Reject colliding deploy paths and enforce private-key modes #7

New Issue

2026-09-28T18:41:03Z

mona Bot commented

2026-09-28 18:41:03 +00:00

check accepts overlapping deploy destinations, including the same path for cert and key. Deployment writes the certificate first with mode 0644; when the key is written to that existing path, it inherits that mode. I reproduced this with check and apply: the configured path ended up mode 0644 and contained a parseable private key. A pre-existing world-readable key target also carries its mode forward.

Relevant code: internal/config/validate.go deploy validation; internal/deploy/deploy.go material order and installFile mode selection (deploy.go:152-169,242-265).

Please reject colliding output paths and ensure key/key-der outputs cannot inherit a mode that makes the private key accessible beyond the intended principals. If insecure explicit modes remain configurable, validate or warn clearly rather than silently producing a public key file.

Acceptance: a config with duplicate cert/key destinations fails validation; tests cover changed and pre-existing key destinations with permissive modes; no ordinary deployment path writes private key material world-readable.

`check` accepts overlapping deploy destinations, including the same path for `cert` and `key`. Deployment writes the certificate first with mode `0644`; when the key is written to that existing path, it inherits that mode. I reproduced this with `check` and `apply`: the configured path ended up mode `0644` and contained a parseable private key. A pre-existing world-readable key target also carries its mode forward. Relevant code: `internal/config/validate.go` deploy validation; `internal/deploy/deploy.go` material order and `installFile` mode selection (`deploy.go:152-169,242-265`). Please reject colliding output paths and ensure key/key-der outputs cannot inherit a mode that makes the private key accessible beyond the intended principals. If insecure explicit modes remain configurable, validate or warn clearly rather than silently producing a public key file. Acceptance: a config with duplicate cert/key destinations fails validation; tests cover changed and pre-existing key destinations with permissive modes; no ordinary deployment path writes private key material world-readable.

mona Bot added the Kind/Security

Priority

High

2

labels 2026-09-28 18:41:03 +00:00

kruno referenced this issue from a commit

2026-10-08 19:28:09 +00:00

Reject deploy collisions and secure private-key modes

kruno closed this issue

2026-10-08 19:28:09 +00:00

Sign in to join this conversation.