From 6cff2261d5a7dd1b2aa243334795061e4ec54561 Mon Sep 17 00:00:00 2001
From: david <davidfolkesmd@gmail.com>
Date: Sat, 19 Sep 2026 00:13:13 -0400
Subject: [PATCH] Add fail-closed NPM ACME bootstrap entrypoint

---
 bootstrap.sh | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/bootstrap.sh b/bootstrap.sh
index 2300d32..1c39dbf 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -3,14 +3,35 @@ set -euo pipefail
 
 readonly ACME_AUTHORITY_ROOT="${ACME_AUTHORITY_ROOT:-/acme_authority}"
 readonly PATCHER="${ACME_AUTHORITY_ROOT}/patch_acme.py"
+readonly NPM_ENTRYPOINT="${NPM_ENTRYPOINT:-/init}"
 
 log()
 {
     printf '[acme-authority] %s\n' "$*"
 }
 
+fail()
+{
+    log "ERROR: $*"
+    exit 1
+}
+
 log "Bootstrap starting"
 
+[[ -r "$PATCHER" ]] ||
+    fail "patcher not readable: $PATCHER"
+
+command -v python3 >/dev/null 2>&1 ||
+    fail "python3 is not available"
+
+[[ -n "$NPM_ENTRYPOINT" ]] ||
+    fail "NPM_ENTRYPOINT is empty"
+
+log "Applying configured ACME authority gates"
+
 python3 "$PATCHER"
 
-log "Bootstrap completed"
+log "ACME authority patch and verification completed"
+log "Handing off to NPM entrypoint: $NPM_ENTRYPOINT"
+
+exec "$NPM_ENTRYPOINT"