pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw

Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch, AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync, list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/ build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era scripts archived. Live-validated against pwvault.turnsys.com. Ticket: https://projects.knownelement.com/issues/832
2026-09-06 16:45:45 -05:00
parent f63417b1eb
commit 4728b3cff0
18 changed files with 1304 additions and 0 deletions
@@ -0,0 +1,44 @@
+#!/bin/sh
+# bw-entrypoint.sh — Bitwarden auth lifecycle, runs inside the container.
+#
+# Mounted at /opt/bw/entrypoint.sh by the host-side wrapper (bw-cli.sh).
+# Handles: server config, API-key login, vault unlock, sync.
+# Then execs the real bw command with BW_SESSION set.
+#
+# API key authentication does NOT require TOTP. The API key itself is
+# obtained from an authenticated web vault session, so 2FA is already
+# satisfied at key-generation time.
+#
+# This script intentionally uses /bin/sh (not bash) for minimal container
+# compatibility. shellcheck directive below silences the "not bash" note.
+# shellcheck shell=sh
+
+set -e
+
+BW_SERVER="${BW_SERVER:-https://pwvault.turnsys.com}"
+
+# Suppress BW CLI data-dir creation noise and telemetry.
+export BW_NO_SENTRY=true
+
+# --- Step 1: Configure server (fails harmlessly if already logged in) ---
+bw config server "$BW_SERVER" >/dev/null 2>&1 || true
+
+# --- Step 2: Login via API key (silently skips if already authenticated) ---
+bw login --apikey >/dev/null 2>&1 || true
+
+# --- Step 3: Unlock the vault ---
+printf '%s' "$BW_PASSWORD" > /tmp/.bwpw
+SESS=$(bw unlock --passwordfile /tmp/.bwpw --raw 2>/dev/null)
+rm -f /tmp/.bwpw
+if [ -z "$SESS" ]; then
+    echo "bw: unlock failed. Check BW_PASSWORD in ~/.config/bw/env" >&2
+    echo "    Values must be single-quoted; \$ chars get mangled if unquoted." >&2
+    exit 1
+fi
+
+# --- Step 4: Sync ---
+bw sync --session "$SESS" >/dev/null 2>&1 || true
+
+# --- Step 5: Execute the requested command ---
+export BW_SESSION="$SESS"
+exec bw "$@"