AG
cb5e5dacef
- package: manifest v1.0 (schema, package_id, layers: odoo_modules/agents/docs/config/brain) - agents: 4 neutral cards + prompts (sellers-recruiter, test-operator, closer, compliance) no script.run in v0.1.0; odoo.* + file.* primitives only - modules: aura_business_core + hitridge_venture_o1 stubs (menus, ACLs, models) - docs: playbook, test-checklist, price-guide-starter, agreement-template.odt - config: channels (olx-bg/forums-local), pricing-rules (BGN, A/B/C/reject, drop ladder) - brain: empty-seed capability contract + seeds README (memories never ship) - toolchain: depo-sign.sh (ed25519, PEM+raw), validate-depo.sh (schema/files/cards/tools/ secrets/sig gates -> writes VALIDATE), tool-registry.json - install.sh: target-side verify (hash + ed25519 + layer files); install is phase 2 - public-keys/depo-signing.pub committed (private key stays out of repo) - VALIDATE: PASS (signed + verified, tamper-rejection tested)
77 lines
2.7 KiB
Bash
Executable File
77 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# O1 target-side verifier + installer (pull model, per manifest-spec v1.0).
|
|
# Runs ON THE TARGET. Nothing is deployed unless signature + verify pass.
|
|
#
|
|
# Usage:
|
|
# install.sh --check # verify signature + hash + package integrity only
|
|
# install.sh --install # full install (phase 2: enabled on Aura tower)
|
|
set -euo pipefail
|
|
|
|
PKG_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
MANIFEST="$PKG_ROOT/manifest.json"
|
|
PUBKEY="${DEPO_PUBKEY:-/etc/depo/depo-signing.pub}"
|
|
|
|
say() { printf '\033[1;32m[install]\033[0m %s\n' "$*"; }
|
|
die() { printf '\033[1;31m[install FAIL]\033[0m %s\n' "$*" >&2; exit 1; }
|
|
|
|
[ -f "$MANIFEST" ] || die "manifest.json missing at $PKG_ROOT"
|
|
|
|
verify_signature() {
|
|
[ -f "$PUBKEY" ] || die "signing pubkey not found at $PUBKEY (set DEPO_PUBKEY)"
|
|
[ -f "$MANIFEST.sig" ] || die "no signature (.sig) — refusal per spec: No signature = refuse"
|
|
[ -f "$MANIFEST.sha256" ] || die "no manifest.sha256 — refusal per spec"
|
|
local got want
|
|
got="$(sha256sum "$MANIFEST" | cut -d' ' -f1)"
|
|
want="$(cat "$MANIFEST.sha256")"
|
|
[ "$got" = "$want" ] || die "hash mismatch: manifest was modified after signing"
|
|
python3 - "$PUBKEY" "$MANIFEST.sig" "$MANIFEST" <<'PY' || die "ed25519 signature verification failed"
|
|
import base64, hashlib, sys
|
|
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
|
|
pub_path, sig_path, manifest_path = sys.argv[1], sys.argv[2], sys.argv[3]
|
|
pub = Ed25519PublicKey.from_public_bytes(open(pub_path, "rb").read())
|
|
sig = base64.b64decode(open(sig_path, "rb").read())
|
|
data = open(manifest_path, "rb").read()
|
|
pub.verify(sig, data)
|
|
print("ed25519 OK")
|
|
PY
|
|
say "signature verified"
|
|
}
|
|
|
|
run_verify() {
|
|
verify_signature
|
|
python3 - "$MANIFEST" <<'PY' || die "install.verify checklist failed"
|
|
import json, os, sys
|
|
m = json.load(open(sys.argv[1]))
|
|
root = os.path.dirname(os.path.abspath(sys.argv[1]))
|
|
missing = []
|
|
for layer, files in m["layers"].items():
|
|
for f in files:
|
|
if layer == "odoo_modules":
|
|
p = os.path.join(root, "modules", f, "__manifest__.py")
|
|
elif layer == "agents":
|
|
p = os.path.join(root, "agents", f + ".json")
|
|
else:
|
|
p = os.path.join(root, f)
|
|
if not os.path.exists(p):
|
|
missing.append(f)
|
|
if missing:
|
|
print("MISSING LAYER FILES:", missing)
|
|
sys.exit(1)
|
|
print("all layer files present:", sum(len(v) for v in m["layers"].values()))
|
|
PY
|
|
say "verify checklist passed"
|
|
}
|
|
|
|
case "${1:---check}" in
|
|
--check)
|
|
run_verify
|
|
;;
|
|
--install)
|
|
run_verify
|
|
die "install is phase 2 (target: Aura tower Odoo). Nothing was deployed."
|
|
;;
|
|
*)
|
|
die "usage: $0 [--check|--install]"
|
|
;;
|
|
esac
|