install.sh: enrollment token never on the command line (#18) #30

Merged

logan merged 3 commits from fix/18-install-token-argv into main 2026-10-04 18:28:19 -04:00

Conversation 1 Commits 3 Files Changed 3

+64 -24

logan commented 2026-10-04 18:10:06 -04:00

Owner

Copy Link

Copy Source

Fixes #18. CISO condition from server-26#61: the enrollment token must never appear as a plaintext CLI argument.

3269203 ("enrollment token via header file too") only got the token off curl's argv. install.sh --token DRB-… was still the documented path: it put the token in shell history, and in ps for the whole install. So #18 was still open on main.

Changes (install.sh + README)

• The token is prompted for on the TTY with hidden input. This is the default and the recommended path.
• Unattended installs: --token-file PATH warns if the file is group- or world-readable, and an exported DRB_ENROLLMENT_TOKEN works too. DRB_ENROLLMENT_TOKEN is unset after it is read, so child processes don't inherit it.
• --token still works so old copied commands don't break, but it prints a deprecation warning.
• Every "re-run with --token DRB-…" hint now points at the prompt or --token-file. A re-run with a stale pickup secret (401/404) now prompts for a token instead of dying.
• The usage text and README example no longer show --token, and they warn that sudo DRB_ENROLLMENT_TOKEN=X bash leaks the token the same way --token does.

Not in this PR: the Server mint panel (drb-frontend/app/settings/nodes/page.tsx:63) still renders --token ${justMinted}, so it is filed in server-26. This PR does not depend on it: an old command still works, with a warning.

Verification: bash -n. I also ran the argument-parsing section in a harness: file, argv, env, none, missing file and empty file all behave as intended. Not run end-to-end on a Pi. No Python touched. edge-node pytest: 287 passed, 9 skipped. flake8 is clean.

🤖 Generated with Claude Code

Fixes #18. CISO condition from server-26#61: **the enrollment token must never appear as a plaintext CLI argument.** `3269203` ("enrollment token via header file too") only got the token off **curl's** argv. `install.sh --token DRB-…` was still the documented path: it put the token in shell history, and in `ps` for the whole install. So #18 was still open on main. **Changes (install.sh + README)** - The token is prompted for on the TTY with hidden input. This is the default and the recommended path. - Unattended installs: `--token-file PATH` warns if the file is group- or world-readable, and an exported `DRB_ENROLLMENT_TOKEN` works too. `DRB_ENROLLMENT_TOKEN` is `unset` after it is read, so child processes don't inherit it. - `--token` still works so old copied commands don't break, but it prints a deprecation warning. - Every "re-run with --token DRB-…" hint now points at the prompt or `--token-file`. A re-run with a stale pickup secret (401/404) now prompts for a token instead of dying. - The usage text and README example no longer show `--token`, and they warn that `sudo DRB_ENROLLMENT_TOKEN=X bash` leaks the token the same way `--token` does. **Not in this PR:** the Server mint panel (`drb-frontend/app/settings/nodes/page.tsx:63`) still renders `--token ${justMinted}`, so it is filed in server-26. This PR does not depend on it: an old command still works, with a warning. **Verification:** `bash -n`. I also ran the argument-parsing section in a harness: file, argv, env, none, missing file and empty file all behave as intended. Not run end-to-end on a Pi. No Python touched. edge-node pytest: 287 passed, 9 skipped. flake8 is clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

logan added 1 commit 2026-10-04 18:10:06 -04:00

install.sh: enrollment token never on the command line (node-26#18) ... 4dff9cbab6

The token is now prompted for on the TTY (hidden input), or read from
--token-file PATH / an exported DRB_ENROLLMENT_TOKEN for unattended installs.
--token still works for old copied commands but warns that it has landed in
shell history and ps. Every "re-run with --token DRB-..." hint now points at
the prompt; stale-pickup (401/404) re-runs prompt for a token instead of
dying. DRB_ENROLLMENT_TOKEN is unset after reading so children don't inherit
it. README install example drops --token.

Server half (mint panel still prints --token) is filed separately.

Refs #18

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

logan referenced this pull request 2026-10-04 18:10:37 -04:00

install.sh --token puts the enrollment token on the command line (shell history + ps) — CISO condition from server-26#61 unmet #18

logan added 1 commit 2026-10-04 18:17:37 -04:00

Drop last --token hint; note sudo drops DRB_ENROLLMENT_TOKEN (node-26#18) ... c4b4cb92c9

- key_pickup.py still told operators to re-run install.sh with --token.
- `curl | sudo bash` resets the env, so the documented exported-token
  path needs `sudo --preserve-env=DRB_ENROLLMENT_TOKEN`; say so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

logan commented 2026-10-04 18:17:55 -04:00

Author

Owner

Copy Link

Copy Source

Review pass (adversarial): pushed c4b4cb9 onto this branch.

