coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement exec-file delivery
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Write the selected field to a mode-0600 temp file, inject FIELD_FILE for
the child only, then overwrite and unlink on every exit path. The value
is not copied into the child environment.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
This commit is contained in:
tegwick 2026-09-02 08:59:56 +02:00
parent afd1c8e593
commit ce1790f267
7 changed files with 126 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/catalog-admission.md
View file

@ -43,8 +43,9 @@ delivery_auth:
The current native implementation supports AppRole. An entry that declares
`exec-env`, `exec-file`, `npm-config`, `read-check`, or `wrapped` must therefore
declare delivery auth. `exec-file` remains a reserved exec schema mode.
`wrapped` operator handoff is `secrets-engine wrap`; it is not an exec adapter.
declare delivery auth. `exec-file` writes the value to a mode-0600 temp file
and injects the path (`FIELD_FILE`) for the child only. `wrapped` operator
handoff is `secrets-engine wrap`; it is not an exec adapter.
Engine-managed AppRoles may bound `token_ttl`, `token_max_ttl`,
`secret_id_ttl`, `secret_id_num_uses`, and `token_num_uses`. The admitted