V8.13.392.2025.11.07

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

lib/lib_check_secrets.sh

@@ -27,10 +27,22 @@ x_remove() {
 
   shopt -s nullglob dotglob
 
-  ### Removes secrets securely.
-  # shellcheck disable=SC2312
-  find "${VAR_TMP_SECRET}" -xdev -type f -print0 | xargs -0 --no-run-if-empty shred -fzu -n 5 --
-  find "${VAR_TMP_SECRET}" -xdev -depth -type d -empty -delete
+  if [[ "${VAR_SIGNER}" == "true" ]]; then
+
+    # shellcheck disable=SC2312
+    find "${VAR_TMP_SECRET}" -xdev -type f \
+      ! -path "${VAR_TMP_SECRET}/signing_key_pass.txt" \
+      -print0 \
+      | xargs -0 --no-run-if-empty shred -fzu -n 5 --
+
+  else
+
+    ### Removes secrets securely.
+    # shellcheck disable=SC2312
+    find "${VAR_TMP_SECRET}" -xdev -type f -print0 | xargs -0 --no-run-if-empty shred -fzu -n 5 --
+    find "${VAR_TMP_SECRET}" -xdev -depth -type d -empty -delete
+
+  fi
 
   shopt -u nullglob dotglob