Skip to content

sc-036b.md

Latest commit

 

History

History
57 lines (47 loc) · 4.65 KB

sc-036b.md

File metadata and controls

57 lines (47 loc) · 4.65 KB
Raw

← Back to Backlog

[SC-036b] Negotiate mode Phase 1 — bootstrap install of krb5 and px

Status: Open Priority: High Component: lib/wsl/scripts/setup-proxy-negotiate.sh, lib/wsl/proxy.ps1 Depends on: SC-036a Parent: SC-036

Summary: As a developer picking Negotiate mode, I want the setup to install krb5-user and px-proxy through a temporary authenticated proxy so that the Kerberos tooling is available on disk before Kerberos is configured — without leaking Basic-auth credentials into any process environment.

Description: Implements Phase 1 of the four-phase Negotiate workflow (see SC-036). After this slice, which px and which kinit succeed inside the target distro; Kerberos is not yet configured and px is not yet running.

This phase has a chicken-and-egg problem: installing the Kerberos stack needs a working authenticated proxy, but the authenticating proxy (px) is what we are trying to install. Solution: temporarily point apt and pip at the company proxy with Basic-auth creds. The key security constraint (from the SC-036 threat model) is that Basic-auth credentials must never be exported to the shell environment — AI coding agents running in the same WSL session can read /proc/*/environ of any process owned by the same user.

Credential handling during bootstrap:

  • apt: creds live in /etc/apt/apt.conf.d/99proxy (root-owned, 644). Same pattern as SC-007 Basic mode. apt reads its config; no env var needed.
  • pip/pipx: write a temporary ~/.config/pip/pip.conf with [global] proxy = http://user:pass@host:port before pipx install px-proxy, then delete pip.conf after the install succeeds. pip reads from config; no env var needed.
  • Never exported: at no point does this script run export HTTP_PROXY=.... The Basic-auth URL does not enter any process env.

Scope Decisions:

  • Creds in config files only (no export HTTP_PROXY): preserves the Negotiate threat model even during bootstrap. Cost: ~5 extra lines of shell to write + delete pip.conf.
  • pipx, not pip3: Ubuntu 24.04+ enforces PEP 668; system-level pip3 install is blocked.
  • Marker transition: write negotiate-bootstrap to /etc/wsl-manager/proxy-mode at the start of Phase 1 (not negotiate — full Negotiate state is reached only after SC-036d). SC-036e's --remove treats negotiate-bootstrap and negotiate identically for teardown purposes.
  • Stop before krb5.conf/px.ini: this slice must not touch Kerberos config, must not start px, must not run kinit. Those belong to SC-036c.
  • Idempotent re-run: if re-invoked, re-read the Basic-auth creds via prompt, overwrite apt.conf.d/99proxy, re-run apt install (no-op if already installed), re-run pipx install (no-op if already installed), re-run pipx ensurepath.

Acceptance Criteria:

  • setup-proxy-negotiate.sh prompts (via the PS1 caller, not the shell) for temporary Basic-auth credentials used during bootstrap
  • setup-proxy-negotiate.sh writes /etc/apt/apt.conf.d/99proxy with the Basic-auth-embedded proxy URL (root-owned)
  • setup-proxy-negotiate.sh writes a temporary ~/.config/pip/pip.conf with the Basic-auth URL in [global] proxy; deletes it after the pip install step succeeds (even on failure via trap)
  • setup-proxy-negotiate.sh never sets HTTP_PROXY, HTTPS_PROXY, http_proxy, or https_proxy in its own environment or exports them to children
  • apt-get update && apt-get install -y krb5-user pipx succeeds through the apt-config-embedded proxy
  • pipx install px-proxy succeeds, using the temp pip.conf for proxy access
  • pipx ensurepath runs so that ~/.local/bin is in PATH for future shells
  • After successful run: /etc/wsl-manager/proxy-mode contains negotiate-bootstrap; ~/.local/bin/px exists; kinit is on PATH
  • Temp pip.conf does not exist after successful run
  • Script is idempotent: a second run updates the apt proxy with fresh creds and leaves the tools as-is
  • Pester unit test covers the PS1 credential-prompt branch for Negotiate bootstrap (mocking the shell invocation)
  • All existing tests continue to pass

Technical Notes:

  • pipx install px-proxy pulls the px-proxy package; per the SC-036 Verified note, px --test --auth=NEGOTIATE passed on the user's system after this install, so no GSSAPI extras are required here.
  • Suggested pip.conf writer: 
    mkdir -p "$TARGET_HOME/.config/pip"
cat > "$TARGET_HOME/.config/pip/pip.conf" <<EOF
[global]
proxy = $BASIC_PROXY_URL
EOF
trap 'rm -f "$TARGET_HOME/.config/pip/pip.conf"' EXIT

← Back to Backlog