fix: secure .key file permissions and add integrity validation (#706) #803

Open

sleepy wants to merge 0 commits from fix/key-file-permissions-706 into main

sleepy commented

2026-06-03 16:00:12 +02:00

Owner

Fixes #706

Summary

Three security improvements to src/api_key_manager.py:

File permissions (0o600): The .key file is now chmod 0o600 immediately after creation, using the project's existing safe_chmod from core.platform_compat (same pattern as secret_storage.py and integrations.py). No-ops on Windows.
Key file integrity validation: get_or_create_key() now checks the key file length (Fernet keys are 44 bytes url-safe base64). If the file is corrupt, empty, or wrong length, it logs an error and regenerates the key.
Code cleanup: Extracted _generate_key() helper to centralize key creation + permission setting.

Out of scope

Issue item 4 (load() decrypts all keys on every call) is out of scope for this fix.

Testing

6 new tests in tests/test_api_key_manager.py (all passing)
Existing security regression tests unaffected (48/48 pass)

Fixes #706 ## Summary Three security improvements to src/api_key_manager.py: 1. **File permissions (0o600)**: The .key file is now chmod 0o600 immediately after creation, using the project's existing safe_chmod from core.platform_compat (same pattern as secret_storage.py and integrations.py). No-ops on Windows. 2. **Key file integrity validation**: get_or_create_key() now checks the key file length (Fernet keys are 44 bytes url-safe base64). If the file is corrupt, empty, or wrong length, it logs an error and regenerates the key. 3. **Code cleanup**: Extracted _generate_key() helper to centralize key creation + permission setting. ### Out of scope - Issue item 4 (load() decrypts all keys on every call) is out of scope for this fix. ### Testing - 6 new tests in tests/test_api_key_manager.py (all passing) - Existing security regression tests unaffected (48/48 pass)

sleepy added 1 commit

2026-06-03 16:00:12 +02:00

fix: secure .key file permissions and add integrity validation 46863f5529

Issue: #706

- Add safe_chmod(path, 0o600) after writing the Fernet key file, using
  the project's existing core.platform_compat.safe_chmod (cross-platform,
  no-ops on Windows).
- Validate key file length (must be 44 bytes / url-safe base64) before
  use; regenerate with a warning if corrupt or wrong length.
- Extract _generate_key() helper to avoid duplication.
- Add tests: 0o600 permissions, corrupt/empty key regeneration,
  encrypt/decrypt round-trip, save/load.

This branch is already included in the target branch. There is nothing to merge.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/key-file-permissions-706:fix/key-file-permissions-706

git switch fix/key-file-permissions-706

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff fix/key-file-permissions-706

git switch fix/key-file-permissions-706

git rebase main

git switch main

git merge --ff-only fix/key-file-permissions-706

git switch fix/key-file-permissions-706

git rebase main

git switch main

git merge --no-ff fix/key-file-permissions-706

git switch main

git merge --squash fix/key-file-permissions-706