pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw
ci / vet (pull_request) Failing after 12s
ci / vet (pull_request) Failing after 12s
Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch, AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync, list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/ build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era scripts archived. Live-validated against pwvault.turnsys.com. Ticket: https://projects.knownelement.com/issues/832
This commit is contained in:
@@ -1,75 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# bw-cli.sh — Bitwarden CLI host wrapper (container-based, native Rust binary).
|
||||
#
|
||||
# Provides transparent `bw` access on hosts where the CLI is not installed
|
||||
# natively. Runs the pre-compiled Rust bw binary inside a minimal Docker
|
||||
# container (debian-slim + ca-certificates, NO Node.js).
|
||||
#
|
||||
# All tool execution happens inside the container. Nothing runs on the host
|
||||
# except this wrapper, which only invokes docker.
|
||||
#
|
||||
# Usage:
|
||||
# bw-cli.sh status Check vault status
|
||||
# bw-cli.sh list items List vault items
|
||||
# bw-cli.sh list collections List collections
|
||||
# bw-cli.sh get password "Item" Retrieve a password
|
||||
# bw-cli.sh get totp "Item" Retrieve a TOTP code
|
||||
# bw-cli.sh get item "Item" Full item JSON
|
||||
# bw-cli.sh generate -ulns Generate a password
|
||||
#
|
||||
# Install to ~/.local/bin/bw via:
|
||||
# scripts/bw-install.sh
|
||||
#
|
||||
# Environment overrides:
|
||||
# BW_ENV_FILE Path to credentials (default: ~/.config/bw/env)
|
||||
# BW_IMAGE Docker image (default: reachableceo-bw-native:2026.7.0)
|
||||
# BW_VOLUME Docker volume for persisted login state
|
||||
# (default: tsys-bw-cli-state)
|
||||
# BW_LIB_DIR Directory containing entrypoint.sh (default: ~/.local/share/bw)
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
BW_ENV_FILE="${BW_ENV_FILE:-$HOME/.config/bw/env}"
|
||||
BW_IMAGE="${BW_IMAGE:-reachableceo-bw-native:2026.7.0}"
|
||||
BW_VOLUME="${BW_VOLUME:-tsys-bw-cli-state}"
|
||||
BW_LIB_DIR="${BW_LIB_DIR:-$HOME/.local/share/bw}"
|
||||
|
||||
# --- Validate prerequisites ---
|
||||
if [ ! -f "$BW_ENV_FILE" ]; then
|
||||
echo "bw: credential file not found: $BW_ENV_FILE" >&2
|
||||
echo " expected BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD, BW_SERVER" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then
|
||||
echo "bw: Docker image not found: $BW_IMAGE" >&2
|
||||
echo " build it: scripts/bw-install.sh" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -f "$BW_LIB_DIR/entrypoint.sh" ]; then
|
||||
echo "bw: entrypoint script missing: $BW_LIB_DIR/entrypoint.sh" >&2
|
||||
echo " install via: scripts/bw-install.sh" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# --- Load credentials (values are single-quoted in env file) ---
|
||||
set -a
|
||||
# shellcheck source=/dev/null
|
||||
. "$BW_ENV_FILE"
|
||||
set +a
|
||||
|
||||
# --- Create persistent volume for BW CLI login state ---
|
||||
docker volume create "$BW_VOLUME" >/dev/null 2>&1 || true
|
||||
|
||||
# --- Run bw inside the container ---
|
||||
docker run --rm -i \
|
||||
-e BW_CLIENTID \
|
||||
-e BW_CLIENTSECRET \
|
||||
-e BW_PASSWORD \
|
||||
-e BW_SERVER \
|
||||
-v "$BW_VOLUME:/root/.config/Bitwarden CLI" \
|
||||
-v "$BW_LIB_DIR/entrypoint.sh:/opt/bw/entrypoint.sh:ro" \
|
||||
--entrypoint sh \
|
||||
"$BW_IMAGE" \
|
||||
/opt/bw/entrypoint.sh "$@"
