fix: rewrite archived README (heredoc expansion corrupted it) [#769 ]

docs: archived — moved to KNEL/secrets per #769
feat: container-based Bitwarden CLI, no host Node.js
2026-09-04 06:58:21 -05:00 · 2026-09-04 06:57:10 -05:00 · 2026-08-14 09:52:05 -05:00 · 2025-07-16 10:17:07 -05:00
7 changed files with 347 additions and 274 deletions
@@ -1,268 +1,5 @@
-# TSYS Secrets Manager
+# KNELSecretsManager (ARCHIVED — moved to KNEL/secrets)
-A comprehensive bash script solution for managing secrets at TSYS using the Bitwarden CLI. This tool provides automated installation, configuration, and secure secret retrieval from your Bitwarden vault.
+This body of work moved to **[KNEL/secrets](https://git.knownelement.com/KNEL/secrets)** per the 2026-09-03 repo split ([#769](https://projects.knownelement.com/issues/769)); content was ported as `legacy-knelsecretsmanager/` (secret-scanned clean — placeholders only).
-## Features
+This repo is historical. New secrets-management work happens in KNEL/secrets (#770).
 - **Automated Installation**: Automatically detects and installs Bitwarden CLI via multiple methods (snap, npm, direct download)
 - **Configuration Management**: Uses secure configuration files for server and authentication details
 - **Multiple Commands**: Support for installation, secret retrieval, listing, and testing
 - **Robust Error Handling**: Comprehensive error codes and detailed logging
 - **Security-First**: Proper session management, cleanup, and credential handling
 - **Cross-Platform**: Designed for Linux environments with multiple installation fallbacks
 ## Quick Start
 1. **Clone and Setup**:
   ```bash
   git clone <repository-url>
   cd KNELSecretsManager
   chmod +x secrets-manager.sh
   ```
 2. **Create Configuration**:
   ```bash
   cp config/bitwarden-config.conf.sample bitwarden-config.conf
   # Edit bitwarden-config.conf with your actual Bitwarden credentials
   ```
 3. **Install Bitwarden CLI** (if not already installed):
   ```bash
   ./secrets-manager.sh install
   ```
 4. **Test Your Setup**:
   ```bash
   ./secrets-manager.sh test
   ```
 5. **Retrieve Secrets**:
   ```bash
   ./secrets-manager.sh get APIKEY-pushover
   ```
 ## Configuration
 Create a `bitwarden-config.conf` file based on the provided sample in the `config/` directory:
 ```bash
 # Bitwarden server URL
 BW_SERVER_URL="https://pwvault.turnsys.com"
 # API credentials (from Bitwarden account settings)
 BW_CLIENTID="your_client_id_here"
 BW_CLIENTSECRET="your_client_secret_here"
 # Master password
 BW_PASSWORD="your_master_password_here"
 ```
 **Security Note**: The actual configuration file is automatically ignored by git to prevent credential exposure.
 ## Usage
 ### Command Reference
 ```bash
 ./secrets-manager.sh [OPTIONS] COMMAND [ARGS]
 ```
 #### Commands
 - **`install`** - Install Bitwarden CLI
 - **`get <secret_name>`** - Retrieve a specific secret
 - **`list`** - List all available secrets in your vault
 - **`test`** - Test configuration and connectivity
 #### Options
 - **`-c, --config FILE`** - Use specific config file (default: `./bitwarden-config.conf`)
 - **`-h, --help`** - Show help message
 - **`-v, --version`** - Show version information
 ### Examples
 ```bash
 # Install Bitwarden CLI
 ./secrets-manager.sh install
 # Test your configuration
 ./secrets-manager.sh test
 # Get a specific secret
 ./secrets-manager.sh get APIKEY-pushover
 # List all available secrets
 ./secrets-manager.sh list
 # Use a custom config file
 ./secrets-manager.sh --config /path/to/custom.conf get my-secret
 ```
 ### Using in Scripts
 ```bash
 #!/bin/bash
 # Example: Load API key into environment variable
 export PUSHOVER_API="$(./secrets-manager.sh get APIKEY-pushover)"
 # Use the secret in your application
 curl -X POST "https://api.pushover.net/1/messages.json" \
  -d "token=$PUSHOVER_API" \
  -d "user=your_user_key" \
  -d "message=Hello from TSYS!"
