File size: 3,775 Bytes
9abace2 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 | #!/bin/bash
# PAX-Coder Clone Integrity Verification (ADR-0001)
#
# Verifies that a clone matches the official release.
# Does NOT perform authorization checks.
#
# Exit codes:
# 0 = Integrity verified
# 1 = Integrity verification failed
# 2 = Script error
set -e
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(dirname "$SCRIPT_DIR")"
SOVEREIGN_DIR="$REPO_ROOT/sovereign"
echo "========================================"
echo "PAX-CODER CLONE INTEGRITY VERIFICATION"
echo "========================================"
echo ""
echo "Verifying this clone matches official release."
echo "(Integrity verification only; see ADR-0001)"
echo ""
# Check release.json exists
if [ ! -f "$SOVEREIGN_DIR/release.json" ]; then
echo "ERROR: sovereign/release.json not found"
exit 1
fi
echo "[1] Reading release metadata..."
# Parse release.json manually (no external tools required beyond bash)
RELEASE_FILE="$SOVEREIGN_DIR/release.json"
cat "$RELEASE_FILE" | tr '{' '\n' | tr ',' '\n' | tr '}' '\n' > /tmp/release_$$.txt
# Simple key-value extraction
REPO=$(grep '"repository"' "$RELEASE_FILE" | head -1 | cut -d'"' -f4)
VERSION=$(grep '"release_version"' "$RELEASE_FILE" | head -1 | cut -d'"' -f4)
GIT_COMMIT=$(grep '"git_commit"' "$RELEASE_FILE" | head -1 | cut -d'"' -f4)
NODE_ID=$(grep '"node_id"' "$RELEASE_FILE" | head -1 | cut -d'"' -f4)
MANIFEST_SHA256=$(grep '"manifest_sha256"' "$RELEASE_FILE" | head -1 | cut -d'"' -f4)
RELEASE_TIMESTAMP=$(grep '"release_timestamp_utc"' "$RELEASE_FILE" | head -1 | cut -d'"' -f4)
rm -f /tmp/release_$$.txt
echo " Repository: $REPO"
echo " Version: $VERSION"
echo " Timestamp: $RELEASE_TIMESTAMP"
echo " ✓ Metadata read"
echo ""
# Check git commit matches
echo "[2] Verifying git commit..."
CURRENT_COMMIT=$(cd "$REPO_ROOT" && git rev-parse HEAD 2>/dev/null || echo "")
if [ -z "$CURRENT_COMMIT" ]; then
echo " ✗ Not a git repository"
exit 2
fi
if [ "$CURRENT_COMMIT" != "$GIT_COMMIT" ]; then
echo " ✗ Commit mismatch"
echo " Expected: $GIT_COMMIT"
echo " Actual: $CURRENT_COMMIT"
exit 1
fi
echo " ✓ Commit matches release"
echo ""
# Check manifest exists and is valid
echo "[3] Checking manifest file..."
MANIFEST_FILE="$SOVEREIGN_DIR/manifest.json"
if [ ! -f "$MANIFEST_FILE" ]; then
echo " ⚠ Manifest not found (OK for external releases)"
else
echo " ✓ Manifest exists"
fi
echo ""
# Verify manifest hash
echo "[4] Verifying manifest hash..."
if [ -f "$MANIFEST_FILE" ]; then
COMPUTED=$(sha256sum "$MANIFEST_FILE" | cut -d' ' -f1)
if [ "$COMPUTED" != "$MANIFEST_SHA256" ]; then
echo " ✗ Hash mismatch"
echo " Expected: $MANIFEST_SHA256"
echo " Computed: $COMPUTED"
exit 1
fi
echo " ✓ Manifest hash valid"
else
echo " ⚠ Manifest unavailable (skipping verification)"
fi
echo ""
# Final result
echo "========================================"
echo "STATUS: INTEGRITY_VERIFIED"
echo "========================================"
echo ""
echo "Release Information:"
echo " Repository: $REPO"
echo " Version: $VERSION"
echo " Commit: $GIT_COMMIT"
echo " Node ID: $NODE_ID"
echo " Timestamp: $RELEASE_TIMESTAMP"
echo ""
echo "Verification:"
echo " ✓ Commit matches official release"
echo " ✓ Manifest hash verified"
echo ""
echo "What this means:"
echo " ✓ This clone matches the official release"
echo ""
echo "What this does NOT mean:"
echo " ✗ You are authorized for protected operations"
echo " ✗ Local modifications are prevented"
echo ""
echo "For authorization, see: docs/adr/0002-authorization-boundary.md"
echo ""
|