Claude
37515ec975
Containers / CI often block the keyutils syscalls wnd uses by default to store secret keys (add_key returns EACCES, keyctl_search returns ENOSYS). The integration-tests feature ships a mock keyring store, but the stock wnd binary doesn't wire it up. Add a tiny opt-in patch. Changes: - headless/patches/whitenoise-mock-keyring.patch: if built with the integration-tests feature and \$WHITENOISE_MOCK_KEYRING is set, wnd calls Whitenoise::initialize_mock_keyring_store() before the normal init path. Harmless on production builds. - headless/setup.sh: apply both harness patches generically from a list; build wn/wnd with --features cli,integration-tests; export WHITENOISE_MOCK_KEYRING=1 alongside WHITENOISE_DISCOVERY_RELAYS when launching each daemon. - preflight swaps keyctl for patch in required tools — we no longer need a real session keyring. https://claude.ai/code/session_01M6dCKAF5Y1VyHGZPjzwDXq
19 lines
794 B
Diff
19 lines
794 B
Diff
--- a/src/bin/wnd.rs
|
|
+++ b/src/bin/wnd.rs
|
|
@@ -22,6 +22,15 @@
|
|
let args = Args::parse();
|
|
let config = Config::resolve(args.data_dir.as_ref(), args.logs_dir.as_ref());
|
|
|
|
+ // marmot-interop-headless patch: allow sandboxes/CI without a real
|
|
+ // kernel keyring to fall back to the integration-tests mock keyring
|
|
+ // by setting $WHITENOISE_MOCK_KEYRING=1. Requires the daemon to be
|
|
+ // built with --features cli,integration-tests. No effect otherwise.
|
|
+ #[cfg(feature = "integration-tests")]
|
|
+ if std::env::var("WHITENOISE_MOCK_KEYRING").is_ok() {
|
|
+ Whitenoise::initialize_mock_keyring_store();
|
|
+ }
|
|
+
|
|
let wn_config = WhitenoiseConfig::new(&config.data_dir, &config.logs_dir, KEYRING_SERVICE_ID);
|
|
Whitenoise::initialize_whitenoise(wn_config).await?;
|
|
|