[mikeland73]

Summary

Fixes P0 bugs #1, #2, #3 and #6 from specs/bug-scan.md, and marks them as fixed in that file.

• Proof of concept "wrapper" binary #1 – env-var name validation (envsec/pkg/envsec/set.go): the name regex had no trailing $, so names like A/../../<otherProject>/prod/KEY or PATH=/evil:… passed validation. The first could overwrite another project's SSM secret; the second corrupted the env passed to exec. The regex is now anchored. This covers set and upload, which both go through SetMap.
• Implement Nixtest: a simple unit testing library for nix #2 – downloaded secrets were world-readable (envsec/pkg/envsec/download.go): envsec download now writes with 0600. An existing file has its permissions tightened to 0600 before it is truncated, so a failed chmod (for example on a file owned by another user) leaves the old contents intact.
• Update README, code of conduct, license, etc #3 – cached AWS credentials were world-readable (pkg/filecache): cache files are now written atomically (temp file + rename) with 0600, inside 0700 directories. Caches left by older versions are also tightened: the cache directory is chmodded to 0700 and a loose cache file to 0600 when read. This means valid, unexpired credentials from before the upgrade don't stay exposed. This protects the Cognito credentials cached by awsfed when ENVSEC_USE_AWS_STORE=1.
• Add ssh key to copybara action #6 – envsec download always failed (envsec/pkg/envcli/download.go): --format defaulted to "env", which ValidateFormat rejects. It now defaults to "", so plain envsec download .env works again and .json auto-detection runs.

Note: envsec pins go.jetify.com/pkg by version, so released envsec binaries get the filecache part of #3 after the usual internal-dependency bump.

How was it tested?

• New tests:
  • envsec/pkg/envsec/set_test.go: path-traversal, =, whitespace, newline and jetpack_ names are rejected.
  • envsec/pkg/envsec/download_test.go: an existing 0644 file ends up 0600 with the new contents.
  • envsec/pkg/envcli/download_test.go: the download command's real --format default passes ValidateFormat. It fails on main.
  • pkg/filecache/filecache_test.go:
    • Set produces a 0600 file in a 0700 dir, replaces a pre-existing 0644 file, and leaves no temp files behind.
    • A cache upgraded from 0755/0644 is tightened to 0700/0600 on a cache hit. This test fails without the fix.
• go vet, go test and golangci-lint v2.15.0 pass in envsec and pkg.

Community Contribution License

All community contributions in this pull request are licensed to the project maintainers under the terms of the Apache 2 License.

By creating this pull request I represent that I have the right to license the contributions to the project maintainers under the Apache 2 License as stated in the Community Contribution License.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Bqy92pq662Fgv5A4GoaUD2

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no new actionable issues remain.

Summary

This PR tightens secret names and file permissions, adds private atomic cache writes, and fixes the download command’s default format.

• Environment names must match the whole allowed name.
• Downloaded environment files are now private to their owner.
• Cached credentials are now stored in private files and folders.
• The download command now picks a valid format by filename.
• The bug-scan list now marks four envsec fixes as done.

All previous findings are addressed or explicitly accepted. mikeland73 accepted best-effort cache permission changes so reads retain their previous behavior when chmod fails.

_{Reviews (2) · Last reviewed commit: "envsec, filecache: address review findin..." · Reviewed by Greptile}