fix: parse env safely in enrollment script

scripts/enroll_update_service.sh

@@ -39,16 +39,34 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
-if [[ -f "${ENV_FILE}" ]]; then
-  set -a
-  # shellcheck disable=SC1090
-  . "${ENV_FILE}"
-  set +a
-fi
+read_env_value() {
+  local key="$1"
+  python3 - <<'PY' "${ENV_FILE}" "${key}"
+from pathlib import Path
+import sys
 
-SERVICE_URL="${SERVICE_URL:-${SKD_UPDATE_SERVICE_URL:-}}"
-PROJECT_ID="${PROJECT_ID:-${SKD_UPDATE_PROJECT_ID:-}}"
-TOKEN_FILE="${OUTPUT_PATH:-${TOKEN_FILE}}"
+path = Path(sys.argv[1])
+key = sys.argv[2]
+if not path.exists():
+    sys.exit(0)
+
+for raw in path.read_text(encoding="utf-8").splitlines():
+    line = raw.strip()
+    if not line or line.startswith("#"):
+        continue
+    if not line.startswith(f"{key}="):
+        continue
+    value = line.split("=", 1)[1].strip()
+    if (value.startswith('"') and value.endswith('"')) or (value.startswith("'") and value.endswith("'")):
+        value = value[1:-1]
+    print(value)
+    sys.exit(0)
+PY
+}
+
+SERVICE_URL="${SERVICE_URL:-$(read_env_value SKD_UPDATE_SERVICE_URL)}"
+PROJECT_ID="${PROJECT_ID:-$(read_env_value SKD_UPDATE_PROJECT_ID)}"
+TOKEN_FILE="${OUTPUT_PATH:-${TOKEN_FILE:-$(read_env_value SKD_UPDATE_TOKEN_FILE)}}"
 CLIENT_ID="${CLIENT_ID:-$(hostname)}"
 
 if [[ -z "${SERVICE_URL}" || -z "${PROJECT_ID}" ]]; then