 ```
 ## Installation Methods
 The script automatically tries multiple installation methods in order:
 1. **Snap Package** (if snapd is available)
 2. **NPM Global Package** (if npm is available)
 3. **Direct Binary Download** (fallback method)
 ## Error Codes
 | Code | Description |
 |------|-------------|
 | 10   | Configuration file not found |
 | 20   | Bitwarden CLI not installed |
 | 30   | Bitwarden CLI installation failed |
 | 40   | Server configuration failed |
 | 50   | Session/unlock failed |
 | 60   | Secret not found |
 | 70   | Login failed |
 ## Logging
 All operations are logged to `/tmp/secrets-manager.sh.log` for debugging and audit purposes.
 ## Security Considerations
 - Configuration files containing credentials are automatically gitignored
 - Session tokens are properly cleaned up on script exit
 - Master passwords are handled securely without shell history exposure
 - All sensitive operations include proper error handling
 ## Legacy Scripts
 ## Repository Structure
 ```
 KNELSecretsManager/
 ├── secrets-manager.sh           # Main secrets management script
 ├── README.md                    # This documentation
 ├── LICENSE                      # License information
 ├── Makefile                     # Build and test automation
 ├── .gitignore                   # Git ignore rules
 ├── bin/                        # Legacy scripts and utilities
 │   ├── poc.sh                  # Original proof of concept
 │   └── prod.sh                 # ChatGPT-assisted production attempt
 ├── config/                     # Configuration templates
 │   └── bitwarden-config.conf.sample  # Sample configuration
 ├── tests/                      # Test suite
 │   └── test-secrets-manager.sh # Comprehensive test framework
 └── docs/                       # Documentation
    └── ADR-Node.md             # Architecture Decision Records
 ```
 The main `secrets-manager.sh` script combines the best features of the legacy implementations while adding robust error handling, installation management, and improved security.
 ## Testing
 This project includes a comprehensive test suite designed to work both standalone and when vendored into shell scripting frameworks.
 ### Running Tests
 ```bash
 # Run all tests
 ./tests/test-secrets-manager.sh run
 # Run tests in CI mode (no colors)
 ./tests/test-secrets-manager.sh --ci run
 # Using Make (recommended)
 make test          # Run all tests
 make test-ci       # Run in CI mode
 make lint          # Run shellcheck
 make all           # Run deps, lint, and tests
 ```
 ### Test Coverage
 The test suite covers:
 - Script existence and permissions
 - Command-line argument parsing
 - Help and version output
 - Error handling and exit codes
 - Configuration file validation
 - Bitwarden CLI dependency checks
 - Performance and startup time
 - Vendor integration compatibility
 ### Vendor Integration Testing
 When this project is vendored into other shell scripting frameworks:
 ```bash
 # Test as vendored dependency
 make vendor-test
 # Or manually
 mkdir /tmp/vendor-test
 cp secrets-manager.sh tests/test-secrets-manager.sh config/bitwarden-config.conf.sample /tmp/vendor-test/
 cd /tmp/vendor-test && ./test-secrets-manager.sh --ci run
 ```
 ### Development Testing
 ```bash
 # Setup development environment
 make dev-setup
 # Run tests with development config
 make dev-test
 ```
 ## Architecture Decision Records
 This project includes ADRs for key architectural decisions:
 - **ADR-001**: [Node.js Version Management Strategy](docs/ADR-Node.md) - Analysis of MISE vs system packages for Node.js version management
 ## Contributing
 When contributing to this project:
 1. **Test all changes thoroughly**:
   ```bash
   make ci  # Run full CI pipeline
   ```
 2. **Update documentation as needed**
 3. **Follow existing code style and conventions**
 4. **Run security checks**:
   ```bash
   make security-check
   ```
 5. **Ensure compatibility with vendor integration**:
   ```bash
   make vendor-test
   ```
 ## Development Commands
 ```bash
 make help           # Show all available commands
 make install        # Install dependencies
 make dev-setup      # Setup development environment
 make lint           # Run shellcheck
 make security-check # Basic security validation
 make clean          # Clean temporary files
 make docs           # Generate documentation
 ```
 ## License
 See [LICENSE](LICENSE) file for details.
