teamsync-cluster 0.1.0__tar.gz

teamsync_cluster-0.1.0/PKG-INFO

@@ -0,0 +1,60 @@
+Metadata-Version: 2.4
+Name: teamsync-cluster
+Version: 0.1.0
+Summary: Verified licensed TeamSync kit bootstrap
+Author: TeamSync
+License: Proprietary
+Project-URL: Releases, https://release.teamsync.com.tw
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+
+# TeamSync cluster bootstrap
+
+Python >=3.8, no Python runtime dependencies. Install GnuPG (`gpg`) on the
+connected download machine. Target kits support Linux amd64 and arm64.
+
+```sh
+pip install teamsync-cluster
+teamsync-cluster fetch --dest ./teamsync-download
+# Hidden license prompt. Or --license-file /secure/license-key (0600), or
+# TEAMSYNC_LICENSE_KEY from a secrets manager. --license KEY is also supported.
+cd teamsync-download/kit
+sudo ./teamsync-cluster config
+sudo ./teamsync-cluster deploy --apply-firewall
+sudo ./teamsync-cluster status
+```
+
+`fetch` redeems once, downloads base plus only the licensed add-ons, verifies
+the pinned GPG release signature and every selected SHA-256, verifies the
+separately signed offline license, then extracts. The destination contains a
+private download receipt with expiring URLs; rerun the same fetch destination
+to resume without redeeming again. Keep it private. An interrupted response
+before that receipt is saved requires TeamSync support to issue a new key.
+
+Copy the complete destination to an offline site. Run the kit's executable
+there; Python >=3.10 is required by the full installer. Other bootstrap
+subcommands delegate only to `TEAMSYNC_KIT` or the last successful download
+path. The bootstrap checks user/root ownership, write permissions, the signed
+license version/architecture and the executable hash in `components/base.json`.
+Use an administrator-owned directory outside shared writable paths such as `/tmp`.
+
+For a different target architecture: `fetch --arch amd64` or `--arch arm64`.
+For a pinned grant: `fetch --version vX.Y.Z`. A `latest` grant resolves the
+latest released version when redeemed. Additional add-ons require a new key.
+Expired download links require a new key; they cannot be renewed by replay.
+The license key is never written to the destination or printed by this tool.
+
+An expired term leaves `status` and `doctor` available with a warning. `deploy`
+can repair the exact configuration authorized before expiry; new installs or
+add-on changes require renewal. To renew with a **new key** without changing the
+installed version or downloading archives (on a connected machine):
+
+```sh
+teamsync-cluster fetch --license-only --kit ./teamsync-download/kit --license-file /secure/new-key
+# For an offline site, copy only the renewed kit/license.json to the same kit.
+```
+
+Published builds contact production only and pin its signing authority. Staging
+uses a separate operator-only build; endpoint/key environment overrides are refused.

teamsync_cluster-0.1.0/README.md

@@ -0,0 +1,48 @@
+# TeamSync cluster bootstrap
+
+Python >=3.8, no Python runtime dependencies. Install GnuPG (`gpg`) on the
+connected download machine. Target kits support Linux amd64 and arm64.
+
+```sh
+pip install teamsync-cluster
+teamsync-cluster fetch --dest ./teamsync-download
+# Hidden license prompt. Or --license-file /secure/license-key (0600), or
+# TEAMSYNC_LICENSE_KEY from a secrets manager. --license KEY is also supported.
+cd teamsync-download/kit
+sudo ./teamsync-cluster config
+sudo ./teamsync-cluster deploy --apply-firewall
+sudo ./teamsync-cluster status
+```
+
+`fetch` redeems once, downloads base plus only the licensed add-ons, verifies
+the pinned GPG release signature and every selected SHA-256, verifies the
+separately signed offline license, then extracts. The destination contains a
+private download receipt with expiring URLs; rerun the same fetch destination
+to resume without redeeming again. Keep it private. An interrupted response
+before that receipt is saved requires TeamSync support to issue a new key.
+
+Copy the complete destination to an offline site. Run the kit's executable
+there; Python >=3.10 is required by the full installer. Other bootstrap
+subcommands delegate only to `TEAMSYNC_KIT` or the last successful download
+path. The bootstrap checks user/root ownership, write permissions, the signed
+license version/architecture and the executable hash in `components/base.json`.
+Use an administrator-owned directory outside shared writable paths such as `/tmp`.
+
+For a different target architecture: `fetch --arch amd64` or `--arch arm64`.
+For a pinned grant: `fetch --version vX.Y.Z`. A `latest` grant resolves the
+latest released version when redeemed. Additional add-ons require a new key.
+Expired download links require a new key; they cannot be renewed by replay.
+The license key is never written to the destination or printed by this tool.
+
+An expired term leaves `status` and `doctor` available with a warning. `deploy`
+can repair the exact configuration authorized before expiry; new installs or
+add-on changes require renewal. To renew with a **new key** without changing the
+installed version or downloading archives (on a connected machine):
+
+```sh
+teamsync-cluster fetch --license-only --kit ./teamsync-download/kit --license-file /secure/new-key
+# For an offline site, copy only the renewed kit/license.json to the same kit.
+```
+
+Published builds contact production only and pin its signing authority. Staging
+uses a separate operator-only build; endpoint/key environment overrides are refused.

