Environment: Ubuntu 24.04.4, Python 3.12.3, cathedral-cli@a663cdb.
cathedral secret set fails on every call, regardless of input:
$ echo "value" | ./cathedral secret set TEST_KEY
✗ internal error in `secret.set`: AttributeError
This is a bug in the node, not in your setup.
Exit code 70 (INTERNAL). Traceback from the crash log:
File "cathedral_node/commands/secret_cmd.py", line 46, in secret_set
AttributeError: module 'cathedral_node.config' has no attribute 'is_forbidden_secret'
secret_cmd.py:46 calls config.is_forbidden_secret(name). That symbol appears exactly once in the repository — at this call site. It is never defined:
$ grep -rn "is_forbidden_secret" --include=*.py .
./cathedral_node/commands/secret_cmd.py:46: if config.is_forbidden_secret(name):
Impact: the documented way to store credentials does not work at all, so no secret can be set on any node.
This is also the cause of all three TestSecretHandling failures in gate 0 (test_a_secret_is_read_from_stdin_and_never_echoed, test_listing_secrets_never_reveals_one, test_the_secret_file_is_owner_only).
Worth stating explicitly: those names read like a secret-disclosure problem, but they are downstream of the command never running — the secret is never written, so listing finds nothing and the file does not exist. No secret is leaked.
Environment: Ubuntu 24.04.4, Python 3.12.3,
cathedral-cli@a663cdb.cathedral secret setfails on every call, regardless of input:Exit code 70 (
INTERNAL). Traceback from the crash log:secret_cmd.py:46callsconfig.is_forbidden_secret(name). That symbol appears exactly once in the repository — at this call site. It is never defined:Impact: the documented way to store credentials does not work at all, so no secret can be set on any node.
This is also the cause of all three
TestSecretHandlingfailures in gate 0 (test_a_secret_is_read_from_stdin_and_never_echoed,test_listing_secrets_never_reveals_one,test_the_secret_file_is_owner_only).Worth stating explicitly: those names read like a secret-disclosure problem, but they are downstream of the command never running — the secret is never written, so listing finds nothing and the file does not exist. No secret is leaked.