From 4bcc66d9dbb1692fbf86975fbff84178e539e202 Mon Sep 17 00:00:00 2001 From: thanhnv Date: Wed, 1 Jul 2026 18:36:11 +0900 Subject: [PATCH] fix(vault-kms): pass pubkey response via tmpfile not string literal MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Embedding $response as Python triple-quoted string caused json.loads() to fail with 'Invalid control character' when Vault's JSON contained \n sequences in the PEM public key (bash \n → Python newline → invalid JSON control char). Fix: write response to mktemp, pass path as argv, read with open(). --- AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh b/AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh index 78579ac..0834ece 100755 --- a/AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh +++ b/AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh @@ -106,11 +106,14 @@ vault_kms_pubkey() { echo "vault-kms: pubkey fetch failed (key=$key)" >&2; exit 1 } - python3 - "$output" < "$tmp_resp" + python3 - "$output" "$tmp_resp" <<'PY' import sys, json output = sys.argv[1] -response = """$response""" -d = json.loads(response) +with open(sys.argv[2]) as f: + d = json.loads(f.read()) keys = d["data"]["keys"] # keys is a dict; pick the latest version latest = max(keys.keys(), key=lambda k: int(k)) @@ -119,6 +122,7 @@ with open(output, "w") as f: f.write(pub if pub.endswith("\n") else pub + "\n") print(f"vault-kms: public key written to {output}", file=sys.stderr) PY + rm -f "$tmp_resp" } # ── Verify a signature ────────────────────────────────────────────────────