|
||||
@@ -1,44 +0,0 @@
|
||||
#!/bin/sh
|
||||
# bw-entrypoint.sh — Bitwarden auth lifecycle, runs inside the container.
|
||||
#
|
||||
# Mounted at /opt/bw/entrypoint.sh by the host-side wrapper (bw-cli.sh).
|
||||
# Handles: server config, API-key login, vault unlock, sync.
|
||||
# Then execs the real bw command with BW_SESSION set.
|
||||
#
|
||||
# API key authentication does NOT require TOTP. The API key itself is
|
||||
# obtained from an authenticated web vault session, so 2FA is already
|
||||
# satisfied at key-generation time.
|
||||
#
|
||||
# This script intentionally uses /bin/sh (not bash) for minimal container
|
||||
# compatibility. shellcheck directive below silences the "not bash" note.
|
||||
# shellcheck shell=sh
|
||||
|
||||
set -e
|
||||
|
||||
BW_SERVER="${BW_SERVER:-https://pwvault.turnsys.com}"
|
||||
|
||||
# Suppress BW CLI data-dir creation noise and telemetry.
|
||||
export BW_NO_SENTRY=true
|
||||
|
||||
# --- Step 1: Configure server (fails harmlessly if already logged in) ---
|
||||
bw config server "$BW_SERVER" >/dev/null 2>&1 || true
|
||||
|
||||
# --- Step 2: Login via API key (silently skips if already authenticated) ---
|
||||
bw login --apikey >/dev/null 2>&1 || true
|
||||
|
||||
# --- Step 3: Unlock the vault ---
|
||||
printf '%s' "$BW_PASSWORD" > /tmp/.bwpw
|
||||
SESS=$(bw unlock --passwordfile /tmp/.bwpw --raw 2>/dev/null)
|
||||
rm -f /tmp/.bwpw
|
||||
if [ -z "$SESS" ]; then
|
||||
echo "bw: unlock failed. Check BW_PASSWORD in ~/.config/bw/env" >&2
|
||||
echo " Values must be single-quoted; \$ chars get mangled if unquoted." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# --- Step 4: Sync ---
|
||||
bw sync --session "$SESS" >/dev/null 2>&1 || true
|
||||
|
||||
# --- Step 5: Execute the requested command ---
|
||||
export BW_SESSION="$SESS"
|
||||
exec bw "$@"
|
||||
@@ -1,125 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# bw-install.sh — Install the container-based Bitwarden CLI wrapper.
