init and serve leave an existing TLS private key readable by other users
Maintainers usually reply within 4 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 70/100
Research direction
Start with check_config_permissions in crates/app/src/serve_helpers.rs (around line 77), which already warns and sets the config to 0600; mirror that for server.tls.key_path. The init skip path is generate_tls_cert_if_needed in crates/app/src/init_helpers.rs. Done when a test starting from a 0644 key shows the warning and ends with the key at 0600 in both serve and init.
Written by the indexing model from the issue text.
Description
Problem
Neither init nor serve checks the mode of an existing TLS private key, so a key.pem that other users can read stays readable.
initskips certificate generation when bothcert.pemandkey.pemexist (generate_tls_cert_if_needed,crates/app/src/init_helpers.rs). It checks that the certificate covers the requested names and does not look at the key's mode.servechecks only the config file's mode:check_config_permissions(crates/app/src/serve_helpers.rsline 77) warns and sets the config to 0600 when group or other bits are set. Read from the code, nothing does the same forserver.tls.key_path(default~/.extenddb/tls/key.pem).
A key ends up wider than 0600 when an older init stopped between writing the key and setting its mode (#709, fixed in #766 for new keys), or when an operator copies a key in with the umask mode.
Measured
2 November 2026, a build of #766 (7cb517498), a fresh HOME, umask 022. init created key.pem at 0600. After chmod 0644 key.pem, a second init with a new config path and a new SQLite path printed --- TLS certificate already exists, skipping generation., exited 0, and left key.pem at 0644.
Expected
Treat the key file as check_config_permissions treats the config: when server.tls.key_path has group or other bits set, serve warns and sets it to 0600, and the init skip path does the same for ~/.extenddb/tls/key.pem. A test starts from a 0644 key and checks the warning and the 0600 result.
- Dominant language
- Rust
- Stars
- 517
- Forks
- 60
- Avg merge
- 4d 19h
- Merged PRs (30d)
- 50
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ExtendDB/extenddb
-
Scan: ExpressionAttributeValues without an expression answers with a ": FilterExpression is null" suffix the service does not sendPossibly taken @LeeroyHannigan claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
ExtendDB/extenddb#722 · 1 assignee ·
Maintainers usually reply within 4 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 4 days
-
init writes the TLS private key at the umask mode before setting it to 0600Possibly taken @LeeroyHannigan claimed this today. Openbug security
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 4 days
-
Export and import paths can write CR, LF and terminal escape sequences into the server logPossibly taken @LeeroyHannigan claimed this today. Openbug security
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 4 days
-
extenddb version prints the first build's commit after a rebuild in the same target directoryPossibly taken @LeeroyHannigan claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 4 days
All issues in ExtendDB/extenddb
Similar issues
-
docs(metrics): replace stale src/metrics.rs line anchors in dashboard-metrics.md with symbol namesOpen
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
ci-cd desktop size:low telemetry-improvement telemetry-round-1
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
vfarcic/dot-agent-deck#2079 ·
Maintainers usually reply within 1 day
-
修改文件名时主键盘上的数字无法输入Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 63/100
qingjian-team/qingjian#894 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
rubys/roundhouse#1757 ·
-
enhancement user-priority/P3
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day