50 lines
2.3 KiB
Python
50 lines
2.3 KiB
Python
|
#!/usr/bin/env python3
|
||
|
|
"""Silent attended child: protected PAT injection, then a value-free receipt."""
|
||
|
|
import argparse
|
||
|
|
import hashlib
|
||
|
|
import json
|
||
|
|
from pathlib import Path
|
||
|
|
import subprocess
|
||
|
|
import sys
|
||
|
|
|
||
|
|
HERE = Path(__file__).resolve().parent
|
||
|
|
|
||
|
|
|
||
|
|
def main():
|
||
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
||
|
|
parser.add_argument('--proposal', type=Path, required=True)
|
||
|
|
parser.add_argument('--receipt', type=Path, required=True)
|
||
|
|
parser.add_argument('--cleanup-only', action='store_true')
|
||
|
|
args = parser.parse_args()
|
||
|
|
proposal_path, receipt = args.proposal.resolve(), args.receipt.resolve()
|
||
|
|
transport = receipt.with_suffix('.cleanup-transport.json' if args.cleanup_only else '.transport.json')
|
||
|
|
if transport.exists() or (receipt.exists() and not args.cleanup_only):
|
||
|
|
return 2
|
||
|
|
try:
|
||
|
|
proposal = json.loads(proposal_path.read_text())
|
||
|
|
for name, digest in proposal['source_sha256'].items():
|
||
|
|
if Path(name).name != name or hashlib.sha256((HERE / name).read_bytes()).hexdigest() != digest:
|
||
|
|
return 2
|
||
|
|
if not {'run_forge_routes.py', 'accept_forge_routes.py'} <= set(proposal['source_sha256']):
|
||
|
|
return 2
|
||
|
|
child = [sys.executable, str(HERE / 'accept_forge_routes.py'), '--proposal', str(proposal_path),
|
||
|
|
'--receipt', str(receipt), '--name', proposal['repository_name']]
|
||
|
|
if args.cleanup_only:
|
||
|
|
child.append('--cleanup-only')
|
||
|
|
# Capture/discard both streams, including warden proxy notices. The
|
||
|
|
# containing login lane requires silence and handles session revocation.
|
||
|
|
result = subprocess.run(['warden', 'access', 'forgejo-admin-api-token', '--field', 'API_TOKEN',
|
||
|
|
'--exec', '--', *child], capture_output=True)
|
||
|
|
transport.write_text(json.dumps({'route_exit_code': result.returncode,
|
||
|
|
'receipt_present': receipt.exists(), 'cleanup_only': args.cleanup_only,
|
||
|
|
'proposal_sha256': hashlib.sha256(proposal_path.read_bytes()).hexdigest(),
|
||
|
|
'raw_diagnostics_retained': False, 'credential_returned_to_agent': False}, indent=2) + '\n')
|
||
|
|
return result.returncode
|
||
|
|
except Exception:
|
||
|
|
transport.write_text(json.dumps({'result': 'handoff-unverified', 'raw_diagnostics_retained': False}) + '\n')
|
||
|
|
return 1
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == '__main__':
|
||
|
|
raise SystemExit(main())
|