From df4b6139d228743f38edef7ec95c339860f12d78 Mon Sep 17 00:00:00 2001 From: Brendan Kellam Date: Fri, 12 Jun 2026 12:27:31 -0700 Subject: [PATCH 1/3] fix(shared): validate SOURCEBOT_ENCRYPTION_KEY is 32 chars The key is used directly as a 32-byte AES-256-CBC key. Validate its length at startup so a misconfigured key fails fast with an actionable message instead of a RangeError deep in an encryption call. Co-Authored-By: Claude Opus 4.8 (1M context) --- packages/shared/src/env.server.ts | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/packages/shared/src/env.server.ts b/packages/shared/src/env.server.ts index b6d49327c..4b8d7d8ef 100644 --- a/packages/shared/src/env.server.ts +++ b/packages/shared/src/env.server.ts @@ -337,7 +337,13 @@ const options = { PERMISSION_SYNC_REPO_DRIVEN_ENABLED: booleanSchema.default('true'), EXPERIMENT_ASK_GH_ENABLED: booleanSchema.default('false'), - SOURCEBOT_ENCRYPTION_KEY: z.string(), + // Used as the key for AES-256-CBC encryption (@see shared/src/crypto.ts). + // The key is read as ASCII (1 char = 1 byte), so AES-256's 32-byte key + // requirement means this must be exactly 32 characters. Generate one with + // `openssl rand -base64 24` (24 random bytes => a 32-character base64 string). + SOURCEBOT_ENCRYPTION_KEY: z.string().length(32, { + message: "SOURCEBOT_ENCRYPTION_KEY must be exactly 32 characters (a 256-bit AES key). Generate one with `openssl rand -base64 24`.", + }), SOURCEBOT_INSTALL_ID: z.string().default("unknown"), SOURCEBOT_LIGHTHOUSE_URL: z.string().url().default("https://deployments.sourcebot.dev"), From def438b74eeba8aa4519da464ff8b12cafd3cd53 Mon Sep 17 00:00:00 2001 From: Brendan Kellam Date: Fri, 12 Jun 2026 12:27:49 -0700 Subject: [PATCH 2/3] docs: add CHANGELOG entry for #1305 Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 73582aabb..cff95faf2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Added the ability to configure email code and credentials login from the security settings. [#1303](https://github.com/sourcebot-dev/sourcebot/pull/1303) - Added a list of configured SSO providers from the security settings. [#1303](https://github.com/sourcebot-dev/sourcebot/pull/1303) +### Fixed +- Validated that `SOURCEBOT_ENCRYPTION_KEY` is exactly 32 characters at startup, failing fast with an actionable message instead of a runtime encryption error. [#1305](https://github.com/sourcebot-dev/sourcebot/pull/1305) + ## [5.0.2] - 2026-06-11 ### Changed From 1b7cffe3419708338fa5028fd2441ba1bd5c0f8b Mon Sep 17 00:00:00 2001 From: Brendan Kellam Date: Fri, 12 Jun 2026 12:34:00 -0700 Subject: [PATCH 3/3] test(shared): use a real 32-char SOURCEBOT_ENCRYPTION_KEY The test value was named "...-32-characters!" but was actually 34 chars, which now fails the length validation. Replace it with a true 32-character value. Co-Authored-By: Claude Opus 4.8 (1M context) --- packages/shared/vitest.config.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/shared/vitest.config.ts b/packages/shared/vitest.config.ts index 74728183f..35f8c7016 100644 --- a/packages/shared/vitest.config.ts +++ b/packages/shared/vitest.config.ts @@ -11,7 +11,7 @@ export default defineConfig({ SOURCEBOT_PUBLIC_KEY_PATH: '/tmp/test-key', NODE_ENV: 'test', CONFIG_PATH: '/tmp/test-config.json', - SOURCEBOT_ENCRYPTION_KEY: 'test-encryption-key-32-characters!', + SOURCEBOT_ENCRYPTION_KEY: 'test-encryption-key-32chars-pad!', SOURCEBOT_LIGHTHOUSE_URL: 'http://localhost:3003', } }