From 2127f43eb6514048866b83aeb185b1d3a72459d1 Mon Sep 17 00:00:00 2001 From: k9ert <117085+k9ert@users.noreply.github.com> Date: Wed, 19 Aug 2026 14:57:42 +0200 Subject: [PATCH] docs: scrub private-repo artifacts now that argit is public - README: replace the bundled-deploy-key install block (embedded SSH private key + github-argit host alias + "the argit repo is private") with plain public https installs; drop the SSH/gh "read access" alternatives. - README: drop link to private blinkbitcoin/bot-provisioning-poc (404s for public readers) and to a tech-spec path that isn't in this repo. - AGENTS.md: replace a local absolute path into a private spec worktree with a note that the spec is internal. - passwrap.py: docstring referenced a private repo's script. - bump 1.11.0 -> 1.12.0 Co-Authored-By: Claude Opus 5 --- AGENTS.md | 10 ++--- README.md | 93 ++++++++----------------------------------- pyproject.toml | 2 +- src/argit/__init__.py | 2 +- src/argit/passwrap.py | 4 +- 5 files changed, 26 insertions(+), 85 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index aa4408e..ec26319 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -169,11 +169,11 @@ failed) + **remediation** (what the operator should do). Construct it that way. ## Spec reference -The multi-track tech-spec driving recent work: -`/Users/kim/src/blink-specs/.claude/worktrees/kn+argit-localisations/argit/implementation-artifacts/tech-spec-argit-manifest-handling.md` - -Tracks D (conventions) / A (hash catalog + drift) / C (overlay) / B (globs) are -all merged. Open follow-ups tracked as GitHub issues. +The multi-track manifest-handling tech-spec driving recent work lives in an +internal (non-public) spec repo. Tracks D (conventions) / A (hash catalog + +drift) / C (overlay) / B (globs) are all merged, so their outcome is fully +described by `MANIFEST.md` plus the code. Open follow-ups are tracked as GitHub +issues on this repo. ## Don't do these diff --git a/README.md b/README.md index 515c0f6..f45e8d4 100644 --- a/README.md +++ b/README.md @@ -9,88 +9,31 @@ commit as plaintext. MVP targets **OpenClaw** only. ## Quick Install / Upgrade -The argit repo is private. Installation uses a bundled read-only deploy key -to clone over SSH. Copy-paste this block (it sets up the SSH key + Host -alias once, then installs/upgrades to whatever ref is at the end — -**re-run the same block to upgrade**): - ```sh -mkdir -p ~/.ssh && chmod 700 ~/.ssh -touch ~/.ssh/config && chmod 600 ~/.ssh/config - -cat > ~/.ssh/argit-deploy <<'EOF' ------BEGIN OPENSSH PRIVATE KEY----- -b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW -QyNTUxOQAAACCbHQz3D+jQgiaKYDWXdsf/LGvw0GJWm3y6h3snQNVNzwAAAJjbdI4O23SO -DgAAAAtzc2gtZWQyNTUxOQAAACCbHQz3D+jQgiaKYDWXdsf/LGvw0GJWm3y6h3snQNVNzw -AAAEAiLVilcVJz2bSoI5QY4qH5W4ECMGmNWl4jGeBLuwhO4JsdDPcP6NCCJopgNZd2x/8s -a/DQYlabfLqHeydA1U3PAAAAFWFyZ2l0LWRlcGxveS1yZWFkb25seQ== ------END OPENSSH PRIVATE KEY----- -EOF -chmod 600 ~/.ssh/argit-deploy - -if ! grep -q "^Host github-argit$" ~/.ssh/config 2>/dev/null; then - cat >> ~/.ssh/config </dev/null; then - echo "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" >> ~/.ssh/known_hosts -fi - -argit_install() { - local URL="git+ssh://git@github-argit/blinkbitcoin/argit.git@${1:-main}" - if command -v uv >/dev/null 2>&1; then - uv tool install --force "$URL" || return $? - elif command -v pipx >/dev/null 2>&1; then - pipx install --force "$URL" || return $? - else - echo "neither uv nor pipx found — install one first" >&2; return 1 - fi - argit --version -}; argit_install main +uv tool install --force git+https://github.com/blinkbitcoin/argit.git@main +argit --version ``` -The trailing word — `main` — is the git ref. To install or upgrade to a -different ref, hit **Ctrl-E** to jump to end-of-line, replace `main` with -`v1.2.0` (or any tag/branch/SHA), and