fix: random secret names for registry and MinIO credentials

crossplane/push.go

@@ -2,10 +2,9 @@ package main
 
 import (
 	"context"
-	"crypto/sha256"
+	"crypto/rand"
 	"dagger/crossplane/internal/dagger"
 	reg "dagger/crossplane/registry"
-	"encoding/hex"
 )
 
 // Push Crossplane Package
@@ -51,9 +50,9 @@ func (m *Crossplane) Push(
 
 // dockerConfigSecret wraps a docker config.json as a Secret, so it is mounted
 // instead of passed as an op argument, which --progress plain prints (#318).
-// The name is derived from the content, so different credentials never share
-// one secret name within a session.
+// The name is random per call: secret names can appear in traces, and a name
+// derived from the content (an unsalted hash of the base64 credential) lets a
+// guessed password be confirmed offline.
 func dockerConfigSecret(configJSON string) *dagger.Secret {
-	sum := sha256.Sum256([]byte(configJSON))
-	return dag.SetSecret("docker-config-"+hex.EncodeToString(sum[:8]), configJSON)
+	return dag.SetSecret("docker-config-"+rand.Text(), configJSON)
 }

flux/push.go

@@ -2,10 +2,9 @@ package main
 
 import (
 	"context"
-	"crypto/sha256"
+	"crypto/rand"
 	"dagger/flux/internal/dagger"
 	reg "dagger/flux/registry"
-	"encoding/hex"
 	"fmt"
 )
 
@@ -149,9 +148,9 @@ func (m *Flux) PushArtifacts(
 
 // dockerConfigSecret wraps a docker config.json as a Secret, so it is mounted
 // instead of passed as an op argument, which --progress plain prints (#318).
-// The name is derived from the content, so different credentials never share
-// one secret name within a session.
+// The name is random per call: secret names can appear in traces, and a name
+// derived from the content (an unsalted hash of the base64 credential) lets a
+// guessed password be confirmed offline.
 func dockerConfigSecret(configJSON string) *dagger.Secret {
-	sum := sha256.Sum256([]byte(configJSON))
-	return dag.SetSecret("docker-config-"+hex.EncodeToString(sum[:8]), configJSON)
+	return dag.SetSecret("docker-config-"+rand.Text(), configJSON)
 }

helm/push.go

@@ -2,10 +2,9 @@ package main
 
 import (
 	"context"
-	"crypto/sha256"
+	"crypto/rand"
 	"dagger/helm/internal/dagger"
 	reg "dagger/helm/registry"
-	"encoding/hex"
 	"fmt"
 )
 
@@ -66,9 +65,9 @@ func (m *Helm) Push(
 
 // dockerConfigSecret wraps a docker config.json as a Secret, so it is mounted
 // instead of passed as an op argument, which --progress plain prints (#318).
-// The name is derived from the content, so different credentials never share
-// one secret name within a session.
+// The name is random per call: secret names can appear in traces, and a name
+// derived from the content (an unsalted hash of the base64 credential) lets a
+// guessed password be confirmed offline.
 func dockerConfigSecret(configJSON string) *dagger.Secret {
-	sum := sha256.Sum256([]byte(configJSON))
-	return dag.SetSecret("docker-config-"+hex.EncodeToString(sum[:8]), configJSON)
+	return dag.SetSecret("docker-config-"+rand.Text(), configJSON)
 }

hugo/export.go

@@ -2,9 +2,8 @@ package main
 
 import (
 	"context"
-	"crypto/sha256"
+	"crypto/rand"
 	"dagger/hugo/internal/dagger"
-	"encoding/hex"
 	"fmt"
 	"strconv"
 	"strings"
@@ -169,8 +168,9 @@ func (m *Hugo) SyncMinioBucket(
 	}
 
 	mcHostURL := fmt.Sprintf("https://%s:%s@%s", accessKeyStr, secretKeyStr, endpoint) // # pragma: allowlist secret
-	mcHostSum := sha256.Sum256([]byte(mcHostURL))
-	mcHost := dag.SetSecret("mc-host-"+hex.EncodeToString(mcHostSum[:8]), mcHostURL)
+	// Random name: secret names can appear in traces, and a hash of the URL
+	// would let guessed MinIO keys be confirmed offline.
+	mcHost := dag.SetSecret("mc-host-"+rand.Text(), mcHostURL)
 
 	var repoContent *dagger.Directory
 	repoContent = dag.Directory()

oci/push.go

@@ -2,10 +2,9 @@ package main
 
 import (
 	"context"
-	"crypto/sha256"
+	"crypto/rand"
 	"dagger/oci/internal/dagger"
 	reg "dagger/oci/registry"
-	"encoding/hex"
 	"fmt"
 )
 
@@ -153,9 +152,9 @@ func (m *Oci) PushArtifacts(
 
 // dockerConfigSecret wraps a docker config.json as a Secret, so it is mounted
 // instead of passed as an op argument, which --progress plain prints (#318).
-// The name is derived from the content, so different credentials never share
-// one secret name within a session.
+// The name is random per call: secret names can appear in traces, and a name
+// derived from the content (an unsalted hash of the base64 credential) lets a
+// guessed password be confirmed offline.
 func dockerConfigSecret(configJSON string) *dagger.Secret {
-	sum := sha256.Sum256([]byte(configJSON))
-	return dag.SetSecret("docker-config-"+hex.EncodeToString(sum[:8]), configJSON)
+	return dag.SetSecret("docker-config-"+rand.Text(), configJSON)
 }