diff options
Diffstat (limited to 'scripts/continuum-signed')
| -rwxr-xr-x | scripts/continuum-signed | 30 |
1 files changed, 29 insertions, 1 deletions
diff --git a/scripts/continuum-signed b/scripts/continuum-signed index 1523094..21eb376 100755 --- a/scripts/continuum-signed +++ b/scripts/continuum-signed @@ -17,6 +17,9 @@ # continuum-signed key-add ID FILE adds (or replaces) key ID of the user's own, # the public key in FILE (.pub), signed # continuum-signed key-remove ID removes key ID of the user's own, signed +# continuum-signed strict turns the swarm strict through a remake: +# shows the values it keeps, signs the manifest +# once confirmed, proposes the remake # # PATH is the store's (`config/mode`), its segments without `/` or characters that need # escaping in a URL. Settings, from the environment: @@ -206,10 +209,34 @@ own_key() { write "_continuum/users/$user" "$entry" "$(jq -r '.signed // empty' "$work/own")" } +# Turns the swarm strict (docs/access.md, Turning a swarm strict): the manifest of the +# values held at signed places now, shown, signed once confirmed (with a key the nodes +# were given, --strict-keys), proposed as a strict remake at the heads it was made at. +strict() { + curl -sf -H "Authorization: Bearer $CONTINUUM_TOKEN" "$url/admin/strict-manifest" \ + >"$work/strict" || die "no manifest from $url (reading _continuum needed)" + echo "The values kept (any other at a signed place goes):" >&2 + jq -r '.values[] | " /\(.path | join("/")): \(.value | tojson)"' "$work/strict" >&2 + echo "The policy: $(jq -r '.manifest | fromjson | .policy | tojson' "$work/strict")" >&2 + printf 'Sign and propose? [y/N] ' >&2 + read -r answer </dev/tty + [ "$answer" = y ] || die "not proposed" + jq -j .manifest "$work/strict" >"$work/manifest" + sign "$work/manifest" continuum-strict + jq -n --rawfile line "$work/manifest" --rawfile signature "$work/manifest.sig" \ + --slurpfile strict "$work/strict" \ + '{kind: "strict", spec: {manifest: ($line + "\n" + $signature)}, + baseHeads: $strict[0].heads}' | + curl -sS --fail-with-body -X POST "$url/admin/remakes" \ + -H "Authorization: Bearer $CONTINUUM_TOKEN" \ + -H 'Content-Type: application/json' --data-binary @- + echo +} + command=${1:-} [ $# -gt 0 ] && shift case $command in - put | delete | get | verify | seal | open | key-add | key-remove) + put | delete | get | verify | seal | open | key-add | key-remove | strict) # One login for all the command's requests, unless given a token. CONTINUUM_TOKEN=${CONTINUUM_TOKEN:-$(login)} [ -n "$CONTINUUM_TOKEN" ] || die "couldn't log in as $user" @@ -225,5 +252,6 @@ case $command in open) [ $# -eq 1 ] || die "open PATH"; open_sealed "$1" ;; key-add) [ $# -eq 2 ] || die "key-add ID FILE"; own_key "$1" "$2" ;; key-remove) [ $# -eq 1 ] || die "key-remove ID"; own_key "$1" ;; + strict) [ $# -eq 0 ] || die "strict takes nothing"; strict ;; *) sed -n '2,/^$/s/^# \{0,1\}//p' "$0" >&2; exit 2 ;; esac |