fix: distinct RAND32 secrets, literal env writes, pinned kustomize (#547, #556)

utils/replace_rand32_in_env_files.sh

@@ -8,16 +8,26 @@ replace_rand32_in_env_files() {
         return
     fi
 
-    # Replace $(RAND32) with a random base64 encoded string in all non-example env files
+    # Replace each $(RAND32) with its OWN fresh random value. The previous global
+    # (g) sed used one value per file, so paired secrets came out identical
+    # (e.g. APP_KEY == ENC_SECRET, S3_ACCESS_KEY == S3_SECRET) and learning the
+    # semi-public one leaked its partner. Rewrite line by line using bash's
+    # replace-first substitution (not sed) so each occurrence gets a distinct
+    # value and no secret is ever interpreted as a sed pattern.
     for env_file in "$secrets_dir"/*.env; do
         if [[ -f "$env_file" && ! "$env_file" == *.example ]]; then
-            # Generate a random base64 encoded string
-            random_string=$(openssl rand -base64 32 | tr '/' '_' | tr '=' '_')
-            if [[ "$OSTYPE" == "darwin"* ]]; then
-                sed -i '' "s/\$(RAND32)/$random_string/g" "$env_file"
-            else
-                sed -i "s/\$(RAND32)/$random_string/g" "$env_file"
-            fi
+            local tmp_file
+            tmp_file=$(mktemp)
+            while IFS= read -r line || [[ -n "$line" ]]; do
+                while [[ "$line" == *'$(RAND32)'* ]]; do
+                    # base64 alphabet minus '/' and padding '='; the remaining
+                    # chars ([A-Za-z0-9+_]) are all literal in the replacement.
+                    random_string=$(openssl rand -base64 32 | tr '/' '_' | tr '=' '_')
+                    line=${line/'$(RAND32)'/$random_string}
+                done
+                printf '%s\n' "$line" >> "$tmp_file"
+            done < "$env_file"
+            mv "$tmp_file" "$env_file"
         fi
     done
 }

utils/setup_kustomize.sh

@@ -1,9 +1,25 @@
 #!/bin/bash
 
 setup_kustomize() {
-    if ! [ -f "$(dirname "$0")/kustomize" ] || ! [ -x "$(dirname "$0")/kustomize" ]
+    local dir
+    dir="$(dirname "$0")"
+    if ! [ -f "$dir/kustomize" ] || ! [ -x "$dir/kustomize" ]
     then
         echo "kustomize not found. Installing..."
-        curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" | bash
+        # Pin the installer to an immutable release tag rather than the moving
+        # `master` branch, and download-then-run instead of piping the network
+        # straight into bash. The installer itself checksum-verifies the
+        # kustomize binary it fetches for the requested version.
+        local version="5.5.0"
+        local script
+        script="$(mktemp)"
+        if curl -fsSL "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/kustomize/v${version}/hack/install_kustomize.sh" -o "$script"; then
+            bash "$script" "$version" "$dir"
+        else
+            echo "Failed to download kustomize installer" >&2
+            rm -f "$script"
+            return 1
+        fi
+        rm -f "$script"
     fi
 }

utils/update_env_var.sh

@@ -4,16 +4,20 @@ update_env_var() {
     local file=$1
     local key=$2
     local value=$3
-
-    if grep -q "^$key=" "$file" 2>/dev/null; then
-        # Key exists, update it
-        if [[ "$OSTYPE" == "darwin"* ]]; then
-            sed -i '' "s|^$key=.*|$key=$value|" "$file"
-        else
-            sed -i "s|^$key=.*|$key=$value|" "$file"
-        fi
-    else
-        echo "$key=$value" >> "$file"
+
+    # Never feed the value through sed: a secret containing sed metacharacters
+    # ('|' delimiter, '&', trailing '\') would corrupt or silently drop the
+    # value (a Steam password like 'p@ss|word' broke the substitution). Instead
+    # remove any existing line for the key, then append the value literally with
+    # printf. Env files are order-independent, so re-appending is safe.
+    if [ -f "$file" ] && grep -q "^$key=" "$file" 2>/dev/null; then
+        # `|| true`: when every surviving line is filtered out (a single-key
+        # file), grep exits 1; without this the mv would be skipped, leaving the
+        # stale line in place next to the appended one. The redirect writes the
+        # (possibly empty) tmp regardless, so mv always runs.
+        grep -v "^$key=" "$file" > "$file.tmp" 2>/dev/null || true
+        mv "$file.tmp" "$file"
     fi
+    printf '%s=%s\n' "$key" "$value" >> "$file"
 }