coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
Operations credential management
14 commits 2 branches 2 tags 3.2 MiB
Find a file
tegwick f3547acd0b feat(warden): WARDEN-WP-0003 — test coverage, permissions, status --state-dir 
- File permissions: os.chmod(cert, 0o600) after every sign in LocalCA and
  VaultCA; chmod(privkey, 0o600) and chmod(pubkey, 0o644) after generate_keypair
- Scorecard: add check_file_permissions() that flags world/group-readable
  cert and key files; run_scorecard now returns 6 checks
- warden status --state-dir: bypasses config loading entirely for operators
  who have a cert but no warden.yaml installed
- tests/test_vault.py: 11 VaultCA unit tests covering success, HTTP 403,
  RequestError, missing token, missing role, missing pubkey, TTL enforcement,
  eviction, signatures log, and cert mode 600
- tests/test_ca.py: generate_keypair tests (paths, args, overwrite, error,
  permissions) and cert mode 600 assertion after sign
- tests/test_scorecard.py: file_permissions check tests (pass, fail cert,
  fail keys dir); scorecard count updated to 6
- tests/test_cli.py: covers sign, issue, status, scorecard, inventory, log,
  cleanup commands using CliRunner and tmp config/inventory files
- tests/test_integration.py: @pytest.mark.integration tests against real
  ssh-keygen; excluded from default suite via pyproject addopts
- pyproject.toml: addopts = "-m 'not integration'", integration marker declared

All 100 unit tests pass; 3 integration tests pass; ruff clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-15 17:05:38 +02:00
src/warden feat(warden): WARDEN-WP-0003 — test coverage, permissions, status --state-dir 2026-05-15 17:05:38 +02:00
tests feat(warden): WARDEN-WP-0003 — test coverage, permissions, status --state-dir 2026-05-15 17:05:38 +02:00
wiki Initial Commit 2026-03-28 00:45:43 +00:00
workplans feat(warden): WARDEN-WP-0003 — test coverage, permissions, status --state-dir 2026-05-15 17:05:38 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-05-15 15:54:34 +02:00
.gitignore chore: remove swap file, add *.swp to .gitignore 2026-05-15 15:53:58 +02:00
CLAUDE.md Initial Commit 2026-03-28 00:45:43 +00:00
LICENSE Initial commit 2026-03-28 00:35:11 +00:00
pyproject.toml feat(warden): WARDEN-WP-0003 — test coverage, permissions, status --state-dir 2026-05-15 17:05:38 +02:00
README.md Initial commit 2026-03-28 00:35:11 +00:00
SCOPE.md Initial Commit 2026-03-28 00:45:43 +00:00
uv.lock feat(bootstrap): WARDEN-WP-0001 initial implementation — 42 tests passing 2026-05-15 13:27:49 +02:00

README.md

repo-seed

A git repository template to bootstrap coulomb projects from.