quarantine: scrub tailnet ref, add license, ship lab/ repro kit, refresh README for cohort

- untrack CLAUDE.md (tailnet leak) + stale HANDOFF.md; keep local via .gitignore - add source-available LICENSE (attribution on fork, royalty on commercial use) - add lab/ reproduction kit (fake-cred LIVE-VM/mock rotation POCs) + lab/README - rewrite README to current status (22 drivers, 8 LIVE-VM/14 MOCK-ONLY/0 LIVE-REAL, 247 tests) and carry the credential-handling safety rules Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-07-17 22:40:12 -07:00
parent 2459cd4fd8
commit ac0ff8e2af
26 changed files with 2156 additions and 236 deletions
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# incredigo sandbox provisioning — FAKE creds only, throwaway VM.
+set -euo pipefail
+
+echo "== installing gopass + gnupg =="
+sudo apt-get update -qq
+sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq gnupg gopass >/dev/null 2>&1 \
+  || { echo "apt gopass failed; trying snap/manual"; sudo snap install gopass --classic || true; }
+command -v gopass >/dev/null || { echo "FATAL: gopass not installed"; exit 1; }
+gopass --version | head -1
+
+# Isolate gopass entirely (rule 4): throwaway homedir + throwaway GNUPGHOME.
+export GOPASS_HOMEDIR="$HOME/.lab-gopass"
+export GNUPGHOME="$HOME/.lab-gnupg"
+mkdir -p "$GNUPGHOME"; chmod 700 "$GNUPGHOME"
+mkdir -p "$GOPASS_HOMEDIR"
+
+echo "== generating throwaway (no-protection) GPG key =="
+cat > /tmp/key.batch <<'EOF'
+%no-protection
+Key-Type: eddsa
+Key-Curve: ed25519
+Subkey-Type: ecdh
+Subkey-Curve: cv25519
+Name-Real: Incredigo Lab
+Name-Email: lab@incredigo.local
+Expire-Date: 0
+%commit
+EOF
+gpg --batch --generate-key /tmp/key.batch 2>/dev/null
+FPR=$(gpg --list-keys --with-colons lab@incredigo.local | awk -F: '/^fpr:/{print $10; exit}')
+echo "key: $FPR"
+
+echo "== initialising isolated gopass store =="
+gopass init --storage fs "$FPR" >/dev/null 2>&1 || gopass init "$FPR" >/dev/null 2>&1
+gopass ls || true
+
+echo "== seeding gopass 'imported/' entries (fake) =="
+printf 'AKIALAB000000FAKE0001:wJalrFAKEsecretKEYwJalrFAKEsecretKEY0001\n' | gopass insert -f imported/aws/default >/dev/null
+printf 'ghp_FAKEtoken000000000000000000000001\n'                         | gopass insert -f imported/github/pat >/dev/null
+printf 'lab-db-PASSWORD-0001\n'                                          | gopass insert -f imported/db/postgres >/dev/null
+echo "seeded: $(gopass ls --flat | wc -l) entries"
+
+echo "== creating sample on-disk creds (fake) =="
+LAB="$HOME/lab"; mkdir -p "$LAB"; cd "$LAB"
+cat > .env <<'EOF'
+# fake lab secrets — NOT real
+API_TOKEN=tok_FAKE_4f9c2a7e8b1d6033aa55ee
+DATABASE_URL=postgres://app:lab-db-PASSWORD-0001@db.lab.local:5432/app
+SENDGRID_API_KEY=SG.FAKE0001.aaaaaaaaaaaaaaaaaaaaaa
+PORT=8080
+EOF
+mkdir -p "$HOME/.aws"
+cat > "$HOME/.aws/credentials" <<'EOF'
+[default]
+aws_access_key_id = AKIALAB000000FAKE0001
+aws_secret_access_key = wJalrFAKEsecretKEYwJalrFAKEsecretKEY0001
+EOF
+# consumer files for the blast-radius map (reference markers, not secrets)
+cat > docker-compose.yml <<'EOF'
+services:
+  app:
+    image: example/app
+    environment:
+      - API_TOKEN=${API_TOKEN}
+      - DATABASE_URL=${DATABASE_URL}
+EOF
+mkdir -p k8s
+cat > k8s/deploy.yaml <<'EOF'
+env:
+  - name: API_TOKEN
+    valueFrom: { secretKeyRef: { name: app, key: API_TOKEN } }
+  - name: SENDGRID_API_KEY
+    valueFrom: { secretKeyRef: { name: app, key: SENDGRID_API_KEY } }
+EOF
+echo "lab dir: $LAB"; ls -la "$LAB"
+echo "PROVISION_OK"