ben/dotfiles-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: install bws from the private tier, not the manifest

Browse Source 
The previous commit put the bws install on the private/bws-secrets row as
a tarball channel. That row can never install anything: selected_packages
drops every row flagged `private`, which is the invariant that makes
--unattended safe to run. The container proved it — unzip installed, bws
did not, and the row still could not deliver on its promise.

Nor can it be a safe row: the defaults preset ticks every safe package, so
that would put a Bitwarden binary and a 12 MB GitHub download on every
throwaway public VM, for a tool those machines have no credential to use.

So ensure_bws lives in dotup and is called from cmd_private immediately
after the token is written. Nothing installs bws unless something is about
to hand it a token, and the manifest keeps its invariant.

core/unzip stays a real package with the @needs edge — the release is a
.zip and 24.04 minimal has no unzip.
This commit is contained in:
bcherb2
2026-08-17 11:20:45 -04:00
parent 90bca39396
commit 400bd9b9f1
3 changed files with 70 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.tests/test.sh
+13 -1
View File
@@ -107,8 +107,20 @@ is "dropping uv drops specify-cli" "off" "$(on agents/specify-cli)"
# is real rather than decorative.
reset; sh $D toggle p:private/bws-secrets >/dev/null
is "ticking bws-secrets pulls in unzip" "on" "$(on core/unzip)"
is "bws-secrets has an install channel" "-tarball" \
# bws must NOT be a manifest package. selected_packages drops every private row
# ("private is never a package" is what makes --unattended safe), and a safe row
# would put a Bitwarden binary on every throwaway public VM via the defaults
# preset. So the private tier installs it itself, next to the token.
is "bws-secrets stays a non-package" "-" \
"$(awk -F'\t' '$1=="private" && $2=="bws-secrets" {print $4}' "$M")"
is "no manifest row installs bws" "0" \
"$(awk -F'\t' '!/^[#@]/ && NF>=3 && $2=="bws" {c++} END{print c+0}' "$M")"
is "the private tier installs bws itself" "1" \
"$(grep -c '^ ensure_bws$' $D)"
is "…only after a token exists to use" "1" \
"$(grep -A1 'bws token written, mode 600' $D | grep -c ensure_bws)"
is "bws is checksum-verified" "1" \
"$(grep -c 'bws checksum mismatch' $D)"
printf '\n\033[1mcredentials never reach a log\033[0m\n'
# `run` echoes its whole argv to stderr. The private init's argv ends in