32 lines
1.6 KiB
Bash
32 lines
1.6 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Regression: the wrapper accepts only an operation name and never places a
|
|
# plaintext credential on a Docker/Compose command line.
|
|
script="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)/provision-machine-credential.sh"
|
|
tmp="$(mktemp -d)"
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
mkdir -p "$tmp/bin" "$tmp/repo/deploy"
|
|
cp "$script" "$tmp/repo/deploy/provision-machine-credential.sh"
|
|
printf 'placeholder\n' > "$tmp/repo/deploy/docker-compose.prod.yml"
|
|
printf 'placeholder\n' > "$tmp/env"
|
|
cat > "$tmp/bin/docker" <<'SH'
|
|
#!/usr/bin/env bash
|
|
printf '%s\n' "$*" >> "${CAPTURE:?}"
|
|
SH
|
|
cat > "$tmp/bin/git" <<'SH'
|
|
#!/usr/bin/env bash
|
|
printf '0123456789abcdef0123456789abcdef01234567\n'
|
|
SH
|
|
chmod +x "$tmp/bin/docker" "$tmp/bin/git" "$tmp/repo/deploy/provision-machine-credential.sh"
|
|
capture="$tmp/capture"
|
|
PATH="$tmp/bin:$PATH" CAPTURE="$capture" REPO_DIR="$tmp/repo" ENV_FILE="$tmp/env" "$tmp/repo/deploy/provision-machine-credential.sh" ensure >/dev/null
|
|
grep -qx 'volume create assistant_control_plane_service_secrets' "$capture"
|
|
grep -q -- '--profile secret-control-plane run --rm --no-deps secret-control-plane ensure' "$capture"
|
|
PATH="$tmp/bin:$PATH" CAPTURE="$capture" REPO_DIR="$tmp/repo" ENV_FILE="$tmp/env" ROTATION_REASON=owner-requested-rotation "$tmp/repo/deploy/provision-machine-credential.sh" rotate >/dev/null
|
|
grep -q -- '--profile secret-control-plane run --rm --no-deps secret-control-plane -reason owner-requested-rotation rotate' "$capture"
|
|
if grep -Eqi '(token=|password=|secret=|authorization:)' "$capture"; then
|
|
echo "provisioning wrapper passed credential material" >&2
|
|
exit 1
|
|
fi
|