Files

T

TSYS Group COO dce7164889 feat: container-based Bitwarden CLI using native Rust binary (no Node.js)

Replace the Node.js @bitwarden/cli dependency with the pre-compiled
native Rust binary (v2026.7.0) for CMMC/ITAR/STIG audit readiness.
The Node.js dependency tree was a significant attack surface that
would fail security audits.

Infrastructure:
- docker/bw-native/Dockerfile: minimal debian-slim + native bw binary
- scripts/bw-cli.sh: host wrapper handling full auth lifecycle
  (config, API-key login, unlock, sync) inside the container
- scripts/bw-entrypoint.sh: container entrypoint for auth lifecycle
- scripts/bw-install.sh: one-command installer (download, build, deploy)

Root causes fixed:
- ~/.config/bw/env values now single-quoted (master password has $
  chars that shell expansion corrupted, truncating 32→16 chars)
- Added BW_SERVER for self-hosted instance (pwvault.turnsys.com)
- Entrypoint bw config server tolerates re-run (|| true)

All scripts pass shellcheck with zero warnings including info-level.
Verified: bw status (unlocked, coo@turnsys.com), generate, list items.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

2026-09-07 14:51:13 -05:00

2.5 KiB

Raw Permalink Blame History

JOURNAL.md — Append-Only Decision & Pattern Log

This file is append-only. Never delete or reorder existing entries. Add one dated section per significant change: what changed, why, the pattern used, any challenges, and the commit hash.

2026-08-13

Bitwarden CLI rebuilt on native Rust binary (no Node.js)

What: Replaced the Node.js-based @bitwarden/cli npm package with the pre-compiled native Rust binary (bw-linux-2026.7.0.zip from GitHub releases). Built a minimal Docker image (debian-slim + ca-certificates, no Node.js). Added a host-side wrapper (scripts/bw-cli.sh) that handles the full auth lifecycle (server config, API-key login, vault unlock, sync) inside the container on every invocation.
Why: Charles mandated zero Node.js in TSYS Group infrastructure for security audit readiness (CMMC L3 / ITAR / STIG). The Node.js bw CLI dependency tree is a significant attack surface that would fail audits. The native Rust binary has zero runtime dependencies.
Root causes fixed during this work:
1. ~/.config/bw/env values were unquoted — the master password contains $ characters that shell expansion corrupted (32-char password truncated to 16 chars on every source call). Fixed by single-quoting all values.
2. Missing BW_SERVER variable — the container defaulted to vault.bitwarden.com (Bitwarden cloud) but the org uses a self-hosted instance at pwvault.turnsys.com. Added BW_SERVER to the env file.
3. Container entrypoint bw config server fails on re-run (returns exit 1 when already logged in). Fixed with || true.
Pattern: Host wrapper (scripts/bw-cli.sh) installed as ~/.local/bin/bw invokes Docker container (reachableceo-bw-native:2026.7.0) with mounted scripts/bw-entrypoint.sh that handles auth lifecycle, then execs the requested bw subcommand. All execution inside containers; host stays clean.
Files added:
- docker/bw-native/Dockerfile — image build definition
- docker/bw-native/.gitignore — excludes the 141MB binary from git
- scripts/bw-cli.sh — host wrapper (installed as ~/.local/bin/bw)
- scripts/bw-entrypoint.sh — container entrypoint (auth lifecycle)
- scripts/bw-install.sh — one-command installer (download, build, install)
- WORKING.md — task tracker
- docs/JOURNAL.md — this file
Shellcheck: All scripts pass with zero warnings (including info-level).
Verified against: bw status (unlocked, coo@turnsys.com), bw generate, bw list items, bw list collections.

2.5 KiB Raw Permalink Blame History

JOURNAL.md — Append-Only Decision & Pattern Log

2026-08-13

Bitwarden CLI rebuilt on native Rust binary (no Node.js)

2.5 KiB

Raw Permalink Blame History