arcsecond 3.17.1__tar.gz → 3.17.2__tar.gz

{arcsecond-3.17.1 → arcsecond-3.17.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: arcsecond
-Version: 3.17.1
+Version: 3.17.2
 Summary: CLI for arcsecond.io
 Project-URL: Homepage, https://github.com/arcsecond-io/cli
 Project-URL: Issues, https://github.com/arcsecond-io/cli/issues

{arcsecond-3.17.1 → arcsecond-3.17.2}/arcsecond/hosting/utils.py

@@ -42,8 +42,10 @@ def _read_env_value(key, env_path=None):
 
 
 def _get_random_secret_key():
-    # No '%' to avoid interpolation surprises
-    chars = "abcdefghijklmnopqrstuvwxyz0123456789!@#$^&*(-_=+)"
+    # The value lands unquoted in .env, which Compose interpolates: '$name'
+    # would be swallowed (with a "variable is not set" warning) and '%' is
+    # unsafe in configparser-style readers. Neither belongs in the alphabet.
+    chars = "abcdefghijklmnopqrstuvwxyz0123456789!@#^&*(-_=+)"
     return "".join(secrets.choice(chars) for _ in range(50))
 
 

{arcsecond-3.17.1 → arcsecond-3.17.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "arcsecond"
-version = "3.17.1"
+version = "3.17.2"
 authors = [
     { name = "Cedric Foellmi", email = "cedric@arcsecond.io" },
 ]

arcsecond-3.17.2/tests/test_hosting_utils_secret_key.py

@@ -0,0 +1,10 @@
+from arcsecond.hosting.utils import _get_random_secret_key
+
+
+def test_secret_key_has_no_compose_interpolation_characters():
+    # Compose interpolates '$name' inside .env; '%' trips configparser readers.
+    for _ in range(200):
+        key = _get_random_secret_key()
+        assert len(key) == 50
+        assert "$" not in key
+        assert "%" not in key

{arcsecond-3.17.1 → arcsecond-3.17.2}/uv.lock

@@ -155,7 +155,7 @@ wheels = [
 
 [[package]]
 name = "arcsecond"
-version = "3.17.1"
+version = "3.17.2"
 source = { editable = "." }
 dependencies = [
     { name = "alpyca" },