Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases 1 Activity

source: advance the checked projection

Browse source 
Source-Sha: 194a59adfd6c901635da7a9c18253bb2210e2426
Policy-Sha: b9b0be0ee74e55f561a803b8aef6be3c2134f5a83b46816a069a372f2eb04f4d
Tree-Digest: 4697f2e281c1c6ecafff17cf6eeb391a0a1ac0fa6e5fc429f5b473f4579c252c
This commit is contained in:
Source publisher 2026-09-21 14:39:08 +00:00
commit ffdccba10f
42 changed files with 2516 additions and 554 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/check-public-history.sh
View file

@ -14,9 +14,8 @@ if [[ "$(git rev-parse --is-shallow-repository)" != "false" ]]; then
fi
git rev-parse --verify "${ref}^{commit}" >/dev/null
# RedFlag legitimately manages private networks. This gate is deliberately
# Casey-specific: it catches known home infrastructure and author metadata,
# not every RFC1918 address a fleet-management tool needs in examples/tests.
# RedFlag legitimately manages private networks. House topology is advisory in
# the surface gate; this legacy check retains private home/identity checks.
#
# It excludes itself, because it has to write down what it is looking for. That
# was invisible while the file arrived in an old commit already on the
@ -26,12 +25,12 @@ git log "$ref" -p --no-ext-diff --no-color --format='@@COMMIT@@%H' \
-- . ':(exclude)scripts/check-public-history.sh' |
awk '
/^@@COMMIT@@/ { sha=substr($0,11); next }
/10\.10\.20\.[0-9]{1,3}|172\.16\.42\.[0-9]{1,3}|wiuf-docker|gitea\.wiuf\.net|\/home\/casey/ { print sha }
/\/home\/casey/ { print sha }
' >"$tmpdir/content"
git log "$ref" --format='%H%x09%an%x09%ae%x09%cn%x09%ce' |
awk -F '\t' '
tolower($0) ~ /@wiuf\.net|@wifu\.net|10\.10\.20\.|172\.16\.42\.|\/home\/casey/ { print $1 }
tolower($0) ~ /@wiuf\.net|@wifu\.net|\/home\/casey/ { print $1 }
' >"$tmpdir/metadata"
sed -E '/^[[:space:]]*(#|$)/d' "$allowlist" | sort -u >"$tmpdir/allowed"

10
scripts/provision-standalone-authority.sh
View file

@ -29,6 +29,8 @@ TOKENS_DIR="/var/lib/redflag/agent/tokens"
MUTATION_REQUEST_DIR="/var/lib/redflag/agent/mutation-requests"
MUTATION_ENVELOPE_DIR="/var/lib/redflag/agent/mutation-envelopes"
MUTATION_RECEIPT_DIR="/var/lib/redflag/agent/mutation-receipts"
FLEET_JOIN_REQUEST_DIR="/var/lib/redflag/agent/fleet-join-requests"
FLEET_JOIN_RECEIPT_DIR="/var/lib/redflag/agent/fleet-join-receipts"
SUDOERS_FILE="/etc/sudoers.d/redflag-agent-mint"
log() { echo "[INFO] [provision] [standalone-authority] $*"; }
@ -66,8 +68,9 @@ install -d -m 0750 -o "$AGENT_USER" -g "$LOCAL_GROUP" "$MINT_REQUEST_DIR"
log "mint request dir ready: $MINT_REQUEST_DIR"
install -d -m 0700 -o "$AGENT_USER" -g "$AGENT_USER" \
"$MUTATION_REQUEST_DIR" "$MUTATION_ENVELOPE_DIR" "$MUTATION_RECEIPT_DIR"
log "mutation exchange dirs ready"
"$MUTATION_REQUEST_DIR" "$MUTATION_ENVELOPE_DIR" "$MUTATION_RECEIPT_DIR" \
"$FLEET_JOIN_REQUEST_DIR" "$FLEET_JOIN_RECEIPT_DIR"
log "mutation and fleet-join exchange dirs ready"
# Tokens dir should already exist from the base install; ensure it does.
[ -d "$TOKENS_DIR" ] || install -d -m 0700 -o "$AGENT_USER" -g "$AGENT_USER" "$TOKENS_DIR"
@ -91,9 +94,10 @@ cat > "$SUDOERS_FILE" <<EOF
$AGENT_USER ALL=(root) NOPASSWD: /usr/bin/systemd-run --wait --property=ProtectSystem=no -- $HELPER_BIN mint --request-file $MINT_REQUEST_DIR/* --token-out $TOKENS_DIR/*
$AGENT_USER ALL=(root) NOPASSWD: /usr/bin/systemd-run --wait --property=ProtectSystem=no -- $HELPER_BIN mint-envelope --request-file $MUTATION_REQUEST_DIR/* --envelope-out $MUTATION_ENVELOPE_DIR/*
$AGENT_USER ALL=(root) NOPASSWD: /usr/bin/systemd-run --wait --property=ProtectSystem=no -- $HELPER_BIN execute-envelope --envelope-file $MUTATION_ENVELOPE_DIR/* --receipt-file $MUTATION_RECEIPT_DIR/*
$AGENT_USER ALL=(root) NOPASSWD: /usr/bin/systemd-run --wait --property=ProtectSystem=no -- $HELPER_BIN adopt-fleet --request-file $FLEET_JOIN_REQUEST_DIR/* --receipt-file $FLEET_JOIN_RECEIPT_DIR/*
EOF
chmod 0440 "$SUDOERS_FILE"
visudo -c -f "$SUDOERS_FILE" >/dev/null || fail "sudoers validation failed for $SUDOERS_FILE"
log "sudoers installed: $SUDOERS_FILE"
log "standalone authority provisioned — fleet join is not implemented; do not add fleet credentials beside this key"
log "standalone authority provisioned — Desktop may retire it through the one-way fleet join"