coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add value-safe verification and audit reporting
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306
This commit is contained in:
tegwick 2026-08-23 12:33:38 +02:00
parent 491e706a70
commit c4504c6de9
19 changed files with 598 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

11
scripts/demo-e2e.sh
View file

@ -21,6 +21,7 @@ export BAO_ADDR="http://127.0.0.1:8270"
export BAO_TOKEN="se-demo-root"
# Keep secret material OUTSIDE the repo worktree (engine enforces this).
TOKENFILE="$WORK/whynot.token"
NEGATIVE_TOKENFILE="$WORK/unrelated.token"
cleanup() {
set +e
@ -59,7 +60,15 @@ secrets-engine provision whynot-design-npm-publish --stage prod \
echo
echo "### 4. verify positive (approved consumer can read) + negative (others denied)"
secrets-engine verify whynot-design-npm-publish --field npm_token --positive --negative | sed 's/^/ /'
"$BAO_BIN" policy write se-demo-unrelated - <<'EOF' >/dev/null
path "secret/data/prod/coulomb/whynot-design/npm" {
capabilities = ["deny"]
}
EOF
umask 077
"$BAO_BIN" token create -field=token -policy=se-demo-unrelated > "$NEGATIVE_TOKENFILE"
secrets-engine verify whynot-design-npm-publish --field npm_token \
--positive --negative --negative-token-file "$NEGATIVE_TOKENFILE" | sed 's/^/ /'
echo
echo "### 5. exec-time delivery: child sees the token via a temp npmrc; parent never does"