tegwick
3b72834bca
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 43s
Closes gap G09: five loosely related defects. lldap-export took the service account password on argv, where ps exposes it to any local user and shell history and process accounting capture it. It now prefers KEYCAPE_LLDAP_BIND_PW or --bind-pw-file; --bind-pw still works but warns, deprecated rather than removed because existing runbooks use it and breaking them silently would be worse than one more cycle of exposure. Conflicting sources are rejected instead of silently ranked, since an operator otherwise cannot tell which bind was attempted. Both migration scripts pass the password by environment now. The canonical export, generated LDIF and Keycloak realm were written 0644. None carries credential material, but the snapshot is every username, display name, email and group membership in the estate, and it tends to land in /tmp. All three are 0600. The image packaged keycape alone, so the validator and migration binaries needed a Go toolchain on the host -- which defeats shipping an image for the cutover work they exist to support. All five ship; the issuer stays the entrypoint. Verified by building the image and running each binary inside it. The publish workflow named 92.205.130.254:32166 while the cluster runs forgejo.coulomb.social/coulomb/key-cape. It now defaults to the recorded name and stays overridable by a repository variable. This repository cannot verify that the runner resolves that hostname or that the registry credentials are valid for it; if the next publish fails, set the REGISTRY variable back to the address. docker-compose.dev.yml mounts a private key and Authelia material that are correctly absent from the checkout. scripts/bootstrap-dev.sh generates them locally under a restrictive umask rather than chmodding afterwards, so the key is never briefly world-readable. Everything it writes is git-ignored. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
21 lines
972 B
Docker
21 lines
972 B
Docker
FROM golang:1.23-alpine AS builder
|
|
WORKDIR /app
|
|
COPY src/go.mod src/go.sum ./
|
|
RUN go mod download
|
|
COPY src/ .
|
|
# Build every command, not only the issuer. The migration and validation
|
|
# binaries are how an operator prepares and checks a cutover, and needing a Go
|
|
# toolchain on the host to run them defeats shipping an image at all
|
|
# (KEY-WP-0026).
|
|
RUN CGO_ENABLED=0 go build -o /out/keycape ./cmd/keycape && \
|
|
CGO_ENABLED=0 go build -o /out/validator ./cmd/validator && \
|
|
CGO_ENABLED=0 go build -o /out/lldap-export ./cmd/lldap-export && \
|
|
CGO_ENABLED=0 go build -o /out/keycape-to-keycloak ./cmd/keycape-to-keycloak && \
|
|
CGO_ENABLED=0 go build -o /out/lldap-to-ldap ./cmd/lldap-to-ldap
|
|
|
|
FROM gcr.io/distroless/static-debian12
|
|
COPY --from=builder /out/ /
|
|
EXPOSE 8080
|
|
# The issuer stays the default. The other binaries are reachable by overriding
|
|
# the entrypoint, e.g. --entrypoint /lldap-export.
|
|
ENTRYPOINT ["/keycape"]
|