AIOS Governed Continuation
abe81d7f64
Ported from authority branch agent/g7-security-critical-closure-20260914 (d5f5c9b, base=beabd053).
S1 auth: role/user from server token->identity mapping, ignore client X-AIOS-* headers.
S2 bootstrap credential: PBKDF2 random-salt, fail-closed SECRET, no plaintext fallback, session HMAC+expiry.
S3 path containment + control-plane file-read hardening.
S4 admin UI XSS + real governed approval + dashboard CSRF/branch validation.
S5 runtime delivery: registry.yaml conflict, openapi securityScheme, install.sh fail propagation, do_POST shadowing.
Tests: 5 negative suites (66 tests). Evidence pack in deliverables/g7-evidence/.
20 lines
1.0 KiB
Bash
20 lines
1.0 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PKG_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
: "${AIOS_RUNTIME_ROOT:=$(pwd)}"
|
|
: "${AIOS_RELEASE_ID:=webops-full-refresh-$(date +%Y%m%dT%H%M%S)}"
|
|
export AIOS_RUNTIME_ROOT AIOS_RELEASE_ID
|
|
bash "$PKG_ROOT/scripts/backup_before_fix.sh"
|
|
python3 "$PKG_ROOT/fixes/patch_runtime_owner_admin_user.py" "$AIOS_RUNTIME_ROOT"
|
|
bash "$PKG_ROOT/scripts/install_webops_overlay.sh" "$AIOS_RUNTIME_ROOT"
|
|
python3 "$PKG_ROOT/scripts/apply_migrations.py" "$AIOS_RUNTIME_ROOT"
|
|
python3 "$PKG_ROOT/scripts/validate_roles_and_domains.py" "$AIOS_RUNTIME_ROOT"
|
|
python3 "$PKG_ROOT/scripts/validate_no_legacy_roles.py" "$AIOS_RUNTIME_ROOT" || true
|
|
bash "$PKG_ROOT/scripts/smoke_test.sh" "$AIOS_RUNTIME_ROOT"
|
|
python3 "$PKG_ROOT/scripts/generate_release_manifest.py" "$AIOS_RUNTIME_ROOT"
|
|
echo "DELTA_FIX_ONLY_APPLY_OK release=$AIOS_RELEASE_ID runtime=$AIOS_RUNTIME_ROOT"
|
|
|
|
python3 "$PKG_ROOT/fixes/patch_runtime_v5_guards.py" "$AIOS_RUNTIME_ROOT"
|
|
echo "V5_DIGITAL_LIFE_DELTA_APPLIED"
|