Development record
The machine credential file (internal/core/credential, ~/.abcd/credentials.json) is decoded with plain json.Unmarshal, so a duplicate key silently takes the last value instead of being refused; the strict duplicate-key decoder (jsonstrict) lives on an unmerged lane, not on this base.
issueresolvedminoriss-2609260120380520
The machine credential file (internal/core/credential, ~/.abcd/credentials.json) is decoded with plain json.Unmarshal, so a duplicate key silently takes the last value instead of being refused; the strict duplicate-key decoder (jsonstrict) lives on an unmerged lane, not on this base.
Grounds
- pursued: a credentials.json naming one credential twice is refused rather than resolved to either value; a store with a repeated or case-twin key that Resolve answers would show it wrong
Frontmatter
| id | iss-2609260120380520 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2609260120380520-the-machine-credential-file-internal.md
open on GitHub ↗ · commit history ↗
mentions2
- iss-2609261312108500ahoy connect's provider-block write re-reads ~/.abcd/config.json under its lock with plain json.Unmarshal (internal/core/oracle/connect.go writeProviderBlockLocked), so a config.json that names a key twice, or two spellings of one, is collapsed last-wins and rewritten without the other spelling. LoadAPI refuses such a file through layered's jsonstrict walk before the call, but the rewrite judges the bytes it re-reads under the lock, and those it reads with the silent decoder: a file edited between the check and the lock is laundered. The sibling of iss-2609260120380520 on the credential store.
- itd-2609061543533170One verb takes a managed repository's site from the checkout to a live address