stacklok / toolhive / 21134104714

59%

Build Type

push

github

Committed by web-flow

Commit Message

Fix keyctl password not re-prompted after incorrect entry (#3334)

When a user mistypes their keyctl password on first invocation after
reboot, all subsequent ToolHive invocations would fail with
"cipher: message authentication failed" until reboot or manual reset.

Root cause: Password was stored in keyring before validating it could
decrypt the secrets file.

This fix implements:
- Two-phase password storage: GetSecretsPassword() now returns
  (password, isNew, error) and password is only stored after
  successful decryption validation via new StoreSecretsPassword()
- Fix deadlock in keyctl DeleteAll by extracting deleteKeyUnlocked()
- Fix cross-process deletion by searching kernel keyring directly
  instead of relying on in-memory map

Fixes #3332

Signed-off-by: Juan Antonio Osorio <ozz@stacklok.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Run Details

17 of 46 new or added lines in 3 files covered. (36.96%)

7 existing lines in 3 files now uncovered.

35380 of 59814 relevant lines covered (59.15%)

82.1 hits per line