TSYS Group COO
dce7164889
Replace the Node.js @bitwarden/cli dependency with the pre-compiled native Rust binary (v2026.7.0) for CMMC/ITAR/STIG audit readiness. The Node.js dependency tree was a significant attack surface that would fail security audits. Infrastructure: - docker/bw-native/Dockerfile: minimal debian-slim + native bw binary - scripts/bw-cli.sh: host wrapper handling full auth lifecycle (config, API-key login, unlock, sync) inside the container - scripts/bw-entrypoint.sh: container entrypoint for auth lifecycle - scripts/bw-install.sh: one-command installer (download, build, deploy) Root causes fixed: - ~/.config/bw/env values now single-quoted (master password has $ chars that shell expansion corrupted, truncating 32→16 chars) - Added BW_SERVER for self-hosted instance (pwvault.turnsys.com) - Entrypoint bw config server tolerates re-run (|| true) All scripts pass shellcheck with zero warnings including info-level. Verified: bw status (unlocked, coo@turnsys.com), generate, list items. 💘 Generated with Crush Assisted-by: Crush:glm-5.2
44 lines
2.5 KiB
Markdown
44 lines
2.5 KiB
Markdown
# JOURNAL.md — Append-Only Decision & Pattern Log
|
|
|
|
> This file is append-only. Never delete or reorder existing entries.
|
|
> Add one dated section per significant change: what changed, why, the pattern
|
|
> used, any challenges, and the commit hash.
|
|
|
|
## 2026-08-13
|
|
|
|
### Bitwarden CLI rebuilt on native Rust binary (no Node.js)
|
|
- **What:** Replaced the Node.js-based `@bitwarden/cli` npm package with the
|
|
pre-compiled native Rust binary (`bw-linux-2026.7.0.zip` from GitHub releases).
|
|
Built a minimal Docker image (debian-slim + ca-certificates, no Node.js).
|
|
Added a host-side wrapper (`scripts/bw-cli.sh`) that handles the full auth
|
|
lifecycle (server config, API-key login, vault unlock, sync) inside the
|
|
container on every invocation.
|
|
- **Why:** Charles mandated zero Node.js in TSYS Group infrastructure for
|
|
security audit readiness (CMMC L3 / ITAR / STIG). The Node.js bw CLI
|
|
dependency tree is a significant attack surface that would fail audits.
|
|
The native Rust binary has zero runtime dependencies.
|
|
- **Root causes fixed during this work:**
|
|
1. `~/.config/bw/env` values were unquoted — the master password contains
|
|
`$` characters that shell expansion corrupted (32-char password truncated
|
|
to 16 chars on every `source` call). Fixed by single-quoting all values.
|
|
2. Missing `BW_SERVER` variable — the container defaulted to
|
|
`vault.bitwarden.com` (Bitwarden cloud) but the org uses a self-hosted
|
|
instance at `pwvault.turnsys.com`. Added `BW_SERVER` to the env file.
|
|
3. Container entrypoint `bw config server` fails on re-run (returns exit 1
|
|
when already logged in). Fixed with `|| true`.
|
|
- **Pattern:** Host wrapper (`scripts/bw-cli.sh`) installed as `~/.local/bin/bw`
|
|
invokes Docker container (`reachableceo-bw-native:2026.7.0`) with mounted
|
|
`scripts/bw-entrypoint.sh` that handles auth lifecycle, then execs the
|
|
requested `bw` subcommand. All execution inside containers; host stays clean.
|
|
- **Files added:**
|
|
- `docker/bw-native/Dockerfile` — image build definition
|
|
- `docker/bw-native/.gitignore` — excludes the 141MB binary from git
|
|
- `scripts/bw-cli.sh` — host wrapper (installed as `~/.local/bin/bw`)
|
|
- `scripts/bw-entrypoint.sh` — container entrypoint (auth lifecycle)
|
|
- `scripts/bw-install.sh` — one-command installer (download, build, install)
|
|
- `WORKING.md` — task tracker
|
|
- `docs/JOURNAL.md` — this file
|
|
- **Shellcheck:** All scripts pass with zero warnings (including info-level).
|
|
- **Verified against:** `bw status` (unlocked, coo@turnsys.com),
|
|
`bw generate`, `bw list items`, `bw list collections`.
|