Skip to main content

Prepare the PII removal example

The walkthrough and machine fixture use these repository files:

  • Fixture: examples/data-security/remove-pii/sample-data.json
  • Configuration: examples/data-security/remove-pii-complete.yaml
  • Fixture environment: examples/data-security/remove-pii/fixture-environment.json
  • Expected output: examples/data-security/remove-pii/expected-output.jsonl

From the repository root, inspect both before changing field names:

jq . examples/data-security/remove-pii/sample-data.json
sed -n '1,220p' examples/data-security/remove-pii-complete.yaml

Salt inputs​

The hash mappings read three environment variables. Generate values for an adapted run without printing them:

export IP_SALT="$(openssl rand -hex 32)"
export EMAIL_SALT="$(openssl rand -hex 32)"
export USER_SALT="$(openssl rand -hex 32)"

printf 'IP=%s EMAIL=%s USER=%s\n' \
  "${#IP_SALT}" "${#EMAIL_SALT}" "${#USER_SALT}"

The configuration has no built-in salt fallback. Treat a missing or empty value as a failed precondition, and load secrets through the controls used by the adapted environment.

Run the exact fixture gate​

With Docker available, run the machine gate from the repository root:

npm run test-pipelines

The gate pulls the digest-pinned Benthos image, serves the canonical HTTP input, posts the synthetic fixture, and compares the file output byte for byte. Its checked-in salts are fixture-specific values, not secrets or deployment defaults.

Scope​

This proves one deterministic core-path result. It does not test malformed inputs, load, recovery, salt rotation, or production controls. Continue with payment-field deletion or inspect the curated Explorer.