From b7bdcc0e2e3d3754963f08e610f1103d80257e81 Mon Sep 17 00:00:00 2001
From: Olivier <1+olivier@noreply.raspot.in>
Date: Wed, 19 Aug 2026 16:13:28 +0200
Subject: [PATCH] =?UTF-8?q?T=C3=A9l=C3=A9verser=20les=20fichiers=20vers=20?=
 =?UTF-8?q?"modules"?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 modules/workstation-setup.nix | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/modules/workstation-setup.nix b/modules/workstation-setup.nix
index 7f0f84e..ca9f81f 100644
--- a/modules/workstation-setup.nix
+++ b/modules/workstation-setup.nix
@@ -93,10 +93,23 @@ let
           raise SystemExit(code)
 
       def read_secret() -> str:
-          value = sys.stdin.readline()
-          if value == "":
+          # Read bytes so Nix/Python escaping cannot accidentally turn the
+          # line terminator into part of the FIDO2 PIN. QProcess terminates
+          # each secret with LF; tolerate CRLF as well.
+          raw = sys.stdin.buffer.readline()
+          if raw == b"":
               fail("INPUT_ERROR", 30)
-          return value.rstrip("\\r\\n")
+          if raw.endswith(bytes([10])):
+              raw = raw[:-1]
+          if raw.endswith(bytes([13])):
+              raw = raw[:-1]
+          try:
+              value = raw.decode("utf-8")
+          except UnicodeDecodeError:
+              fail("INPUT_ERROR", 30)
+          if chr(10) in value or chr(13) in value:
+              fail("INPUT_ERROR", 30)
+          return value
 
       new_pin = read_secret()
       confirmation = read_secret()
@@ -242,7 +255,7 @@ let
 
   workstationSetup = pkgs.stdenv.mkDerivation {
     pname = "nixos-workstations-setup";
-    version = "1.8.2";
+    version = "1.8.3";
 
     src = ../workstation-setup;