|
| 1 | +#!/usr/bin/env bash |
| 2 | +# |
| 3 | +# SecAI OS — Forensic Bundle Export/Verify (M51) |
| 4 | +# |
| 5 | +# Exports a signed forensic bundle from the incident recorder, or |
| 6 | +# verifies the integrity of a previously exported bundle. |
| 7 | +# |
| 8 | +# Usage: |
| 9 | +# secai-forensic export [--output FILE] Export a signed forensic bundle |
| 10 | +# secai-forensic verify <FILE> Verify bundle hash integrity |
| 11 | +# secai-forensic --help Show help |
| 12 | +# |
| 13 | +set -euo pipefail |
| 14 | + |
| 15 | +INCIDENT_RECORDER_URL="${INCIDENT_RECORDER_URL:-http://127.0.0.1:8515}" |
| 16 | +SERVICE_TOKEN_PATH="${SERVICE_TOKEN_PATH:-/run/secure-ai/service-token}" |
| 17 | + |
| 18 | +# --------------------------------------------------------------------------- |
| 19 | +# Helpers |
| 20 | +# --------------------------------------------------------------------------- |
| 21 | +RED='\033[0;31m' |
| 22 | +GREEN='\033[0;32m' |
| 23 | +YELLOW='\033[0;33m' |
| 24 | +NC='\033[0m' |
| 25 | + |
| 26 | +info() { echo -e "${GREEN}[INFO]${NC} $*"; } |
| 27 | +warn() { echo -e "${YELLOW}[WARN]${NC} $*"; } |
| 28 | +err() { echo -e "${RED}[ERROR]${NC} $*" >&2; } |
| 29 | + |
| 30 | +usage() { |
| 31 | + cat <<'EOF' |
| 32 | +secai-forensic — Forensic bundle export and verification |
| 33 | +
|
| 34 | +Usage: |
| 35 | + secai-forensic export [--output FILE] Export a signed forensic bundle |
| 36 | + secai-forensic verify <FILE> Verify bundle hash integrity |
| 37 | + secai-forensic --help Show this help |
| 38 | +
|
| 39 | +The export subcommand downloads a signed forensic bundle from the local |
| 40 | +incident recorder service. The bundle contains all incidents, audit log |
| 41 | +entries, system state, and a policy digest, signed with HMAC-SHA256. |
| 42 | +
|
| 43 | +The verify subcommand recomputes the bundle hash and checks it against |
| 44 | +the stored hash to detect tampering. |
| 45 | +
|
| 46 | +Environment: |
| 47 | + INCIDENT_RECORDER_URL (default: http://127.0.0.1:8515) |
| 48 | + SERVICE_TOKEN_PATH (default: /run/secure-ai/service-token) |
| 49 | +EOF |
| 50 | + exit 0 |
| 51 | +} |
| 52 | + |
| 53 | +# --------------------------------------------------------------------------- |
| 54 | +# Export |
| 55 | +# --------------------------------------------------------------------------- |
| 56 | +cmd_export() { |
| 57 | + local output="${1:-}" |
| 58 | + if [[ -z "$output" ]]; then |
| 59 | + output="forensic-bundle-$(date -u +%Y%m%d-%H%M%S).json" |
| 60 | + fi |
| 61 | + |
| 62 | + # Read service token if available |
| 63 | + local auth_args=() |
| 64 | + if [[ -f "$SERVICE_TOKEN_PATH" ]]; then |
| 65 | + local token |
| 66 | + token=$(cat "$SERVICE_TOKEN_PATH") |
| 67 | + auth_args=(-H "Authorization: Bearer ${token}") |
| 68 | + else |
| 69 | + warn "Service token not found at ${SERVICE_TOKEN_PATH} — trying without auth" |
| 70 | + fi |
| 71 | + |
| 72 | + info "Exporting forensic bundle from ${INCIDENT_RECORDER_URL}..." |
| 73 | + |
| 74 | + local http_code |
| 75 | + http_code=$(curl -sf -w "%{http_code}" \ |
| 76 | + "${auth_args[@]+"${auth_args[@]}"}" \ |
| 77 | + "${INCIDENT_RECORDER_URL}/api/v1/forensic/export" \ |
| 78 | + -o "$output" 2>/dev/null) || true |
| 79 | + |
| 80 | + if [[ ! -f "$output" ]] || [[ ! -s "$output" ]]; then |
| 81 | + err "Export failed (HTTP ${http_code:-unknown}). Is the incident recorder running?" |
| 82 | + rm -f "$output" |
| 83 | + exit 1 |
| 84 | + fi |
| 85 | + |
| 86 | + # Show summary |
| 87 | + local size |
| 88 | + size=$(wc -c < "$output" | tr -d ' ') |
| 89 | + info "Exported: ${output} (${size} bytes)" |
