mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-10-21 02:56:18 +00:00
SatoshiQaziMuhammed
3ba40d4e52
- ops: deploy scripts the CI keys are pinned to - ci: deploy over pinned, single-purpose keys from GitHub-hosted runners - ops: tell shellcheck the test's variables are read through eval
19 lines
581 B
Bash
Executable File
19 lines
581 B
Bash
Executable File
#!/bin/bash
|
|
# Forced command for the pwap indexer deploy key, installed root-owned at
|
|
# /usr/local/sbin/pwap-indexer-ssh:
|
|
#
|
|
# restrict,command="/usr/local/sbin/pwap-indexer-ssh" ssh-ed25519 ...
|
|
#
|
|
# CI runs `ssh indexer-deploy@<host> <sha>`. The SHA is the only input; the
|
|
# deploy itself is pwap-indexer-deploy, which sudo lets this user run and
|
|
# nothing else.
|
|
set -euo pipefail
|
|
|
|
SHA="${SSH_ORIGINAL_COMMAND:-}"
|
|
if ! [[ "$SHA" =~ ^[0-9a-f]{7,40}$ ]]; then
|
|
echo "pwap-indexer-ssh: expected an image SHA" >&2
|
|
exit 2
|
|
fi
|
|
|
|
exec sudo -n /usr/local/sbin/pwap-indexer-deploy "$SHA"
|