ansible_vault.py missing shebang line and execute permission preventing vault decryption

[null0route]

Summary

The ansible_vault.py password client script shipped with nac-yaml is missing a
shebang line and execute permission, causing ansible-vault to fail when attempting
to decrypt inline !vault tagged values in YAML files.

Environment

• nac-yaml version: 1.1.1
• Python version: 3.14.2
• OS: macOS (Apple Silicon)
• ansible-core version:

Steps to Reproduce

1. Install nac-yaml
2. Set environment variables ANSIBLE_VAULT_PASSWORD and ANSIBLE_VAULT_ID=default
3. Create a YAML file with an inline !vault encrypted value
4. Run nac-validate against the file

Expected Behavior

nac-yaml successfully decrypts inline !vault tagged values using the
ANSIBLE_VAULT_PASSWORD environment variable.

Actual Behavior

Decryption fails with the following error:

ERROR! Decryption failed (no vault secrets were found that could decrypt) on - for -
ERROR - Unexpected error: Command '['ansible-vault', 'decrypt', '--vault-id', 
'default@/opt/homebrew/lib/python3.14/site-packages/nac_yaml/ansible_vault.py']' 
returned non-zero exit status 1.

Root Cause

ansible_vault.py is used as a vault password client script by ansible-vault.
For ansible-vault to invoke it correctly, two conditions must be met:

1. The script must have a shebang line so the OS knows which interpreter to use
2. The script must have execute permissions (+x)

Neither condition is met in the installed package.

Workaround

Until a fix is released, users can apply the following command after installing nac-yaml:

VAULT_SCRIPT=$(python3 -c "import importlib.util; \
print(importlib.util.find_spec('nac_yaml.ansible_vault').origin)") \
&& sed -i '1s|^|#!/usr/bin/env python3\n|' "$VAULT_SCRIPT" \
&& chmod +x "$VAULT_SCRIPT"

Suggested Fix

1. Add the following as the first line of ansible_vault.py:

    #!/usr/bin/env python3
   

2. In setup.py / pyproject.toml, ensure the script is marked as executable
   upon installation.