bad50daad2
Rotator base exposes the four lifecycle methods as abstract; subclasses register at compile time via 'register_as :kind' macro. REGISTRY is populated as soon as the rotator file is required - drop a new file in src/cre/rotators/ and the orchestrator can dispatch to it. EnvFileRotator implements the simplest rotation: - generate: 32 random bytes -> base64-urlsafe (no padding) - apply: write to PATH.pending atomically (in-place line replace, 0600) - verify: parse pending file, confirm key=value present and non-empty - commit: rename PATH.pending -> PATH (atomic on POSIX) - rollback_apply: unlink PATH.pending RotationOrchestrator runs the 4-step contract with full event publishing, state machine transitions in DB (generating -> applying -> verifying -> committing -> completed | failed), and rollback_apply on apply/verify failure. 8 specs cover happy path + raised-during-apply + rollback verification. |
||
|---|---|---|
| .. | ||
| api-security-scanner | ||
| binary-analysis-tool | ||
| credential-enumeration | ||
| credential-rotation-enforcer | ||
| dlp-scanner | ||
| docker-security-audit | ||
| sbom-generator-vulnerability-matcher | ||
| secrets-scanner | ||
| siem-dashboard | ||