From 41dd030cd6414f0acf60a32dcc4de415966601d0 Mon Sep 17 00:00:00 2001 From: Craig Jennings Date: Tue, 16 Jun 2026 00:00:45 -0500 Subject: chore(scripts): warn when apikey.txt is group/other-readable The seed script reads the Linear key from the environment, but the README sources it from a gitignored `apikey.txt` that was landing at mode 644. `main` now warns on startup when that file is group- or other-accessible, so a loose key file gets flagged instead of sitting silently exposed. The warning points at `chmod 600`. --- scripts/seed_pearl_workspace.py | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to 'scripts/seed_pearl_workspace.py') diff --git a/scripts/seed_pearl_workspace.py b/scripts/seed_pearl_workspace.py index bc5300a..97079b6 100644 --- a/scripts/seed_pearl_workspace.py +++ b/scripts/seed_pearl_workspace.py @@ -41,6 +41,7 @@ Usage: import argparse import json import os +import stat import sys import urllib.request @@ -363,12 +364,31 @@ def seed(client): "default_issue_state": INTAKE_STATE if default_set else "unchanged"} +def warn_if_key_file_world_readable(path, stream=None): + """Warn when PATH exists and is readable by group or others. + + The key file holds a Linear API key, so group/other access is a leak risk. + Returns True when a warning was emitted, False otherwise (absent or 600).""" + if stream is None: + stream = sys.stderr + try: + mode = os.stat(path).st_mode + except OSError: + return False + if mode & (stat.S_IRWXG | stat.S_IRWXO): + print(f"warning: {path} is group/other-accessible; chmod 600 it " + "(it holds your Linear API key)", file=stream) + return True + return False + + def main(argv=None): parser = argparse.ArgumentParser(description="Seed a Pearl Linear workspace.") parser.add_argument("--dry-run", action="store_true", help="print the reconcile plan without changing anything") args = parser.parse_args(argv) + warn_if_key_file_world_readable("apikey.txt") api_key = os.environ.get("LINEAR_API_KEY") if not api_key: print("LINEAR_API_KEY is not set", file=sys.stderr) -- cgit v1.2.3