@@ -0,0 +1,75 @@
 #!/usr/bin/env bash
 # bw-cli.sh — Bitwarden CLI host wrapper (container-based, native Rust binary).
 #
 # Provides transparent `bw` access on hosts where the CLI is not installed
 # natively. Runs the pre-compiled Rust bw binary inside a minimal Docker
 # container (debian-slim + ca-certificates, NO Node.js).
 #
 # All tool execution happens inside the container. Nothing runs on the host
 # except this wrapper, which only invokes docker.
 #
 # Usage:
 #   bw-cli.sh status                 Check vault status
 #   bw-cli.sh list items             List vault items
 #   bw-cli.sh list collections       List collections
 #   bw-cli.sh get password "Item"    Retrieve a password
 #   bw-cli.sh get totp "Item"        Retrieve a TOTP code
 #   bw-cli.sh get item "Item"        Full item JSON
 #   bw-cli.sh generate -ulns         Generate a password
 #
 # Install to ~/.local/bin/bw via:
 #   scripts/bw-install.sh
 #
 # Environment overrides:
 #   BW_ENV_FILE   Path to credentials (default: ~/.config/bw/env)
 #   BW_IMAGE      Docker image (default: reachableceo-bw-native:2026.7.0)
 #   BW_VOLUME     Docker volume for persisted login state
 #                 (default: tsys-bw-cli-state)
 #   BW_LIB_DIR    Directory containing entrypoint.sh (default: ~/.local/share/bw)
 set -euo pipefail
 BW_ENV_FILE="${BW_ENV_FILE:-$HOME/.config/bw/env}"
 BW_IMAGE="${BW_IMAGE:-reachableceo-bw-native:2026.7.0}"
 BW_VOLUME="${BW_VOLUME:-tsys-bw-cli-state}"
 BW_LIB_DIR="${BW_LIB_DIR:-$HOME/.local/share/bw}"
 # --- Validate prerequisites ---
 if [ ! -f "$BW_ENV_FILE" ]; then
    echo "bw: credential file not found: $BW_ENV_FILE" >&2
    echo "    expected BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD, BW_SERVER" >&2
    exit 1
 fi
 if ! docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then
    echo "bw: Docker image not found: $BW_IMAGE" >&2
    echo "    build it: scripts/bw-install.sh" >&2
    exit 1
 fi
 if [ ! -f "$BW_LIB_DIR/entrypoint.sh" ]; then
    echo "bw: entrypoint script missing: $BW_LIB_DIR/entrypoint.sh" >&2
    echo "    install via: scripts/bw-install.sh" >&2
    exit 1
 fi
 # --- Load credentials (values are single-quoted in env file) ---
 set -a
 # shellcheck source=/dev/null
 . "$BW_ENV_FILE"
 set +a
 # --- Create persistent volume for BW CLI login state ---
 docker volume create "$BW_VOLUME" >/dev/null 2>&1 || true
 # --- Run bw inside the container ---
 docker run --rm -i \
    -e BW_CLIENTID \
    -e BW_CLIENTSECRET \
    -e BW_PASSWORD \
    -e BW_SERVER \
    -v "$BW_VOLUME:/root/.config/Bitwarden CLI" \
    -v "$BW_LIB_DIR/entrypoint.sh:/opt/bw/entrypoint.sh:ro" \
    --entrypoint sh \
    "$BW_IMAGE" \
    /opt/bw/entrypoint.sh "$@"
