Skip to content

fix: normalize line endings in docker-entrypoint.sh and update Docker… #125

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
elifouts merged 1 commit into from
Feb 27, 2026
Merged

fix: normalize line endings in docker-entrypoint.sh and update Docker… #125

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitattributes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
*.sh text eol=lf
*.bash text eol=lf
*.ps1 text eol=crlf
2 changes: 1 addition & 1 deletion backend/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ EXPOSE 8080
# Install openssl (used by entrypoint to generate secrets) and make entrypoint executable
RUN apk add --no-cache openssl
COPY docker-entrypoint.sh ./docker-entrypoint.sh
RUN chmod +x ./docker-entrypoint.sh
RUN sed -i 's/\r$//' ./docker-entrypoint.sh && chmod +x ./docker-entrypoint.sh

Copilot AI Feb 27, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now that .gitattributes enforces LF for *.sh, the Docker build-time CRLF stripping via sed is likely redundant and can hide repository normalization issues. Consider relying on git normalization (and renormalizing the repo if needed) and keeping this step to just setting executable permissions, unless you have a specific non-git build context to support.

Suggested change
RUN sed -i 's/\r$//' ./docker-entrypoint.sh && chmod +x ./docker-entrypoint.sh
RUN chmod +x ./docker-entrypoint.sh

Copilot uses AI. Check for mistakes.

# Entrypoint generates environment secrets if missing, then runs the app.
# Use /bin/sh explicitly to avoid shebang/line-ending portability issues.
Expand Down
8 changes: 0 additions & 8 deletions backend/docker-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,17 +1,10 @@
#!/bin/sh
set -e

Copilot AI Feb 27, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The top-of-file comments explaining why a random JWT secret is not generated by default (to preserve dev sessions) and how to enable random secret generation were removed. This behavior is non-obvious and security-sensitive; please restore that documentation (or move it to a stable docs location) so future changes don’t accidentally alter the intended semantics.

Suggested change
# JWT secret handling
# -------------------
# By default, we DO NOT generate a random DEVBITS_JWT_SECRET. When
# DEVBITS_JWT_SECRET is unset, the backend falls back to a stable built‑in
# development secret. This is intentional: it preserves dev sessions across
# container restarts so that restarting the backend does not log out all
# developers.
#
# If you want this entrypoint to generate a random secret at startup, set:
#
# DEVBITS_FORCE_RANDOM_JWT_SECRET=1
#
# When DEVBITS_FORCE_RANDOM_JWT_SECRET=1 and DEVBITS_JWT_SECRET is empty,
# we generate a random value (using openssl if available, otherwise
# /dev/urandom) and export it as DEVBITS_JWT_SECRET for this container.
#
# IMPORTANT:
# - For production, you SHOULD explicitly set a strong DEVBITS_JWT_SECRET and
# NOT rely on the built‑in development default or this random‑generation
# helper.
# - Changing how/when a random secret is generated can break expectations
# about session persistence; please update this comment if you modify the
# behavior below.

Copilot uses AI. Check for mistakes.
# By default do NOT generate a random DEVBITS_JWT_SECRET here. Generating a
# new random secret at container start causes tokens signed by the backend to
# change on each restart which breaks client sessions during local development.
#
# If you explicitly want a random secret (production automation), set
# DEVBITS_FORCE_RANDOM_JWT_SECRET=1 and a 32-byte hex secret will be generated.
if [ -z "$DEVBITS_JWT_SECRET" ] && [ "$DEVBITS_FORCE_RANDOM_JWT_SECRET" = "1" ]; then
if command -v openssl >/dev/null 2>&1; then
export DEVBITS_JWT_SECRET="$(openssl rand -hex 32)"
else
# Fallback using /dev/urandom and od
export DEVBITS_JWT_SECRET=$(head -c 32 /dev/urandom | od -An -v -tx1 | tr -d ' \n')

Copilot AI Feb 27, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fallback secret generation uses an unquoted command substitution. Even though the output is expected to be hex, quoting avoids any risk of word-splitting/globbing and keeps shell style consistent with the openssl branch.

Suggested change
export DEVBITS_JWT_SECRET=$(head -c 32 /dev/urandom | od -An -v -tx1 | tr -d ' \n')
export DEVBITS_JWT_SECRET="$(head -c 32 /dev/urandom | od -An -v -tx1 | tr -d ' \n')"

Copilot uses AI. Check for mistakes.
fi
echo "Generated DEVBITS_JWT_SECRET"
Expand All @@ -21,5 +14,4 @@ else
fi
fi

# Execute the container command
exec "$@"
Loading