tegwick
502f8208e4
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1abf1-7e95-7141-87c9-ee78332bf790
59 lines
2.2 KiB
Python
59 lines
2.2 KiB
Python
#!/usr/bin/env python3
|
|
"""Run the pinned read-only inventory through the founder's existing SSH login.
|
|
|
|
Run from the workstation checkout in the founder's own interactive terminal.
|
|
Default only reviews the transport. --run connects to railiance01 explicitly;
|
|
SSH and sudo authenticate in that terminal. No administrative credential leaves
|
|
the node. The public source travels as a quoted argument, preserving stdin for
|
|
the sudo prompt and avoiding a remote checkout requirement.
|
|
"""
|
|
|
|
import argparse
|
|
import hashlib
|
|
import json
|
|
import shlex
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
SOURCE_SHA256 = "b610059b5d7398138062de51edab3555b973cfbb61f02fa684184852805d7507"
|
|
SOURCE = Path(__file__).with_name("vergabe_pilot_inventory.py")
|
|
|
|
|
|
def remote_command(source):
|
|
if hashlib.sha256(source.encode()).hexdigest() != SOURCE_SHA256:
|
|
raise ValueError("inventory_source_pin_mismatch")
|
|
operation = [
|
|
"sudo", "/usr/bin/env", "KUBECONFIG=/etc/rancher/k3s/k3s.yaml",
|
|
"/usr/bin/python3", "-c", source,
|
|
]
|
|
return ["ssh", "-t", "railiance01", shlex.join(operation)]
|
|
|
|
|
|
def main(argv=None):
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("--run", action="store_true")
|
|
args = parser.parse_args(argv)
|
|
command = remote_command(SOURCE.read_text())
|
|
if not args.run:
|
|
print(json.dumps({"status": "prepared", "ssh_target": "railiance01",
|
|
"inventory_source_sha256": SOURCE_SHA256,
|
|
"runtime_mutations": False}))
|
|
return 0
|
|
if not sys.stdin.isatty():
|
|
raise ValueError("founder_interactive_terminal_required")
|
|
return subprocess.run(command, check=False).returncode
|
|
|
|
|
|
if __name__ == "__main__":
|
|
try:
|
|
raise SystemExit(main())
|
|
except ValueError as error:
|
|
reason = str(error)
|
|
if reason not in {"inventory_source_pin_mismatch", "founder_interactive_terminal_required"}:
|
|
reason = "invalid_transport_input"
|
|
print(json.dumps({"status": "launcher_failed", "failure": reason}))
|
|
raise SystemExit(1)
|
|
except OSError:
|
|
print(json.dumps({"status": "launcher_failed", "failure": "source_or_ssh_unavailable"}))
|
|
raise SystemExit(1)
|