pki: T9149: fix broken OpenVPN shared-secret generated by op-mode

Since T9008, "generate pki openvpn shared-secret install" kept the comment
lines of the openvpn --genkey output as empty lines. The BEGIN marker of the
key was therefore stored as part of the key data, and the key file written
on commit carried it twice. OpenVPN refused to start every tunnel using it.

Comment-only lines are dropped again, as the previous grep -o pipeline did,
so only the hex key material is installed. Printed and file output lose the
leading blank lines as well.

The OpenVPN smoketest now installs a key through the op-mode command and
brings up a site-to-site tunnel with it, instead of only using a hardcoded
key.

1 files changed, 4 insertions, 3 deletions

diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py
index d53be1f92..55f307894 100755
--- a/src/op_mode/pki.py
+++ b/src/op_mode/pki.py
@@ -939,9 +939,10 @@ def generate_keypair(name, install=False, file=False):
 
 def generate_openvpn_key(name, install=False, file=False):
     raw_result = cmdl(['openvpn', '--genkey', 'secret', '/dev/stdout'])
-    # equivalent to the old `grep -o "^[^#]*"`, applied per line: keep
-    # everything before the first '#' on each line (comment lines become empty)
-    result = '\n'.join(line.split('#', 1)[0] for line in raw_result.splitlines())
+    # equivalent to the old `grep -o "^[^#]*"`: keep everything before the first
+    # '#' on each line and drop lines left empty (grep -o prints nothing for them)
+    stripped = (line.split('#', 1)[0] for line in raw_result.splitlines())
+    result = '\n'.join(line for line in stripped if line)
 
     if not result:
         print('Failed to generate OpenVPN key')