leetcrypt
ac0ff8e2af
ci / build-test (push) Has been cancelled
- untrack CLAUDE.md (tailnet leak) + stale HANDOFF.md; keep local via .gitignore - add source-available LICENSE (attribution on fork, royalty on commercial use) - add lab/ reproduction kit (fake-cred LIVE-VM/mock rotation POCs) + lab/README - rewrite README to current status (22 drivers, 8 LIVE-VM/14 MOCK-ONLY/0 LIVE-REAL, 247 tests) and carry the credential-handling safety rules Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
52 lines
1.8 KiB
Bash
Executable File
52 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Provision the incredigo postgres-rotation POC inside the sandbox VM.
|
|
# FAKE creds only, isolated gopass store. Idempotent-ish (drops/recreates role+db).
|
|
set -euo pipefail
|
|
|
|
export GNUPGHOME="$HOME/.lab-gnupg"
|
|
export GOPASS_HOMEDIR="$HOME/.lab-gopass"
|
|
INIT_PW="oldpw$(date +%s | tail -c 4)" # fake starting password
|
|
ENTRY="imported/postgres/labapp"
|
|
|
|
echo "== 1. isolated GNUPGHOME + no-protection GPG key =="
|
|
rm -rf "$GNUPGHOME" "$GOPASS_HOMEDIR"
|
|
mkdir -p "$GNUPGHOME"; chmod 700 "$GNUPGHOME"
|
|
cat > /tmp/keyparams <<EOF
|
|
%no-protection
|
|
Key-Type: eddsa
|
|
Key-Curve: ed25519
|
|
Subkey-Type: ecdh
|
|
Subkey-Curve: cv25519
|
|
Name-Real: incredigo lab
|
|
Name-Email: lab@incredigo.invalid
|
|
Expire-Date: 0
|
|
%commit
|
|
EOF
|
|
gpg --batch --gen-key /tmp/keyparams >/dev/null 2>&1
|
|
rm -f /tmp/keyparams
|
|
KEYID=$(gpg --list-keys --with-colons lab@incredigo.invalid | awk -F: '/^pub/{print $5; exit}')
|
|
echo " key: $KEYID"
|
|
|
|
echo "== 2. isolated gopass store =="
|
|
gopass init --storage fs "$KEYID" >/dev/null 2>&1 || gopass init "$KEYID" >/dev/null 2>&1
|
|
gopass ls >/dev/null 2>&1 || true
|
|
|
|
echo "== 3. postgres role + db (labapp owns labdb), starting pw=$INIT_PW =="
|
|
sudo -u postgres psql -v ON_ERROR_STOP=1 <<SQL >/dev/null
|
|
DROP DATABASE IF EXISTS labdb;
|
|
DROP ROLE IF EXISTS labapp;
|
|
CREATE ROLE labapp LOGIN PASSWORD '$INIT_PW';
|
|
CREATE DATABASE labdb OWNER labapp;
|
|
SQL
|
|
|
|
echo "== 4. prove the starting password authenticates over TCP =="
|
|
PGPASSWORD="$INIT_PW" psql -X -w -h 127.0.0.1 -p 5432 -U labapp -d labdb -tAc 'SELECT 1;'
|
|
|
|
echo "== 5. seed the DSN into gopass (no plaintext file on disk) =="
|
|
printf 'postgres://labapp:%s@127.0.0.1:5432/labdb' "$INIT_PW" \
|
|
| gopass insert --multiline=false -f "$ENTRY" >/dev/null
|
|
echo " stored $ENTRY:"
|
|
gopass ls --flat | sed 's/^/ /'
|
|
|
|
echo "DONE. starting pw recorded only in gopass; rotation will replace it."
|