From dd2d3b59146f35c0a6a50e004dc00ef4ea4da1a8 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Sun, 19 Jul 2026 15:00:40 +1000 Subject: [PATCH] Fix prepare-host-key.sh: backticks in a double-quoted nix-shell --run string were parsed as command substitution by the outer shell MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The whole keygen+instructions block ran inside one big double-quoted nix-shell --run "..." string. Markdown-style `keys:` backticks in the instructions heredoc are live to the *outer* shell in that context (it parses the string before nix-shell ever sees it) — bash tried to run a command literally called "keys:", failed, and silently dropped the backtick-quoted text from the output. Split into two minimal, single-purpose nix-shell --run invocations (keygen, then age derivation into a captured variable) and moved the instructions to a plain heredoc in the outer script, where normal quoting rules apply and there's nothing left to misinterpret. Also resolves host-keys/ to an absolute path instead of the literal ./scripts/../host-keys/... that showed up in output before. Co-Authored-By: Claude Sonnet 5 --- scripts/prepare-host-key.sh | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/scripts/prepare-host-key.sh b/scripts/prepare-host-key.sh index 1277f55..51bd6e9 100755 --- a/scripts/prepare-host-key.sh +++ b/scripts/prepare-host-key.sh @@ -26,7 +26,7 @@ if [[ ! -f "$sops_yaml" ]]; then exit 1 fi -keydir="$(dirname "$0")/../host-keys" +keydir="$(cd "$(dirname "$0")/.." && pwd)/host-keys" mkdir -p "$keydir" keyfile="${keydir}/${hostname}_ssh_host_ed25519_key" @@ -35,16 +35,16 @@ if [[ -f "$keyfile" ]]; then exit 1 fi -nix-shell -p openssh ssh-to-age --run " - set -euo pipefail - ssh-keygen -t ed25519 -N '' -C '${hostname}' -f '${keyfile}' >/dev/null - age_pub=\$(ssh-to-age -i '${keyfile}.pub') - cat </dev/null + +age_pub="$(nix-shell -p ssh-to-age --run "ssh-to-age -i '${keyfile}.pub'")" + +cat <