From 4ef37ab52fd4942e9e9190ec6fefdf2ecde65755 Mon Sep 17 00:00:00 2001
From: Guillem Jover <gjover@sipwise.com>
Date: Wed, 31 Dec 2025 00:18:29 +0100
Subject: [PATCH] MT#62899 Improve secret key generation

If we generate the secret key and then change its permissions, we leave
a race-condition where an observer can try to open or read the contents
before the permissions have been reduced.

Improve the progress reporting to print a message when we start and once
we are done.

Change-Id: Idef205ae9e687a0439c68a58793477e9d8347836
---
 debian/repoapi.postinst | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/debian/repoapi.postinst b/debian/repoapi.postinst
index 52046cd..e37b276 100644
--- a/debian/repoapi.postinst
+++ b/debian/repoapi.postinst
@@ -25,10 +25,14 @@ case "$1" in
 
   configure)
     if ! [ -f "${LIB_DIR}/.secret_key" ] ; then
-      mk_dj_secret > "${LIB_DIR}/.secret_key"
+      printf "Generating repoapi secret_key file... "
+      (
+        umask 0077
+        mk_dj_secret >"${LIB_DIR}/.secret_key"
+      )
       chmod 600 "${LIB_DIR}/.secret_key"
       chown www-data:www-data "${LIB_DIR}/.secret_key"
-      echo "generated secret_key"
+      echo "done."
     fi
     cd "${USR_DIR}" && make venv_prod
     service uwsgi restart repoapi || true