| #!/bin/bash
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
| REPO_ROOT="$(dirname "$SCRIPT_DIR")"
|
| SOVEREIGN_DIR="$REPO_ROOT/sovereign"
|
|
|
| PASS_COUNT=0
|
| FAIL_COUNT=0
|
|
|
| echo "=========================================="
|
| echo "PAX-CODER SECURITY STATUS REPORT"
|
| echo "=========================================="
|
| echo ""
|
|
|
|
|
|
|
|
|
|
|
| echo "Release Integrity Check"
|
| if "$SCRIPT_DIR/verify-clone" > /tmp/pax-integrity.txt 2>&1; then
|
| INTEGRITY_STATUS="PASS"
|
| PASS_COUNT=$((PASS_COUNT+1))
|
| echo " ✓ PASS"
|
| else
|
| INTEGRITY_STATUS="FAIL"
|
| FAIL_COUNT=$((FAIL_COUNT+1))
|
| echo " ✗ FAIL"
|
| fi
|
|
|
| rm -f /tmp/pax-integrity.txt
|
| echo ""
|
|
|
|
|
|
|
|
|
|
|
| echo "Release Signature Check"
|
|
|
| if [ -f "$SOVEREIGN_DIR/release.json" ]; then
|
| if grep -q '"signature_hex"' "$SOVEREIGN_DIR/release.json"; then
|
| SIGNATURE_STATUS="PASS"
|
| PASS_COUNT=$((PASS_COUNT+1))
|
| echo " ✓ PASS (signature present in release.json)"
|
| else
|
| SIGNATURE_STATUS="FAIL"
|
| FAIL_COUNT=$((FAIL_COUNT+1))
|
| echo " ✗ FAIL (signature missing)"
|
| fi
|
| else
|
| SIGNATURE_STATUS="UNAVAILABLE"
|
| echo " ⊘ UNAVAILABLE (no release.json)"
|
| fi
|
|
|
| echo ""
|
|
|
|
|
|
|
|
|
|
|
| echo "Node Identity Check"
|
|
|
| if [ -f "$SOVEREIGN_DIR/node.json" ] && [ -f "$SOVEREIGN_DIR/node_pk.pem" ]; then
|
| NODE_STATUS="PASS"
|
| PASS_COUNT=$((PASS_COUNT+1))
|
| NODE_ID=$(grep '"node_id"' "$SOVEREIGN_DIR/node.json" 2>/dev/null | cut -d'"' -f4 || echo "unknown")
|
| echo " ✓ PASS"
|
| echo " Node ID: $NODE_ID"
|
| else
|
| NODE_STATUS="FAIL"
|
| FAIL_COUNT=$((FAIL_COUNT+1))
|
| echo " ✗ FAIL (node.json or node_pk.pem missing)"
|
| fi
|
|
|
| echo ""
|
|
|
|
|
|
|
|
|
|
|
| echo "Capability Presence Check"
|
|
|
| CAPABILITY_TOKEN="${PAX_CAPABILITY_TOKEN:-}"
|
| CAPABILITY_FILE="$SOVEREIGN_DIR/.capability"
|
|
|
| if [ -n "$CAPABILITY_TOKEN" ] || [ -f "$CAPABILITY_FILE" ]; then
|
| CAPABILITY_PRESENT="YES"
|
| echo " ✓ YES (capability available)"
|
| else
|
| CAPABILITY_PRESENT="NO"
|
| echo " ✗ NO (capability not available)"
|
| fi
|
|
|
| echo ""
|
|
|
|
|
|
|
|
|
|
|
| echo "Capability Validity Check"
|
|
|
| if [ "$CAPABILITY_PRESENT" = "YES" ]; then
|
| if [ -n "$CAPABILITY_TOKEN" ]; then
|
| CAPABILITY="$CAPABILITY_TOKEN"
|
| else
|
| CAPABILITY=$(cat "$CAPABILITY_FILE" 2>/dev/null || echo "")
|
| fi
|
|
|
|
|
| CAPABILITY_EXPIRES=$(echo "$CAPABILITY" | grep -o '"expires_at":"[^"]*"' | cut -d'"' -f4 || echo "")
|
|
|
| if [ -z "$CAPABILITY_EXPIRES" ]; then
|
| CAPABILITY_VALIDITY_STATUS="FAIL"
|
| FAIL_COUNT=$((FAIL_COUNT+1))
|
| echo " ✗ FAIL (expiration not found)"
|
| else
|
|
|
| CURRENT_TIME=$(date +%s 2>/dev/null || echo "0")
|
| EXPIRATION_TIME=$(date -d "$CAPABILITY_EXPIRES" +%s 2>/dev/null || date -j -f "%Y-%m-%dT%H:%M:%SZ" "$CAPABILITY_EXPIRES" +%s 2>/dev/null || echo "0")
