secret

181 Commits 8 Branches 0 Tags

3 Commits

Author	SHA1	Message	Date
clawbot	a040f9831b	Lock the state directory and write vault files atomically (closes #34 ) check / check (push) Successful in 46s Details Each command that changes the state directory holds one lock: flock(2) on `lock` in the state directory, dropped by the kernel if the process dies, or a process-wide mutex on the in-memory test filesystem. It covers the state directory, not each vault, because `currentvault`, `vault create` and cross-vault moves span vaults, and a lock file in a vault would be deleted by `vault remove` under a waiting command. Files go through `secret.WriteFileAtomic`; versions, new secrets and cross-vault copies are built in a temporary directory and renamed into place; removals rename out of the way first. Left for later: replacing an unlocker (#71) and deleting what an interrupted command leaves under a `.tmp-` name (#75). Model: opus-5-5	2026-10-03 16:19:55 +00:00
clawbot	d52b4f1240	Let a plain docker build pass and stamp the git version (closes #57 ) check / check (push) Successful in 1m1s Details The size tests skip a case whose secret needs more locked memory than the process can lock, found by locking a buffer of that size: memguard panics otherwise, and a plain `docker build .` runs under an 8 MiB RLIMIT_MEMLOCK. script/cibuild, or any process allowed to lock past the limit, runs every case. The build stage stamps the VERSION build argument, else `git describe --tags --always`, and fails when .git is present but yields no version. `make build` stamps `git describe` too instead of the fixed 0.1.0. .dockerignore keeps .git/config out; script/docker is now the canonical copy. Model: opus-5-5 Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>	2026-10-02 14:16:02 +02:00
clawbot user clawbot	b090b3f86b	ci: add Gitea Actions workflow for make check (#21 ) check / check (push) Successful in 26s Details Adds CI workflow that runs `make check` on push/PR to main. Co-authored-by: user <user@Mac.lan guest wan> Co-authored-by: clawbot <clawbot@eeqj.de> Reviewed-on: #21 Co-authored-by: clawbot <sneak+clawbot@sneak.cloud> Co-committed-by: clawbot <sneak+clawbot@sneak.cloud>	2026-03-30 21:34:49 +02:00

Author

SHA1

Message

Date

clawbot

a040f9831b

Lock the state directory and write vault files atomically (closes #34 )

check / check (push) Successful in 46s

Details

Each command that changes the state directory holds one lock: flock(2)
on `lock` in the state directory, dropped by the kernel if the process
dies, or a process-wide mutex on the in-memory test filesystem. It
covers the state directory, not each vault, because `currentvault`,
`vault create` and cross-vault moves span vaults, and a lock file in a
vault would be deleted by `vault remove` under a waiting command.

Files go through `secret.WriteFileAtomic`; versions, new secrets and
cross-vault copies are built in a temporary directory and renamed into
place; removals rename out of the way first. Left for later: replacing
an unlocker (#71) and deleting
what an interrupted command leaves under a `.tmp-` name
(#75).

Model: opus-5-5

2026-10-03 16:19:55 +00:00

clawbot

d52b4f1240

Let a plain docker build pass and stamp the git version (closes #57 )

check / check (push) Successful in 1m1s

Details

The size tests skip a case whose secret needs more locked memory than
the process can lock, found by locking a buffer of that size: memguard
panics otherwise, and a plain `docker build .` runs under an 8 MiB
RLIMIT_MEMLOCK. script/cibuild, or any process allowed to lock past the
limit, runs every case.

The build stage stamps the VERSION build argument, else
`git describe --tags --always`, and fails when .git is present but
yields no version. `make build` stamps `git describe` too instead of
the fixed 0.1.0. .dockerignore keeps .git/config out; script/docker is
now the canonical copy.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

2026-10-02 14:16:02 +02:00

b090b3f86b

ci: add Gitea Actions workflow for make check (#21 )

check / check (push) Successful in 26s

Details

Adds CI workflow that runs `make check` on push/PR to main.

Co-authored-by: user <user@Mac.lan guest wan>
Co-authored-by: clawbot <clawbot@eeqj.de>
Reviewed-on: #21
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>
Co-committed-by: clawbot <sneak+clawbot@sneak.cloud>

2026-03-30 21:34:49 +02:00