security: MQTT password embedded in decode_pickle.sh at HEAD

time commented

2026-09-17 23:32:57 +00:00

Contributor

decode_pickle.sh:53 (introduced in commit 9e058d5, on origin/main and origin/fix/wdt-sleep-mode) contains a full MQTT URL with an embedded password: mqtt://ha.cryogen.cc:1883,user=pickle,pass=98fvn...,base=pickle,... The same credentials also exist in untracked working-tree files (decode_pickle_tcp.sh, decode_pickle_soapy.sh, decode_pickle.sh.bkp) — one git add . away from being committed. Fix: rotate the pickle MQTT credential on the broker, replace the URL at HEAD with env vars/placeholders, and clean up the untracked copies. Repo is private as of 2026-09-14, so history rewrite is deferred.

decode_pickle.sh:53 (introduced in commit 9e058d5, on origin/main and origin/fix/wdt-sleep-mode) contains a full MQTT URL with an embedded password: mqtt://ha.cryogen.cc:1883,user=pickle,pass=98fvn...,base=pickle,... The same credentials also exist in untracked working-tree files (decode_pickle_tcp.sh, decode_pickle_soapy.sh, decode_pickle.sh.bkp) — one `git add .` away from being committed. Fix: rotate the pickle MQTT credential on the broker, replace the URL at HEAD with env vars/placeholders, and clean up the untracked copies. Repo is private as of 2026-09-14, so history rewrite is deferred.

time commented

2026-09-18 04:06:36 +00:00

Author

Contributor

Fix approach decided: move MQTT creds to a gitignored .env at the repo root (same pattern as wxShark's config.py/python-dotenv setup). Commit a .env.example with blank MQTT_USER/MQTT_PASSWORD; decode_pickle.sh sources .env and builds the rtl_433 -F URL from it, with a clear error if .env is missing. .bashrc rejected: only loaded in interactive shells (breaks cron/systemd/direct invocation) and pollutes every shell with a live password. Prereq: rotate the pickle broker credential before putting the new value in .env. Untracked decode_pickle_{tcp,soapy}.sh get the same treatment locally.

time referenced this issue from a pull request that will close it,

2026-09-18 04:09:51 +00:00

fix: move MQTT credentials from decode script to gitignored .env #52

time commented

2026-09-18 04:10:06 +00:00

Author

Contributor

Fix in PR #52 (branch fix/mqtt-creds-env): decode_pickle.sh now reads MQTT creds from gitignored .env; .env.example committed. Untracked decode_pickle_{tcp,soapy}.sh updated locally the same way. Remaining: rotate the pickle broker credential, put the new value in .env, then rewrite history (git filter-repo) before any public push.

daru closed this issue

2026-09-18 04:19:01 +00:00

Rows
Columns

security: MQTT password embedded in decode_pickle.sh at HEAD #51