Add gen-secret: generate bash/YAML/JSON-safe random strings
Outputs cryptographically random strings using only characters safe for unquoted use in bash, YAML, and JSON: [A-Za-z0-9._+\-:@^~] Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Paul O'Reilly
63
scripts/gen-secret
Executable file
63
scripts/gen-secret
Executable file
@@ -0,0 +1,63 @@
|
||||
#!/usr/bin/env bash
|
||||
set -uo pipefail
|
||||
|
||||
CHARSET='A-Za-z0-9._+\-:@^~'
|
||||
DEFAULT_LENGTH=32
|
||||
|
||||
usage() {
|
||||
cat <<'EOF'
|
||||
Usage: gen-secret [OPTIONS] [LENGTH]
|
||||
|
||||
Generate a cryptographically random string safe for bash, YAML, and JSON.
|
||||
|
||||
Arguments:
|
||||
LENGTH Number of characters (default: 32)
|
||||
|
||||
Options:
|
||||
-n, --dryrun Preview what would happen
|
||||
-h, --help Show this help
|
||||
EOF
|
||||
}
|
||||
|
||||
dryrun=false
|
||||
length=""
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
-h|--help)
|
||||
usage
|
||||
exit 0
|
||||
;;
|
||||
-n|--dryrun)
|
||||
dryrun=true
|
||||
shift
|
||||
;;
|
||||
-*)
|
||||
echo "Error: Unknown option: $1" >&2
|
||||
exit 1
|
||||
;;
|
||||
*)
|
||||
if [[ -n "$length" ]]; then
|
||||
echo "Error: Too many arguments" >&2
|
||||
exit 1
|
||||
fi
|
||||
length="$1"
|
||||
shift
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
length="${length:-$DEFAULT_LENGTH}"
|
||||
|
||||
if ! [[ "$length" =~ ^[0-9]+$ ]] || [[ "$length" -le 0 ]]; then
|
||||
echo "Error: Length must be a positive integer" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if $dryrun; then
|
||||
echo "[dryrun] Would generate a ${length}-character secret from charset: [${CHARSET}]"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
tr -dc "$CHARSET" < /dev/urandom | head -c "$length"
|
||||
echo
|
||||
82
specs/gen-secret.spec.md
Normal file
82
specs/gen-secret.spec.md
Normal file
@@ -0,0 +1,82 @@
|
||||
# gen-secret
|
||||
|
||||
## Purpose
|
||||
|
||||
Generate a cryptographically random string that is safe to embed unquoted in bash, YAML, and JSON without escaping.
|
||||
|
||||
## Usage
|
||||
|
||||
```
|
||||
gen-secret [OPTIONS] [LENGTH]
|
||||
```
|
||||
|
||||
### Arguments
|
||||
|
||||
| Argument | Default | Description |
|
||||
|----------|---------|-------------|
|
||||
| `LENGTH` | 32 | Number of characters in the generated secret |
|
||||
|
||||
### Flags
|
||||
|
||||
| Flag | Description |
|
||||
|------|-------------|
|
||||
| `--help`, `-h` | Show usage information |
|
||||
| `--dryrun`, `-n` | Print what would happen without generating a secret |
|
||||
|
||||
## Character Set
|
||||
|
||||
The output uses only characters that need no escaping in bash (unquoted assignment), YAML (plain scalar), and JSON (string value):
|
||||
|
||||
```
|
||||
A-Z a-z 0-9 . _ + - : @ ^ ~
|
||||
```
|
||||
|
||||
**Excluded** (unsafe in at least one context): `"`, `'`, `\`, `` ` ``, `$`, `!`, `{`, `}`, `(`, `)`, `[`, `]`, `#`, `%`, `&`, `|`, `<`, `>`, `*`, `?`, `;`, `,`, `=`, space, tab, newline, `/`
|
||||
|
||||
Note: `/` is excluded because YAML plain scalars starting with `//` or containing `#` after a space can cause issues, and removing `/` keeps the set simpler without meaningful entropy loss.
|
||||
|
||||
## Behaviour
|
||||
|
||||
1. Validate that LENGTH is a positive integer.
|
||||
2. Read random bytes from `/dev/urandom`.
|
||||
3. Filter to the allowed character set.
|
||||
4. Output exactly LENGTH characters followed by a newline.
|
||||
5. Exit 0 on success.
|
||||
|
||||
## Dryrun Behaviour
|
||||
|
||||
When `--dryrun` or `-n` is passed:
|
||||
|
||||
```
|
||||
[dryrun] Would generate a 32-character secret from charset: [A-Za-z0-9._+\-:@^~]
|
||||
```
|
||||
|
||||
(Substituting the actual length if provided.)
|
||||
|
||||
No random output is produced.
