tegwick
b97f9f616f
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c
45 lines
2 KiB
Bash
Executable file
45 lines
2 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Compatibility entry point: metadata-only recovery guide; never export roots.
|
|
set +x
|
|
set -euo pipefail
|
|
|
|
CONFIRM=false
|
|
case "${1:-}" in
|
|
""|--reprint|--help) [[ $# -le 1 ]] || exit 2 ;;
|
|
--confirm) [[ $# -eq 1 ]] || exit 2; CONFIRM=true ;;
|
|
*) printf '%s\n' 'ERROR: secret-export arguments are retired; see docs/security-bootstrap-age-custody.md.' >&2; exit 2 ;;
|
|
esac
|
|
|
|
if [[ "$CONFIRM" == true && ( ! -t 0 || ! -t 1 ) ]]; then
|
|
printf '%s\n' 'ERROR: recovery acknowledgment requires an attended terminal.' >&2
|
|
exit 2
|
|
fi
|
|
|
|
cat <<'GUIDE'
|
|
NetKingdom recovery guide (non-secret)
|
|
|
|
The private age key stays in the operator password safe or offline custody.
|
|
This command never reads, generates or displays that key or any password.
|
|
The encrypted ops bundle holds service recovery material; it does not hold
|
|
its own decryption key. Preserve an off-host copy and keep the key separately.
|
|
|
|
Before acknowledging a newly created bundle:
|
|
1. Store the exact encrypted bundle off-host.
|
|
2. In the approved isolated recovery workspace, use the custody unlock helper
|
|
to verify that the independently held key can decrypt that bundle.
|
|
3. Confirm the needed service recovery files are present without printing them.
|
|
4. Remove decrypted drill files and retain only the non-secret drill receipt.
|
|
|
|
For an actual incident, use the scoped owner recovery procedure. An old
|
|
bootstrap snapshot may contain superseded passwords. Guide output or a human
|
|
acknowledgment is not a native restore test or evidence of current credentials.
|
|
See docs/security-bootstrap-age-custody.md and docs/security-bootstrap-king-credential-kit.md.
|
|
GUIDE
|
|
|
|
if [[ "$CONFIRM" == true ]]; then
|
|
printf '%s' 'After completing those steps, type STORED AND VERIFIED: ' >&2
|
|
IFS= read -r answer || exit 2
|
|
[[ "$answer" == 'STORED AND VERIFIED' ]] || { printf '%s\n' 'ERROR: custody acknowledgment not received.' >&2; exit 2; }
|
|
unset answer
|
|
printf '%s\n' 'Recovery handoff acknowledged by the operator; retain the independent drill receipt.'
|
|
fi
|