search

basecamp / kamal

Deploy web apps anywhere.
https://kamal-deploy.org
MIT License
10.6k stars 408 forks source link

Escape secrets in inline command substitution #1008

Closed djmb closed 4 days ago

djmb commented 4 days ago

Kamal "inlines" calls to kamal secrets in the dotenv file, but the results of the calls were not being escaped properly. To "fix" this kamal secrets fetch escaped the JSON string before returning it.

The two errors cancelled out, but it meant that the commands didn't work from a shell.

To fix, we'll escape the inline command results and remove the escaping from kamal secrets fetch.

Fixes https://github.com/basecamp/kamal/issues/1007

djmb commented 4 days ago

No this won't work.

The dotenv gem needs the escaped output from kamal secrets fetch function correctly - it's not behaving exactly the same as a shell would. Escaping the output of the "inlined" kamal secrets commands kind of works around that, but it means that the inlined commands don't work the same a a non inlined version would.

So the problem here is that dotenv and the shell are out of sync. I think maybe the best thing to do is add a kamal secrets print command that can be used when debugging secrets so you don't need to run the commands directly from the command line.

djmb commented 4 days ago

Closing in favour of https://github.com/basecamp/kamal/pull/1009