diff --git a/lib/lib_check_secrets.sh b/lib/lib_check_secrets.sh index dc98933..93f8500 100644 --- a/lib/lib_check_secrets.sh +++ b/lib/lib_check_secrets.sh @@ -27,10 +27,22 @@ x_remove() { shopt -s nullglob dotglob - ### Removes secrets securely. - # shellcheck disable=SC2312 - find "${VAR_TMP_SECRET}" -xdev -type f -print0 | xargs -0 --no-run-if-empty shred -fzu -n 5 -- - find "${VAR_TMP_SECRET}" -xdev -depth -type d -empty -delete + if [[ "${VAR_SIGNER}" == "true" ]]; then + + # shellcheck disable=SC2312 + find "${VAR_TMP_SECRET}" -xdev -type f \ + ! -path "${VAR_TMP_SECRET}/signing_key_pass.txt" \ + -print0 \ + | xargs -0 --no-run-if-empty shred -fzu -n 5 -- + + else + + ### Removes secrets securely. + # shellcheck disable=SC2312 + find "${VAR_TMP_SECRET}" -xdev -type f -print0 | xargs -0 --no-run-if-empty shred -fzu -n 5 -- + find "${VAR_TMP_SECRET}" -xdev -depth -type d -empty -delete + + fi shopt -u nullglob dotglob