teamsync_cluster-0.1.0/pyproject.toml

@@ -0,0 +1,23 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "teamsync-cluster"
+version = "0.1.0"
+description = "Verified licensed TeamSync kit bootstrap"
+readme = "README.md"
+requires-python = ">=3.8"
+license = {text = "Proprietary"}
+authors = [{name = "TeamSync"}]
+dependencies = []
+classifiers = ["Programming Language :: Python :: 3", "Operating System :: OS Independent"]
+
+[project.scripts]
+teamsync-cluster = "teamsync_bootstrap.cli:main"
+
+[project.urls]
+Releases = "https://release.teamsync.com.tw"
+
+[tool.setuptools.packages.find]
+where = ["src"]

teamsync_cluster-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

teamsync_cluster-0.1.0/src/teamsync_bootstrap/__init__.py

@@ -0,0 +1,2 @@
+"""Public download bootstrap. Installer implementation stays in private kits."""
+__version__ = "0.1.0"

teamsync_cluster-0.1.0/src/teamsync_bootstrap/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())

teamsync_cluster-0.1.0/src/teamsync_bootstrap/cli.py

@@ -0,0 +1,433 @@
+"""Python 3.8+ stdlib-only licensed downloader; never emits secret-bearing errors."""
+import argparse
+from contextlib import contextmanager
+import getpass
+import hashlib
+import http.client
+import json
+import os
+from pathlib import Path, PurePosixPath
+import platform
+import re
+import shutil
+import stat
+import subprocess
+import sys
+import tarfile
+import tempfile
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+
+from .license_verify import verify_license
+
+REDEEM_URL = "https://api.cluster.scfg.io/public/distribution/licenses/redeem"
+RELEASE_FINGERPRINT = "D31470AE995860024BD4427FB44C979CC1A80E3A"
+VERSION = re.compile(r"v[0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9][A-Za-z0-9.-]{0,40})?\Z")
+
+
+class FetchError(Exception):
+    pass
+
+
+class SecretSafeParser(argparse.ArgumentParser):
+    def error(self, message):
+        # argparse's default errors echo invalid/unrecognized argv, which may
+        # include a mistyped --license invocation. Never print those values.
+        self.print_usage(sys.stderr)
+        self.exit(2, "Invalid arguments. See teamsync-cluster fetch --help; key values withheld.\n")
+
+
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        raise FetchError("Unexpected download redirect; contact TeamSync support.")
+
+
+def _https(url):
+    parsed = urllib.parse.urlsplit(url)
+    if (parsed.scheme != "https" or not (parsed.hostname or "").endswith(".r2.cloudflarestorage.com")
+            or parsed.port not in (None, 443) or parsed.username or parsed.password or parsed.fragment):
+        raise FetchError("Invalid download endpoint.")
+    return url
+
+
+def _opener():
+    return urllib.request.build_opener(NoRedirect())
+
+
+def _save(path, document):
+    temporary = path.with_name(path.name + ".new")
+    with os.fdopen(os.open(str(temporary), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600), "w") as stream:
+        json.dump(document, stream, ensure_ascii=True, sort_keys=True)
+        stream.flush()
+        os.fsync(stream.fileno())
+    os.replace(str(temporary), str(path))
+
+
+@contextmanager
+def _lock(destination):
+    path = destination / ".fetch.lock"
+    try:
+        path.mkdir()
+    except FileExistsError:
+        raise FetchError("Another fetch is active. If it stopped, remove .fetch.lock and retry.") from None
+    try:
+        yield
+    finally:
+        path.rmdir()
+
+
+def _redeem(key, version, arch, license_only=False):
+    endpoint = REDEEM_URL
+    if os.environ.get("TEAMSYNC_LICENSE_ENDPOINT"):
+        raise FetchError("Endpoint overrides are not supported; use the separate operator staging build.")
+    body = {"key": key, "arch": [arch]}
+    if license_only:
+        body["license_only"] = True
+    if version:
+        body["version"] = version
+    try:
+        machine = Path("/etc/machine-id")
+        if machine.is_file():
+            body["host_fingerprint"] = hashlib.sha256(machine.read_bytes()).hexdigest()
+        request = urllib.request.Request(endpoint, data=json.dumps(body).encode(),
+            headers={"Content-Type": "application/json", "User-Agent": "teamsync-cluster-bootstrap/0.1"}, method="POST")
+        with _opener().open(request, timeout=60) as response:
+            data = response.read(262145)
+        if len(data) > 262144:
+            raise FetchError("License response exceeds limit.")
