From 1816fcccc573bca4773860396fd23eb8fef10f5d Mon Sep 17 00:00:00 2001
From: navigator <popsolutions.co@gmail.com>
Date: Thu, 8 Oct 2026 01:43:09 +0000
Subject: [PATCH] fix: the ACL fragment's comment keeps every line a comment

A line of the comment redis_acl_fragment writes into
/etc/redis/redis.conf.d/50-keel-secret.conf had lost its "#". The first
boot wrote it as it was, Redis read it as a directive and redis-server
refused to start ("Unresolved Configuration(s) Detected ... aborting"),
found by the headless boot of the Keel Redis 19.0-7 image.

tests/redis.bats: every line of the rendered fragment is a comment, a blank
or a user rule (it fails on the old text), and a real redis-server started
on the shipped 20-keel-acl.conf and the rendered fragment keeps running
until the timeout stops it. The workflow installs redis-server so the
second test runs in CI instead of skipping. unit-redis 1.0.4.
---
 .github/workflows/tests.yml            |  3 ++
 changelog                              | 13 +++++++++
 overlay/usr/lib/inithooks/lib/redis.sh |  2 +-
 tests/redis.bats                       | 39 ++++++++++++++++++++++++++
 version                                |  2 +-
 5 files changed, 57 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 5bdd378..108cec8 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -28,6 +28,9 @@ jobs:
     uses: keel-linux/.github/.github/workflows/test-shell.yml@main
     with:
       threshold: 100
+      # tests/redis.bats starts a real redis-server on the rendered ACL
+      # fragment; without it that test would skip and prove nothing here
+      apt-packages: redis-server
   package:
     # Only on a pull request: require-changelog reads the base commit from
     # github.event.pull_request.base.sha, which is empty on a push.
diff --git a/changelog b/changelog
index 5f529c4..04d7737 100644
--- a/changelog
+++ b/changelog
@@ -1,3 +1,16 @@
+unit-redis-1.0.4 (1) keel; urgency=low
+
+  * lib/redis.sh: a line of the comment redis_acl_fragment writes into
+    /etc/redis/redis.conf.d/50-keel-secret.conf had lost its "#", so the
+    first boot wrote a line Redis reads as a directive and redis-server
+    refused to start ("Unresolved Configuration ... aborting"); found by the
+    headless boot of the Redis 19.0-7 image. tests/redis.bats now checks that
+    every line of the rendered fragment is a comment, a blank or a user rule,
+    and starts a real redis-server on the shipped ACL file and the rendered
+    fragment; the workflow installs redis-server for it.
+
+ -- KeelLinux maintainers <admin@keellinux.org>  Thu, 08 Oct 2026 01:41:14 +0000
+
 unit-redis-1.0.3 (1) keel; urgency=low
 
   * bin/redispass.py draws its password box on the terminal.
diff --git a/overlay/usr/lib/inithooks/lib/redis.sh b/overlay/usr/lib/inithooks/lib/redis.sh
index 434edc6..41281cd 100644
--- a/overlay/usr/lib/inithooks/lib/redis.sh
+++ b/overlay/usr/lib/inithooks/lib/redis.sh
@@ -102,7 +102,7 @@ redis_acl_fragment() {
 # The password is not here and is not anywhere on this machine except the
 # file the description points at.
 #
-This file is the only place the account is declared. Redis refuses a
+# This file is the only place the account is declared. Redis refuses a
 # user declared twice across configuration files, so 20-keel-acl.conf names
 # no administrative account at all and this one names it once. Editing this
 # by hand is how an operator would change the account; the password itself
diff --git a/tests/redis.bats b/tests/redis.bats
index 1847373..c364583 100644
--- a/tests/redis.bats
+++ b/tests/redis.bats
@@ -162,3 +162,42 @@ setup() {
     [ "$(redis_masked s3cret)" = "(6 characters)" ]
     [[ "$(redis_masked s3cret)" != *s3cret* ]]
 }
+
+# --------------------------------------------- the fragment as Redis reads it
+
+@test "every line of the rendered fragment is a comment, blank, or a user rule" {
+    local hash line n=0
+    hash=$(printf '%s' secret | sha256sum | cut -d ' ' -f 1)
+    run redis_acl_fragment admin "$hash"
+    [ "$status" -eq 0 ]
+    while IFS= read -r line; do
+        n=$((n + 1))
+        [[ -z "$line" || "$line" == '#'* || "$line" == 'user '* ]] \
+            || { echo "line $n is neither a comment nor a rule: $line"; false; }
+    done <<< "$output"
+    [ "$n" -gt 1 ]
+}
+
+@test "redis-server starts with the shipped ACL file and the rendered fragment" {
+    command -v redis-server >/dev/null || skip "redis-server is not installed"
+    local hash dir="$BATS_TEST_TMPDIR/redis"
+    mkdir -p "$dir"
+    hash=$(printf '%s' secret | sha256sum | cut -d ' ' -f 1)
+    redis_acl_fragment admin "$hash" > "$dir/50-keel-secret.conf"
+    {
+        echo "port 0"
+        echo "unixsocket $dir/redis.sock"
+        echo "dir $dir"
+        echo "daemonize no"
+        echo "logfile \"\""
+        echo "include $BATS_TEST_DIRNAME/../overlay/etc/redis/redis.conf.d/20-keel-acl.conf"
+        echo "include $dir/50-keel-secret.conf"
+    } > "$dir/redis.conf"
+    # a configuration Redis refuses makes it exit at once; one it accepts
+    # keeps it running until the timeout stops it (status 124)
+    run timeout 3 redis-server "$dir/redis.conf"
+    echo "$output"
+    [ "$status" -eq 124 ]
+    [[ "$output" != *"Unresolved Configuration"* ]]
+    [[ "$output" != *"FATAL CONFIG FILE ERROR"* ]]
+}
diff --git a/version b/version
index 21e8796..ee90284 100644
--- a/version
+++ b/version
@@ -1 +1 @@
-1.0.3
+1.0.4