From 01ca0a7b09e84995bf2cdd32f2c115757dfd25d6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 15 Aug 2026 12:25:08 +0000
Subject: [PATCH] Fix leading-whitespace bug in garage key create output
 parsing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Garage's real CLI output pads labels with extra spaces for column
alignment ("Key ID:              GKxxxx"), not a single space like the
mocked test used ("Key ID: GKxxxx") — the fixed ": " field separator left
that padding stuck to the parsed value, so .env ended up with access
key/secret strings carrying leading whitespace inside the quotes.
Confirmed live by the user right after install. This would have broken S3
auth outright once actually used, since access keys have to match exactly.

Switched to ':[[:space:]]+' as a regex field separator, which consumes
however many spaces are actually there instead of assuming exactly one.
Verified against both the single-space and padded/aligned formats — both
now produce the identical clean value with no leading whitespace.
---
 services/garage.sh | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/services/garage.sh b/services/garage.sh
index 5653145..ba4720d 100644
--- a/services/garage.sh
+++ b/services/garage.sh
@@ -277,8 +277,15 @@ ENV
     local _key_out
     _key_out="$(docker exec garage /garage key create "$KEY_NAME" 2>&1)"
     local ACCESS_KEY_ID ACCESS_KEY_SECRET
-    ACCESS_KEY_ID="$(echo "$_key_out" | awk -F': ' '/^Key ID:/{print $2}')"
-    ACCESS_KEY_SECRET="$(echo "$_key_out" | awk -F': ' '/^Secret key:/{print $2}')"
+    # Garage's real CLI output pads labels with extra spaces for column
+    # alignment (e.g. "Key ID:              GKxxxx", not just "Key ID: GKxxxx")
+    # — a fixed ": " separator leaves that padding stuck to the value.
+    # ':[[:space:]]+' as a regex field separator consumes ALL of it,
+    # however many spaces there actually are. Confirmed live: the fixed
+    # single-space version left leading spaces baked into .env, which
+    # would have broken S3 auth (access keys have to match exactly).
+    ACCESS_KEY_ID="$(echo "$_key_out" | awk -F':[[:space:]]+' '/^Key ID:/{print $2}')"
+    ACCESS_KEY_SECRET="$(echo "$_key_out" | awk -F':[[:space:]]+' '/^Secret key:/{print $2}')"
 
     if [ -z "$ACCESS_KEY_ID" ] || [ -z "$ACCESS_KEY_SECRET" ]; then
         log_error "Couldn't parse the access key from 'garage key create' output:"