On Mon, Jul 06, 2026 at 14:55:57 -0400, Jeffrey Walton wrote: > On Mon, Jul 6, 2026 at 11:52 AM Vincent Lefevre <[email protected]> wrote: > > I've eventually found the issue. This is due to the newline character > > after the passphrase, which cryptroot-unlock doesn't remove! I could > > confirm with "echo -n <passphrase> | ssh ...", which works. > > > > I've reported the bug: > > > > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141580 > > > > (I thought I had tried with "printf %s <passphrase>" earlier, > > but I may have made a mistake in my test.)
In your bug report, you mention that you didn't want to use "echo -n <passphrase>" on a multi-user system. Presumably, this is because you want to avoid having the passphrase visible in "ps" or similar process listings. But echo is a shell builtin, in both bash and dash. Because it's a shell builtin, it will not be visible as a process. That said, "printf %s" is superior to "echo -n", because "echo -n" will potentially interpret some of the characters in its argument. "printf %s" is guaranteed not to do so. And printf is also a shell builtin, in both bash and dash, so it's also safe from being listed as a processm, just like echo. > It feels like something like IFS=$'\n\0' should be used somewhere, but > I guess not. This is not possible in shells. Shell variables are stored as C strings, in which the NUL byte marks the end of the string. It's simply impossible to include a NUL byte as a meaningful character in a string in a shell, even in special variables like IFS. If you execute IFS=$'\n\0' you will get exactly the same result as if you'd used IFS=$'\n'. There are tricks you can use in shells to handle streams of NUL-delimited data. The three most common are: * You can call tools like "xargs -0", "sort -z" and so on. * Bash has had "read -d" forever (since version 2.04), which lets read a single string terminated by a specific delimiter. It lets you pass the empty string '' as the delimiter, to signify the NUL byte. * Bash 4.4 and above also have "readarray -d", which lets you populate a shell array variable with elements read from a stream with a chosen delimiter. As with "read -d", you can pass '' as the delimiter to indicate a NUL-delimited input stream.
