Repository navigation
Read jwt_token from the environment in upload_dars.sh - #96
Open
gyorgybalazsi wants to merge 2 commits into
Open
gyorgybalazsi wants to merge 2 commits into
gyorgybalazsi wants to merge 2 commits into
Conversation
upload_dars.sh set jwt_token="" at the top, which replaced a token the user exported. The README and the DAR install guide both tell users to export jwt_token, so the upload went out without an Authorization header. Default the variable to the exported value instead. Tested with a stub grpcurl: an exported token now reaches the request, no token still sends no header, and the old script fails the same check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gyorgybalazsi
requested review from
a team and
sosaucily
and
a balanced review from Copilot
October 9, 2026 12:33
There was a problem hiding this comment.
🟢 Approval recommended
The focused change correctly fixes the documented authentication issue without altering unauthenticated behavior.
0 open findings
What changed in this PR
Updates the DAR upload script to preserve an optional JWT token supplied through the environment.
Changes:
- Reads
jwt_tokenfrom the environment with an empty fallback. - Documents the fix in the changelog.
| File | Description |
|---|---|
CHANGELOG.md |
Records the JWT environment-variable fix. |
cbtc-dars/upload_dars.sh |
Preserves an exported JWT token for authenticated uploads. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
The DAR README offered two ways to set jwt_token: export it, or write it into upload_dars.sh. The script is tracked, so the second option puts a token one commit away from the repository. Now that the script reads the exported value, keep only the export. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
cbtc-dars/upload_dars.shnow readsjwt_tokenfrom the environment. Line 13 changes fromjwt_token=""tojwt_token="${jwt_token:-}".The DAR README now gives one way to set the token:
export jwt_token=....Why
The script set
jwt_token=""at the top, so it replaced a token that the user exported. The README and the DAR install guide on docs.bitsafe.finance both tell users to runexport jwt_token=.... With that instruction, the upload went to the Admin API with noAuthorizationheader. It could not succeed on a participant that requires a token.The default is still an empty string. A user who exports no token gets the same behaviour as before: no header.
Who this affects
Canton requires a token on the Admin API only when the operator configures
auth-serviceson it. Without that setting, the Admin API accepts requests with no token.Our own configs in
cantonanddlc-attestor-stackset noauth-serviceson the Admin API. I do not know how customer participants are configured, so the README and the docs keep the token optional. See Configure API Authentication and Authorization with JWT.How tested
I ran the script with a stub
grpcurlthat records its arguments, from a directory with one test DAR.Authorizationheader. This reproduces the bug.I did not test against a real participant.
Notes
The DAR README also offered a second option: write the token into
upload_dars.sh. The script is a tracked file, so that option puts a token one commit away from the repository. This PR removes it and keeps onlyexport jwt_token=....🤖 Generated with Claude Code