base64 encoded bcrypt-hashed password is multiline

[shezaan-hashgraph]

I'm trying to set up Kargo and one of the first steps is to create a secret for the admin account. I am following this https://docs.kargo.io/operator-guide/security/secure-configuration/#securing-the-admin-account but have realized that the base64 encoded bcrypt-hashed password is a multiline password. That script does not put the password onto a single line. My question is that in the secret object does the password need to be on a single line as shown by this
I'm not using this so please nobody freak out but this is a sample output of the script from step # 1 on that link

Password: Ya1llbB8uBEHKc6yciu4QbZpYLVEdpZr
Password Hash: $2y$10$oGfFZJuAm1X3KqvVHiQBZeu.tnZWVNZbJaHyg9i5Rj.35980WtqJq
Encoded Password Hash: JDJ5JDEwJG9HZkZaSnVBbTFYM0txdlZIaVFCWmV1LnRuWldWTlpiSmFIeWc5aTVSai4zNTk4
MFd0cUpx -------> Notice this is a multiline Password Hash
Encoded Signing Key: NENsTGFvTUJESkhOU0R5MUI2YThsMkdSc0x0SGRxU1Y=

apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: <secret name>
  namespace: <kargo namespace>
data:
  ADMIN_ACCOUNT_TOKEN_SIGNING_KEY: <base64 encoded signing key>
  ADMIN_ACCOUNT_PASSWORD_HASH: <base64 encoded bcrypt-hashed password> ----> Single line only?

[krancour]

A line break isn't a valid base64 character, so the question here shouldn't be one of how to enter this in the config, but rather one of how you even got that result from the script. 🤔

[shezaan-hashgraph]

I ran that script on both linux and macOS and both give a line break. I literally copy and pasted the script to get the result I posted above. And I keep getting the line breaks.

[shezaan-hashgraph]

Looks like the default behavior of base64 (Linux) wraps output at 76 characters. For Mac I found it to be 72 chars. That explains the wrapping. I think the docs should use a better script like so...

#!/bin/bash

# Generate a random 32-character password
pass=$(openssl rand -base64 48 | tr -d "=+/" | head -c 32)
echo "Password: $pass"

# Generate bcrypt hash and ensure it is single-line
hashed_pass=$(htpasswd -bnBC 10 "" "$pass" | tr -d ':\n')

# Base64 encode the hashed password (ensure single-line output)
encoded_hash=$(echo -n "$hashed_pass" | base64 -w 0)
echo "Encoded Password Hash: $encoded_hash"

# Generate a Base64-encoded signing key
encoded_signing_key=$(openssl rand -base64 48 | tr -d "=+/" | head -c 32 | base64 -w 0)
echo "Encoded Signing Key: $encoded_signing_key"

Also on Mac, the base64 is installed by the homebrew coreutils package as gbase64 so I simply removed the separately installed base64 via homebrew i.e. homebrew remove base64 which installs an ancient non-gnu version of base64 and did this sudo ln -s /opt/homebrew/bin/gbase64 /opt/homebrew/bin/base64 to use the coreutils version of base64 which matches what is on linux and also supports -w0 as shown in the script above.

[krancour]

TIL the base64 command wraps in Linux. I was able to confirm the wrapping on Ubuntu.

The default base64 on Mac does not wrap by default, but does respect -w.

So I agree we should add -w to the script.

I'm not sure I followed how exactly you came to be using any version of base64 that didn't support -w. If you're saying you got such a version from homebrew, great as homebrew is, that's something you opted into, so the modified script you posted seems it would work fine on both Mac and Linux unless someone has opted into the non-default base64 binary, right?

I'd welcome a PR to amend the script exactly as you've suggested. You may want to do a search because the same command appears other places in the docs as well and should receive the same update.

[shezaan-hashgraph]

TIL the base64 command wraps in Linux. I was able to confirm the wrapping on Ubuntu.

Not without the -w flag though right? Because when I tested the existing script from the docs, it did not wrap even on Linux. Only the number of characters it wraps differs on Linux vs Mac.

I'm not sure I followed how exactly you came to be using any version of base64 that didn't support -w. If you're saying you got such a version from homebrew, great as homebrew is, that's something you opted into, so the modified script you posted seems it would work fine on both Mac and Linux unless someone has opted into the non-default base64 binary, right?

That is correct for the most part. Few caveats here, base64 can installed via homebrew by 2 separate packages i.e. coreutils as well as base64. The latter should be removed and the one from coreutils should be symlinked like so sudo ln -s /opt/homebrew/bin/gbase64 /opt/homebrew/bin/base64 before using the script otherwise base64 cannot be found as coreutils installs base64 as gbase64. I don't know if base64 is installed on the Mac by default. It wasn't so in my case which is why I had to install it via coreutils. Could you do a which base64 and base64 --version on your Mac please. base64 --help too would be useful to understand what default version of base64 ships with the Mac (although I can't find a default that came with my Mac M3).

Before I make a PR, I'd like to first understand all the variations of the base64 binary. There seem to be 3 we are dealing with, one of which should never be installed to begin with.

This is the one that I am using and is part of coreutils package

base64 --version
base64 (GNU coreutils) 9.6
Copyright (C) 2025 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Simon Josefsson.

 base64 --help
Usage: base64 [OPTION]... [FILE]
Base64 encode or decode FILE, or standard input, to standard output.

With no FILE, or when FILE is -, read standard input.

Mandatory arguments to long options are mandatory for short options too.
  -d, --decode          decode data
  -i, --ignore-garbage  when decoding, ignore non-alphabet characters
  -w, --wrap=COLS       wrap encoded lines after COLS character (default 76).
                          Use 0 to disable line wrapping
      --help        display this help and exit
      --version     output version information and exit

The data are encoded as described for the base64 alphabet in RFC 4648.
When decoding, the input may contain newlines in addition to the bytes of
the formal base64 alphabet.  Use --ignore-garbage to attempt to recover
from any other non-alphabet bytes in the encoded stream.

GNU coreutils online help: <https://www.gnu.org/software/coreutils/>
Full documentation <https://www.gnu.org/software/coreutils/base64>
or available locally via: info '(coreutils) base64 invocation'

[krancour]

Not without the -w flag though right? Because when I tested the existing script from the docs, it did not wrap even on Linux. Only the number of characters it wraps differs on Linux vs Mac.

Using a large file to test on Sequoia:

$ which base64
/usr/bin/base64
$ base64 --version
FreeBSD base64
$ cat coverage.txt | base64 | wc -l
       1 # Single line by default
$ cat coverage.txt | base64 -w 64 | wc -l
   14365 # But -w is respected if supplied
$ docker run -it -v $(pwd):/test -w /test ubuntu:latest bash
$ which base64
/usr/bin/base64
$ base64 --version
base64 (GNU coreutils) 9.4
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Simon Josefsson.e data and print to standard output
$ cat coverage.txt | base64 | wc -l
12097 # Wrapping at 76 by default
$ cat coverage.txt | base64 -w 0 | wc -l
0 # -w 0 is respected if supplied
$ exit

Note a small discrepancy: wc -l counts lines on Mac and counts line breaks in Linux.

As far as I can tell, stock base64 binaries on Mac and Linux are both fine with -w 0.

I don't think we can (or should) get into dealing with all the possible alternate versions someone might be using. Perhaps a brief disclaimer that the script may require slight modifications on some systems would suffice.