Chris Farhood
5d3785a96c
Repo renamed from privilegedescalation/privilegedescalation to privilegedescalation/agents. All filesystem paths in agent configs, heartbeats, and tools updated to match the new on-disk location. Co-Authored-By: Paperclip <noreply@paperclip.ing> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
60 lines
2.0 KiB
Bash
Executable File
60 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
#
|
|
# Generates a GitHub App installation access token.
|
|
# Reads credentials from env vars set in each agent's adapter config:
|
|
# GITHUB_APP_ID_<NAME> — the GitHub App ID
|
|
# GITHUB_PEM_PATH_<NAME> — path to the private key PEM file
|
|
#
|
|
# Usage: export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)
|
|
|
|
# Auto-detect credentials from env (each agent has exactly one of each)
|
|
APP_ID=$(printenv | grep '^GITHUB_APP_ID_' | head -1 | cut -d= -f2)
|
|
PEM_PATH=$(printenv | grep '^GITHUB_PEM_PATH_' | head -1 | cut -d= -f2)
|
|
|
|
if [[ -z "${APP_ID:-}" || -z "${PEM_PATH:-}" ]]; then
|
|
echo "Error: GITHUB_APP_ID_* and GITHUB_PEM_PATH_* env vars must be set" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -f "$PEM_PATH" ]]; then
|
|
echo "Error: PEM file not found at $PEM_PATH" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# --- Build JWT (RS256) ---
|
|
b64url() { openssl base64 -e -A | tr '+/' '-_' | tr -d '='; }
|
|
|
|
NOW=$(date +%s)
|
|
HEADER=$(printf '{"alg":"RS256","typ":"JWT"}' | b64url)
|
|
PAYLOAD=$(printf '{"iat":%d,"exp":%d,"iss":"%s"}' "$((NOW - 60))" "$((NOW + 600))" "$APP_ID" | b64url)
|
|
SIGNATURE=$(printf '%s.%s' "$HEADER" "$PAYLOAD" \
|
|
| openssl dgst -sha256 -sign "$PEM_PATH" | b64url)
|
|
JWT="${HEADER}.${PAYLOAD}.${SIGNATURE}"
|
|
|
|
# --- Get installation ID (first installation for this app) ---
|
|
INSTALLATION_ID=$(curl -sf \
|
|
-H "Authorization: Bearer $JWT" \
|
|
-H "Accept: application/vnd.github+json" \
|
|
https://api.github.com/app/installations \
|
|
| python3 -c "import sys,json; print(json.load(sys.stdin)[0]['id'])")
|
|
|
|
if [[ -z "$INSTALLATION_ID" ]]; then
|
|
echo "Error: Could not get installation ID for app $APP_ID" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# --- Exchange for installation access token ---
|
|
TOKEN=$(curl -sf -X POST \
|
|
-H "Authorization: Bearer $JWT" \
|
|
-H "Accept: application/vnd.github+json" \
|
|
"https://api.github.com/app/installations/${INSTALLATION_ID}/access_tokens" \
|
|
| python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")
|
|
|
|
if [[ -z "$TOKEN" ]]; then
|
|
echo "Error: Could not get installation access token" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "$TOKEN"
|