Tyler King
043b9b9bdc
New crate: bascule-shell (471 lines, 1.8MB binary) Login shell that detects identity + platform attestation at startup. Wraps bash/zsh/fish — operator works normally, identity travels with them. Identity detection (priority order): 1. Entra via WSL2 interop 2. Azure CLI 3. Kerberos TGT 4. Cached OIDC token 5. System user (fallback) Platform attestation: TPM 2.0 PCR values via tpm2_pcrread (PCRs 0,1,2,7,10,14) IMA measurement log hash + count Keylime agent state Entra device compliance (WSL2 only) Composite SHA-256 hash over all evidence Shell features: Banner with identity + attestation summary BASCULE_* env vars injected into inner shell --info mode for dry-run display --json mode for machine-readable output --exec mode for single-command execution Configurable via ~/.config/bascule/shell.toml Tested on Fedora with real TPM 2.0: 6 PCRs successfully read from hardware All env vars propagated to inner shell 1.8MB binary, 0 substrate deps Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
28 lines
740 B
Docker
28 lines
740 B
Docker
# Build stage
|
|
FROM rust:1-bookworm AS builder
|
|
WORKDIR /build
|
|
COPY . .
|
|
RUN cargo build --release -p bascule-server
|
|
|
|
# Runtime stage
|
|
FROM debian:bookworm-slim
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
openssh-client \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=builder /build/target/release/bascule /usr/local/bin/bascule
|
|
RUN chmod +x /usr/local/bin/bascule
|
|
|
|
# Create non-root user
|
|
RUN useradd -r -s /usr/sbin/nologin bascule
|
|
|
|
# Config, keys, and host key directories
|
|
RUN mkdir -p /etc/bascule/keys /var/lib/bascule \
|
|
&& chown -R bascule:bascule /etc/bascule /var/lib/bascule
|
|
|
|
USER bascule
|
|
EXPOSE 2222
|
|
ENTRYPOINT ["bascule"]
|
|
CMD ["--config", "/etc/bascule/config.toml"]
|