From 10c272efa2ea2bad873257be82548aeabefb6bce Mon Sep 17 00:00:00 2001
From: sysadmin <dev@silverlabs.uk>
Date: Wed, 21 Oct 2026 15:30:09 +0100
Subject: [PATCH] fix: feed curl auth config on stdin (no process substitution
 on Git Bash)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 catalogue-publish/publish-to-catalogue.sh |  9 +++++----
 catalogue-publish/test.sh                 | 20 ++++++++++++++++++++
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/catalogue-publish/publish-to-catalogue.sh b/catalogue-publish/publish-to-catalogue.sh
index 6de8ef5..e421099 100644
--- a/catalogue-publish/publish-to-catalogue.sh
+++ b/catalogue-publish/publish-to-catalogue.sh
@@ -150,12 +150,13 @@ fi
 
 [ -n "${CATALOGUE_PUBLISH_KEY:-}" ] || die "CATALOGUE_PUBLISH_KEY is not set"
 
-# Pass the bearer header through a curl config read from a process
-# substitution, so the key never lands in argv or the shell trace.
+# Pass the bearer header through a curl config on stdin (-K -), so the key never
+# lands in argv or the shell trace. (Not process substitution: native Windows
+# curl under Git Bash cannot open /dev/fd paths.)
 BODY_FILE="$(mktemp)"
 trap 'rm -f "$BODY_FILE"' EXIT
-HTTP_CODE="$(curl -sS -o "$BODY_FILE" -w '%{http_code}' -X POST \
-  -K <(printf 'header = "Authorization: Bearer %s"\n' "$CATALOGUE_PUBLISH_KEY") \
+HTTP_CODE="$(printf 'header = "Authorization: Bearer %s"\n' "$CATALOGUE_PUBLISH_KEY" |
+  curl -sS -o "$BODY_FILE" -w '%{http_code}' -X POST -K - \
   "${FIELDS[@]}" "$URL")" || die "request to $URL failed"
 
 BODY="$(cat "$BODY_FILE")"
diff --git a/catalogue-publish/test.sh b/catalogue-publish/test.sh
index b8da514..dcb68b3 100644
--- a/catalogue-publish/test.sh
+++ b/catalogue-publish/test.sh
@@ -20,4 +20,24 @@ OUT="$(GITHUB_ACTION_PATH="$HERE" INPUT_APP=silvermail INPUT_FILE="$TMP/App-1.0.
 for n in Platform=Windows Format=Nupkg VersionCode=1000000 AppSlug=silvermail; do
   printf '%s' "$OUT" | grep -qF -- "$n" && ok "dry-run has $n" || bad "dry-run missing $n"; done
 printf '%s' "$OUT" | grep -qF -- "$SECRET" && bad "key leaked" || ok "key not printed"
+
+# -K must not use process substitution (breaks native curl under Git Bash).
+grep -nE -- '-K[[:space:]]+<\(' "$HERE/publish-to-catalogue.sh" >/dev/null && bad "uses -K <(...)" || ok "no process substitution for -K"
+
+# Fake curl: header must arrive on stdin, never in argv.
+mkdir "$TMP/bin"
+cat > "$TMP/bin/curl" <<'F'
+#!/usr/bin/env bash
+out=""; k=""
+while [ $# -gt 0 ]; do case "$1" in -o) out="$2"; shift 2;; -K) k="$2"; shift 2;; *) printf '%s
+' "$1" >> "$FAKE_ARGS"; shift;; esac; done
+printf '%s' "$k" > "$FAKE_K"
+cat > "$FAKE_STDIN"
+echo '{}' > "$out"; printf 201
+F
+export FAKE_ARGS="$TMP/args" FAKE_K="$TMP/k" FAKE_STDIN="$TMP/stdin"; : > "$FAKE_ARGS"
+PATH="$TMP/bin:$PATH" CATALOGUE_PUBLISH_KEY="$SECRET" bash "$HERE/publish-to-catalogue.sh"   --slug a --platform windows --arch x64 --format nupkg --version 1.0.0 --version-code 1 --channel beta "$TMP/App-1.0.0.nupkg" >/dev/null 2>&1   && ok "fake-curl publish exit 0" || bad "fake-curl publish failed"
+[ "$(cat "$TMP/k")" = "-" ] && ok "-K -" || bad "-K arg is '$(cat "$TMP/k")'"
+grep -qF "Authorization: Bearer $SECRET" "$TMP/stdin" && ok "header on stdin" || bad "header not on stdin"
+grep -qF "$SECRET" "$TMP/args" && bad "key in argv" || ok "key not in argv"
 exit $FAILS
-- 
2.39.5