| 90 | + |
| 91 | + # Extract and show bundle hash |
| 92 | + if command -v python3 &>/dev/null; then |
| 93 | + python3 -c " |
| 94 | +import json, sys |
| 95 | +try: |
| 96 | + b = json.load(open('${output}')) |
| 97 | + print('Bundle hash: ' + b.get('bundle_hash', 'N/A')) |
| 98 | + print('Exported at: ' + b.get('exported_at', 'N/A')) |
| 99 | + print('Incidents: ' + str(len(b.get('incidents', [])))) |
| 100 | + print('Audit lines: ' + str(len(b.get('audit_entries', [])))) |
| 101 | + print('Signed: ' + ('yes' if b.get('signature') else 'no')) |
| 102 | +except Exception as e: |
| 103 | + print('Could not parse bundle: ' + str(e), file=sys.stderr) |
| 104 | +" |
| 105 | + fi |
| 106 | +} |
| 107 | + |
| 108 | +# --------------------------------------------------------------------------- |
| 109 | +# Verify |
| 110 | +# --------------------------------------------------------------------------- |
| 111 | +cmd_verify() { |
| 112 | + local file="$1" |
| 113 | + if [[ ! -f "$file" ]]; then |
| 114 | + err "File not found: ${file}" |
| 115 | + exit 1 |
| 116 | + fi |
| 117 | + |
| 118 | + if ! command -v python3 &>/dev/null; then |
| 119 | + err "python3 is required for bundle verification" |
| 120 | + exit 1 |
| 121 | + fi |
| 122 | + |
| 123 | + python3 -c " |
| 124 | +import json, hashlib, sys |
| 125 | +
|
| 126 | +bundle = json.load(open('${file}')) |
| 127 | +
|
| 128 | +# Recompute hash over content fields (same structure as Go ExportForensicBundle) |
| 129 | +hash_input = json.dumps({ |
| 130 | + 'exported_at': bundle['exported_at'], |
| 131 | + 'incidents': bundle['incidents'], |
| 132 | + 'audit_entries': bundle['audit_entries'], |
| 133 | + 'system_state': bundle['system_state'], |
| 134 | + 'policy_digest': bundle['policy_digest'], |
| 135 | +}, separators=(',', ':'), sort_keys=False).encode() |
| 136 | +
|
| 137 | +computed = hashlib.sha256(hash_input).hexdigest() |
| 138 | +stored = bundle.get('bundle_hash', '') |
| 139 | +
|
| 140 | +if stored == computed: |
| 141 | + print('VERIFIED: Bundle hash matches.') |
| 142 | + print(' Hash: ' + stored) |
| 143 | + print(' Incidents: ' + str(len(bundle.get('incidents', [])))) |
| 144 | + print(' Exported at: ' + bundle.get('exported_at', 'N/A')) |
| 145 | + sys.exit(0) |
| 146 | +else: |
| 147 | + print('FAILED: Bundle hash mismatch — content may have been tampered.', file=sys.stderr) |
| 148 | + print(' Expected: ' + stored, file=sys.stderr) |
| 149 | + print(' Computed: ' + computed, file=sys.stderr) |
| 150 | + sys.exit(1) |
| 151 | +" |
| 152 | +} |
| 153 | + |
| 154 | +# --------------------------------------------------------------------------- |
| 155 | +# Main |
| 156 | +# --------------------------------------------------------------------------- |
| 157 | +case "${1:-}" in |
| 158 | + export) |
| 159 | + shift |
| 160 | + output="" |
| 161 | + while [[ $# -gt 0 ]]; do |
| 162 | + case "$1" in |
| 163 | + --output) |
| 164 | + [[ $# -lt 2 ]] && { err "--output requires a filename"; exit 1; } |
| 165 | + output="$2" |
| 166 | + shift 2 |
| 167 | + ;; |
| 168 | + *) |
| 169 | + err "Unknown option: $1" |
| 170 | + usage |
| 171 | + ;; |
| 172 | + esac |
| 173 | + done |
| 174 | + cmd_export "$output" |
| 175 | + ;; |
| 176 | + verify) |
| 177 | + shift |
| 178 | + [[ $# -lt 1 ]] && { err "verify requires a filename"; usage; } |
| 179 | + cmd_verify "$1" |
| 180 | + ;; |
| 181 | + --help|-h) |
| 182 | + usage |
| 183 | + ;; |
| 184 | + *) |
| 185 | + err "Unknown command: ${1:-}" |
| 186 | + echo "" |
| 187 | + usage |
| 188 | + ;; |
| 189 | +esac |
0 commit comments