|
|
|
| if [ "$CURRENT_TIME" -le "$EXPIRATION_TIME" ]; then
|
| CAPABILITY_VALIDITY_STATUS="VALID"
|
| PASS_COUNT=$((PASS_COUNT+1))
|
| echo " ✓ VALID"
|
| echo " Expires: $CAPABILITY_EXPIRES"
|
| else
|
| CAPABILITY_VALIDITY_STATUS="EXPIRED"
|
| FAIL_COUNT=$((FAIL_COUNT+1))
|
| echo " ✗ EXPIRED"
|
| echo " Expired: $CAPABILITY_EXPIRES"
|
| fi
|
| fi
|
| else
|
| CAPABILITY_VALIDITY_STATUS="N/A"
|
| echo " ⊘ N/A (no capability)"
|
| fi
|
|
|
| echo ""
|
|
|
|
|
|
|
|
|
|
|
| echo "Capability Signature Check"
|
|
|
| if [ "$CAPABILITY_PRESENT" = "YES" ]; then
|
| CAPABILITY_SIGNATURE=$(echo "$CAPABILITY" | cut -d'|' -f2 || echo "")
|
|
|
| if [ -z "$CAPABILITY_SIGNATURE" ]; then
|
| SIGNATURE_CHECK_STATUS="FAIL"
|
| FAIL_COUNT=$((FAIL_COUNT+1))
|
| echo " ✗ FAIL (signature missing)"
|
| elif echo "$CAPABILITY_SIGNATURE" | grep -qE '^[a-f0-9]{128}$'; then
|
| SIGNATURE_CHECK_STATUS="PASS"
|
| PASS_COUNT=$((PASS_COUNT+1))
|
| echo " ✓ PASS (signature format valid)"
|
| else
|
| SIGNATURE_CHECK_STATUS="FAIL"
|
| FAIL_COUNT=$((FAIL_COUNT+1))
|
| echo " ✗ FAIL (signature format invalid)"
|
| fi
|
| else
|
| SIGNATURE_CHECK_STATUS="N/A"
|
| echo " ⊘ N/A (no capability)"
|
| fi
|
|
|
| echo ""
|
|
|
|
|
|
|
|
|
|
|
| echo "Protected Execution Authorization"
|
|
|
| if [ "$INTEGRITY_STATUS" = "PASS" ] && [ "$CAPABILITY_VALIDITY_STATUS" = "VALID" ] && [ "$SIGNATURE_CHECK_STATUS" = "PASS" ]; then
|
| EXECUTION_STATUS="AUTHORIZED"
|
| echo " ✓ AUTHORIZED"
|
| echo ""
|
| echo " You may execute protected operations:"
|
| echo " - generate_node_key"
|
| echo " - generate_release"
|
| else
|
| EXECUTION_STATUS="DENIED"
|
| echo " ✗ DENIED"
|
| echo ""
|
|
|
| if [ "$INTEGRITY_STATUS" != "PASS" ]; then
|
| echo " Reason: Release integrity verification failed"
|
| fi
|
|
|
| if [ "$CAPABILITY_PRESENT" = "NO" ]; then
|
| echo " Reason: Capability not available"
|
| elif [ "$CAPABILITY_VALIDITY_STATUS" = "EXPIRED" ]; then
|
| echo " Reason: Capability expired"
|
| elif [ "$SIGNATURE_CHECK_STATUS" = "FAIL" ]; then
|
| echo " Reason: Capability signature invalid"
|
| fi
|
| fi
|
|
|
| echo ""
|
|
|
|
|
|
|
|
|
|
|
| echo "=========================================="
|
| echo "SUMMARY"
|
| echo "=========================================="
|
| echo ""
|
| echo "Release Integrity: $INTEGRITY_STATUS"
|
| echo "Release Signature: $SIGNATURE_STATUS"
|
| echo "Node Identity: $NODE_STATUS"
|
| echo "Capability: $CAPABILITY_PRESENT"
|
| echo "Capability Validity: $CAPABILITY_VALIDITY_STATUS"
|
| echo "Capability Signature: $SIGNATURE_CHECK_STATUS"
|
| echo "Protected Execution: $EXECUTION_STATUS"
|
| echo ""
|
| echo "Passed: $PASS_COUNT | Failed: $FAIL_COUNT"
|
| echo ""
|
|
|
| if [ $FAIL_COUNT -eq 0 ] && [ "$EXECUTION_STATUS" = "AUTHORIZED" ]; then
|
| exit 0
|
| else
|
| exit 1
|
| fi
|
|
|
