c759597ad0
fix: pass YubiKey PIN via stdin instead of CLI arg ( #18 , #31 )
...
--pin-source stdin prevents PIN visibility in `ps` output.
Use tempfile.mkstemp for all temp files (unpredictable names, 0600 perms).
Clean up temp files in finally block.
Add tests for PIN not in args and mkstemp usage.
2026-07-04 04:49:56 +00:00
279a28515f
fix: generate JWT secret on first boot instead of hardcoded default ( #19 )
...
Generate random 256-bit secret stored in /var/lib/certauth/.jwt_secret (mode 0600)
ENV JWT_SECRET takes precedence. Remove CHANGE_ME_JWT_SECRET default.
Add tests for secret generation and env override
2026-07-04 04:48:30 +00:00
c4d952430e
update local changes
2026-07-03 01:14:04 +00:00
0670f2be43
Add secrets to .gitignore
2026-07-01 04:52:16 +00:00
5d417c20e1
Fix setup.sh: add -k flag, NSS import for Fedora, correct trust flags, LibreWolf docs
2026-07-01 04:51:40 +00:00
