Follow-up from #1095 (review thread #1095 (comment)).
main.tf passes var.additional_arguments straight into scripts/start.sh.tftpl. The value is free-form: if it contains $(...), backticks or embedded double quotes, that text is spliced into the Bash source of the start script. Command substitutions then run while the script is evaluated, before xargs splits the intended arguments, and quotes can leave the launcher malformed.
AGENTS.md (template encoding rules) requires free-form strings to be passed as base64encode(var.foo) and decoded in the template with ARG_FOO=$(echo -n '${ARG_FOO}' | base64 -d).
Proposed change:
ADDITIONAL_ARGUMENTS : base64encode(var.additional_arguments) in main.tf- decode into a shell variable at the top of
start.sh.tftpl and keep the existing xargs parsing on the decoded value
- update the
custom_additional_arguments tftest and the "parses custom additional_arguments" container test, and add a case with a quote and a $(...) literal that must be passed through verbatim
This predates #1095 (the same interpolation existed in run.sh) and was kept out of that PR to limit its scope to the persistent, version-aware install.
Xum acted on behalf of @ibetitsmike when filing this issue.
Follow-up from #1095 (review thread #1095 (comment)).
main.tfpassesvar.additional_argumentsstraight intoscripts/start.sh.tftpl. The value is free-form: if it contains$(...), backticks or embedded double quotes, that text is spliced into the Bash source of the start script. Command substitutions then run while the script is evaluated, beforexargssplits the intended arguments, and quotes can leave the launcher malformed.AGENTS.md (template encoding rules) requires free-form strings to be passed as
base64encode(var.foo)and decoded in the template withARG_FOO=$(echo -n '${ARG_FOO}' | base64 -d).Proposed change:
ADDITIONAL_ARGUMENTS : base64encode(var.additional_arguments)inmain.tfstart.sh.tftpland keep the existingxargsparsing on the decoded valuecustom_additional_argumentstftest and the "parses custom additional_arguments" container test, and add a case with a quote and a$(...)literal that must be passed through verbatimThis predates #1095 (the same interpolation existed in
run.sh) and was kept out of that PR to limit its scope to the persistent, version-aware install.