30 lines
1 KiB
Python
30 lines
1 KiB
Python
|
"""Narrow installed CLI entry point; rendered by build_release_bundle.py."""
|
||
|
|
import hashlib
|
||
|
|
import os
|
||
|
|
from pathlib import Path
|
||
|
|
import sys
|
||
|
|
|
||
|
|
EXPECTED_HELPER_SHA256 = "@HELPER_SHA256@"
|
||
|
|
|
||
|
|
|
||
|
|
def main():
|
||
|
|
prefix = Path(__file__).resolve().parent.parent
|
||
|
|
helper = prefix / "libexec" / "secrets-engine-pdp-verify"
|
||
|
|
try:
|
||
|
|
if helper.is_symlink() or not helper.is_file():
|
||
|
|
raise ValueError("missing helper")
|
||
|
|
if hashlib.sha256(helper.read_bytes()).hexdigest() != EXPECTED_HELPER_SHA256:
|
||
|
|
raise ValueError("changed helper")
|
||
|
|
except (OSError, ValueError):
|
||
|
|
print("secrets-engine: installed verifier missing or changed", file=sys.stderr)
|
||
|
|
return 1
|
||
|
|
# The bundle always uses its reviewed helper; ambient overrides do not select
|
||
|
|
# another executable. The owner admits runtime trust separately.
|
||
|
|
os.environ["SECRETS_ENGINE_PDP_VERIFIER"] = str(helper)
|
||
|
|
from secrets_engine.cli import main as cli_main
|
||
|
|
return cli_main()
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
raise SystemExit(main())
|