tegwick
ebca4f5adb
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
29 lines
1 KiB
Python
29 lines
1 KiB
Python
"""Narrow installed CLI entry point; rendered by build_release_bundle.py."""
|
|
import hashlib
|
|
import os
|
|
from pathlib import Path
|
|
import sys
|
|
|
|
EXPECTED_HELPER_SHA256 = "@HELPER_SHA256@"
|
|
|
|
|
|
def main():
|
|
prefix = Path(__file__).resolve().parent.parent
|
|
helper = prefix / "libexec" / "secrets-engine-pdp-verify"
|
|
try:
|
|
if helper.is_symlink() or not helper.is_file():
|
|
raise ValueError("missing helper")
|
|
if hashlib.sha256(helper.read_bytes()).hexdigest() != EXPECTED_HELPER_SHA256:
|
|
raise ValueError("changed helper")
|
|
except (OSError, ValueError):
|
|
print("secrets-engine: installed verifier missing or changed", file=sys.stderr)
|
|
return 1
|
|
# The bundle always uses its reviewed helper; ambient overrides do not select
|
|
# another executable. The owner admits runtime trust separately.
|
|
os.environ["SECRETS_ENGINE_PDP_VERIFIER"] = str(helper)
|
|
from secrets_engine.cli import main as cli_main
|
|
return cli_main()
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|