|
||||
#
|
||||
# Downloads the native Rust bw binary, builds the Docker image, and installs
|
||||
# the host-side wrapper plus container entrypoint to the user's local paths.
|
||||
# No Node.js is involved at any layer.
|
||||
#
|
||||
# Usage:
|
||||
# bw-install.sh Download, build, and install everything
|
||||
# bw-install.sh --check Verify installation status without changes
|
||||
#
|
||||
# Prerequisites:
|
||||
# - docker on PATH
|
||||
# - BW env file at ~/.config/bw/env (see prereq-check.sh in TSYSGroupAIOS)
|
||||
#
|
||||
# After install, ~/.local/bin/bw provides transparent CLI access. Add
|
||||
# ~/.local/bin to PATH if not already (most distros do this via ~/.profile).
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
REPO_ROOT="$(cd "$HERE/.." && pwd)"
|
||||
|
||||
BW_VERSION="2026.7.0"
|
||||
BW_IMAGE="reachableceo-bw-native:${BW_VERSION}"
|
||||
BW_BINARY_URL="https://github.com/bitwarden/clients/releases/download/cli-v${BW_VERSION}/bw-linux-${BW_VERSION}.zip"
|
||||
|
||||
INSTALL_BIN="${HOME}/.local/bin"
|
||||
INSTALL_LIB="${HOME}/.local/share/bw"
|
||||
BUILD_DIR=""
|
||||
|
||||
# --- Helpers ---
|
||||
log_info() { printf '\033[0;34m›\033[0m %s\n' "$*"; }
|
||||
log_ok() { printf '\033[0;32m✓\033[0m %s\n' "$*"; }
|
||||
log_warn() { printf '\033[1;33m⚠\033[0m %s\n' "$*" >&2; }
|
||||
log_error() { printf '\033[0;31m✗\033[0m %s\n' "$*" >&2; }
|
||||
log_step() { printf '\n\033[1m== %s ==\033[0m\n' "$*"; }
|
||||
die() { log_error "$*"; exit 1; }
|
||||
|
||||
# --- Cleanup on exit ---
|
||||
cleanup() {
|
||||
[ -n "$BUILD_DIR" ] && rm -rf "$BUILD_DIR"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
# --- Check mode ---
|
||||
if [ "${1:-}" = "--check" ]; then
|
||||
log_step "BW CLI installation check"
|
||||
if command -v docker >/dev/null 2>&1; then
|
||||
log_ok "docker on PATH"
|
||||
else
|
||||
log_error "docker not on PATH"
|
||||
fi
|
||||
if docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then
|
||||
log_ok "Docker image ${BW_IMAGE} exists"
|
||||
else
|
||||
log_error "Docker image ${BW_IMAGE} missing"
|
||||
fi
|
||||
if [ -x "${INSTALL_BIN}/bw" ]; then
|
||||
log_ok "Host wrapper at ${INSTALL_BIN}/bw"
|
||||
else
|
||||
log_error "Host wrapper at ${INSTALL_BIN}/bw missing"
|
||||
fi
|
||||
if [ -f "${INSTALL_LIB}/entrypoint.sh" ]; then
|
||||
log_ok "Entrypoint at ${INSTALL_LIB}/entrypoint.sh"
|
||||
else
|
||||
log_error "Entrypoint at ${INSTALL_LIB}/entrypoint.sh missing"
|
||||
fi
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# --- Prerequisites ---
|
||||
command -v docker >/dev/null 2>&1 || die "docker not found on PATH"
|
||||
|
||||
log_step "Installing container-based Bitwarden CLI (native Rust, no Node.js)"
|
||||
|
||||
# --- Step 1: Download and extract the native binary ---
|
||||
BUILD_DIR=$(mktemp -d)
|
||||
log_info "Downloading bw ${BW_VERSION} native binary..."
|
||||
|
||||
docker run --rm -v "${BUILD_DIR}:/build" alpine:3.20 \
|
||||
sh -c "apk add --no-cache unzip >/dev/null 2>&1 && \
|
||||
wget -q -O /build/bw.zip '${BW_BINARY_URL}' && \
|
||||
unzip -o /build/bw.zip -d /build/ && \
|
||||
rm /build/bw.zip && \
|
||||
chmod +x /build/bw"
|
||||
|
||||
[ -f "${BUILD_DIR}/bw" ] || die "download failed: bw binary not found"
|
||||
log_ok "Downloaded native binary"
|
||||
|
||||
# --- Step 2: Build the Docker image ---
|
||||
log_info "Building Docker image ${BW_IMAGE}..."
