villebase/sopuli-dba

No problems traced to this repository code in these checks. 4 static matches retained as context.

Reviewed as expected for a test run: apt refreshed its package lists; attempted writes that failed, so nothing was written.

4 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The tool validates configuration files.: Real input produced the expected result: ok: 1 target, 1 binding, 0 warnings

  Source: config validate

  Input: .coldpass/single-application.yaml

  Expected: ok: 1 target, 1 binding, 0 warnings

  Command: <guest-path> --config .coldpass/single-application.yaml config validate

  Observed: ok: 1 target, 1 binding, 0 warnings

Examples

• Validate the smallest application configuration: command completed successfully

  Source: examples/single-application.yaml, comment at top

  Input: .coldpass/single-application.yaml

  Expected: configuration is valid

  Command: <guest-path> --config .coldpass/single-application.yaml config validate

  Observed: config: .coldpass/single-application.yaml ok: 1 target, 1 binding, 0 warnings

Local or hosted: local

Validate and list configured database targets

pwd; git status --short; rg --files -g 'README*' -g 'pyproject.toml' -g 'requirements*' -g 'package.json' -g 'Makefile' -g 'AGENTS.md' -g '*.yml' -g '*.yaml' | head -80; python3 --version; sed -n '1,240p' README.md
sed -n '240,520p' README.md; find . -maxdepth 3 -type f | sort | head -100
sed -n '1,260p' docs/getting-started.md; find examples -maxdepth 2 -type f -print; ls -la
sudo apt-get -o DPkg::Lock::Timeout=300 update && sudo apt-get -o DPkg::Lock::Timeout=300 install -y pipx; pipx --version; sed -n '1,180p' examples/single-application.yaml; grep -n 'config validate\|sopuli --config' docs/getting-started.md | head
pipx install 'sopuli-dba[oracle,hashicorp]'
mkdir -p .coldpass; cp examples/single-application.yaml .coldpass/single-application.yaml; <guest-path> --config .coldpass/single-application.yaml config validate
chmod 600 .coldpass/single-application.yaml; <guest-path> --config .coldpass/single-application.yaml config validate; <guest-path> --config .coldpass/single-application.yaml target list
mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","--config",".coldpass/single-application.yaml","target","list"],"cwd":"<guest-path>","expected_text":"1 target (1 explicit)"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The target list displays the configured database target.","source":"Check it before you use it:\n#     sopuli --config single-application.yaml config validate","input":"examples/single-application.yaml","expected":"free-pdb appears as the configured target","probe_kind":"cli","argv":["<guest-path>","--config",".coldpass/single-application.yaml","target","list"],"expected_text":"1 target (1 explicit)","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Validate the smallest application configuration","source":"examples/single-application.yaml, comment at top","input":".coldpass/single-application.yaml","expected":"configuration is valid","argv":["<guest-path>","--config",".coldpass/single-application.yaml","config","validate"],"cwd":"<guest-path>","expected_text":"ok: 1 target, 1 binding, 0 warnings"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README quick example and CLI entrypoints; they describe manually invoked creds generate/apply/check commands, with no scheduler or recurring cycle implementation."}
EOF

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The tool can validate the supplied configuration.","source":"the file is valid","input":".coldpass/single-application.yaml","expected":"ok: 1 target, 1 binding, 0 warnings","probe_kind":"cli","argv":["<guest-path>","--config",".coldpass/single-application.yaml","config","validate"],"expected_text":"ok: 1 target, 1 binding, 0 warnings","cwd":"<guest-path>"}]
EOF
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Validate and list configured database targets","operation_scope":"Local configuration validation and target listing; no database or vault connection","steps":["Checked Python 3.12.3 against README minimum 3.11","Installed pipx using apt and installed sopuli-dba[oracle,hashicorp]","Copied documented examples/single-application.yaml and set mode 0600","Ran config validate and target list"],"deviations":["Oracle Instant Client, Oracle, and Vault are documented prerequisites for connected commands; only local config operations were run."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The tool validates configuration files.","source":"config validate","input":".coldpass/single-application.yaml","expected":"ok: 1 target, 1 binding, 0 warnings","probe_kind":"cli","argv":["<guest-path>","--config",".coldpass/single-application.yaml","config","validate"],"expected_text":"ok: 1 target, 1 binding, 0 warnings","cwd":"<guest-path>"}]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay