From 2c4e0e18b1fbd3fa7f9b9036cd56f7b5e043ba06 Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Mon, 31 Aug 2026 15:52:23 +0200 Subject: [PATCH] fix(sys-svc-rdbms): refuse a persisted-password patch that matches nothing The script ran sed and printed PATCHED unconditionally, so an expression that matched no line reported success and the deploy believed a rotated password had reached the application's own config. Nothing downstream could tell the difference. Adding the check found two expressions that could never have worked: friendica sed: -e expression #1, char 44: invalid reference \2 on 's' command kix sed: -e expression #1, char 59: Invalid content of \{\} Both spell their groups as (...) with \1 \2, which is extended-regex syntax, while the script called basic-regex sed. Under sed -E all five declarations match a sample of the line they target -- friendica, matomo, moodle, nextcloud and kix -- so the fix is the flag, not the expressions. That makes 06f5905d64 incomplete: it moved friendica's patch in front of the health gate, but the patch itself aborted sed on every run and said PATCHED anyway. The dry pass uses the same expression the write will use, so a matching line is proven before the file is touched rather than after. Co-Authored-By: Claude Opus 5 (1M context) --- .../files/shell/patch_persisted_password.sh | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/roles/sys-svc-rdbms/files/shell/patch_persisted_password.sh b/roles/sys-svc-rdbms/files/shell/patch_persisted_password.sh index 22d9e70a32..1336131dbf 100755 --- a/roles/sys-svc-rdbms/files/shell/patch_persisted_password.sh +++ b/roles/sys-svc-rdbms/files/shell/patch_persisted_password.sh @@ -10,7 +10,8 @@ # # Param: PATCH_VOLUME - docker volume the app persists its config in # Param: PATCH_CONFIG_REL - config path relative to that volume's mountpoint -# Param: PATCH_EXPRESSION - sed expression, with @PASSWORD@ where the value goes +# Param: PATCH_EXPRESSION - extended-regex sed expression (sed -E), with +# @PASSWORD@ where the value goes # Param: PATCH_PASSWORD - the value, already escaped for the sed delimiter set -euo pipefail @@ -25,5 +26,12 @@ mountpoint="$(container volume inspect --format '{{.Mountpoint}}' "$PATCH_VOLUME config="${mountpoint}/${PATCH_CONFIG_REL}" test -f "$config" || exit 0 -sed -i "${PATCH_EXPRESSION//@PASSWORD@/$PATCH_PASSWORD}" "$config" +expression="${PATCH_EXPRESSION//@PASSWORD@/$PATCH_PASSWORD}" + +if [ -z "$(sed -E -n "${expression}p" "$config" | head -n1)" ]; then + echo "FAILED: no line in ${PATCH_CONFIG_REL} matches the patch expression" >&2 + exit 1 +fi + +sed -E -i "$expression" "$config" echo PATCHED