Skip to content

Commit f641332

Browse files
hslatmanhslatman
committed
Use --password-file to provide password to step crypto keypair
In CI the TTY is not available, and will result in this error: `error reading password: error allocating terminal: open /dev/tty: no such device or address` We prevent this by using the `--password-file` flag.
1 parent 1fc663b commit f641332

2 files changed

Lines changed: 15 additions & 32 deletions

File tree

‎integration/script/crypto_test.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,9 @@ func TestCryptoJWTCommand(t *testing.T) {
6565
func TestCryptoKeyPair(t *testing.T) {
6666
testscript.Run(t, testscript.Params{
6767
Files: []string{"testdata/crypto/keypair.txtar"},
68+
Setup: func(e *testscript.Env) error {
69+
return os.WriteFile(filepath.Join(e.Cd, "password.txt"), []byte("password"), 0600)
70+
},
6871
Cmds: map[string]func(ts *testscript.TestScript, neg bool, args []string){
6972
"check_key_pair": checkKeyPair,
7073
},

‎integration/script/testdata/crypto/keypair.txtar‎

Lines changed: 12 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,7 @@
33
# in timeouts that I haven't the root cause for (yet).
44

55
# defaults
6-
exec echo password
7-
ttyin stdout
8-
exec step crypto keypair key.pub key.priv
6+
exec step crypto keypair --password-file password.txt key.pub key.priv
97
check_key_pair key.pub key.priv ECDSA P-256
108

119

@@ -30,37 +28,27 @@ stderr 'flag ''--no-password'' requires the ''--insecure'' flag'
3028

3129

3230
# no-password with insecure
33-
exec echo ''
34-
ttyin stdout
3531
exec step crypto keypair --no-password --insecure no-pass.pub no-pass.priv
3632
check_key_pair key.pub key.priv ECDSA P-256
3733

3834

3935
# RSA defaults
40-
exec echo password
41-
ttyin stdout
42-
exec step crypto keypair --kty RSA rsa-key.pub rsa-key.priv
36+
exec step crypto keypair --password-file password.txt --kty RSA rsa-key.pub rsa-key.priv
4337
check_key_pair rsa-key.pub rsa-key.priv RSA 2048
4438

4539

4640
# RSA size 1024 with insecure flag
47-
exec echo password
48-
ttyin stdout
49-
exec step crypto keypair --kty RSA --size 1024 --insecure rsa-1024.pub rsa-1024.priv
41+
exec step crypto keypair --password-file password.txt --kty RSA --size 1024 --insecure rsa-1024.pub rsa-1024.priv
5042
check_key_pair rsa-1024.pub rsa-1024.priv RSA 1024
5143

5244

5345
# RSA size 3072
54-
exec echo password
55-
ttyin stdout
56-
exec step crypto keypair --kty RSA --size 3072 rsa-3072.pub rsa-3072.priv
46+
exec step crypto keypair --password-file password.txt --kty RSA --size 3072 rsa-3072.pub rsa-3072.priv
5747
check_key_pair rsa-3072.pub rsa-3072.priv RSA 3072
5848

5949

6050
# RSA size 4096
61-
exec echo password
62-
ttyin stdout
63-
exec step crypto keypair --kty RSA --size 4096 rsa-4096.pub rsa-4096.priv
51+
exec step crypto keypair --password-file password.txt --kty RSA --size 4096 rsa-4096.pub rsa-4096.priv
6452
check_key_pair rsa-4096.pub rsa-4096.priv RSA 4096
6553

6654

@@ -79,9 +67,9 @@ stderr 'flag ''--size'' requires at least 2048 unless ''--insecure'' flag is pro
7967
stderr 'flag ''--size'' must be greater than or equal to 0'
8068

8169

82-
# RSA size 16 with insecure flag
83-
! exec step crypto keypair --kty RSA --size 16 --insecure rsa-error.pub rsa-error.priv
84-
stderr 'error generating RSA key: rsa: key too small'
70+
# RSA size 16 with insecure flag; skipped on Go < 1.24, because small keys were supported on those
71+
[go1.24] ! exec step crypto keypair --password-file password.txt --kty RSA --size 16 --insecure rsa-error.pub rsa-error.priv
72+
[go1.24] stderr 'error generating RSA key: rsa: key too small'
8573

8674

8775
# RSA size 1024 without insecure flag
@@ -95,30 +83,22 @@ stderr 'flag ''--curve'' is incompatible with flag ''--kty RSA'''
9583

9684

9785
# EC defaults
98-
exec echo password
99-
ttyin stdout
100-
exec step crypto keypair --kty EC ec-key.pub ec-key.priv
86+
exec step crypto keypair --password-file password.txt --kty EC ec-key.pub ec-key.priv
10187
check_key_pair ec-key.pub ec-key.priv EC P-256
10288

10389

10490
# EC P-256
105-
exec echo password
106-
ttyin stdout
107-
exec step crypto keypair --kty EC --crv P-256 ec-256.pub ec-256.priv
91+
exec step crypto keypair --password-file password.txt --kty EC --crv P-256 ec-256.pub ec-256.priv
10892
check_key_pair ec-256.pub ec-256.priv EC P-256
10993

11094

11195
# EC P-384
112-
exec echo password
113-
ttyin stdout
114-
exec step crypto keypair --kty EC --crv P-384 ec-384.pub ec-384.priv
96+
exec step crypto keypair --password-file password.txt --kty EC --crv P-384 ec-384.pub ec-384.priv
11597
check_key_pair ec-384.pub ec-384.priv EC P-384
11698

11799

118100
# EC P-521
119-
exec echo password
120-
ttyin stdout
121-
exec step crypto keypair --kty EC --crv P-521 ec-521.pub ec-521.priv
101+
exec step crypto keypair --password-file password.txt --kty EC --crv P-521 ec-521.pub ec-521.priv
122102
check_key_pair ec-521.pub ec-521.priv EC P-521
123103

124104

0 commit comments

Comments
 (0)