AG
cb5e5dacef
- package: manifest v1.0 (schema, package_id, layers: odoo_modules/agents/docs/config/brain) - agents: 4 neutral cards + prompts (sellers-recruiter, test-operator, closer, compliance) no script.run in v0.1.0; odoo.* + file.* primitives only - modules: aura_business_core + hitridge_venture_o1 stubs (menus, ACLs, models) - docs: playbook, test-checklist, price-guide-starter, agreement-template.odt - config: channels (olx-bg/forums-local), pricing-rules (BGN, A/B/C/reject, drop ladder) - brain: empty-seed capability contract + seeds README (memories never ship) - toolchain: depo-sign.sh (ed25519, PEM+raw), validate-depo.sh (schema/files/cards/tools/ secrets/sig gates -> writes VALIDATE), tool-registry.json - install.sh: target-side verify (hash + ed25519 + layer files); install is phase 2 - public-keys/depo-signing.pub committed (private key stays out of repo) - VALIDATE: PASS (signed + verified, tamper-rejection tested)
55 lines
2.0 KiB
Bash
Executable File
55 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# depo-sign.sh — sign a package manifest with an ed25519 key (per manifest-spec v1.0).
|
|
# Writes, next to the manifest:
|
|
# <manifest>.sha256 — hex hash of manifest.json
|
|
# <manifest>.sig — base64 ed25519 signature over the manifest bytes
|
|
#
|
|
# Usage:
|
|
# depo-sign.sh <package_dir> [--key <path>] [--out <dir>]
|
|
# --key ed25519 private key (PEM). Default: $DEPO_SIGNING_KEY
|
|
# --out where artifacts land. Default: package dir (side-by-side with manifest)
|
|
set -euo pipefail
|
|
|
|
usage() { echo "usage: $0 <package_dir> [--key <path>] [--out <dir>]"; exit 1; }
|
|
|
|
PKG_DIR="${1:?missing package dir}"; shift
|
|
KEY="${DEPO_SIGNING_KEY:-}"
|
|
OUT=""
|
|
while [ $# -gt 0 ]; do
|
|
case "$1" in
|
|
--key) KEY="${2:?}"; shift 2 ;;
|
|
--out) OUT="${2:?}"; shift 2 ;;
|
|
*) usage ;;
|
|
esac
|
|
done
|
|
|
|
MANIFEST="$PKG_DIR/manifest.json"
|
|
[ -f "$MANIFEST" ] || { echo "depo-sign: no manifest.json in $PKG_DIR" >&2; exit 1; }
|
|
[ -n "$KEY" ] && [ -f "$KEY" ] || { echo "depo-sign: no ed25519 key (set --key or DEPO_SIGNING_KEY)" >&2; exit 1; }
|
|
OUT="${OUT:-$PKG_DIR}"
|
|
mkdir -p "$OUT"
|
|
|
|
SHA="$(sha256sum "$MANIFEST" | cut -d' ' -f1)"
|
|
printf '%s\n' "$SHA" > "$OUT/manifest.json.sha256"
|
|
|
|
python3 - "$KEY" "$MANIFEST" "$OUT/manifest.json.sig" <<'PY'
|
|
import base64, sys
|
|
from cryptography.hazmat.primitives import serialization
|
|
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
|
|
key_path, manifest_path, out_path = sys.argv[1], sys.argv[2], sys.argv[3]
|
|
data = open(key_path, "rb").read()
|
|
try:
|
|
key = serialization.load_pem_private_key(data, password=None)
|
|
except ValueError:
|
|
key = Ed25519PrivateKey.from_private_bytes(data) # raw 32-byte fallback
|
|
if not isinstance(key, Ed25519PrivateKey):
|
|
raise SystemExit("depo-sign: key is not an ed25519 key")
|
|
manifest = open(manifest_path, "rb").read()
|
|
sig = key.sign(manifest)
|
|
open(out_path, "wb").write(base64.b64encode(sig))
|
|
PY
|
|
|
|
echo "depo-sign: signed $MANIFEST"
|
|
echo " sha256 $OUT/manifest.json.sha256"
|
|
echo " sig $OUT/manifest.json.sig"
|