hit Enter. Re-running with the same -ref reinstalls (use this to pick up new commits on `main`). - -If `argit` isn't on PATH after install, run `pipx ensurepath` and `source ~/.bashrc` (or `~/.zshrc`). - -### About the bundled deploy key - -The key above has **read-only** access scoped to `blinkbitcoin/argit` (no write, -no other repos, no user). Anyone with the README contents can clone argit; -that's the trade-off chosen for `curl|paste|bash` UX over a private repo. -GitHub permits this pattern for read-only deploy keys. If the key needs -rotation, ship a new argit release with an updated README and revoke the old -deploy key on the repo. - -### Alternative install methods - -If you have your own SSH key registered with GitHub and read access to the repo: +Or with `pipx`: ```sh -uv tool install git+ssh://git@github.com/blinkbitcoin/argit.git@main +pipx install --force git+https://github.com/blinkbitcoin/argit.git@main ``` -If you have `gh` authenticated: +The trailing ref — `main` — is any tag, branch, or SHA. Re-run the same command +to upgrade: with the same ref to pick up new commits, or with a different one +(`@v1`, `@v1.11.0`) to move releases. + +There is also a bootstrap script (used in the six-step flow below) that picks +whichever of `uv` / `pipx` is present; it installs the `v1` tag by default, +overridable with `ARGIT_TAG`: ```sh -gh repo clone blinkbitcoin/argit /tmp/argit && pipx install /tmp/argit +curl -fsSL https://raw.githubusercontent.com/blinkbitcoin/argit/main/install.sh | bash ``` +If `argit` isn't on PATH after install, run `pipx ensurepath` and `source ~/.bashrc` (or `~/.zshrc`). + ## Six-Step Bootstrap ```sh @@ -286,9 +229,8 @@ Two recommended setups: 1. **GitHub CLI**: `gh auth login` — handles HTTPS remotes out of the box. 2. **Personal SSH key**: set up GitHub with SSH as usual; `git push` Just Works. -Advanced (deploy-key-in-pass pattern): see -[bot-provisioning-poc/scripts/on_host/secrets_setup.sh](https://github.com/blinkbitcoin/bot-provisioning-poc/blob/main/scripts/on_host/secrets_setup.sh). -Automated deploy-key setup is planned for a later QS; out of MVP scope. +Automated deploy-key setup (storing a per-repo deploy key in the pass store) is +out of MVP scope. ### `UnicodeEncodeError` mid-command (`LANG=C` containers) @@ -331,8 +273,7 @@ stderr before exec, `argit doctor` previews commands, `--skip-lifecycle` bypasses), supply-chain compromise of argit itself, or compromised GPG private keys. -See [tech-spec-01-mvp.md](argit/implementation-artifacts/tech-spec-01-mvp.md) -and [MANIFEST.md](MANIFEST.md) for design rationale and manifest authoring. +See [MANIFEST.md](MANIFEST.md) for design rationale and manifest authoring. ## License diff --git a/pyproject.toml b/pyproject.toml index c4fb59d..beae21a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "argit" -version = "1.11.0" +version = "1.12.0" description = "Per-user agent backup/restore CLI" requires-python = ">=3.10" authors = [{ name = "Blink", email = "engineering@blinkbtc.com" }] diff --git a/src/argit/__init__.py b/src/argit/__init__.py index f84c53b..b518f6e 100644 --- a/src/argit/__init__.py +++ b/src/argit/__init__.py @@ -1 +1 @@ -__version__ = "1.11.0" +__version__ = "1.12.0" diff --git a/src/argit/passwrap.py b/src/argit/passwrap.py index a9e6cc3..2933071 100644 --- a/src/argit/passwrap.py +++ b/src/argit/passwrap.py @@ -86,8 +86,8 @@ def show(self, pass_path: str) -> str: def insert(self, pass_path: str, value: str) -> None: """Idempotent insert: skip the write when the existing value matches. - Mirrors bot-provisioning-poc/inject_secret.sh — strip trailing - newlines on both sides before comparison so re-runs don't churn. + Strips trailing newlines on both sides before comparison so re-runs + don't churn. """ if self.has(pass_path): existing = self.show(pass_path)