From 5227cd7f6e69ffb5af0dfe75bc1e16f8e9117411 Mon Sep 17 00:00:00 2001
From: notplants-bot <bot@notplants.invalid>
Date: Mon, 17 Aug 2026 00:12:15 +0000
Subject: [PATCH] tools/secrets.sh: EXIT trap must return 0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

scrub() ended in `[ -n "$WD" ] && { ... }`. As an EXIT trap, its status becomes the
script's status, so with WD unset every read-only command exited 1 while printing the correct
answer. Callers saw a silent false failure — tests/run.sh reported 'could not read
tailscale_authkey' having successfully read it.
---
 tools/secrets.sh | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/tools/secrets.sh b/tools/secrets.sh
index 87dba20..dc474d3 100755
--- a/tools/secrets.sh
+++ b/tools/secrets.sh
@@ -59,7 +59,16 @@ install_encrypted() {
 }
 
 workdir() { local d; d=$(mktemp -d "$DIR/.work.XXXXXX"); chmod 700 "$d"; echo "$d"; }
-scrub() { [ -n "${WD:-}" ] && { find "$WD" -type f -exec shred -u {} + 2>/dev/null || true; rm -rf "$WD"; }; }
+# NB: must return 0. As an EXIT trap its status becomes the script's status, and an
+# `[ -n "$WD" ] && ...` that is simply false would make every read-only command (get/list/verify)
+# exit 1 while printing a perfectly correct answer — a silent false failure in callers.
+scrub() {
+  if [ -n "${WD:-}" ]; then
+    find "$WD" -type f -exec shred -u {} + 2>/dev/null || true
+    rm -rf "$WD"
+  fi
+  return 0
+}
 trap scrub EXIT
 
 have_sops