setup.sh fails with Debian yq and does not generate certificates

[senthalan]

Description

I believe this issue could affect quite a few users, especially those installing ThunderID on Debian- or Ubuntu-based systems. Since these distributions may provide a different yq implementation than the one expected by setup.sh, users can run into this problem even when they have installed all seemingly required dependencies.

I found an issue with setup.sh in ThunderID 1.0.1 on Debian.

The setup script detects yq using:

if command -v yq >/dev/null 2>&1; then
and then executes commands such as:

yq eval '.server.hostname // "localhost"' deployment.yaml
The problem is that Debian can provide a different yq implementation which does not support the yq eval syntax expected by the script.

Because setup.sh also uses:

set -e
the script exits immediately when that yq command fails.

As a result, it never reaches:

configure_direct_auth_secret
configure_certificates
and files such as the following are not generated:

config/certs/server.cert
config/certs/server.key
config/certs/signing.cert
config/certs/signing.key
config/certs/ecdsa-signing.cert
config/certs/ecdsa-signing.key
config/certs/crypto.key
config/secrets/direct_auth_secret
The startup then fails with errors such as:

Failed to initialize certificate service
certificate file not found at .../config/certs/signing.cert
I confirmed the failure with bash -x ./setup.sh --verbose. The trace stops around:

• command -v yq
  ++ yq eval '.server.hostname // "localhost"' ./deployment.yaml
• HOSTNAME=
  A possible fix would be to check whether the installed yq actually supports the required syntax before using it, for example:

if command -v yq >/dev/null 2>&1 &&
yq eval '.' /dev/null >/dev/null 2>&1; then
and otherwise use the existing grep/awk fallback.

Alternatively, the setup script could explicitly check for Mike Farah's yq v4 and provide a clear error message if an incompatible implementation is installed.

It may also be useful to avoid having an optional YAML parser failure terminate the entire setup process under set -e.

Steps to Reproduce

Run setup.sh in ThunderID 1.0.1 on Debian.

Version

1.0.1 Linux x64

Environment Details (with versions)

OS: Debian
Shell: Bash 5.2.x

[senthalan]

@rajithacharith @ZiyamSanthosh Can you please take a look into this ?

[ZiyamSanthosh]

We investigated the behavior and found that it appears to depend on the yq implementation available in the environment, rather than Debian or Ubuntu alone.

We tested the reported flow on Ubuntu 24.04 LTS. The setup completed successfully and generated all expected certificates. This can happen when yq is not installed, causing the script to use its fallback parser, or when Mike Farah yq v4 is installed and supports the required yq eval syntax.

To help us reproduce your exact environment, could you please clarify the following?

1. Which Debian release and architecture were you using?
2. Was yq installed on the machine when the issue occurred?
3. Which yq implementation and version were installed?
4. How was yq installed, for example through APT, Snap, pip, or a downloaded binary?
5. Were there multiple yq installations on the machine that could have affected which executable was selected?

Based on the current findings, this should not affect every Debian- or Ubuntu-based system. The likely trigger is an incompatible yq implementation being selected by setup.sh. These details will help us confirm and narrow the reproduction conditions.

[Niubi90]

Hi @ZiyamSanthosh ,

Here are the details:

Debian release and architecture:
Debian 13.6 (Trixie), amd64.

This was a completely fresh Debian installation from the Debian 13.6.0 amd64 ISO.

Was yq installed when the issue occurred?
Yes.

Which yq implementation and version were installed?
It was the yq package provided by the official Debian 13 repository.

The Debian package version is 3.4.3-2. This is the Python-based yq implementation that acts as a jq wrapper for YAML, not Mike Farah's Go-based yq v4.

How was yq installed?
Directly from the standard Debian repository using:

sudo apt install yq

Were there multiple yq installations on the machine?
No. This was a fresh Debian installation, and the only yq I installed was the package from the Debian repository using APT.

The sequence to reproduce the problem was essentially:

sudo apt install yq
./setup.sh

After running ./setup.sh, the setup terminated before generating the certificate and secret files.

So this should be reproducible on a clean Debian 13.6 amd64 installation by installing yq from the standard Debian repository and running the ThunderID setup script.

Best regards

[ZiyamSanthosh]

Hi @Niubi90

These details confirm the reproduction condition. The issue occurs on Debian 13.6 amd64 when the official APT yq 3.4.3-2 package is installed. This is the Python/jq implementation and does not support the Mike Farah v4 yq eval syntax expected by the current scripts.

We also verified the compatibility check against Python/jq yq 3.4.3. The yq eval '.' /dev/null probe is rejected with a non-zero status, which allows the script to identify this implementation as incompatible. This also explains why the issue may not reproduce on another Debian- or Ubuntu-based system when yq is absent or when Mike Farah yq v4 is installed.

The proposed fix checks both that yq is available and that it supports the required eval syntax. If the capability check fails, the script uses the existing grep/awk parser instead. Because the failed probe is evaluated as part of the if condition, set -e does not terminate the script, and Direct Auth secret and certificate generation can proceed normally. The same compatibility check is applied to both setup.sh and build.sh.

The fix is available for review in #5253. Once merged, rerunning setup.sh should generate the missing security material without requiring users to replace the Debian-provided yq package.