mig5/enroll
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Activity Actions

Add warning about --dangerous mode if sops is not in use
All checks were successful
CI / test (push) Successful in 50s
Details
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 12m37s
Details
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 20m21s
Details
Lint / test (push) Successful in 45s
Details

Browse source
This commit is contained in:
Miguel Jacq 2026-06-22 12:56:21 +10:00
parent bf1c72c542
commit a1d7a9e4e6
Signed by: mig5
GPG key ID: 03906B4110AAD3B8
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
enroll/cli.py
View file

@ -113,6 +113,15 @@ def _action_lookup(p: argparse.ArgumentParser) -> dict[str, argparse.Action]:
return m return m
def _warn_dangerous_harvest(*, sops_enabled: bool) -> None:
if not sops_enabled:
print(
"warning: --dangerous is enabled. The harvest may contain sensitive "
"files, credentials, private keys, tokens, or application secrets. "
"Consider using --sops to encrypt the harvest at rest."
)
def _choose_flag(a: argparse.Action) -> Optional[str]: def _choose_flag(a: argparse.Action) -> Optional[str]:
# Prefer a long flag if available (e.g. --dangerous over -d) # Prefer a long flag if available (e.g. --dangerous over -d)
for s in getattr(a, "option_strings", []) or []: for s in getattr(a, "option_strings", []) or []:
@ -954,6 +963,11 @@ def main() -> None:
) )
args = ap.parse_args(argv) args = ap.parse_args(argv)
if args.cmd in {"harvest", "single-shot"} and bool(
getattr(args, "dangerous", False)
):
_warn_dangerous_harvest(sops_enabled=bool(getattr(args, "sops", None)))
_confirm_root_path_safety(force=bool(getattr(args, "assume_safe_path", False))) _confirm_root_path_safety(force=bool(getattr(args, "assume_safe_path", False)))
# Preserve historical defaults for remote harvesting unless ssh_config lookup is enabled. # Preserve historical defaults for remote harvesting unless ssh_config lookup is enabled.