fugue / credstash

A little utility for managing credentials in the cloud
Apache License 2.0
2.06k stars 214 forks source link

Credstash versions are confused #133

Closed ns-cweber closed 7 years ago

ns-cweber commented 7 years ago

I have the following versions for a particular key:

0000000000000000001
0000000000000000005
0000000000000000006
0000000000000000007
2
3
4

I added 0000000000000000005-0000000000000000007 via credstash put -v 5 {key} {value}. These keys were the last added, but credstash get {key} always returns the value for key 4 (presumably credstash is doing a string sort and returning the last item). When I rerun the command to add -v 5, it fails with the error message: version 4 is already in the credential store. Use the -v flag to specify a new version. If I add 8 (greater than the last value I added, which was 7), it will create 0000000000000000008, but credstash get {key} will still return the value for 4.

I've also tried adding credstash put -v v5 {key} {value}, but that just creates entry 00000000000000000v5.

It also appears that credstash delete won't delete a specific version.

I'm using version 1.13.2 on OSX. Versions 2, 3, and 4 were created on Linux with version 1.11.0.

seanieb commented 7 years ago

Not sure if this is related:

Prior to December 2015, credstash auto-versioned with unpadded integers. This resulted in a sorting error once a key hit ten versions. To ensure support for versions that were not numbers (such as dates, build versions, names, etc.), the lexicographical sorting behavior was retained, but the auto-versioning behavior was changed to left-pad integer representations.

If you've used auto-versioning so far, you should run the credstash-migrate-autoversion.py script included in the root of the repository. If you are supplying your own version numbers, you should ensure a lexicographic sort of your versions produces the result you desire.

seanieb commented 7 years ago

@ns-cweber did this answer your question?

ns-cweber commented 7 years ago

@seanieb Yes, thank you. Apologies for the belated response.

bensussman commented 3 years ago

It also appears that credstash delete won't delete a specific version.

Is this still true? The docs don't seem to have an example or support a -v arg to credstash delete