| |
| """Release gate for the pinned entitlement keys (spec account-gated 2.4, 7.1 step 10). |
| |
| Fails (exit 1) while any kid in sibyl_memory_client._entitlement_keys.TRUSTED_KEYS |
| is a PLACEHOLDER, while a pinned key is malformed (not 32 bytes, kid does not |
| match sha256(raw)[:16]), or, when --expect-kids is given, while the pinned kid |
| set differs from the kids the operator read from production |
| /api/plugin/health `entitlement_public_keys`. No network: the expected kids |
| are an argument. |
| |
| python scripts/check_release_keys.py --expect-kids 3f9a1c2b7e4d6a80 |
| python scripts/check_release_keys.py --src path/to/src # check a tree, not the install |
| """ |
| from __future__ import annotations |
|
|
| import argparse |
| import hashlib |
| import importlib.util |
| import sys |
| from pathlib import Path |
|
|
|
|
| def _load_keys_module(src: str | None): |
| if src: |
| path = Path(src) / "sibyl_memory_client" / "_entitlement_keys.py" |
| spec = importlib.util.spec_from_file_location("_pinned_keys_under_check", path) |
| mod = importlib.util.module_from_spec(spec) |
| assert spec and spec.loader |
| spec.loader.exec_module(mod) |
| return mod |
| from sibyl_memory_client import _entitlement_keys |
| return _entitlement_keys |
|
|
|
|
| def check(src: str | None, expect: set[str] | None) -> list[str]: |
| mod = _load_keys_module(src) |
| keys = dict(mod.TRUSTED_KEYS) |
| placeholders = set(getattr(mod, "PLACEHOLDER_KIDS", frozenset())) |
| problems: list[str] = [] |
| if not keys: |
| problems.append("TRUSTED_KEYS is empty") |
| if not 1 <= len(keys) <= 2: |
| problems.append(f"TRUSTED_KEYS holds {len(keys)} keys (expected 1, or 2 during a rotation)") |
| for kid, raw in keys.items(): |
| if kid in placeholders: |
| problems.append(f"kid {kid} is a PLACEHOLDER key; replace it with the production public key") |
| if not isinstance(raw, (bytes, bytearray)) or len(raw) != 32: |
| problems.append(f"kid {kid}: public key is not 32 raw bytes") |
| elif hashlib.sha256(bytes(raw)).hexdigest()[:16] != kid: |
| problems.append(f"kid {kid}: does not equal sha256(raw public key)[:16]") |
| if expect is not None and set(keys) != expect: |
| problems.append(f"pinned kids {sorted(keys)} != production kids {sorted(expect)}") |
| return problems |
|
|
|
|
| def main(argv: list[str] | None = None) -> int: |
| ap = argparse.ArgumentParser(description=__doc__.splitlines()[0]) |
| ap.add_argument("--expect-kids", default=None, |
| help="comma-separated kids from production /api/plugin/health") |
| ap.add_argument("--src", default=None, help="check this source tree instead of the installed package") |
| args = ap.parse_args(argv) |
| expect = None |
| if args.expect_kids is not None: |
| expect = {k.strip() for k in args.expect_kids.split(",") if k.strip()} |
| problems = check(args.src, expect) |
| if problems: |
| for p in problems: |
| print(f"RELEASE BLOCKED: {p}") |
| return 1 |
| print("pinned entitlement keys OK") |
| return 0 |
|
|
|
|
| if __name__ == "__main__": |
| sys.exit(main()) |
|
|
