fix: preserve trailing newline in vault-read.sh output

otica-resolverrequested to merge
agent/issue-4 into main

What

scripts/vault-read.sh now emits the exact bytes stored in a secret, including any significant trailing newline (PEM files, tokens, certs).

Why

Two things dropped the trailing newline: command substitution v=$(echo "$j" | jq -r ...) strips all trailing newlines, and emission via echo -n "$v". The fix removes the intermediate capture and pipes jq -j (raw output, no added newline) straight to stdout — and to base64 --decode in the base64 branch — so exact stored bytes survive. Also quoted $path defensively.

Verification

  • make validate passes.
  • Plaintext branch: a value ending in \n now emits hunter2\\n (old: hunter2).
  • Base64 branch: decoded payload's trailing newline preserved.

Scope note

Make callers that wrap this script in $(...) (terraform.mk, external-dns.mk, cloudsql.mk, gl-add-deploy-key.sh) still strip trailing newlines at the call site — unchanged by this fix; responsibility correctly moves to the caller. The gitlab.sh base64vault:// path is unintentionally improved.

Closes #4 (closed)

Closes #4 (closed)

Merge request reports