39 lines
1.5 KiB
Text
39 lines
1.5 KiB
Text
|
#!/usr/bin/env nu
|
||
|
|
def main [
|
||
|
|
--workspace: string = ""
|
||
|
|
--key-type: string = ""
|
||
|
|
--dry-run
|
||
|
|
]: nothing -> nothing {
|
||
|
|
let ws = if ($workspace | is-not-empty) { $workspace } else { $env.PLAYBOOK_PARAM_WORKSPACE? | default "" }
|
||
|
|
let ktype = if ($key_type | is-not-empty) { $key_type } else { $env.PLAYBOOK_PARAM_KEY_TYPE? | default "" }
|
||
|
|
|
||
|
|
if ($ws | is-empty) { error make { msg: "workspace is required" } }
|
||
|
|
|
||
|
|
let repo = $"state-($ws)"
|
||
|
|
|
||
|
|
if $dry_run {
|
||
|
|
print $"[dry-run] would revoke old ($ktype) key from delegation set in ($repo)"
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
let list_r = do { ^rad patch list --repo $repo --state merged --json } | complete
|
||
|
|
if $list_r.exit_code != 0 {
|
||
|
|
print $"WARNING: cannot list merged patches on ($repo) to confirm old key revoked: ($list_r.stderr | str trim)"
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
let patches = $list_r.stdout | from json
|
||
|
|
let rotation_patches = $patches | where { |p|
|
||
|
|
($p.title? | default "" | str contains "Rotate") and ($p.title? | default "" | str contains $ktype)
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($rotation_patches | is-empty) {
|
||
|
|
print $"WARNING: no merged rotation patch found for ($ktype) in ($repo) — old key revocation should be verified manually"
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
let patch_id = $rotation_patches | last | get id
|
||
|
|
print $"Delegation patch ($patch_id) merged — old ($ktype) key is no longer in delegation set"
|
||
|
|
print $"Verify: rad delegate list --repo ($repo) should not contain old pubkey"
|
||
|
|
}
|