|
||||
|
||||
## Edge Cases
|
||||
|
||||
| Case | Handling |
|
||||
|------|----------|
|
||||
| LENGTH is 0 | Error: "Length must be a positive integer", exit 1 |
|
||||
| LENGTH is negative | Error: "Length must be a positive integer", exit 1 |
|
||||
| LENGTH is not a number | Error: "Length must be a positive integer", exit 1 |
|
||||
| No arguments | Default to 32 |
|
||||
| Multiple arguments | Error: "Too many arguments", exit 1 |
|
||||
|
||||
## Examples
|
||||
|
||||
```bash
|
||||
# Default 32-character secret
|
||||
$ gen-secret
|
||||
xQ9.kT3+mR7:nW2@pF5^bY8~cH4_dL6a
|
||||
|
||||
# Custom length
|
||||
$ gen-secret 64
|
||||
xQ9.kT3+mR7:nW2@pF5^bY8~cH4_dL6axQ9.kT3+mR7:nW2@pF5^bY8~cH4_dL6a
|
||||
|
||||
# Dryrun
|
||||
$ gen-secret -n 16
|
||||
[dryrun] Would generate a 16-character secret from charset: [A-Za-z0-9._+\-:@^~]
|
||||
```
|
||||
120
tests/test-gen-secret.sh
Executable file
120
tests/test-gen-secret.sh
Executable file
@@ -0,0 +1,120 @@
|
||||
#!/usr/bin/env bash
|
||||
set -uo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
GEN_SECRET="$SCRIPT_DIR/scripts/gen-secret"
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
NC='\033[0m'
|
||||
|
||||
pass=0
|
||||
fail=0
|
||||
|
||||
assert_eq() {
|
||||
local desc="$1" expected="$2" actual="$3"
|
||||
if [[ "$expected" == "$actual" ]]; then
|
||||
echo -e "${GREEN}PASS${NC}: $desc"
|
||||
((pass++))
|
||||
else
|
||||
echo -e "${RED}FAIL${NC}: $desc"
|
||||
echo " expected: $expected"
|
||||
echo " actual: $actual"
|
||||
((fail++))
|
||||
fi
|
||||
}
|
||||
|
||||
assert_match() {
|
||||
local desc="$1" pattern="$2" actual="$3"
|
||||
if [[ "$actual" =~ $pattern ]]; then
|
||||
echo -e "${GREEN}PASS${NC}: $desc"
|
||||
((pass++))
|
||||
else
|
||||
echo -e "${RED}FAIL${NC}: $desc"
|
||||
echo " pattern: $pattern"
|
||||
echo " actual: $actual"
|
||||
((fail++))
|
||||
fi
|
||||
}
|
||||
|
||||
assert_exit() {
|
||||
local desc="$1" expected="$2" actual="$3"
|
||||
if [[ "$expected" -eq "$actual" ]]; then
|
||||
echo -e "${GREEN}PASS${NC}: $desc"
|
||||
((pass++))
|
||||
else
|
||||
echo -e "${RED}FAIL${NC}: $desc"
|
||||
echo " expected exit: $expected"
|
||||
echo " actual exit: $actual"
|
||||
((fail++))
|
||||
fi
|
||||
}
|
||||
|
||||
echo "=== gen-secret tests ==="
|
||||
echo
|
||||
|
||||
# --- Dryrun tests ---
|
||||
|
||||
out=$("$GEN_SECRET" --dryrun 2>&1)
|
||||
assert_eq "dryrun default length" \
|
||||
'[dryrun] Would generate a 32-character secret from charset: [A-Za-z0-9._+\-:@^~]' \
|
||||
"$out"
|
||||
|
||||
out=$("$GEN_SECRET" -n 16 2>&1)
|
||||
assert_eq "dryrun custom length" \
|
||||
'[dryrun] Would generate a 16-character secret from charset: [A-Za-z0-9._+\-:@^~]' \
|
||||
"$out"
|
||||
|
||||
# --- Help ---
|
||||
|
||||
out=$("$GEN_SECRET" --help 2>&1)
|
||||
rc=$?
|
||||
assert_exit "help exits 0" 0 "$rc"
|
||||
assert_match "help mentions LENGTH" "LENGTH" "$out"
|
||||
|
||||
# --- Default generation ---
|
||||
|
||||
out=$("$GEN_SECRET" 2>&1)
|
||||
rc=$?
|
||||
assert_exit "default exits 0" 0 "$rc"
|
||||
assert_eq "default length is 32" 32 "${#out}"
|
||||
assert_match "default uses safe charset" '^[A-Za-z0-9._+:@^~-]+$' "$out"
|
||||
|
||||
# --- Custom length ---
|
||||
|
||||
out=$("$GEN_SECRET" 64 2>&1)
|
||||
assert_eq "custom length 64" 64 "${#out}"
|
||||
|
||||
out=$("$GEN_SECRET" 1 2>&1)
|
||||
assert_eq "minimum length 1" 1 "${#out}"
|
||||
|
||||
# --- Error cases ---
|
||||
|
||||
out=$("$GEN_SECRET" 0 2>&1)
|
||||
rc=$?
|
||||
assert_exit "length 0 exits 1" 1 "$rc"
|
||||
assert_match "length 0 error message" "positive integer" "$out"
|
||||
|
||||
out=$("$GEN_SECRET" -5 2>&1)
|
||||
rc=$?
|
||||
assert_exit "negative length exits 1" 1 "$rc"
|
||||
|
||||
out=$("$GEN_SECRET" abc 2>&1)
|
||||
rc=$?
|
||||
assert_exit "non-numeric exits 1" 1 "$rc"
|
||||
assert_match "non-numeric error message" "positive integer" "$out"
|
||||
|
||||
out=$("$GEN_SECRET" 10 20 2>&1)
|
||||
rc=$?
|
||||
assert_exit "too many args exits 1" 1 "$rc"
|
||||
assert_match "too many args error message" "Too many arguments" "$out"
|
||||
|
||||
# --- Summary ---
|
||||
|
||||
echo
|
||||
total=$((pass + fail))
|
||||
echo -e "Results: ${GREEN}${pass}${NC}/${total} passed"
|
||||
if [[ $fail -gt 0 ]]; then
|
||||
echo -e "${RED}${fail} test(s) failed${NC}"
|
||||
exit 1
|
||||
fi
|
||||
Reference in New Issue
Block a user