Josh Huang's Engineering Notes
The Code That Looked Right in Every Way Except the One That Mattered
A ported CLI authenticator produced a plausible-looking code for every account — right length, right character set — for one specific account type it would never actually have worked, because it silently skipped that type's own non-standard algorithm entirely.
This article is also available in Traditional Chinese: 中文版 — same content, just a language difference.
Porting a Windows-only desktop authenticator app into a cross-platform CLI (the same project behind winauth-cli's docs site), the release build ran cleanly, produced codes of the right length and shape for every account, and passed every surface-level check. One specific account type's codes would never actually have authenticated — and the only way to catch that was to write an independent reference implementation and diff the two outputs directly.
Two CI problems first, both real, neither the actual bug
Before the real issue ever surfaced, two separate release-pipeline problems had to be cleared first. The first looked like a silent CI failure — a release appeared to just not happen — but turned out to be correct behavior: the release job was gated on a specific tag pattern, and the triggering push had gone to the main branch instead of a tag, so nothing should have run. Pushing an actual tag surfaced a second, genuine bug: the release step ran a "create release" command that assumed it already had a checked-out copy of the repository, when it never actually checked one out, failing with a plain "not a git repository" error. That one was worked around by publishing the built artifact by hand for that release.
Unlock this article to keep reading, or subscribe for unlimited access to everything. See Pricing for details.