8000 fix(install): keep .env readable only by its owner when the line runs again by adeelahmad · Pull Request #361 · adeelahmad/lense · GitHub
[go: up one dir, main page]
Skip to content

fix(install): keep .env readable only by its owner when the line runs again #361

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adeelahmad merged 1 commit into from
Oct 14, 2026
Merged

fix(install): keep .env readable only by its owner when the line runs again #361

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/install.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,6 +177,7 @@ jobs:
sh < install.sh
after="$(grep -E '^(ACCESS_SECRET_KEY|ARCHIVE_SECRET_KEY|AUTH_SECRET|SURREAL_PASS|LENS_SETUP_CODE)=' "$LENS_DIR/.env" | sha256sum)"
test "$before" = "$after" || { echo "the second run changed the secrets"; exit 1; }
test "$(stat -c %a "$LENS_DIR/.env")" = 600 || { echo "the second run left .env readable to others"; exit 1; }
curl -fsS -o /dev/null "$(cat setup-url)"

- name: An upgrade asked for in the web app is installed by the machine's agent
Expand Down Expand Up @@ -262,6 +263,7 @@ jobs:
LENS_BACKEND='' sh < install.sh | tee again.log
after="$(grep -E '^(ACCESS_SECRET_KEY|ARCHIVE_SECRET_KEY|AUTH_SECRET|SURREAL_PASS|LENS_SETUP_CODE)=' "$LENS_DIR/.env" | sha256sum)"
test "$before" = "$after" || { echo "the second run changed the secrets"; exit 1; }
test "$(stat -c %a "$LENS_DIR/.env")" = 600 || { echo "the second run left .env readable to others"; exit 1; }
grep -q "Stopping the Lens that's running" again.log || { echo "the second run didn't stop the running sandbox first"; exit 1; }
curl -fsS -o /dev/null "$(cat setup-url)"

Expand Down
3 changes: 3 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ The backend (`fastapi_backend`) and the frontend (`nextjs-frontend`) are version

## Unreleased

- **Running the install line again keeps `.env` readable only by you.** Each update rewrote `.env` with the shell's
default permissions, so after an update its secrets could be read by other users of the machine. It is now written
for its owner alone, and an install an earlier update left open is closed again the next time the line runs.
- **A microsandbox install whose keys don't open its database comes up when the line runs again.** A reinstall made
before 0.8.1, after `~/lens` was deleted, wrote new keys but kept the earlier install's `lens-data` volume, and every
update after it kept both: its API stopped at every start with `SURREAL_USER/SURREAL_PASS don't match`. The sandbox
Expand Down
5 changes: 3 additions & 2 deletions install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -352,9 +352,9 @@ HTTPS_PORT="${HTTPS_PORT:-443}"
HTTP_PORT="${HTTP_PORT:-80}"

# --- Secrets, once: changing them later would sign everyone out and make stored credentials unreadable ------------
setenv() { # key value: replace the line, or add it
setenv() { # key value: replace the line, or add it (only this user can read the copy that replaces it)
if grep -q "^$1=" .env; then
sed "s|^$1=.*|$1=$2|" .env >.env.tmp && mv .env.tmp .env
(umask 077 && sed "s|^$1=.*|$1=$2|" .env >.env.tmp) && mv .env.tmp .env
else
printf '%s=%s\n' "$1" "$2" >>.env
fi
Expand All @@ -369,6 +369,7 @@ if [ ! -f .env ]; then
setenv AUTH_SECRET "$(secret)"
setenv SURREAL_PASS "$(secret)"
fi
chmod 600 .env # the secrets are this user's alone, also where an earlier update left them readable to others
grep -q '^LENS_SETUP_CODE=' .env || setenv LENS_SETUP_CODE "$(code)" # only used until the first admin exists
setenv LENS_BACKEND "$BACKEND"
setenv LENS_TARGET "$TARGET"
Expand Down
Loading
0