{"record":{"id":"3b66322a7b50a9c3","repo":"onetimesecret/onetimesecret","slug":"name-is-set-to-an-unrecognized-boolean-value","errorCode":null,"errorMessage":"#{name} is set to an unrecognized boolean (#{value.length} chars, sha256:#{::Digest::SHA256.hexdigest(value)[0, BOOL_DIGEST_LENGTH]}). Use one of #{TRUTHY_VALUES.join('/')} or #{FALSEY_VALUES.join('/')}, or leave unset.","messagePattern":"#(.+?) is set to an unrecognized boolean \\(#(.+?) chars, sha256:#(.+?)\\)\\. Use one of #(.+?) or #(.+?), or leave unset\\.","errorType":"validation","errorClass":"Onetime::ConfigError","httpStatus":null,"severity":"error","filePath":"lib/onetime/utils/strings.rb","lineNumber":307,"sourceCode":"      # to confirm which value a log line refers to. Honest caveat: 8 hex\n      # characters of a low-entropy value like \"ture\" is brute-forceable —\n      # which is fine, because low-entropy values are exactly the case that\n      # was never sensitive.\n      #\n      # @param name [String] Flag name, for the error message (e.g. 'RABBITMQ_VERIFY_PEER')\n      # @param raw [Object] Raw value as supplied\n      # @param default [Boolean] Value to use when raw is unset/blank\n      # @return [Boolean]\n      # @raise [Onetime::ConfigError] if raw is present but not a recognized token\n      def strict_bool!(name, raw, default:)\n        # Normalize exactly once so the blank guard and the token tables can\n        # never disagree about what normalization means.\n        value = raw.to_s.strip.downcase\n        return default if value.empty?\n        return true    if TRUTHY_VALUES.include?(value)\n        return false   if FALSEY_VALUES.include?(value)\n\n        raise Onetime::ConfigError,\n          \"#{name} is set to an unrecognized boolean \" \\\n          \"(#{value.length} chars, sha256:#{::Digest::SHA256.hexdigest(value)[0, BOOL_DIGEST_LENGTH]}). \" \\\n          \"Use one of #{TRUTHY_VALUES.join('/')} or #{FALSEY_VALUES.join('/')}, or leave unset.\"\n      end\n      module_function :strict_bool!\n\n      private\n\n      # Masks a single email address string\n      # @param raw [String] Raw email address to mask\n      # @return [String] Masked email address\n      def mask_email_address(raw)\n        addr = ::Mail::Address.new(raw)\n        return mask_unparsed_address(raw) unless addr.local && addr.domain\n\n        local  = mask_string_head(addr.local, EMAIL_MASK_MIN_LOCAL)\n        domain = mask_domain(addr.domain)\n        \"#{local}@#{domain}\"","sourceCodeStart":289,"sourceCodeEnd":325,"githubUrl":"https://github.com/onetimesecret/onetimesecret/blob/f81295e41bc3e808a3dd2cbea03ef65401a662e4/lib/onetime/utils/strings.rb#L289-L325","documentation":"Onetime::Utils::Strings.strict_bool! resolves operator-supplied booleans strictly (ADR-033): after strip+downcase, blank means unset and returns the caller's default; otherwise the value must be exactly one of TRUTHY_VALUES (1/true/yes/on/y/t) or FALSEY_VALUES (0/false/no/off/n/f). Anything else raises Onetime::ConfigError rather than silently disabling a default-ON control. The message deliberately never echoes the value — it may be a misrouted credential — and instead reports its length plus an 8-hex-char SHA-256 tag you can recompute locally (lib/onetime/utils/strings.rb:299).","triggerScenarios":"Setting any flag consumed through strict_bool! — callers include enabled?, automatic_tax?, smtp2go_fastaccept/coerce_fastaccept, and QueueConfig flags such as RABBITMQ_VERIFY_PEER — to a token outside the tables: typos like 'ture' or 'flase', words like 'enabled'/'check', '1|0', or literal quotes left around the value.","commonSituations":"Hand-edited .env typo; systemd Environment= or docker --env-file quoting that leaves literal quotes in the value; a CI secret accidentally exported under a boolean flag's name (the long random string shows up as a length plus sha256 tag); 'TRUE' works (downcased) but 'yes please' does not.","solutions":["Set the flag to a recognized token — 1/true/yes/on/y/t or 0/false/no/off/n/f — or delete the line to take the default.","To identify a mystery value, recompute the tag and compare with the sha256: prefix in the message: ruby -rdigest -e 'puts Digest::SHA256.hexdigest(ARGV[0].strip.downcase)[0,8]' 'suspected-value'.","Remove literal quotes or stray characters introduced by systemd units or docker env files.","If the reported length looks like a credential, grep your environment for a value misrouted into this flag's name."],"exampleFix":"# before — typo meant to disable peer verification, fails fast at boot\nRABBITMQ_VERIFY_PEER=ture\n# Onetime::ConfigError: RABBITMQ_VERIFY_PEER is set to an unrecognized boolean (4 chars, sha256:...)\n\n# after — recognized token (or leave unset for the default)\nRABBITMQ_VERIFY_PEER=true","handlingStrategy":"type-guard","validationCode":"# Lint boolean flags before boot\nok = Onetime::Utils::Strings::TRUTHY_VALUES + Onetime::Utils::Strings::FALSEY_VALUES\n%w[RABBITMQ_VERIFY_PEER SMTP2GO_FASTACCEPT].each do |flag|\n  v = ENV[flag].to_s.strip.downcase\n  next if v.empty? || ok.include?(v)\n  abort \"#{flag} is not a recognized boolean (#{ok.join('/')}) — fix or unset\"\nend","typeGuard":"# Recognizer matching strict_bool!'s normalization exactly\nmodule BoolGuard\n  TOKENS = Onetime::Utils::Strings::TRUTHY_VALUES +\n           Onetime::Utils::Strings::FALSEY_VALUES\n\n  def self.strict_bool_token?(raw)\n    TOKENS.include?(raw.to_s.strip.downcase)\n  end\nend\n\nBoolGuard.strict_bool_token?(ENV['SMTP2GO_FASTACCEPT']) # false => strict_bool! would raise","tryCatchPattern":"begin\n  fast = Onetime::Utils::Strings.strict_bool!('SMTP2GO_FASTACCEPT',\n                                              ENV['SMTP2GO_FASTACCEPT'], default: false)\nrescue Onetime::ConfigError => ex\n  abort \"Boot aborted — fix the environment first: #{ex.message}\"\nend","preventionTips":["Run an env-var lint step (CI or container entrypoint) over every boolean flag before the app boots.","Never quote boolean values in systemd Environment= or docker env files.","Standardize on true/false in automation; treat any other spelling as a typo to fix at the source."],"tags":["configuration","boolean","environment-variables","validation","ruby"],"backgroundTag":"invalid-boolean-config-value","analyzedSha":"f81295e41bc3e808a3dd2cbea03ef65401a662e4","analyzedAt":"2026-08-23T21:13:10.635Z","schemaVersion":2},"datasetVersion":"2026-08-24T02:17:37.098Z"}