|
||||
|
||||
DOCKERFILE_DIR="${REPO_ROOT}/docker/bw-native"
|
||||
if [ ! -f "${DOCKERFILE_DIR}/Dockerfile" ]; then
|
||||
die "Dockerfile not found: ${DOCKERFILE_DIR}/Dockerfile"
|
||||
fi
|
||||
|
||||
cp "${BUILD_DIR}/bw" "${DOCKERFILE_DIR}/bw"
|
||||
docker build -t "$BW_IMAGE" "$DOCKERFILE_DIR"
|
||||
rm -f "${DOCKERFILE_DIR}/bw"
|
||||
log_ok "Built image ${BW_IMAGE}"
|
||||
|
||||
# --- Step 3: Install host-side wrapper and entrypoint ---
|
||||
mkdir -p "$INSTALL_BIN" "$INSTALL_LIB"
|
||||
|
||||
cp "${HERE}/bw-cli.sh" "${INSTALL_BIN}/bw"
|
||||
chmod 755 "${INSTALL_BIN}/bw"
|
||||
log_ok "Installed wrapper to ${INSTALL_BIN}/bw"
|
||||
|
||||
cp "${HERE}/bw-entrypoint.sh" "${INSTALL_LIB}/entrypoint.sh"
|
||||
chmod 755 "${INSTALL_LIB}/entrypoint.sh"
|
||||
log_ok "Installed entrypoint to ${INSTALL_LIB}/entrypoint.sh"
|
||||
|
||||
# --- Step 4: Verify ---
|
||||
log_info "Verifying installation..."
|
||||
if "${INSTALL_BIN}/bw" --version >/dev/null 2>&1; then
|
||||
log_ok "bw CLI is operational"
|
||||
else
|
||||
log_warn "bw wrapper installed but verification call failed"
|
||||
log_warn "check ~/.config/bw/env credentials and try: bw status"
|
||||
fi
|
||||
|
||||
log_step "Installation complete"
|
||||
log_info "Usage: bw status | bw list items | bw get password \"Item Name\""
|
||||
-148
@@ -1,148 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Written by Chatgpt
|
||||
# 70% problem for sure..
|
||||
|
||||
|
||||
# shellcheck disable=SC1090
|
||||
|
||||
# Bash3 Boilerplate Setup
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
set -o pipefail
|
||||
IFS=$'\n\t'
|
||||
|
||||
# Constants
|
||||
readonly SCRIPT_NAME=$(basename "$0")
|
||||
readonly SCRIPT_VERSION="1.0"
|
||||
readonly SCRIPT_AUTHOR="Charles N Wyble"
|
||||
readonly SCRIPT_DESC="TSYS Secrets Manager - Fetch secrets using the Bitwarden CLI"
|
||||
|
||||
# Configuration
|
||||
readonly BW_SERVER_URL="https://pwvault.turnsys.com" # Updated Bitwarden server URL
|
||||
|
||||
# Logging and Debugging
|
||||
readonly LOG_FILE="/tmp/${SCRIPT_NAME}.log"
|
||||
readonly TIMESTAMP=$(date '+%m-%d-%Y %H:%M:%S')
|
||||
info() { echo "[INFO] [$TIMESTAMP] $*" | tee -a "$LOG_FILE"; }
|
||||
error() { echo "[ERROR] [$TIMESTAMP] $*" >&2 | tee -a "$LOG_FILE"; }
|
||||
|
||||
# Default Exit Codes
|
||||
readonly ERR_BW_NOT_INSTALLED=10
|
||||
readonly ERR_BW_SERVER_CONFIG=20
|
||||
readonly ERR_SESSION_INVALID=30
|
||||
readonly ERR_SECRET_NOT_FOUND=40
|
||||
|
||||
# Cleanup function to unset session environment variable
|
||||
cleanup() {
|
||||
info "Cleaning up and unsetting session environment variable."
|
||||
unset BW_SESSION
|
||||
}
|
||||
|
||||
# Function: Setup Bitwarden server configuration
|
||||
setup_bitwarden_server() {
|
||||
info "Configuring Bitwarden server to $BW_SERVER_URL..."
|
||||
# Set the server URL for Bitwarden CLI
|
||||
if ! bw config --quiet server "$BW_SERVER_URL"; then
|
||||
error "Failed to configure Bitwarden server."
|
||||
exit $ERR_BW_SERVER_CONFIG
|
||||
fi
|
||||
info "Bitwarden server configured successfully."
