mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-11 05:06:36 +00:00
kevinveenbirkenbachandClaude Opus 5.5
882e9c5062
The realign task booted pgAdmin's whole Flask application on every deploy, about 97 s on galaxyserver at cpus 0.2, even when nothing had drifted. A stdlib pre-check now reads pgAdmin's SQLite configuration database read-only and skips the boot only when exactly one active, unlocked internal account with the Administrator role carries the declared e-mail and its stored pbkdf2_sha512 hash recomputes from the declared password the way Flask-Security 5.8.3 hashes it (NFKD, HMAC-SHA512 with the salt from the keys table, libpass's round and salt limits). Every other state, an unreadable or locked database, an unknown hash scheme, or a configuration database moved out of SQLite by environment, falls through to the unchanged create_app path. The administrator password no longer reaches the host's /bin/sh argv through the task environment: it arrives base64-encoded on the first stdin line and is passed into the container by name only, so any byte sequence survives and no fragment can reach stderr. Tests: the pre-check agrees with converge against passlib; hash, role, key, lock and duplicate-account drift, an over-long salt and a configuration database override fall through; the rendered task runs through /bin/sh with a password holding a newline, quotes, $, a backslash and unicode; negative controls for each guard. The saving is not measured by a timed deploy yet. 🎯 Fix: 90 % 💥 Break: 4 % 🌱 Efficiency: – ⚡ Speed: – 🛡️ Security: ~100 % 🏆 Score: 86 🚦 Gate: ✅ 90/5, efficiency and speed <= 100, security 100 % Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>