ic-builder
4728b3cff0
ci / vet (pull_request) Failing after 12s
Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch, AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync, list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/ build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era scripts archived. Live-validated against pwvault.turnsys.com. Ticket: https://projects.knownelement.com/issues/832
26 lines
1.1 KiB
Markdown
26 lines
1.1 KiB
Markdown
# ADR-003: Custom Go CLI replaces the upstream Rust bw binary
|
|
|
|
Date: 2026-09-06. Decided by founder directive (finish the project with our
|
|
custom Go cli, not the upstream rust one; no Rust supply-chain risk).
|
|
|
|
## Decision
|
|
|
|
KNELSecretsManager ships a pure-Go CLI (`cli/cmd/smcli`) implementing the
|
|
Bitwarden/Vaultwarden API client: prelogin (PBKDF2/Argon2id), password grant
|
|
with 2FA (TOTP), key derivation + decryption (stretched master key, user
|
|
sym key), sync, item create/edit/delete with hidden fields.
|
|
|
|
The upstream Rust `bw` binary is RETIRED: bin/ scripts moved to
|
|
archive/rust-bw-era/. The CLI ships in our own container
|
|
(golang build -> alpine runtime, CA certs, non-root), delivered as the
|
|
always-hot compose service `ukrrs-secretsmgr-cli` and the lane shim
|
|
`.tools/sm`.
|
|
|
|
## Consequences
|
|
|
|
- No Rust/Node supply chain in the secrets tooling; Go module set is
|
|
stdlib + golang.org/x/crypto.
|
|
- Vault account bootstrapping (password + TOTP) happens via docker exec
|
|
from the TSGCOO env file; the container env_file holds non-secret config.
|
|
- Rotation waves (#829) rewire consumers from `bwlane.sh`/`.creds` to `sm`.
|