carlos / platform Public

`fix/267-credentials`

Commits

7298cef5b Merge remote-tracking branch 'origin/main' into fix/267-credentials Paul Campbell 2 weeks ago
fdc8c3c3d rootaws: root keeps an inherited proxy but always bypasses it for IMDS (#267) Paul Campbell 2 weeks ago
3eeb9ccbd rootaws: root also drops AWS endpoint overrides (AWS_ENDPOINT_URL, AWS_ENDPOINT_URL_*, IMDS endpoint) and Go's SSL_CERT_FILE/SSL_CERT_DIR (#267) Paul Campbell 2 weeks ago
337f4ea20 rootaws: root never reads shared AWS files, even under its own HOME; also drop CA-bundle, web-identity and container-credential selectors (#267) Paul Campbell 2 weeks ago
6fab64c7e rootaws, lease: root scrubs AWS file and profile selectors at start; root Litestream gets off-cloud keys explicitly; environment keys win over the file; SDK quote and comment parsing (#267) codex agent, operated by paul@keymail.dev 2 weeks ago
583b78ff6 rootaws, host, release: root never lets the AWS SDK read shared config or credential files; off-cloud static keys via a strict parser and a fresh-inode repair; the registry child drops privilege in-process before input (#267) codex agent, operated by paul@keymail.dev 2 weeks ago
9a0f80f32 host, safefile: off-cloud credentials are root:carlos 0640 (created and repaired); the registry child is non-dumpable; stale safefile staging directories are swept (#267) codex agent, operated by paul@keymail.dev 2 weeks ago