Uh oh!
There was an error while loading. Please reload this page.
fix: normalize default SOURCEBOT_ENCRYPTION_KEY to 32 characters - #1311
Closed
brendan-kellam wants to merge 3 commits into
Closed
fix: normalize default SOURCEBOT_ENCRYPTION_KEY to 32 characters#1311brendan-kellam wants to merge 3 commits into
brendan-kellam wants to merge 3 commits into
Conversation
The default SOURCEBOT_ENCRYPTION_KEY in docker-compose is 33 zeros, which fails the 32-character (AES-256) length validation. Preprocess the value so the all-zeros default is trimmed to 32 characters before validation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
Caution Review failedPull request was closed or merged during review WalkthroughThe PR handles legacy ChangesEncryption Key Normalization
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/shared/src/env.server.ts`:
- Around line 344-355: The SOURCEBOT_ENCRYPTION_KEY preprocessing silently
normalizes the malformed 33-zero key pattern into a valid but cryptographically
weak 32-zero key without alerting the operator. Instead of silently accepting
this weak key, modify the preprocessing function to detect when this pattern is
provided and emit a warning or error message to inform the operator that they
are using a predictable all-zero encryption key and should rotate it
immediately. This ensures security implications are not hidden from deployments
using this migration path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 8f1a140d-f0f8-4867-9fbd-2eca574d762d
📒 Files selected for processing (2)
CHANGELOG.mdpackages/shared/src/env.server.ts
Comment on lines
+344
to
+355
| SOURCEBOT_ENCRYPTION_KEY: z.preprocess( | ||
| // @hack in our docker-compose.yml, we mistakenly used a | ||
| // encryption key with _33_ zeros. As a hacky mechanism to | ||
| // fix peoples deployments without requiring them to update | ||
| // their encryption key, we look for keys with this pattern | ||
| // and coerce them into _32_ zeros. | ||
| // @see https://github.com/sourcebot-dev/sourcebot/commit/e30e75e7af96308b3b063bb3aed8369f5b15aa2e | ||
| (value) => value === "0".repeat(33) ? "0".repeat(32) : value, | ||
| z.string().length(32, { | ||
| message: "SOURCEBOT_ENCRYPTION_KEY must be exactly 32 characters (a 256-bit AES key). Generate one with `openssl rand -base64 24`.", | ||
| }), | ||
| ), |
Contributor
There was a problem hiding this comment.
Avoid silently accepting the known weak all-zero encryption key.
This normalization fixes startup, but it also preserves a predictable key ("0".repeat(32)) for deployments that never rotate it, weakening encryption-at-rest guarantees.
Suggested mitigation
SOURCEBOT_ENCRYPTION_KEY: z.preprocess(
// `@hack` in our docker-compose.yml, we mistakenly used a
// encryption key with _33_ zeros. As a hacky mechanism to
// fix peoples deployments without requiring them to update
// their encryption key, we look for keys with this pattern
// and coerce them into _32_ zeros.
// `@see` https://github.com/sourcebot-dev/sourcebot/commit/e30e75e7af96308b3b063bb3aed8369f5b15aa2e
- (value) => value === "0".repeat(33) ? "0".repeat(32) : value,+ (value) => {+ if (value === "0".repeat(33)) {+ console.warn(+ "SOURCEBOT_ENCRYPTION_KEY default placeholder detected and normalized. Rotate to a unique 32-character key immediately.",+ );+ return "0".repeat(32);+ }+ return value;+ },
z.string().length(32, {
message: "SOURCEBOT_ENCRYPTION_KEY must be exactly 32 characters (a 256-bit AES key). Generate one with `openssl rand -base64 24`.",
}),
),Based on learnings from provided context, packages/shared/src/crypto.ts:18-47 consumes this env var directly as AES/HMAC key material, so predictable defaults materially reduce secrecy.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/shared/src/env.server.ts` around lines 344 - 355, The
SOURCEBOT_ENCRYPTION_KEY preprocessing silently normalizes the malformed 33-zero
key pattern into a valid but cryptographically weak 32-zero key without alerting
the operator. Instead of silently accepting this weak key, modify the
preprocessing function to detect when this pattern is provided and emit a
warning or error message to inform the operator that they are using a
predictable all-zero encryption key and should rotate it immediately. This
ensures security implications are not hidden from deployments using this
migration path.
Move the 33-zeros -> 32-zeros default key normalization out of the env schema and into encrypt()/decrypt() in crypto.ts, where the key is actually used. SOURCEBOT_ENCRYPTION_KEY is now a plain string in the env schema. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The default
SOURCEBOT_ENCRYPTION_KEYshipped indocker-compose.ymlis 33 zeros, but the env validation added in #1305 requires the key to be exactly 32 characters (a 256-bit AES key). This causes startup to fail with the default value.This is a hacky workaround: the all-zeros default (33 chars) is coerced to 32 chars inside
encrypt()anddecrypt()inpackages/shared/src/crypto.ts, where the key is actually used for AES-256.SOURCEBOT_ENCRYPTION_KEYis now a plain string in the env schema (the strict.length(32)check is removed so the default value loads). Any other key value is used unchanged.🤖 Generated with Claude Code
Summary by CodeRabbit