Standardize the VM provisioning scripts to the rotation scripts' conventions #17

New issue

Open

opened 2026-07-19 01:09:15 +01:00 by vnprc-agent · 0 comments

vnprc-agent commented

2026-07-19 01:09:15 +01:00

Bring the VM provisioning scripts — rotate-token, bootstrap-vm.sh, bootstrap-vm-from-host.sh, rebuild-vm-from-host, and verify-vm-from-host — up to the same coding standard the SSH-key-rotation scripts already follow after their shared-helper consolidation.

Primary goals:

Reuse the shared helpers — route forge-connection and repo-URL construction through the existing lib/rotation-common.sh and lib/resolve-repos.sh instead of rebuilding it inline in each script.
Consistent CLI — same environment-override handling and a real usage()/--help in every script (two have none today).
Safer secrets — stop decrypting secrets into plain bash variables where a stdin/tmpfs pattern works instead.
Consistent guards — one git-working-tree policy across the host-side scripts.
Tests — focused unit tests for the shared bash libraries that need no live VM, Forgejo, or host secrets.

Current state and specifics

The SSH-key-rotation scripts now share lib/rotation-common.sh (resolve_forge_connection, key fingerprinting, tmpfs workdirs, JSON-field readers) and lib/resolve-repos.sh (registry resolution). Most provisioning scripts source resolve-repos.sh for checkout paths but otherwise have not adopted these conventions:

Forge URL construction is inline and duplicated. bootstrap-vm-from-host.sh derives the host/user via nix eval, bootstrap-vm.sh builds ssh://git@…/.git, and rotate-token builds https://…/.git — each its own way. resolve_forge_connection is called only by the rotation scripts.
Help text is inconsistent. bootstrap-vm.sh and bootstrap-vm-from-host.sh have no usage/help; the others do.
Plaintext secrets. rotate-token decrypts secrets straight into bash variables; review these and the key-install flows for stdin/tmpfs alternatives.
Remote-shell / filename hardening. Validate anything written to ~/.ssh/<key> or /etc/ssh/<target> and harden remote command construction.
Working-tree policy. Decide and standardize whether each host-side script must refuse a dirty inventory/secrets/profiles tree, rather than each choosing differently.
Helper tests. Cover the shared libraries without requiring live VMs, a live Forgejo, or host secrets.

Scope

Limited to the provisioning scripts listed above. Hardening of the SSH-key-rotation scripts themselves is tracked separately; this issue should not fold in rotation-specific changes.

Bring the VM provisioning scripts — `rotate-token`, `bootstrap-vm.sh`, `bootstrap-vm-from-host.sh`, `rebuild-vm-from-host`, and `verify-vm-from-host` — up to the same coding standard the SSH-key-rotation scripts already follow after their shared-helper consolidation. Primary goals: - **Reuse the shared helpers** — route forge-connection and repo-URL construction through the existing `lib/rotation-common.sh` and `lib/resolve-repos.sh` instead of rebuilding it inline in each script. - **Consistent CLI** — same environment-override handling and a real `usage()`/`--help` in every script (two have none today). - **Safer secrets** — stop decrypting secrets into plain bash variables where a stdin/tmpfs pattern works instead. - **Consistent guards** — one git-working-tree policy across the host-side scripts. - **Tests** — focused unit tests for the shared bash libraries that need no live VM, Forgejo, or host secrets. ### Current state and specifics The SSH-key-rotation scripts now share `lib/rotation-common.sh` (`resolve_forge_connection`, key fingerprinting, tmpfs workdirs, JSON-field readers) and `lib/resolve-repos.sh` (registry resolution). Most provisioning scripts source `resolve-repos.sh` for checkout paths but otherwise have not adopted these conventions: - **Forge URL construction is inline and duplicated.** `bootstrap-vm-from-host.sh` derives the host/user via `nix eval`, `bootstrap-vm.sh` builds `ssh://git@…/.git`, and `rotate-token` builds `https://…/.git` — each its own way. `resolve_forge_connection` is called only by the rotation scripts. - **Help text is inconsistent.** `bootstrap-vm.sh` and `bootstrap-vm-from-host.sh` have no usage/help; the others do. - **Plaintext secrets.** `rotate-token` decrypts secrets straight into bash variables; review these and the key-install flows for stdin/tmpfs alternatives. - **Remote-shell / filename hardening.** Validate anything written to `~/.ssh/<key>` or `/etc/ssh/<target>` and harden remote command construction. - **Working-tree policy.** Decide and standardize whether each host-side script must refuse a dirty inventory/secrets/profiles tree, rather than each choosing differently. - **Helper tests.** Cover the shared libraries without requiring live VMs, a live Forgejo, or host secrets. ### Scope Limited to the provisioning scripts listed above. Hardening of the SSH-key-rotation scripts themselves is tracked separately; this issue should not fold in rotation-specific changes.

vnprc-agent referenced this issue

2026-07-20 16:33:55 +01:00

Harden the SSH-key rotation script suite to a uniform posture #18