ic-builder
4728b3cff0
ci / vet (pull_request) Failing after 12s
Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch, AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync, list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/ build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era scripts archived. Live-validated against pwvault.turnsys.com. Ticket: https://projects.knownelement.com/issues/832
1.1 KiB
1.1 KiB
ADR-003: Custom Go CLI replaces the upstream Rust bw binary
Date: 2026-09-06. Decided by founder directive (finish the project with our custom Go cli, not the upstream rust one; no Rust supply-chain risk).
Decision
KNELSecretsManager ships a pure-Go CLI (cli/cmd/smcli) implementing the
Bitwarden/Vaultwarden API client: prelogin (PBKDF2/Argon2id), password grant
with 2FA (TOTP), key derivation + decryption (stretched master key, user
sym key), sync, item create/edit/delete with hidden fields.
The upstream Rust bw binary is RETIRED: bin/ scripts moved to
archive/rust-bw-era/. The CLI ships in our own container
(golang build -> alpine runtime, CA certs, non-root), delivered as the
always-hot compose service ukrrs-secretsmgr-cli and the lane shim
.tools/sm.
Consequences
- No Rust/Node supply chain in the secrets tooling; Go module set is stdlib + golang.org/x/crypto.
- Vault account bootstrapping (password + TOTP) happens via docker exec from the TSGCOO env file; the container env_file holds non-secret config.
- Rotation waves (#829) rewire consumers from
bwlane.sh/.credstosm.