From f13aa9d03ccfa774cf868722d38218c3fcfbab11 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Schottst=C3=A4dt?= <marc.schottstaedt@gmail.com>
Date: Sun, 7 Jun 2026 19:41:11 +0200
Subject: [PATCH] fix(cs2): harden postinstall password generation

---
 scrolls/lgsm/cs2server/data/postinstall.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/scrolls/lgsm/cs2server/data/postinstall.sh b/scrolls/lgsm/cs2server/data/postinstall.sh
index 67b58124..a75527a1 100644
--- a/scrolls/lgsm/cs2server/data/postinstall.sh
+++ b/scrolls/lgsm/cs2server/data/postinstall.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-set -euo pipefail
+set -eu
 
 config_file="serverfiles/game/csgo/cfg/server.cfg"
 password_file=".druid-rcon-password"
@@ -9,7 +9,11 @@ if [ -n "${CS2_RCON_PASSWORD:-}" ]; then
 elif [ -f "$password_file" ]; then
   rcon_password="$(cat "$password_file")"
 else
-  rcon_password="$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 50)"
+  rcon_password="$(LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 50 || true)"
+  if [ "${#rcon_password}" -ne 50 ]; then
+    echo "failed to generate rcon password" >&2
+    exit 1
+  fi
   printf '%s\n' "$rcon_password" > "$password_file"
   chmod 600 "$password_file"
 fi