Repository navigation
fix: random secret names for registry and MinIO credentials - #417
Merged
Merged
Conversation
#403 named the docker config secret (crossplane, helm, oci, flux push) and the mc host secret (hugo export) after a SHA-256 prefix of their content. Secret names are not secret: they show up in --progress plain output and in traces. An unsalted hash of the base64 user:token, or of https://<access key>:<secret key>@<endpoint>, lets a guessed credential be confirmed offline. Same finding as #411 for sops set. The names are now crypto/rand.Text() per call. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
🎉 This PR is included in version 0.137.3 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
patrick-hermann-sva
added a commit
to stuttgart-things/blueprints
that referenced
this pull request
Oct 7, 2026
…s) (#227) dagger v0.137.3 (stuttgart-things/dagger#417) names the registry docker config secret and the MinIO mc host secret randomly per call instead of after a SHA-256 prefix of the credential. The names show up in --progress plain output and traces, and an unsalted hash lets a guessed credential be confirmed offline. Between v0.136.2 and v0.137.3 these three modules changed only by #417. - helm: flux, helm, kubernetes-microservice - crossplane: crossplane-configuration - hugo: presentations Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
github-actions Bot
pushed a commit
to stuttgart-things/blueprints
that referenced
this pull request
Oct 7, 2026
## [3.11.1](v3.11.0...v3.11.1) (2026-10-07) ### Bug Fixes * bump dagger helm/crossplane/hugo to v0.137.3 (random secret names) ([#227](#227)) ([bebc3df](bebc3df)), closes [stuttgart-things/dagger#417](stuttgart-things/dagger#417)
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #403, same finding as #411 (point 1,
sops set).Problem
#403 named the secrets after an unsalted SHA-256 prefix of their content:
push.godocker-config-<sha256(config.json)[:8]>user:tokenexport.gomc-host-<sha256(url)[:8]>https://<access key>:<secret key>@<endpoint>Secret names are not secret: they show up in
--progress plainand in traces (Dagger Cloud). Someone who knows the username and endpoint can confirm a guessed password offline against the hash prefix. For long GitHub PATs that's practically impossible; for weak MinIO keys it isn't.Fix
The names are now
crypto/rand.Text()per call (Go ≥ 1.24, 26 random base32 characters, cannot fail). No moresha256/hexin these files.Side effect: a new secret ID per call means push/export are never served from the Dagger cache either. That's correct for side-effecting operations.
The only other
SetSecretwithout random naming in the repo isansible/execute.go, which uses the environment variable's name, not something derived from the value.Verified
dagger develop+go vet: crossplane, helm, oci, flux, hugooci push-artifact --password env:FAKEPW --progress plainagainst ghcr.io, run twice:docker-config-KZ73L6DPGBL7LNC5EVLUXEXAL7, thendocker-config-WKI3EVINUOA6PW7VYKI2IQ55WT, i.e. different per callDENIED, so the credentials still arrive🤖 Generated with Claude Code