AIOS Governed Continuation
abe81d7f64
Ported from authority branch agent/g7-security-critical-closure-20260914 (d5f5c9b, base=beabd053).
S1 auth: role/user from server token->identity mapping, ignore client X-AIOS-* headers.
S2 bootstrap credential: PBKDF2 random-salt, fail-closed SECRET, no plaintext fallback, session HMAC+expiry.
S3 path containment + control-plane file-read hardening.
S4 admin UI XSS + real governed approval + dashboard CSRF/branch validation.
S5 runtime delivery: registry.yaml conflict, openapi securityScheme, install.sh fail propagation, do_POST shadowing.
Tests: 5 negative suites (66 tests). Evidence pack in deliverables/g7-evidence/.
13 lines
387 B
Bash
Executable File
13 lines
387 B
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
SILENT_INSTALL="$ROOT/scripts/silent_install.sh"
|
|
if [ ! -f "$SILENT_INSTALL" ]; then
|
|
echo "[V5] ERROR: missing required installer: $SILENT_INSTALL" >&2
|
|
exit 1
|
|
fi
|
|
bash "$SILENT_INSTALL"
|
|
echo "V5_SILENT_INSTALL_OK"
|
|
echo "WebOps: https://ops.cnnetmkt.top"
|
|
echo "Digital Life: https://ops.cnnetmkt.top/life"
|