kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

pvsecret: Deny adding secrets with preexisting IDs

Browse Source 
Denies the addition of secrets with an ID that is already stored in the
secret store. This can be overruled by using the force option.

This is considered a breaking change as adding duplicated IDs was
possible without the '--force' option before.

Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Tested-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Steffen Eiden
2025-04-23 11:16:45 +02:00
committed by Jan Höppner
parent 5d2c93bc7a
commit f7bba3a687
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
rust/pvsecret/src/cli.rs
View File

@@ -262,6 +262,13 @@ pub struct AddSecretOpt {
#[arg(value_name = "FILE", value_hint = ValueHint::FilePath,)]
#[cfg(target_arch = "s390x")]
pub input: String,
/// Force the addition of add-secret requests.
///
/// Add an add-secret request even if there is already a secret with the same ID in the secret
/// store.
#[arg(short, long)]
pub force: bool,
}
#[derive(Copy, Clone, PartialEq, Eq, PartialOrd, Ord, ValueEnum, Debug, Default)]

8
rust/pvsecret/src/cmd/add.rs
View File

@@ -3,7 +3,7 @@
// Copyright IBM Corp. 2023
use crate::{cli::AddSecretOpt, cmd::list::list_uvc};
use anyhow::{Context, Result};
use anyhow::{bail, Context, Result};
use log::warn;
use pv::{
secret::AddSecretRequest,
@@ -20,7 +20,11 @@ pub fn add(opt: &AddSecretOpt) -> Result<()> {
if let Some(id) = AddSecretRequest::bin_id(cmd.data().unwrap())? {
if list_uvc(&uv)?.iter().any(|e| e.id() == id.as_ref()) {
warn!("There is already a secret in the secret store with that id. Adding the secret anyways.");
warn!("There is already a secret in the secret store with that id.");
match opt.force {
true => warn!("'--force' specified: Adding the secret anyways."),
false => bail!("Unable to add the secret due to duplicated IDs"),
}
}
}