code wiki / _hdl_build / nx_stage_secret.nx
nx_stage_secret.nx source
↩ module page · 19 lines · 988 B
1// nx_stage_secret.nx -- sovereign helper: write a value to a file (0600), no trailing newline. Used to stage
2// a plaintext secret into /tmp/nxsecret.in for `nx_vault seal` (the documented vault ingest path), without a
3// shell. argv: [1]=path [2]=value. (For real secrets the operator stages out-of-band; this exists so the
4// seal->open->arm round-trip can be proven end-to-end with sovereign organs only.) license_tier: ORIGINAL
5import "nx_syscalls.nx"
6
7func ss_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
8
9func main(argc: i64, argv: *i64) -> i64 {
10 if argc < 3 { sys_write(2, "usage: nx_stage_secret <path> <value>\n" as *u8, 38); return 1 }
11 let path: *u8 = argv[1] as *u8
12 let val: *u8 = argv[2] as *u8
13 let fd: i64 = sys_openat_wr(path, 0x180)
14 if fd < 0 { sys_write(2, "stage: open FAIL\n" as *u8, 17); return 2 }
15 sys_write(fd, val, ss_len(val))
16 sys_close(fd)
17 sys_write(1, "staged\n" as *u8, 7)
18 return 0
19}