Secure Secrets: Cleanup & Lifecycle In Rust/Bun

Hey guys! Keeping secrets secure, especially when you're working in a public repository, is super important. Nobody wants their API keys or sensitive data floating around where they shouldn't be. This article dives into how we can handle cleanup and lifecycle management of these secrets directly within your Rust engine or using a Bun-powered utility, all while staying away from Bash scripts. Let's get into the details and make sure our projects are locked down tight!

1. The Rust "Self-Destruct" Pattern: Guarding Secrets with RAII

So, the main idea here is to make sure your sensitive files only exist for the briefest possible moment. The best way to do this is with Rust's "Drop Guard" pattern. This technique leverages Rust's ownership and borrowing system, which ensures resources are cleaned up automatically when they're no longer needed. It's like having a little cleanup crew that springs into action as soon as the job is done.

Let's check out the code.

services/engine/src/agents/lifecycle.rs

use std::fs;
use std::path::PathBuf;

pub struct TempFileGuard {
    pub path: PathBuf,
}

impl TempFileGuard {
    pub fn new(path: PathBuf, content: String) -> anyhow::Result<Self> {
        fs::write(&path, content)?;
        Ok(Self { path })
    }
}

// The "Magic": When the variable goes out of scope, the file is deleted.
impl Drop for TempFileGuard {
    fn drop(&mut self) {
        if self.path.exists() {
            let _ = fs::remove_file(&self.path);
            println!("🧹 Securely wiped: {:?}", self.path);
        }
    }
}

Here, we've defined a TempFileGuard struct. When you create an instance of this struct, it writes the provided content to the specified path. The real magic happens with the impl Drop for TempFileGuard block. The drop function is automatically called when the TempFileGuard variable goes out of scope (e.g., at the end of a block of code). Inside this drop function, we check if the file still exists and then securely delete it.

Usage in your Linker Agent:

{
    let _setup_script = TempFileGuard::new(
        PathBuf::from("setup.sh"), 
        rendered_content
    )?;
    
    // Run your deployment/auth logic here...
    // Once this block ends, setup.sh is automatically deleted.
}

See how easy that is? This pattern provides a high level of security because the file is automatically deleted, even if your program crashes or exits unexpectedly. This ensures that any sensitive information stored in the file is quickly wiped from the disk. This approach is excellent for short-lived processes where you need to create and use secrets.

2. The Bun Cleanup Utility (TS): Globbing Your Way to a Clean Slate

If you prefer to manage the cleanup process using your TypeScript/Bun layer, perhaps after running a Dagger build or similar process, then using a glob-based wiper is the perfect choice. This method provides a more flexible way to identify and delete multiple files matching specific patterns.

infra/scripts/cleanup.ts

import { unlink } from "node:fs/promises";
import { Glob } from "bun";

const sensitivePatterns = ["**/setup.sh", "**/credentials.json", "**/.env.tmp"];

export async function nukeSensitiveFiles() {
  for (const pattern of sensitivePatterns) {
    const glob = new Glob(pattern);
    for await (const file of glob.scan(".")) {
      console.log(`🧨 Nuking sensitive file: ${file}`);
      await unlink(file);
    }
  }
}

await nukeSensitiveFiles();

In this example, we import the unlink function from node:fs/promises to delete files and the Glob class from Bun to match file patterns. The sensitivePatterns array holds patterns (using glob syntax) that specify which files to target for deletion. The nukeSensitiveFiles function iterates over each pattern, uses Glob to find matching files, and then calls unlink to delete them. This approach offers medium security because it relies on a manual trigger, but it's great for cleaning up after build processes.

3. Justfile Integration (TS Only): Automating Cleanup with Just

To keep things clean and tidy, you can integrate your cleanup tasks with a tool like just. This is super convenient, particularly if you're working primarily with TypeScript and want to avoid relying on Bash scripts.

# Securely wipe all auto-generated artifacts containing secrets
cleanup:
    @bun run infra/scripts/cleanup.ts

# Run the SSOT sync, execute, and then immediately cleanup
sync-and-run:
    cargo run -p lornu-engine -- --task sync
    # ... execute your logic ...
    just cleanup

With this setup, the cleanup task simply runs your cleanup.ts script. The sync-and-run task first runs a Rust command and then triggers the cleanup. The just tool ensures that your secrets are handled correctly. This strategy provides a medium level of security because it relies on a manual trigger. Using just simplifies your workflow and makes sure your secrets are handled correctly.

4. Evaluation of the "No-Bash" Security Stack: A Quick Comparison

Let's break down the different methods we've explored to help you choose the best approach for your project. This table provides a quick overview:

As you can see, each method has its strengths and weaknesses. The RAII Guard pattern in Rust is excellent for ensuring automatic deletion, while the Bun Glob method provides flexibility for cleanup tasks in CI/CD pipelines.

Pro-Tip: Skip the File Entirely? Ultimate Security

Here's a pro-tip: Can we avoid writing the file to disk in the first place? You got it! For tools like Cloudflare and GitHub, there is a way to pass the secret directly into the Command::env() or Command::stdin() of whatever process needs it, so it never even touches the disk! This approach offers the highest security by eliminating the risk of secrets being written to disk.

Do you want me to show you the Rust code to execute a sub-process while piping the secret directly into its memory, bypassing the disk entirely? Just let me know!

That's it, guys! We've covered some awesome strategies for handling secrets securely in a public repo environment. By implementing these techniques, you can significantly reduce the risk of sensitive data leaks and keep your projects safe. Stay secure out there!