Fix windows redaction clean #1876

bennyyang11 · 2025-10-02T15:43:56Z

Description, Motivation and Context

Fixes Windows redaction file locking failures that completely prevented support bundle redaction from working on Windows systems.

Problem: Support bundle redaction consistently failed on Windows with "Access is denied" and "file is being used by another process" errors during file operations, making redaction unusable for Windows users.

Solution: Implemented Windows-specific file handling that uses destination directory temp files and copy+delete operations instead of system temp and rename operations, which are more compatible with Windows file system behavior and antivirus software.

Impact: Windows users can now successfully run support bundle redaction without file locking crashes.

Fixes: #1607

Checklist

New and existing tests pass locally with introduced changes.
Tests for the changes have been added (for bug fixes / features)
The commit message(s) are informative and highlight any breaking changes
Any documentation required has been added/updated. For changes to https://troubleshoot.sh/ create a PR here

Does this PR introduce a breaking change?

Yes
No

Technical Changes:

Windows: Use destination directory for temp files and copy+delete file operations
Linux/macOS: Preserve exact original behavior with no changes
Platform detection using runtime.GOOS for Windows-specific handling only

Test commands for redaction

Multiline Redaction

Use unnamed capture group for the key, named capture for the value
@"
apiVersion: troubleshoot.sh/v1beta2
kind: Redactor
metadata:
name: multiline-regex-test
spec:
redactors:

name: Redact password value
removals:
regex:
- selector: 'username:'
  redactor: '(password:\s*)(?P.*)'
name: Redact api_secret value
removals:
regex:
- selector: 'api_key:'
  redactor: '(api_secret:\s*)(?P.*)'
  "@ | Out-File -FilePath C:\Users\Public\Downloads\test-troubleshoot\multiline-redactor.yaml -Encoding UTF8 -Force

.\bin\troubleshoot.exe redact --bundle C:\Users\Public\Downloads\test-troubleshoot\multiline-test.tar.gz C:\Users\Public\Downloads\test-troubleshoot\multiline-redactor.yaml

Check results
$latest = Get-Item redacted-support-bundle-*.tar.gz | Sort-Object LastWriteTime | Select-Object -Last 1
tar -xzf $latest.Name
Get-Content multiline-test\credentials.txt

Single-line redaction

Create a redactor using VALUES (literal string replacement)
@"
apiVersion: troubleshoot.sh/v1beta2
kind: Redactor
metadata:
name: test-redactor
spec:
redactors:

name: Test literal replacement
removals:
values:
- password
- token
  "@ | Out-File -FilePath C:\Users\Public\Downloads\test-troubleshoot\values-redactor.yaml -Encoding UTF8

Test with values redactor
.\bin\troubleshoot.exe redact --bundle C:\Users\Public\Downloads\test-troubleshoot\test-bundle.tar.gz C:\Users\Public\Downloads\test-troubleshoot\values-redactor.yaml

Extract and check - the word "password" and "token" should be replaced with "HIDDEN"
tar -xzf (Get-Item redacted-support-bundle-*.tar.gz | Sort-Object LastWriteTime | Select-Object -Last 1).Name
Get-Content test-bundle\cluster-resources\secret.json

- Add Windows-specific copy+delete file replacement strategy - Preserve original Linux/macOS behavior exactly (no changes) - Use runtime.GOOS detection for platform-specific handling only - Fixes GitHub issue #1607 without affecting other platforms Windows changes: - replaceFileWindows() with retry logic and copy+delete approach - copyAndDeleteWindows() for robust file operations - isWindowsFileLockError() for smart error detection Linux/macOS unchanged: - Still uses original os.Rename() behavior - Still uses system temp directory - Zero functional impact

- Windows: Use working directory for bundle extraction temp files - Linux/macOS: Preserve original system temp behavior exactly - Prevents antivirus file locking during bundle processing on Windows - Zero impact on Linux/macOS functionality Complete Windows-only solution for GitHub issue #1607

NoaheCampbell · 2025-10-03T21:51:40Z

pkg/collect/result.go

+	} else {
+		// Linux/macOS: EXACT original behavior - DO NOT CHANGE
+		err = os.Rename(tmpFile.Name(), filepath.Join(bundlePath, relativePath))
+	}


It looks like bugbot is right about this to me, the file is removed and then its copied? Shouldnt it be copied before its deleted?

bennyyang11 added 3 commits October 1, 2025 17:02

just windows fix

118d1f0

bennyyang11 added the type::feature New feature or request label Oct 2, 2025