Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package grafana-image for openSUSE:Factory checked in at 2026-10-31 23:09:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/grafana-image (Old) and /work/SRC/openSUSE:Factory/.grafana-image.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "grafana-image" Sat Oct 31 23:09:00 2026 rev:51 rq:1394050 version:unknown Changes: -------- --- /work/SRC/openSUSE:Factory/grafana-image/grafana-image.changes 2026-09-19 22:22:00.080753741 +0200 +++ /work/SRC/openSUSE:Factory/.grafana-image.new.1255/grafana-image.changes 2026-10-31 23:11:07.145750582 +0100 @@ -1,0 +2,5 @@ +Sat Oct 31 08:25:46 UTC 2026 - SUSE Update Bot <[email protected]> + +- avoid printing credentials to the log + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ run.sh ++++++ --- /var/tmp/diff_new_pack.KkpgjR/_old 2026-10-31 23:11:08.283797828 +0100 +++ /var/tmp/diff_new_pack.KkpgjR/_new 2026-10-31 23:11:08.286797953 +0100 @@ -28,7 +28,13 @@ fi if [ ! -z ${GF_AWS_PROFILES+x} ]; then + mkdir -p "$GF_PATHS_HOME/.aws" + + # Save the current umask and restrict newly created files to 0600 (read/write by owner only) + old_umask="$(umask)" + umask 077 :> "$GF_PATHS_HOME/.aws/credentials" + umask "$old_umask" for profile in ${GF_AWS_PROFILES}; do access_key_varname="GF_AWS_${profile}_ACCESS_KEY_ID" @@ -38,18 +44,21 @@ access_key="$(printenv "$access_key_varname")" || access_key="" secret_key="$(printenv "$secret_key_varname")" || secret_key="" if [ ! -z "${access_key}" ] && [ ! -z "${secret_key}" ]; then - echo "[${profile}]" >> "$GF_PATHS_HOME/.aws/credentials" - echo "aws_access_key_id = ${access_key}" >> "$GF_PATHS_HOME/.aws/credentials" - echo "aws_secret_access_key = ${secret_key}" >> "$GF_PATHS_HOME/.aws/credentials" - + # Feed credentials via stdin (here-document) instead of command-line arguments + cat <<EOF >> "$GF_PATHS_HOME/.aws/credentials" +[${profile}] +aws_access_key_id = ${access_key} +aws_secret_access_key = ${secret_key} +EOF region="$(printenv "$region_varname")" || region="" if [ ! -z "${region}" ]; then echo "region = ${region}" >> "$GF_PATHS_HOME/.aws/credentials" fi fi - done - chmod 600 "$GF_PATHS_HOME/.aws/credentials" + # Clean sensitive variables from the shell environment before launching Grafana + unset "$access_key_varname" "$secret_key_varname" access_key secret_key + done fi # Convert all environment variables with names ending in __FILE into the content of
