Key rotate writes the new passphrase to the wrong backend

Open Beginner friendly
  • Is something wrong?
#32 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
70/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
bash, shell
Domain
cli, security

Research direction

Start in bin/xenv at the two cited lines (around 1916 and 2000), then read lookup_key to see the file, keychain, pass order it uses. Set up a key in keys/<env>.key and a pass entry for the same env, run key rotate, then run get. Done when rotate writes the new key to the same backend lookup_key reads from, and get succeeds afterwards.

Written by the indexing model from the issue text.

Description

bug

Files: bin/xenv:1916, bin/xenv:2000

Repro: Store the env key in keys/.key and also have a pass entry for the same env. lookup_key returns the file. Rotate then stores the new key in pass because the pass check runs last. The next get still reads the old file and fails the MAC.

Fix: Choose the backend the way lookup_key does: file, then keychain, then pass. Stop at the first hit.

Found at 6e8d2b4 by three runs of a whole-repo review team (deploystrata/offload), then hand-checked against the code by Grok. Lines marked Reproduced were also run by Claude.

Dominant language
Shell
Stars
8
Forks
0
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ahoward/xenv

All issues in ahoward/xenv

Similar issues

More Shell/Bash issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.