Merge pull request #154 from theta42/fix/unseal-key-unbound-v1.35.11

fix: UNSEAL_KEY unbound variable in setup.sh (v1.35.11)
chore: changelog for v1.35.11
2026-08-03 22:45:27 -04:00 · 2026-08-03 22:44:03 -04:00 · 2026-08-03 22:43:51 -04:00
2 changed files with 8 additions and 1 deletions
@@ -8,6 +8,11 @@ orchestration code; see each submodule's own `CHANGELOG.md`
 [sso-manager-node](https://github.com/theta42/sso-manager-node/blob/master/CHANGELOG.md))
 for what changed inside the apps it composes.

+## [v1.35.11] - 2026-08-04
+
+### Fixed
+- **`setup.sh` aborted with `UNSEAL_KEY: unbound variable` on re-runs** — when OpenBao was already unsealed, the unseal block was skipped and `UNSEAL_KEY` was never set, so the later `if [[ -n "$UNSEAL_KEY" ]]` crashed under `set -u`. Guarded with `${UNSEAL_KEY:-}`.
+
 ## [v1.35.10] - 2026-08-04

 ### Added
@@ -775,7 +775,9 @@ if [[ -z "$VAULT_TOKEN" ]]; then
 	die "Could not determine OpenBao VAULT_TOKEN from $CONFIG_DIR/bao-init.json or .env."
 fi

-if [[ -n "$UNSEAL_KEY" ]]; then
+# UNSEAL_KEY is only set when OpenBao needed unsealing this run; on a re-run of
+# an already-unsealed store it is unset, so guard with ${UNSEAL_KEY:-} (set -u).
+if [[ -n "${UNSEAL_KEY:-}" ]]; then
 	env_upsert VAULT_UNSEAL_KEY "$UNSEAL_KEY"
 fi
 env_upsert VAULT_TOKEN "$VAULT_TOKEN"
Author	SHA1	Message	Date
wmantly	f9af81983b	Merge pull request #154 from theta42/fix/unseal-key-unbound-v1.35.11 CI/CD / build-theta-agent (push) Successful in 45s Details CI/CD / docker-push (push) Failing after 16s Details fix: UNSEAL_KEY unbound variable in setup.sh (v1.35.11)	2026-08-03 22:45:27 -04:00
wmantly	5ef2493e17	chore: changelog for v1.35.11	2026-08-03 22:44:03 -04:00
wmantly	8535372123	fix: guard UNSEAL_KEY with ${UNSEAL_KEY:-} in setup.sh (v1.35.11) On a re-run where OpenBao is already unsealed, the unseal block is skipped and UNSEAL_KEY is never set; line 778 then referenced it under set -u and aborted with 'UNSEAL_KEY: unbound variable'. Guard with ${UNSEAL_KEY:-} so the VAULT_UNSEAL_KEY upsert is simply skipped when there's no key this run. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-03 22:43:51 -04:00