@@ -0,0 +1,44 @@
 #!/bin/sh
 # bw-entrypoint.sh — Bitwarden auth lifecycle, runs inside the container.
 #
 # Mounted at /opt/bw/entrypoint.sh by the host-side wrapper (bw-cli.sh).
 # Handles: server config, API-key login, vault unlock, sync.
 # Then execs the real bw command with BW_SESSION set.
 #
 # API key authentication does NOT require TOTP. The API key itself is
 # obtained from an authenticated web vault session, so 2FA is already
 # satisfied at key-generation time.
 #
 # This script intentionally uses /bin/sh (not bash) for minimal container
 # compatibility. shellcheck directive below silences the "not bash" note.
 # shellcheck shell=sh
 set -e
 BW_SERVER="${BW_SERVER:-https://pwvault.turnsys.com}"
 # Suppress BW CLI data-dir creation noise and telemetry.
 export BW_NO_SENTRY=true
 # --- Step 1: Configure server (fails harmlessly if already logged in) ---
 bw config server "$BW_SERVER" >/dev/null 2>&1 || true
 # --- Step 2: Login via API key (silently skips if already authenticated) ---
 bw login --apikey >/dev/null 2>&1 || true
 # --- Step 3: Unlock the vault ---
 printf '%s' "$BW_PASSWORD" > /tmp/.bwpw
 SESS=$(bw unlock --passwordfile /tmp/.bwpw --raw 2>/dev/null)
 rm -f /tmp/.bwpw
 if [ -z "$SESS" ]; then
    echo "bw: unlock failed. Check BW_PASSWORD in ~/.config/bw/env" >&2
    echo "    Values must be single-quoted; \$ chars get mangled if unquoted." >&2
    exit 1
 fi
 # --- Step 4: Sync ---
 bw sync --session "$SESS" >/dev/null 2>&1 || true
 # --- Step 5: Execute the requested command ---
 export BW_SESSION="$SESS"
 exec bw "$@"
@@ -0,0 +1,125 @@
 #!/usr/bin/env bash
 # bw-install.sh — Install the container-based Bitwarden CLI wrapper.
 #
 # Downloads the native Rust bw binary, builds the Docker image, and installs
 # the host-side wrapper plus container entrypoint to the user's local paths.
 # No Node.js is involved at any layer.
 #
 # Usage:
 #   bw-install.sh                Download, build, and install everything
 #   bw-install.sh --check        Verify installation status without changes
 #
 # Prerequisites:
 #   - docker on PATH
 #   - BW env file at ~/.config/bw/env (see prereq-check.sh in TSYSGroupAIOS)
 #
 # After install, ~/.local/bin/bw provides transparent CLI access. Add
 # ~/.local/bin to PATH if not already (most distros do this via ~/.profile).
 set -euo pipefail
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$HERE/.." && pwd)"
 BW_VERSION="2026.7.0"
 BW_IMAGE="reachableceo-bw-native:${BW_VERSION}"
 BW_BINARY_URL="https://github.com/bitwarden/clients/releases/download/cli-v${BW_VERSION}/bw-linux-${BW_VERSION}.zip"
 INSTALL_BIN="${HOME}/.local/bin"
 INSTALL_LIB="${HOME}/.local/share/bw"
 BUILD_DIR=""
 # --- Helpers ---
 log_info()  { printf '\033[0;34m›\033[0m %s\n' "$*"; }
 log_ok()    { printf '\033[0;32m✓\033[0m %s\n' "$*"; }
 log_warn()  { printf '\033[1;33m⚠\033[0m %s\n' "$*" >&2; }
 log_error() { printf '\033[0;31m✗\033[0m %s\n' "$*" >&2; }
 log_step()  { printf '\n\033[1m== %s ==\033[0m\n' "$*"; }
 die()       { log_error "$*"; exit 1; }
 # --- Cleanup on exit ---
 cleanup() {
    [ -n "$BUILD_DIR" ] && rm -rf "$BUILD_DIR"
 }
 trap cleanup EXIT
 # --- Check mode ---
 if [ "${1:-}" = "--check" ]; then
    log_step "BW CLI installation check"
    if command -v docker >/dev/null 2>&1; then
        log_ok "docker on PATH"
    else
        log_error "docker not on PATH"
    fi
    if docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then
        log_ok "Docker image ${BW_IMAGE} exists"
    else
        log_error "Docker image ${BW_IMAGE} missing"
    fi
    if [ -x "${INSTALL_BIN}/bw" ]; then
        log_ok "Host wrapper at ${INSTALL_BIN}/bw"
    else
        log_error "Host wrapper at ${INSTALL_BIN}/bw missing"
    fi
    if [ -f "${INSTALL_LIB}/entrypoint.sh" ]; then
        log_ok "Entrypoint at ${INSTALL_LIB}/entrypoint.sh"
    else
        log_error "Entrypoint at ${INSTALL_LIB}/entrypoint.sh missing"
    fi
    exit 0
 fi
 # --- Prerequisites ---
 command -v docker >/dev/null 2>&1 || die "docker not found on PATH"
 log_step "Installing container-based Bitwarden CLI (native Rust, no Node.js)"
 # --- Step 1: Download and extract the native binary ---
 BUILD_DIR=$(mktemp -d)
 log_info "Downloading bw ${BW_VERSION} native binary..."
