File size: 5,131 Bytes
ef6eb55 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 | #!/bin/bash
# Sovereign Node Identity Generator
#
# Creates a node IDENTITY REQUEST (not an authorized credential).
# This is PUBLIC — does not require authorization.
#
# The identity created here is:
# - UNREGISTERED (no provision yet)
# - UNAUTHRIZED (not provisioned by PAX-Coder authority)
#
# To become AUTHORIZED for protected execution, the node must:
# 1. Request provisioning from the authority
# 2. Receive a signed authorization capability
# 3. Pass the capability to protected operations
#
# This script creates the identity. It does NOT auto-authorize.
set -e
SOVEREIGN_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(dirname "$SOVEREIGN_DIR")")
NODE_ID="pax-coder-$(date +%s)"
CREATED_AT=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
GIT_COMMIT=$(cd "$REPO_ROOT" && git rev-parse HEAD)
echo "[*] Generating Sovereign Node Key for PAX-Coder"
echo " Node ID: $NODE_ID"
echo " Created: $CREATED_AT"
echo " Git Commit: $GIT_COMMIT"
# Step 1: Generate Ed25519 keypair (private key NOT committed)
echo "[*] Generating Ed25519 keypair..."
openssl genpkey -algorithm Ed25519 -out "$SOVEREIGN_DIR/.node_sk" 2>/dev/null
openssl pkey -in "$SOVEREIGN_DIR/.node_sk" -pubout -out "$SOVEREIGN_DIR/node_pk.pem" 2>/dev/null
# Extract public key in hex
PUB_KEY_HEX=$(openssl pkey -in "$SOVEREIGN_DIR/node_pk.pem" -pubin -outform DER -out /tmp/pk.der 2>/dev/null && xxd -p /tmp/pk.der | tr -d '\n' && rm /tmp/pk.der)
# Step 2: Create node.json manifest
echo "[*] Creating node identity manifest..."
cat > "$SOVEREIGN_DIR/node.json" <<EOF
{
"node_id": "$NODE_ID",
"algorithm": "Ed25519",
"public_key_hex": "$PUB_KEY_HEX",
"created_at_utc": "$CREATED_AT",
"repository": "SNAPKITTYWEST/pax-coder",
"git_commit": "$GIT_COMMIT",
"version": "1.0.0"
}
EOF
chmod 444 "$SOVEREIGN_DIR/node.json"
echo " ✓ $SOVEREIGN_DIR/node.json"
# Step 3: Generate repository manifest and commitment
echo "[*] Computing repository commitment..."
cd "$REPO_ROOT"
# Find tracked files, normalize, hash each
MANIFEST_FILE="$SOVEREIGN_DIR/manifest.json"
cat > "$MANIFEST_FILE" <<'MANIFEST_EOF'
{
"files": [
MANIFEST_EOF
git ls-tree -r HEAD | awk '{print $4}' | sort | while read file; do
if [ -f "$file" ]; then
FILE_HASH=$(sha256sum "$file" | cut -d' ' -f1)
echo " \"$file\": \"$FILE_HASH\"," >> "$MANIFEST_FILE"
fi
done
# Remove trailing comma and close JSON
sed -i '$ s/,$//' "$MANIFEST_FILE"
cat >> "$MANIFEST_FILE" <<'MANIFEST_EOF'
],
"generated_at_utc": "GENERATED_AT_PLACEHOLDER",
"git_commit": "GIT_COMMIT_PLACEHOLDER"
}
MANIFEST_EOF
# Replace placeholders
sed -i "s/GENERATED_AT_PLACEHOLDER/$CREATED_AT/g" "$MANIFEST_FILE"
sed -i "s/GIT_COMMIT_PLACEHOLDER/$GIT_COMMIT/g" "$MANIFEST_FILE"
# Compute manifest hash
REPO_COMMITMENT=$(sha256sum "$MANIFEST_FILE" | cut -d' ' -f1)
echo " Repository Commitment: $REPO_COMMITMENT"
# Step 4: Create prior-art timestamp record
echo "[*] Creating prior-art timestamp record..."
cat > "$SOVEREIGN_DIR/prior_art.json" <<EOF
{
"artifact": "PAX-Coder",
"repository": "SNAPKITTYWEST/pax-coder",
"git_commit": "$GIT_COMMIT",
"repository_sha256": "$REPO_COMMITMENT",
"node_id": "$NODE_ID",
"created_at_utc": "$CREATED_AT",
"timestamp_method": "local-generation",
"status": "UNCONFIRMED",
"node_public_key": "$PUB_KEY_HEX"
}
EOF
chmod 444 "$SOVEREIGN_DIR/prior_art.json"
echo " ✓ $SOVEREIGN_DIR/prior_art.json"
# Step 5: Create verification record
echo "[*] Creating cryptographic record..."
cat > "$SOVEREIGN_DIR/verification.json" <<EOF
{
"node_id": "$NODE_ID",
"algorithm": "Ed25519",
"repository_commitment_algorithm": "SHA-256",
"repository_commitment": "$REPO_COMMITMENT",
"git_commit": "$GIT_COMMIT",
"manifest_file": "manifest.json",
"prior_art_file": "prior_art.json",
"verification_timestamp": "$CREATED_AT"
}
EOF
chmod 444 "$SOVEREIGN_DIR/verification.json"
echo " ✓ $SOVEREIGN_DIR/verification.json"
# Step 6: Secure private key
echo "[*] Securing private key..."
chmod 400 "$SOVEREIGN_DIR/.node_sk"
echo " ⚠ PRIVATE KEY: $SOVEREIGN_DIR/.node_sk (permissions: 400)"
echo " ⚠ NEVER commit, share, or upload this file"
echo ""
echo "[✓] Sovereign Node Key generated successfully"
echo ""
echo "Files created:"
echo " Public:"
echo " - sovereign/node.json (public identity)"
echo " - sovereign/node_pk.pem (public key PEM)"
echo " - sovereign/manifest.json (repository fingerprint)"
echo " - sovereign/prior_art.json (prior-art timestamp)"
echo " - sovereign/verification.json (cryptographic record)"
echo ""
echo " Private (LOCAL ONLY, DO NOT COMMIT):"
echo " - sovereign/.node_sk (PRIVATE KEY - 400 perms)"
echo ""
echo "Next steps:"
echo " 1. Verify: ./sovereign/verify_node_key.sh"
echo " 2. Commit public files (sovereign/node.json, etc) - DO NOT COMMIT .node_sk"
echo " 3. Keep .node_sk secure"
echo " 4. For signing: set PAX_NODE_KEY=\$(cat sovereign/.node_sk | xxd -p | tr -d '\\n')"
|