magus v0.3.0 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
2 min read

MGS2011: secret too short to mask

A value read through magus\secret.read is shorter than four characters, so magus did NOT register it for redaction. The value is returned to the magusfile normally; only its protection is declined.

[MGS2011] secret "PIN" is shorter than 4 characters, so its value is NOT
redacted from magus output

Why

Redaction is literal substring replacement over everything magus persists: captured output, the raw log, the output store, the journal, and every log format. A two- or three-character value occurs constantly in ordinary text, so masking every occurrence would shred the logs you need while protecting something that was almost certainly never a credential. A build log reading gr*** a t***le is worse than useless.

magus therefore declines, and says so. It used to decline in silence, which left the caller with no way to discover that a value they treated as secret had nothing behind it.

This notice is informational, not an error. The read succeeded.

Resolution

Pick whichever applies:

  • It is not really a credential. A short flag, a version, a boolean. Read it with os\env instead; secret.read implies a protection it will not get here, and using it teaches the next reader the wrong thing.
  • It IS a credential. Rotate it to something longer. A credential short enough to trip this is short enough to guess, and no build tool can fix that. Four characters is the floor for masking, not a recommendation.
  • You cannot change it. Then treat its appearance in output as expected. Keep it out of anything that echoes: pass it through --mount=type=secret for a container build, or hand it to the tool on stdin rather than as an argument.

What magus does not claim

Registering a value for redaction is not protection - it is tidying. Even a long secret is only masked where magus can match it literally: a child that re-encodes it in a form magus does not register, or splits it across two writes, defeats the match. See concepts/secrets for the full list of limits, and for why the point of the feature is blast radius and dwell time rather than secrecy.

sandbox diagnosticsLanding page for the sandbox that confines magus spells to the workspace, plus its MGS2xxx diagnostics for denied reads, writes, execs, and env leaks. SecretsResolve credentials through a secret provider so magus knows a value is sensitive and redacts it from the run log, the terminal and the output store - with the built-in environment provider, spell-backed providers, and the limits stated plainly. magus stdlibReference for every magus stdlib module - fs, os, http, json, yaml, crypto, and the rest of the magusfile API surface. magusfile diagnosticsLanding page for MGS1xxx diagnostics that flag authoring mistakes in a workspace's magusfile, such as missing targets or unresolved declarations.
MGS2011secretsredactionprovidersecuritylogging
Last updated (a170f9b2)
Glossary

Magusfile

The magusfile.buzz that declares a project's targets (as export funs) and binds its spells. See targets.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.