+        return json.loads(data)
+    except urllib.error.HTTPError as exc:
+        if exc.code == 403:
+            raise FetchError("License is invalid or unavailable. Contact TeamSync support.") from None
+        if exc.code == 429:
+            raise FetchError("Too many attempts. Wait one minute before retrying.") from None
+        raise FetchError("License service is unavailable. Contact TeamSync support before redeeming again.") from None
+
+
+def _download(item, directory):
+    name = item["name"]
+    final, partial = directory / name, directory / (name + ".part")
+    if final.is_file():
+        return final
+    for attempt in range(3):
+        offset = partial.stat().st_size if partial.is_file() else 0
+        headers = {"Range": "bytes=%d-" % offset} if offset else {}
+        request = urllib.request.Request(_https(item["url"]), headers=headers)
+        try:
+            with _opener().open(request, timeout=60) as response:
+                append = offset > 0 and response.status == 206
+                if response.status == 206:
+                    content_range = response.headers.get("Content-Range", "")
+                    match = re.fullmatch(r"bytes ([0-9]+)-([0-9]+)/([0-9]+)", content_range)
+                    if not match or int(match[1]) != offset:
+                        raise FetchError("Invalid resume response.")
+                length = response.headers.get("Content-Length")
+                if length is None or not length.isdigit():
+                    raise FetchError("Download has no valid Content-Length.")
+                expected = int(length)
+                received = 0
+                with partial.open("ab" if append else "wb") as output:
+                    while True:
+                        chunk = response.read(1024 * 1024)
+                        if not chunk:
+                            break
+                        received += len(chunk)
+                        output.write(chunk)
+                if received != expected:
+                    raise OSError("Interrupted download")
+            os.replace(str(partial), str(final))
+            print("Downloaded: " + name)
+            return final
+        except urllib.error.HTTPError as exc:
+            if exc.code in (401, 403):
+                raise FetchError("Download window expired. Contact TeamSync support for a new key.") from None
+            if exc.code == 416:
+                # Cannot know whether a partial is complete until its signed
+                # checksum has been checked; safely restart this artifact.
+                partial.unlink(missing_ok=True)
+        except (OSError, urllib.error.URLError, http.client.HTTPException):
+            pass
+        if attempt < 2:
+            time.sleep(attempt + 1)
+    raise FetchError("Download interrupted. Rerun fetch with the same destination to resume.")
+
+
+def signature_status_ok(status):
+    """Same NEWSIG/GOODSIG/VALIDSIG state machine as sign-release-checksums.sh."""
+    good = pinned = ok = bad = False
+    for line in status.splitlines():
+        words = line.split()
+        if len(words) < 2 or words[0] != "[GNUPG:]":
+            continue
+        kind = words[1]
+        if kind == "NEWSIG":
+            ok = ok or (good and pinned)
+            good = pinned = False
+        elif kind == "GOODSIG":
+            good = True
+        elif kind == "VALIDSIG" and words[-1] == RELEASE_FINGERPRINT:
+            pinned = True
+        elif kind in ("BADSIG", "ERRSIG", "EXPKEYSIG", "REVKEYSIG", "EXPSIG"):
+            bad = True
+    return (ok or (good and pinned)) and not bad
+
+
+def _verify(directory, files):
+    with tempfile.TemporaryDirectory(prefix="teamsync-gpg-") as home:
+        command = ["gpg", "--no-options", "--batch", "--no-tty", "--homedir", home,
+                   "--no-auto-key-retrieve"]
+        def gpg(*args):
+            return subprocess.run(command + list(args), stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                                  text=True, timeout=60)
+        key = str(directory / "teamsync-release-key.asc")
+        shown = gpg("--with-colons", "--show-keys", key)
+        pubs = [line for line in shown.stdout.splitlines() if line.startswith("pub:")]
+        fingerprints = [line.split(":")[9] for line in shown.stdout.splitlines() if line.startswith("fpr:")]
