Module windows 

Secrets on a Windows VM, in PowerShell. Delivery keeps each value under KEPT_DIR, a folder only SYSTEM and Administrators can open, and leaves the mark DELIVERED the set-up waits for; each file is then written at its path with the same two readers and nobody else.

The values come on the connection’s standard input (WinRM’s or OpenSSH’s), after the receiving script itself: the command line the runner starts is BOOTSTRAP, the same for every machine, which reads the script’s first line and runs it. Nothing of a value is in a command line, a generated file or the output.

At every boot a startup task (isoloom-apply-secrets) writes the files again. Task Scheduler starts the startup tasks in no fixed order, so the before and command scripts run the same placing script first themselves: their process never starts without its files.

Constants

BOOTSTRAP

What the runner starts on the machine (as powershell -EncodedCommand): it reads the first line of its standard input, the receiving script in base64, and runs it. The script reads the values from the lines that follow.

DELIVERED

The mark delivery leaves once every secret is kept.

KEPT_DIR

Where a Windows machine keeps the secrets delivered to it.

PLACE_SCRIPT

The script putting the files in place, run by the startup task and before the process.

PLACE_TASK

The startup task running PLACE_SCRIPT at every boot.

Functions

command_line

The command line running BOOTSTRAP through a remote shell (OpenSSH’s): powershell and powershell_args, none of which a shell changes.

from_environment

A Windows VM’s Secrets step when the tool that runs it hands the values over itself (Vagrant’s provisioner environment over WinRM): each of values, a secret’s name and the variable holding its value in base64 (PowerShell never expands anything in it), kept in the SYSTEM- and Administrators-only folder and the delivery marked; then the placing script written, registered and run, as step does. Nothing waits. An empty or unset variable writes an empty value the first time, and keeps the value already kept after.

input

What the deliverer writes on the connection’s standard input: the receiving script in base64 on the first line, then values (one base64 line per secret, in names’ order).

path

The path of a secret file on Windows: a drive path as it is, a path from / on drive C:.

place

Each kept secret written at its path, its folder made when missing. The file is created empty and limited to SYSTEM and Administrators before the value is written into it, so it never holds the value with its folder’s (wider) access list.

place_first

The line a before or command script starts with on a machine that gets secrets: the files put in place first, whichever startup task Windows ran first.

powershell_args

The arguments of powershell.exe running BOOTSTRAP, encoded (UTF-16LE in base64) so that no remote shell (cmd, PowerShell) reads anything into it.

receive

The receiving script. After the line that holds it, its standard input holds one line per secret of names, in that order, each value in base64; it keeps each one, marks the delivery, then puts files in place (so a run again refreshes them).

step

A Windows VM’s Secrets step: the wait, then the placing script written, registered as a startup task (as SYSTEM) and run now.

wait

Waits for the delivery mark, saying so once; fails after DELIVERY_TIMEOUT seconds with what to do.