bad50daad2
Rotator base exposes the four lifecycle methods as abstract; subclasses register at compile time via 'register_as :kind' macro. REGISTRY is populated as soon as the rotator file is required - drop a new file in src/cre/rotators/ and the orchestrator can dispatch to it. EnvFileRotator implements the simplest rotation: - generate: 32 random bytes -> base64-urlsafe (no padding) - apply: write to PATH.pending atomically (in-place line replace, 0600) - verify: parse pending file, confirm key=value present and non-empty - commit: rename PATH.pending -> PATH (atomic on POSIX) - rollback_apply: unlink PATH.pending RotationOrchestrator runs the 4-step contract with full event publishing, state machine transitions in DB (generating -> applying -> verifying -> committing -> completed | failed), and rollback_apply on apply/verify failure. 8 specs cover happy path + raised-during-apply + rollback verification. |
||
|---|---|---|
| .. | ||
| .github/workflows | ||
| spec | ||
| src | ||
| .editorconfig | ||
| .gitignore | ||
| LICENSE | ||
| Makefile | ||
| README.md | ||
| shard.lock | ||
| shard.yml | ||
README.md
Credential Rotation Enforcer (cre)
A Crystal-based daemon that tracks and enforces credential rotation
policies across AWS Secrets Manager, HashiCorp Vault, GitHub fine-grained
PATs, and local .env files.
Full README, asciinema demos, and walkthrough live in
learn/. This README will be expanded in Phase 16 of the build.