generated from coulomb/repo-seed
tegwick
f3547acd0b
- File permissions: os.chmod(cert, 0o600) after every sign in LocalCA and VaultCA; chmod(privkey, 0o600) and chmod(pubkey, 0o644) after generate_keypair - Scorecard: add check_file_permissions() that flags world/group-readable cert and key files; run_scorecard now returns 6 checks - warden status --state-dir: bypasses config loading entirely for operators who have a cert but no warden.yaml installed - tests/test_vault.py: 11 VaultCA unit tests covering success, HTTP 403, RequestError, missing token, missing role, missing pubkey, TTL enforcement, eviction, signatures log, and cert mode 600 - tests/test_ca.py: generate_keypair tests (paths, args, overwrite, error, permissions) and cert mode 600 assertion after sign - tests/test_scorecard.py: file_permissions check tests (pass, fail cert, fail keys dir); scorecard count updated to 6 - tests/test_cli.py: covers sign, issue, status, scorecard, inventory, log, cleanup commands using CliRunner and tmp config/inventory files - tests/test_integration.py: @pytest.mark.integration tests against real ssh-keygen; excluded from default suite via pyproject addopts - pyproject.toml: addopts = "-m 'not integration'", integration marker declared All 100 unit tests pass; 3 integration tests pass; ruff clean. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
37 lines
750 B
TOML
37 lines
750 B
TOML
[build-system]
|
|
requires = ["hatchling"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[project]
|
|
name = "ops-warden"
|
|
version = "0.1.0"
|
|
description = "SSH CA and certificate lifecycle manager for ops actors"
|
|
requires-python = ">=3.11"
|
|
dependencies = [
|
|
"typer[all]>=0.12",
|
|
"pyyaml>=6.0",
|
|
"httpx>=0.27",
|
|
]
|
|
|
|
[project.scripts]
|
|
warden = "warden.cli:app"
|
|
ops-ssh-wrapper = "warden.scripts.ops_ssh_wrapper:main"
|
|
|
|
[tool.hatch.build.targets.wheel]
|
|
packages = ["src/warden"]
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
pythonpath = ["src"]
|
|
addopts = "-m 'not integration'"
|
|
markers = ["integration: requires ssh-keygen binary; run with pytest -m integration"]
|
|
|
|
[tool.ruff]
|
|
line-length = 88
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"pytest>=8.0",
|
|
"ruff>=0.4",
|
|
]
|