tegwick
4f65e41ac5
Some checks failed
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
43 lines
2.4 KiB
Bash
43 lines
2.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Candidate owner launcher. Review and native fixture proof required before use.
|
|
set +x
|
|
set -euo pipefail
|
|
ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
cd -- "$ROOT"
|
|
umask 077
|
|
[[ $# == 6 ]] || { printf '%s\n' 'Usage: run-isolated-keycape.sh VERIFIED_TRANSFER_RECEIPT ADMISSION ADMISSION_SHA256 TLS_CERT TLS_KEY TRUST'; exit 1; }
|
|
[[ "$3" =~ ^[a-f0-9]{64}$ ]] || { printf '%s\n' 'ERROR: exact reviewed admission digest required.'; exit 1; }
|
|
for index in 1 2 4 5 6; do
|
|
[[ -f "${!index}" && ! -L "${!index}" ]] || { printf '%s\n' 'ERROR: provide regular owner-controlled input files.'; exit 1; }
|
|
done
|
|
[[ -t 0 && -t 1 && -t 2 ]] || { printf '%s\n' 'ERROR: run in your own interactive terminal.'; exit 1; }
|
|
for tool in python3 age age-keygen docker; do
|
|
command -v "$tool" >/dev/null || { printf 'ERROR: required tool unavailable: %s\n' "$tool"; exit 1; }
|
|
done
|
|
python3 tools/bootstrap-recovery/prepare-isolated-keycape.py \
|
|
--transfer-receipt "$1" --admission "$2" --admission-sha256 "$3" \
|
|
--tls-cert "$4" --tls-key "$5" --trust "$6"
|
|
python3 - <<'PY'
|
|
import importlib.util
|
|
from pathlib import Path
|
|
p=Path('tools/bootstrap-recovery/isolated-keycape-session.py')
|
|
spec=importlib.util.spec_from_file_location('session',p)
|
|
m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
|
|
try:
|
|
m.local.preflight()
|
|
m.run(['docker','image','inspect',m.adapter.IMAGE])
|
|
except Exception:
|
|
raise SystemExit('ERROR: exact local Docker/images/tmpfs preflight failed; no key requested.')
|
|
print('OK: fixed local target and cached pinned images available.')
|
|
PY
|
|
NK49_KC_RUN="$(mktemp -d /tmp/nk49-isolated-keycape-XXXXXXXX)"
|
|
printf 'Safe evidence directory: %s\n' "$NK49_KC_RUN"
|
|
printf '%s\n' 'Isolated original issuer/trust and selected registered service-client checks only.'
|
|
printf '%s\n' 'No browser, downstream consumer or retained-factor MFA acceptance is claimed.'
|
|
printf '%s\n' 'Enter only the independently held backup age key at the hidden prompt.'
|
|
bash sso-mfa/bootstrap/sops-custody-unlock.sh \
|
|
--expected-recipient age1zvryunvjhvpkmasskauga2heeg0ztnte9ymgppvjge36ekumk50syr3tsz \
|
|
--sealed-fd --prompt -- python3 tools/bootstrap-recovery/isolated-keycape-session.py \
|
|
--transfer-receipt "$1" --admission "$2" --admission-sha256 "$3" \
|
|
--tls-cert "$4" --tls-key "$5" --trust "$6" --receipt "$NK49_KC_RUN/recovery.json"
|
|
printf 'Safe receipt: %s/recovery.json\n' "$NK49_KC_RUN"
|