 docker run --rm -v "${BUILD_DIR}:/build" alpine:3.20 \
    sh -c "apk add --no-cache unzip >/dev/null 2>&1 && \
           wget -q -O /build/bw.zip '${BW_BINARY_URL}' && \
           unzip -o /build/bw.zip -d /build/ && \
           rm /build/bw.zip && \
           chmod +x /build/bw"
 [ -f "${BUILD_DIR}/bw" ] || die "download failed: bw binary not found"
 log_ok "Downloaded native binary"
 # --- Step 2: Build the Docker image ---
 log_info "Building Docker image ${BW_IMAGE}..."
 DOCKERFILE_DIR="${REPO_ROOT}/docker/bw-native"
 if [ ! -f "${DOCKERFILE_DIR}/Dockerfile" ]; then
    die "Dockerfile not found: ${DOCKERFILE_DIR}/Dockerfile"
 fi
 cp "${BUILD_DIR}/bw" "${DOCKERFILE_DIR}/bw"
 docker build -t "$BW_IMAGE" "$DOCKERFILE_DIR"
 rm -f "${DOCKERFILE_DIR}/bw"
 log_ok "Built image ${BW_IMAGE}"
 # --- Step 3: Install host-side wrapper and entrypoint ---
 mkdir -p "$INSTALL_BIN" "$INSTALL_LIB"
 cp "${HERE}/bw-cli.sh" "${INSTALL_BIN}/bw"
 chmod 755 "${INSTALL_BIN}/bw"
 log_ok "Installed wrapper to ${INSTALL_BIN}/bw"
 cp "${HERE}/bw-entrypoint.sh" "${INSTALL_LIB}/entrypoint.sh"
 chmod 755 "${INSTALL_LIB}/entrypoint.sh"
 log_ok "Installed entrypoint to ${INSTALL_LIB}/entrypoint.sh"
 # --- Step 4: Verify ---
 log_info "Verifying installation..."
 if "${INSTALL_BIN}/bw" --version >/dev/null 2>&1; then
    log_ok "bw CLI is operational"
 else
    log_warn "bw wrapper installed but verification call failed"
    log_warn "check ~/.config/bw/env credentials and try: bw status"
 fi
 log_step "Installation complete"
 log_info "Usage: bw status | bw list items | bw get password \"Item Name\""
@@ -0,0 +1,23 @@
 # Dockerfile — Native Bitwarden CLI (Rust binary, no Node.js)
 #
 # Builds a minimal container image around the pre-compiled native bw CLI
 # binary from the official Bitwarden GitHub releases. The binary is a
 # Rust executable with glibc dependencies. No Node.js runtime is
 # included or required.
 #
 # Build prerequisites:
 #   1. Download the native binary:
 #      https://github.com/bitwarden/clients/releases/download/cli-v2026.7.0/bw-linux-2026.7.0.zip
 #   2. Unzip and place the `bw` executable next to this Dockerfile.
 #   3. Build: docker build -t reachableceo-bw-native:2026.7.0 .
 #
 # Or use the installer: scripts/bw-install.sh
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
 COPY bw /usr/local/bin/bw
 RUN chmod +x /usr/local/bin/bw
 ENTRYPOINT ["bw"]
@@ -0,0 +1,77 @@
 # ADR-002: Container-Based Bitwarden CLI (No Host Node.js)
 ## Status
 Accepted (supersedes ADR-001 for BW CLI purposes)
 ## Context
 ADR-001 selected a hybrid Node.js version-management strategy because the
 Bitwarden CLI (`bw`) is distributed via npm and therefore requires a Node.js
 runtime on every consuming host. For TSYS hosts operating under CMMC L3 /
 ITAR / STIG alignment, any host-side language runtime is an attack surface
 and a compliance finding. The KNEL/TSYS baseline ("Docker for everything")
 also forbids host language toolchains.
 Bitwarden additionally publishes the CLI as a pre-compiled single binary.
