judgevet.adapters.inbound.credential_command
Status: draft.
judgevet.adapters.inbound.credential_command
Run trusted credential commands with bounded output and process cleanup.
Commands execute argv directly with no implicit shell. POSIX process groups allow cleanup of descendants that retain the command's pipes.
Examples:
from judgevet.adapters.inbound.credential_command import MAX_KEY_BYTES
assert MAX_KEY_BYTES == 4096
See Also
- judgevet.adapters.inbound.credentials: Source selection and decoding.
- judgevet.adapters.inbound.settings: Command deadline configuration.
run_command(command, timeout)
Resolve a trusted POSIX command without disclosing its streams or argv.
Parameters:
| Name | Type | Description | Default |
|---|---|---|---|
command
|
SecretStr
|
Wrapped command specification with the leading exclamation mark. |
required |
timeout
|
float
|
Finite positive deadline supplied by validated settings. |
required |
Returns:
| Type | Description |
|---|---|
SecretBytes
|
Wrapped bounded stdout. |
Raises:
| Type | Description |
|---|---|
ValueError
|
If commands are unsupported or execution fails. |