Skip to content
cccskills
FreePublished on GitHub

bash-herestring-newline-secrets

Fix password/secret authentication failures caused by trailing newlines when creating Google Cloud secrets (or similar) with bash here-strings. Use when: (1) Password authentication fails with correct password, (2) Secret created with `<<< "value"` syntax, (3) Error like "password authentication failed" or "invalid token" despite correct value. Bash here-strings (`<<<`) add a trailing newline that corrupts secrets.

The English summary is being prepared. Showing the original description.

divinevideo/divine-mobile
Works withGoogle Cloud
See how to install

Files included (1)

  • SKILL.md3.1 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Bash Here-String Newline in Secrets

Problem

When creating secrets using bash here-strings (<<<), a trailing newline is silently appended to the value. This causes authentication failures with misleading error messages that suggest the password/token is wrong when it's actually correct—just with an extra newline character.

Context / Trigger Conditions

  • Secret created with: gcloud secrets create NAME --data-file=- <<< "value"
  • Or similar: echo "value" | gcloud secrets create... (echo adds newline by default)
  • Error messages like:
    • "password authentication failed for user X"
    • "invalid token"
    • "authentication failed"
  • The secret value appears correct when viewed
  • Works locally but fails when secret is used

Solution

Wrong (adds newline):

gcloud secrets create my-secret --data-file=- <<< "mypassword"
echo "mypassword" | gcloud secrets create my-secret --data-file=-

Correct (no newline):

echo -n "mypassword" | gcloud secrets create my-secret --data-file=-
printf '%s' "mypassword" | gcloud secrets create my-secret --data-file=-

To fix an existing secret:

echo -n "correct-value" | gcloud secrets versions add my-secret --data-file=-

Verification

Check the secret length to detect trailing newline:

# Get secret and count bytes
gcloud secrets versions access latest --secret=my-secret | wc -c
# Compare to expected length (password length, not password length + 1)

Or use xxd to see the actual bytes:

gcloud secrets versions access latest --secret=my-secret | xxd | tail -1
# Look for '0a' (newline) at the end

Example

Symptom:

Database connection test failed: password authentication failed for user "crawler"

Investigation:

$ gcloud secrets versions access latest --secret=my-db-password
mypassword
$ gcloud secrets versions access latest --secret=my-db-password | wc -c
11  # But password is only 10 characters!

Fix:

$ echo -n "mypassword" | gcloud secrets versions add my-db-password --data-file=-
Created version [2] of the secret [my-db-password].

Notes

  • This affects any system that uses secrets: databases, APIs, tokens, etc.
  • The <<< here-string is a bash feature that ALWAYS adds a newline
  • echo also adds a newline by default; use echo -n or printf '%s'
  • Some systems trim whitespace from secrets, but many (like PostgreSQL) don't
  • When debugging auth failures, always check for trailing whitespace first

References

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

argocd-externalsecret-namespace-permission

Free

Fix ArgoCD ExternalSecret deployment failing with "namespace X is not permitted in project Y". Use when: (1) ExternalSecret shows OutOfSync in ArgoCD but won't sync, (2) ArgoCD application status shows "namespace X is not permitted in project 'infrastructure'", (3) ExternalSecret targets a namespace managed by a different ArgoCD project, (4) Using apps-of-apps pattern with separate infrastructure and application projects.

The English summary is being prepared. Showing the original description.

divinevideo/divine-mobile266Updated Oct 19, 2026

art-direct

Free

Art direction for any content — reads text, PDF, Word, HTML, PPT, then proposes 2-3 creative directions with photography style, mood, and visual language. After selection, generates AI image prompts and visual briefs section-by-section. Use when the user shares content and needs visual direction, image sourcing, or creative direction for any material.

The English summary is being prepared. Showing the original description.

divinevideo/divine-mobile266Updated Oct 19, 2026

async-await-null-race-condition

Free

Fix "Null check operator used on a null value" errors when an object is set to null during an async await. Use when: (1) Object reference is nullified while awaiting, (2) Code accesses object with ! after await returns, (3) Cancel/dispose operations run concurrently with async operations on same object. Solution: capture local reference before await.

The English summary is being prepared. Showing the original description.

divinevideo/divine-mobile266Updated Oct 19, 2026

aws-v4-signing-custom-headers-gcs

Free

Add custom metadata headers (x-amz-meta-*) to AWS v4 signed requests for GCS S3-compatible API. Use when: (1) Adding custom metadata to GCS uploads via S3 API, (2) Getting signature mismatch errors after adding new headers, (3) x-amz-meta-* headers being ignored or causing 403 errors. Custom headers MUST be included in canonical headers and signed headers list.

The English summary is being prepared. Showing the original description.

divinevideo/divine-mobile266Updated Oct 19, 2026

blossom-content-addressed-url-filtering

Free

Fix silent video/media processing failures caused by URL extraction code that filters on file extensions (.mp4, .webm, .webp). Use when: (1) Media moderation, transcoding, or analysis silently skips files from Blossom or content-addressed storage servers, (2) URL extraction from Nostr event tags (imeta, r tags) drops URLs without recognized extensions, (3) CDN fallback URLs append .mp4 but the actual server uses extensionless content-addressed paths like /{sha256}. Common in Nostr video events (kind 34236) where different clients use different URL formats.

The English summary is being prepared. Showing the original description.

divinevideo/divine-mobile266Updated Oct 19, 2026

certmanager-dns01-gke-private-cluster

Free

Fix cert-manager DNS01 ACME challenges stuck in "pending" state with "DNS record not yet propagated" inside GKE private clusters, even when TXT records exist in Cloudflare DNS. Use when: (1) cert-manager challenges show "pending" for hours with propagation check failures, (2) dig from outside cluster shows correct TXT records but cert-manager can't verify them, (3) Using Cloudflare DNS01 solver in a GKE private cluster with Cloud NAT, (4) Google Cloud intercepts 8.8.8.8 DNS queries returning NXDOMAIN for Cloudflare-managed records, (5) Even --dns01-recursive-nameservers with 1.1.1.1 doesn't fix the propagation check despite TXT records being verifiable from busybox pods in the same namespace. Covers the full debugging flow and certbot manual workaround.

The English summary is being prepared. Showing the original description.

divinevideo/divine-mobile266Updated Oct 19, 2026

See all skills by divinevideo

Report a problem with this skill