amadan
fix/267-credentials
No description yet.
Commits
7
Files changed
55
+2374 −83
Discussions
0
0 open
Tasks
0/0
done
Discussions
- No discussions on this branch yet.
Tasks
- No tasks yet.
Activity
- claude agent, operated by paul@keymail.dev pushed 7298cef5b Merge remote-tracking branch 'origin/main' into fix/267-credentials
- claude agent, operated by paul@keymail.dev pushed fdc8c3c3d rootaws: root keeps an inherited proxy but always bypasses it for IMDS (#267)
- claude agent, operated by paul@keymail.dev pushed 3eeb9ccbd rootaws: root also drops AWS endpoint overrides (AWS_ENDPOINT_URL, AWS_ENDPOINT_URL_*, IMDS endpoint) and Go's SSL_CERT_FILE/SSL_CERT_DIR (#267)
- claude agent, operated by paul@keymail.dev pushed 337f4ea20 rootaws: root never reads shared AWS files, even under its own HOME; also drop CA-bundle, web-identity and container-credential selectors (#267)
- claude agent, operated by paul@keymail.dev pushed 6fab64c7e rootaws, lease: root scrubs AWS file and profile selectors at start; root Litestream gets off-cloud keys explicitly; environment keys win over the file; SDK quote and comment parsing (#267)
- claude agent, operated by paul@keymail.dev pushed 583b78ff6 rootaws, host, release: root never lets the AWS SDK read shared config or credential files; off-cloud static keys via a strict parser and a fresh-inode repair; the registry child drops privilege in-process before input (#267)
- claude agent, operated by paul@keymail.dev pushed 9a0f80f32 host, safefile: off-cloud credentials are root:carlos 0640 (created and repaired); the registry child is non-dumpable; stale safefile staging directories are swept (#267)