+        if shown.returncode or len(pubs) != 1 or not fingerprints or fingerprints[0] != RELEASE_FINGERPRINT:
+            raise FetchError("Release key fingerprint mismatch. Do not install.")
+        if gpg("--import", key).returncode:
+            raise FetchError("Release key import failed. Do not install.")
+        checked = gpg("--status-fd", "1", "--verify", str(directory / "SHA256SUMS.asc"), str(directory / "SHA256SUMS"))
+        if checked.returncode or not signature_status_ok(checked.stdout):
+            raise FetchError("Release signature verification failed. Do not install.")
+    print("SIGNATURE OK (" + RELEASE_FINGERPRINT + ")")
+    checksums = {}
+    for line in (directory / "SHA256SUMS").read_text(encoding="utf-8").splitlines():
+        match = re.fullmatch(r"([a-f0-9]{64})  (.+)", line)
+        if not match or match[2] in checksums:
+            raise FetchError("Invalid signed checksum list.")
+        checksums[match[2]] = match[1]
+    for item in files:
+        if item["kind"] in ("checksums", "signature", "public-key"):
+            continue
+        name = item["name"]
+        digest = hashlib.sha256()
+        with (directory / name).open("rb") as source:
+            for chunk in iter(lambda: source.read(1024 * 1024), b""):
+                digest.update(chunk)
+        if checksums.get(name) != digest.hexdigest():
+            # The next run can resume other files but must redownload corruption.
+            (directory / name).unlink()
+            raise FetchError("Checksum failed for " + name + ". Rerun fetch; do not install.")
+        print(name + ": OK")
+
+
+def _validate_grant(grant, arch, requested):
+    version = grant["version"]
+    if not VERSION.fullmatch(version) or (requested and requested != version):
+        raise FetchError("Unexpected release version.")
+    try:
+        license_payload = verify_license(grant["license"], version=version, arch=arch)
+    except ValueError:
+        raise FetchError("Offline license is invalid or expired. Contact TeamSync support.") from None
+    clean = version[1:]
+    expected = {"SHA256SUMS": "checksums", "SHA256SUMS.asc": "signature",
+                "teamsync-release-key.asc": "public-key", "安裝指南.pdf": "guide",
+                "teamsync-base-%s-%s.tar.gz" % (clean, arch): "base"}
+    for addon in license_payload["addons"]:
+        expected["teamsync-addon-%s-%s-%s.tar.gz" % (addon, clean, arch)] = "addon"
+    files = grant["files"]
+    if len(files) != len(expected) or {item["name"]: item["kind"] for item in files} != expected:
+        raise FetchError("Download list does not match signed license entitlements.")
+    for item in files:
+        _https(item["url"])
+    return version
+
+
+def _extract(directory, files, kits, version, arch, license_document):
+    root_name = "teamsync-%s-%s" % (version[1:], arch)
+    target = kits / "kit"
+    if target.exists():
+        raise FetchError("Kit directory already exists; choose a new destination for this download.")
+    kits.mkdir(exist_ok=True)
+    with tempfile.TemporaryDirectory(prefix=".extract-", dir=str(kits)) as temporary:
+        staging = Path(temporary)
+        written = set()
+        for item in sorted(files, key=lambda entry: entry["kind"] != "base"):
+            if item["kind"] not in ("base", "addon"):
+                continue
+            with tarfile.open(str(directory / item["name"]), "r:gz") as archive:
+                for member in archive:
+                    path = PurePosixPath(member.name)
+                    if (path.is_absolute() or "\\" in member.name or ":" in member.name
+                            or not path.parts or path.parts[0] != root_name
+                            or ".." in path.parts or not (member.isfile() or member.isdir())
+                            or member.mode & 0o7000):
+                        raise FetchError("Unsafe kit archive. Do not install.")
+                    output = staging.joinpath(*path.parts)
+                    if member.isdir():
+                        output.mkdir(parents=True, exist_ok=True)
+                        continue
+                    if str(path) in written:
+                        raise FetchError("Conflicting files in kit components. Do not install.")
+                    written.add(str(path))
+                    output.parent.mkdir(parents=True, exist_ok=True)
+                    with archive.extractfile(member) as source, output.open("xb") as sink:
+                        shutil.copyfileobj(source, sink)
+                    output.chmod(member.mode & 0o777)
+        kit = staging / root_name
+        _save(kit / "license.json", license_document)
+        combined = {}
+        for component in ("base", *license_document["payload"]["addons"]):
+            receipt = kit / "system" / ("BUNDLE_FILES." + component + ".json")
+            entries = json.loads(receipt.read_text())["files"]
+            if combined.keys() & entries.keys():
+                raise FetchError("Conflicting component receipts.")
+            combined.update(entries)
+        _save(kit / "system/BUNDLE_FILES.json", {"format": 1, "files": combined})
+        shutil.copyfile(str(directory / "安裝指南.pdf"), str(kit / "安裝指南.pdf"))
+        if not (kit / "teamsync-cluster").is_file():
+            raise FetchError("Base kit is missing teamsync-cluster.")
+        os.replace(str(kit), str(target))
+    return target
+
+
+def _license_key(args):
+    environment_key = os.environ.pop("TEAMSYNC_LICENSE_KEY", "")
+    key = args.license or environment_key
+    if args.license_file:
+        key = args.license_file.expanduser().read_text().strip()
+    if not key:
+        if not sys.stdin.isatty():
+            raise FetchError("Use --license-file or TEAMSYNC_LICENSE_KEY when no interactive terminal is available.")
+        key = getpass.getpass("TeamSync license key (hidden): ").strip()
+    if not key:
+        raise FetchError("A license key is required.")
+    return key
+
+
+def fetch(args):
+    if args.license_only:
+        return _renew(args)
+    if args.kit is not None:
+        raise FetchError("--kit is used only with --license-only.")
+    if not shutil.which("gpg"):
+        raise FetchError("Install GnuPG (gpg) on this connected machine before redeeming.")
+    arch = args.arch
+    if arch == "auto":
+        arch = {"x86_64": "amd64", "amd64": "amd64", "aarch64": "arm64", "arm64": "arm64"}.get(platform.machine().lower())
+    if arch not in ("amd64", "arm64"):
+        raise FetchError("Choose --arch amd64 or --arch arm64 for the target Linux host.")
+    destination = args.dest.expanduser().resolve()
+    destination.mkdir(mode=0o700, parents=True, exist_ok=True)
+    with _lock(destination):
+        receipt = destination / ".teamsync-fetch.json"
+        if receipt.is_file():
+            grant = json.loads(receipt.read_text())
+        else:
+            key = _license_key(args)
+            grant = _redeem(key, args.version, arch)
+            key = None
+            # Preserve URLs immediately, including if later verification fails;
+            # the license itself is not redeemed a second time on retry.
+            _save(receipt, grant)
+        version = _validate_grant(grant, arch, args.version)
+        directory = destination / "downloads"
+        directory.mkdir(mode=0o700, exist_ok=True)
+        for item in grant["files"]:
+            _download(item, directory)
+        _verify(directory, grant["files"])
+        target = destination / "kit"
+        if not target.exists():
+            target = _extract(directory, grant["files"], destination, version, arch, grant["license"])
+        config = Path.home() / ".config" / "teamsync-cluster"
+        config.mkdir(mode=0o700, parents=True, exist_ok=True)
+        _save(config / "kit-path.json", {"path": str(target)})
+        print("License signature: OK")
+        print("Ready: " + str(target))
+        print("On the target Linux machine: cd " + str(target) + "; sudo ./teamsync-cluster config")
+    return 0
+
+
+def _secure_path(path):
+    path = Path(os.path.abspath(str(path.expanduser())))
+    for entry in (path, *path.parents):
+        info = entry.lstat()
+        if (stat.S_ISLNK(info.st_mode) or info.st_uid not in (0, os.getuid())
+                or info.st_mode & 0o022):
+            raise FetchError("Kit paths must be owned by you or root and must not be group/world writable or symlinks.")
+    return path
+
+
+def _installed_kit(explicit=None):
+    selected = explicit or os.environ.get("TEAMSYNC_KIT")
+    if selected is None:
+        saved = Path.home() / ".config" / "teamsync-cluster" / "kit-path.json"
+        if not saved.is_file():
+            raise FetchError("Fetch a licensed kit first, or explicitly set TEAMSYNC_KIT.")
+        _secure_path(saved)
+        selected = json.loads(saved.read_text())["path"]
