fix: the conf script sets no database password at build time #3

Merged

marcos-mendez merged 1 commit from fix/no-build-time-password into main

2026-10-07 12:56:17 -03:00

marcos-mendez commented

2026-10-07 12:44:33 -03:00

(Migrated from github.com)

What

conf opened with set ${PGSQL_PASS:=postgres} and ran alter user postgres with encrypted password '$PGSQL_PASS', so a layer built with nothing declared shipped the superuser password postgres. Only keel-postgresql's conf.d/main cleared it afterwards. Found by the 2026-10-03 audit of the data service layers.

conf: the password step is removed. The cluster is created fresh, so the role has no password until firstboot.d/35pgsqlpass sets it from DB_PASS.
conf-vars: removed; PGSQL_PASS was its only variable.
tests/unit.bats: fails when any conf script of the unit (conf, conf.d/*) sets a database password at build time.
tests/conf.bats: no role gets a password, and a PGSQL_PASS in the build environment reaches nothing.
Version 1.0.1, changelog entry.

First boot

keel-postgresql's 36pgsqlverify is unaffected (keel-postgresql still builds from common's conf/pgsql). Its tests/hook.bats passes on main: with DB_PASS preseeded the password is proved on [::1]:5432; without it the hook exits 1 with no DB_PASS in <conf> ... declare secrets.db_password in the instance description and never prompts.

Test plan

Tests written first and failed on the two lines that set the password
bats tests: 22/22
tests/coverage.sh 100: conf 15/15
CI green
Next keel-postgresql or keel-lapp build from this unit boots with DB_PASS preseeded

## What `conf` opened with `set ${PGSQL_PASS:=postgres}` and ran `alter user postgres with encrypted password '$PGSQL_PASS'`, so a layer built with nothing declared shipped the superuser password `postgres`. Only keel-postgresql's `conf.d/main` cleared it afterwards. Found by the 2026-10-03 audit of the data service layers. - `conf`: the password step is removed. The cluster is created fresh, so the role has no password until `firstboot.d/35pgsqlpass` sets it from `DB_PASS`. - `conf-vars`: removed; `PGSQL_PASS` was its only variable. - `tests/unit.bats`: fails when any conf script of the unit (`conf`, `conf.d/*`) sets a database password at build time. - `tests/conf.bats`: no role gets a password, and a `PGSQL_PASS` in the build environment reaches nothing. - Version 1.0.1, changelog entry. ## First boot keel-postgresql's `36pgsqlverify` is unaffected (keel-postgresql still builds from common's `conf/pgsql`). Its `tests/hook.bats` passes on main: with `DB_PASS` preseeded the password is proved on `[::1]:5432`; without it the hook exits 1 with `no DB_PASS in <conf> ... declare secrets.db_password in the instance description` and never prompts. ## Test plan - [x] Tests written first and failed on the two lines that set the password - [x] `bats tests`: 22/22 - [x] `tests/coverage.sh 100`: conf 15/15 - [ ] CI green - [ ] Next keel-postgresql or keel-lapp build from this unit boots with `DB_PASS` preseeded