40 lines
1.5 KiB
Bash
40 lines
1.5 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
OPERATION_PATH="${1:-}"
|
|
OPERATION_NAME="${2:-}"
|
|
REQUEST_FILE="${3:-}"
|
|
|
|
fail() {
|
|
echo "PROVENANCE_DENIED: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
[[ -n "$OPERATION_PATH" ]] || fail "usage: $0 <deployment|rollback|audit|code_change|runtime_execute|evidence_write> <operation> <request-json-file>"
|
|
[[ -n "$OPERATION_NAME" ]] || fail "operation name is required"
|
|
[[ -n "$REQUEST_FILE" && -f "$REQUEST_FILE" ]] || fail "request JSON file is required"
|
|
|
|
: "${AIOS_PROVENANCE_PUBLIC_KEY_FILE:?missing AIOS_PROVENANCE_PUBLIC_KEY_FILE}"
|
|
: "${AIOS_PROVENANCE_KEY_ID:?missing AIOS_PROVENANCE_KEY_ID}"
|
|
: "${AIOS_PROVENANCE_STORE_FILE:?missing AIOS_PROVENANCE_STORE_FILE}"
|
|
: "${AIOS_PROVENANCE_RECEIPT_DIR:?missing AIOS_PROVENANCE_RECEIPT_DIR}"
|
|
: "${AIOS_PROVENANCE_ID:?missing AIOS_PROVENANCE_ID}"
|
|
: "${AIOS_RUN_ID:?missing AIOS_RUN_ID}"
|
|
: "${AIOS_TENANT_ID:?missing AIOS_TENANT_ID}"
|
|
: "${AIOS_TASK_ID:?missing AIOS_TASK_ID}"
|
|
: "${AIOS_AGENT_ID:?missing AIOS_AGENT_ID}"
|
|
: "${AIOS_PRINCIPAL_ID:?missing AIOS_PRINCIPAL_ID}"
|
|
|
|
PYTHONPATH_VALUE="${AIOS_V2_PYTHONPATH:-/opt/aios/current/active-runtime/app}"
|
|
|
|
PYTHONPATH="$PYTHONPATH_VALUE${PYTHONPATH:+:$PYTHONPATH}" \
|
|
python3 -m aios_v2.provenance_cli authorize \
|
|
--context-from-env \
|
|
--store-file "$AIOS_PROVENANCE_STORE_FILE" \
|
|
--public-key-file "$AIOS_PROVENANCE_PUBLIC_KEY_FILE" \
|
|
--key-id "$AIOS_PROVENANCE_KEY_ID" \
|
|
--receipt-dir "$AIOS_PROVENANCE_RECEIPT_DIR" \
|
|
--path "$OPERATION_PATH" \
|
|
--operation "$OPERATION_NAME" \
|
|
--request-file "$REQUEST_FILE"
|