+    root = _secure_path(Path(selected))
+    executable = _secure_path(root / "teamsync-cluster")
+    marker = _secure_path(root / "components/base.json")
+    license_path = _secure_path(root / "license.json")
+    if not all(path.is_file() for path in (executable, marker, license_path)) or executable == Path(sys.argv[0]).resolve():
+        raise FetchError("Invalid installed kit.")
+    base = json.loads(marker.read_text())
+    if (base.get("component") != "base" or base.get("arch") not in ("amd64", "arm64")
+            or not VERSION.fullmatch(base.get("version", ""))
+            or hashlib.sha256(executable.read_bytes()).hexdigest() != base.get("cli_sha256")):
+        raise FetchError("Kit identity mismatch. Restore the verified base component.")
+    # Delegation must preserve access to the kit's diagnostics/repair grace.
+    # The real installer owns command-specific expiry and entitlement checks.
+    verify_license(json.loads(license_path.read_text()), version=base["version"], arch=base["arch"], allow_expired=True)
+    return root, base
+
+
+def _renew(args):
+    root, base = _installed_kit(args.kit)
+    if args.version not in (None, base["version"]) or args.arch not in ("auto", base["arch"]):
+        raise FetchError("License-only renewal must match the installed kit version and architecture.")
+    with _lock(root):
+        grant = _redeem(_license_key(args), base["version"], base["arch"], license_only=True)
+        if grant.get("files") != [] or grant.get("version") != base["version"]:
+            raise FetchError("Unexpected license renewal response.")
+        verify_license(grant["license"], version=base["version"], arch=base["arch"])
+        _save(root / "license.json", grant["license"])
+    print("License renewed: " + base["version"])
+    return 0
+
+
+def _delegate(argv):
+    root, _ = _installed_kit()
+    executable = root / "teamsync-cluster"
+    os.execv(str(executable), [str(executable)] + argv)
+
+
+def main(argv=None):
+    argv = list(sys.argv[1:] if argv is None else argv)
+    try:
+        if argv and argv[0] not in ("fetch", "--help", "-h", "--version"):
+            if any(value in {"--license", "--license-file"} or value.startswith(("--license=", "--license-file="))
+                   or re.search(r"tsl_[A-Za-z0-9_-]{43}", value) for value in argv):
+                raise FetchError("License key inputs are accepted only by fetch.")
+            os.environ.pop("TEAMSYNC_LICENSE_KEY", None)
+            return _delegate(argv)
+        parser = SecretSafeParser(prog="teamsync-cluster", description="Download a licensed TeamSync kit; other commands run its installer.")
+        parser.add_argument("--version", action="version", version="teamsync-cluster bootstrap 0.1.0")
+        sub = parser.add_subparsers(dest="command")
+        command = sub.add_parser("fetch", help="Redeem once, resume downloads, verify, then unpack")
+        keys = command.add_mutually_exclusive_group()
+        keys.add_argument("--license", metavar="KEY", help="Prefer a hidden prompt, --license-file or TEAMSYNC_LICENSE_KEY")
+        keys.add_argument("--license-file", type=Path)
+        command.add_argument("--license-only", action="store_true", help="Renew the installed version using a new key; no kit downloads")
+        command.add_argument("--kit", type=Path, help="Installed kit directory for --license-only renewal")
+        command.add_argument("--version", type=lambda value: value if VERSION.fullmatch(value) else parser.error("Use vX.Y.Z"))
+        command.add_argument("--arch", choices=("auto", "amd64", "arm64"), default="auto")
+        command.add_argument("--dest", type=Path, default=Path("teamsync-download"))
+        args = parser.parse_args(argv)
+        if args.command != "fetch":
+            parser.print_help()
+            return 0
+        return fetch(args)
+    except FetchError as exc:
+        print(str(exc), file=sys.stderr)
+        return 2
+    except (OSError, ValueError, KeyError, TypeError, urllib.error.URLError, http.client.HTTPException, subprocess.SubprocessError):
+        print("Fetch failed; credentials and URLs withheld. Keep the destination and contact TeamSync support.", file=sys.stderr)
+        return 2
+    except KeyboardInterrupt:
+        print("Stopped. Rerun fetch with the same destination to resume.", file=sys.stderr)
+        return 130