 Distributing that binary inside a minimal pinned container gives every host
 transparent `bw` access with zero host-side runtimes.
 ## Decision
 **Run the official pre-compiled bw binary inside a pinned Docker container,
 exposed to users as a transparent `bw` wrapper at `~/.local/bin/bw`.**
 Components (all in this repo):
 | File | Role |
 |---|---|
 | `docker/bw-native/Dockerfile` | `debian:12-slim` + ca-certificates + bw binary, pinned `2026.7.0` |
 | `bin/bw-entrypoint.sh` | In-container auth lifecycle: config server, API-key login, unlock, sync, exec |
 | `bin/bw-cli.sh` | Host wrapper: docker run with volume-persisted session, tsys- container prefix |
 | `bin/bw-install.sh` | One-command installer for the wrapper + image |
 Credentials live only in `~/.config/bw/env` (single-quoted values, mode 600)
 per the org-wide "no secrets on disk except BW access info" rule. The
 Vaultwarden API key is used for login (no TOTP interaction needed); the
 master password unlocks the vault; `bw sync` runs after every login so
 multi-client vault state stays coherent.
 ## Known Caveat
 The Bitwarden "native" Linux binary is actually a Node.js SEA (Single
 Executable Application): it embeds a Node.js runtime and can print Node
 errors on crash. Node.js is **absent from every host**, which satisfies the
 host-hygiene goal, but the "zero Node.js anywhere" stretch goal is not met.
 Alternatives (Rust vaultwarden clients such as `rbw`) were considered and
 rejected for now due to Vaultwarden API compatibility gaps. Revisit if a
 mature Rust client emerges; the wrapper isolates users from this swap.
 ## Consequences
 ### Positive
 - Zero language runtimes on hosts (CMMC/ITAR/STIG-friendly host hygiene)
 - Identical bw behavior across all TSYS hosts; version pinned in one Dockerfile
 - Session persistence via named Docker volume; no state divergence when
  wrapper is used consistently
 - Vendoring into shell frameworks is one installer invocation
 ### Negative
 - Requires Docker on every consuming host (accepted: it is an org baseline)
 - SEA caveat above (Node embedded inside the container image)
 ## Verification
 Deployed and verified on the TSGCOO orchestration host against
 `https://pwvault.turnsys.com` (account `coo@turnsys.com`): status, list,
 generate, get password/totp/item, create/edit items. Shellcheck clean at
 zero warnings including info-level. In production use since 2026-08-13.
 ---
 **Decision Date:** 2026-08-14
 **Decision Makers:** VP TechOps (proposed), TSGCOO (implemented)
 **Related:** ADR-001 (superseded for BW CLI purposes; MISE guidance remains
 valid for projects that genuinely require host Node.js)
@@ -44,14 +44,6 @@ install_bitwarden_cli() {
    info "Installing Bitwarden CLI..."
    if command -v snap &>/dev/null; then
        info "Installing via snap..."
        if sudo snap install bw; then
            info "Bitwarden CLI installed successfully via snap"
            return 0
        fi
    fi
    if command -v npm &>/dev/null; then
        info "Installing via npm..."
        if sudo npm install -g @bitwarden/cli; then
Author	SHA1	Message	Date
mrcharles	f63417b1eb	fix: rewrite archived README (heredoc expansion corrupted it) [#769 ]	2026-09-04 06:58:21 -05:00
mrcharles	3956928dc1	docs: archived — moved to KNEL/secrets per #769	2026-09-04 06:57:10 -05:00
vptechops	e3e54512a4	feat: container-based Bitwarden CLI, no host Node.js Adds the dockerized bw deployment in production use on the TSGCOO orchestration host since 2026-08-13: pinned debian-slim image carrying the pre-compiled bw binary, an in-container auth lifecycle entrypoint (config, API-key login, unlock, sync), a transparent host wrapper, and a one-command installer. ADR-002 records the decision and supersedes ADR-001 for BW CLI purposes: hosts keep zero language runtimes. Known caveat documented: the upstream "native" binary is a Node.js SEA, so Node is embedded in the image though absent from all hosts. Shellcheck clean (zero warnings incl. info-level).	2026-08-14 09:52:05 -05:00
mrcharles	1936e54b5f	removed snap	2025-07-16 10:17:07 -05:00