Skip to content

fix: remove trailing newline from connection detail output files#799

Merged
adrianriobo merged 1 commit into
redhat-developer:mainfrom
jangel97:fix-trailing-newline-in-secrets
May 14, 2026
Merged

fix: remove trailing newline from connection detail output files#799
adrianriobo merged 1 commit into
redhat-developer:mainfrom
jangel97:fix-trailing-newline-in-secrets

Conversation

@jangel97
Copy link
Copy Markdown
Contributor

Summary

The writeOutput function in pkg/provider/util/output/output.go appends "\n" to every value written to connection detail files (host, username, etc.). This trailing newline propagates through the Tekton task pipeline and causes SSH connection failures in downstream consumers.

Root cause

The full chain:

  1. mapt writes fedora\n to /opt/host-info/username (the +"\n" on line 25)
  2. The Tekton host-info-secret step base64-encodes the file contents into a Kubernetes Secret — the newline is faithfully encoded (ZmVkb3JhCg== instead of ZmVkb3Jh)
  3. Kubernetes decodes the Secret value back via secretKeyRef and sets the env var with the newline preserved: USERNAME=fedora\n
  4. Downstream tasks build an SSH command: ssh_cmd="ssh ... ${USERNAME}@${HOST}"
    With the newline, this becomes: ssh ... fedora\n@ec2-host\n
  5. When ${ssh_cmd} is expanded unquoted, bash word-splits on the newline, producing:
    [ssh] [...] [fedora] [@ec2-host]
    
  6. SSH interprets fedora as the hostname → "Could not resolve hostname fedora: Name or service not known"

Reproduction

Verified inside the quay.io/redhat-developer/mapt:v1.0.0-dev container:

=== WITH newline ===
ssh_cmd with cat -v:
ssh -o StrictHostKeyChecking=no fedora
@ec2-1-2-3-4.compute.amazonaws.com
Word split:
  [ssh]  [-o]  [StrictHostKeyChecking=no]  [fedora]  [@ec2-1-2-3-4.compute.amazonaws.com]

=== WITHOUT newline ===
ssh_cmd with cat -v:
ssh -o StrictHostKeyChecking=no fedora@ec2-1-2-3-4.compute.amazonaws.com
Word split:
  [ssh]  [-o]  [StrictHostKeyChecking=no]  [fedora@ec2-1-2-3-4.compute.amazonaws.com]

Fix

Remove the +"\n" from writeOutput. The output files are only consumed by the Tekton host-info-secret step which pipes them through base64 -w0 — no consumer depends on a trailing newline.

@adrianriobo
Copy link
Copy Markdown
Collaborator

@anjannath ^^ why did you added the newline?

Also @jangel97 that was added in the last commit, so instead of new commit can you just revert?

@adrianriobo
Copy link
Copy Markdown
Collaborator

Ok, so I think even better do not revert but add sanitizers within the tekton tasks i.e.

id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0)

trim the value before encoding so we will ensure it will work

@anjannath
Copy link
Copy Markdown
Collaborator

anjannath commented May 14, 2026

@anjannath ^^ why did you added the newline?

this was added to resolve issue #695 there it has reasoning around why new-line should be appended to end-of-file

A text file, under unix, consists of a series of lines, each of which ends with a newline character (\n). A file that is not empty and does not end with a newline is therefore not a text file.

@jangel97 jangel97 force-pushed the fix-trailing-newline-in-secrets branch from 5242090 to 9aa0801 Compare May 14, 2026 08:28
type: Opaque
data:
host: $(cat /opt/host-info/host | base64 -w0)
username: $(cat /opt/host-info/username | base64 -w0)
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It does not affect host?, that file should have now a new line too

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, host is also affected `output.go appends '\n' to all values written (host, username, id_rsa, etc.), so both need the trim. wdyt?

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah basically you wanna ensure any base64 encoding is trim..so basically any line that | base64 needs to be trimmed

@jangel97 jangel97 force-pushed the fix-trailing-newline-in-secrets branch from 9aa0801 to 3f64b3d Compare May 14, 2026 09:37
Strip trailing newlines from host, username, bastion_host, and
bastion_username values before base64 encoding them into Kubernetes
secrets. The output files may contain trailing newlines (added for
POSIX text file compliance), which when base64-encoded into secrets
cause SSH connection failures in downstream consumers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@jangel97 jangel97 force-pushed the fix-trailing-newline-in-secrets branch from 3f64b3d to f3aa666 Compare May 14, 2026 09:39
Copy link
Copy Markdown
Collaborator

@adrianriobo adrianriobo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@adrianriobo adrianriobo merged commit 83fe6f2 into redhat-developer:main May 14, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants