coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: make custody input explicit and remove partial decryptions
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c
This commit is contained in:
tegwick 2026-10-12 10:53:30 +02:00
parent b97f9f616f
commit 4cf26a9bc8
6 changed files with 299 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

29
docs/security-bootstrap-age-custody.md
View file

@ -77,9 +77,12 @@ Use `sso-mfa/bootstrap/sops-custody-unlock.sh` when an operator needs to run a
SOPS-backed drill, recovery, or lockdown command but the private key is only in
the password safe or offline custody packet.
The helper disables shell tracing before handling input and refuses conflicting input modes.
Noninteractive callers must select `--from-stdin` or `--from-file` explicitly.
The helper:
- reads the private age key from a hidden prompt, stdin, or a source file;
- reads the private age key from one explicit source: hidden prompt, stdin, or a source file;
- derives the public age recipient with `age-keygen -y`;
- refuses to continue unless it matches the expected recipient;
- writes a `0600` temporary `SOPS_AGE_KEY_FILE`;
@ -152,3 +155,27 @@ its expected contents without printing values, then remove decrypted files and
retain a non-secret receipt. Acknowledgment of a guide is not that verification.
No live root or password was read or rotated during the source correction.
NK-WP-0049 tracks remaining native acceptance and other legacy custody callers.
## Direct helper correction — 2026-10-12
`encrypt-secrets.sh` defaults to the registered `keys/age.pub`. It accepts a public
recipient or public-recipient file and rejects private-key files instead of
loading them to derive metadata. `decrypt-secrets.sh` accepts an explicit key
argument or the custody helper's `NETKINGDOM_CUSTODY_AGE_KEY_FILE`; it no longer
searches HOME. Successful decryption publishes a new private output directory
only after every input decrypts. Failed/empty input removes partial staging;
existing files, directories and dangling symlinks are never replaced.
The custody helper disables shell tracing, rejects repeated/mixed input modes,
does not echo unknown arguments and clears competing inline/key-command SOPS
authentication before the child starts. HUP/INT/TERM now retain failure status
and EXIT cleanup rather than running cleanup and then continuing. Bash may defer
its trap while a foreground child runs; this is not a process-group supervisor,
SIGKILL cleanup guarantee or a runtime authority boundary. Temporary key cleanup
on command return does not certify that an arbitrary child retained no copies.
Remaining concrete caller defects stay in NK-WP-0049-T02: Make `sops-setup` /
`creds-init` still install or require permanent HOME keys; Make `sops-decrypt`
still emits plaintext; legacy rotation and privacyIDEA bootstrap helpers contain
secret-bearing output. Do not use those legacy paths as the recovery procedure
or treat these narrower helper repairs as closure of the whole custody surface.