• drb-edge-node/app/internal/key_pickup.py still logged "Re-run install.sh with --token to recover" — the one re-run hint the PR missed. Reworded.
• The documented unattended path ("an exported DRB_ENROLLMENT_TOKEN") doesn't survive curl ... | sudo bash — sudo's env_reset drops it. --help and README now say sudo --preserve-env=DRB_ENROLLMENT_TOKEN.

Local: edge-node pytest 296 passed, 0 skipped (flock shim), flake8 clean. #30 and #31 still merge cleanly together.

🤖 Generated with Claude Code

Review pass (adversarial): pushed `c4b4cb9` onto this branch. - `drb-edge-node/app/internal/key_pickup.py` still logged "Re-run install.sh with --token to recover" — the one re-run hint the PR missed. Reworded. - The documented unattended path ("an exported `DRB_ENROLLMENT_TOKEN`") doesn't survive `curl ... | sudo bash` — sudo's env_reset drops it. `--help` and README now say `sudo --preserve-env=DRB_ENROLLMENT_TOKEN`. Local: edge-node pytest 296 passed, 0 skipped (flock shim), flake8 clean. #30 and #31 still merge cleanly together. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

logan added 1 commit 2026-10-04 18:26:14 -04:00

Merge branch 'main' into fix/18-install-token-argv dbb41f2fd3

logan merged commit 582bc407be into main 2026-10-04 18:28:19 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

area/ai-pipeline

Scene/entity extraction, summarizer, AI providers, embeddings

area/auth

AuthN/Z, roles, tenancy/org scoping, API keys, credentials

area/billing

Plans, entitlements, AI spend accounting and caps

area/correlation

Incident correlation, linking, lifecycle, severity, corr_debug

area/discord

Discord bot, radio bots, voice streams, bot tokens, webhooks

area/frontend

Web UI: Next.js app and the edge-node local dashboard

area/governance

Board process, minutes, unattended runner, agent tooling

area/growth

Go-to-market, outreach, cold email, discovery conversations

area/infra-deploy

CI/CD, VM, registry, Firestore rules/indexes deploy, Terraform/Caddy

area/legal

ToS, retention, licences/DAAs, CAN-SPAM, E&O, name suppression

area/map

Live map: pins, paths, tiles, legend, geocoding

area/mqtt

Node-C2 MQTT, checkins, commands, node sweeper, dynsec

area/node-ota

Node install, enrollment, OTA updater, image skew

area/osint

External feeds: cameras, 511, ADS-B, AIS, outages, and their licences

area/recording-audio

Call capture, boundaries, PulseAudio, ring buffer, trimming, attribution

area/sdr-radio

OP25 decode, SDR hardware/tuning, conventional, second SDR, mesh radio

area/transcription

STT, transcript correction, place verification, name accuracy

board

Board process: minutes and board-filed items

board:agenda

Needs board scoping at the next sitting; CEO removes the label once scoped

kind

behavior-bug

Wrong product behavior; the instrument reads it correctly

kind

measurement-bug

Corrupts the recording/instrument (debug data, evals, health checks), not behavior

priority

p0

Drop everything: prod broken, live exposure, or owner-ruled P0

priority

p1

Next up: blocks a gate, a customer, or core incident quality

priority

p2

Normal: real defect or planned work, schedule in turn

priority

p3

Low: minor, cosmetic, or someday

status

blocked

Waiting on an external party, spend, or another issue

status

in-progress

Branch or PR open against it

status

needs-decision

Waiting on an owner or board ruling before work

status

needs-info

Root cause or repro unknown; needs a reading first

type

bug

Something built is wrong: code, data, or a measurement

type

chore

Maintenance, refactor, tests, pinning, cleanup: no user-visible change

type

decision

A ruling to make or record: board minutes, owner calls, legal reviews

type

docs

Docs, runbooks, CLAUDE.md, skills, SOPs

type

feature

New capability or an extension of an existing one

type

security

Security, privacy, credential or tenant-isolation exposure

type

tracking

Tracker, checklist, initiative or punch-list spanning several changes

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

logan

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: logan/node-26#30