ansible-taler-exchange

commit 40bde7b5d415ecbb656b652fe6a6bb305906090c
parent 49fcd06cb05aa100edf9648943e5e1fe26302b43
Author: Florian Dold <dold@taler.net>
Date:   Fri, 31 Jul 2026 15:47:19 +0200

fix argument checks and entropy source in the fact helpers

Diffstat:
M
roles/common_packages/files/setup-challenger-client-id-fact
 | 
9
+++++++--
M
roles/common_packages/files/setup-secret-fact
 | 
7
++++---

2 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/roles/common_packages/files/setup-challenger-client-id-fact b/roles/common_packages/files/setup-challenger-client-id-fact
@@ -3,7 +3,7 @@
 # Helper script, intented to be used by ansible
 # to generate a fact file.
 
-if [[ $# < 5 ]];
+if [ $# -lt 5 ];
 then
   echo "Usage: $0 <fact_file> <user> <conf> <client_secret> <url>" >&2
   exit 1
@@ -19,5 +19,10 @@ url=$5
 
 client_id=$(sudo -u "$myuser" challenger-admin -c "$conf" --quiet --add="$client_secret" "$url")
 
+if [ -z "$client_id" ]; then
+  echo "$0: challenger-admin returned an empty client id" >&2
+  exit 1
+fi
+
 # Output as JSON string
-echo "\"$client_id\"" > "$fact_file"
+jq -n --arg id "$client_id" '$id' > "$fact_file"
diff --git a/roles/common_packages/files/setup-secret-fact b/roles/common_packages/files/setup-secret-fact
@@ -1,14 +1,15 @@
 #!/usr/bin/env bash
 
-if [[ $# < 1 ]]; then
-  echo "Usage: $0 <fact_file> [prefix]"
+if [ $# -lt 1 ]; then
+  echo "Usage: $0 <fact_file> [prefix]" >&2
   exit 1
 fi
 
 set -eu
 set -o pipefail
 
-SECRET=$(dd if=/dev/random count=1 bs=32 status=none | gnunet-base32)
+# head, not dd: dd can return a short read and silently shorten the secret.
+SECRET=$(head -c 32 /dev/urandom | gnunet-base32)
 
 jq \
   -n \