免费在 GitHub 公开

bash-herestring-newline-secrets

Fix password/secret authentication failures caused by trailing newlines when creating Google Cloud secrets (or similar) with bash here-strings. Use when: (1) Password authentication fails with correct password, (2) Secret created with `<<< "value"` syntax, (3) Error like "password authentication failed" or "invalid token" despite correct value. Bash here-strings (`<<<`) add a trailing newline that corrupts secrets.

中文简介正在准备中。当前显示原文说明。

divinevideo/divine-mobile

集成工具Google Cloud

查看安装方法

包含的文件（1）

SKILL.md3.1 KB

SKILL.md（原文）

安装前可以查看交给 AI 代理的指令内容。

Bash Here-String Newline in Secrets

Problem

When creating secrets using bash here-strings (<<<), a trailing newline is silently appended to the value. This causes authentication failures with misleading error messages that suggest the password/token is wrong when it's actually correct—just with an extra newline character.

Context / Trigger Conditions

Secret created with: gcloud secrets create NAME --data-file=- <<< "value"
Or similar: echo "value" | gcloud secrets create... (echo adds newline by default)
Error messages like:
- "password authentication failed for user X"
- "invalid token"
- "authentication failed"
The secret value appears correct when viewed
Works locally but fails when secret is used

Solution

Wrong (adds newline):

gcloud secrets create my-secret --data-file=- <<< "mypassword"
echo "mypassword" | gcloud secrets create my-secret --data-file=-

Correct (no newline):

echo -n "mypassword" | gcloud secrets create my-secret --data-file=-
printf '%s' "mypassword" | gcloud secrets create my-secret --data-file=-

To fix an existing secret:

echo -n "correct-value" | gcloud secrets versions add my-secret --data-file=-

Verification

Check the secret length to detect trailing newline:

# Get secret and count bytes
gcloud secrets versions access latest --secret=my-secret | wc -c
# Compare to expected length (password length, not password length + 1)

Or use xxd to see the actual bytes:

gcloud secrets versions access latest --secret=my-secret | xxd | tail -1
# Look for '0a' (newline) at the end

Example

Symptom:

Database connection test failed: password authentication failed for user "crawler"

Investigation:

$ gcloud secrets versions access latest --secret=my-db-password
mypassword
$ gcloud secrets versions access latest --secret=my-db-password | wc -c
11  # But password is only 10 characters!

Fix:

$ echo -n "mypassword" | gcloud secrets versions add my-db-password --data-file=-
Created version [2] of the secret [my-db-password].

Notes

This affects any system that uses secrets: databases, APIs, tokens, etc.
The <<< here-string is a bash feature that ALWAYS adds a newline
echo also adds a newline by default; use echo -n or printf '%s'
Some systems trim whitespace from secrets, but many (like PostgreSQL) don't
When debugging auth failures, always check for trailing whitespace first

References

Bash manual on here-strings: https://www.gnu.org/software/bash/manual/bash.html#Here-Strings

评价

还没有评价。欢迎分享你的使用感受。

无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

同一仓库的技能

argocd-externalsecret-namespace-permission

免费

Fix ArgoCD ExternalSecret deployment failing with "namespace X is not permitted in project Y". Use when: (1) ExternalSecret shows OutOfSync in ArgoCD but won't sync, (2) ArgoCD application status shows "namespace X is not permitted in project 'infrastructure'", (3) ExternalSecret targets a namespace managed by a different ArgoCD project, (4) Using apps-of-apps pattern with separate infrastructure and application projects.

中文简介正在准备中。当前显示原文说明。