actions/fluxcd-flux2
2
0
Fork 0
mirror of https://github.com/fluxcd/flux2.git synced 2026-05-23 09:55:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

fix: return clear error when --private-key-file path starts with '~'

Browse source 
The tilde character is expanded by the shell, not by the Flux CLI, so
paths like ~/.ssh/id_ecdsa passed with =value syntax were opened
verbatim and failed with a confusing "no such file or directory" error.
Detect the leading '~' up front and surface a message pointing users at
absolute paths or $HOME instead. Fixes #5591.

Signed-off-by: Rafael Peroco <rafaelperoco@gmail.com>
This commit is contained in:
Rafael Peroco 2026-04-21 16:36:34 -03:00
parent befe53a722
commit 566bbe6e00
3 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
cmd/flux/bootstrap_git.go
View file

@ -364,6 +364,9 @@ func getAuthOpts(u *url.URL, caBundle []byte) (*git.AuthOptions, error) {
Password: gitArgs.password,
}
if bootstrapArgs.privateKeyFile != "" {
if strings.HasPrefix(bootstrapArgs.privateKeyFile, "~") {
return nil, fmt.Errorf("failed to open private key file: path %q starts with '~' which is not expanded; use an absolute path or $HOME", bootstrapArgs.privateKeyFile)
}
pk, err := os.ReadFile(bootstrapArgs.privateKeyFile)
if err != nil {
return nil, err

5
cmd/flux/create_secret_git_test.go
View file

@ -56,6 +56,11 @@ func TestCreateGitSecret(t *testing.T) {
args: "create secret git podinfo-auth --url=https://github.com/stefanprodan/podinfo --username=aaa --password=zzzz --bearer-token=aaaa --namespace=my-namespace --export",
assert: assertError("user credentials and bearer token cannot be used together"),
},
{
name: "ssh key with tilde path",
args: "create secret git podinfo-auth --url=ssh://git@github.com/stefanprodan/podinfo --private-key-file=~/.ssh/id_ecdsa --namespace=my-namespace --export",
assert: assertError(`failed to open private key file: path "~/.ssh/id_ecdsa" starts with '~' which is not expanded; use an absolute path or $HOME`),
},
}
for _, tt := range tests {