V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_1250_yaml/1256_secret_parser.sh

@@ -122,7 +122,7 @@ yaml_secret() {
   ### Declare Arrays, HashMaps, and Variables.
   declare -r  SOPS_AGE_KEY_FILE="/root/.config/sops/age/keys.txt"
   declare     secrets_encrypted="" secrets_yaml="${CISS_SECRETS_SOURCE}" \
-              __path="" __path_wo_prefix="" __pipe_fd="" __umask="" __value="" __varname="" __yq_expr=""
+              __path="" __path_wo_prefix="" __pipe_fd="" __umask="" __value="" __varname=""
 
   secrets_encrypted="$(yq -r '.secrets.x_files // false' -- "${secrets_yaml}")" || secrets_encrypted="false"
 
@@ -142,32 +142,33 @@ yaml_secret() {
   __umask=$(umask)
   umask 0077
 
-  ### Build a single streaming producer: (sops -d |) yq -rj '...'
-  ### yq emits: <path_wo_value>\0<plain_value>\0 -> for each secret.
-  ### No newlines between results (-j), only NUL (\u0000) separators -> robust with arbitrary value content.
-  # shellcheck disable=SC2016
-  __yq_expr='
-    paths(scalars) as $p
-    | select($p[0] == "secrets" and $p[-1] == "value")
-    | ($p[0:-1] | join("."))                           # E.g. "secrets.db.password".
-      + "\u0000"
-      + ((getpath($p) // "") | tostring)               # Plain scalar value; coerce non-strings.
-      + "\u0000"
-  '
-
   ### Create the producer as a process substitution.
   if [[ "${secrets_encrypted}" == "true" ]]; then
 
-    ### Decrypt once, stream into yq; avoid storing full doc in memory.
+    ### Decrypt once, stream into yq; avoid storing full doc in memory; emits '<path>\0<value>\0' for each 'secrets.*.value'
-    # shellcheck disable=SC1083,SC2312
+    # shellcheck disable=SC2016,SC2312
     exec {__pipe_fd}< <(
-      sops -d --input-type=yaml --output-type=yaml -- "${secrets_yaml}" | yq -r --join-output "${__yq_expr}" -
+      sops -d --input-type=yaml --output-type=yaml -- "${secrets_yaml}" | yq -r -N -0 '
+        paths(scalars) as $p
+        | select($p[0] == "secrets" and $p[-1] == "value")
+        | ($p[0:-1] | join(".")), ((getpath($p) // "") | tostring)
+      ' -
     )
 
   else
 
-    # shellcheck disable=SC1083,SC2312
+    ### One-pass producer: emits '<path>\0<value>\0' for each 'secrets.*.value'
-    exec {__pipe_fd}< <( yq -r --join-output "${__yq_expr}" -- "${secrets_yaml}")
+    # -r : raw scalars
+    # -N : no "---" doc separators
+    # -0 : NUL between *each* result
+    # shellcheck disable=SC2016,SC2312
+    exec {__pipe_fd}< <(
+      yq -r -N -0 '
+        paths(scalars) as $p
+        | select($p[0] == "secrets" and $p[-1] == "value")
+        | ($p[0:-1] | join(".")), ((getpath($p) // "") | tostring)
+      ' -- "${secrets_yaml}"
+    )
 
   fi