bash-herestring-newline-secrets

# Bash Here-String Newline in Secrets ## Problem When creating secrets using bash here-strings (`<<<`), a trailing newline is silently appended to the value. This causes authentication failures with misleading error messages that suggest the password/token is wrong when it's actually correct—just with an extra newline character. ## Context / Trigger Conditions - Secret created with: `gcloud secrets create NAME --data-file=- <<< "value"` - Or similar: `echo "value" | gcloud secrets create...` (echo adds newline by default) - Error messages like: - "password authentication failed for user X" - "invalid token" - "authentication failed" - The secret value appears correct when viewed - Works locally but fails when secret is used ## Solution **Wrong (adds newline):** ```bash gcloud secrets create my-secret --data-file=- <<< "mypassword" echo "mypassword" | gcloud secrets create my-secret --data-file=- ``` **Correct (no newline):** ```bash echo -n "mypassword" | gcloud secrets create my-secret --data-file=- printf '%s' "mypassword" | gcloud secrets create my-secret --data-file=- ``` **To fix an existing secret:** ```bash echo -n "correct-value" | gcloud secrets versions add my-secret --data-file=- ``` ## Verification Check the secret length to detect trailing newline: ```bash # Get secret and count bytes gcloud secrets versions access latest --secret=my-secret | wc -c # Compare to expected length (password length, not password length + 1) ``` Or use `xxd` to see the actual bytes: ```bash gcloud secrets versions access latest --secret=my-secret | xxd | tail -1 # Look for '0a' (newline) at the end ``` ## Example **Symptom:** ``` Database connection test failed: password authentication failed for user "crawler" ``` **Investigation:** ```bash $ gcloud secrets versions access latest --secret=my-db-password mypassword $ gcloud secrets versions access latest --secret=my-db-password | wc -c 11 # But password is only 10 characters! ``` **Fix:** ```bash $ echo -n "mypassword" | gcloud secrets versions add my-db-password --data-file=- Created version [2] of the secret [my-db-password]. ``` ## Notes - This affects any system that uses secrets: databases, APIs, tokens, etc. - The `<<<` here-string is a bash feature that ALWAYS adds a newline - `echo` also adds a newline by default; use `echo -n` or `printf '%s'` - Some systems trim whitespace from secrets, but many (like PostgreSQL) don't - When debugging auth failures, always check for trailing whitespace first ## References - Bash manual on here-strings: https://www.gnu.org/software/bash/manual/bash.html#Here-Strings