search

Versent / unicreds

unicreds is a CLI which manages secrets in AWS using DynamoDB and KMS.
https://github.com/Versent/unicreds
MIT License
117 stars 39 forks source link

getall and exec SIGSEGV with keys that trigger InvalidCiphertextException #61

Closed johnzook closed 7 years ago

johnzook commented 7 years ago

Reproduced with both unicreds 1.5.0 and 1.5.1. Occurring on Mac OS X Sierra using darwin builds from github and within an alpine docker container using linux builds, also running on OS X.

Environment has multiple keys, with only some using the 'env:prod' context.

| => unicreds -r us-east-1 -E 'env:prod' getall -d • Configure AWS profile= region=us-east-1 • Getting all secrets panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x2496]

goroutine 1 [running]: panic(0x3e5640, 0xc4200140d0) /usr/local/Cellar/go/1.7/libexec/src/runtime/panic.go:500 +0x1a1 main.main() /Users/markw/Code/go/src/github.com/versent/unicreds/cmd/unicreds/main.go:171 +0x456

Get returns a proper result:

| => unicreds -r us-east-1 -E 'env:prod' get key ⨯ failed error=InvalidCiphertextException: status code: 400, request id: 037d2e62-bc06-11e6-9287-8fb5c387f130

Attempted to reproduce with a local build. Instead of reproducing the failure, it simply works as expected with a subset of keys returned. Based on some quick searches, it may be a go bug related to OS X Sierra. The go patch I found was committed on October 17th, so even the 1.5.1 build is likely to be missing it.

Now using a local build to unblock. Filing this issue to bring visibility in case this impacts other users.

johnzook commented 7 years ago

Issue was fixed via an unreleased commit which was getting picked up by the local build. When a new release of unicreds is issued, it will fix this issue.