From c4b4cb92c9a752b893744d93bfdcf4be802493d6 Mon Sep 17 00:00:00 2001 From: Logan Cusano Date: Sun, 4 Oct 2026 18:17:30 -0400 Subject: [PATCH] Drop last --token hint; note sudo drops DRB_ENROLLMENT_TOKEN (node-26#18) - key_pickup.py still told operators to re-run install.sh with --token. - `curl | sudo bash` resets the env, so the documented exported-token path needs `sudo --preserve-env=DRB_ENROLLMENT_TOKEN`; say so. Co-Authored-By: Claude Opus 5.5 --- README.md | 3 ++- drb-edge-node/app/internal/key_pickup.py | 2 +- install.sh | 2 ++ 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 6d2324a..1f88290 100644 --- a/README.md +++ b/README.md @@ -149,7 +149,8 @@ curl -fsSL https://git.vpn.cusano.net/logan/node-26/raw/tag/v1/install.sh \ It prompts (hidden input) for an enrollment token, minted at **Settings → Nodes** in the web app. The token never goes on the command line — argv lands in shell history and `ps` (node-26#18). Unattended installs use `--token-file PATH` (mode -0600) or an exported `DRB_ENROLLMENT_TOKEN`; the old `--token` flag still works +0600) or an exported `DRB_ENROLLMENT_TOKEN` (pass it through with +`sudo --preserve-env=DRB_ENROLLMENT_TOKEN`; plain `sudo` drops it); the old `--token` flag still works but warns. Run `install.sh --help` for every flag; each also has a `DRB_*` env var. `--build` compiles op25 on the Pi (~1h) instead of pulling. diff --git a/drb-edge-node/app/internal/key_pickup.py b/drb-edge-node/app/internal/key_pickup.py index 9c1bb3a..f6e6b22 100644 --- a/drb-edge-node/app/internal/key_pickup.py +++ b/drb-edge-node/app/internal/key_pickup.py @@ -50,7 +50,7 @@ async def fetch_api_key() -> Optional[str]: if r.status_code == 401: logger.error( "Key pickup: C2 rejected the saved pickup secret (401) — it was rotated by a re-enroll elsewhere. " - "Re-run install.sh with --token to recover." + "Re-run install.sh and give it a fresh enrollment token when it asks (node-26#18)." ) return None if r.status_code == 404: diff --git a/install.sh b/install.sh index 7f0c335..d470b85 100644 --- a/install.sh +++ b/install.sh @@ -144,6 +144,8 @@ DRB_MQTT_BROKER, DRB_REF, DRB_INSTALL_DIR, DRB_REGISTRY_USER/PASS, ... Secrets are read from a file, the environment or a TTY prompt, never from a pipe. Never put the token on a command line: `--token X` and `sudo DRB_ENROLLMENT_TOKEN=X bash` both expose it in shell history and `ps`. +An exported DRB_ENROLLMENT_TOKEN only reaches the installer through sudo with +`sudo --preserve-env=DRB_ENROLLMENT_TOKEN bash` (plain sudo drops it). (`--token` still works for old copied commands but is deprecated, see node-26#18.) USAGE }