TSYS Group COO
dce7164889
Replace the Node.js @bitwarden/cli dependency with the pre-compiled native Rust binary (v2026.7.0) for CMMC/ITAR/STIG audit readiness. The Node.js dependency tree was a significant attack surface that would fail security audits. Infrastructure: - docker/bw-native/Dockerfile: minimal debian-slim + native bw binary - scripts/bw-cli.sh: host wrapper handling full auth lifecycle (config, API-key login, unlock, sync) inside the container - scripts/bw-entrypoint.sh: container entrypoint for auth lifecycle - scripts/bw-install.sh: one-command installer (download, build, deploy) Root causes fixed: - ~/.config/bw/env values now single-quoted (master password has $ chars that shell expansion corrupted, truncating 32→16 chars) - Added BW_SERVER for self-hosted instance (pwvault.turnsys.com) - Entrypoint bw config server tolerates re-run (|| true) All scripts pass shellcheck with zero warnings including info-level. Verified: bw status (unlocked, coo@turnsys.com), generate, list items. 💘 Generated with Crush Assisted-by: Crush:glm-5.2
2.5 KiB
2.5 KiB
JOURNAL.md — Append-Only Decision & Pattern Log
This file is append-only. Never delete or reorder existing entries. Add one dated section per significant change: what changed, why, the pattern used, any challenges, and the commit hash.
2026-08-13
Bitwarden CLI rebuilt on native Rust binary (no Node.js)
- What: Replaced the Node.js-based
@bitwarden/clinpm package with the pre-compiled native Rust binary (bw-linux-2026.7.0.zipfrom GitHub releases). Built a minimal Docker image (debian-slim + ca-certificates, no Node.js). Added a host-side wrapper (scripts/bw-cli.sh) that handles the full auth lifecycle (server config, API-key login, vault unlock, sync) inside the container on every invocation. - Why: Charles mandated zero Node.js in TSYS Group infrastructure for security audit readiness (CMMC L3 / ITAR / STIG). The Node.js bw CLI dependency tree is a significant attack surface that would fail audits. The native Rust binary has zero runtime dependencies.
- Root causes fixed during this work:
~/.config/bw/envvalues were unquoted — the master password contains$characters that shell expansion corrupted (32-char password truncated to 16 chars on everysourcecall). Fixed by single-quoting all values.- Missing
BW_SERVERvariable — the container defaulted tovault.bitwarden.com(Bitwarden cloud) but the org uses a self-hosted instance atpwvault.turnsys.com. AddedBW_SERVERto the env file. - Container entrypoint
bw config serverfails on re-run (returns exit 1 when already logged in). Fixed with|| true.
- Pattern: Host wrapper (
scripts/bw-cli.sh) installed as~/.local/bin/bwinvokes Docker container (reachableceo-bw-native:2026.7.0) with mountedscripts/bw-entrypoint.shthat handles auth lifecycle, then execs the requestedbwsubcommand. All execution inside containers; host stays clean. - Files added:
docker/bw-native/Dockerfile— image build definitiondocker/bw-native/.gitignore— excludes the 141MB binary from gitscripts/bw-cli.sh— host wrapper (installed as~/.local/bin/bw)scripts/bw-entrypoint.sh— container entrypoint (auth lifecycle)scripts/bw-install.sh— one-command installer (download, build, install)WORKING.md— task trackerdocs/JOURNAL.md— this file
- Shellcheck: All scripts pass with zero warnings (including info-level).
- Verified against:
bw status(unlocked, coo@turnsys.com),bw generate,bw list items,bw list collections.