tegwick
6450e1cf02
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
28 lines
1.4 KiB
Bash
28 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Bootstrap handoff to the identity owner's isolated archive verifier.
|
|
set -euo pipefail
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
if [[ $# == 0 || "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
|
|
cat <<'EOF'
|
|
Usage: bin/railiance identity-recovery --transfer-receipt PATH --receipt NEW_PATH
|
|
|
|
Run through net-kingdom/sso-mfa/bootstrap/sops-custody-unlock.sh --prompt
|
|
with the independently held railiance-backup age key. Requires an independently
|
|
retrieved ciphertext and its safe transfer receipt, age, Docker and the pinned
|
|
PostgreSQL image. Default owner checkout: sibling net-kingdom; set
|
|
NETKINGDOM_RECOVERY_ROOT to an explicitly reviewed alternative checkout.
|
|
|
|
This decrypts only into disposable local storage and verifies the full manifest,
|
|
SQLite/key pairs and native PostgreSQL restore. It does not restore production,
|
|
contact SSO or prove full identity authentication/audit continuity.
|
|
See docs/identity-recovery.md for the bootstrap ordering and custody handoff.
|
|
EOF
|
|
exit 0
|
|
fi
|
|
OWNER="${NETKINGDOM_RECOVERY_ROOT:-${ROOT}/../net-kingdom}"
|
|
CHECKER="${OWNER}/tools/bootstrap-recovery/verify-identity.py"
|
|
if [[ ! -f "$CHECKER" || ! -f "${OWNER}/tools/bootstrap-recovery/identity-backup-profile.json" ]]; then
|
|
echo 'Missing reviewed NetKingdom recovery checkout; see docs/identity-recovery.md.' >&2
|
|
exit 1
|
|
fi
|
|
exec python3 "$CHECKER" "$@"
|