coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Run the custody session through a Make target, and give the runner a shebang
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
The runner was executable with no shebang, so a shell handed its path tried to
interpret Python as shell script. That is what a broken command line hit, and it
would have hit anyone invoking the file directly.

Also adds `make openbao-open-questions`, which is short enough that terminal
wrapping cannot split it, refuses a receipt path that is missing or already
exists, and clears OPENBAO_TOKEN/VAULT_TOKEN/BAO_TOKEN before invoking the
attended envelope so the identity comes from the login rather than a standing
token.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1275505@bnt-lap001
Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5
This commit is contained in:
codex 2026-09-10 08:15:41 +02:00
parent 3109f950f9
commit 18f4ddec2b
3 changed files with 20 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
Makefile
View file

@ -34,6 +34,7 @@ OPENBAO_UI_OVERLAY_DIR ?= helm/openbao-ui-overlay
OPENBAO_UI_OVERLAY_K8S ?= helm/openbao-ui-overlay-k8s.yaml
OPENBAO_PUBLIC_INGRESS_ROLLBACK ?= helm/openbao-public-ingress.rollback.yaml
OPENBAO_VERIFY_AUTH_ARGS ?=
SESSION_QUESTIONS ?= Q1,Q2,Q3,Q4,Q5
OPENBAO_RESTORE_EVIDENCE ?= /tmp/netkingdom-openbao-restore-drill/evidence.json
OPENBAO_EMERGENCY_EVIDENCE ?= /tmp/netkingdom-openbao-emergency-drill/evidence.json
EXTERNAL_SECRETS_NAMESPACE ?= external-secrets
@ -338,6 +339,15 @@ credential-change-status-json: ## Render credential change request readiness sta
credential-change-sync-decision: ## Sync resolved State Hub decision back into a CCR
scripts/credential-change.py sync-decision $(CREDENTIAL_CHANGE) --state-hub-url $(STATE_HUB_URL)
.PHONY: openbao-open-questions
openbao-open-questions: ## Attended read-only session for the open custody questions (SESSION_RECEIPT=<new path>)
@test -n "$(SESSION_RECEIPT)" || { echo "SESSION_RECEIPT=<new file path> is required" >&2; exit 2; }
@test ! -e "$(SESSION_RECEIPT)" || { echo "SESSION_RECEIPT already exists: $(SESSION_RECEIPT)" >&2; exit 2; }
env -u OPENBAO_TOKEN -u VAULT_TOKEN -u BAO_TOKEN \
scripts/openbao-attended-exec.py -- /usr/bin/python3 \
scripts/openbao_open_questions_session.py \
--questions $(SESSION_QUESTIONS) --receipt $(SESSION_RECEIPT)
credential-change-apply-plan: ## Render approved-only operator apply plan
scripts/credential-change.py apply-plan $(CREDENTIAL_CHANGE)