From 4fe6a5ae16c1dced445848429aea2ded1d79650c Mon Sep 17 00:00:00 2001
From: Audiobuzz <audiobuzz@gmail.com>
Date: Sun, 12 Jul 2026 06:05:40 +0000
Subject: [PATCH] issue-cert: probe both smallstep password locations
 (secrets/password on older images)

---
 serving/audit-collector/issue-cert.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/serving/audit-collector/issue-cert.sh b/serving/audit-collector/issue-cert.sh
index d795520..d0c976d 100755
--- a/serving/audit-collector/issue-cert.sh
+++ b/serving/audit-collector/issue-cert.sh
@@ -31,11 +31,17 @@ cd "$BENCH_DIR"
 CA_PORT=${CA_PORT:-8443}
 CA_CONNECT=${CA_CONNECT:-localhost}   # see bootstrap.sh: SAN-valid AND resolvable
 CA_URL="https://${CA_CONNECT}:${CA_PORT}"
-CONTAINER_PW="/home/step/password"    # bootstrap.sh: pki/stepca/password in-container
 
 step()  { docker compose exec -T step-ca step "$@"; }
 incca() { docker compose exec -T step-ca "$@"; }
 
+# CA/provisioner password file, as seen INSIDE the container. Location varies by
+# smallstep image version (newer: $STEPPATH/password, older: $STEPPATH/secrets/
+# password) — probe both, like bootstrap.sh does.
+# shellcheck disable=SC2016  # $f expands in the CONTAINER's sh, not here
+CONTAINER_PW=$(incca sh -c 'for f in /home/step/password /home/step/secrets/password; do [ -f "$f" ] && { echo "$f"; exit 0; }; done; exit 1') \
+  || { echo "ERROR: no CA password file in the step-ca container (/home/step{,/secrets}/password) — did the CA auto-init? Check: docker compose logs step-ca" >&2; exit 1; }
+
 echo "==> issuing audit-collector cert (CN/SAN: $AUDIT_HOST) from the fleet CA"
 incca mkdir -p /export/audit
 step ca certificate "$AUDIT_HOST" \