V8.13.392.2025.11.07

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

lib/lib_check_secrets.sh

@@ -27,11 +27,23 @@ x_remove() {
 
   shopt -s nullglob dotglob
 
+  if [[ "${VAR_SIGNER}" == "true" ]]; then
+
+    # shellcheck disable=SC2312
+    find "${VAR_TMP_SECRET}" -xdev -type f \
+      ! -path "${VAR_TMP_SECRET}/signing_key_pass.txt" \
+      -print0 \
+      | xargs -0 --no-run-if-empty shred -fzu -n 5 --
+
+  else
+
     ### Removes secrets securely.
     # shellcheck disable=SC2312
     find "${VAR_TMP_SECRET}" -xdev -type f -print0 | xargs -0 --no-run-if-empty shred -fzu -n 5 --
     find "${VAR_TMP_SECRET}" -xdev -depth -type d -empty -delete
 
+  fi
+
   shopt -u nullglob dotglob
 
   printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"