Node / ReticulumProjects / MeshChatX.git / files / scripts / ci / verify-tree-rsm.sh

Displaying Raw • Download

T8b949e#!/bin/sh

T8b949e# Verify meshchatx.rsm signature and byte-level file hashes.

T8b949e#

T8b949e# By default mismatches print warnings and exit 0 so CI is not blocked when

T8b949e# the signed inventory lags dependency or license refreshes.

T8b949e# Set RNS_TREE_VERIFY_STRICT=1 to exit non-zero on failure.

T8b949e#

T8b949e# Env:

T8b949e# RNS_REQUIRED_SIGNER identity hash (default: e46112d44649266d71fe2193e00a4710)

T8b949e# RNS_RSM_PATH path to .rsm (default: meshchatx.rsm)

T8b949e# RNS_INVENTORY_OUT if set, write extracted inventory here (for end-of-job recheck)

T8b949e# RNS_TREE_VERIFY_STRICT if 1, fail the process on verify errors

T8b949e#

T8b949e# Usage:

T8b949e# sh scripts/ci/verify-tree-rsm.sh

Tffa657set -eu

Te6edf3ROOTTff7b72=Ta5d6ff"Tff7b72$(Te6edf3CDPATHTff7b72=Ta5d6ff'' Tffa657cd -- Ta5d6ff"Tff7b72$(dirname Ta5d6ff"Te6edf3$0Ta5d6ff"Tff7b72)Ta5d6ff/../..Ta5d6ff" Tff7b72&& Tffa657pwdTff7b72)Ta5d6ff"

Tffa657cd Ta5d6ff"Te6edf3$ROOTTa5d6ff"

Te6edf3SIGNERTff7b72=Ta5d6ff"Tffd700${Te6edf3RNS_REQUIRED_SIGNERTff7b72:-Te6edf3e46112d44649266d71fe2193e00a4710Tffd700}Ta5d6ff"

Te6edf3RSM_PATHTff7b72=Ta5d6ff"Tffd700${Te6edf3RNS_RSM_PATHTff7b72:-Te6edf3$ROOTTb4b4b4/meshchatx.rsmTffd700}Ta5d6ff"

Te6edf3HEADERTff7b72=Ta5d6ff"# meshchatx tree manifest v1"

Te6edf3STRICTTff7b72=Ta5d6ff"Tffd700${Te6edf3RNS_TREE_VERIFY_STRICTTff7b72:-Te6edf30Tffd700}Ta5d6ff"

warn_or_failTff7b72(Tff7b72) Tff7b72{

Te6edf3msgTff7b72=Ta5d6ff"Te6edf3$1Ta5d6ff"

Tff7b72if Tff7b72[ Ta5d6ff"Te6edf3$STRICTTa5d6ff" Tff7b72= Ta5d6ff"1" Tff7b72]Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"Ta5d6ffverify-tree-rsm.sh: Te6edf3$msgTa5d6ff" >Tb4b4b4&T79c0ff2

Tffa657exit T79c0ff1

Tff7b72fi

Tffa657echo Ta5d6ff"Ta5d6ffverify-tree-rsm.sh: WARNING: Te6edf3$msgTa5d6ff (non-blocking)Ta5d6ff" >Tb4b4b4&T79c0ff2

Tffa657exit T79c0ff0

Tff7b72}

run_rnidTff7b72(Tff7b72) Tff7b72{

Tff7b72if Tffa657command -v rnid >/dev/null T79c0ff2>Tb4b4b4&T79c0ff1Tb4b4b4; Tff7b72then

rnid Ta5d6ff"Te6edf3$@Ta5d6ff"

Tff7b72elif Tff7b72[ -x Ta5d6ff"Te6edf3$ROOTTa5d6ff/.venv/bin/rnidTa5d6ff" Tff7b72]Tb4b4b4; Tff7b72then

