Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases 1 Activity

source: advance the checked projection

Browse source 
Source-Sha: 194a59adfd6c901635da7a9c18253bb2210e2426
Policy-Sha: b9b0be0ee74e55f561a803b8aef6be3c2134f5a83b46816a069a372f2eb04f4d
Tree-Digest: 4697f2e281c1c6ecafff17cf6eeb391a0a1ac0fa6e5fc429f5b473f4579c252c
This commit is contained in:
Source publisher 2026-09-21 14:39:08 +00:00
commit ffdccba10f
42 changed files with 2516 additions and 554 deletions
Download patch file Download diff file Expand all files Collapse all files

2
agent/cmd/agent/cli.go
View file

@ -18,6 +18,7 @@ type CLI struct {
Scan bool
Status bool
LocalStatus bool
VerifyEnvelope string
InitStandalone bool
ListUpdates bool
Version bool
@ -49,6 +50,7 @@ func ParseFlags() *CLI {
flag.BoolVar(&cli.Scan, "scan", false, "Scan for updates and display locally")
flag.BoolVar(&cli.Status, "status", false, "Show agent status")
flag.BoolVar(&cli.LocalStatus, "local-status", false, "Show live local agent status over local IPC")
flag.StringVar(&cli.VerifyEnvelope, "verify-envelope", "", "Verify a signed mutation envelope through the installed privileged Helper and print its receipt")
flag.BoolVar(&cli.InitStandalone, "init-standalone", false, "Create or print this host's standalone Agent identity")
flag.BoolVar(&cli.ListUpdates, "list-updates", false, "List detailed update information")
flag.BoolVar(&cli.Version, "version", false, "Show version information")

28
agent/cmd/agent/main.go
View file

@ -1,6 +1,7 @@
package main
import (
"context"
"fmt"
"log"
"os"
@ -48,6 +49,16 @@ func main() {
return
}
// Read-only proof of the privileged Helper transport (SEC-030). It runs
// before config load for the same reason -local-status does: driving the
// fixed task needs the Agent's own rights, not its protected config.
if cli.VerifyEnvelope != "" {
if err := HandleVerifyEnvelopeCommand(cli.VerifyEnvelope); err != nil {
log.Fatal("Envelope verification failed: ", err)
}
return
}
// Handle Windows service management commands
if HandleWindowsServiceCommands(cli) {
return
@ -91,8 +102,8 @@ func main() {
// Handle registration command
if cli.Register {
if cfg.IsStandalone() {
log.Fatal("Registration refused: standalone fleet join is not implemented; do not add fleet credentials beside local authority")
if cfg.IsStandalone() || cfg.PendingFleetJoin != nil {
log.Fatal("Registration refused: use RedFlag Desktop to complete the standalone fleet join")
}
if err := handleRegistration(cfg, cli.ServerURL); err != nil {
log.Fatal("Registration failed:", err)
@ -133,6 +144,17 @@ func main() {
}
defer unlock()
// A Server may have accepted this identity before the process stopped
// during local authority replacement. Resume that exact transaction before
// evaluating mode; the helper is idempotent for the same Server key.
if cfg.PendingFleetJoin != nil {
receipt, err := handlers.CompletePendingFleetJoin(context.Background(), cfg, configPath)
if err != nil {
log.Fatalf("[FATAL] [agent] [fleet-join] recovery_failed request_id=%s error=%v", cfg.PendingFleetJoin.RequestID, err)
}
log.Printf("[INFO] [agent] [fleet-join] recovery_completed request_id=%s key_id=%s", receipt.RequestID, receipt.SigningKeyID)
}
// Check if registered
if !cfg.IsRegistered() && !cfg.IsStandalone() {
log.Fatal("Agent has no complete identity. Register with a fleet or run the standalone provisioning script.")
@ -147,7 +169,7 @@ func main() {
}
// Start agent service (console mode)
if err := agent.RunAgentLoop(cfg); err != nil {
if err := agent.RunAgentLoop(cfg, configPath); err != nil {
log.Fatal("Agent failed:", err)
}
}