip_var` and the for-loop. The workflow step is now: copy the static template, then append shell-quoted assignments for every secret the env: block injects. GHCR_AUTH is no longer defined at all, so the `[ -n "$GHCR_AUTH" ]` warning branch in crs-architecture.sh:63 fires as intended. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
17 lines
699 B
Plaintext
17 lines
699 B
Plaintext
export BUTTERCUP_K8S_VALUES_TEMPLATE=./k8s/values-upstream-minikube.template
|
|
export DEPLOY_CLUSTER=true
|
|
export DEPLOY_SIGNOZ=false
|
|
export CLUSTER_TYPE=minikube
|
|
export TAILSCALE_ENABLED=false
|
|
export COMPETITION_API_ENABLED=false
|
|
export CRS_KEY_ID="515cc8a0-3019-4c9f-8c1c-72d0b54ae561"
|
|
export CRS_KEY_TOKEN="VGuAC8axfOnFXKBB7irpNDOKcDjOlnyB"
|
|
export CRS_KEY_TOKEN_HASH='$argon2id$v=19$m=65536,t=3,p=4$Dg1v6NPGTyXPoOPF4ozD5A$wa/85ttk17bBsIASSwdR/uGz5UKN/bZuu4wu+JIy1iA'
|
|
export LITELLM_MASTER_KEY="06beca4d4debbb6bd0933cddd28a3f60"
|
|
export AZURE_API_BASE="ignore-me"
|
|
export AZURE_API_KEY="ignore-me"
|
|
export OTEL_PROTOCOL="http"
|
|
export LANGFUSE_ENABLED=true
|
|
export DOCKER_USERNAME=""
|
|
export DOCKER_PAT=""
|