39 lines
1.8 KiB
Python
39 lines
1.8 KiB
Python
|
#!/usr/bin/env python3
|
||
|
|
"""Silent attended decryption of the hash-verified primary archive download."""
|
||
|
|
import argparse
|
||
|
|
import hashlib
|
||
|
|
import json
|
||
|
|
import os
|
||
|
|
from pathlib import Path
|
||
|
|
import subprocess
|
||
|
|
from state_hub_preflight_lane import bao, data
|
||
|
|
|
||
|
|
|
||
|
|
def digest(path):
|
||
|
|
with path.open('rb') as source: return hashlib.file_digest(source,'sha256').hexdigest()
|
||
|
|
|
||
|
|
|
||
|
|
def main():
|
||
|
|
p=argparse.ArgumentParser(description=__doc__)
|
||
|
|
for name in ['source','output','transfer-receipt','receipt']: p.add_argument('--'+name,required=True,type=Path)
|
||
|
|
a=p.parse_args();receipt={'schema':'platform.forgejo-primary-decryption.v1','status':'failed'}
|
||
|
|
fd=os.open(a.receipt,os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600)
|
||
|
|
try:
|
||
|
|
transfer=json.loads(a.transfer_receipt.read_text())
|
||
|
|
if (transfer.get('status')!='primary_fetched_pending_application_restore'
|
||
|
|
or not transfer.get('download_hash_matches')
|
||
|
|
or digest(a.source)!=transfer.get('ciphertext_sha256')):
|
||
|
|
raise ValueError('verified_primary_download_required')
|
||
|
|
value=data(bao(['read','-format=json','platform/data/workloads/railiance/backup/offsite-lane']))['data']['data']['AGE_PRIVATE_KEY']
|
||
|
|
with a.output.open('xb') as target:
|
||
|
|
a.output.chmod(0o600)
|
||
|
|
result=subprocess.run(['age','-d','-i','/dev/stdin',str(a.source)],input=(value.strip()+'\n').encode(),stdout=target,stderr=subprocess.PIPE,timeout=1200)
|
||
|
|
if result.returncode: raise ValueError('primary_decryption_failed')
|
||
|
|
receipt.update(transfer,decrypted=True,plaintext_sha256=digest(a.output))
|
||
|
|
except Exception:
|
||
|
|
receipt['error']='bounded_primary_decryption_failed'
|
||
|
|
finally:
|
||
|
|
with os.fdopen(fd,'w') as output: json.dump(receipt,output,indent=2)
|
||
|
|
return int(receipt['status']=='failed')
|
||
|
|
if __name__=='__main__': raise SystemExit(main())
|