teamsync_cluster-0.1.0/src/teamsync_bootstrap/license_verify.py

@@ -0,0 +1,59 @@
+"""Portable RSA/SHA-256 license verification (Python >=3.8, standard library).
+
+This exact file is shipped in the public bootstrap and the kit zipapp. The
+private half is LICENSE_SIGNING_PRIVATE_KEY in the cloud's Infisical project.
+It is deliberately unrelated to the offline GPG release-signing key.
+"""
+import base64
+from datetime import datetime, timezone
+import hashlib
+import hmac
+import json
+import re
+
+PUBLIC_EXPONENT = 65537
+LICENSE_ENVIRONMENT = "prod"
+PUBLIC_MODULUS = int(
+    "9D64349F17D04C5996D1577BC22014B09DBCE4AC5AE9DDA147E70788D3094F7EC3BBA616A5649DB126453F6B21D3F56DCE4DCC40C63C396A04643C98B61A4A73B820928A6496FF0FAF1E0058144D48AF4F18909B7EF1E7CC04EEE512D8EFBB6EC4EE8356301C9AFF69203D735238E95289715275D461356350D6946D36AE838C917ACF609D45B2185E0E4237EA5DA1B8C41C461EDD2F8674632ECA58837DE67CA2964AE94B58A27D3EA133109F76A4942B49DF683700AB56BDA8D754D8E9695C953CA077F8D8DB3D2FCBADB59436FD9DD362FC220248872BE4359C5D59D8D22C852A1D97FF58B8CD64FBA377D38FD2E10E57B6AB5C7E943E3F17A208254B2F2F5AC58DF5AA8461852CBCEB0970F638F64BDC640D1CBC17F31D4F01E2336678AEC855C4F2CDF4F62297E1D549AB48C989CEB1A43099671C6EF154586C63058274BF80BF56B3E12AB077C38D3B34BC32BD31299FA8C36C0087F48A0209F99ED10AE238D6E8503D9E475F9EB7F50372B4E42E47C8B61838282B781FA601463C2FA9", 16)
+ADDONS = frozenset(("jitsi", "edge-workers", "sandbox"))
+
+
+def canonical(payload):
+    return json.dumps(payload, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode("utf-8")
+
+
+def verify_license(document, version=None, arch=None, now=None, allow_expired=False):
+    """Strict PKCS#1 v1.5 verification; no network, key discovery or overrides."""
+    try:
+        if set(document) != {"payload", "signature"}:
+            raise ValueError()
+        payload = document["payload"]
+        if set(payload) != {"schema_version", "environment", "key_id", "customer", "addons", "arches", "version", "valid_until"}:
+            raise ValueError()
+        signature = base64.b64decode(document["signature"], validate=True)
+        size = (PUBLIC_MODULUS.bit_length() + 7) // 8
+        number = int.from_bytes(signature, "big")
+        if len(signature) != size or number >= PUBLIC_MODULUS:
+            raise ValueError()
+        digest_info = bytes.fromhex("3031300d060960864801650304020105000420") + hashlib.sha256(canonical(payload)).digest()
+        expected = b"\x00\x01" + b"\xff" * (size - len(digest_info) - 3) + b"\x00" + digest_info
+        actual = pow(number, PUBLIC_EXPONENT, PUBLIC_MODULUS).to_bytes(size, "big")
+        if not hmac.compare_digest(actual, expected):
+            raise ValueError()
+        until = datetime.fromisoformat(payload["valid_until"].replace("Z", "+00:00"))
+        if until.tzinfo is None or (not allow_expired and until <= (now or datetime.now(timezone.utc))):
+            raise ValueError()
+        if (payload["schema_version"] != 1 or payload["environment"] != LICENSE_ENVIRONMENT
+                or not isinstance(payload["customer"], str)
+                or not re.fullmatch(r"[a-f0-9-]{36}", payload["key_id"])
+                or not re.fullmatch(r"v[0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9][A-Za-z0-9.-]{0,40})?", payload["version"])
+                or not isinstance(payload["addons"], list) or len(set(payload["addons"])) != len(payload["addons"])
+                or not set(payload["addons"]) <= ADDONS
+                or not isinstance(payload["arches"], list) or not payload["arches"]
+                or not set(payload["arches"]) <= {"amd64", "arm64"}
+                or (version is not None and version != payload["version"])
+                or (arch is not None and arch not in payload["arches"])):
+            raise ValueError()
+        return payload
+    except (ValueError, TypeError, KeyError, OverflowError, AttributeError):
+        raise ValueError("License is invalid, expired or does not cover this kit.") from None