Ta5d6ff"Te6edf3$ROOTTa5d6ff/.venv/bin/rnidTa5d6ff" Ta5d6ff"Te6edf3$@Ta5d6ff"

Tff7b72elif Tffa657command -v uv >/dev/null T79c0ff2>Tb4b4b4&T79c0ff1Tb4b4b4; Tff7b72then

uv run rnid Ta5d6ff"Te6edf3$@Ta5d6ff"

Tff7b72else

Tffa657echo Ta5d6ff"verify-tree-rsm.sh: rnid not found (install rns or sync the venv)" >Tb4b4b4&T79c0ff2

Tff7b72return T79c0ff1

Tff7b72fi

Tff7b72}

Tff7b72if Tff7b72[ ! -f Ta5d6ff"Te6edf3$RSM_PATHTa5d6ff" Tff7b72]Tb4b4b4; Tff7b72then

warn_or_fail Ta5d6ff"Ta5d6ffmissing Te6edf3$RSM_PATHTa5d6ff"

Tff7b72fi

Te6edf3INVTff7b72=Ta5d6ff"Tff7b72$(mktemp Ta5d6ff"Tffd700${Te6edf3TMPDIRTff7b72:-Tb4b4b4/tmpTffd700}Ta5d6ff/tree-inv-verify.XXXXXXTa5d6ff"Tff7b72)Ta5d6ff"

Te6edf3RAWTff7b72=Ta5d6ff"Tff7b72$(mktemp Ta5d6ff"Tffd700${Te6edf3TMPDIRTff7b72:-Tb4b4b4/tmpTffd700}Ta5d6ff/tree-rsm-raw.XXXXXXTa5d6ff"Tff7b72)Ta5d6ff"

Tffa657trap Ta5d6ff'rm -f "$INV" "$RAW"' EXIT INT

Tff7b72if ! run_rnid -i Ta5d6ff"Te6edf3$SIGNERTa5d6ff" -V Ta5d6ff"Te6edf3$RSM_PATHTa5d6ff" >Ta5d6ff"Te6edf3$RAWTa5d6ff" T79c0ff2>/dev/nullTb4b4b4; Tff7b72then

warn_or_fail Ta5d6ff"RSM signature verification failed"

Tff7b72fi

T8b949e# Keep only the embedded inventory (starts at the manifest header line).

awk -v Te6edf3hTff7b72=Ta5d6ff"Te6edf3$HEADERTa5d6ff" Ta5d6ff'BEGIN{p=0} $0==h{p=1} p{print}' Ta5d6ff"Te6edf3$RAWTa5d6ff" >Ta5d6ff"Te6edf3$INVTa5d6ff"

Tff7b72if Tff7b72[ ! -s Ta5d6ff"Te6edf3$INVTa5d6ff" Tff7b72]Tb4b4b4; Tff7b72then

warn_or_fail Ta5d6ff"could not extract inventory from RSM"

Tff7b72fi

Tff7b72if Tff7b72[ -n Ta5d6ff"Tffd700${Te6edf3RNS_INVENTORY_OUTTff7b72:-Tffd700}Ta5d6ff" Tff7b72]Tb4b4b4; Tff7b72then

cp Ta5d6ff"Te6edf3$INVTa5d6ff" Ta5d6ff"Te6edf3$RNS_INVENTORY_OUTTa5d6ff"

Tff7b72fi

Tff7b72if ! sh Ta5d6ff"Te6edf3$ROOTTa5d6ff/scripts/ci/tree-manifest.shTa5d6ff" verify-tracked Ta5d6ff"Te6edf3$INVTa5d6ff"Tb4b4b4; Tff7b72then

warn_or_fail Ta5d6ff"tree inventory hash check failed"

Tff7b72fi

Tffa657echo Ta5d6ff"Ta5d6ffverify-tree-rsm.sh: OK (signer Te6edf3$SIGNERTa5d6ff)Ta5d6ff"