vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-04-28 03:49:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

fix(security): harden shell scripts - fix sed portability, curl HTTPS enforcement, token expiry (#1917)

Browse source 
- MEDIUM: Validate flyctl auth status before empty FLY_API_TOKEN fallback
  in provision.sh (fail fast instead of silent failure)
- LOW: Fix sed -i portability in qa.sh (use sed -i.bak for macOS compat)
- LOW: Increase FLY_API_TOKEN expiry from 2h to 8h in common.sh
- LOW: Add --proto '=https' to all curl -L calls in digitalocean scripts
  (6 files) to prevent HTTP downgrade on redirects

Fixes #1913

Agent: code-health

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
A 2026-02-25 03:23:32 -08:00 • committed by GitHub
parent 9d7175bc1b
commit 4994c28594
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 35 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

4
sh/e2e/lib/common.sh
View file

@ -83,7 +83,7 @@ require_env() {
# Check / generate FLY_API_TOKEN
if [ -z "${FLY_API_TOKEN:-}" ]; then
log_info "FLY_API_TOKEN not set, generating via flyctl..."
FLY_API_TOKEN=$(flyctl tokens create org personal --expiry 2h 2>/dev/null || true)
FLY_API_TOKEN=$(flyctl tokens create org personal --expiry 8h 2>/dev/null || true)
if [ -z "${FLY_API_TOKEN:-}" ]; then
log_warn "Could not generate token. Falling back to flyctl stored credentials."
# Validate flyctl is authenticated
@ -93,7 +93,7 @@ require_env() {
fi
else
export FLY_API_TOKEN
log_ok "Generated FLY_API_TOKEN (expires in 2h)"
log_ok "Generated FLY_API_TOKEN (expires in 8h)"
fi
fi