teamsync_cluster-0.1.0/src/teamsync_cluster.egg-info/PKG-INFO

@@ -0,0 +1,60 @@
+Metadata-Version: 2.4
+Name: teamsync-cluster
+Version: 0.1.0
+Summary: Verified licensed TeamSync kit bootstrap
+Author: TeamSync
+License: Proprietary
+Project-URL: Releases, https://release.teamsync.com.tw
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+
+# TeamSync cluster bootstrap
+
+Python >=3.8, no Python runtime dependencies. Install GnuPG (`gpg`) on the
+connected download machine. Target kits support Linux amd64 and arm64.
+
+```sh
+pip install teamsync-cluster
+teamsync-cluster fetch --dest ./teamsync-download
+# Hidden license prompt. Or --license-file /secure/license-key (0600), or
+# TEAMSYNC_LICENSE_KEY from a secrets manager. --license KEY is also supported.
+cd teamsync-download/kit
+sudo ./teamsync-cluster config
+sudo ./teamsync-cluster deploy --apply-firewall
+sudo ./teamsync-cluster status
+```
+
+`fetch` redeems once, downloads base plus only the licensed add-ons, verifies
+the pinned GPG release signature and every selected SHA-256, verifies the
+separately signed offline license, then extracts. The destination contains a
+private download receipt with expiring URLs; rerun the same fetch destination
+to resume without redeeming again. Keep it private. An interrupted response
+before that receipt is saved requires TeamSync support to issue a new key.
+
+Copy the complete destination to an offline site. Run the kit's executable
+there; Python >=3.10 is required by the full installer. Other bootstrap
+subcommands delegate only to `TEAMSYNC_KIT` or the last successful download
+path. The bootstrap checks user/root ownership, write permissions, the signed
+license version/architecture and the executable hash in `components/base.json`.
+Use an administrator-owned directory outside shared writable paths such as `/tmp`.
+
+For a different target architecture: `fetch --arch amd64` or `--arch arm64`.
+For a pinned grant: `fetch --version vX.Y.Z`. A `latest` grant resolves the
+latest released version when redeemed. Additional add-ons require a new key.
+Expired download links require a new key; they cannot be renewed by replay.
+The license key is never written to the destination or printed by this tool.
+
+An expired term leaves `status` and `doctor` available with a warning. `deploy`
+can repair the exact configuration authorized before expiry; new installs or
+add-on changes require renewal. To renew with a **new key** without changing the
+installed version or downloading archives (on a connected machine):
+
+```sh
+teamsync-cluster fetch --license-only --kit ./teamsync-download/kit --license-file /secure/new-key
+# For an offline site, copy only the renewed kit/license.json to the same kit.
+```
+
+Published builds contact production only and pin its signing authority. Staging
+uses a separate operator-only build; endpoint/key environment overrides are refused.

teamsync_cluster-0.1.0/src/teamsync_cluster.egg-info/SOURCES.txt

@@ -0,0 +1,11 @@
+README.md
+pyproject.toml
+src/teamsync_bootstrap/__init__.py
+src/teamsync_bootstrap/__main__.py
+src/teamsync_bootstrap/cli.py
+src/teamsync_bootstrap/license_verify.py
+src/teamsync_cluster.egg-info/PKG-INFO
+src/teamsync_cluster.egg-info/SOURCES.txt
+src/teamsync_cluster.egg-info/dependency_links.txt
+src/teamsync_cluster.egg-info/entry_points.txt
+src/teamsync_cluster.egg-info/top_level.txt

teamsync_cluster-0.1.0/src/teamsync_cluster.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

teamsync_cluster-0.1.0/src/teamsync_cluster.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+teamsync-cluster = teamsync_bootstrap.cli:main

teamsync_cluster-0.1.0/src/teamsync_cluster.egg-info/top_level.txt

@@ -0,0 +1 @@
+teamsync_bootstrap