|
||||
}
|
||||
|
||||
# Function: Fetch or initialize Bitwarden session
|
||||
fetch_bw_session() {
|
||||
local session_token
|
||||
|
||||
# Check if Bitwarden CLI is installed
|
||||
if ! command -v bw &>/dev/null; then
|
||||
error "Bitwarden CLI (bw) is not installed or not in PATH. Please install it and try again."
|
||||
exit $ERR_BW_NOT_INSTALLED
|
||||
fi
|
||||
|
||||
# Check for existing session environment variable and reuse if valid
|
||||
if [[ -n "${BW_SESSION:-}" ]] && bw unlock --check --session "$BW_SESSION" >/dev/null 2>&1; then
|
||||
info "Using existing Bitwarden session token."
|
||||
return
|
||||
fi
|
||||
|
||||
# Unlock the Bitwarden vault and obtain a new session token
|
||||
info "Unlocking Bitwarden vault..."
|
||||
|
||||
bw login --apikey $BW_CLIENTID $BW_CLIENTSECRET
|
||||
|
||||
session_token=$(bw unlock --passwordenv TSYS_BW_PASSWORD_REACHABLECEO --raw)
|
||||
if [[ -z "$session_token" ]]; then
|
||||
error "Failed to unlock Bitwarden vault. Ensure you're logged in using 'bw login'."
|
||||
exit $ERR_SESSION_INVALID
|
||||
fi
|
||||
|
||||
export BW_SESSION="$session_token"
|
||||
info "Session initialized successfully."
|
||||
}
|
||||
|
||||
# Function: Fetch a secret by name
|
||||
fetch_secret() {
|
||||
local secret_name="$1"
|
||||
local secret_value
|
||||
|
||||
info "Fetching secret '$secret_name' from Bitwarden..."
|
||||
if ! secret_value=$(bw get password "$secret_name" --session "$BW_SESSION"); then
|
||||
error "Failed to retrieve the secret '$secret_name'. Ensure the secret exists in the vault."
|
||||
exit $ERR_SECRET_NOT_FOUND
|
||||
fi
|
||||
|
||||
if [[ -z "$secret_value" ]]; then
|
||||
error "Secret '$secret_name' is empty or not found. Check the vault for proper configuration."
|
||||
exit $ERR_SECRET_NOT_FOUND
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
# Function: Display usage instructions
|
||||
usage() {
|
||||
cat <<EOF
|
||||
$SCRIPT_DESC
|
||||
|
||||
Usage:
|
||||
$SCRIPT_NAME <secret_name>
|
||||
|
||||
Options:
|
||||
-h, --help Display this help message.
|
||||
|
||||
Example:
|
||||
$SCRIPT_NAME tsys_api_key
|
||||
EOF
|
||||
}
|
||||
|
||||
# Main function
|
||||
main() {
|
||||
|
||||
bw logout || true
|
||||
|
||||
source D:/tsys/secrets/bitwarden/data/apikey-bitwarden-reachableceo
|
||||
|
||||
local secret_name="$1"
|
||||
|
||||
# Setup Bitwarden server and session management
|
||||
setup_bitwarden_server
|
||||
fetch_bw_session
|
||||
|
||||
# Fetch the specified secret
|
||||
secret_value=$(fetch_secret "$secret_name")
|
||||
info "Secret '$secret_name' fetched successfully."
|
||||
|
||||
echo "Secret value is: $secret_value"
|
||||
|
||||
}
|
||||
|
||||
# Trap signals (Ctrl+C, kill, etc.) to ensure cleanup happens
|
||||
trap cleanup EXIT INT TERM
|
||||
|
||||
# Argument parsing
|
||||
if [[ $# -lt 1 ]] || [[ "$1" == "-h" ]] || [[ "$1" == "--help" ]]; then
|
||||
usage
|
||||
exit 0
|
||||
fi
|
||||
|
||||
main "$1"
|
||||
Reference in New Issue
Block a user