From 3bb992fc1b7a88385f6d83d9e291c44d00a96382 Mon Sep 17 00:00:00 2001 From: sneak Date: Mon, 21 Sep 2026 18:03:21 +0000 Subject: [PATCH] test: reject the config.example.yml placeholder signing_key The placeholder is 45 characters, so it passes the length check and a deployment could unknowingly sign URLs with a key that is public in this repository. Add a failing validation case (and the placeholder constant it references); the rejection follows. Model: opus-4-8 --- internal/config/config.go | 6 ++++++ internal/config/config_validation_internal_test.go | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/internal/config/config.go b/internal/config/config.go index fb6e02d..9725a66 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -44,6 +44,12 @@ const ( keyCacheMaxBytes = "cache_max_bytes" ) +// placeholderSigningKey is the dummy signing_key shipped in +// config.example.yml. It is 45 characters, so it passes the length +// check, but it is public in this repository and must be rejected at +// startup so no deployment ever signs URLs with it. +const placeholderSigningKey = "CHANGE_ME_generate_with_openssl_rand_base64_32" + // Static validation errors. Each use site attaches the offending key // and value by wrapping these with fmt.Errorf and %w. var ( diff --git a/internal/config/config_validation_internal_test.go b/internal/config/config_validation_internal_test.go index ca1573e..c12d27d 100644 --- a/internal/config/config_validation_internal_test.go +++ b/internal/config/config_validation_internal_test.go @@ -303,6 +303,11 @@ func invalidHostAndCredentialCases() []abortCase { yaml: "signing_key: short\n", wantErrSubstrings: []string{keySigningKey}, }, + { + name: "signing_key is the documented placeholder", + yaml: "signing_key: " + placeholderSigningKey + "\n", + wantErrSubstrings: []string{keySigningKey}, + }, { name: "signing_key missing", yaml: "port: 8080\n",