#!/bin/sh
# Install backup-pair-writer. Silent: warden access rejects any child output.
set -eu
policy=/home/worsch/railiance-platform/openbao/policies/backup-pair-writer.hcl
receipt_dir=/home/worsch/.local/state/railiance/receipts
umask 077
mkdir -p "$receipt_dir"
bao policy write backup-pair-writer "$policy" >/dev/null 2>&1 || exit 31
bao policy read backup-pair-writer >"$receipt_dir/backup-pair-writer.policy" 2>/dev/null || exit 32
sha256sum "$receipt_dir/backup-pair-writer.policy" >"$receipt_dir/backup-pair-writer.sha256" || exit 33
exit 0