commit 6af0bc68dc484f4c9ba90aab06340c75e8064000
author Antonio Barone <syntonyze@gmail.com> Mon Sep 07 14:02:53 2020 +0200
committer Antonio Barone <syntonyze@gmail.com> Mon Sep 07 14:02:53 2020 +0200
tree d9ea68477dcbe4b8c5bd0b82b0ac10265775e454
parent 466e9d2da196fa52b6a4e3628e58e3af7b017713

Trim potential trailing newlines from secrets

One of the prerequisites for the execution of a recipe is the
creation and storing of secrets in AWS. The documentation instructs to
create files and then run the add_secrets_aws_secrets_manager.sh to
upload their value to AWS.

Depending on how secret files are created however, trailing newlines
might be added at the end of the file, which in turn might create
problems when the secret is retrieved and used.

For example newlines are not allowed when the LDAP secret is quoted,
causing:

```
fatal: Caused by: org.eclipse.jgit.errors.ConfigInvalidException:
Newline in quotes not allowed
```

Improve add_secrets_aws_secrets_manager.sh so that trailing newlines at
the end of the file are stripped before the secret is created in AWS.

Bug: Issue 13353
Change-Id: Id3ab9a2b5edce8f9623c636c76904790c44293b0

gerrit/add_secrets_aws_secrets_manager.sh

diff --git a/gerrit/add_secrets_aws_secrets_manager.sh b/gerrit/add_secrets_aws_secrets_manager.sh
index 2bccd2b..2b4fa4e 100755
--- a/gerrit/add_secrets_aws_secrets_manager.sh
+++ b/gerrit/add_secrets_aws_secrets_manager.sh
@@ -16,18 +16,24 @@
 function set-secret-string {
   SECRET_ID=$1
 
+  # Remove potential trailing newlines from EOF.
+  TEMP_SECRETS="awsGerritTmpSecret"
+  trap 'rm $TEMP_SECRETS*' EXIT
+  NORMALIZED_SECRET_FILE=$(mktemp $TEMP_SECRETS.XXXXXX)
+  printf %s "$(< $SECRETS_DIRECTORY/$SECRET_ID)" > $NORMALIZED_SECRET_FILE
+
   if aws secretsmanager describe-secret --region ${AWS_REGION} --secret-id ${KEY_PREFIX}_${SECRET_ID} > /dev/null 2>&1
   then
     echo "Updating secret ${KEY_PREFIX}_${SECRET_ID} ..."
     aws secretsmanager put-secret-value --region ${AWS_REGION} \
       --secret-id ${KEY_PREFIX}_${SECRET_ID} \
-      --secret-string file://$SECRETS_DIRECTORY/${SECRET_ID}
+      --secret-string file://$NORMALIZED_SECRET_FILE
   else
     echo "Creating secret ${KEY_PREFIX}_${SECRET_ID} ..."
     aws secretsmanager create-secret --region ${AWS_REGION} \
       --name ${KEY_PREFIX}_${SECRET_ID} \
       --description "Gerrit ${SECRET_ID}" \
-      --secret-string file://$SECRETS_DIRECTORY/${SECRET_ID}
+      --secret-string file://$NORMALIZED_SECRET_FILE
   fi
 }