gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: plan 16-01

Browse Source
This commit is contained in:
thanhnv
2026-07-06 21:47:38 +09:00
parent 4419cd9eae
commit 8c3c5e8bff
30 changed files with 1646 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/.specify/scripts/bash/verify-tool-audit.sh
+11
View File
@@ -56,5 +56,16 @@ if [[ -f "$HEAD_FILE" && -f "$HEAD_SIG" && -f "$AUDIT_PUB" ]] && command -v open
fi
echo "TOOL_AUDIT_VALID anchor=signed last_hash=$COMPUTED_HEAD"
else
# SEC-01 (H-01): enforced mode treats a missing/unverifiable signature as FAIL.
# Self-contained (this script is copied into sandboxes by tests — no common.sh).
if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_VERIFY_STRICT:-}" == "1" ]]; then
MISSING=""
[[ -f "$HEAD_FILE" ]] || MISSING="$MISSING head-file"
[[ -f "$HEAD_SIG" ]] || MISSING="$MISSING head-sig"
[[ -f "$AUDIT_PUB" ]] || MISSING="$MISSING pubkey"
command -v openssl >/dev/null 2>&1 || MISSING="$MISSING openssl"
echo "TOOL_AUDIT_UNSIGNED_STRICT_FAIL last_hash=$COMPUTED_HEAD missing=${MISSING# }" >&2
exit 1
fi
echo "TOOL_AUDIT_VALID anchor=unsigned last_hash=$COMPUTED_HEAD"
fi